# Should Adversarial Attacks Use Pixel p-Norm?

Source: [Should Adversarial Attacks Use Pixel p-Norm?](<https://www.sota2.com/research/paper/68fa65d81e209131cea0cbba>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-25T21:36:37.771Z

Authors: Ayon Sen, Xiaojin Zhu, Liam Marshall, Robert Nowak

Published: 2019-06-06T06:47:55.000Z

## Abstract

Adversarial attacks aim to confound machine learning systems, while remaining virtually imperceptible to humans. Attacks on image classification systems are typically gauged in terms of $p$-norm distortions in the pixel feature space. We perform a behavioral study, demonstrating that the pixel $p$-norm for any $0\\le p \\le \\infty$, and several alternative measures including earth mover's distance, structural similarity index, and deep net embedding, do not fit human perception. Our result has the potential to improve the understanding of adversarial attack and defense strategies.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/1906.02439>)

[PDF](<https://arxiv.org/pdf/1906.02439.pdf>)