You will be shown an excerpt from a computer science scientific research paper, followed by a question about the paper. Please answer the question. Do not include any text in your response other than the answer.

Context: In this paper, we have measured the perturbations using the \ell_{2} norm. Our framework is however not limited to this choice, and the proposed algorithm can simply be adapted to find minimal adversarial perturbations for any \ell_{p} norm (p\in[1,\infty)). To do so, the update steps in line 10 and 11 in Algorithm 2 must be respectively substituted by the following updates\displaystyle\hat{l}\displaystyle\leftarrow\operatorname*{arg\,min}_{k\neq{\hat{k}(\bm{x}_{0})}}\frac{\left|f^{\prime}_{k}\right|}{\|\bm{w}^{\prime}_{k}\|_{q}},(11)\displaystyle\bm{r}_{i}\displaystyle\leftarrow\frac{|f^{\prime}_{\hat{l}}|}{\|\bm{w}^{\prime}_{\hat{l}}\|_{q}^{q}}|\bm{w}^{\prime}_{\hat{l}}|^{q-1}\odot\text{sign}(\bm{w}^{\prime}_{\hat{l}}),(12)where \odot is the pointwise product and q=\frac{p}{p-1}.333To see this, one can apply Holder’s inequality to obtain a lower bound on the \ell_{p} norm of the perturbation. In particular, when p=\infty (i.e., the supremum norm \ell_{\infty}), these update steps become\displaystyle\hat{l}\displaystyle\leftarrow\operatorname*{arg\,min}_{k\neq{\hat{k}(\bm{x}_{0})}}\frac{\left|f^{\prime}_{k}\right|}{\|\bm{w}^{\prime}_{k}\|_{1}},(13)\displaystyle\bm{r}_{i}\displaystyle\leftarrow\frac{|f^{\prime}_{\hat{l}}|}{\|\bm{w}^{\prime}_{\hat{l}}\|_{1}}\text{sign}(\bm{w}^{\prime}_{\hat{l}}).(14) An accurate method for finding the adversarial perturbations is thus necessary to study and compare the robustness of different classifiers to adversarial perturbations. It might be the key to a better understanding of the limits of current architectures and to design methods to increase robustness. Despite the importance of the vulnerability of state-of-the-art classifiers to adversarial instability, no well-founded method has been proposed to compute adversarial perturbations and we fill this gap in this paper. It should be noted that, when perturbations are measured using the \ell_{\infty} norm, the above conclusions remain unchanged: DeepFool yields adversarial perturbations that are smaller (hence closer to the optimum) compared to other methods for computing adversarial examples. Table 2 reports the \ell_{\infty} robustness to adversarial perturbations measured by \hat{\rho}_{\text{adv}}^{\infty}(f)=\frac{1}{|\mathscr{D}|}\sum_{\bm{x}\in\mathscr{D}}\frac{\|\hat{\bm{r}}(\bm{x})\|_{\infty}}{\|\bm{x}\|_{\infty}}, where \hat{\bm{r}}(\bm{x}) is computed respectively using DeepFool (with p=\infty, see Section 3.3), and the Fast gradient sign method for MNIST and CIFAR-10 tasks. Our main contributions are the following:•We propose a simple yet accurate method for computing and comparing the robustness of different classifiers to adversarial perturbations.•We perform an extensive experimental comparison, and show that 1) our method computes adversarial perturbations more reliably and efficiently than existing methods 2) augmenting training data with adversarial examples significantly increases the robustness to adversarial perturbations.•We show that using imprecise approaches for the computation of adversarial perturbations could lead to different and sometimes misleading conclusions about the robustness. Hence, our method provides a better understanding of this intriguing phenomenon and of its influence factors.We now review some of the relevant work. The phenomenon of adversarial instability was first introduced and studied in [18]. The authors estimated adversarial examples by solving penalized optimization problems and presented an analysis showing that the high complexity of neural networks might be a reason explaining the presence of adversarial examples. Unfortunately, the optimization method employed in [18] is time-consuming and therefore does not scale to large datasets. In [14], the authors showed that convolutional networks are not invariant to some sort of transformations based on the experiments done on Pascal3D+ annotations. Recently, Tsai et al. [19] provided a software to misclassify a given image in a specified class, without necessarily finding the smallest perturbation. Nguyen et al. [13] generated synthetic unrecognizable images, which are classified with high confidence. The authors of [3] also studied a related problem of finding the minimal geometric transformation that fools image classifiers, and provided quantitative measure of the robustness of classifiers to geometric transformations. Closer to our work, the authors of [4] introduced the “fast gradient sign” method, which computes the adversarial perturbations for a given classifier very efficiently. Despite its efficiency, this method provides only a coarse approximation of the optimal perturbation vectors. In fact, it performs a unique gradient step, which often leads to sub-optimal solutions. Then in an attempt to build more robust classifiers to adversarial perturbations, [5] introduced a smoothness penalty in the training procedure that allows to boost the robustness of the classifier. Notably, the method in [18] was applied in order to generate adversarial perturbations. We should finally mention that the phenomenon of adversarial instability also led to theoretical work in [2] that studied the problem of adversarial perturbations on some families of classifiers, and provided upper bounds on the robustness of these classifiers. A deeper understanding of the phenomenon of adversarial instability for more complex classifiers is however needed; the method proposed in this work can be seen as a baseline to efficiently and accurately generate adversarial perturbations in order to better understand this phenomenon.

Question: Why did the authors measure the perturbations using the L`2 norm?
The authors claim that the DeepFool algorithm is a well-founded baseline for finding adversarial perturbations for state-of-the-art models. Although the use of the l-2 norm is not explicitly justified within the paper, it is a reasonable choice taking into account the scarcity of baseline methods. Also, the method can be easily adapted to any l-p norm and the claims of the paper seem to hold for the l-infinity norm.