Functional Adversarial Attacks

Abstract

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models. Unlike a standard p -ball threat model, a functional adversarial threat model allows only a single function to be used to perturb input features to produce an adversarial example. For example, a functional adversarial attack applied on colors of an image can change all red pixels simultaneously to light red. Such global uniform changes in images can be less perceptible than perturbing pixels of the image individually. For simplicity, we refer to functional adversarial attacks on image colors as ReColorAdv, which is the main focus of our experiments. We show that functional threat models can be combined with existing additive ( p ) threat models to generate stronger threat models that allow both small, individual perturbations and large, uniform changes to an input. Moreover, we prove that such combinations encompass perturbations that would not be allowed in either constituent threat model. In practice, ReCol-orAdv can significantly reduce the accuracy of a ResNet-32 trained on CIFAR-10. Furthermore, to the best of our knowledge, combining ReColorAdv with other attacks leads to the strongest existing attack even after adversarial training.Preprint. Under review.

Robustness and Generalization via Generative Adversarial Training

“…One way to achieve this is by applying subtle geometric transformations such as spatial transformations [37,1], translations and rotations [14] or pose changes [2] to the inputs. Other works consider recoloring [19,25,4], intermediate features [13,26,41] and inserting new objects or patches in the image [6]. A challenge for creating unrestricted adversarial examples and defending against them is introduced in [5] using the simple task of classifying between birds and bicycles.…”

“…We also evaluate the adversarially trained model against various unforeseen attacks to demonstrate generalizable robustness of the model. We consider several attacks including recoloring [19,25], spatial transformations [37], perceptual [26] and additive perturbations [28]. Results are shown in Table 2, and are compared against other defense methods such as Adversarial Training with PGD (AT PGD) [28], AT Spatial [37], AT Recolor [25], PAT [26] and AT Ad-vProp [38].…”

“…We consider several attacks including recoloring [19,25], spatial transformations [37], perceptual [26] and additive perturbations [28]. Results are shown in Table 2, and are compared against other defense methods such as Adversarial Training with PGD (AT PGD) [28], AT Spatial [37], AT Recolor [25], PAT [26] and AT Ad-vProp [38]. We observe that our adversarially trained model achieves superior robustness to these attacks.…”

“…In order for a model to become robust to all realistic variations of inputs, it needs to see a diverse set of samples during training. However, most of the existing works only alter a low-level aspect of images such as color [19,25,4], spatial [14,37,1], pose [2,43], and others. Even if we consider the union of several types of attacks, the model can still be vulnerable to other input variations that are not contained in any of the constituent threat models.…”

Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates

“…Many of the recent studies have explored the semantic attacks. Semantic attacks are powerful for attacking defenses (Engstrom et al, 2017;Hosseini & Poovendran, 2018;Laidlaw & Feizi, 2019). Many of semantic attacks are applicable to Imagenet, however, none of them consider increasing the radii of the certificates generated by the certifiable defenses.…”