English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Deep neural networks could be fooled by adversarial examples with trivialdifferences to original samples. To keep the difference imperceptible in humaneyes, researchers bound the adversarial perturbations by the $\ell_\infty$norm, which is now commonly served as the standard to align the strength ofdifferent attacks for a fair comparison. However, we propose that using the$\ell_\infty$ norm alone is not sufficient in measuring the attack strength,because even with a fixed $\ell_\infty$ distance, the $\ell_2$ distance alsogreatly affects the attack transferability between models. Through thediscovery, we reach more in-depth understandings towards the attack mechanism,i.e., several existing methods attack black-box models better partly becausethey craft perturbations with 70% to 130% larger $\ell_2$ distances. Sincelarger perturbations naturally lead to better transferability, we therebyadvocate that the strength of attacks should be simultaneously measured by boththe $\ell_\infty$ and $\ell_2$ norm. Our proposal is firmly supported byextensive experiments on ImageNet dataset from 7 attacks, 4 white-box models,and 9 black-box models.

Measuring the Transferability of $\ell_\infty$ Attacks by the $\ell_2$ Norm