  Standard adversarial attacks change the predicted class label of a selected
image by adding specially tailored small perturbations to its pixels. In
contrast, a universal perturbation is an update that can be added to any image
in a broad class of images, while still changing the predicted class label. We
study the efficient generation of universal adversarial perturbations, and also
efficient methods for hardening networks to these attacks. We propose a simple
optimization-based universal attack that reduces the top-1 accuracy of various
network architectures on ImageNet to less than 20%, while learning the
universal perturbation 13X faster than the standard method.
  To defend against these perturbations, we propose universal adversarial
training, which models the problem of robust classifier generation as a
two-player min-max game, and produces robust models with only 2X the cost of
natural training. We also propose a simultaneous stochastic gradient method
that is almost free of extra computation, which allows us to do universal
adversarial training on ImageNet.
