C and W Attack on Vision Models
Optimize the smallest change that flips the prediction, trading many passes for perturbations far below the budget.
Why Does This Exist?
PGD fills the budget it is given, which overstates what flipping truly needs and leaves visible traces at larger budgets. The Carlini and Wagner attack asks the opposite question: what is the smallest change that flips this image. Its threat model is white-box with generous query budget and no fixed spend, targeted or untargeted. Defenses that round away FGSM noise often fall to these minimal changes, which is why the attacks overview ranks it the subtlety benchmark.
Think of It Like This
Picking a lock versus kicking the door
FGSM kicks every door with the same force and PGD rams one door twenty times, while a lockpick feels each pin and opens with the least motion that works. Minimal motion leaves the least evidence. The analogy stops at cost: lockpicking takes skill and time, and C and W takes hundreds of optimization passes per image.
How It Actually Works
Minimize a combined objective: the perturbation size plus a margin term that goes negative exactly when the model flips, weighted so flipping is required first and shrinkage second. Optimize in an unconstrained space mapped back to valid pixels, restart from several constants weighting the two terms, and keep the smallest successful change. Confidence parameters force stronger flips that transfer better at larger sizes.
Worked example with recomputed numbers
Demo image flipping from class A score 8.2 against runner-up 7.9. The margin term needs the runner-up ahead by at least 0, and optimization settles at runner-up 8.05 versus 7.70 with mean pixel change 0.011. Across 100 images, 94 flip with mean change 0.011 and maximum 0.028, all inside the 0.03 box PGD fills completely. Median passes per image are 400 against 20 for PGD, which prices the subtlety at twenty times the queries.
Condition and trade
C and W assumes full gradient access and patience, so it governs high-value targeted settings rather than bulk scanning. Where queries are capped, PGD finds more flips per pass at larger sizes.
Watch Out For
Comparing minimal changes against budget-filling attacks
Judging C and W by flip rate alone misses its point and crowns PGD, which spends the full budget everywhere. The symptom is a bake-off at fixed budget that hides a 0.011 versus 0.03 size gap. Report mean and maximum change beside flip rate, and crown per goal: flips per pass versus change per flip.
The Quick Version
- Optimizes the smallest flipping change instead of spending a fixed budget.
- Demo: 94 flips at mean change 0.011, max 0.028, inside the 0.03 box.
- Median cost is 400 passes per image, twenty times PGD here.
- Breaks input rounding and denoising that stop FGSM-level noise.
- Judge it on size per flip, not flips alone.