Agentic data science with the Data Agent Kit
cloud.google.com·7h ago
AI Research
arXiv CS.AI·24d ago·5 min read
Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attacks
TL;DR
This research investigates how the choice of the Lp norm parameter affects the sparsity and smoothness of adversarial attacks on neural networks. It finds that using Lp norms with p values between 1.3 and 1.5 offers the best balance for effective attacks.
✦ Why It Matters
Consider adjusting the Lp norm parameter in your adversarial attack strategies to improve effectiveness.
Key Takeaways
- Experiment with Lp norms between 1.3 and 1.5 for better attack performance.
- Evaluate the sparsity and smoothness of your adversarial examples.
- Use established and new metrics to assess adversarial perturbations.
- Consider the specific task when selecting the Lp norm parameter.
Full Summary
Adversarial attacks on deep neural networks often rely on Lp norm constraints, typically using values like p=1, p=2, or p=∞. However, the impact of varying the norm parameter p on the characteristics of these attacks has not been systematically explored.
This study examines how different p values within the range of [1, 2] influence the sparsity (the number of non-zero elements in the perturbation) and smoothness (the continuity of the perturbation) of adversarial examples. By employing established sparsity measures and introducing new smoothness metrics, the researchers conducted extensive experiments across various image datasets and neural network architectures.
Results indicate that using Lp norms with p values between 1.3 and 1.5 generally yields superior performance compared to the traditional choices of Lp norms. These findings underscore the necessity of carefully selecting the norm parameter to optimize adversarial attack design.