Functional Adversarial Attacks

TL;DR

This paper introduces functional adversarial attacks, allowing global, uniform perturbations to input features, which can be combined with traditional methods to create stronger attacks that are less perceptible and more effective.

Contribution

The paper proposes a new class of threat models called functional adversarial attacks, exemplified by ReColorAdv, and demonstrates their effectiveness and combination with existing threat models.

Findings

ReColorAdv significantly reduces ResNet-32 accuracy on CIFAR-10.

Combining functional and additive threat models creates stronger, more versatile attacks.

The combined attacks outperform existing methods even after adversarial training.

Abstract

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models. Unlike a standard $\ell_p$-ball threat model, a functional adversarial threat model allows only a single function to be used to perturb input features to produce an adversarial example. For example, a functional adversarial attack applied on colors of an image can change all red pixels simultaneously to light red. Such global uniform changes in images can be less perceptible than perturbing pixels of the image individually. For simplicity, we refer to functional adversarial attacks on image colors as ReColorAdv, which is the main focus of our experiments. We show that functional threat models can be combined with existing additive ($\ell_p$) threat models to generate stronger threat models that allow both small, individual perturbations and large, uniform changes to an input. Moreover, we prove that such combinations encompass perturbations that would not be allowed in either constituent threat model. In practice, ReColorAdv can significantly reduce the accuracy of a ResNet-32 trained on CIFAR-10. Furthermore, to the best of our knowledge, combining ReColorAdv with other attacks leads to the strongest existing attack even after adversarial training. An implementation of ReColorAdv is available at https://github.com/cassidylaidlaw/ReColorAdv .