The Madry Lab recently hosted a competition designed to test the robustness of their adversarially trained MNIST model. Attacks were constrained to perturb each pixel of the input image by a scaled maximal L∞ distortion ϵ = 0.3. This discourages the use of attacks which are not optimized on the L∞ distortion metric. Our experimental results demonstrate that by relaxing the L∞ constraint of the competition, the elastic-net attack to deep neural networks (EAD) can generate transferable adversarial examples which, despite their high average L∞ distortion, have minimal visual distortion. These results call into question the use of L∞ as a sole measure for visual distortion, and further demonstrate the power of EAD at generating robust adversarial examples.
@article{arxiv.1710.10733,
title = {Attacking the Madry Defense Model with $L_1$-based Adversarial Examples},
author = {Yash Sharma and Pin-Yu Chen},
journal= {arXiv preprint arXiv:1710.10733},
year = {2018}
}