How Much Do $\ell_1$ Attacks Need Concentrated Perturbations?

Melika Shirian; Kianoosh Vadaei; Arshia Hemmat

cs.LGOct 20, 2026

How Much Do $\ell_1$ Attacks Need Concentrated Perturbations?

Authors: Melika Shirian, Kianoosh Vadaei, Arshia Hemmat

Organizations: University of Cambridge

Abstract

A global $\ell_1$ budget limits how much an adversary may change an image, not how that change is distributed. We ask how much of an $\ell_1$ attack's observed success remains when large coordinate changes are restricted. We add a per-coordinate cap to the budget, enforce the joint constraint by exact in-loop projection, and sweep the cap for APGD- $\ell_1$ , SLIDE, and FMN- $\ell_1$ without altering their objectives. Across 18 standard-model settings, caps of at most $32/255$ retain a median $97\%$ of attack success relative to each method's native uncapped baseline, while median peak magnitude falls by $80\%$ and median effective support nearly triples. At matched realized $\ell_1$ , capped perturbations remain structurally distinct; separate ImageNet comparisons also show lower LPIPS and DISTS at selected caps. Direct in-loop constrained optimization preserves up to $88$ percentage points more attack success than post-hoc clipping, highlighting the importance of constraint enforcement. Suitable caps nevertheless vary across attacks and models, and adversarially trained classifiers exhibit more heterogeneous concentration sensitivity. These results establish perturbation concentration as a complementary, model- and attack-dependent axis of $\ell_1$ attack evaluation.

Figures & tables

Figure 1: Equal- $\ell_{1}$ perturbations can have substantially different local structures. APGD- $\ell_{1}$ examples on ImageNet/ResNet-50 (top) and CIFAR-10/ResNet-18 (bottom) compare capped and conventional uncapped ( $c=1$ ) perturbations matched by realized $\ell_{1}$ magnitude. Both are successful, but the capped perturbations have lower peak changes and broader support. Magnified crops highlight these differences. Perturbations are amplified by $16\times$ for visualization and do not represent their original-scale appearance.

Data	Model	Attack	$255c^{\star}$	ASR 1	ASR ⋆	Ret.	$\Delta_{\infty}$	$\Delta S_{\rm eff}$
				(%)
C10	ResNet-18	APGD-L1	16	96.04	92.65	96.47	79.80	145.94
C10	ResNet-18	SLIDE	32	90.80	88.60	97.58	56.31	46.17
C10	ResNet-18	FMN-L1	16	95.98	92.29	96.16	72.77	186.79
C10	WRN-28-10	APGD-L1	8	96.91	93.02	95.98	88.28	268.71
C10	WRN-28-10	SLIDE	32	89.31	88.09	98.63	48.40	31.17

Table 1: Main perturbation–concentration results for standard models at the primary budgets (

B=4

for CIFAR-10/100 and

B=20

for ImageNet).

c^{\star}

is the tightest evaluated cap retaining at least

95\%

of the native uncapped ASR.

\Delta_{\infty}

denotes the reduction in median

\ell_{\infty}

, and

\Delta S_{\mathrm{eff}}

the increase in median effective support.

Data	Model	Attack	$255c^{\star}$	ASR 1	ASR ⋆	Ret.	$\Delta_{\infty}$	$\Delta S_{\rm eff}$
				(%)
C10	CH PreActRN-18 ( $\ell_{1}$ )	APGD-L1	32	8.65	8.35	96.55	50.68	52.74
C10	CH PreActRN-18 ( $\ell_{1}$ )	SLIDE	64	7.80	7.67	98.38	1.10	4.29
C10	MSD PreActRN-18	APGD-L1	64	12.14	11.96	98.59	9.25	4.47
C10	MSD PreActRN-18	SLIDE	64	12.82	12.78	99.71	1.04	3.00
C10	XCiT-S12 ( $\ell_{\infty}$ )	APGD-L1	255	28.50	28.50	100.00	0.00	0.00

Table 2: Perturbation–concentration results for adversarially trained models at their reference budgets (

B=4

for CIFAR-10 and

B=20

for ImageNet).

c^{\star}

is the tightest evaluated cap retaining at least

95\%

of the native uncapped ASR.

\Delta_{\infty}

denotes the percentage reduction in median

\ell_{\infty}

, and

\Delta S_{\mathrm{eff}}

the percentage increase in median effective support. C10 and IN denote CIFAR-10 and ImageNet, respectively.

Figure 2: Standard-model perturbation–concentration frontiers across both global budgets. Panels show CIFAR-10/ResNet-18, CIFAR-10/WRN-28-10, ImageNet/ResNet-50, and ImageNet/ViT-B/16. Markers indicate the independently selected

c^{\star}_{0.95}

values. CIFAR-100 results are included in Table 1 .

Figure 3: Qualitative perturbation progression under increasingly tight coordinate caps for a CIFAR-10 example at $B=4$ . Tightening the cap progressively reduces peak magnitude and spreads the perturbation over larger effective support. The selected $c^{\star}_{0.95}=16/255$ operating point is highlighted; perturbations are shown at $8\times$ scale.

Figure 4: Perturbation–concentration frontiers for adversarially trained models. Solid curves denote the reference budget and dashed curves the corresponding secondary budget. Circled points indicate

c^{\star}_{0.95}

at the reference budget.

Attack	$255c$	Post-hoc	Direct	$\Delta$ ASR [95% CI]
APGD-L1	16	46.72	92.21	$+45.49\ [44.13,46.91]$
FMN-L1	16	3.83	91.94	$+88.11\ [87.20,88.99]$

Table 3: Constraint-enforcement control (A04) on

4{,}750

clean-correct CIFAR-10/ResNet-18 examples at

B=4

\Delta

denotes direct constrained ASR minus post-hoc ASR.

Attack	Condition	$255c$	Main	Strong	$\Delta$ ASR
APGD-L1	Uncapped	255	95.58	98.08	+2.51
	$c^{\star}$	16	91.81	93.94	+2.13
	Tighter	8	86.51	88.55	+2.04
FMN-L1	Uncapped	255	95.96	96.40	+0.44
	$c^{\star}$	16	91.89	92.86	+0.97
	Tighter	8	86.11	87.28	+1.18

Table 4: Optimization-strength control (A05) on CIFAR-10/ResNet-18 at

B=4

. “Main” and “Strong” denote the default and strengthened configurations. The selected operating points are frozen before this comparison.

Figure 5: Repeated-run optimizer audit (A06). Cumulative best-of-

k

APGD-L1 ASR, selecting the highest-loss candidate among the first

k

runs, is shown for

c=1

and

c=64/255

, with

95\%

Wilson intervals. Markers show the corresponding

500

-step FMN-L1 references. Increasing independent search effort improves both conditions and narrows the capped-over-uncapped APGD gap.

Attack	ASR (%)	$\Delta$ (pp)
Official $\ell_{1}$ AutoAttack	98.50	—
APGD-L1	96.20	-2.30
FMN-L1	95.70	-2.80

Table 5: External uncapped attack-strength reference (A07).

\Delta

denotes comparator ASR minus official AutoAttack ASR.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Data	Attack	$N_{\mathrm{pairs}}$	Matched ASR	Med. err.	P95 err.	$\ell_{\infty}$ C/U	$M_{1\%}$ C/U	$M_{5\%}$ C/U	$S_{\mathrm{eff}}$ C/U
CIFAR-10	APGD-L1	4367	99.29	$2.38{\times}10^{-7}$	$1.31{\times}10^{-6}$	.0627/.3060	.4765/.7342	.9865/1.0000	90.2/37.2
CIFAR-10	SLIDE	4194	99.17	$1.19{\times}10^{-7}$	$2.38{\times}10^{-7}$	.1255/.2846	.6728/.7377	1.0000/1.0000	55.1/38.1
ImageNet	APGD-L1	656	96.95	$8.58{\times}10^{-7}$	$9.25{\times}10^{-6}$	.0157/.4569	.8462/.9668	1.0000/1.0000	1769.5/215.2
ImageNet	SLIDE	640	99.84	$1.91{\times}10^{-7}$	$1.24{\times}10^{-6}$	.0314/.1543	.9349/.9572	1.0000/1.0000	980.5/502.3

Appendix

Table 6: Complete matched-realized-

\ell_{1}

structural summaries. All rows are conditioned on success of the capped source perturbation. “C/U” denotes capped source / independently optimized matched uncapped. Matching-error columns report the relative error between the realized

\ell_{1}

magnitudes of the paired perturbations.

Data	Attack	$\Delta\ell_{\infty}$ [95% CI]	$\Delta M_{1\%}$ [95% CI]	$\Delta M_{5\%}$ [95% CI]	$\Delta S_{\mathrm{eff}}$ [95% CI]
CIFAR-10	APGD-L1	.2433 [.2392,.2483]	.2620 [.2585,.2662]	.0010 [.0004,.0019]	52.85 [52.47,53.28]
CIFAR-10	SLIDE	.1592 [.1555,.1627]	.0644 [.0626,.0667]	.0000 [.0000,.0000]	16.68 [16.45,16.99]
ImageNet	APGD-L1	.4413 [.4284,.4524]	.1064 [.1020,.1104]	.0000 [.0000,.0000]	1536.43 [1515.61,1555.61]
ImageNet	SLIDE	.1230 [.1199,.1256]	.0204 [.0193,.0215]	.0000 [.0000,.0000]	477.67 [471.15,482.81]

Appendix

Table 7: Paired structural differences in the matched-realized-

\ell_{1}

controls, with

95\%

deterministic paired-bootstrap intervals. For

\ell_{\infty}

M_{1\%}

, and

M_{5\%}

, differences are matched-uncapped minus capped; for

S_{\mathrm{eff}}

, differences are capped minus matched-uncapped. Positive values therefore indicate broader, lower-peak allocation under the cap.

Figure 6: Perturbation structure under matched realized

\ell_{1}

. Filled markers denote capped perturbations and open markers independently optimized uncapped perturbations with approximately matched realized

\ell_{1}

. Capped solutions exhibit lower peak magnitude, larger effective support, and reduced concentration in the largest coordinates.

Figure 7: Effectiveness–perceptual-distance tradeoff on ImageNet/ResNet-50. Circles denote the selected

c^{\star}_{0.95}

and crosses the next tighter evaluated cap. The horizontal axis reports ASR change relative to the uncapped condition, while the vertical axis reports reduction in LPIPS or DISTS.

Attack	Target	$255c$	$\Delta$ ASR (pp) [95% CI]	$\Delta$ LPIPS [95% CI]	$\Delta$ DISTS [95% CI]
APGD-L1	$c^{\star}$	4	$-3.92$ [ $-5.87$ , $-1.96$ ]	$-0.01048$ [ $-0.01145$ , $-0.00970$ ]	$-0.01104$ [ $-0.01213$ , $-0.01017$ ]
APGD-L1	tighter	2	$-10.70$ [ $-13.19$ , $-8.36$ ]	$-0.01264$ [ $-0.01358$ , $-0.01163$ ]	$-0.01351$ [ $-0.01438$ , $-0.01272$ ]
SLIDE	$c^{\star}$	8	$-2.87$ [ $-4.18$ , $-1.83$ ]	$-0.001895$ [ $-0.002001$ , $-0.001702$ ]	$-0.002205$ [ $-0.002412$ , $-0.002000$ ]
SLIDE	tighter	4	$-10.18$ [ $-12.40$ , $-8.22$ ]	$-0.003466$ [ $-0.003785$ , $-0.003252$ ]	$-0.004441$ [ $-0.004701$ , $-0.004201$ ]
FMN-L1	$c^{\star}$	8	$-1.44$ [ $-3.52$ , $+0.53$ ]	$-0.001209$ [ $-0.001360$ , $-0.001013$ ]	$-0.001406$ [ $-0.001592$ , $-0.001215$ ]
FMN-L1	tighter	4	$-7.31$ [ $-9.79$ , $-4.83$ ]	$-0.001592$ [ $-0.001807$ , $-0.001394$ ]	$-0.002181$ [ $-0.002438$ , $-0.001996$ ]

Appendix

Table 8: Paired ImageNet/ResNet-50 perceptual comparisons against the native uncapped reference.

\Delta

ASR is target minus uncapped in percentage points.

\Delta

LPIPS and

\Delta

DISTS are paired median differences (target minus uncapped) on the corresponding common-success population. Brackets give

95\%

deterministic paired-bootstrap intervals.

Attack	$255c$	Post-hoc	Direct	$\Delta$ ASR [95% CI]
APGD-L1	16	46.72	92.21	$+45.49\ [44.13,46.91]$
FMN-L1	16	3.83	91.94	$+88.11\ [87.20,88.99]$

Appendix

Table 9: Complete constraint-enforcement control on CIFAR-10/ResNet-18 (

N=4{,}750

B=4

). Confidence intervals are deterministic paired-bootstrap intervals.

Attack	Condition	$255c$	Main	Strong	$\Delta$	95% CI
APGD-L1	Uncapped	255	95.58	98.08	+2.51	[2.06,2.97]
APGD-L1	$c^{\star}$	16	91.81	93.94	+2.13	[1.73,2.55]
APGD-L1	Tighter	8	86.51	88.55	+2.04	[1.64,2.44]
FMN-L1	Uncapped	255	95.96	96.40	+0.44	[0.19,0.72]
FMN-L1	$c^{\star}$	16	91.89	92.86	+0.97	[0.69,1.28]
FMN-L1	Tighter	8	86.11	87.28	+1.18	[0.84,1.54]

Appendix

Table 10: Complete optimization-strength control on CIFAR-10/ResNet-18 (

N=4{,}750

B=4

Figure 8: Finite-compute ASR change relative to the native uncapped reference, $\Delta_{\mathrm{ASR}}(B,c)$ , for the CIFAR-10 and ImageNet standard-model frontiers. Rows correspond to dataset–model–attack configurations and columns to capped conditions. Positive entries indicate that the finite-compute capped execution achieves higher ASR than its directly optimized $c=1$ reference. No monotonic smoothing is applied. SLIDE uses the native $c=1$ baseline. This diagnostic localizes differences in empirical optimization outcomes; A06 provides a direct repeated-search audit of one representative discrepancy.

Figure 9: CIFAR-100 finite-compute ASR change relative to the native uncapped reference across both evaluated budgets. The definition and interpretation of $\Delta_{\mathrm{ASR}}(B,c)$ are the same as in Fig. 8 . The figure completes the optimization-gain diagnostic for the standard-model evaluation rather than introducing an additional selection criterion.

Profile	ASR c=1	ASR 64/255	$\Delta$
	(%)	(%)	(pp)
APGD best-of-1	88.71	92.71	+4.00
APGD best-of-2	91.14	93.71	+2.57
APGD best-of-3	91.71	94.00	+2.29
APGD best-of-4	91.86	94.14	+2.29
APGD best-of-5	92.43	94.43	+2.00

Appendix

Table 11: Numerical repeated-run optimizer audit. APGD-L1 entries are cumulative best-of-

k

ASR based on highest cross-entropy loss. FMN-L1 is an independent

500

-step reference.

Attack	ASR (%)	$\Delta$ (pp)	95% CI
Official $\ell_{1}$ AutoAttack	98.50	—	—
APGD-L1	96.20	-2.30	[-3.30,-1.40]
FMN-L1	95.70	-2.80	[-3.90,-1.80]

Appendix

Table 12: Official AutoAttack reference on the matched fixed population. Differences use official AutoAttack as the reference.

Regime	$\rho$	Distribution of $255c^{\star}_{\rho}$	Median
Standard	0.90	$2{:}3,\ 4{:}4,\ 8{:}7,\ 16{:}4$	8
Standard	0.95	$2{:}2,\ 4{:}2,\ 8{:}7,\ 16{:}4,\ 32{:}3$	8
Standard	0.99	$2{:}1,\ 4{:}2,\ 8{:}1,\ 16{:}4,\ 32{:}5,\ 64{:}5$	32
Robust	0.90	$4{:}1,\ 16{:}1,\ 32{:}3,\ 64{:}1,\ 255{:}2$	32
Robust	0.95	$4{:}1,\ 32{:}1,\ 64{:}4,\ 255{:}2$	64
Robust	0.99	$4{:}1,\ 64{:}2,\ 255{:}5$	255

Appendix

Table 13: Sensitivity of the selected operating-point distribution to the retention threshold at the reference budgets. Entries in the distribution column give counts of settings selecting each value of

255c^{\star}_{\rho}

. Standard results cover the

18

standard attack–model settings; robust results cover the eight APGD-L1/SLIDE reference-budget settings. The primary paper uses

\rho=0.95

Dataset	Model	APGD-L1	SLIDE	FMN-L1
CIFAR-10	ResNet-18	$32\!\rightarrow\!16$	$32\!\rightarrow\!32$	$32\!\rightarrow\!16$
CIFAR-10	WRN-28-10	$16\!\rightarrow\!8$	$32\!\rightarrow\!32$	$32\!\rightarrow\!16$
CIFAR-100	ResNet-18	$16\!\rightarrow\!8$	$32\!\rightarrow\!32$	$32\!\rightarrow\!8$
CIFAR-100	WRN-28-10	$2\!\rightarrow\!2$	$8\!\rightarrow\!8$	$16\!\rightarrow\!2$
ImageNet	ResNet-50	$16\!\rightarrow\!4$	$8\!\rightarrow\!8$	$16\!\rightarrow\!8$
ImageNet	ViT-B/16	$4\!\rightarrow\!4$	$8\!\rightarrow\!8$	$32\!\rightarrow\!16$

Appendix

Table 14: Budget dependence of the

95\%

-retention operating point for all standard models. Smaller values correspond to tighter coordinate caps. Across the

18

model–attack comparisons, the higher budget selects a tighter cap in

10

cases and the same cap in eight; no comparison becomes looser.

Figure 10: Complete CIFAR-100 perturbation–concentration frontiers across both evaluated global budgets for ResNet-18 and WRN-28-10. Curves show APGD-L1, SLIDE, and FMN-L1 as the per-coordinate cap is tightened over the same predefined grid used in the main evaluation. Solid and dashed curves distinguish the two global budgets, and markers denote the independently selected

c^{\star}_{0.95}

operating points. No monotonic smoothing is applied. The SLIDE curves use the native

c=1

reference executions.

Structural metric	LPIPS $\rho_{s}$ [95% CI]	DISTS $\rho_{s}$ [95% CI]
$\ell_{\infty}$	$0.344\ [0.326,0.365]$	$0.418\ [0.400,0.439]$
Top- $1\%$ mass	$-0.301\ [-0.327,-0.274]$	$-0.218\ [-0.249,-0.187]$
Top- $5\%$ mass	$-0.051\ [-0.076,-0.024]$	$0.012\ [-0.014,0.037]$
$S_{\mathrm{eff}}$	$0.130\ [0.103,0.155]$	$0.076\ [0.045,0.106]$

Appendix

Table 15: Descriptive Spearman correlations between perturbation-structure metrics and LPIPS/DISTS over successful ImageNet/ResNet-50 perceptual-evaluation rows. Brackets give

95\%

sample-cluster bootstrap intervals. The estimates pool attacks and cap conditions and are not interpreted causally.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 451 papers

Don't Waste the Noise: Importance-Guided Perturbation Allocation under Joint Global and Local Constraints
Oct 1, 2026Melika Shirian, Kianoosh VadaeiAdversarial Attacks Adversarial Robustness
Independent Researcher
Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attacks
Feb 6, 2026Christof Duhme, Florian Eilers, Xiaoyi JiangAdversarial Attacks Adversarial Perturbations
Department of Computer Science University of Münster Münster, Germany
Pareto-Improving Adversarial Attacks with Primal-Dual Regularization
Oct 3, 2026Yang Dai, Longfei Zhang, Wei Tao +3Adversarial Attacks Transfer-Based Adversarial Attacks
Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410073, China

Oct 1, 2026J/K move · Enter open · S save

Don't Waste the Noise: Importance-Guided Perturbation Allocation under Joint Global and Local Constraints

Melika Shirian, Kianoosh Vadaei

Independent Researcher

Adversarial Attacks Adversarial Robustness Adversarial Perturbations

Open paper AskPDF arXiv

Adversarial optimization under a shared

\ell_1

budget requires deciding not only how much perturbation to use, but also where that limited budget should be spent. This allocation problem becomes particularly important when individual input coordinates are subject to local magnitude constraints, which restrict the extent to which perturbation can be concentrated on a small number of locations. We introduce an importance-guided allocation mechanism that uses a fixed clean-gradient prior to steer perturbation toward model-sensitive regions while leaving the feasible perturbation set unchanged. A centered allocation objective encourages perturbation at above-average importance locations and discourages unnecessary expenditure elsewhere, thereby redistributing rather than enlarging the available budget. Across ten robust model--dataset configurations under a common capacity-limited threat setting, the proposed method improves attack success over matched APGD- and PMA-based baselines by

2.52

17.70

percentage points. Allocation analysis shows that these gains are accompanied by substantially greater perturbation mass in high-importance regions without increased global

\ell_1

consumption. Mechanism ablations further show that centered non-uniform redistribution provides part of the benefit, while model-derived importance yields an additional improvement. These results identify perturbation allocation as a distinct and practically relevant dimension of adversarial optimization under shared-budget, locally constrained threat models.

Abstract

Adversarial Attacks

Explore similar work

Don't Waste the Noise: Importance-Guided Perturbation Allocation under Joint Global and Local Constraints

Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attacks

Pareto-Improving Adversarial Attacks with Primal-Dual Regularization