CyberCertPrepAI Security FundamentalsAdversarial ML & Model AttacksEASYFree question
An attacker wants to cause a specific misclassification in a facial-recognition system without the change being visible to a human observer. Which constraint governs what perturbations are considered "imperceptible"?
- A.A. The perturbation must be less than 1 pixel in size
- B.C. The perturbation must not change the image file size
- C.B. The perturbation magnitude must be below a chosen Lp norm bound (most commonly L∞ norm with epsilon = 8/255 for images) - changes within this bound are typically imperceptible to humans
- D.D. The perturbation must preserve the original image's color palette
Why C is correct
Adversarial machine learning research operationalizes imperceptibility using Lp norms. The L∞ norm with epsilon = 8/255 (a per-pixel change of at most 8 out of 256 intensity values) is the most common benchmark for "imperceptible" perturbations in image classification research. L2 norm bounds are also used. These are mathematical proxies for human perception - not perfect, but standardized enough for reproducible research. Pixel count, file size, and color palette are not the standard constraints.
Know someone studying for AI Security Fundamentals? Send them this one.