PaperlayerView exact revision on arXiv

Source-linked AI summary

Functional Adversarial Attacks

Cassidy Laidlaw, Soheil Feizi

arXiv:1906.00001v2cs.LGcs.CV

TL;DR

Existing additive threat models focus on small, independent perturbations, motivating a broader model for other potentially imperceptible changes. The paper introduces functional threat models and ReColorAdv, then shows that combining them with additive attacks produces especially strong attacks, including after adversarial training.

  • Problem

    Existing ℓp threat models capture small independent changes but miss other perturbations that may remain imperceptible to humans.

  • Method

    The paper applies one function uniformly to all input features, instantiates this approach as ReColorAdv for image colors, and combines it with additive threat models.

  • Results

    3.6% accuracy remained after adversarial training against a combined ReColorAdv + StAdv + delta attack, reported as the lowest accuracy the authors know of.

  • Takeaways & Limitations

    Functional attacks expand the perturbations available to adversaries, and their combinations can strengthen attacks without a significant increase in perceptual distortion.

Abstract

from arXiv · show

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models. Unlike a standard $\ell_p$-ball threat model, a functional adversarial threat model allows only a single function to be used to perturb input features to produce an adversarial example. For example, a functional adversarial attack applied on colors of an image can change all red pixels simultaneously to light red. Such global uniform changes in images can be less perceptible than perturbing pixels of the image individually. For simplicity, we refer to functional adversarial attacks on image colors as ReColorAdv, which is the main focus of our experiments. We show that functional threat models can be combined with existing additive ($\ell_p$) threat models to generate stronger threat models that allow both small, individual perturbations and large, uniform changes to an input. Moreover, we prove that such combinations encompass perturbations that would not be allowed in either constituent threat model. In practice, ReColorAdv can significantly reduce the accuracy of a ResNet-32 trained on CIFAR-10. Furthermore, to the best of our knowledge, combining ReColorAdv with other attacks leads to the strongest existing attack even after adversarial training. An implementation of ReColorAdv is available at https://github.com/cassidylaidlaw/ReColorAdv .

1 Introduction

The paper introduces functional adversarial threat models, which apply one function uniformly across input features, and combines them with additive attacks. It focuses on ReColorAdv, showing strong attacks against image classifiers, including after adversarial training.

  • Motivation: Existing ℓp threat models permit small, independent feature changes but omit other potentially imperceptible perturbations.The paper motivates functional threat models as a broader alternative to a simple small-distance constraint.
  • Functional threat models: Functional attacks apply a single function f(·) to every feature, such as darkening every red pixel or increasing every audio timestep's volume.The resulting perturbation is uniform across features rather than individually selected.
  • Functional threat models: Uniform changes can remain less perceptible than independent pixel changes, allowing larger absolute modifications while preserving dependencies such as image shape boundaries and shading.The paper discusses regularizing f(·) to maintain imperceptibility.
  • Combined threat models: Combining additive and functional threat models allows both small individual changes and large uniform changes, encompassing more perturbations than either model alone.The introduction states this result through an informal theorem for grayscale images and illustrates the combination in Figure 1.
  • ReColorAdv: ReColorAdv maps each input pixel color c to f(c), with regularization limiting color changes and encouraging smooth mappings.It supports RGB and CIELUV color spaces; CIELUV produces less perceptually different adversarial examples.
  • Experimental results: 3.0% accuracy remained for a CIFAR-10 ResNet-32 attacked by ReColorAdv, while a combined attack reached 3.6% after adversarial training.The combined attack was reported as stronger than the previous strongest attack, and combinations improved attack strength without increasing LPIPS perceptual difference.

2 Review of Existing Threat Models

The review defines adversarial examples and threat models, then describes additive, spatial, renderer-based, GAN-based, and coloring-based alternatives. Most existing attacks use additive perturbations constrained by a norm.

  • Problem definition: An adversarial example changes a classifier's output while remaining perceptually close to the original input under a threat model.A threat model maps sets of classifier inputs to allowed perturbed inputs.
  • Additive threat model: The additive threat model changes each feature independently by adding a corresponding δ_i.For an input x = (x_1, . . . , x_n), the adversarial example is (x_1 + δ_1, . . . , x_n + δ_n).
  • Additive threat model: Additive attacks commonly constrain δ with ℓ_2, ℓ_0, or ℓ_∞ norms to enforce perceptual similarity.A small ε is usually necessary because independently modifying features can otherwise make the input incomprehensible.
  • Existing attacks: Most prior adversarial-attack research employs additive threat models, including both gradient-based and gradient-free methods.Examples include FGSM, DeepFool, Carlini & Wagner, SPSA, and the Boundary Attack.
  • Alternative threat models: Other threat models perturb feature locations, use 3D-renderer properties, construct examples with GANs, or modify image hue and saturation.The review also mentions image inversion among coloring-based approaches.

3 Functional Threat Model

Functional threat models apply one shared function to every input feature, preserving dependencies while permitting uniform changes that may remain imperceptible. Combining functional and additive threat models expands the allowed perturbations beyond either model alone.

  • Functional Threat Models: Unlike additive attacks, functional attacks preserve dependencies among features, enabling larger coordinated changes that may remain imperceptible.For images, shared transformations can preserve shape boundaries and shading.
  • Functional Threat Models: Functional threat models transform every feature with a single perturbation function f, so equal-valued input features receive equal outputs.The function family F can constrain the magnitude and smoothness of feature changes.
  • Regularization: Fdiff bounds each feature’s absolute change, while Fsmooth requires similar features to receive similar perturbations.The paper may use either constraint, their intersection, or another allowed function family F.
  • Formal Definition: The functional threat model is tfunc(S) = {(f(x1), . . . , f(xn)) | (x1, . . . , xn) ∈ S, f ∈ F}.This constructs adversarial inputs by applying one allowed function to all features.
  • Combining Threat Models: Combining additive and functional threat models permits adversarial examples outside the union of examples allowed by either constituent model.The paper presents this result formally for bounded pixel changes combined with uniform image darkening or lightening.

4 ReColorAdv: Functional Adversarial Attacks on Image Colors

ReColorAdv attacks image classifiers by applying one learned color transformation to every pixel, with bounds and smoothness constraints defined over a color space. The method uses a parameterized interpolated function and emphasizes perceptually accurate CIELUV representations.

  • Attack Definition: ReColorAdv applies a single function f to each pixel’s color, transforming an input image into an adversarial example through uniform color changes.Each pixel is treated as a point in a 3-dimensional color space such as RGB or CIELUV.
  • Function Parameterization: The perturbation function is parameterized on a discrete color grid, with trilinear interpolation defining f at points between grid locations.Grid values are represented by parameters θ1, . . . , θm.
  • Constraints: ReColorAdv constrains per-dimension color changes and enforces smooth perturbations between neighboring grid points.Its allowable functions are Fcol = Fdiff-col ∩ Fsmooth-col.
  • Optimization: The attack minimizes the adversarial loss subject to f ∈ Fcol, using a Lagrangian relaxation for smoothness and projected gradient descent optimization.The smoothness constraint is replaced by an additional regularization term during optimization.
  • Color Space: CIELUV separates luma from chroma and makes Euclidean color distance roughly correspond to perceptual difference, unlike RGB.The paper evaluates ReColorAdv in both RGB and CIELUV; CIELUV produces more realistic perturbations and a stronger attack.
  • Evaluation: Table 1 reports adversarially trained CIFAR-10 accuracy across attack combinations, with rows denoting training attacks and columns denoting evaluation attacks.The table distinguishes CIELUV and RGB ReColorAdv, delta and StAdv attacks, TRADES, and black-and-white preprocessing.

5 Experiments

Experiments evaluate ReColorAdv across defended and undefended CIFAR-10 and ImageNet classifiers, including combinations with additive and spatial attacks. Combined attacks generally provide stronger attacks without much additional perceptual distortion, while CIELUV improves ReColorAdv strength and perceptual quality.

  • Experimental scope: ReColorAdv and other attacks were evaluated against defended and undefended CIFAR-10 and ImageNet classifiers.The CIFAR-10 experiments used ResNet-32, while ImageNet experiments used Inception-v4; combinations included delta and StAdv attacks.
  • Combination attacks: 3.6% accuracy remained after adversarial training against the ReColorAdv + StAdv + delta attack, the lowest reported in the study.Combination attacks were generally strongest against defended and undefended classifiers.
  • Transferability: Robustness transfer was limited across perturbation types, especially from StAdv-trained models to ReColorAdv and delta attacks.ReColorAdv and delta showed more transferable robustness because both operate on a per-pixel basis, unlike StAdv’s spatial feature movement.
  • Color space: CIELUV made ReColorAdv stronger than RGB while producing less perceptible perturbations.The result supports using perceptually accurate color models when designing and defending against adversarial examples.
  • Perceptual distortion: Combinations of attacks tended to produce less perceptible changes than the attacks applied separately.Figure 5 shows adversarial examples against a CIFAR-10 WideResNet trained using TRADES.
  • Perceptual distortion: Combining ReColorAdv and delta attacks greatly increased attack strength without much additional perceptual distortion.Figure 6 compares LPIPS perceptual distortion with error-rate attack strength across varying bounds.

6 Conclusion

The paper introduces functional threat models that permit large, uniform input changes and combines them with additive threat models. ReColorAdv yields strong image-classification attacks, including combinations that remain powerful after adversarial training without significant perceptual distortion.

  • 6 Conclusion: Functional threat models allow large, uniform changes and can be combined with additive threat models to provably expand attack perturbations.The combined models permit perturbations beyond those allowed by either constituent model alone.
  • 6 Conclusion: ReColorAdv is a strong attack on image classifiers, and combinations with other attacks remain powerful after adversarial training.These combinations achieve greater attack power without a significant increase in perceptual distortion.
  • 6 Conclusion: Functional adversarial attacks could also be designed for audio, text, and other domains.The conclusion emphasizes the need for defenses addressing a more complete threat model of human-imperceptible adversarial examples.

A Combining the Additive and Functional Threat Models

The appendix formalizes additive and functional threat models and proves that their combination can generate perturbations excluded from either model separately. The construction combines a uniform image scaling with a bounded individual pixel change.

  • Threat model: The combined model first darkens or lightens the image and then applies small individual pixel changes.This composes a functional scaling with additive perturbations.
  • Theorem 1: tcombined(S) ⊋ tadd(S) ∪ tfunc(S), so the combined threat model contains a perturbation excluded from both constituent models.The theorem is established by constructing an explicit adversarial example.
  • Proof construction: The constructed example scales all pixels by 1 − ϵ2 and adds ϵ1 only to the first pixel.Choosing c = 1 − ϵ2, δ1 = ϵ1, and all remaining δi = 0 satisfies the combined constraints.
  • Proof construction: The example is excluded from the additive model because its second-pixel change equals ϵ2x2 > ϵ1.It is excluded from the functional model because the first pixel includes an additional ϵ1 term that uniform scaling cannot reproduce.

B Experimental Setup

The experiments implement ReColorAdv with gradient-based optimization and sequentially combine attack parameters. Adversarial training uses continued ResNet-32 training on mixed clean and adversarial CIFAR-10 batches, with CIELUV-specific preprocessing definitions and LPIPS evaluation settings.

  • Attack implementation: ReColorAdv adversarial examples are generated with PGD using Adam at learning rate 0.001.Training uses 100 Adam iterations, evaluation uses 300, and the lowest-loss iterate is selected.
  • Attack implementation: Combined attacks are applied sequentially while optimizing all attack parameters simultaneously.This procedure follows the approach used by Jordan et al.
  • Adversarial training: Adversarial training continues from a trained ResNet32 using batches split evenly between original and adversarial CIFAR-10 examples.Training uses batch size 500 for 50 epochs, followed by channel standardization before classification.
  • Color representation: The color-space parameterization ensures that CIELUV color vectors lie in [0, 1]^3.The cited setup defines the CIELUV representation used by ReColorAdv.
  • Evaluation: LPIPS v0.1 with AlexNet is used for the section 5.3 perceptual-distortion experiments.This specifies the evaluation configuration for the perceptual metric.

B.1 Regularization Parameters

ReColorAdv exposes regularization parameters that trade off attack strength against perceptual similarity and constrain color changes, function resolution, and smoothness.

  • Changing the objective constants alters both attack strength and the perceptual similarity of adversarial examples to the input.
  • ϵ1, ϵ2, and ϵ3 bound how much each color channel can change; in RGB, each is set to 0.1, or approximately 25/255.
  • Grid resolution regularizes the attack by limiting variation in how the perturbation function transforms colors along each dimension.RGB uses R1 = R2 = R3 = 25, while CIELUV uses R1 = 16 and R2 = R3 = 32.
  • λ controls the importance of the smoothness objective term Lsmooth and is fixed at 0.05.

C Other Color Spaces

The paper evaluates ReColorAdv across multiple color spaces and channel-wise variants, while noting optimization and perceptual-representation trade-offs. Fewer attack iterations weaken combined attacks and complicate efficient adversarial training.

  • C Other Color Spaces: ReColorAdv is evaluated in RGB, CIELUV, YPbPr, and an approximate HSV′ color space, with additional channel-wise variants.HSV′ approximates HSV using a hexagonal pyramid because the RGB-to-HSV derivative is highly discontinuous during PGD.
  • C Other Color Spaces: Separate-channel variants apply independent functions to R, G, and B rather than one function jointly to the color channels.
  • C Other Color Spaces: Channel-specific RGB bounds use ϵR = 0.1, ϵG = 0.05, and ϵB = 0.15 to reflect differing sensitivity to color variations.
  • C Other Color Spaces: The reported variation results measure accuracy of an undefended model under each attack.
  • C Other Color Spaces: Combined attacks are weaker with 100 rather than 300 PGD iterations, likely because their larger parameter sets require more optimization.This creates a challenge for efficient adversarial training because strong attacks need many inner-loop iterations.

E Non-Additive Threat Models

The paper situates functional threat models among spatial, color-based, renderer-based, and generative attacks, and uses smoothness constraints to avoid degenerate perturbation functions.

  • E Non-Additive Threat Models: Spatial attacks perturb feature locations, including StAdv’s smooth flow field that moves pixels by small bounded distances.
  • E Non-Additive Threat Models: Prior color attacks include colorization networks, affine color functions followed by PGD, hue and saturation changes, and image inversion.The latter three approaches are described as special examples of functional threat models.
  • E Non-Additive Threat Models: Other non-additive approaches perturb 3D-renderer properties or use generative models to craft adversarial examples without modifying another image.
  • E Non-Additive Threat Models: Figure 7 compares original images, ReColorAdv adversarial examples, and magnified differences for an Inception-v4 classifier on ImageNet.
  • E Non-Additive Threat Models: Figure 8 shows combinations of ReColorAdv, delta, and StAdv attacks, with the difference from the original displayed beside each example.The caption states that combined attacks tend to produce less perceptible changes than attacks used separately.
  • E Non-Additive Threat Models: The Lipschitz threat model enforces smooth mappings between similar features but also permits constant functions that remove salient input features.Because of this disadvantage, the paper ultimately uses Fsmooth instead.
Loading 1906.00001v2…