Carlini & Wagner Attack (C&W)

Unlike single-step methods like FGSM, the C&W attack frames adversarial example generation as a constrained optimization problem. It uses a margin-based loss function and solves for the minimal perturbation δ that causes misclassification, typically using the Adam optimizer. The objective function is designed to be differentiable, allowing for efficient gradient-based search.

The attack employs a sophisticated loss function that directly optimizes the margin between the correct class and the target class logits. The original formulation introduced several loss variants (L0, L2, L∞), with the L2 version being most widely used. The loss is defined as:

• f(x') = max(max{Z(x')_i : i ≠ t} - Z(x')_t, -κ)
• Where Z(x') are logits, t is the target class, and κ controls the confidence margin

The C&W attack is specifically designed to find the smallest possible perturbation that causes misclassification. By directly minimizing the Lp-norm of the perturbation while satisfying the misclassification constraint, it produces adversarial examples that are nearly imperceptible to humans. This makes it a gold standard for evaluating worst-case model robustness.

To ensure adversarial examples remain valid inputs (e.g., pixel values in [0,1]), the attack uses a change-of-variables technique. Instead of optimizing pixel values directly, it optimizes a new variable w where:

• x' = ½(tanh(w) + 1)
• This guarantees all generated examples automatically satisfy the valid input range without requiring projection steps.

The C&W attack supports both attack modes:

• Targeted: Forces the model to classify the input as a specific, attacker-chosen class
• Untargeted: Causes any misclassification away from the correct class
• The targeted variant is more challenging and is the standard benchmark for evaluating defense mechanisms

The C&W attack famously demonstrated the brittleness of defensive distillation, a defense technique that was considered state-of-the-art at the time. By showing that distilled models could be fooled with imperceptible perturbations, it established itself as the primary benchmark for evaluating new defense proposals. Most defenses published without C&W evaluation are considered incomplete.