Perceptual Carlini-Wagner Attack: A Robust and Imperceptible Adversarial Attack Using LPIPS

Adversarial attacks on deep neural networks (DNNs) present significant challenges by exploiting model vulnerabilities using perturbations that are often imperceptible to human observers. Traditional approaches typically constrain perturbations using <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</i>-norms, which do not effectively capture human perceptual similarity. In this work, we propose the Perceptual Carlini-Wagner (PCW) attack, which integrates the Learned Perceptual Image Patch Similarity (LPIPS) metric into the adversarial optimization process. By replacing <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</i>-norm constraints with LPIPS, PCW generates adversarial examples that are both highly effective at inducing misclassification and visually indistinguishable from the original images. We evaluate PCW on the CIFAR-10, CIFAR-100, and ImageNet datasets. On ImageNet, adversarial examples crafted using PCW achieve an LPIPS distance of only 0.0002 from clean images, in contrast to 0.3 LPIPS for those produced by the CW and PGD attacks. In terms of robustness, PCW shows superior performance under common image processing defenses such as JPEG compression and bit-depth reduction, outperforming CW and SSAH and rivaling PGD. Additionally, we test PCW against adversarially trained models from RobustBench and find that it maintains high attack success rates, significantly outperforming CW and PGD in this more challenging setting. Finally, we assess the transferability of PCW across model architectures. While LPIPS contributes to perceptual alignment, it does not significantly improve transferability, with results comparable to those of the original CW attack.