研究限制坐标上限后 ℓ1 对抗攻击仍有 97% 成功率
How Much Do $\ell_1$ Attacks Need Concentrated Perturbations?
一项对抗鲁棒性研究：给 ℓ1 攻击加个逐坐标上限，APGD-ℓ1 等三种攻击的成功率几乎不掉，说明扰动分布方式是个新评估维度。
arXiv 论文 2610.27773 研究 ℓ1 对抗攻击中扰动集中程度的影响，在攻击预算外加入逐坐标上限，并用循环内精确投影强制执行该约束。在 18 个标准模型设置上，APGD-ℓ1、SLIDE、FMN-ℓ1 三种攻击方法在 32/255 上限下保留中位数 97% 的攻击成功率，峰值幅值中位数下降 80%，有效支撑接近扩大三倍。ImageNet 对比显示受限扰动在部分上限下 LPIPS 和 DISTS 更低。直接循环内约束优化比事后裁剪最多多保留 88 个百分点的攻击成功率。
How Much Do $\ell_1$ Attacks Need Concentrated Perturbations?
A global $\ell_1$ budget limits how much an adversary may change an image, not how that change is distributed. We ask how much of an $\ell_1$ attack's observed success remains when large coordinate changes are restricted. We add a per-coordinate cap to the budget, enforce the joint constraint by exact in-loop projection, and sweep the cap for APGD-$\ell_1$, SLIDE, and FMN-$\ell_1$ without altering their objectives. Across 18 standard-model settings, caps of at most $32/255$ retain a median $97\%$ of attack success relative to each method's native uncapped baseline, while median peak magnitude falls by $80\%$ and median effective support nearly triples. At matched realized $\ell_1$, capped perturbations remain structurally distinct; separate ImageNet comparisons also show lower LPIPS and DISTS at selected caps. Direct in-loop constrained optimization preserves up to $88$ percentage points more attack success than post-hoc clipping, highlighting the importance of constraint enforcement. Suitable caps nevertheless vary across attacks and models, and adversarially trained classifiers exhibit more heterogeneous concentration sensitivity. These results establish perturbation concentration as a complementary, model- and attack-dependent axis of $\ell_1$ attack evaluation.