Imperceptibility Threshold

The threshold is mathematically formalized using Lp-norm distances between the original and perturbed input vectors. The most common constraints are:

• L∞-norm: Limits the maximum change to any single pixel, ensuring no individual feature is altered beyond a set value (e.g., 8/255).
• L2-norm: Constrains the Euclidean distance, limiting the total cumulative perturbation energy across all pixels.
• L0-norm: Restricts the total number of pixels that can be altered, regardless of the magnitude of change.

Rooted in psychophysics, the threshold is calibrated against the Weber-Fechner law of human perception. The JND defines the minimum stimulus change detectable 50% of the time. In adversarial contexts, perturbations must fall below this perceptual floor, accounting for:

• Spatial frequency masking: Humans are less sensitive to perturbations in highly textured or high-frequency regions.
• Luminance masking: Changes are less visible in very bright or very dark areas of an image.

The epsilon (ε) parameter explicitly defines the maximum allowed perturbation magnitude under a chosen Lp-norm. This budget serves as the hard constraint for attack algorithms like Projected Gradient Descent (PGD). A typical budget for CIFAR-10 is ε = 8/255 under L∞, while ImageNet attacks often use ε = 4/255 or 16/255. The selection of ε directly trades off attack success rate against visual perceptibility.

Pixel-wise Lp-norms are poor proxies for human vision. Advanced thresholds use perceptual color spaces like CIELAB or CIEDE2000, where Euclidean distance correlates with perceived color difference. Attacks constrained by CIEDE2000 produce perturbations that align with human visual uniformity, making them harder to detect than those constrained by simple RGB L∞-norm budgets.

Beyond pixel differences, the threshold can be defined by Structural Similarity Index (SSIM) or MS-SSIM metrics. These measure perceived changes in luminance, contrast, and structure. An adversarial example is considered imperceptible if it maintains an SSIM score above a high threshold (e.g., > 0.95), ensuring the structural integrity of the image is preserved even if pixel values shift.

In modern attacks, imperceptibility is enforced by minimizing the distance in the feature space of a pre-trained deep network (e.g., VGG or AlexNet). Perceptual loss or LPIPS (Learned Perceptual Image Patch Similarity) constrains perturbations to be invisible in the deep feature representations that correlate with human semantic judgment, producing more natural-looking adversarial examples than raw pixel-space constraints.

The maximum allowed magnitude of an adversarial perturbation, typically constrained by an Lp-norm such as L-infinity. This budget directly defines the imperceptibility threshold by limiting how much each pixel or feature can change. A smaller epsilon forces attackers to find more subtle, often more elegant, perturbations that remain invisible to human observers while still breaking model predictions.

A defensive technique that injects adversarial examples—generated within the imperceptibility threshold—into the training dataset with their correct labels. This forces the model to learn a smoother decision boundary that is less sensitive to small perturbations. It remains the most empirically effective defense against evasion attacks, directly leveraging the threshold as a training constraint.

A formal, verifiable guarantee that a model's prediction will remain constant for any perturbation within a specified Lp-norm radius. Unlike empirical defenses, certificates provide a provable lower bound on robustness. Techniques like randomized smoothing construct a smoothed classifier that certifies predictions against all attacks below the imperceptibility threshold, offering mathematical certainty where heuristic defenses fail.

A detection method that compares model predictions on original inputs versus squeezed versions—such as reduced color bit depth or spatial smoothing. Adversarial examples crafted near the imperceptibility threshold are often highly sensitive to these transformations, causing prediction divergence. This technique exploits the fragility of adversarial perturbations to identify inputs that lie suspiciously close to the decision boundary.