elastic net attack

**Elastic Net Attack (EAD)** is an **adversarial attack that combines $L_1$ and $L_2$ perturbation penalties** — optimizing $min |x_{adv} - x|_1 + c cdot |x_{adv} - x|_2^2$ subject to misclassification, producing perturbations that are both sparse ($L_1$) and small ($L_2$). **How EAD Works** - **Objective**: $min c cdot f(x_{adv}) + eta |x_{adv} - x|_1 + |x_{adv} - x|_2^2$. - **$L_1$ Term ($eta$)**: Encourages sparsity — most features remain unchanged. - **$L_2$ Term**: Limits the magnitude of changes — keeps perturbations small. - **Optimization**: Uses ISTA (Iterative Shrinkage-Thresholding Algorithm) for the $L_1$ term. **Why It Matters** - **Mixed Sparsity**: Produces adversarial examples that are both sparse and small — more realistic perturbations. - **Flexible**: By adjusting $eta$, interpolate between $L_1$-like (sparse) and $L_2$-like (smooth) perturbations. - **Stronger Than C&W**: EAD can find adversarial examples that C&W $L_2$ alone misses. **EAD** is **the balanced adversarial attack** — combining sparsity and smoothness for adversarial perturbations that are both minimal and localized.