[Paper Review] Functional Adversarial Attacks

Cassidy Laidlaw, Soheil Feizi|arXiv (Cornell University)|May 29, 2019

Adversarial Robustness in Machine Learning31 references58 citations

TL;DR

The paper introduces functional adversarial threat models, notably ReColorAdv for images, showing how combining functional with additive threats yields stronger attacks than either alone.

ABSTRACT

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models. Unlike a standard $\ell_p$-ball threat model, a functional adversarial threat model allows only a single function to be used to perturb input features to produce an adversarial example. For example, a functional adversarial attack applied on colors of an image can change all red pixels simultaneously to light red. Such global uniform changes in images can be less perceptible than perturbing pixels of the image individually. For simplicity, we refer to functional adversarial attacks on image colors as ReColorAdv, which is the main focus of our experiments. We show that functional threat models can be combined with existing additive ($\ell_p$) threat models to generate stronger threat models that allow both small, individual perturbations and large, uniform changes to an input. Moreover, we prove that such combinations encompass perturbations that would not be allowed in either constituent threat model. In practice, ReColorAdv can significantly reduce the accuracy of a ResNet-32 trained on CIFAR-10. Furthermore, to the best of our knowledge, combining ReColorAdv with other attacks leads to the strongest existing attack even after adversarial training. An implementation of ReColorAdv is available at https://github.com/cassidylaidlaw/ReColorAdv .

Motivation & Objective

• Propose a new class of threat models called functional adversarial threat models.
• Demonstrate how functional threats can be combined with additive threats to expand perturbation space.
• Develop ReColorAdv as a practical instantiation attacking image classifiers by globally perturbing colors.
• Analyze perceptual impact and compare against existing attacks under various defenses.
• Provide recommendations for defense against functional adversarial attacks.

Proposed method

• Define functional threat models and regularization schemes to keep perturbations imperceptible.
• Prove that combining additive and functional threat models yields perturbations not possible under either model alone.
• Introduce ReColorAdv that applies a parameterized perturbation function f to all pixel colors via a discrete grid and trilinear interpolation.
• Enforce color-space specific constraints (diff and smooth) with a Lagrangian relaxation and PGD optimization.
• Evaluate ReColorAdv on CIFAR-10 with ResNet-32 and ImageNet with Inception-v4, including adversarial training scenarios.
• Compare RGB vs. perceptually uniform CIELUV color spaces for attack strength and perceptual quality.

Experimental results

Research questions

• RQ1 Can functional threat models enable perturbations that are imperceptible yet not allowed by additive threats alone?
• RQ2 Does combining functional and additive threat models create a superset of perturbations, enhancing attack strength?
• RQ3 How effective is ReColorAdv against defended and undefended models, and does color space choice affect outcomes?
• RQ4 What is the impact of combining ReColorAdv with other attacks on adversarial robustness after adversarial training?

Key findings

• Functional threat models can enable large, uniform perturbations that remain imperceptible due to feature dependencies.
• Combining additive and functional threat models yields perturbations not contained in either model alone.
• ReColorAdv, using a perturbation function on image colors, can reduce CIFAR-10 ResNet-32 accuracy to 3.0% and, when combined with other attacks, to 3.6% after adversarial training.
• CIELUV color space yields stronger, less perceptible ReColorAdv perturbations than RGB, improving attack potency.
• Combining ReColorAdv with StAdv and delta attacks often produces the strongest attacks even under adversarial training (TRADES).
• Grayscale preprocessing does not defend effectively against ReColorAdv and can reduce natural and robust accuracy.