# Quantifying Perceptual Distortion of Adversarial Examples

arXiv: https://arxiv.org/abs/1902.08265 · HTML: https://mlsanity.com/paper/1902.08265/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Feb 2019.

## Built on by (most cited first, 10 of 10)

- [Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations](https://mlsanity.com/paper/2202.04235/) (2022)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Sparse Adversarial Video Attacks with Spatial Transformations](https://mlsanity.com/paper/2111.05468/) (2021)
- [Imperceptible Adversarial Examples by Spatial Chroma-Shift](https://mlsanity.com/paper/2108.02502/) (2021)
- [Class-Conditioned Transformation for Enhanced Robust Image Classification](https://mlsanity.com/paper/2303.15409/) (2023)
- [Adversarial Image Generation by Spatial Transformation in Perceptual Colorspaces](https://mlsanity.com/paper/2310.13950/) (2023)
- [FROB: Few-shot ROBust Model for Classification and Out-of-Distribution Detection](https://mlsanity.com/paper/2111.15487/) (2021)
- [Counterfactual Explanations on Robust Perceptual Geodesics](https://mlsanity.com/paper/2601.18678/) (2026)
- [Localized Uncertainty Attacks](https://mlsanity.com/paper/2106.09222/) (2021)
- [Robustifying ℓ_∞ Adversarial Training to the Union of Perturbation Models](https://mlsanity.com/paper/2105.14710/) (2021)

## Abstract (arXiv)

Recent work has shown that additive threat models, which only permit the addition of bounded noise to the pixels of an image, are insufficient for fully capturing the space of imperceivable adversarial examples. For example, small rotations and spatial transformations can fool classifiers, remain imperceivable to humans, but have large additive distance from the original images. In this work, we leverage quantitative perceptual metrics like LPIPS and SSIM to define a novel threat model for adversarial attacks. To demonstrate the value of quantifying the perceptual distortion of adversarial examples, we present and employ a unifying framework fusing different attack styles. We first prove that our framework results in images that are unattainable by attack styles in isolation. We then perform adversarial training using attacks generated by our framework to demonstrate that networks are only robust to classes of adversarial perturbations they have been trained against, and combination attacks are stronger than any of their individual components. Finally, we experimentally demonstrate that our combined attacks retain the same perceptual distortion but induce far higher misclassification rates when compared against individual attacks.