Tight Robustness Certification Through the Convex Hull of ${\ell }_0$ Attacks

Yuval Shapira, Dana Drachsler-Cohen

Few-pixel attacks mislead a classifier by modifying a few pixels of an image. Their perturbation space is an ${\ell }_0$-ball, which is not convex, unlike ${\ell }_p$-balls for $p\ge 1$.…