On the Suitability of $L_p$-norms for Creating and Preventing Adversarial Examples

1. Introduction

• Lp-norm nearness is insufficient for perceptual similarity, while prior work shows it is also unnecessary, across the paper’s studied settings.The studies use CIFAR10 and MNIST, common norms, and thresholds; the broader conclusion combines these findings with prior work.Source: §1 · p. 2
• About 4% of digit pixels perturbed at small L0 distance left humans correctly classifying the resulting images only 3% of the time.The perturbation amount is comparable to prior work [23].Source: §1 · p. 2
• Small Lp distance does not ensure that people perceive an attack image as similar to its benign original or classify both consistently.The authors warn that defense training to classify what ought to be an adversarial example may be extremely difficult and could produce ill-trained models.Source: §1 · p. 2
• The authors propose discussing alternatives to Lp-norms to stimulate research on similarity metrics for adversarial examples and their benign counterparts.They hope this research will improve attacks and, in return, defenses.Source: §1 · p. 2

2. Background and Related Work

• An adversarial example is a similar input that a model classifies differently from a correctly classified benign input.The formal conditions require the benign input to be correctly classified, the altered input to be misclassified, and their distance to remain below a threshold.Source: §2 · p. 2
• Similarity can mean shared features or human indistinguishability; prior work implicitly treats it as perceptual or visual similarity.The text links this assumption to the expectation that similar inputs have nearby convolutional-network features [7].Source: §2 · p. 2
• Lp distances are commonly used in attacks and defenses: L0 targets changed-pixel count, L2 Euclidean distance, and L∞ maximum coordinate change.Adversarial training generates bounded-Lp examples, usually with p = ∞, and trains DNNs to classify them correctly.Source: §2 · pp. 2–3
• Prior research rarely accounts explicitly for human perception; this paper takes an experimental approach to testing whether Lp distances define adversarial examples appropriately.Concurrent work by Elsayed et al. [3] considered higher-dimensional images but allowed perturbations above norms commonly used in practice.Source: §2 · p. 3
• The paper focuses on perceptual similarity, although some attacks do not aim to make outputs perceptually similar to a reference image.Examples include images that seem incomprehensible or benign to humans but are classified as street signs [16, 21, 28].Source: §2 · p. 3
• Geometric transformations can fool DNNs despite producing perceptually similar images with large Lp distances, as illustrated by Engstrom et al. [4].Other approaches include geometric transformations and maximizing SSIM; the paper also previews a preliminary SSIM analysis.Source: Figure 1 · p. 3, §2 · p. 3

3. Necessity and Sufficiency of Conditions for Perceptual Similarity

• The section frames the goal as choosing D and epsilon to capture perceptually similar samples with conditions that are both necessary and sufficient.It treats this as important to finding adversarial examples and defending against them.Source: §3 · p. 3

3.1. Necessity

• If D(x, xhat) ≤ epsilon is unnecessary, attacks may miss similar examples outside the bound, while defenses may fail to address them.This is especially relevant to adversarial training, which targets inputs satisfying the condition.Source: §3.1 · p. 3
• Geometric transformations can preserve perceptual similarity while producing large Lp distances, showing that small Lp distance is not necessary.For 32 × 32 images, examples have L0 ≥ 3,010, L2 ≥ 15.83, and L∞ ≥ 0.87, despite remaining similar to their benign samples.Source: §3.1 · pp. 3–4

3.2. Sufficiency

• If the bound is insufficient, attacks may produce examples that meet it but are not perceptually similar, and defenses may train models against inputs that mislead humans.The paper notes that adversarial training could thereby lead models to classify inputs differently from humans.Source: §3.2 · p. 4
• The insufficiency claim concerns what common Lp norms and thresholds permit in principle, not whether prior algorithms' reported examples are imperceptible.Other constraints on particular algorithms may still lead them to produce imperceptible examples.Source: §3.2 · p. 4

4.1. Experiment Design

• The studies inferred perceptual similarity by comparing categorization responses from separate participant groups, treating disagreement as evidence of dissimilarity.Participants labeled images in benign, adversarial-and-imperceptible, or adversarial-and-perceptible conditions; the study also collected confidence ratings.Source: §4.1 · pp. 4–5

4.2. Participants

• The researchers recruited 399 U.S. participants through Prolific, whose ages ranged from 18 to 78.Participants took about six minutes on average and received $1.Source: §4.2 · p. 5

4.3. Insufficiency of L0

• For L0, users’ average accuracy was 95% on CB, 97% on CAI, and 3% on CAP; no CAP image was classified correctly by majority vote.The difference between CAP and the other conditions was significant (p < 0.01), while CB and CAI did not differ significantly (p = 0.34).Source: §4.3 · p. 6

4.4. Insufficiency of L2

• For L2, users’ average accuracy was 93% on CB, 89% on CAI, and 57% on CAP, with the CAP drop significant (p < 0.01).The study used CIFAR10 examples with fixed L2 distance 6; CAI accuracy was not significantly lower than CB (p ≈1).Source: §4.4 · p. 6

4.5. Insufficiency of L∞

• For L∞, users’ average accuracy was 91% on CB, 79% on CAI, and 36% on CAP; both attack conditions differed significantly from CB (p < 0.01).CAI examples used L∞ distance 0.1; the study reports CAP as significantly less similar to benign images.Source: §4.5 · pp. 6–7

5. Discussion

• User studies confirm that L0, L2, and L∞ can be insufficient for ensuring perceptual similarity in some cases.The discussion also considers limitations and alternatives to Lp-norms.Source: §5 · p. 7

5.1. Limitations

• Results cover two DNNs and two datasets, and may not apply to every DNN or image-recognition task.The authors also caution that lower thresholds might prevent human deception but could keep attacks in the studied conditions from finding successful examples.Source: §5.1 · p. 7
• Similarity was proxied by category consistency, but inconspicuousness threat models may instead require testing whether people can reliably distinguish adversarial from benign images.The authors note that similarity has different facets depending on the threat model.Source: §5.1 · p. 7

5.2. Alternatives to Lp-norms

• Using one threshold for all samples may produce images that mislead humans; sample-specific thresholds would require principled automation or human feedback for every sample.Source: §5.2 · p. 7
• SSIM can be low under small geometric transformations yet high for dissimilar images, making it potentially unnecessary and insufficient as a similarity condition.Figure 4 reports SSIM values of 0.89 and 0.95 for different-subject pairs, versus 0.77 and 0.87 for noisy versions of the originals.Source: §5.2 · p. 7, Figure 4 · p. 8
• Jang et al.’s Fourier-, edge-, and gradient-based metrics need further validation; slight geometric transformations may dramatically affect gradients.Source: §5.2 · pp. 7–8
• Simply conjoining or disjoining metrics may preserve the problems of unnecessary or insufficient similarity conditions.Source: §5.2 · p. 8
• Better perceptual-similarity measures remain an open problem, and the authors recommend human-subject studies alongside known metrics.Source: §5.2 · p. 8

• Lp-distance conditions can be unnecessary for similarity and can also classify an adversarial image as similar when it is not.Source: §6 · p. 8
• The paper discusses possible alternatives to Lp-norms, but notes that they too appear to have limitations.Source: §6 · p. 8
• The conclusion calls for further research on assessing similarity when developing adversarial-example attacks and defenses.Source: §6 · p. 8