Carlini & Wagner (C&W) Attack

Unlike earlier attacks that use cross-entropy loss, C&W employs a margin-based loss that directly optimizes the difference between the logit of the target class and the logit of the next most likely class. The attack succeeds when this margin exceeds zero, meaning the model assigns higher confidence to the target class. This formulation avoids the gradient saturation problems that make defensive distillation resistant to standard attacks, as the loss continues to provide useful gradients even when the model is highly confident in its incorrect prediction.

The C&W attack frames adversarial generation as solving:

• Minimize: ||δ||_p + c · f(x + δ)
• Subject to: x + δ ∈ [0,1]^n

Where δ is the perturbation, ||·||_p is the Lp norm (typically L2), f is the objective function, and c is a constant balancing distortion against attack success. The constraint that the perturbed input remains in valid pixel space is enforced through a change-of-variables using the tanh function, transforming the box-constrained optimization into an unconstrained problem solvable with standard optimizers like Adam.

The C&W framework supports three distinct distance metrics, each producing different perturbation characteristics:

• L2 attack: Minimizes Euclidean distance, producing small, distributed perturbations across many pixels—the most commonly used variant
• L∞ attack: Minimizes the maximum per-pixel change, ensuring no single pixel is altered beyond a threshold
• L0 attack: Minimizes the number of altered pixels, producing sparse perturbations through an iterative pixel-selection procedure

This flexibility allows security researchers to evaluate model robustness against different threat models and perceptual constraints.

Defensive distillation was considered a promising defense at the time of C&W's introduction, training a second model on the softened probability outputs of a first model to smooth decision boundaries. The C&W attack systematically breaks defensive distillation because:

• The margin-based loss avoids the gradient vanishing problem that occurs with softmax-saturated distilled models
• The optimization directly targets logits rather than probabilities, bypassing the temperature-scaled softmax that distillation relies on
• The attack achieves 100% success against distilled models with distortions comparable to those needed for undefended models

The attack uses an outer optimization loop with binary search to find the smallest constant c that produces a successful adversarial example. Starting with a small initial value, the algorithm:

• Solves the inner minimization for the current c
• If the attack fails, increases c to penalize misclassification more heavily
• If the attack succeeds, decreases c to prioritize minimizing distortion
• Repeats until finding the boundary value where attack just succeeds

This ensures the final perturbation is near-optimal in terms of the distortion-attack success trade-off.

The C&W attack has become the de facto standard for evaluating adversarial robustness in academic research. Its widespread adoption stems from:

• Near-optimal perturbation magnitudes that establish strong upper bounds on model vulnerability
• Consistent performance across diverse architectures including convolutional networks, residual networks, and transformers
• Availability in major adversarial robustness libraries such as Foolbox, CleverHans, and Adversarial Robustness Toolbox
• Use as the primary evaluation metric in hundreds of defense papers, making it the benchmark against which new defenses must demonstrate resilience