Exploring Sparsity and Smoothness of Arbitrary $\ell_p$ Norms in Adversarial Attacks

TL;DR

This paper systematically investigates how the choice of lp norms influences the sparsity and smoothness of adversarial attacks on neural networks, revealing that intermediate lp values often produce more effective perturbations.

Contribution

It introduces a comprehensive framework with new measures for analyzing sparsity and smoothness of adversarial perturbations across lp norms, providing empirical insights into optimal norm choices.

Findings

Intermediate lp norms (lp lp  1.3 to 1.5) produce better trade-offs between sparsity and smoothness.

lp or lp=2 are often suboptimal for generating adversarial attacks.

The optimal lp norm depends on the specific dataset and model architecture.

Abstract

Adversarial attacks against deep neural networks are commonly constructed under $\ell_p$ norm constraints, most often using $p=1$, $p=2$ or $p=\infty$, and potentially regularized for specific demands such as sparsity or smoothness. These choices are typically made without a systematic investigation of how the norm parameter \( p \) influences the structural and perceptual properties of adversarial perturbations. In this work, we study how the choice of \( p \) affects sparsity and smoothness of adversarial attacks generated under \( \ell_p \) norm constraints for values of $p \in [1,2]$. To enable a quantitative analysis, we adopt two established sparsity measures from the literature and introduce three smoothness measures. In particular, we propose a general framework for deriving smoothness measures based on smoothing operations and additionally introduce a smoothness measure based on first-order Taylor approximations. Using these measures, we conduct a comprehensive empirical evaluation across multiple real-world image datasets and a diverse set of model architectures, including both convolutional and transformer-based networks. We show that the choice of $\ell_1$ or $\ell_2$ is suboptimal in most cases and the optimal $p$ value is dependent on the specific task. In our experiments, using $\ell_p$ norms with $p\in [1.3, 1.5]$ yields the best trade-off between sparse and smooth attacks. These findings highlight the importance of principled norm selection when designing and evaluating adversarial attacks.