Can perceptual similarity metrics be used to compare adversarial attacks?

Adversarial attacks in computer vision are often bound in $\ell _{p}$ distance. This precludes comparing these techniques with …