Elastic Net Attack (EAD) is an adversarial attack that combines $L_1$ and $L_2$ perturbation penalties — optimizing $min |x_{adv} - x|_1 + c cdot |x_{adv} - x|_2^2$ subject to misclassification, producing perturbations that are both sparse ($L_1$) and small ($L_2$).

How EAD Works

• Objective: $min c cdot f(x_{adv}) + eta |x_{adv} - x|_1 + |x_{adv} - x|_2^2$.
• $L_1$ Term ($eta$): Encourages sparsity — most features remain unchanged.
• $L_2$ Term: Limits the magnitude of changes — keeps perturbations small.
• Optimization: Uses ISTA (Iterative Shrinkage-Thresholding Algorithm) for the $L_1$ term.

Why It Matters

• Mixed Sparsity: Produces adversarial examples that are both sparse and small — more realistic perturbations.
• Flexible: By adjusting $eta$, interpolate between $L_1$-like (sparse) and $L_2$-like (smooth) perturbations.
• Stronger Than C&W: EAD can find adversarial examples that C&W $L_2$ alone misses.

EAD is the balanced adversarial attack — combining sparsity and smoothness for adversarial perturbations that are both minimal and localized.