Should Adversarial Attacks Use Pixel p-Norm?

1 Introduction

• The study asks whether current measures of small change adequately characterize visual detection by a human inspector in image-classification attacks.The paper frames this as relevant to the efficacy of adversarial learning research.Source: §1 · p. 1
• A pixel p-norm ball can mismatch the set of changes humans perceive as small, making it difficult for attackers to predict success and defenders to know what to inspect.The authors describe false acceptances as futile attacks and false rejections as a source of false security.Source: §1 · pp. 1–2
• An earlier behavioral study tested only pixel 0-, 2-, and ∞-norms and used low-resolution thumbnails and a task requiring knowledge of the perturbation radius.The authors argue that thumbnail categorization does not capture noticing small changes in a normal-sized image before its category changes.Source: §1 · p. 2
• Pixel p-norms, earth mover’s distance, SSIM, and deep neural network representation do not define human-perceived small changes, although pixel 3-norm is the closest approximation tested.The authors caution that it remains an approximation rather than a good fit.Source: §1 · p. 2
• The authors identify as limitations that they cannot directly determine the correct measure, use a show-original-then-perturb paradigm, and study only visual inputs.They note that computational modeling of human visual perception remains an open question.Source: §1 · p. 2

2 The pixel p-norm central hypothesis and its implications

• The central hypothesis posits a single p* such that each image x0 has a threshold r(x0): changes below it are imperceptible and changes at or above it are noticed.The pixel feature space is X = {0, . . . , 255}^d, with d equal to the number of pixels times the number of color channels.Source: §2 · p. 2
• The paper calls r(x0) the just noticeable difference (JND) and defines J(x0) as the shell of the norm ball at that threshold.A testable implication is that all images in J(x0) have the same p*-norm distance from x0.Source: §2 · pp. 2–3
• The study tests the hypothesis through human behavioral experiments using perturbations along rays from x0, including directions generated by adversarial attacks.For ±1 directions, nonzero elements are chosen according to the corresponding pixel value; with integer scales from 1 to 128, clipping and rounding are unnecessary.Source: §2 · pp. 2–3
• For any p-norm to fit the central hypothesis, two just-noticeable ±1 perturbations with equal sparsity must have equal scales.This implication can be tested without knowing p* or r(x0); if it fails, no pixel p-norm fits the hypothesis.Source: §2 · p. 3

Participants and stimuli

• 68 participants viewed three resized ImageNet images—a panda, macaw, and cat—and tested ten perturbation directions for each.The images were resized to 299 × 299 to match Inception V3 input dimensions.Source: §3 · pp. 3–4

Perturbation directions

• Eight crafted ±1 directions varied changed dimensions, color channels, and pixel shapes; the other two were FGSM and PGD adversarial directions generated with Inception V3.PGD targets were gibbon for panda, guacamole for cat, and cleaver for macaw.Source: §3 · p. 3, Figure 3 · p. 4

Procedure

• In each of 34 randomized trials, participants adjusted perturbation strength and submitted the image when it became just noticeably different from the original.Trials comprised 30 perturbation or adversarial trials and four guard trials; participants were not told the perturbation type or current scale.Source: §3 · pp. 3–4
• Participants could vary ±1 perturbations from a = 0 to 128, while adversarial perturbation strength could increase indefinitely; no participant exceeded a = 80.Participants unable to detect a change at a = 128 could give up; guard trials presented a sudden noisy image change at a = 20.Source: §3 · p. 4

Participants and inclusion

• The study enrolled 68 participants, but only 42 passed the stringent guard-trial inclusion criterion and were retained for analysis.A participant was excluded if any of four guard-trial responses fell outside a = 18–22.Source: §3 · pp. 4–5

Data analysis

• Give-up responses produced right-censored perturbation scales of at least 129, and the analyses used Kolmogorov-Smirnov tests with Bonferroni correction across nine tests.The individual test level was α/9 for a paper-wide significance level such as α = 0.01.Source: §3 · p. 5

4.1 Humans probably do not use pixel 0-norm, 1-norm, 2-norm, or ∞-norm

• For p=1, panda medians were 1068581 (FGSM) versus 8928 (M-RGB-Dot), with KS p=6.4 × 10^-19; p=2 and ∞ tests also rejected equal distributions.The p=2 comparison was PGD versus X-RGB-Box on macaw (p=2.6 × 10^-16); the p=∞ comparison was M-RGB-Box versus L-RGB-Box on cat (p=1.1 × 10^-14).Source: §4.1 · p. 6, Figure 6 · p. 6
• For p=0, M, L, and X directions had vastly different 0-norms despite each reaching human JND at a nonzero perturbation scale.This contradicts the p=0 prediction that detectability depends on crossing a 0-norm threshold regardless of scale.Source: §4.1 · p. 6

4.2 Humans probably do not use any pixel p-norm

• For equal-sparsity cat perturbations, median JND scales were 62 for M-Red-Dot and 37 for M-Red-Eye; KS p=9.5 × 10^-6 rejected equal distributions.The directions differed in support shape: random pixels versus pixels in the eye region.Source: §4.2 · p. 7
• Taken together, the results indicate that pixel p-norms are not a good fit for human behavior regardless of p.The paper suggests other perceptual attributes important to humans are unaccounted for by pixel p-norms.Source: §4.2 · p. 7

5 Some measures other than pixel p-norms

• The sought alternative distance ρ should ideally assign the same value to every human JND image relative to its original image.The paper notes that ρ need not be a metric.Source: §5 · p. 7
• For cat images, human JND EMD differed across M-RGB-Box and X-RGB-Box directions; KS p=6.4 × 10^-19 rejected equal distributions.The X-RGB-Box direction required substantially more earth movement before participants perceived a difference.Source: §5 · p. 7, Figure 7 · p. 7
• For panda images, human JND 1−SSIM differed between X-RGB-Box and FGSM directions; KS p=1.1 × 10^-9 rejected equal distributions.The paper uses 1−SSIM as the distance because SSIM is a similarity score.Source: §5 · pp. 7–8
• For macaw images, DNN 2-norm medians were 1.8 for M-Red-Dot and 13.6 for PGD; KS p=2.1 × 10^-12 rejected equal distributions.The DNN distances use Inception V3 last-hidden-layer representations.Source: §5 · pp. 7–8

6 But which measure is a better approximation?

• The comparison normalizes each measure by its value at the center image and pools participant and perturbation-direction data, excluding give-up trials.The standard deviation is computed separately for each center image x0.Source: §6 · p. 8
• DNN representation measures have standard deviations larger than 0.12 for every p and are omitted from the main plot.The appendix shows the DNN values in Figure 15.Source: §6 · p. 8
• Pixel 3-norm is the best approximation of human JND judgments among the tested measures.The authors compare the consistency of each measure across human JND images; Figure 8 shows pixel 3-norm results for panda, macaw, and cat.Source: §6 · p. 8, Figure 8 · p. 8

7 Conclusion

• Pixel p-norms, EMD, 1 - SSIM, and DNN representation p-norms do not match human judgments of just-noticeably-different images.Source: §7 · p. 9
• Pixel 3-norm is the closest tested approximation, but its results still show significant variability.Source: §7 · p. 9
• Future work is needed to identify better measures of cognitive response to image distortion and extend the study to audio and text.Source: §7 · p. 9

A.1 Further statistical tests

• For panda, humans reached JND at median scales 57.5 for M-Red-Dot and 31 for M-RGB-Dot; the distributions differed (n = 42, p-value 2.1 × 10^-4).The test rejects the same-distribution null, and the authors state that the two tests refute implication 2 and indicate that no p* makes the central hypothesis true.Source: §A.1 · p. 11
• Implication 3 predicts that the larger-support perturbation reaches JND at a smaller scale, and the observed medians generally decrease as support grows from S to M, L, and X.The panda L-RGB-Box versus X-RGB-Box comparison is a statistically significant inversion of this general pattern.Source: §A.1 · p. 11
• For panda, the L-RGB-Box mean JND scale was 6.5 versus 9.9 for X-RGB-Box, reversing the support-size prediction (n = 42, p-value 1.8 × 10^-5).The authors report that the inversion is statistically significant and speculate that the black-and-white panda makes the L box boundary more prominent.Source: §A.1 · p. 11

A.2 Additional figures

• Figures 9 and 10 show the three natural images and photos used for guard trials alongside distorted versions.Source: Figure 9 · p. 12, Figure 10 · p. 12
• Figures 11–14 plot JND measurements for pixel norms, Earth Mover’s Distance, 1 - SSIM, and DNN representation norms.Figure 11 identifies p = 1, 2, and infinity rows and perturbation directions within plots; Figure 14 uses rows for p = 1, 2, and infinity.Source: Figure 11 · p. 12, Figure 12 · p. 13, Figure 13 · p. 13
• Figure 15 compares variability of fit to human data, where lower values indicate better fit.Source: Figure 15 · p. 14

• Screenshots of the instructions displayed to participants are included in the appendix for reference.Source: §A.3 · p. 15
• The instruction screenshots are presented as Page 1 and Page 2 figures, with two continuation figures for Page 2.Source: Figure 16 · p. 15, Figure 17 · p. 16, Figure 18 · p. 17
• A separate figure presents Instruction Page 3.Source: Figure 20 · p. 19