9. Carlini & Wagner

• minimize difference between original and adversarial sample (x - x’)

• while also minimizing the classificaiton loss of the adversarial exampls x’ to the target t

• keep the distorted x’ in the respective domain ([0,1] for images)

1. how to choose c?

2. optimal attacker loss J?

3. how to enforce x’ element [0,1]^n?

• binary search…

• -> very expensive

binary search:

• chose initial range of c [min, max]

• -> if current c leads to succesfull misclassification

  • -> update upper bound

• -> if not

  • -> update lower bound

• => until balance between size of distortion and sucess is found

• tested several different ones…

• require:

  • x’ classified as t

  • <=>

  • f_k(x’) <= 0

  • if 2-class netowrk

• if higher class network (n>=3)

  • f_k(x’) <= 0

  • =>

  • x’ classified as t

• baseline loss: cross entropy loss

• we use cross entropy loss

-> negative sum over classification errors

-> wher the classification error is the log of the softmax output

-> 0 if we classified correctly (i.e. log(1))

-> infinity if we missed completely (i.e. -log(0))

-> thus, for C&W, if our softmax classifiaction is > 1/2 -> the loss should be negative…!!!

->

-log_2(F(x)_t) -1

• y-axis: loss

• x-axis: F(x’)_t

  • -> how sure is our model that x’ is target class?

• => intersection of function and x-axis at 1/2!!!

-> maximum of other classificaiton softmax

-> minus softmax of target class

-> maximum of both

wher Z(x’)i is the logit

-> output of the NN before applying softmax…

1. Project Gradient Descent

2. Clipped Gradient Descent

3. Change of Variables

• clipping x’ after each update

• works poorly for more complacted optimizers

• example: manually moving the x’i interferes with momentum

• clip in objective function f_k

• via min(max(x’,0),1)

• authors report convergence problems

  • -> flat spots

• replace x’

• minimize w.r.t. w (which is the replacement for x’)

• first half is esentially ||x-x’||, where x’ is replaced to fulfill box constraints

• second half is the sixth loss function, where we also replaced x’ with the box constraint with w

• -> first part minimize distortion

• -> second part minimize loss w.r.t target class

• strong attack

• expensive (due to finding c empirically, i.e. binary search)

• no thershold epsilon for maximal distortion

  • as opposed to FGSM and iterative FGSM

  • distrortion controlled via hyperparameter c

• -> FGSM fast

• -> C&W good