Epsilon Ball

Epsilon ball (or ε-ball) is a neighborhood of points in a metric space that lie within a distance ε of a central point. In the context of adversarial examples, the epsilon ball defines the region of input space within which an adversary is permitted to perturb an input without changing its semantic meaning to a human observer. The constraint that perturbations must stay within an epsilon ball is what makes adversarial examples "small" — and what makes them disturbing.

The choice of epsilon is arbitrary and domain-dependent. In image classification, epsilon is typically measured in L∞ norm (pixel-wise maximum change) or L2 norm (Euclidean distance). But these norms do not capture human perceptual similarity: a rotation or translation of an image may be large in L2 norm but invisible to humans, while a carefully structured perturbation may be small in norm but semantically meaningful. The epsilon ball formalism has been criticized for conflating geometric proximity with perceptual similarity, and for treating all directions in input space as equally important when they are not.

The epsilon ball is the standard perturbation model in adversarial training and certified defense, but it may not be the right model for the adversarial threats that actually matter. The real threat is not small-norm noise but structured, semantically coherent perturbations that exploit the model's learned representations in ways that fall outside any epsilon ball.