State exactly which perturbations count

Let the original input lie in an explicitly declared domain, such as a real-valued image box. Intersect the perturbation ball with that domain, and say whether submitted inputs must also survive rounding, encoding, or another validity constraint. A continuous [0,1] threat does not automatically describe perturbations of integer image bytes. Preserve the original input used to compute the distance; projecting each step around the latest iterate would let an attack drift beyond its total budget.

Coordinatewise normalization changes geometry. If channel c is divided by standard deviation s_c, then a raw perturbation δ_c becomes δ_c/s_c in normalized coordinates. A uniform raw infinity-norm budget therefore becomes channel-dependent after normalization unless the scales coincide. Put preprocessing inside the model wrapper and measure the threat in its intended external coordinates. Otherwise two evaluators can use the same epsilon string while attacking substantially different sets of inputs.

A white-box evaluation may expose weights, preprocessing, and derivatives. A score-based interface exposes numeric outputs, while a label-only interface reveals less. State query limits, attacker knowledge of randomness, and whether repeated requests share state. Untargeted failure means an incorrect output; targeted failure requires a particular specified wrong output. Rejection may count as safe abstention, denial of service, or failure depending on the application. These are distinct success predicates and need separate denominators.

For ordinary deterministic classification, a sample is truly robust only if every allowed input preserves its correct label. Clean errors already fail this definition because the unperturbed input is feasible. An attack suite examines only some feasible candidates. The fraction surviving those candidates is therefore an upper bound on exact finite-test-set robust accuracy, provided success and feasibility are checked correctly. A failed search cannot supply a lower bound or a certificate of the universal property.

Record dataset version, selected examples, label policy, norm, epsilon, input scaling, model artifact, preprocessing, output rule, attack access, and compute budget. If the classifier is stochastic, define whether success means a single draw, a threshold misclassification probability, or a failure of an aggregated decision. Fixing one convenient random seed changes the attacked object unless the actual service uses that same deterministic decision rule. Test the object named in the report.

Norm relationships help diagnose budget mistakes but do not make threat models interchangeable. In d dimensions, a bounded infinity norm implies a Euclidean bound that grows with the square root of d; the converse gives a different set inclusion. Neither norm establishes perceptual equivalence or label preservation. A tiny change can matter for a task built around a small critical feature, while a large brightness shift may preserve another task’s label. Report the mathematical scope and semantic assumptions separately.