# Perceptually Constrained Adversarial Attacks Source: [Perceptually Constrained Adversarial Attacks]() Collection index: [llms.txt]() Data updated: 2025-10-28T13:56:46.471Z Authors: Muhammad Zaid Hameed, Andras Gyorgy Published: 2021-02-14T12:28:51.000Z ## Abstract Motivated by previous observations that the usually applied $L\_p$ norms ($p=1,2,\\infty$) do not capture the perceptual quality of adversarial examples in image classification, we propose to replace these norms with the structural similarity index (SSIM) measure, which was developed originally to measure the perceptual similarity of images. Through extensive experiments with adversarially trained classifiers for MNIST and CIFAR-10, we demonstrate that our SSIM-constrained adversarial attacks can break state-of-the-art adversarially trained classifiers and achieve similar or larger success rate than the elastic net attack, while consistently providing adversarial images of better perceptual quality. Utilizing SSIM to automatically identify and disallow adversarial images of low quality, we evaluate the performance of several defense schemes in a perceptually much more meaningful way than was done previously in the literature. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. ## Original sources and implementation [Original paper]() [PDF]()