Adversarial attacks are often constrained by a global ℓ1 budget, which limits the total change an adversary can make to an image but leaves the distribution of that change unconstrained. A new arXiv preprint asks whether that freedom is essential: how much of an ℓ1 attack's observed success remains when large changes to individual coordinates are disallowed?
The question matters because ℓ1 attacks could succeed in two very different ways—by making a few large, concentrated edits or by spreading many small changes across the image. If success depends on concentrated perturbations, then defenses that cap per-pixel modifications could blunt the attack even when the global budget is generous.
The abstract is truncated, so the method and reported results are not yet available from this summary. The work is posted as arXiv:2610.27773v1.