The Madry Lab recently hosted a competition designed to test the robustness
of their adversarially trained MNIST model. Attacks were constrained to perturb
each pixel of the input image by a scaled maximal $L_\infty$ distortion
$\epsilon$ = 0.3. This discourages the use of attacks which are not optimized
on the $L_\infty$ distortion metric. Our experimental results demonstrate that
by relaxing the $L_\infty$ constraint of the competition, the elastic-net
attack to deep neural networks (EAD) can generate transferable adversarial
examples which, despite their high average $L_\infty$ distortion, have minimal
visual distortion. These results call into question the use of $L_\infty$ as a
sole measure for visual distortion, and further demonstrate the power of EAD at
generating robust adversarial examples.

研究通过实验结果证明，通过放宽对 L-infinity 约束条件，深度神经网络的弹性网络（EAD）可以构建可传递的对抗样本，这些样本具有最小的视觉失真度。这些结果对于通过最小化 L-infinity 距离来评价对抗性攻击的视觉失真度的有效性提出了质疑，并进一步展示了 EAD 的强大能力。