  Deep neural networks (DNNs) have significantly boosted the performance of
many challenging tasks. Despite the great development, DNNs have also exposed
their vulnerability. Recent studies have shown that adversaries can manipulate
the predictions of DNNs by adding a universal adversarial perturbation (UAP) to
benign samples. On the other hand, increasing efforts have been made to help
users understand and explain the inner working of DNNs by highlighting the most
informative parts (i.e., attribution maps) of samples with respect to their
predictions. Moreover, we first empirically find that such attribution maps
between benign and adversarial examples have a significant discrepancy, which
has the potential to detect universal adversarial perturbations for defending
against adversarial attacks. This finding motivates us to further investigate a
new research problem: whether there exist universal adversarial perturbations
that are able to jointly attack DNNs classifier and its interpretation with
malicious desires. It is challenging to give an explicit answer since these two
objectives are seemingly conflicting. In this paper, we propose a novel
attacking framework to generate joint universal adversarial perturbations
(JUAP), which can fool the DNNs model and misguide the inspection from
interpreters simultaneously. Comprehensive experiments on various datasets
demonstrate the effectiveness of the proposed method JUAP for joint attacks. To
the best of our knowledge, this is the first effort to study UAP for jointly
attacking both DNNs and interpretations.
