Neural Information Processing Systems http://nips.cc/

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models.

The transition matrices for parts can be learned by exploiting anchor points (i.e., data points that belong to a specific class almost surely).

We thank all reviewers for providing us valuable and insightful comments. Below, we answer all of the questions. R1 Q1) The main assumption in this method for part-dependent label noise is not realistic. Thus, we believe the assumption makes sense in reality. Q2) When the deep model is trained using the noisy labels, the features maybe not the accurate or reliable features.