Many machine learning models are susceptible to adversarial attacks, with
decision-based black-box attacks representing the most critical threat in
real-world applications. These attacks are extremely stealthy, generating
adversarial examples using hard labels obtained from the target machine
learning model. This is typically realized by optimizing perturbation
directions, guided by decision boundaries identified through query-intensive
exact search, significantly limiting the attack success rate. This paper
introduces a novel approach using the Approximation Decision Boundary (ADB) to
efficiently and accurately compare perturbation directions without precisely
determining decision boundaries. The effectiveness of our ADB approach (ADBA)
hinges on promptly identifying suitable ADB, ensuring reliable differentiation
of all perturbation directions. For this purpose, we analyze the probability
distribution of decision boundaries, confirming that using the distribution's
median value as ADB can effectively distinguish different perturbation
directions, giving rise to the development of the ADBA-md algorithm. ADBA-md
only requires four queries on average to differentiate any pair of perturbation
directions, which is highly query-efficient. Extensive experiments on six
well-known image classifiers clearly demonstrate the superiority of ADBA and
ADBA-md over multiple state-of-the-art black-box attacks.

该论文介绍了一种使用近似决策边界（ADB）的新方法，通过快速识别适当的决策边界来有效且准确地比较扰动方向，进一步发展出 ADB 算法。ADB 算法仅平均需要四个查询来区分任意一对扰动方向，具有非常高的查询效率，在六个知名图像分类器的广泛实验证明了 ADBA 和 ADBA-md 优于多个最先进的黑盒攻击方法。