Functional Adversarial Attacks

Abstract

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models. Unlike a standard ${\ell }_p$-ball threat model, a functional adversarial threat model allows only a single function to be used to perturb input features to produce an adversarial example. For example, a functional adversarial attack applied on colors of an image can change all red pixels simultaneously to light red. Such global uniform changes in images can be less perceptible than perturbing pixels of the image individually. For simplicity, we refer to functional adversarial attacks on image colors as ReColorAdv, which is the main focus of our experiments. We show that functional threat models can be combined with existing additive (${\ell }_p$) threat models to generate stronger threat models that allow both small, individual perturbations and large, uniform changes to an input. Moreover, we prove that such combinations encompass perturbations that would not be allowed in either constituent threat model. In practice, ReColorAdv can significantly reduce the accuracy of a ResNet-32 trained on CIFAR-10. Furthermore, to the best of our knowledge, combining ReColorAdv with other attacks leads to the strongest existing attack even after adversarial training. An implementation of ReColorAdv is available at https://github.com/cassidylaidlaw/ReColorAdv .

arXiv commentAccepted to NeurIPS 2019

References in corpus (8)

• Adam: A Method for Stochastic Optimization
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Spatially Transformed Adversarial Examples
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Quantifying Perceptual Distortion of Adversarial Examples
• Transfer of Adversarial Robustness Between Perturbation Types

Cited by in corpus (32)

• RobustBench: a standardized adversarial robustness benchmark
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Security and Privacy Issues in Deep Learning
• Learning perturbation sets for robust machine learning
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• Randomized Smoothing of All Shapes and Sizes
• Mutual Adversarial Training: Learning together is better than going alone
• Towards Visual Distortion in Black-Box Attacks
• Towards Feature Space Adversarial Attack
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attacks
• Imperceptible Adversarial Examples by Spatial Chroma-Shift
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates
• Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter
• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• Training Robust Deep Models for Time-Series Domain: Novel Algorithms and Theoretical Analysis
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Adversarial Image Color Transformations in Explicit Color Filter Space
• ATOM: Robustifying Out-of-distribution Detection Using Outlier Mining
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Certifying Confidence via Randomized Smoothing
• Sparse Adversarial Video Attacks with Spatial Transformations
• Improved Image Wasserstein Attacks and Defenses
• Playing it Safe: Adversarial Robustness with an Abstain Option
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Going Grayscale: The Road to Understanding and Improving Unlearnable Examples
• Semantically Adversarial Learnable Filters
• Targeted Adversarial Perturbations for Monocular Depth Prediction
• Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training
• Color and Edge-Aware Adversarial Image Perturbations