  Adversarial examples have shown a powerful ability to make a well-trained
model misclassified. Current mainstream adversarial attack methods only
consider one of the distortions among $L_0$-norm, $L_2$-norm, and
$L_\infty$-norm. $L_0$-norm based methods cause large modification on a single
pixel, resulting in naked-eye visible detection, while $L_2$-norm and
$L_\infty$-norm based methods suffer from weak robustness against adversarial
defense since they always diffuse tiny perturbations to all pixels. A more
realistic adversarial perturbation should be sparse and imperceptible. In this
paper, we propose a novel $L_p$-norm distortion-efficient adversarial attack,
which not only owns the least $L_2$-norm loss but also significantly reduces
the $L_0$-norm distortion. To this aim, we design a new optimization scheme,
which first optimizes an initial adversarial perturbation under $L_2$-norm
constraint, and then constructs a dimension unimportance matrix for the initial
perturbation. Such a dimension unimportance matrix can indicate the adversarial
unimportance of each dimension of the initial perturbation. Furthermore, we
introduce a new concept of adversarial threshold for the dimension unimportance
matrix. The dimensions of the initial perturbation whose unimportance is higher
than the threshold will be all set to zero, greatly decreasing the $L_0$-norm
distortion. Experimental results on three benchmark datasets show that under
the same query budget, the adversarial examples generated by our method have
lower $L_0$-norm and $L_2$-norm distortion than the state-of-the-art.
Especially for the MNIST dataset, our attack reduces 8.1$\%$ $L_2$-norm
distortion meanwhile remaining 47$\%$ pixels unattacked. This demonstrates the
superiority of the proposed method over its competitors in terms of adversarial
robustness and visual imperceptibility.
