mlsanityData to 14 Oct 2026

Functional Adversarial Attacks

arXiv 1906.00001 ↗First posted 29 May 2019cs.LG cs.CVcited by 82

Not on the map. Why?

Abstract (arXiv)

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models. Unlike a standard ℓp-ball threat model, a functional adversarial threat model allows only a single function to be used to perturb input features to produce an adversarial example. For example, a functional adversarial attack applied on colors of an image can change all red pixels simultaneously to light red. Such global uniform changes in images can be less perceptible than perturbing pixels of the image individually. For simplicity, we refer to functional adversarial attacks on image colors as ReColorAdv, which is the main focus of our experiments. We show that functional threat models can be combined with existing additive (ℓp) threat models to generate stronger threat models that allow both small, individual perturbations and large, uniform changes to an input. Moreover, we prove that such combinations encompass perturbations that would not be allowed in either constituent threat model. In practice, ReColorAdv can significantly reduce the accuracy of a ResNet-32 trained on CIFAR-10. Furthermore, to the best of our knowledge, combining ReColorAdv with other attacks leads to the strongest existing attack even after adversarial training. An implementation of ReColorAdv is available at https://github.com/cassidylaidlaw/ReColorAdv .

Key facts. Cited by 82 papers in the map (data through 14 Oct 2026). First posted on arXiv 29 May 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 18; 2022: 26; 2023: 21; 2024: 9; 2025: 5; 2026: 3.

82 papers.

Sort:

By area:

  1. 2023Certifying LLM Safety against Adversarial Promptingcited by 266
  2. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
  3. 2023Content-based Unrestricted Adversarial Attackcited by 73
  4. 2023StyleAdv: Meta Style Adversarial Training for Cross-Domain Few-Shot Learningcited by 53
  5. 2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
  6. 2024Cross-Modality Perturbation Synergy Attack for Person Re-identificationcited by 45
  7. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  8. 2022Probabilistically Robust Learning: Balancing Average- and Worst-case Performancecited by 37
  9. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  10. 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
  11. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  12. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
38 more
  1. 2023CUDA: Convolution-based Unlearnable Datasetscited by 26
  2. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 23
  3. 2021Robustness and Generalization via Generative Adversarial Trainingcited by 20
  4. 2022Explicit Tradeoffs between Adversarial and Natural Distributional Robustnesscited by 20
  5. 2022Scaling Adversarial Training to Large Perturbation Boundscited by 20
  6. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  7. 2022PRoA: A Probabilistic Robustness Assessment against Functional Perturbationscited by 19
  8. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  9. 2021Center Smoothing: Certified Robustness for Networks with Structured Outputscited by 18
  10. 2021Mutual Adversarial Training: Learning together is better than going alonecited by 17
  11. 2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
  12. 2022Poisons that are learned faster are more effectivecited by 14
  13. 2022Scattering Model Guided Adversarial Examples for SAR Target Recognition: Attack and Defensecited by 14
  14. 2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
  15. 2023Vulnerabilities in Video Quality Assessment Models: The Challenge of Adversarial Attackscited by 12
  16. 2024Cross-Modality Attack Boosted by Gradient-Evolutionary Multiform Optimizationcited by 12
  17. 2021Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddingscited by 11
  18. 2021Learning to Predict Trustworthiness with Steep Slope Losscited by 11
  19. 2021Sparse Adversarial Video Attacks with Spatial Transformationscited by 11
  20. 2021ℓ_∞-Robustness and Beyond: Unleashing Efficient Adversarial Trainingcited by 11
  21. 2021Going Grayscale: The Road to Understanding and Improving Unlearnable Examplescited by 10
  22. 2021Interpolated Joint Space Adversarial Training for Robust and Generalizable Defensescited by 10
  23. 2023Attacking Perceptual Similarity Metricscited by 10
  24. 2025Adversarially Robust CLIP Models Can Induce Better (Robust) Perceptual Metricscited by 10
  25. 2022Tools and Practices for Responsible AI Engineeringcited by 9
  26. 2022Adversarial Coreset Selection for Efficient Robust Trainingcited by 9
  27. 2022Formulating Robustness Against Unforeseen Attackscited by 8
  28. 2023Recognizing Rigid Patterns of Unlabeled Point Clouds by Complete and Continuous Isometry Invariants with no False Negatives and no False Positivescited by 8
  29. 2025Adversarial Alignment for LLMs Requires Simpler, Reproducible, and More Measurable Objectivescited by 8
  30. 2021Imperceptible Adversarial Examples by Spatial Chroma-Shiftcited by 7
  31. 2022Learnability Lock: Authorized Learnability Control Through Adversarial Invertible Transformationscited by 7
  32. 2022Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Featurescited by 7
  33. 2022NCVX: A General-Purpose Optimization Solver for Constrained Machine and Deep Learningcited by 7
  34. 2023MultiRobustBench: Benchmarking Robustness Against Multiple Attackscited by 7
  35. 2022Differential Evolution based Dual Adversarial Camouflage: Fooling Human Eyes and Object Detectorscited by 6
  36. 2023Optimization and Optimizers for Adversarial Robustnesscited by 6
  37. 2023Indirect Gradient Matching for Adversarial Robust Distillationcited by 6
  38. 2022Certifying Model Accuracy under Distribution Shiftscited by 5

50 most cited of 82 All 82 (JSON)