L-Infinity Attacks

$L_\infty$ Attacks are adversarial attacks that perturb every input feature by at most $\epsilon$ — constrained within a hypercube $|x - x_{adv}|_\infty \leq \epsilon$, making small, imperceptible changes to all features simultaneously.

Key $L_\infty$ Attack Methods

• FGSM: Single-step sign of gradient: $x_{adv} = x + \epsilon \cdot \text{sign}(\nabla_x L)$.
• PGD: Multi-step projected gradient descent with random start — the standard strong attack.
• AutoAttack: Ensemble of parameter-free attacks (APGD-CE, APGD-DLR, FAB, Square) — the benchmark standard.
• C&W $L_\infty$: Lagrangian relaxation of the constraint for minimum $\epsilon$ finding.

Why It Matters

• Standard Threat Model: $L_\infty$ is the most common threat model in adversarial robustness research.
• Imperceptibility: Small per-pixel changes are the least visible to human inspectors.
• Practical: Models sensor drift in industrial settings where all readings shift slightly.

$L_\infty$ Attacks are the subtle, everywhere perturbation — small, uniform changes across all features that are the standard threat model in adversarial ML.