Adversarial Perturbation Budget

Adversarial Perturbation Budget ($epsilon$) is the maximum allowed perturbation magnitude that defines the threat model for adversarial robustness — specifying how much an attacker can modify the input while the perturbation remains imperceptible, measured under a chosen $L_p$ norm.

Common Perturbation Budgets

• $L_\infty$, CIFAR-10: $epsilon = 8/255 approx 0.031$ — each pixel can change by at most ~3%.
• $L_\infty$, ImageNet: $epsilon = 4/255 approx 0.016$ — smaller budget for higher resolution.
• $L_2$, CIFAR-10: $epsilon = 0.5$ — total Euclidean perturbation magnitude.
• $L_0$: Maximum number of pixels that can be changed (sparse perturbation).

Why It Matters

• Threat Model Definition: $epsilon$ defines what "adversarial" means — too small is trivial, too large is visible.
• Benchmark Standardization: Standard $epsilon$ values enable fair comparison across defense methods.
• Accuracy Trade-Off: Larger $epsilon$ requires more robustness sacrifice — the fundamental accuracy-robustness trade-off.

Perturbation Budget is the attacker's allowance — the maximum "invisible" modification defining the boundary between legitimate and adversarial inputs.