Carlini & Wagner

• minimize ||x-x’||_2^2 + c J(x’, t)

• such that x’ element [0,1]^n

=> t == target…

• how to choose c?

• optimal attacker loss J?

• How to enforce [0,1] limits on x’?

• empirical approach

• -> smallest c so that missclassification is good

  • (e.g. plot …)

• binary search

• expensive

• suggest several possible loss functions and compare them

• f1(x’)

  • Training Loss - 1

• f2(x’)

  • max(max i!=t (F(x’)i) - F(x’)t, 0)

• f4(x’)

  • max(0, 0.5-F(x’)t)

• f5(x’)

  • -log(2*F(x’)t)

• f6(x’)

  • max(max i!= t(Z(x’)i)-Z(x’)t, 0)

  • => works best apparently

either:

1. Clipping x after each update

   • works poorly for more complicated optimizers

2. clip in objective function f via min(max(x’, 0) 1)

   • convergence problems -> flat spots

3. change of variables

   
   

• x’ = 1/2(tanh(w)+1)

• -> forces to be in [0,1]

• => basically map x with fucntion that always maps between [0,1]

• arg min w

• || x - 0.5(tanh(w)+1)||

• +

• c *f_6(0.5(tanh(w)+1), t)

• strong attack, better than baseline

• expensive (due to finding c empirically e.g. binary search)

• no threshold epsilon for maximal distortion

  • as opposed to FGSM and iterative FGSM

  • distortion controlled via hyperparameter c

-> FGSM fast

-> C+W good

• the target label…

f_k(x’) <= 0