[D] How to , concretly, measure a model’s robustness against adversarial/perturbations examples? … I mean concretly.
We know that we can measure a model’s robustness to perturbation by applying perturbation to training points and checking if the outputs are the same:
lpball around an image is said to be the adversarial ball, and a network is said to be
xif every point in the adversarial ball around
xclassifies the same. source, Part 3
But how is this done concretely?