lp norm constraints

**$L_p$ Norm Constraints** define the **geometry of allowed adversarial perturbations** — the choice of $p$ (0, 1, 2, or ∞) determines the shape of the perturbation ball and the nature of the adversarial threat model. **$L_p$ Norm Comparison** - **$L_infty$**: Max absolute change per feature. Ball = hypercube. Spreads perturbation evenly across all features. - **$L_2$**: Euclidean distance. Ball = hypersphere. Perturbation concentrated in a few features. - **$L_1$**: Sum of absolute changes. Ball = cross-polytope. Sparse perturbation (few features changed a lot). - **$L_0$**: Number of changed features. Sparsest — only a few features are modified. **Why It Matters** - **Different Threats**: Each $L_p$ models a different attack scenario ($L_infty$ = subtle overall shift, $L_0$ = few-pixel attack). - **Defense Mismatch**: A defense robust under $L_infty$ may not be robust under $L_2$ — separate evaluation needed. - **Semiconductor**: For sensor/process data, $L_infty$ models sensor drift; $L_0$ models individual sensor failure. **$L_p$ Norms** are **the geometry of attacks** — different norms define different shapes of adversarial perturbation, each modeling a distinct threat.