Abstract:Decision-based attacks (DBA), wherein attackers perturb inputs to spoof learning algorithms by observing solely the output labels, are a type of severe adversarial attacks against Deep Neural Networks (DNNs) requiring minimal knowledge of attackers. State-of-the-art DBA attacks relying on zeroth-order gradient estimation require an excessive number of queries. Recently, Bayesian optimization (BO) has shown promising in reducing the number of queries in score-based attacks (SBA), in which attackers need to observe real-valued probability scores as outputs. However, extending BO to the setting of DBA is nontrivial because in DBA only output labels instead of real-valued scores, as needed by BO, are available to attackers. In this paper, we close this gap by proposing an efficient DBA attack, namely BO-DBA. Different from existing approaches, BO-DBA generates adversarial examples by searching so-called \emph{directions of perturbations}. It then formulates the problem as a BO problem that minimizes the real-valued distortion of perturbations. With the optimized perturbation generation process, BO-DBA converges much faster than the state-of-the-art DBA techniques. Experimental results on pre-trained ImageNet classifiers show that BO-DBA converges within 200 queries while the state-of-the-art DBA techniques need over 15,000 queries to achieve the same level of perturbation distortion. BO-DBA also shows similar attack success rates even as compared to BO-based SBA attacks but with less distortion.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to reduce the number of queries required to generate adversarial samples in decision - based attacks (DBA), while maintaining or improving the quality of adversarial samples. Specifically, traditional DBA methods require a large number of queries to generate effective adversarial samples, which is inefficient and time - consuming in practical applications. This paper proposes a method based on Bayesian Optimization (BO), namely BO - DBA, aiming to reduce the number of queries by optimizing the perturbation direction and minimize the distortion of the perturbation, thereby improving the efficiency and effectiveness of the attack. ### Key points: 1. **Background and motivation**: - Decision - based attacks (DBA) are a method of attacking deep neural networks (DNNs). Attackers generate adversarial samples only by observing the output labels of the model, without knowing the specific structure or parameters of the model. - Existing DBA methods usually require thousands of queries to generate effective adversarial samples, which is very inefficient in practical applications. - Bayesian Optimization (BO) has shown the potential to reduce the number of queries in score - based attacks (SBA), but applying BO in DBA is challenging because DBA can only obtain output labels rather than probability scores. 2. **Method innovation**: - A new DBA method - BO - DBA is proposed. This method minimizes the distortion of the perturbation by searching for the perturbation direction and transforming the problem into a BO problem. - Different from the traditional zero - order optimization - based DBA methods, BO - DBA uses Bayesian Optimization to optimize the perturbation direction, thereby significantly reducing the number of queries required to generate adversarial samples. 3. **Experimental results**: - The experimental results show that on the pre - trained ImageNet classifier, BO - DBA can converge within 200 queries, while existing DBA techniques require more than 15,000 queries to achieve the same perturbation distortion. - BO - DBA is not only superior to existing DBA methods in query efficiency, but also performs well in attack success rate and perturbation quality, and even exceeds the BO - based SBA method in some aspects. ### Formula explanation: - **Perturbation direction and distance**: \[ \theta=\frac{S(\delta')}{|S(\delta')|} \] \[ g'(\delta') = \arg\min_{\Delta>0}(h_b(x_0+\Delta\theta)=1) \] where \(\theta\) is the normalized perturbation direction, and \(g'(\delta')\) represents the distance from the input \(x_0\) to the nearest adversarial sample along the direction \(\theta\). - **Optimization problem**: \[ \min_{\delta'}g'(\delta') \] The objective of this optimization problem is to find the direction \(\delta'\) that minimizes the perturbation distortion. ### Conclusion: By introducing Bayesian Optimization technology, this paper successfully solves the problem of excessive queries in decision - based attacks and improves the efficiency and quality of generating adversarial samples. This method provides new ideas and tools for future adversarial attack research.

BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization

Black-box Bayesian Adversarial Attack with Transferable Priors

ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attacks

Bayesian Optimization Based on Pseudo Labels

Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Prior

Improving Query Efficiency of Black-box Adversarial Attack

EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks

Adv-BDPM: Adversarial Attack Based on Boundary Diffusion Probability Model.

Boosting Decision-Based Black-Box Adversarial Attack with Gradient Priors

Decision-based Query Efficient Adversarial Attack Via Adaptive Boundary Learning

Bayesian Evolutionary Optimization for Crafting High-Quality Adversarial Examples with Limited Query Budget.

Black-Box Boundary Attack Based on Gradient Optimization

Decision-BADGE: Decision-based Adversarial Batch Attack with Directional Gradient Estimation

Improved Black-Box Attack Based on Query and Perturbation Distribution

DBA: an Efficient Approach to Boost Transfer-Based Adversarial Attack Performance Through Information Deletion.

Perception-Driven Imperceptible Adversarial Attack Against Decision-Based Black-Box Models

Bayesian Adversarial Learning

QEBA: Query-Efficient Boundary-Based Blackbox Attack

ADDA: an Adversarial Direction-Guided Decision-Based Attack Via Multiple Surrogate Models

Improving Query Efficiency of Black-Box Attacks via the Preference of Deep Learning Models

Aha! Adaptive History-driven Attack for Decision-based Black-box Models