Many attack techniques have been proposed to explore the vulnerability of
DNNs and further help to improve their robustness. Despite the significant
progress made recently, existing black-box attack methods still suffer from
unsatisfactory performance due to the vast number of queries needed to optimize
desired perturbations. Besides, the other critical challenge is that
adversarial examples built in a noise-adding manner are abnormal and struggle
to successfully attack robust models, whose robustness is enhanced by
adversarial training against small perturbations. There is no doubt that these
two issues mentioned above will significantly increase the risk of exposure and
result in a failure to dig deeply into the vulnerability of DNNs. Hence, it is
necessary to evaluate DNNs' fragility sufficiently under query-limited settings
in a non-additional way. In this paper, we propose the Spatial Transform
Black-box Attack (STBA), a novel framework to craft formidable adversarial
examples in the query-limited scenario. Specifically, STBA introduces a flow
field to the high-frequency part of clean images to generate adversarial
examples and adopts the following two processes to enhance their naturalness
and significantly improve the query efficiency: a) we apply an estimated flow
field to the high-frequency part of clean images to generate adversarial
examples instead of introducing external noise to the benign image, and b) we
leverage an efficient gradient estimation method based on a batch of samples to
optimize such an ideal flow field under query-limited settings. Compared to
existing score-based black-box baselines, extensive experiments indicated that
STBA could effectively improve the imperceptibility of the adversarial examples
and remarkably boost the attack success rate under query-limited settings.

提出了一种在查询有限环境下构造强大对抗性例子的新框架 STBA，通过引入流场到干净图像的高频部分来生成对抗性例子，结合有效的梯度估计方法，显著提高了对抗性例子的真实性和攻击成功率。

STBA: 针对查询受限黑盒情景评估深度神经网络的鲁棒性

STBA: Towards Evaluating the Robustness of DNNs for Query-Limited  Black-box Scenario

In generating adversarial examples, the conventional black-box attack methods
rely on sufficient feedback from the to-be-attacked models by repeatedly
querying until the attack is successful, which usually results in thousands of
trials during an attack. This may be unacceptable in real applications since
Machine Learning as a Service Platform (MLaaS) usually only returns the final
result (i.e., hard-label) to the client and a system equipped with certain
defense mechanisms could easily detect malicious queries. By contrast, a
feasible way is a hard-label attack that simulates an attacked action being
permitted to conduct a limited number of queries. To implement this idea, in
this paper, we bypass the dependency on the to-be-attacked model and benefit
from the characteristics of the distributions of adversarial examples to
reformulate the attack problem in a distribution transform manner and propose a
distribution transform-based attack (DTA). DTA builds a statistical mapping
from the benign example to its adversarial counterparts by tackling the
conditional likelihood under the hard-label black-box settings. In this way, it
is no longer necessary to query the target model frequently. A well-trained DTA
model can directly and efficiently generate a batch of adversarial examples for
a certain input, which can be used to attack un-seen models based on the
assumed transferability. Furthermore, we surprisingly find that the
well-trained DTA model is not sensitive to the semantic spaces of the training
dataset, meaning that the model yields acceptable attack performance on other
datasets. Extensive experiments validate the effectiveness of the proposed idea
and the superiority of DTA over the state-of-the-art.

该论文通过利用对抗示例的分布特征，以困难标签黑盒设置下的条件似然函数为依据建立统计映射，从而提出了一种基于分布变换的攻击方法（DTA），该方法可以无需频繁查询目标模型，直接且高效地生成一批对抗示例，用于攻击未知模型。实验验证了该方法的有效性和优越性。

DTA: 基于分布变换的受查询限制场景攻击

DTA: Distribution Transform-based Attack for Query-Limited Scenario

Black-box attack methods aim to infer suitable attack patterns to targeted
DNN models by only using output feedback of the models and the corresponding
input queries. However, due to lack of prior and inefficiency in leveraging the
query and feedback information, existing methods are mostly query-intensive for
obtaining effective attack patterns. In this work, we propose a meta attack
approach that is capable of attacking a targeted model with much fewer queries.
Its high queryefficiency stems from effective utilization of meta learning
approaches in learning generalizable prior abstraction from the previously
observed attack patterns and exploiting such prior to help infer attack
patterns from only a few queries and outputs. Extensive experiments on MNIST,
CIFAR10 and tiny-Imagenet demonstrate that our meta-attack method can
remarkably reduce the number of model queries without sacrificing the attack
performance. Besides, the obtained meta attacker is not restricted to a
particular model but can be used easily with a fast adaptive ability to attack
a variety of models.The code of our work is available at
this https URL

本研究提出了一种元攻击方法，通过元学习的方法从以前观察到的攻击模式中学习可推广的先验抽象，并利用这样的先验信息，可以从很少的查询和输出中推断攻击模式，从而显着减少模型查询的数量，而不会牺牲攻击性能。