The Budget That Says Nothing About Distribution
An adversarial attack against an image classifier is usually described by a single number: how much, in total, the pixels were allowed to move. In the standard formulation, that budget is an L1 constraint — the sum of absolute changes across every coordinate must stay under some bound B. What the constraint never specifies is where the change lands. The same total mass can be dumped onto a handful of pixels or smeared thinly across thousands, and both satisfy the budget identically. A new study by Melika Shirian, Kianoosh Vadaei, and Arshia Hemmat takes this gap seriously and asks a pointed question: how much of an L1 attack’s apparent success survives when you forbid it from making any single large change? [2] The answer turns out to be uncomfortable for anyone who assumed the concentration was the point.
The setup is deliberately modest. The authors add a per-coordinate cap c to the existing global budget, so the admissible perturbation set becomes the intersection of the L1 ball, a box of half-width c, and the valid image range. Setting c = 1 recovers the conventional threat set, since no pixel can move more than one unit anyway. Smaller caps carve nested subsets out of that set — a cap of 32/255 permits only a fraction of the coordinate-wise freedom of the uncapped case, and 2/255 permits almost none. Crucially, the global budget B stays fixed throughout. The experiment does not give the attacker less total room to work; it only forbids the attacker from spending that room in one place.
What the Frontier Shows
Across 18 standard-model settings — three attacks (APGD-L1, SLIDE, and FMN-L1) run against ResNet-18, WideResNet-28-10, ResNet-50, and ViT-B/16 on CIFAR-10, CIFAR-100, and ImageNet — the results are strikingly flat. Every one of those 18 configurations retains at least 95 percent of its native uncapped attack success rate at some evaluated cap no larger than 32/255. [2] The selected caps range from 2/255 to 32/255 depending on the setting. The median retention across the 18 standard-model settings is 97 percent. [2] In plain terms: you can take away the attack’s ability to make large local edits, and it barely notices.
The structural consequences of that restriction are large. At the selected operating points, the median peak magnitude of the perturbation falls by 80 percent, and the median effective support — a participation-ratio measure of how many coordinates carry the mass — nearly triples. [2]. The attack is not succeeding less; it is succeeding differently. Where an uncapped L1 attack tends to concentrate its budget on a small number of high-leverage pixels, the capped version spreads the same total across a much wider footprint, at much lower amplitude per coordinate.
This is the first place where the gap between appearance and mechanism opens up. An L1 attack looks sparse. It is often described as sparse. The sparsity is real in the sense that the optimizer, left to its own devices, does concentrate mass. But the concentration is not load-bearing. Remove it, and the classifier still fails.
The Control That Rules Out the Obvious Explanation
A skeptic could object that the capped attacks simply use less of their budget, and that a smaller realized perturbation is trivially less visible and perhaps trivially different in structure. The authors anticipate this and build a matched-realized-L1 comparison. For each successful capped perturbation, they record its actual L1 magnitude Ln(c) and rerun the uncapped attack on the same image with that value as its budget. Now the two perturbations share an input and approximately the same total mass, but were generated under different constraint geometries.
The structural difference persists. Capped perturbations remain distinct in peak magnitude, top-mass concentration, and effective support even at matched realized L1. The redistribution is not an artifact of under-spending the budget; it is a genuine change in how the attack allocates mass when the option to concentrate is withdrawn. The optimizer, denied its preferred few large edits, finds a broader solution that works about as well.
The Gap Between Optimizing and Clipping
The most consequential result in the paper concerns enforcement. A naive way to impose a coordinate cap is to run the uncapped attack and then clip any coordinate that exceeds the cap. This is cheap, requires no modification to the attack, and is almost certainly what a practitioner would try first. The authors compare it directly against in-loop projection — enforcing the joint constraint at every optimization step, so the attack can reallocate mass as it goes.
Post-hoc clipping loses up to 88 percentage points of attack success relative to in-loop constrained optimization. The clipped perturbation has had mass removed without being given a chance to redistribute it; the optimizer never sees the clipped geometry during search, so it never finds the broader solution that the capped feasible set would have permitted. The attack that appears to fail under clipping is not failing because the constraint is hard. It is failing because the constraint was applied after the fact, to a solution optimized for a different problem.
This is a clean, almost pedagogical illustration of a general principle: a constraint is not a post-processing step. But it also sharpens the deception angle. If you evaluate robustness by clipping an attack’s output and observing that it breaks, you will conclude the model is more robust than it is. The attack’s apparent failure is an artifact of your evaluation procedure, not a property of the model. The paper’s authors are explicit that they treat post-hoc clipping only as a control, not as a realization of the capped optimization procedure — and the 88-point gap is the reason why.
Where the Story Gets Messier
The clean headline — 97 percent retention, 80 percent lower peaks, triple the support — holds for standard models. It does not hold uniformly for adversarially trained ones. The paper reports a separate set of frontiers for robust classifiers: Croce-Hein L1-robust PreActResNet-18, MSD multi-norm PreActResNet-18, and L∞-robust XCiT-S12 on CIFAR-10, plus robust XCiT-S12 on ImageNet.
The results there are heterogeneous in a way that resists summary. Some robust models show high retention at tight caps, like their standard counterparts. Others do not. The L∞-trained XCiT-S12 on CIFAR-10, for instance, requires the uncapped condition to satisfy the 95 percent retention criterion under APGD-L1, because the attack’s success rate is already low enough that tightening the cap cannot meaningfully reduce it further. The same model under SLIDE selects a cap of 64/255. The concentration sensitivity is real but model-dependent, and the authors are careful to say so: adversarially trained classifiers exhibit more heterogeneous concentration sensitivity. [2].” There is a subtler wrinkle in the standard-model table as well. One entry shows a retention above 100 percent: CIFAR-100/WRN-28-10 under APGD-L1 retains 100.90 percent at a cap of 2/255, meaning the capped attack actually succeeds slightly more often than the uncapped one. The authors flag this explicitly as finite-compute non-monotonicity. Because the feasible sets are nested, a tighter cap cannot increase the true worst-case adversarial risk; any empirical increase is an artifact of the optimizer encountering different geometry, not evidence that the smaller threat set is stronger. The paper reports these frontiers without smoothing precisely because the non-monotonic regions are informative about optimization behavior, not about the underlying threat model.
The Perceptual Side
On ImageNet, the authors also measure LPIPS and DISTS — two learned perceptual distance metrics — between clean and adversarial images at the uncapped condition, the selected cap, and the next tighter cap. At selected caps, both metrics decrease. The paper reports, for ImageNet/ResNet-50, median LPIPS falling from 0.0155 to 0.0049 and median DISTS from 0.0194 to 0.0074. [2]. The authors are careful about what this does and does not mean: a decrease in a learned distance metric supports a claim of lower measured perceptual distortion, not a claim of human imperceptibility. They do not assert visibility thresholds or perceptual preference. The measurement is a supporting observation, not a security guarantee.
Still, the direction is consistent with the structural story. A perturbation spread thinly across many coordinates is, by these metrics, less perceptually disruptive than one concentrated on a few — even at the same total L1 mass. The attack that looks sparser is not the attack that looks less visible.
What the Frontier Actually Measures
The paper is careful to frame its central quantity — the retention ratio R(c) = F(c) / F(1), and the operating point c^⋆0.95 defined as the tightest cap retaining at least 95 percent of native uncapped success — as a property of the specified attack implementations, not as a claim about best-achievable adversarial success. This distinction matters. The retention statistic characterizes what these particular optimizers do when their feasible set is narrowed. It does not say that no attack could do better under the cap, nor that the capped threat set is equivalent to the uncapped one. The authors state plainly that they never treat capped and uncapped conditions as equivalent adversarial capabilities. [2].” What the frontier does establish is that perturbation concentration is a separate axis of L1 attack evaluation, orthogonal to the total budget. A single uncapped ASR number collapses that axis to a point. Sweeping the cap at fixed budget recovers the curve, and the curve shows that for standard models, the attack’s effectiveness is largely insensitive to how concentrated its perturbation is — even though its structure changes dramatically.
The controls reinforce this. Stronger optimization profiles — five restarts instead of one for APGD-L1, 500 steps instead of 100 for FMN-L1 — preserve high-retention behavior in the tested configurations, with the strengthened attacks retaining 95.8 percent and 96.3 percent of their respective uncapped success rates at the selected caps. A 700-image ImageNet audit evaluating best-of-k APGD-L1 for k = 1, …, 5 and 500-step FMN-L1 at c ∈ \{1, 64/255\} confirms that the retention is not an artifact of weak optimization. And an external anchor — official L1 AutoAttack at B=4, c=1 on 1,000 fixed CIFAR-10/ResNet-18 images — provides a reference point against which the capped conditions can be compared.
The Gap That Isn’t Quite a Deception
It would be easy to read this paper as a story about evaluation misleading us: the attack looks sparse, but it doesn’t need to be; the defense looks robust, but only because the evaluation clipped the attack’s output. That reading is not wrong, but it is too simple. The paper is not about a model lying. It is about an evaluation convention — the global norm budget — that has been treated as if it fully specified the threat, when in fact it specifies only one dimension of it.
The gap, such as it is, lives between the convention and the mechanism. An L1 budget says how much an adversary may change. It does not say how the adversary will spend it. The optimizer, left alone, concentrates; the concentration is visible in the perturbation plots; and it is natural to assume the concentration is what makes the attack work. The capped experiments show that assumption is false for standard models. The attack works just as well when the concentration is forbidden, and it works better under in-loop enforcement than under post-hoc clipping, because the optimizer can find the broader solution only if it is allowed to search for it.
The practical implication is not that L1 attacks are stronger than we thought, nor that they are weaker. It is that a robustness number computed under a single uncapped evaluation is incomplete in a specific, measurable way. The attack’s success rate tells you how often it succeeds. It does not tell you how much of that success depends on a structural property — concentration — that the evaluation never varied. The paper’s contribution is to vary it, and to show that for standard models, the answer is: not much.
The Question That Remains Open
The authors close by proposing perturbation concentration as a complementary, model- and attack-dependent axis of L1 attack evaluation, and the word “complementary” is doing real work. The frontier does not replace the conventional ASR measurement; it sits alongside it, and the two together say more than either alone. The suitable cap varies across attacks and models, and the robust-model results are heterogeneous enough that no single cap can be recommended as a universal operating point.
What the paper establishes is a method and a set of baseline observations. What it does not establish is a general theory of why some models are more concentration-sensitive than others, or how the frontier behaves under attack families not tested here, or whether the perceptual improvements at selected caps translate into any meaningful security property. The authors are explicit about the limits: the retention statistic characterizes the specified implementations, the perceptual metrics are supporting measurements rather than guarantees, and the finite-compute non-monotonicities are optimization artifacts rather than threat-set reversals.
The next question, then, is not whether L1 attacks need concentrated perturbations. For standard models, the answer is clearly no. [2] The next question is which models, under which training regimes, do depend on concentration — and what that dependence tells us about the robustness they actually have, as opposed to the robustness their evaluation scores suggest. That is a question the frontier makes askable. It does not answer it.