adversarial perturbation budget

**Adversarial Perturbation Budget ($epsilon$)** is the **maximum allowed perturbation magnitude that defines the threat model for adversarial robustness** — specifying how much an attacker can modify the input while the perturbation remains imperceptible, measured under a chosen $L_p$ norm. **Common Perturbation Budgets** - **$L_infty$, CIFAR-10**: $epsilon = 8/255 approx 0.031$ — each pixel can change by at most ~3%. - **$L_infty$, ImageNet**: $epsilon = 4/255 approx 0.016$ — smaller budget for higher resolution. - **$L_2$, CIFAR-10**: $epsilon = 0.5$ — total Euclidean perturbation magnitude. - **$L_0$**: Maximum number of pixels that can be changed (sparse perturbation). **Why It Matters** - **Threat Model Definition**: $epsilon$ defines what "adversarial" means — too small is trivial, too large is visible. - **Benchmark Standardization**: Standard $epsilon$ values enable fair comparison across defense methods. - **Accuracy Trade-Off**: Larger $epsilon$ requires more robustness sacrifice — the fundamental accuracy-robustness trade-off. **Perturbation Budget** is **the attacker's allowance** — the maximum "invisible" modification defining the boundary between legitimate and adversarial inputs.