# Should Adversarial Attacks Use Pixel p-Norm?

arXiv: https://arxiv.org/abs/1906.02439 · HTML: https://mlsanity.com/paper/1906.02439/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Jun 2019.

## Built on by (most cited first, 10 of 10)

- [Unrestricted Adversarial Attacks on ImageNet Competition](https://mlsanity.com/paper/2110.09903/) (2021)
- [Generative Counterfactuals for Neural Networks via Attribute-Informed Perturbation](https://mlsanity.com/paper/2101.06930/) (2021)
- [Imperceptible Protection against Style Imitation from Diffusion Models](https://mlsanity.com/paper/2403.19254/) (2024)
- [Bridging the Gap Between Adversarial Robustness and Optimization Bias](https://mlsanity.com/paper/2102.08868/) (2021)
- [Constrained Gradient Descent: A Powerful and Principled Evasion Attack Against Neural Networks](https://mlsanity.com/paper/2112.14232/) (2021)
- [Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training](https://mlsanity.com/paper/2103.15385/) (2021)
- [Towards Imperceptible Query-limited Adversarial Attacks with Perceptual Feature Fidelity Loss](https://mlsanity.com/paper/2102.00449/) (2021)
- [Generating Structured Adversarial Attacks Using Frank-Wolfe Method](https://mlsanity.com/paper/2102.07360/) (2021)
- [Examining the Human Perceptibility of Black-Box Adversarial Attacks on Face Recognition](https://mlsanity.com/paper/2107.09126/) (2021)
- [Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attacks](https://mlsanity.com/paper/2602.06578/) (2026)

## Abstract (arXiv)

Adversarial attacks aim to confound machine learning systems, while remaining virtually imperceptible to humans. Attacks on image classification systems are typically gauged in terms of p-norm distortions in the pixel feature space. We perform a behavioral study, demonstrating that the pixel p-norm for any 0≤ p ≤ ∞, and several alternative measures including earth mover's distance, structural similarity index, and deep net embedding, do not fit human perception. Our result has the potential to improve the understanding of adversarial attack and defense strategies.