This paper investigates the visual quality of the adversarial examples.
Recent papers propose to smooth the perturbations to get rid of high frequency
artefacts. In this work, smoothing has a different meaning as it perceptually
shapes the perturbation according to the visual content of the image to be
attacked. The perturbation becomes locally smooth on the flat areas of the
input image, but it may be noisy on its textured areas and sharp across its
edges.
This operation relies on Laplacian smoothing, well-known in graph signal
processing, which we integrate in the attack pipeline. We benchmark several
attacks with and without smoothing under a white-box scenario and evaluate
their transferability. Despite the additional constraint of smoothness, our
attack has the same probability of success at lower distortion.

本文研究对抗样本的视觉质量，探讨了不同于传统 smoothing 的新型 smoothing 方式，即基于 Laplacian smoothing，并以白盒攻击的场景为基础，对不同攻击方式的效果进行了比较和评估，得到新方法在可感知噪音畸变情况下，成功率相对较高的结论。

平滑对抗样本

Smooth Adversarial Examples

We consider the problem of estimating a function defined over $n$ locations
on a $d$-dimensional grid (having all side lengths equal to $n^{1/d}$). When
the function is constrained to have discrete total variation bounded by $C_n$,
we derive the minimax optimal (squared) $\ell_2$ estimation error rate,
parametrized by $n$ and $C_n$. Total variation denoising, also known as the
fused lasso, is seen to be rate optimal. Several simpler estimators exist, such
as Laplacian smoothing and Laplacian eigenmaps. A natural question is: can
these simpler estimators perform just as well? We prove that these estimators,
and more broadly all estimators given by linear transformations of the input
data, are suboptimal over the class of functions with bounded variation. This
extends fundamental findings of Donoho and Johnstone [1998] on 1-dimensional
total variation spaces to higher dimensions. The implication is that the
computationally simpler methods cannot be used for such sophisticated denoising
tasks, without sacrificing statistical accuracy. We also derive minimax rates
for discrete Sobolev spaces over $d$-dimensional grids, which are, in some
sense, smaller than the total variation function spaces. Indeed, these are
small enough spaces that linear estimators can be optimal---and a few
well-known ones are, such as Laplacian smoothing and Laplacian eigenmaps, as we
show. Lastly, we investigate the problem of adaptivity of the total variation
denoiser to these smaller Sobolev function spaces.

在高维离散空间中，假设函数具有有限的总变异性，本文通过导出最小化 (平方) L2 估计误差率，表明了：总变异性去噪（融合拉索）优于拉普拉斯平滑和拉普拉斯特征图等较简单的估计器。