Should Adversarial Attacks Use Pixel p-Norm?

Abstract

Adversarial attacks aim to confound machine learning systems, while remaining virtually imperceptible to humans. Attacks on image classification systems are typically gauged in terms of $p$-norm distortions in the pixel feature space. We perform a behavioral study, demonstrating that the pixel $p$-norm for any $0\le p\le \infty$, and several alternative measures including earth mover's distance, structural similarity index, and deep net embedding, do not fit human perception. Our result has the potential to improve the understanding of adversarial attack and defense strategies.

References in corpus (4)

• Explaining and Harnessing Adversarial Examples
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Perception-in-the-Loop Adversarial Examples

Cited by in corpus (11)

• Unrestricted Adversarial Attacks on ImageNet Competition
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Generative Counterfactuals for Neural Networks via Attribute-Informed Perturbation
• Bridging the Gap Between Adversarial Robustness and Optimization Bias
• Semantically Adversarial Learnable Filters
• Towards Imperceptible Query-limited Adversarial Attacks with Perceptual Feature Fidelity Loss
• Generating Structured Adversarial Attacks Using Frank-Wolfe Method
• Achieving Adversarial Robustness Requires An Active Teacher
• Examining the Human Perceptibility of Black-Box Adversarial Attacks on Face Recognition
• Training Efficiency and Robustness in Deep Learning
• Trace-Norm Adversarial Examples