Perturbation Budget

The budget is almost always defined by an Lp-norm distance metric, which mathematically limits the perturbation's magnitude. The choice of norm directly shapes the attack's geometry:

• L-infinity norm: Constrains the maximum change to any single pixel. This creates a hyper-cube of allowed perturbations and is the most common constraint for image attacks.
• L2 norm: Constrains the Euclidean distance between the original and adversarial input, allowing many small changes that sum to a fixed total magnitude.
• L1 norm: Constrains the sum of absolute changes, promoting sparse perturbations where only a few pixels are modified significantly.
• L0 norm: Constrains the total number of pixels that can be altered, regardless of the magnitude of change.

The epsilon (ε) value is the scalar that quantifies the perturbation budget's size. For an L-infinity budget, ε defines the maximum absolute change per pixel, typically normalized to the [0,1] or [0,255] pixel range. A larger epsilon grants the adversary more power, making attacks easier to find but also more perceptible. The selection of epsilon is a critical security parameter: setting it too high allows trivially visible distortions, while setting it too low may underestimate real-world adversarial risk. Standard benchmarks use ε = 8/255 for MNIST and CIFAR-10, and ε = 4/255 or 16/255 for ImageNet.

The perturbation budget formalizes the tension between stealth and attack efficacy. A budget constrained by human perceptual limits—the imperceptibility threshold—ensures that adversarial examples remain visually undetectable. However, this constraint also limits the attacker's ability to force misclassification. Defenses evaluated against small epsilon budgets may appear robust but catastrophically fail against slightly larger, yet still imperceptible, perturbations. Conversely, an overly generous budget may produce adversarial examples that are trivially detectable by human auditors, violating the core assumption of a stealthy adversary.

A common pitfall in robustness evaluation occurs when the defense is tuned for a specific epsilon but the attacker operates under a different, often larger, budget. An attacker exploiting a budget mismatch can completely bypass defenses that rely on gradient masking or input preprocessing. Rigorous evaluation protocols, such as those recommended by Carlini & Wagner, demand testing against a range of epsilon values to ensure no budget mismatch vulnerability exists. This prevents a false sense of security from defenses that only work at a single, narrow perturbation magnitude.

During iterative attacks like Projected Gradient Descent (PGD), the perturbation budget is enforced by a projection operator. After each gradient step, the perturbed input is mathematically projected back onto the epsilon-ball centered at the original input. This ensures the final adversarial example strictly satisfies the Lp-norm constraint. The projection operation differs by norm: for L-infinity, it is a simple per-pixel clipping operation; for L2, it requires renormalizing the entire perturbation vector to the epsilon radius. This mechanism is what makes the budget a hard, non-negotiable constraint.

In advanced threat modeling, the perturbation budget is not a fixed constant but an adaptive parameter chosen per-input. An attacker may allocate a larger budget to inputs near the decision boundary and a smaller budget to those deep within a class manifold. This per-instance budget maximizes attack success while minimizing average perceptual distortion. Defending against adaptive budgets requires robustness certificates that guarantee prediction invariance for any perturbation within a radius, rather than empirical defenses that assume a static, global epsilon.