Using a tropical symmetric metric as an activation function in the last layer improves the robustness of CNNs against attacks.The decision boundary of a tropical CNN is defined by tropical bisectors.A refined version of the Carlini-Wagner attack is proposed, tailored for the tropical architecture.Computational experiments with MNIST and LeNet5 demonstrate the improved success rate of the attacks.