I am trying to understand why adversarial attacks work in theory.
I have read, that the image is perturbed by a special perturbation $X_{adv}=X_1+p$, but i can't find any reference on that perturbation being an i.i.d. violation by itself.
If the i.i.d. assumption is not violated, then the only meaningful explanation in my mind would be, that the current date observed is out of distribution. But wouldn't this be an i.i.d. violation also?