L1 attacks keep success despite limits on big pixel changes
How Much Do $\ell_1$ Attacks Need Concentrated Perturbations?
Machine LearningArtificial IntelligenceComputer Vision and Pattern Recognition
Summary
When computers try to trick image-recognition systems by changing images a little bit, they often focus changes on a few pixels. This work studies what happens if those big changes per pixel are limited while keeping the total amount of change the same. The authors find that even with strict limits on big pixel changes, attacks still work almost as well, but the changes spread out more over the image. They also show that carefully enforcing these limits during the attack process works much better than just cutting down big changes after the fact.
What this means in practice
- •For machine learning engineers: Design adversarial attacks that spread small changes widely rather than concentrating on few pixels, improving evaluation of model robustness.
- •For security analysts: Assess defenses by testing models against perturbations with controlled per-pixel maximums, revealing robustness to different attack styles.
Authors
Melika Shirian, Kianoosh Vadaei, Arshia Hemmat
Abstract
A global $\ell_1$ budget limits how much an adversary may change an image, not how that change is distributed. We ask how much of an $\ell_1$ attack's observed success remains when large coordinate changes are restricted. We add a per-coordinate cap to the budget, enforce the joint constraint by exact in-loop projection, and sweep the cap for APGD-$\ell_1$, SLIDE, and FMN-$\ell_1$ without altering their objectives. Across 18 standard-model settings, caps of at most $32/255$ retain a median $97\%$ of attack success relative to each method's native uncapped baseline, while median peak magnitude falls by $80\%$ and median effective support nearly triples. At matched realized $\ell_1$, capped perturbations remain structurally distinct; separate ImageNet comparisons also show lower LPIPS and DISTS at selected caps. Direct in-loop constrained optimization preserves up to $88$ percentage points more attack success than post-hoc clipping, highlighting the importance of constraint enforcement. Suitable caps nevertheless vary across attacks and models, and adversarially trained classifiers exhibit more heterogeneous concentration sensitivity. These results establish perturbation concentration as a complementary, model- and attack-dependent axis of $\ell_1$ attack evaluation.