$L_p$ Norm Constraints define the geometry of allowed adversarial perturbations — the choice of $p$ (0, 1, 2, or ∞) determines the shape of the perturbation ball and the nature of the adversarial threat model.

$L_p$ Norm Comparison

• $L_infty$: Max absolute change per feature. Ball = hypercube. Spreads perturbation evenly across all features.
• $L_2$: Euclidean distance. Ball = hypersphere. Perturbation concentrated in a few features.
• $L_1$: Sum of absolute changes. Ball = cross-polytope. Sparse perturbation (few features changed a lot).
• $L_0$: Number of changed features. Sparsest — only a few features are modified.

Why It Matters

• Different Threats: Each $L_p$ models a different attack scenario ($L_infty$ = subtle overall shift, $L_0$ = few-pixel attack).
• Defense Mismatch: A defense robust under $L_infty$ may not be robust under $L_2$ — separate evaluation needed.
• Semiconductor: For sensor/process data, $L_infty$ models sensor drift; $L_0$ models individual sensor failure.

$L_p$ Norms are the geometry of attacks — different norms define different shapes of adversarial perturbation, each modeling a distinct threat.