Should Adversarial Attacks Use Pixel p-Norm?

Abstract

Adversarial attacks aim to confound machine learning systems, while remaining virtually imperceptible to humans. Attacks on image classification systems are typically gauged in terms of $p$-norm distortions in the pixel feature space. We perform a behavioral study, demonstrating that the pixel $p$-norm for any $0\le p\le \infty$, and several alternative measures including earth mover's distance, structural similarity index, and deep net embedding, do not fit human perception. Our result has the potential to improve the understanding of adversarial attack and defense strategies.

References in corpus (1)

• Explaining and Harnessing Adversarial Examples

Cited by in corpus (9)

• Unrestricted Adversarial Attacks on ImageNet Competition
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Generative Counterfactuals for Neural Networks via Attribute-Informed Perturbation
• Towards Imperceptible Query-limited Adversarial Attacks with Perceptual Feature Fidelity Loss
• Generating Structured Adversarial Attacks Using Frank-Wolfe Method
• Achieving Adversarial Robustness Requires An Active Teacher
• Trace-Norm Adversarial Examples
• Examining the Human Perceptibility of Black-Box Adversarial Attacks on Face Recognition
• Training Efficiency and Robustness in Deep Learning