<p>Adversarial examples are commonly crafted by introducing a perturbation that changes the classifier's prediction while the underlying class of the input did not change. Setting a maximum value for the norm of that introduced perturbation is difficult, whether the norm is measured with L2 or Linfinity. Typically, this norm is constrained to be smaller than a certain constant epsilon, because we assume that if epsilon is small enough, it is unlikely that the underlying class of the input changed once it has been perturbed. However, we now know that it is difficult to set a value of epsilon that holds across all inputs. You can find more details here: <a href="https://arxiv.org/abs/1903.10484" rel="nofollow noreferrer">https://arxiv.org/abs/1903.10484</a></p>
How to set L2 constrain on cw_l2 attack?
<p>How do we set constrain on L2 distance for cw L2 attack and deepfool attack? In attack publications authors mention smaller Lp distance to claim a stronger attack, but how to limit L2 distance to a fixed value is confusing. For L-ifinity it can be a max min crop but L2 distance is the average L2 distance on pixel value if I am not wrong, and how do we set that to be a fixed value?</p>