The paper, Attacking Convolutional Neural Network using Differential Evolution, explains how to tweak the one pixel attack to produce adversarial images that minimize the amount of perturbation in an image. It would be nice to incorporate these changes.