optimal-per-feature-l2-attack-formula
IN premise — summaries/2026/08/24/elhage-2022-toy-models-superposition-chunk-8.md
Created 2026-08-25T02:58:01+00:00
The optimal per-feature L2 adversarial attack direction is attack_i = λ · (W^TW)_i / ||(W^TW)_i||_2, where λ is the perturbation budget and the feature i that maximally degrades model output is selected.
Summary
This gives a direct, closed-form recipe for the single most damaging way to nudge one input feature: compute a specific matrix product from the model's weights, normalize each column, and scale it to the allowed perturbation size. The practical implication is that finding the best per-feature attack no longer requires iterative optimization; it is a one-step calculation, and whichever column produces the largest shift in the model's output tells you exactly which feature to target.