Should Adversarial Attacks Use Pixel p-Norm?
Not on the map. Why?
Abstract (arXiv)
Adversarial attacks aim to confound machine learning systems, while remaining virtually imperceptible to humans. Attacks on image classification systems are typically gauged in terms of p-norm distortions in the pixel feature space. We perform a behavioral study, demonstrating that the pixel p-norm for any 0≤ p ≤ ∞, and several alternative measures including earth mover's distance, structural similarity index, and deep net embedding, do not fit human perception. Our result has the potential to improve the understanding of adversarial attack and defense strategies.
Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 Jun 2019.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 8; 2022: 0; 2023: 0; 2024: 1; 2025: 0; 2026: 1.
10 papers.
- 2021Unrestricted Adversarial Attacks on ImageNet Competitioncited by 23
- 2021Generative Counterfactuals for Neural Networks via Attribute-Informed Perturbationcited by 11
- 2024Imperceptible Protection against Style Imitation from Diffusion Modelscited by 8
- 2021Bridging the Gap Between Adversarial Robustness and Optimization Biascited by 5
- 2021Constrained Gradient Descent: A Powerful and Principled Evasion Attack Against Neural Networkscited by 4
- 2021Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Trainingcited by 3
- 2021Towards Imperceptible Query-limited Adversarial Attacks with Perceptual Feature Fidelity Losscited by 0
- 2021Generating Structured Adversarial Attacks Using Frank-Wolfe Methodcited by 0
- 2021Examining the Human Perceptibility of Black-Box Adversarial Attacks on Face Recognitioncited by 0
- 2026Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attackscited by 0
- 2026Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attacks6 Feb 2026
- 2024Imperceptible Protection against Style Imitation from Diffusion Models28 Mar 2024
- 2021Constrained Gradient Descent: A Powerful and Principled Evasion Attack Against Neural Networks28 Dec 2021
- 2021Unrestricted Adversarial Attacks on ImageNet Competition17 Oct 2021
- 2021Examining the Human Perceptibility of Black-Box Adversarial Attacks on Face Recognition19 Jul 2021
- 2021Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training29 Mar 2021
- 2021Bridging the Gap Between Adversarial Robustness and Optimization Bias17 Feb 2021
- 2021Generating Structured Adversarial Attacks Using Frank-Wolfe Method15 Feb 2021
- 2021Towards Imperceptible Query-limited Adversarial Attacks with Perceptual Feature Fidelity Loss31 Jan 2021
- 2021Generative Counterfactuals for Neural Networks via Attribute-Informed Perturbation18 Jan 2021