mlsanityData to 7 Oct 2026

Perceptually Constrained Adversarial Attacks

arXiv 2102.07140 ↗First posted 14 Feb 2021cs.LG cs.CR stat.MLcited by 7

Not on the map. Why?

Abstract (arXiv)

Motivated by previous observations that the usually applied Lp norms (p=1,2,∞) do not capture the perceptual quality of adversarial examples in image classification, we propose to replace these norms with the structural similarity index (SSIM) measure, which was developed originally to measure the perceptual similarity of images. Through extensive experiments with adversarially trained classifiers for MNIST and CIFAR-10, we demonstrate that our SSIM-constrained adversarial attacks can break state-of-the-art adversarially trained classifiers and achieve similar or larger success rate than the elastic net attack, while consistently providing adversarial images of better perceptual quality. Utilizing SSIM to automatically identify and disallow adversarial images of low quality, we evaluate the performance of several defense schemes in a perceptually much more meaningful way than was done previously in the literature.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Builds on 27 of its 33 references that are in the map. First posted on arXiv 14 Feb 2021.

Builds on

27 of 33 references.

References · 27

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016Wide Residual Networkscited by 3,057
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  9. 2016Adversarial Machine Learning at Scalecited by 934
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  12. 2019Adversarial Training for Free!cited by 638
15 more
  1. 2017Countering Adversarial Images using Input Transformationscited by 517
  2. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  3. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  4. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  5. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  6. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  7. 2016Technical Report on the CleverHans v2.1.0 Adversarial Examples Librarycited by 123
  8. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  9. 2019Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Trainingcited by 95
  10. 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 72
  11. 2015Learning with a Strong Adversarycited by 68
  12. 2018On the Suitability of Lp-norms for Creating and Preventing Adversarial Examplescited by 57
  13. 2018Two-Player Games for Efficient Non-Convex Constrained Optimizationcited by 55
  14. 2018Deep Defense: Training DNNs with Improved Adversarial Robustnesscited by 41
  15. 2019Perceptual Quality-preserving Black-Box Attack against Deep Learning Image Classifierscited by 8

Built on by

Cited by year

Citing papers per year: 2021: 1; 2022: 1; 2023: 2; 2024: 1; 2025: 2.

7 papers.

  1. 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 76
  2. 2021Defending Against Image Corruptions Through Adversarial Augmentationscited by 28
  3. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  4. 2023Face Encryption via Frequency-Restricted Identity-Agnostic Attackscited by 6
  5. 2023CamPro: Camera-based Anti-Facial Recognitioncited by 2
  6. 2025Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Samplingcited by 1
  7. 2025A Knowledge-guided Adversarial Defense for Resisting Malicious Visual Manipulationcited by 0