%PDF-1.7
%
1 0 obj
<< /Metadata 3 0 R /Pages 4 0 R /Type /Catalog >>
endobj
2 0 obj
<< /Author (Jerome Rony; Eric Granger; Marco Pedersoli; Ismail Ben Ayed) /Producer (pikepdf 3.1.0) /Subject (IEEE International Conference on Computer Vision) /Title (Augmented Lagrangian Adversarial Attacks) >>
endobj
3 0 obj
<< /Subtype /XML /Type /Metadata /Length 1147 >>
stream
Augmented Lagrangian Adversarial AttacksJerome Rony Eric Granger Marco Pedersoli Ismail Ben AyedIEEE International Conference on Computer Vision
endstream
endobj
4 0 obj
<< /Count 10 /Kids [ 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R ] /Type /Pages >>
endobj
5 0 obj
<< /Annots [ 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R ] /Contents [ 41 0 R 42 0 R 43 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /Font 44 0 R /ProcSet [ /PDF /Text ] /XObject << /CSCbI66b4AFWSf7BtE4gmg 45 0 R /eSwW01OiyrsYO-dmo3yIPA 46 0 R >> >> /Rotate 0 /Type /Page >>
endobj
6 0 obj
<< /Annots [ 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R ] /Contents [ 58 0 R 59 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /Font 60 0 R /ProcSet [ /PDF /Text ] /XObject << /NJU33yf71HRcS9uZDmvhcw 61 0 R >> >> /Rotate 0 /Type /Page >>
endobj
7 0 obj
<< /Annots [ 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R 76 0 R 77 0 R 78 0 R ] /Contents [ 79 0 R 80 0 R ] /Group 81 0 R /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /ExtGState 82 0 R /Font 83 0 R /ProcSet [ /PDF /Text ] /XObject 84 0 R >> /Rotate 0 /Type /Page >>
endobj
8 0 obj
<< /Annots [ 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R ] /Contents [ 93 0 R 94 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /Font 95 0 R /ProcSet [ /PDF /Text ] /XObject << /I-nvOhjN9yJBUSLgDM7FeQ 96 0 R >> >> /Rotate 0 /Type /Page >>
endobj
9 0 obj
<< /Annots [ 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R ] /Contents [ 107 0 R 108 0 R ] /Group 81 0 R /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /ExtGState 109 0 R /Font 110 0 R /ProcSet [ /PDF /Text ] /XObject 111 0 R >> /Rotate 0 /Type /Page >>
endobj
10 0 obj
<< /Annots [ 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R ] /Contents [ 144 0 R 145 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /Font 146 0 R /ProcSet [ /PDF /Text ] /XObject << /oskxqV6OwiqrEq5BI4DFtg 147 0 R >> >> /Rotate 0 /Type /Page >>
endobj
11 0 obj
<< /Annots [ 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R ] /Contents [ 172 0 R 173 0 R ] /Group 81 0 R /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /ExtGState 174 0 R /Font 175 0 R /ProcSet [ /PDF /Text ] /XObject 176 0 R >> /Rotate 0 /Type /Page >>
endobj
12 0 obj
<< /Annots [ 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R ] /Contents [ 201 0 R 202 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /Font 203 0 R /ProcSet [ /PDF /Text ] /XObject << /CDQjh7CqQ0A5F3RijeX2ZQ 204 0 R >> >> /Rotate 0 /Type /Page >>
endobj
13 0 obj
<< /Annots [ 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R ] /Contents [ 266 0 R 267 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /Font 268 0 R /ProcSet [ /PDF /Text ] /XObject << /TuKdqwf40z_DMJtUdzN_qQ 269 0 R >> >> /Rotate 0 /Type /Page >>
endobj
14 0 obj
<< /Annots [ 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R ] /Contents [ 280 0 R 281 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources << /Font 282 0 R /ProcSet [ /PDF /Text ] /XObject << /vsh8zKMM1XgEHkJXfoguXw 283 0 R >> >> /Rotate 0 /Type /Page >>
endobj
15 0 obj
<< /A << /S /URI /Type /Action /URI (https://github.com/jeromerony/augmented_lagrangian_adversarial_attacks) >> /Border [ 0 0 0 ] /C [ 0 1 1 ] /Rect [ 120.422 631.829 499.002 647.77 ] /Subtype /Link /Type /Annot >>
endobj
16 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 471.009 null ] /Rect [ 153.011 205.306 159.985 214.028 ] /Subtype /Link /Type /Annot >>
endobj
17 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 391.455 null ] /Rect [ 232.308 181.251 239.282 190.257 ] /Subtype /Link /Type /Annot >>
endobj
18 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 14 0 R /XYZ 50.112 720.0 null ] /Rect [ 71.175 169.376 83.131 178.302 ] /Subtype /Link /Type /Annot >>
endobj
19 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 102.531 null ] /Rect [ 52.45 133.51 64.405 142.436 ] /Subtype /Link /Type /Annot >>
endobj
20 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 14 0 R /XYZ 50.112 419.857 null ] /Rect [ 126.063 133.51 138.018 142.436 ] /Subtype /Link /Type /Annot >>
endobj
21 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 542.142 null ] /Rect [ 184.652 133.65 196.607 142.436 ] /Subtype /Link /Type /Annot >>
endobj
22 0 obj
<< /A << /S /URI /Type /Action /URI (jerome.rony.1@etsmtl.net) >> /Border [ 0 0 0 ] /C [ 0 1 1 ] /Rect [ 137.878 77.164 254.64 88.621 ] /Subtype /Link /Type /Annot >>
endobj
23 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 655.018 null ] /Rect [ 329.56 594.828 341.515 603.755 ] /Subtype /Link /Type /Annot >>
endobj
24 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 630.189 null ] /Rect [ 391.868 582.793 403.823 591.799 ] /Subtype /Link /Type /Annot >>
endobj
25 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 349.224 null ] /Rect [ 343.417 547.008 355.372 555.934 ] /Subtype /Link /Type /Annot >>
endobj
26 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 471.009 null ] /Rect [ 487.84 523.162 494.814 531.884 ] /Subtype /Link /Type /Annot >>
endobj
27 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 569.028 null ] /Rect [ 433.238 438.965 440.212 447.892 ] /Subtype /Link /Type /Annot >>
endobj
28 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 249.043 null ] /Rect [ 443.226 439.105 455.181 447.892 ] /Subtype /Link /Type /Annot >>
endobj
29 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 496.072 null ] /Rect [ 458.195 439.105 470.15 447.892 ] /Subtype /Link /Type /Annot >>
endobj
30 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 393.478 null ] /Rect [ 473.164 438.965 485.119 447.892 ] /Subtype /Link /Type /Annot >>
endobj
31 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 349.224 null ] /Rect [ 488.133 438.965 500.088 447.892 ] /Subtype /Link /Type /Annot >>
endobj
32 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 496.072 null ] /Rect [ 476.8 355.418 488.755 364.205 ] /Subtype /Link /Type /Annot >>
endobj
33 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 349.224 null ] /Rect [ 491.071 331.369 503.027 340.295 ] /Subtype /Link /Type /Annot >>
endobj
34 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 249.043 null ] /Rect [ 311.25 295.643 323.205 304.43 ] /Subtype /Link /Type /Annot >>
endobj
35 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 393.478 null ] /Rect [ 481.607 295.503 493.562 304.43 ] /Subtype /Link /Type /Annot >>
endobj
36 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 114.377 null ] /Rect [ 387.175 271.593 399.13 280.519 ] /Subtype /Link /Type /Annot >>
endobj
37 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 569.028 null ] /Rect [ 505.57 223.772 512.544 232.699 ] /Subtype /Link /Type /Annot >>
endobj
38 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 14 0 R /XYZ 50.112 419.857 null ] /Rect [ 395.277 115.73 407.232 124.656 ] /Subtype /Link /Type /Annot >>
endobj
39 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 542.142 null ] /Rect [ 455.649 115.869 467.604 124.656 ] /Subtype /Link /Type /Annot >>
endobj
40 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 14 0 R /XYZ 50.112 519.892 null ] /Rect [ 471.03 115.73 482.985 124.656 ] /Subtype /Link /Type /Annot >>
endobj
41 0 obj
<< /Length 22441 >>
stream
q 0.1 0 0 0.1 0 0 cm
0 g
q
10 0 0 10 0 0 cm BT
/R7 14.3462 Tf
1 0 0 1 161.561 703.76 Tm
[(A)50.0017(ugmented)-250.003(Lagrangian)-250.008(Adv)10.0014(ersarial)-250.012(Attacks)]TJ
/R9 11.9552 Tf
-46.2578 -37.8582 Td
(J)Tj
5.31406 0.0589844 Td
Tj
-0.664063 -0.0589844 Td
(er)Tj
10.2879 0.0589844 Td
<88>Tj
-0.998828 -0.0589844 Td
[(ome)-250.011(Ron)15(y)]TJ
/R9 7.9701 Tf
49.3027 2.57695 Td
(*)Tj
/R9 11.9552 Tf
26.9 -2.57695 Td
[(Eric)-250.008(Granger)-2250(Marco)-249.993(Pedersoli)-2250(Ismail)-250.014(Ben)-249.985(A)92.0102(yed)]TJ
38.877 -12.3379 Td
Tj
-1.66172 -2.60625 Td
[(ETS)-250.014(Montreal,)-250.01(Canada)]TJ
/R9 8.9664 Tf
-145.442 -13.9477 Td
(Code:)Tj
ET
Q
0 1 0 0 k
q
10 0 0 10 0 0 cm BT
/R11 8.9664 Tf
1 0 0 1 121.418 637.01 Tm
(https://github.com/jeromerony/augmented_lagrangian_adversarial_attacks)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R7 11.9552 Tf
1 0 0 1 145.995 595.964 Tm
(Abstract)Tj
/R13 9.9626 Tf
1.007 0 0 1 62.0672 572.046 Tm
[(Adver)9.98663(sarial)-246.989(attac)19.9964(k)-247.008(algorithms)-247.006(ar)36.9898(e)-247.008(dominated)-246.014(by)-246.992(penalty)]TJ
1.02 0 0 1 50.1121 560.09 Tm
[(methods,)-519.007(whic)14.9953(h)-465.007(ar)36.009(e)-463.999(slow)-464.001(in)-465.007(pr)14.9821(actice)10.0041(,)-519(or)-464.984(mor)36.9844(e)-464.998(ef)18.0045(\002cient)]TJ
11.9551 TL
T*[(distance-customized)-367.016(methods,)-397.997(whic)14.9953(h)-366.984(ar)36.009(e)-367.014(heavily)-367.012(tailor)36.0138(ed)]TJ
T*[(to)-256.007(the)-255.992(pr)45.004(operties)-256.004(of)-256.007(the)-255.992(distance)-255.983(consider)36.994(ed.)-336.002(W)89.9864(e)-255.998(pr)44.0046(opose)-255.996(a)]TJ
0.987 0 0 1 50.1121 524.225 Tm
[(white-box)-253.007(attac)19.9981(k)-252.985(algorithm)-253(to)-252.004(g)9.98478(ener)15.0113(ate)-253.011(minimally)-252.98(perturbed)]TJ
0.981 0 0 1 50.1121 512.27 Tm
[(adver)9.98402(sarial)-255.002(e)20.0136(xamples)-254.981(based)-255.003(on)-255.012(A)19.9855(ugmented)-255.019(La)9.98214(gr)15.0082(angian)-255.012(prin-)]TJ
1.02 0 0 1 50.1121 500.315 Tm
[(ciples.)-393.012(W)90.9859(e)-274.988(bring)-275(se)14.9893(ver)15.0037(al)-274.996(algorithmic)-274.005(modi\002cations,)-282.003(whic)13.9947(h)]TJ
11.9559 TL
T*[(have)-338.003(a)-337(crucial)-337.982(ef)18.0033(fect)-337.017(on)-337.993(performance)15.0025(.)-581.004(Our)-338.001(attac)20.0154(k)-337.991(enjoys)]TJ
0.98 0 0 1 50.1121 476.404 Tm
[(the)-252.984(g)10.0055(ener)15.9894(ality)-252.994(of)-253(penalty)-252.985(methods)-252.996(and)-253.009(the)-252.984(computational)-253.007(ef)17.9967<022d>]TJ
11.9547 TL
T*[(ciency)-211.005(of)-211.991(distance-customized)-210.98(algorithms,)-220.001(and)-212(can)-210.987(be)-210.989(r)36.9986(eadily)]TJ
1.02 0 0 1 50.1121 452.494 Tm
[(used)-245.008(for)-245.99(a)-245.012(wide)-245.015(set)-245.982(of)-245.013(distances.)-303.987(W)89.9864(e)-246.004(compar)37.0108(e)-246.004(our)-244.983(attac)20.0154(k)-246.004(to)]TJ
1.001 0 0 1 50.1121 440.539 Tm
[(state-of-the-art)-251.013(methods)-251.013(on)-251.99(thr)36.985(ee)-250.984(datasets)-251.018(and)-251.995(se)15.0143(ver)14.9825(al)-250.996(mod-)]TJ
1.011 0 0 1 50.1121 428.584 Tm
[(els,)-247.001(and)-248.006(consistently)-247.012(obtain)-248.016(competitive)-247.008(performances)-247.99(with)]TJ
1 0 0 1 50.1121 416.628 Tm
[(similar)-249.995(or)-249.986(lower)-250.01(computational)-250.013(comple)20.0089(xity)55.0153(.)]TJ
/R7 11.9552 Tf
35.8891 TL
T*[(1.)-249.99(Intr)18.0146(oduction)]TJ
/R9 9.9626 Tf
1.008 0 0 1 62.0672 361.802 Tm
[(The)-246.987(last)-247.982(fe)24.9859(w)-246.987(years)-247.994(ha)20.0179(v)14.9818(e)-246.984(seen)-247.989(an)-247.017(arms)-247.004(race)-248.001(in)-247(adv)15.0049(ersarial)]TJ
1.015 0 0 1 50.1121 349.847 Tm
[(attacks,)-246.017(where)-247.018(s)1.00317(e)24.018(v)15.004(eral)-245.981(methods)-246.981(ha)20.0162(v)15.004(e)-246.004(been)-246.986(proposed)-245.992(to)-245.996<026e64>]TJ
1.02 0 0 1 50.1121 337.892 Tm
[(minimally)-291.994(perturbed)-291.995(adv)15.0194(ersarial)-291.986(e)14.0067(xamples.)-444.01(In)-291.995(most)-291.998(cases,)]TJ
11.9563 TL
T*[(adv)15.0188(ersarial)-341.996(e)14.0067(xample)-341.995(generation)-341.983(is)-341.982(stated)-341.987(as)-343.006(a)-341.989(constrained)]TJ
11.9551 TL
T*[(optimization,)-380.018(which)-353.995(seeks)-352.995(the)-354.015(smallest)-352.998(additi)24.0132(v)14.9989(e)-352.983(perturba-)]TJ
T*[(tion,)-358(according)-334.987(to)-335.002(some)-335.996(distance,)-357.012(to)-336(misclassify)-334.988(an)-334.986(input.)]TJ
T*[(Existing)-260.018(methods)-259.988(f)9.98608(all)-260.997(within)-259.985(tw)10.0077(o)-260.004(cate)14.9953(gories:)-335.005(atta)0.987436(cks)-261.005(using)]TJ
/R13 9.9626 Tf
0.996 0 0 1 50.1121 278.116 Tm
(penalty)Tj
/R9 9.9626 Tf
31.8312 0 Td
[(methods)-250.994(for)-251.001(constrained)-250.989(optimization,)-250.992(and)-251.993(dista)1.01615(nce-)]TJ
0.995 0 0 1 50.1121 266.161 Tm
[(customized)-252.002(attacks)-253.02(le)24.9835(v)14.9891(eraging)-252.01(the)-253.012(properti)1.01471(es)-252.995(of)-252.01(the)-253.012(distance)]TJ
1 0 0 1 50.1121 254.205 Tm
[(considered)-249.98(\(typically)]TJ
/R15 9.9626 Tf
86.325 0 Td
[(`)-0.699638]TJ
/R17 6.9738 Tf
4.15078 -1.49414 Td
[(p)-0.899712]TJ
/R9 9.9626 Tf
4.60508 1.49414 Td
(-norms\).)Tj
1.02 0 0 1 62.0672 242.242 Tm
[(Penalties)-526.987(are)-526.998(a)-527.003(natural)-526.986(choice,)-598.016(as)-527.019(the)15.011(y)-527.01(transform)-526.988(a)]TJ
0.98 0 0 1 50.1121 230.287 Tm
[(constrained-optimization)-247.989(problem)-247.995(into)-247.98(an)-247.998(unconstrained)-248.005(one.)]TJ
1.02 0 0 1 49.6441 218.332 Tm
[(W)38.9989(ithin)-312.009(this)-312.992(cate)14.9953(gory)63.0145(,)-328.988(the)-313(most)-311.985(notorious)-313.012(attack)-312.011(is)-312.998(the)-313(one)]TJ
0.984 0 0 1 50.1121 206.377 Tm
[(from)-253.983(Carlini)-254.015(and)-253.987(W)81.997(agner)-253.998([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 154.007 206.377 Tm
(7)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.984 0 0 1 158.988 206.377 Tm
[(])-253.982(kno)24.9951(wn)-253.005(for)-254.018(its)]TJ
/R15 9.9626 Tf
1 0 0 1 219.337 206.377 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15078 -1.49492 Td
[(2)-0.500618]TJ
/R9 9.9626 Tf
0.984 0 0 1 230.446 206.377 Tm
[(v)24.9889(ariant.)-314.986(Build-)]TJ
1.02 0 0 1 50.1121 194.422 Tm
[(ing)-357.982(on)-358.981(the)-358.013(w)10.0077(ork)-357.99(of)-358.997(Carlini)-358(and)-358.006(W)78.0159(agner)39.0121(,)-385.996(se)23.9844(v)14.9989(eral)-358.014(other)-358.016(at-)]TJ
11.9559 TL
T*[(tacks)-308.004(ha)19.0099(v)14.9983(e)-309.008(been)-307.982(proposed,)]TJ
/R13 9.9626 Tf
109.211 0 Td
[(e)15.0061(.g)]TJ
/R9 9.9626 Tf
11.7494 0 Td
[(.)-308(EAD)-309.004(for)]TJ
/R15 9.9626 Tf
1 0 0 1 218.166 182.466 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15117 -1.49414 Td
[(1)-0.500618]TJ
/R9 9.9626 Tf
1.02 0 0 1 229.92 182.466 Tm
([)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 233.304 182.466 Tm
(9)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 238.285 182.466 Tm
[(])-307.994(and)-308.995(StrAt-)]TJ
0.983 0 0 1 50.1121 170.511 Tm
[(tack)-254.012([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 72.1719 170.511 Tm
(31)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.983 0 0 1 82.134 170.511 Tm
[(],)-253.994(which)-253.015(generalizes)-254.004(EAD)-252.995(and)-254(introduces)-252.987(sparsity)-254.007(in)]TJ
1.016 0 0 1 50.1121 158.556 Tm
[(the)-246.992(perturbations.)-306.981(More)-246.018(recently)64.0079(,)-246.983(other)-246.994(w)9.98318(orks)-246.987(ha)20(v)14.016(e)-246.02(tackled)]TJ
1.02 0 0 1 50.1121 146.601 Tm
[(other)-279.981(distances)-281.016(than)-280.011(the)-280.017(standard)]TJ
/R15 9.9626 Tf
1 0 0 1 186.834 146.601 Tm
[(`)-0.699638]TJ
/R17 6.9738 Tf
4.15117 -1.49414 Td
[(p)-0.899712]TJ
/R9 9.9626 Tf
1.02 0 0 1 195.59 146.601 Tm
[(-norms,)-288.987(such)-279.987(as)-281.001(SSIM)]TJ
1.005 0 0 1 50.1121 134.646 Tm
([)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 53.4461 134.646 Tm
(16)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.005 0 0 1 63.409 134.646 Tm
[(],)-249.014(CIEDE2000)-247.993([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 127.059 134.646 Tm
(37)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.005 0 0 1 137.022 134.646 Tm
[(])-249.012(or)-248.001(LPIPS)-249.02([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 185.648 134.646 Tm
(21)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.005 0 0 1 195.611 134.646 Tm
[(],)-249.015(and)-248(follo)24.9861(wed)-249.005(similar)]TJ
1.01 0 0 1 50.1121 122.691 Tm
[(penalty-based)-247.982(strate)15.0104(gies.)-309.012(Although)-248.003(con)40.0025(v)15.0091(enient)-247.998(and)-248.01(applica-)]TJ
0.994 0 0 1 50.1121 110.735 Tm
[(ble)-252.011(to)-252.995(a)-251.982(wide)-253.013(class)-251.988(of)-252.983(distances,)-252.989(penalty)-252.019(methods)-252.007(are)-253.01(kno)25.0037(wn)]TJ
0.98 0 0 1 50.1121 98.7801 Tm
[(to)-235.996(result)-236.013(in)-235.996(slo)26.0136(w)-235.984(con)39.9931(v)16.0075(er)17.9829(gence)-235.999(in)-235.996(the)-236.02(general)-235.98<02656c64>-235.99(of)-236.01(optimiza-)]TJ
ET
Q
3.98 w
0 G
501.121 904.148 m
1446.11 904.148 l
S
q
10 0 0 10 0 0 cm BT
/R9 5.9776 Tf
1 0 0 1 60.9711 82.4922 Tm
(*)Tj
/R9 7.9701 Tf
3.48672 -1.49219 Td
[(Corresponding)-250(author:)]TJ
ET
Q
0 1 0 0 k
q
10 0 0 10 0 0 cm BT
/R11 7.9701 Tf
1 0 0 1 138.875 81 Tm
(jerome.rony.1@etsmtl.net)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 308.862 595.964 Tm
[(tion)-246.006([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 330.556 595.964 Tm
(18)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 340.519 595.964 Tm
[(].)-306.009(Furthermore,)-246.009(choosing)-245.989(the)-245.999(weight)-246.018(of)-245.98(the)-245.999(penalty)]TJ
-31.0363 -11.9551 Td
[(is)-313.997(not)-314.007(a)-313.005(tri)24.0156(vial)-314(task)-313.015([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 392.864 584.009 Tm
(19)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 402.827 584.009 Tm
[(].)-510.012(In)-313.981(f)9.98488(act,)-331(in)-314.014(adv)15.0206(ersarial)-314.009(attacks,)-330.995(it)]TJ
-92.1224 -11.9551 Td
[(has)-346.996(recently)-346.994(been)-346.999(sho)23.9844(wn)-346.982(that)-346.982(the)-346.982(optimal)-347.006(penalty)-346.991(weight)]TJ
11.9559 TL
T*[(actually)-250.002(v)24.9934(aries)-251.013(by)-250.004(orders)-249.985(of)-250.016(magnitude)-249.997(across)-249.982(samples)-250.006(and)]TJ
11.9551 TL
T*[(models)-275.985([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 344.413 548.143 Tm
(26)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 354.376 548.143 Tm
[(].)-397.997(Although)-276.994(penalty)-275.992(methods)-277.015(can)-276.006(achie)23.9964(v)14.9965(e)-276.987(com-)]TJ
-44.6216 -11.9551 Td
[(petiti)25.0054(v)14(e)-338.991(performance,)-361.99(the)15.011(y)-339(typically)-338.996(require)-338.981(an)-338.986(e)15.0061(xpensi)25.0054(v)13.9971(e)]TJ
11.9551 TL
T*[(line-search)-258.014(to)-257.005<026e64>-258(optimal)-258.016(penalt)1(y)-258.007(weights)-257.988([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 488.837 524.233 Tm
(7)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 493.818 524.233 Tm
[(],)-260.995(thereby)-257.012(re-)]TJ
1.013 0 0 1 308.862 512.278 Tm
[(quiring)-245.989(lar)16.9822(ge)-246.015(numbers)-245.993(of)-246.005(iterations.)-306.014(This)-247.017(may)-246.005(impede)-245.991(their)]TJ
1.02 0 0 1 308.862 500.323 Tm
[(practical)-361.017(deplo)9.98968(yment)-360.998(for)-360.003(training)-361.008(rob)19.9938(ust)-361.003(models)-361.017(and)-360.003(ef)23.9916<02>1(-)]TJ
1 0 0 1 308.862 488.367 Tm
[(ciently)-250.015(e)25.0105(v)24.9811(aluating)-250.01(rob)20.004(ustness.)]TJ
0.983 0 0 1 320.817 475.966 Tm
[(T)81.0184(o)-252.992(accelerate)-252.985(the)-252.99(generation)-253.987(of)-253.01(adv)15.0026(ersarial)-253.005(e)15.0126(xamples,)-252.995(and)]TJ
1.003 0 0 1 308.862 464.011 Tm
[(impro)14.9893(v)14.9868(e)-248.004(performance)-248.013(o)14.9868(v)14.9868(er)-247.989(penalty)-248.009(methods,)-249(there)-247.999(has)-247.994(been)]TJ
1.02 0 0 1 308.862 452.056 Tm
[(an)-304.003(intensi)23.9964(v)14.9989(e)-304.01(focus)-303.984(on)-304.013(de)24.0084(v)14.9965(eloping)-303.986(ef)23.9916<02>1(cient)-303.991(algorithms)-304.01(cus-)]TJ
1.009 0 0 1 308.862 440.101 Tm
[(tomized)-247.991(for)-248.015(speci\002c)]TJ
/R15 9.9626 Tf
1 0 0 1 391.16 440.101 Tm
[(`)-0.700863]TJ
/R17 6.9738 Tf
4.15078 -1.49414 Td
[(p)-0.899712]TJ
/R9 9.9626 Tf
1.009 0 0 1 399.916 440.101 Tm
[(-norms)-248.006([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 434.235 440.101 Tm
(5)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.009 0 0 1 439.216 440.101 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 444.222 440.101 Tm
(12)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.009 0 0 1 454.185 440.101 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 459.191 440.101 Tm
(22)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.009 0 0 1 469.154 440.101 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 474.16 440.101 Tm
(25)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.009 0 0 1 484.123 440.101 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 489.129 440.101 Tm
(26)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.009 0 0 1 499.092 440.101 Tm
[(].)-308.009(Ho)25.0157(we)25.0109(v)13.9845(er)39.9912(,)]TJ
1.02 0 0 1 308.862 428.146 Tm
[(such)-245.007(distance-customized)-245.014(methods)-245.994(are)-245(not)-245.004(generally)-245.004(appli-)]TJ
1.01 0 0 1 308.862 416.191 Tm
[(cable)-248.993(because)-248.99(the)15.0188(y)-249.012(rely)-248(hea)19.0174(vily)-248.008(on)-248.988(the)-249.002(geometry/properties)]TJ
1.02 0 0 1 308.862 404.235 Tm
[(of)-256.015(the)-254.994(distance)-256.013(considered)-256.008(\()]TJ
/R13 9.9626 Tf
109.784 0 Td
[(e)15.0061(.g)]TJ
/R9 9.9626 Tf
11.749 0 Td
[(.)-255.989(using)-255.008(projections)-255.984(and)-255.984(dual)]TJ
-121.533 -11.9551 Td
[(norms\))-320.991(to)-321.008<026e64>-320.004(minimally)-321.015(perturbed)-321.015(adv)15.0206(ersarial)-321.006(e)15.0061(xamples.)]TJ
-0.302926 -11.9551 Td
[(The)-311.009(most)-310.987(notable)-311.014(attacks)-311.987(within)-310.997(this)-310.992(second)-310.987(cate)14.9965(gory)-311.011(are:)]TJ
1.017 0 0 1 308.862 368.37 Tm
[(DeepF)15.007(ool)-246.992(for)-245.992(the)]TJ
/R15 9.9626 Tf
1 0 0 1 380.361 368.37 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15117 -1.49375 Td
[(2)-0.500618]TJ
/R9 9.9626 Tf
1.017 0 0 1 391.479 368.37 Tm
(and)Tj
/R15 9.9626 Tf
1 0 0 1 408.607 368.37 Tm
[(`)-0.700863]TJ
/R21 6.9738 Tf
4.15117 -1.49375 Td
[(1)-0.903213]TJ
/R9 9.9626 Tf
1.017 0 0 1 423.696 368.37 Tm
[(norms,)-247.014(which)-246.011(uses)-247.014(a)-245.997(linear)-247(ap-)]TJ
0.98 0 0 1 308.862 356.415 Tm
[(proximation)-233.995(of)-234.01(the)-234.02(model)-233.997(at)-234.985(each)-234(iteration)-233.99([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 477.796 356.415 Tm
(22)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.98 0 0 1 487.758 356.415 Tm
[(];)-240.996(DDN)-234(for)-234.005(the)]TJ
/R15 9.9626 Tf
1 0 0 1 308.862 344.46 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15078 -1.49531 Td
[(2)-0.500618]TJ
/R9 9.9626 Tf
1.012 0 0 1 317.482 344.46 Tm
[(-norm,)-246.997(which)-247.019(uses)-246.98(projections)-246.994(on)-246.985(the)]TJ
/R15 9.9626 Tf
1 0 0 1 468.791 344.46 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15117 -1.49531 Td
[(2)-0.497117]TJ
/R9 9.9626 Tf
1.012 0 0 1 477.412 344.46 Tm
[(-ball)-246.985(to)-247.019(decouple)]TJ
0.98 0 0 1 308.862 332.504 Tm
[(the)-241.981(direction)-242.006(and)-240.994(the)-241.981(norm)-241.986(of)-242.011(the)-241.981(perturbation)-241.996([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 492.068 332.504 Tm
(26)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.98 0 0 1 502.03 332.504 Tm
[(];)-245.997(and)-241.991(F)75.0075(AB)]TJ
1.02 0 0 1 308.862 320.549 Tm
[(for)-252.985(the)]TJ
/R15 9.9626 Tf
1 0 0 1 338.274 320.549 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15117 -1.49414 Td
[(1)-0.500618]TJ
/R9 9.9626 Tf
1.02 0 0 1 346.894 320.549 Tm
(,)Tj
/R15 9.9626 Tf
1 0 0 1 352.028 320.549 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15078 -1.49414 Td
[(2)-0.500618]TJ
/R9 9.9626 Tf
1.02 0 0 1 363.221 320.549 Tm
(and)Tj
/R15 9.9626 Tf
1 0 0 1 380.468 320.549 Tm
[(`)-0.700863]TJ
/R21 6.9738 Tf
4.15117 -1.49414 Td
[(1)-0.899712]TJ
/R9 9.9626 Tf
1.02 0 0 1 393.059 320.549 Tm
[(,)-254.992(which)-253.014(combines)-254.014(a)-253(linear)-252.99(approxima-)]TJ
0.992 0 0 1 308.862 308.594 Tm
[(tion)-252.997(of)-253(the)-253.995(model)-253.019(and)-252.982(projections)-252.997(w)65.0093(.r)56.0074(.t.)-253.017(the)-253.995(norm)-253.012(considered)]TJ
1.02 0 0 1 308.862 296.639 Tm
([)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 312.246 296.639 Tm
(12)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 322.208 296.639 Tm
[(].)-432.017(The)-287.983(recently)-287.988(proposed)-287.01(FMN)-287.99(attack)-287.985([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 482.603 296.639 Tm
(25)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 492.566 296.639 Tm
[(])-288.005(e)15.0061(xtends)-288.014(the)]TJ
1.013 0 0 1 308.862 284.684 Tm
[(DDN)-247.007(attack)-246.985(to)-247.012(other)-247(norms.)-305.99(Be)13.997(yond)]TJ
/R15 9.9626 Tf
1 0 0 1 457.968 284.684 Tm
[(`)-0.700863]TJ
/R17 6.9738 Tf
4.15195 -1.49492 Td
[(p)-0.903213]TJ
/R9 9.9626 Tf
1.013 0 0 1 466.725 284.684 Tm
[(-norms,)-246.992(W)78.9989(ong)]TJ
/R13 9.9626 Tf
59.1976 0 Td
[(et)-247.002(al)]TJ
/R9 9.9626 Tf
17.4135 0 Td
(.)Tj
0.984 0 0 1 308.862 272.729 Tm
[(proposed)-253.002(an)-252.994(attack)-253([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 388.171 272.729 Tm
(30)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.984 0 0 1 398.134 272.729 Tm
[(])-252.987(to)-252.992(produce)-252.992(adv)15.0172(ersarial)-252.982(perturbations)]TJ
0.98 0 0 1 308.503 260.773 Tm
[(with)-256.995(minimal)-255.997(W)80.9989(asserstein)-256.005(distance)-256.985(using)-257.005(projected)-256.01(Sinkhorn)]TJ
1.02 0 0 1 308.862 248.818 Tm
[(iterations.)-482.006(Finally)62.9893(,)-318.995(one)-304.998(attack)-304.015(that)-305.005(does)-305.014(not)-304.01(strictly)-304.99(f)9.98488(all)-305.01(in)]TJ
1.005 0 0 1 308.862 236.863 Tm
[(either)-247.991(of)-248.003(the)-248.01(tw)10.0169(o)-248.017(cate)14.9887(gories)-248.983(w)9.99248(as)-248.003(proposed)-248.008(by)-247.983(Brendel)]TJ
/R13 9.9626 Tf
213.907 0 Td
[(et)-248.008(al)]TJ
/R9 9.9626 Tf
17.425 0 Td
(.,)Tj
0.982 0 0 1 308.862 224.908 Tm
[(and)-254.011(designed)-253.996(for)]TJ
/R15 9.9626 Tf
1 0 0 1 376.638 224.908 Tm
[(`)-0.700863]TJ
/R17 6.9738 Tf
4.15117 -1.49531 Td
[(p)-0.899712]TJ
/R9 9.9626 Tf
0.982 0 0 1 385.394 224.908 Tm
[(-norms)-253.981(with)]TJ
/R15 9.9626 Tf
1 0 0 1 435.479 224.908 Tm
[(p)-0.102924]TJ
/R23 9.9626 Tf
7.78008 0 Td
[(2)-278.703(f)]TJ
/R25 9.9626 Tf
14.3902 0 Td
(0)Tj
/R15 9.9626 Tf
4.98164 0 Td
[(;)-0.803787]TJ
/R25 9.9626 Tf
4.42812 0 Td
(1)Tj
/R15 9.9626 Tf
4.98086 0 Td
[(;)-0.803787]TJ
/R25 9.9626 Tf
4.42812 0 Td
(2)Tj
/R15 9.9626 Tf
4.98125 0 Td
[(;)-0.803787]TJ
/R23 9.9626 Tf
4.42773 0 Td
(1g)Tj
/R9 9.9626 Tf
0.982 0 0 1 503.308 224.908 Tm
([)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 506.566 224.908 Tm
(5)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.982 0 0 1 511.548 224.908 Tm
[(].)-316.014(In)-253.996(this)]TJ
1.02 0 0 1 308.862 212.953 Tm
[(attack,)-279.007(the)-271.985(optimization)-271.985(is)-271.98(formulated)-273.008(such)-271.994(that)-271.985(the)-271.985(pertur)19.9986(-)]TJ
11.9551 TL
T*[(bation)-271.009(follo)23.9892(ws)-271.007(the)-270.985(decision)-271.014(boundary)-272(of)-271.004(a)-270.99(classi\002er)39.0169(,)-278.015(while)]TJ
11.9559 TL
T*[(minimizing)-265.003(the)-264.988(considered)-266.002(distance.)-364.006(This)-264.988(is)-264.984(not)-264.993(limited)-265.983(to)]TJ
/R15 9.9626 Tf
1 0 0 1 308.862 177.087 Tm
[(`)-0.700863]TJ
/R17 6.9738 Tf
4.15078 -1.49414 Td
[(p)-0.899712]TJ
/R9 9.9626 Tf
1.02 0 0 1 317.618 177.087 Tm
[(-norms)-306(b)19.9962(ut,)-320.986(in)-306.016(practice,)-322.015(the)-305.005(implementation)-305.985(le)24.0012(v)14.9965(erages)-306(a)]TJ
-8.58418 -11.9551 Td
[(trust-re)15.0085(gion)-282.018(solv)14.9869(er)-281.993(designed)-281.998(for)-282.008(each)]TJ
/R15 9.9626 Tf
1 0 0 1 461.722 165.132 Tm
[(`)-0.700863]TJ
/R17 6.9738 Tf
4.15117 -1.49414 Td
[(p)-0.903213]TJ
/R9 9.9626 Tf
1.02 0 0 1 470.478 165.132 Tm
[(-norm)-281.998(speci\002cally)64.0176(,)]TJ
1 0 0 1 308.503 153.177 Tm
[(which)-249.983(limits)-249.99(applicability)-249.988(to)-249.988(other)-249.988(distances.)]TJ
1.02 0 0 1 320.817 140.776 Tm
[(Penalty)-367.989(methods)-368.004(are)-367.009(generally)-368.013(applicable,)-398.991(and)-367(can)-367.994(be)]TJ
1.015 0 0 1 308.862 128.821 Tm
[(used)-247.015(for)-245.994(distances)-246.996(other)-246.981(than)-246.993(the)-246.004(standard)]TJ
/R15 9.9626 Tf
1 0 0 1 478.534 128.821 Tm
[(`)-0.700863]TJ
/R17 6.9738 Tf
4.15117 -1.49492 Td
[(p)-0.903213]TJ
/R9 9.9626 Tf
1.015 0 0 1 487.29 128.821 Tm
[(-norms;)-247.003(for)-246.998(in-)]TJ
1.02 0 0 1 308.862 116.866 Tm
[(stance,)-293.014(CIEDE2000)-283.003([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 396.274 116.866 Tm
(37)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 406.236 116.866 Tm
[(])-283.007(or)-282.998(LPIPS)-284.016([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 456.645 116.866 Tm
(21)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 466.608 116.866 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 472.026 116.866 Tm
(35)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 481.989 116.866 Tm
[(].)-417.986(The)14.0019(y)-282.993(replace)]TJ
1.011 0 0 1 308.862 104.91 Tm
[(constrained)-248.017(problems)-248.012(with)-248(unconstrained)-247.985(ones)-247.995(by)-248.994(adding)-248.005(a)]TJ
1.012 0 0 1 308.862 92.9551 Tm
[(penalty)63.9885(,)-247.011(which)-247.019(increases)-247.004(when)-246.99(the)-246.985(constraint)-247(is)-247.982(vi)0.983134(olated.)-307.009(A)]TJ
1.017 0 0 1 308.503 81 Tm
[(weight)-245.019(of)-245.002(the)-245.009(penalty)-245.011(is)-244.99(chosen)-244.994(and)-246.002(i)0.992759(ncreased)-245.992(heuristical)1.0024(ly)62.9823(,)]TJ
ET
Q
Q
endstream
endobj
42 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/eSwW01OiyrsYO-dmo3yIPA Do
Q
endstream
endobj
43 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/CSCbI66b4AFWSf7BtE4gmg Do
Q
endstream
endobj
44 0 obj
<< /R11 284 0 R /R13 285 0 R /R15 286 0 R /R17 287 0 R /R19 288 0 R /R21 289 0 R /R23 290 0 R /R25 291 0 R /R7 292 0 R /R9 293 0 R >>
endobj
45 0 obj
<< /BBox [ 0 0 612 792 ] /Matrix [ 1 0 0 1 0 0 ] /Resources << /Font 294 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ] >> /Subtype /Form /Type /XObject /Length 112 /Filter /FlateDecode >>
stream
x-1@{Ŕ$q%r"A?@ )sDb%$-ܜCWdpUh/jƝڧ> /Resources << /ExtGState << /a0 << /CA 1 /ca 1 >> /a1 << /CA 0.5 /ca 0.5 >> >> /XObject << /x6 295 0 R >> >> /Subtype /Form /Type /XObject /Length 382 /Filter /FlateDecode >>
stream
xe[n!Y7P|=Q'y(Ji;#$v0U-V\oZWɽ:5db,6IR6@6Pc"3K+GQ؎3T<9j`UT@
v5ڳtHN;9+7[^S؇:[E"8+sW\qEeКu6Bhsj;)y;Tp0nؚgʦFǃS-="z7ۺ9*&Q~ZPuí}C9嬂8l?Jܪmx%e8w](Rlq鞋t×e:=p=y0`XeJCWxau~uof{`r
endstream
endobj
47 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 658.96 null ] /Rect [ 147.307 673.176 154.281 681.963 ] /Subtype /Link /Type /Annot >>
endobj
48 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 635.808 null ] /Rect [ 157.26 673.036 164.234 681.963 ] /Subtype /Link /Type /Annot >>
endobj
49 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 125.683 null ] /Rect [ 167.214 673.036 179.169 681.963 ] /Subtype /Link /Type /Annot >>
endobj
50 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 308.862 417.169 null ] /Rect [ 182.148 673.176 194.103 681.963 ] /Subtype /Link /Type /Annot >>
endobj
51 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 658.96 null ] /Rect [ 246.369 625.355 253.343 634.142 ] /Subtype /Link /Type /Annot >>
endobj
52 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 347.062 null ] /Rect [ 256.347 625.216 268.302 634.142 ] /Subtype /Link /Type /Annot >>
endobj
53 0 obj
<< /Border [ 0 0 0 ] /C [ 1 0 0 ] /Dest [ 6 0 R /XYZ 318.977 539.863 null ] /Rect [ 497.394 492.809 544.813 503.753 ] /Subtype /Link /Type /Annot >>
endobj
54 0 obj
<< /Border [ 0 0 0 ] /C [ 1 0 0 ] /Dest [ 6 0 R /XYZ 337.094 616.055 null ] /Rect [ 429.054 480.854 474.494 491.798 ] /Subtype /Link /Type /Annot >>
endobj
55 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 471.009 null ] /Rect [ 522.1 337.557 529.074 346.279 ] /Subtype /Link /Type /Annot >>
endobj
56 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 203.511 null ] /Rect [ 403.102 275.641 415.058 284.567 ] /Subtype /Link /Type /Annot >>
endobj
57 0 obj
<< /Border [ 0 0 0 ] /C [ 0 1 0 ] /Dest [ 13 0 R /XYZ 50.112 203.511 null ] /Rect [ 520.665 251.73 532.62 260.657 ] /Subtype /Link /Type /Annot >>
endobj
58 0 obj
<< /Length 27746 >>
stream
q 0.1 0 0 0.1 0 0 cm
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 49.7531 710.037 Tm
[(while)-387.984(the)-387.996(unconstrained)-388(optimization)-386.998(is)-387.995(repeated)-387.995(se)23.9844(v)14.9989(eral)]TJ
0.351945 -11.9551 Td
[(times.)-684.982(Po)24.9916(werful)-372.009(Augmented)-371.991(Lagrangian)-372.014(principles)-372.004(ha)20.0106(v)14(e)]TJ
-0.351945 -11.9551 Td
[(well-established)-352.99(adv)24.0144(antages)-352.998(o)13.9983(v)14.9977(er)-353.991(penalties)-352.998(in)-353.99(t)1(he)-354.014(general)]TJ
0.995 0 0 1 50.1121 674.172 Tm
[(conte)15.0138(xt)-251.014(of)-252.01(optimization)-252.012([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 148.303 674.172 Tm
(2)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.995 0 0 1 153.285 674.172 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 158.257 674.172 Tm
(3)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.995 0 0 1 163.238 674.172 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 168.21 674.172 Tm
(15)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.995 0 0 1 178.173 674.172 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 183.144 674.172 Tm
(24)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
0.995 0 0 1 193.107 674.172 Tm
[(],)-252.017(and)-251.017(completely)-251.995(a)19.9888(v)19.9937(oid)]TJ
1.02 0 0 1 50.1121 662.217 Tm
[(penalty-weight)-317.016(heuristics)-315.981(by)-317.004(automatically)-317.015(estimating)-316.989(the)]TJ
11.9551 TL
T*[(multipliers.)-485.012(Furthermore,)-320.005(the)-306.003(multiplier)-305.002(estimates)-305.01(tend)-305.997(to)]TJ
1.008 0 0 1 50.1121 638.306 Tm
[(the)-246.981(Lagrange)-246.983(multipliers,)-247.982(which)-247(a)20.0118(v)20(oids)-247.014(the)-247.994(ill)1(-conditioning)]TJ
1.011 0 0 1 50.1121 626.351 Tm
[(problems)-245.996(often)-246.006(encountered)-245.984(in)-246.015(penalty)-246.019(methods)-246.01([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 247.365 626.351 Tm
(2)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.011 0 0 1 252.347 626.351 Tm
(,)Tj
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 257.343 626.351 Tm
(10)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.011 0 0 1 267.305 626.351 Tm
[(].)-306.011(Fi-)]TJ
1.02 0 0 1 50.1121 614.396 Tm
[(nally)63.9911(,)-296.007(Augmented)-286(Lagrangian)-285.984(methods)-286.011(a)20.0034(v)18.9967(oid)-285.984(the)-285.016(need)-285.994(for)]TJ
0.98 0 0 1 50.1121 602.441 Tm
[(e)15.0198(xplicitly)-241.994(solving)-242.983(the)-241.981(dual)-243.018(problem,)-245.012(unlik)10.0023(e)-241.999(basic)-243.017(Lagrangian-)]TJ
1.02 0 0 1 50.1121 590.486 Tm
[(dual)-252.988(optimization,)-254.01(which)-253.012(might)-251.997(be)-252.994(intractable/unstable)-252.003(for)]TJ
1 0 0 1 50.1121 578.531 Tm
[(non-con)40.0105(v)14.9828(e)15.0128(x)-249.993(problems.)]TJ
1.02 0 0 1 62.0672 566.496 Tm
[(Despite)-322.983(their)-324.003(well-established)-323.007(adv)24.0144(antages)-323.014(and)-323.987(popular)19.9818(-)]TJ
-11.7207 -11.9551 Td
[(ity)-263.003(in)-263.003(the)-262.988(optimization)-262.99(community)-263.995(for)-262.981(solving)-263(non-con)39.0169(v)14.9989(e)15.0061(x)]TJ
11.9551 TL
T*[(problems,)-281(Augmented)-273.007(Lagrangian)-273.991(met)1.01867(hods)-274(ha)20.0106(v)14(e)-272.989(not)-273.991(been)]TJ
T*[(in)38.9845(v)14.9983(estig)5(ated)-282.003(pre)24.9982(viously)-281.99(for)-282.009(adv)15.0194(ersarial)-281.991(attacks.)-413.986(While)-281.996(this)]TJ
0.98 0 0 1 50.1121 518.676 Tm
[(seems)-197.016(rather)-197.99(surprising,)-209(we)-196.998(found)-197.99(in)-196.987(this)-197.984(w)9.99483(ork)-196.996(that)-197.996(the)-197.011(v)25.0083(anilla)]TJ
1.01 0 0 1 49.7531 506.721 Tm
[(Augmented)-246.012(Lagrangian)-246.985(methods)-245.999(are)-246.005(not)-247.003(competiti)24.9861(v)15.0091(e)-246.003(in)-246.988(the)]TJ
0.98 0 0 1 50.1121 494.765 Tm
[(conte)15.0185(xt)-245.999(of)-246.012(adv)14.9872(ersarial)-245.984(attacks)-246.985(\()]TJ
/R13 9.9626 Tf
121.83 0 Td
[(e)15.0198(.g)]TJ
/R9 9.9626 Tf
11.7427 0 Td
[(.)-245.996(in)-246.999(terms)-246.015(of)-246.012(computational)]TJ
-133.572 -11.9551 Td
[(ef)25.9848<02>-1.00961(cienc)14.9916(y\),)-220.984(which)-214.02(might)-212.993(e)15.0198(xplain)-213.992(wh)5.9964(y)-214.006(the)14.9985(y)-213.007(ha)19.9847(v)16.0062(e)-213.992(been)-213.01(a)19.9822(v)20.0072(oided)]TJ
0.995 0 0 1 50.1121 470.855 Tm
[(so)-252.006(f)9.98762(ar)55(.)-313.981(Ho)24.9983(we)24.994(v)14.9891(er)39.9862(,)-251.995(we)-251.991(introduce)-252.99(se)26(v)14.9891(eral)-252.999(algorithm)0.99008(ic)-252.988(modi\002ca-)]TJ
1.02 0 0 1 50.1121 458.9 Tm
[(tions)-258.016(to)-257.006(design)-257.995(a)-257.997(customize)1.00546(d)-258.006(Augmented)-258.014(Lagrangian)-257(algo-)]TJ
0.982 0 0 1 50.1121 446.945 Tm
[(rithm)-255.981(for)-255.991(adv)14.9823(ersarial)-256.019(e)16.0136(xample)-256.017(generation.)-319.982(Our)-256.007(modi\002cations)]TJ
1.02 0 0 1 50.1121 434.99 Tm
[(are)-294.01(crucial)-292.992(to)-293.986(achie)24.9958(v)13.9983(e)-293.016(highly)-294.005(competiti)24.9934(v)14.9989(e)-294.016(performances)-293.989(in)]TJ
1 0 0 1 50.1121 423.034 Tm
[(comparisons)-247.997(to)-247.005(state-of-the-art)-247.987(methods.)-309.007(The)-247.993(modi\002cations)]TJ
1.02 0 0 1 50.1121 411.079 Tm
[(include)-340.996(inte)15.0116(grating)-341.019(the)-340.984(Augmented)-341.008(Lagrangian)-340.992(inner)-340.987(and)]TJ
T*[(outer)-302.008(iterations)-302.011(with)-303.006(joint)-302.014(updates)-301.995(of)-301.99(the)-302.007(perturbation)-302.982(and)]TJ
1.014 0 0 1 50.1121 387.169 Tm
[(the)-247.995(multipliers,)-248.004(relaxing)-246.989(the)-247.995(need)-248.009(for)-246.999(an)-248.013(inner)19.9912(-con)38.9989(v)14.991(er)17.9902(gence)]TJ
0.998 0 0 1 50.1121 375.214 Tm
[(criterion,)-249.991(introducing)-249.008(an)-249.993(e)15.0177(xponential)-248.981(mo)15.0177(ving)-249.993(a)20.0073(v)14.9932(erage)-250.015(of)-248.983(the)]TJ
1.02 0 0 1 50.1121 363.259 Tm
[(multipliers,)-268.016(and)-263.981(adapting)-262.994(the)-263.988(learning)-263.009(rates)-264.006(to)-263.002(the)-263.989(distance)]TJ
11.9559 TL
T*[(function.)-546.992(All-in-all,)-346.003(we)-325.985(propose)-325.997(a)-325.998(white-box)-326.008(Augmented)]TJ
0.985 0 0 1 50.1121 339.348 Tm
[(Lagrangian)-252.006(Method)-251.99(for)-252.017(Adv)14.9895(ersarial)-252.007(\(ALMA\))-252(attacks,)-252.993(which)]TJ
1.007 0 0 1 50.1121 327.393 Tm
[(enjo)9.99697(ys)-247.014(both)-247.014(the)-247(general)-248.009(applica)1.00748(b)-0.996533(i)1.00505(lity)-247.993(of)-246.985(penalty)-247.009(approaches)]TJ
1.01 0 0 1 50.1121 315.438 Tm
[(and)-248.981(computational)-248(ef)25(\002cienc)14.9958(y)-249.011(of)-249.017(distance-customized)-248(meth-)]TJ
1.016 0 0 1 50.1121 303.483 Tm
[(ods.)-306.985(Our)-245.997(attack)-247.001(can)-246.01(be)-247.017(readily)-246.001(used)-247.014(to)-245.992(generate)-246.984(adv)14.988(ersarial)]TJ
1.02 0 0 1 50.1121 291.528 Tm
[(e)15.0055(xamples)-352.006(for)-351.01(a)-350.984(lar)16.9954(ge)-351.017(set)-351.001(of)-352(distances,)-378.017(including)]TJ
/R15 9.9626 Tf
1 0 0 1 251.611 291.528 Tm
[(`)-0.700863]TJ
/R19 6.9738 Tf
4.15117 -1.49492 Td
[(1)-0.500618]TJ
/R9 9.9626 Tf
1.02 0 0 1 260.231 291.528 Tm
(-norm,)Tj
/R15 9.9626 Tf
1 0 0 1 50.1121 279.572 Tm
[(`)-0.700251]TJ
/R19 6.9738 Tf
4.15078 -1.49375 Td
[(2)-0.499743]TJ
/R9 9.9626 Tf
1.02 0 0 1 58.732 279.572 Tm
[(-norm,)-246.994(CIEDE2000,)-247(LPIPS)-247(and)-246.99(SSIM,)-247.015(and)-245.992(we)-246.989(adv)20.0154(ocate)]TJ
0.98 0 0 1 50.1121 267.617 Tm
[(its)-231.995(use)-231.004(for)-232.006(other)-232.013(distances)-230.989(that)-232.004(might)-231.998(be)-231.994(i)1.01524(n)40.0118(v)16.0062(estig)5.00117(ated)-232.002(in)-231.997(future)]TJ
1.02 0 0 1 50.1121 255.662 Tm
[(research)-286.005(in)-285.99(adv)15.0194(ersarial)-285.989(attacks.)-426.019(W)79.0153(e)-285.982(e)24.0012(v)24.9934(aluate)-285.987(our)-285.991(attack)-285.987(on)]TJ
11.9551 TL
T*[(three)-278.013(datasets)-277.985(\(MNIST)72.0132(,)-278.016(CIF)73.0102(AR10)-277.991(and)-279.011(ImageNet\))-277.988(and)-278.013(se)24.9838(v-)]TJ
1.016 0 0 1 50.1121 231.752 Tm
[(eral)-244.996(models)-244.991(\(re)13.9967(gularl)0.981676(y)-246.016(and)-245.003(adv)14.9892(ersarially-trained\).)-304.992(F)14.9832(or)-244.982(each)]TJ
0.993 0 0 1 50.1121 219.797 Tm
[(distance,)-251.016(we)-249.991(compare)-250.991(our)-250.015(method)-251.003(ag)4.99369(ainst)-250.997(sta)0.982203(te-of-the-art)-250.987(at-)]TJ
0.98 0 0 1 50.1121 207.841 Tm
[(tacks)-219.01(proposed)-219.986(speci\002cally)-218.994(for)-219.004(that)-220.001(distance,)-225.995(and)-218.989(consistently)]TJ
1 0 0 1 50.1121 195.886 Tm
[(observ)14.9914(e)-250.002(competiti)25.0179(v)14.9828(e)-250.002(performance.)]TJ
/R7 11.9552 Tf
24.1469 TL
T*[(2.)-249.99(Pr)17.9906(eliminaries)]TJ
/R9 9.9626 Tf
1.02 0 0 1 62.0672 152.731 Tm
(Let)Tj
/R59 9.9626 Tf
1 0 0 1 78.809 152.731 Tm
(x)Tj
/R9 9.9626 Tf
1.02 0 0 1 88.5711 152.731 Tm
[(be)-314.998(a)-314.005(sample)-314.995(from)-313.985(the)-314.998(input)-314.001(space)]TJ
/R23 9.9626 Tf
1 0 0 1 229.472 152.731 Tm
[(X)-555.297<1a>-0.798886]TJ
/R61 9.9626 Tf
24.4621 0 Td
[(R)-0.200947]TJ
/R17 6.9738 Tf
7.19609 3.61523 Td
[(d)-0.700165]TJ
/R9 9.9626 Tf
1.02 0 0 1 265.775 152.731 Tm
[(,)-331.988(and)]TJ
/R15 9.9626 Tf
1 0 0 1 50.1121 140.776 Tm
[(y)-0.300195]TJ
/R23 9.9626 Tf
10.3758 0 Td
[(2)-515.685(Y)-0.300195]TJ
/R9 9.9626 Tf
1.02 0 0 1 83.5109 140.776 Tm
[(its)-371.005(associated)-370.99(label,)-401.991(where)]TJ
/R23 9.9626 Tf
1 0 0 1 197.393 140.776 Tm
[(Y)-0.300195]TJ
/R9 9.9626 Tf
1.02 0 0 1 208.64 140.776 Tm
[(is)-371.005(a)-371.012(set)-370.99(of)-369.991(discrete)]TJ
1.012 0 0 1 50.1121 128.821 Tm
[(labels)-247.016(of)-246.995(size)-246.993(K.)-248.016(Let)]TJ
/R15 9.9626 Tf
1 0 0 1 133.409 128.821 Tm
[(f)-0.599165]TJ
/R25 9.9626 Tf
8.72109 0 Td
[(:)-0.800112]TJ
/R61 9.9626 Tf
5.53711 0 Td
[(R)-0.200947]TJ
/R17 6.9738 Tf
7.19492 3.61484 Td
[(d)-0.700165]TJ
/R23 9.9626 Tf
7.41602 -3.61484 Td
(!)Tj
/R61 9.9626 Tf
12.7328 0 Td
[(R)-0.200947]TJ
/R17 6.9738 Tf
7.19492 3.61484 Td
[(K)-0.899712]TJ
/R9 9.9626 Tf
1.012 0 0 1 192.379 128.821 Tm
[(be)-246.997(a)-247.004(model)-248.011(that)-247.016(outputs)]TJ
1.02 0 0 1 50.1121 116.866 Tm
[(logits)-293.996(\()]TJ
/R13 9.9626 Tf
28.3931 0 Td
(i.e)Tj
/R9 9.9626 Tf
9.68444 0 Td
[(.)-294.008(pre-softmax)-294.019(scores\))]TJ
/R59 9.9626 Tf
1 0 0 1 178.335 116.866 Tm
[(z)-0.0992481]TJ
/R23 9.9626 Tf
9.63789 0 Td
[(2)-0.699638]TJ
/R61 9.9626 Tf
10.3301 0 Td
[(R)-0.200947]TJ
/R17 6.9738 Tf
7.1957 3.61484 Td
[(K)-0.899712]TJ
/R9 9.9626 Tf
1.02 0 0 1 216.168 116.866 Tm
[(gi)24.9934(v)14(en)-294.009(an)-294.009(input)]TJ
/R59 9.9626 Tf
1 0 0 1 277.798 116.866 Tm
(x)Tj
/R9 9.9626 Tf
1.02 0 0 1 284.364 116.866 Tm
(;)Tj
/R15 9.9626 Tf
1 0 0 1 50.1121 104.91 Tm
[(f)-0.60039]TJ
/R17 6.9738 Tf
4.87773 -1.49414 Td
[(k)-0.299321]TJ
/R25 9.9626 Tf
4.90117 1.49414 Td
[(\()-0.899972]TJ
/R59 9.9626 Tf
3.875 0 Td
(x)Tj
/R25 9.9626 Tf
6.56484 0 Td
[(\))-0.899972]TJ
/R9 9.9626 Tf
1.02 0 0 1 77.2719 104.91 Tm
[(denotes)-301.995(the)]TJ
/R15 9.9626 Tf
1 0 0 1 126.867 104.91 Tm
[(k)-0.599165]TJ
/R9 9.9626 Tf
1.02 0 0 1 132.367 104.91 Tm
[(-th)-301.99(component)-301.998(of)-300.99(the)-302.007(v)14.9989(ector)]TJ
/R15 9.9626 Tf
1 0 0 1 250.276 104.91 Tm
[(f)-0.60039]TJ
/R25 9.9626 Tf
5.95 0 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.875 0 Td
(x)Tj
/R25 9.9626 Tf
6.56484 0 Td
[(\))-0.90181]TJ
/R9 9.9626 Tf
1.02 0 0 1 270.541 104.91 Tm
[(.)-473.986(In)]TJ
-216.107 -11.9551 Td
[(a)-355.982(classi\002cation)-356(scenario,)-384.005(the)-356.014(probability)]TJ
/R15 9.9626 Tf
1 0 0 1 219.476 92.9551 Tm
[(p)-0.100473]TJ
/R17 6.9738 Tf
5.01172 -1.49414 Td
[(y)-0.399094]TJ
/R25 9.9626 Tf
9.64297 1.49414 Td
[(=)-0.798886]TJ
/R15 9.9626 Tf
12.6043 0 Td
(P)Tj
/R25 9.9626 Tf
7.77891 0 Td
[(\()-0.90181]TJ
/R15 9.9626 Tf
3.875 0 Td
[(y)-0.30142]TJ
/R23 9.9626 Tf
5.2418 0 Td
[(j)-0.798886]TJ
/R15 9.9626 Tf
2.76719 0 Td
[(x)-0.499917]TJ
/R25 9.9626 Tf
5.69414 0 Td
[(\))-0.90181]TJ
/R9 9.9626 Tf
1.02 0 0 1 279.584 92.9551 Tm
(is)Tj
-224.972 -11.9551 Td
[(obtained)-305.009(using)-305.983(the)]TJ
/R25 9.9626 Tf
1 0 0 1 128.861 81 Tm
[(s)-0.399443(of)-0.599165(t)-0.900585(m)-0.300195(ax)-0.800112]TJ
/R9 9.9626 Tf
1.02 0 0 1 166.337 81 Tm
(function:)Tj
/R15 9.9626 Tf
1 0 0 1 207.348 81 Tm
[(p)-0.100473]TJ
/R17 6.9738 Tf
5.01211 -1.49414 Td
[(y)-0.399094]TJ
/R25 9.9626 Tf
8.69297 1.49414 Td
[(=)-392.805(s)-0.399443(of)-0.60039(t)-0.89936(m)-0.30142(ax)-0.798886]TJ
/R17 6.9738 Tf
46.0238 -1.49414 Td
[(y)-0.399094]TJ
/R25 9.9626 Tf
4.78906 1.49414 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.875 0 Td
[(z)-0.100473]TJ
/R25 9.9626 Tf
5.95 0 Td
[(\))-0.90181]TJ
/R9 9.9626 Tf
1.02 0 0 1 285.565 81 Tm
(.)Tj
0.98 0 0 1 308.862 710.037 Tm
[(In)-220.006(this)-220.989(w)9.99483(ork,)-226.983(we)-221.004(assume)-220.019(that)]TJ
/R23 9.9626 Tf
1 0 0 1 421.264 710.037 Tm
[(X)-0.29897]TJ
/R9 9.9626 Tf
0.98 0 0 1 431.982 710.037 Tm
[(is)-220.006(the)-221.017(h)5.00617(ypercube)]TJ
/R23 9.9626 Tf
1 0 0 1 497.497 710.037 Tm
[(X)-0.29897]TJ
/R25 9.9626 Tf
11.3332 0 Td
[(=)-278.787([)-0.803787(0)]TJ
/R15 9.9626 Tf
18.2641 0 Td
[(;)-0.803787]TJ
/R25 9.9626 Tf
4.42773 0 Td
[(1])-0.803787]TJ
/R17 6.9738 Tf
7.74922 3.61602 Td
[(d)-0.700165]TJ
/R9 9.9626 Tf
0.98 0 0 1 543.916 710.037 Tm
(,)Tj
1 0 0 1 308.503 698.082 Tm
[(which)-249.983(is)-249.985(general)-249.997(enough)-250.017(for)-249.997(computer)-250.012(vision)-250.002(applications.)]TJ
/R7 10.9589 Tf
0.358984 -19.8492 Td
[(2.1.)-250.004(Pr)17.9938(oblem)-250.009(f)24.9957(ormulation)]TJ
/R9 9.9626 Tf
0.993 0 0 1 320.817 660.3 Tm
[(The)-252.016(problem)-252.012(of)-251.984(adv)15.0193(ersarial)-252.012(e)14.9897(xample)-252.002(generation)-252.002(has)-251.987(been)]TJ
0.981 0 0 1 308.862 648.345 Tm
[(mainly)-254.013(formulated)-254.987(in)-253.988(tw)10.0196(o)-255.007(w)10.0021(ays.)-314.987(One)-255.009(w)10.0021(ay)-254.015(is)-254.994(to)-253.99<026e64>-255.014(adv)15.0032(ersar)20.9935(-)]TJ
1 0 0 1 308.862 636.39 Tm
[(ial)-249.988(e)15.0122(xamples)-250.01(satisfying)-249.995(a)-250.002(distance)-250.017(constraint:)]TJ
28.232 -21.2961 Td
<026e64>Tj
/R15 9.9626 Tf
25.4648 0 Td
[<0e>-0.399443]TJ
/R9 9.9626 Tf
14.7672 0 Td
(s.t.)Tj
/R25 9.9626 Tf
23.2488 0 Td
[(ar)-0.698413(g)-181.019(m)-0.303871(ax)-0.798886]TJ
/R17 6.9738 Tf
14.9012 -8.44023 Td
[(k)-0.301071]TJ
/R15 9.9626 Tf
20.9648 8.44023 Td
[(f)-0.597939]TJ
/R17 6.9738 Tf
4.87695 -1.49414 Td
[(k)-0.301071]TJ
/R25 9.9626 Tf
4.90195 1.49414 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.875 0 Td
(x)Tj
/R25 9.9626 Tf
8.77891 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96328 0 Td
[<0e>-0.401894]TJ
/R25 9.9626 Tf
4.80508 0 Td
[(\))-0.90181]TJ
/R23 9.9626 Tf
6.64102 0 Td
(6)Tj
/R25 9.9626 Tf
0 0 Td
[(=)-0.803787]TJ
/R15 9.9626 Tf
10.5156 0 Td
[(y)-0.29897]TJ
-91.884 -21.7902 Td
[(D)-0.90181]TJ
/R25 9.9626 Tf
8.525 0 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.87422 0 Td
(x)Tj
/R25 9.9626 Tf
8.78008 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96172 0 Td
[<0e>17.6(;)-0.803787]TJ
/R59 9.9626 Tf
8.68008 0 Td
(x)Tj
/R25 9.9626 Tf
6.56523 0 Td
[(\))-0.90181]TJ
/R23 9.9626 Tf
6.6418 0 Td
[<14>-0.803787]TJ
/R15 9.9626 Tf
10.516 0 Td
[<0f>-0.896909]TJ
/R25 9.9626 Tf
4.04414 0 Td
[(;)-0.803787]TJ
/R59 9.9626 Tf
6.08789 0 Td
(x)Tj
/R25 9.9626 Tf
8.78008 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96172 0 Td
[<0e>-0.401894]TJ
/R23 9.9626 Tf
7.57227 0 Td
[(2)-278.703(X)-0.29897]TJ
/R9 9.9626 Tf
34.591 10.7961 Td
(\(1\))Tj
1.02 0 0 1 308.503 572.153 Tm
[(Alternati)24.9862(v)14(ely)63.9839(,)-272.982(the)-266.987(objecti)24.9886(v)13.9971(e)-266.992(is)-266.983(to)-267.002<026e64>-266.992(adv)13.9827(ersarial)-266.997(e)15.0061(xamples)]TJ
1 0 0 1 308.862 560.198 Tm
[(that)-249.983(are)-250.01(minimally)-250.017(distorted)-250.002(w)65.0137(.r)55.0104(.t)-249.988(a)-250.002(distance)-250.017(function)]TJ
/R15 9.9626 Tf
210.209 0 Td
[(D)-0.90181]TJ
/R9 9.9626 Tf
8.525 0 Td
(:)Tj
-208.619 -21.2949 Td
(min)Tj
/R17 6.9738 Tf
5.81406 -6.50312 Td
[<0e>-0.29757]TJ
/R15 9.9626 Tf
19.6512 6.50312 Td
[(D)-0.90181]TJ
/R25 9.9626 Tf
8.525 0 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.87383 0 Td
(x)Tj
/R25 9.9626 Tf
8.78008 0 Td
[(+)-0.798886]TJ
/R15 9.9626 Tf
9.96172 0 Td
[<0e>17.6(;)-0.798886]TJ
/R59 9.9626 Tf
8.6793 0 Td
(x)Tj
/R25 9.9626 Tf
6.56602 0 Td
[(\))-0.90181]TJ
/R9 9.9626 Tf
13.8367 0 Td
(s.t.)Tj
/R25 9.9626 Tf
23.2492 0 Td
[(ar)-0.700863(g)-181.019(m)-0.303871(ax)-0.798886]TJ
/R17 6.9738 Tf
14.9008 -8.44023 Td
[(k)-0.301071]TJ
/R15 9.9626 Tf
20.9652 8.44023 Td
[(f)-0.597939]TJ
/R17 6.9738 Tf
4.87695 -1.49414 Td
[(k)-0.301071]TJ
/R25 9.9626 Tf
4.90195 1.49414 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.87422 0 Td
(x)Tj
/R25 9.9626 Tf
8.77969 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96328 0 Td
[<0e>-0.401894]TJ
/R25 9.9626 Tf
4.80391 0 Td
[(\))-0.90181]TJ
/R23 9.9626 Tf
6.6418 0 Td
(6)Tj
/R25 9.9626 Tf
0 0 Td
[(=)-0.803787]TJ
/R15 9.9626 Tf
10.516 0 Td
[(y)-0.29897]TJ
/R59 9.9626 Tf
-91.884 -21.7902 Td
(x)Tj
/R25 9.9626 Tf
8.7793 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96289 0 Td
[<0e>-0.401894]TJ
/R23 9.9626 Tf
7.57188 0 Td
[(2)-278.703(X)-0.29897]TJ
/R9 9.9626 Tf
80.9281 10.7953 Td
(\(2\))Tj
1.02 0 0 1 320.817 495.962 Tm
[(In)-358.997(this)-360.003(w)10.0089(ork,)-387.99(we)-359.004(are)-359.014(interested)-360.003(in)-358.99(solving)]TJ
ET
Q
0 0.890625 0.939453 0.280029 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 498.385 495.962 Tm
[(Equation)-360.003(2)]TJ
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 543.819 495.962 Tm
(,)Tj
1 0 0 1 308.503 484.007 Tm
[(which)-249.983(is)-249.985(equi)24.9885(v)24.9811(alent)-249.988(to)-249.985(solving)]TJ
ET
Q
0 0.890625 0.939453 0.280029 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 430.046 484.007 Tm
[(Equation)-250.002(1)]TJ
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 475.984 484.007 Tm
[(for)-251.017(e)25.0105(v)14.9828(ery)]TJ
/R15 9.9626 Tf
38.332 0 Td
[<0f>-0.896909]TJ
/R9 9.9626 Tf
4.04414 0 Td
[(.)-309.983(Thus,)]TJ
-209.498 -11.9551 Td
[(it)-249.983(is)-249.985(a)-250.002(more)-249.988(general)-249.997(b)20.0016(ut)-249.985(more)-249.988(dif)24.986(\002cult)-250.007(problem.)]TJ
/R7 10.9589 Tf
19.85 TL
T*[(2.2.)-250.004(Equi)10.005(v)9.99384(alent)-249.989(pr)17.9938(oblem)]TJ
/R9 9.9626 Tf
1.02 0 0 1 320.817 434.269 Tm
[(In)-345.004(the)-343.983(general)-344.995(case,)-369.018(constraint)]TJ
/R59 9.9626 Tf
1 0 0 1 449.475 434.269 Tm
(x)Tj
/R25 9.9626 Tf
9.52891 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
10.7109 0 Td
[<0e>-0.401894]TJ
/R23 9.9626 Tf
9.44531 0 Td
[(2)-466.711(X)-0.29897]TJ
/R9 9.9626 Tf
1.02 0 0 1 502.509 434.269 Tm
[(is)-345.016(not)-343.988(nec-)]TJ
-189.85 -11.9551 Td
[(essarily)-290.001(tri)25.015(vial.)-438.984(Ho)25.0054(we)24.0156(v)14.9989(er)38.9833(,)-301.002(in)-289.989(our)-288.99(conte)13.9923(xt,)-300.997(this)-290.004(corresponds)]TJ
11.9551 TL
T*[(to)-331.003(a)-331.995(box)-330.991(constraint:)]TJ
/R63 9.9626 Tf
1 0 0 1 394.369 410.359 Tm
(0)Tj
/R23 9.9626 Tf
10.1199 0 Td
[<14>-0.803787]TJ
/R59 9.9626 Tf
12.1391 0 Td
(x)Tj
/R25 9.9626 Tf
9.42891 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
10.6121 0 Td
[<0e>-0.401894]TJ
/R23 9.9626 Tf
9.1957 0 Td
[<14>-0.803787]TJ
/R63 9.9626 Tf
12.1391 0 Td
(1)Tj
/R9 9.9626 Tf
1.02 0 0 1 463.733 410.359 Tm
[(.)-563.012(W)79.0141(e)-331.995(therefore)-330.981(han-)]TJ
-151.834 -11.9551 Td
[(dle)-285.016(it)-284.997(with)-284.016(a)-284.982(simple)-284.987(projection)]TJ
/R23 9.9626 Tf
1 0 0 1 435.183 398.404 Tm
[(P)-0.597939]TJ
/R19 6.9738 Tf
6.92891 -1.79883 Td
[([)-0.399094(0)-0.497117]TJ
/R17 6.9738 Tf
6.22695 0 Td
[(;)-0.301071]TJ
/R19 6.9738 Tf
2.36602 0 Td
[(1)-0.497117(])-0.399094]TJ
/R9 9.9626 Tf
1.02 0 0 1 457.43 398.404 Tm
[(.)-423.012(F)14.9917(or)-284.997(bre)23.9964(vity)64.0176(,)-295.006(we)-285.006(will)]TJ
-145.655 -11.9551 Td
[(omit)-317.005(this)-317.988(constraint)-316.996(in)-318.01(the)-316.998(rest)-317.988(of)-316.979(the)-317.998(paper)54.0039(.)-520.996(In)-318.017(the)-316.998(abo)15.0206(v)13.9971(e)]TJ
(formulations,)'
/R25 9.9626 Tf
1 0 0 1 366.692 374.494 Tm
[(ar)-0.698413(g)-181.019(m)-0.29897(ax)-0.801337]TJ
/R9 9.9626 Tf
1.02 0 0 1 404.078 374.494 Tm
[(is)-312.996(not)-313.005(dif)24.9814(ferentiable,)-330.015(and)-312.991(therefore)]TJ
-93.349 -11.9563 Td
[(not)-314.007(readily)-313.988(amenable)-313.983(to)-314.012(gradient-based)-314.005(optimization.)-510.983(W)78.0147(e)]TJ
0.99 0 0 1 308.862 350.583 Tm
[(replace)-251.988(the)]TJ
/R25 9.9626 Tf
1 0 0 1 354.366 350.583 Tm
[(ar)-0.698413(g)-181.019(m)-0.29897(ax)-0.801337]TJ
/R9 9.9626 Tf
0.99 0 0 1 391.06 350.583 Tm
[(constraint)-252.013(with)-252.993(an)-251.998(inequality)-252.013(constraint)]TJ
1 0 0 1 308.862 338.628 Tm
[(on)-249.988(the)-249.99(logits,)-249.997(as)-249.995(done)-249.988(in)-249.985(se)25.0154(v)14.9828(eral)-250.002(w)10.0032(orks,)-249.983(most)-250.007(notably)-250.007([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 523.097 338.628 Tm
(7)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 528.079 338.628 Tm
(]:)Tj
-219.216 -21.2953 Td
(min)Tj
/R17 6.9738 Tf
5.81406 -6.50273 Td
[<0e>-0.29757]TJ
/R15 9.9626 Tf
19.65 6.50273 Td
[(D)-0.90181]TJ
/R25 9.9626 Tf
8.525 0 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.875 0 Td
(x)Tj
/R25 9.9626 Tf
8.77891 0 Td
[(+)-0.798886]TJ
/R15 9.9626 Tf
9.96289 0 Td
[<0e>17.6(;)-0.798886]TJ
/R59 9.9626 Tf
8.67891 0 Td
(x)Tj
/R25 9.9626 Tf
6.56602 0 Td
[(\))-0.90181]TJ
/R9 9.9626 Tf
13.8371 0 Td
(s.t.)Tj
/R15 9.9626 Tf
21.5879 0 Td
[(f)-0.597939]TJ
/R17 6.9738 Tf
4.87812 -1.49375 Td
[(y)-0.399094]TJ
/R25 9.9626 Tf
4.78906 1.49375 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.87383 0 Td
(x)Tj
/R25 9.9626 Tf
8.78008 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96211 0 Td
[<0e>-0.401894]TJ
/R25 9.9626 Tf
4.80508 0 Td
[(\))-0.90181]TJ
/R23 9.9626 Tf
6.08789 0 Td
[<00>-0.803787]TJ
/R25 9.9626 Tf
9.96289 0 Td
[(m)-0.303871(ax)-0.798886]TJ
/R17 6.9738 Tf
1.86602 -6.50273 Td
[(k)-0.301071]TJ
/R21 6.9738 Tf
4.40313 0 Td
(6)Tj
/R19 6.9738 Tf
0 0 Td
(=)Tj
/R17 6.9738 Tf
6.11602 0 Td
[(y)-0.399094]TJ
/R15 9.9626 Tf
7.8168 6.50273 Td
[(f)-0.597939]TJ
/R17 6.9738 Tf
4.87812 -1.49375 Td
[(k)-0.301071]TJ
/R25 9.9626 Tf
4.90117 1.49375 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.875 0 Td
(x)Tj
/R25 9.9626 Tf
8.77891 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96289 0 Td
[<0e>-0.401894]TJ
/R25 9.9626 Tf
4.80508 0 Td
[(\))-0.90181]TJ
/R15 9.9626 Tf
6.64102 0 Td
[(<)-0.803787]TJ
/R25 9.9626 Tf
10.5168 0 Td
(0)Tj
/R9 9.9626 Tf
-10.3418 -16.6457 Td
(\(3\))Tj
1.02 0 0 1 308.394 288.732 Tm
[(While)-264.006(more)-263.991(suited)-263.999(to)-264.001(gradients,)-268.001(this)-264.018(constraint)-263.989(is)-263.984(not)-263.994(scale)]TJ
0.458793 -11.9559 Td
[(in)38.9857(v)24.9934(ariant,)-388.007(as)-358.997(noted)-359(in)-358.987([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 404.099 276.776 Tm
(13)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1.02 0 0 1 414.061 276.776 Tm
[(]:)-531.985(e)15.0061(xtreme)-359(scaling)-359.009(of)-358.994(the)-359.014(logits)]TJ
1.006 0 0 1 308.862 264.821 Tm
[(may)-248.007(result)-247.98(in)-247.985(gradient)-248.002(masking.)-307.988(W)79.9968(e)-248.005(use)-247.995(a)-248.005(slightly)-248.019(modi\002ed)]TJ
1 0 0 1 308.862 252.866 Tm
[(Dif)24.9836(ference)-250.017(of)-249.995(Logits)-250.002(Ratio)-250.007(\(DLR\))-249.983(for)-249.997(this)-250.012(constraint)-250.007([)]TJ
ET
Q
1 0 1 0 k
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 521.664 252.866 Tm
(13)Tj
ET
Q
0 g
q
10 0 0 10 0 0 cm BT
/R9 9.9626 Tf
1 0 0 1 531.626 252.866 Tm
[(])-250.002(:)]TJ
/R25 9.9626 Tf
-163.825 -31.4789 Td
[(D)-0.89936(LR)-0.100473]TJ
/R19 6.9738 Tf
21.1707 4.11406 Td
(+)Tj
/R25 9.9626 Tf
6.61406 -4.11406 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.87422 0 Td
[(z)-0.100473]TJ
/R15 9.9626 Tf
5.95 0 Td
[(;)-167.788(y)-0.29897]TJ
/R25 9.9626 Tf
9.66992 0 Td
[(\))-278.909(=)-0.803787]TJ
/R59 9.9626 Tf
18.3531 12.741 Td
[(z)-0.0980229]TJ
/R17 6.9738 Tf
5.52969 -1.49414 Td
[(y)-0.399094]TJ
/R23 9.9626 Tf
7.00312 1.49414 Td
[<00>-0.803787]TJ
/R25 9.9626 Tf
9.96211 0 Td
[(m)-0.303871(ax)-0.798886]TJ
/R17 6.9738 Tf
2.65898 -6.50312 Td
[(i)-0.196046]TJ
/R21 6.9738 Tf
2.81797 0 Td
(6)Tj
/R19 6.9738 Tf
0 0 Td
(=)Tj
/R17 6.9738 Tf
6.11602 0 Td
[(y)-0.399094]TJ
/R59 9.9626 Tf
8.60898 6.50312 Td
[(z)-0.0980229]TJ
/R17 6.9738 Tf
5.53086 -1.49414 Td
[(i)-0.196046]TJ
ET
Q
3.98 w
0 G
4334.33 2238.78 m
4849.78 2238.78 l
S
q
10 0 0 10 0 0 cm BT
/R59 9.9626 Tf
1 0 0 1 438.542 214.553 Tm
[(z)-0.0980229]TJ
/R17 6.9738 Tf
5.52969 -1.49414 Td
<19>Tj
/R65 4.9813 Tf
4.65898 -0.996094 Td
[(1)-0.597939]TJ
/R23 9.9626 Tf
6.6 2.49023 Td
[<00>-0.803787]TJ
/R59 9.9626 Tf
9.96211 0 Td
[(z)-0.0980229]TJ
/R17 6.9738 Tf
5.53125 -1.49414 Td
<19>Tj
/R65 4.9813 Tf
4.65898 -0.996094 Td
[(3)-0.597939]TJ
/R9 9.9626 Tf
58.0129 9.32422 Td
(\(4\))Tj
1.014 0 0 1 308.503 193.821 Tm
(where)Tj
/R59 9.9626 Tf
1 0 0 1 335.678 193.821 Tm
[(z)-0.100473]TJ
/R25 9.9626 Tf
8.725 0 Td
[(=)-0.798886]TJ
/R15 9.9626 Tf
10.5238 0 Td
[(f)-0.60039]TJ
/R25 9.9626 Tf
5.95 0 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.875 0 Td
(x)Tj
/R25 9.9626 Tf
6.56523 0 Td
[(\))-0.90181]TJ
/R9 9.9626 Tf
1.014 0 0 1 377.687 193.821 Tm
(and)Tj
/R15 9.9626 Tf
1 0 0 1 394.769 193.821 Tm
<19>Tj
/R9 9.9626 Tf
1.014 0 0 1 403.301 193.821 Tm
[(is)-246.991(the)-246.991(ordering)-247.005(of)-246.991(the)-246.991(elements)-247.01(of)]TJ
/R59 9.9626 Tf
1 0 0 1 539.162 193.821 Tm
[(z)-0.0980229]TJ
/R9 9.9626 Tf
1.02 0 0 1 308.862 181.866 Tm
[(in)-299.981(decreasing)-300.015(order)54.0183(.)-468.989(This)-300.008(loss)-300.012(is)-299.003(ne)14.0115(g)5.00205(ati)25(v)13.9971(e)-300.012(if)-299.998(and)-299.998(only)-300.008(if)]TJ
/R59 9.9626 Tf
1 0 0 1 538.546 181.866 Tm
(x)Tj
/R9 9.9626 Tf
1.02 0 0 1 308.862 169.911 Tm
[(is)-245.997(not)-245.007(classi\002ed)-246.004(as)]TJ
/R15 9.9626 Tf
1 0 0 1 384.9 169.911 Tm
[(y)-0.30142]TJ
/R9 9.9626 Tf
1.02 0 0 1 390.142 169.911 Tm
[(,)-245.997(and)-245.989(its)-245(maximum)-246.013(is)-245.994(1.)-304.995(Therefore,)-246.013(we)]TJ
1 0 0 1 308.862 157.955 Tm
[(solv)15(e)-250.002(the)-249.99(follo)24.9983(wing)-250.017(optimization)-250.017(problem:)]TJ
8.32188 -21.357 Td
(min)Tj
/R17 6.9738 Tf
5.81406 -6.50312 Td
[<0e>-0.29757]TJ
/R15 9.9626 Tf
19.65 6.50312 Td
[(D)-0.90181]TJ
/R25 9.9626 Tf
8.525 0 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.87383 0 Td
(x)Tj
/R25 9.9626 Tf
8.78008 0 Td
[(+)-0.798886]TJ
/R15 9.9626 Tf
9.96211 0 Td
[<0e>17.6(;)-0.798886]TJ
/R59 9.9626 Tf
8.68008 0 Td
(x)Tj
/R25 9.9626 Tf
6.56484 0 Td
[(\))-0.90181]TJ
/R9 9.9626 Tf
13.8371 0 Td
(s.t.)Tj
/R25 9.9626 Tf
21.5891 0 Td
[(D)-0.90181(LR)-0.0980229]TJ
/R19 6.9738 Tf
21.1707 4.11406 Td
(+)Tj
/R25 9.9626 Tf
6.61406 -4.11406 Td
[(\()-0.90181]TJ
/R15 9.9626 Tf
3.87422 0 Td
[(f)-0.597939]TJ
/R25 9.9626 Tf
5.95 0 Td
[(\()-0.90181]TJ
/R59 9.9626 Tf
3.875 0 Td
(x)Tj
/R25 9.9626 Tf
8.77891 0 Td
[(+)-0.803787]TJ
/R15 9.9626 Tf
9.96289 0 Td
[<0e>-0.401894]TJ
/R25 9.9626 Tf
4.80508 0 Td
[(\))-0.90181]TJ
/R15 9.9626 Tf
3.87383 0 Td
[(;)-167.791(y)-0.29897]TJ
/R25 9.9626 Tf
9.67031 0 Td
[(\))-0.90181]TJ
/R15 9.9626 Tf
6.64102 0 Td
[(<)-0.803787]TJ
/R25 9.9626 Tf
10.5168 0 Td
(0)Tj
/R9 9.9626 Tf
13.3031 -2.025 Td
(\(5\))Tj
/R7 10.9589 Tf
-224.634 -23.6852 Td
[(2.3.)-250.004(Distances)]TJ
/R9 9.9626 Tf
0.999 0 0 1 320.817 92.9551 Tm
[(Most)-250.981(attacks)-249.993(in)-251.016(the)-250.01(literature)-250.984(measure)-250.002(the)-250.993(size)-249.993(of)-251.003(the)-250.012(per)19.9921(-)]TJ
1.02 0 0 1 308.862 81 Tm
[(turbations)-271.989(in)-271.997(terms)-272.009(of)]TJ
/R15 9.9626 Tf
1 0 0 1 399.51 81 Tm
[(`)-0.700863]TJ
/R17 6.9738 Tf
4.15078 -1.49414 Td
[(p)-0.899712]TJ
/R9 9.9626 Tf
1.02 0 0 1 408.266 81 Tm
[(-norms.)-384.009(In)-272.004(this)-272.013(w)10.0089(ork,)-279.01(we)-272.013(propose)]TJ
ET
Q
Q
endstream
endobj
59 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/NJU33yf71HRcS9uZDmvhcw Do
Q
endstream
endobj
60 0 obj
<< /R13 285 0 R /R15 286 0 R /R17 287 0 R /R19 288 0 R /R21 289 0 R /R23 290 0 R /R25 291 0 R /R59 296 0 R /R61 297 0 R /R63 298 0 R /R65 299 0 R /R7 292 0 R /R9 293 0 R >>
endobj
61 0 obj
<< /BBox [ 0 0 612 792 ] /Matrix [ 1 0 0 1 0 0 ] /Resources << /Font 300 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ] >> /Subtype /Form /Type /XObject /Length 112 /Filter /FlateDecode >>
stream
x-0D|i;LV$:1EB*CN7OB IWLy