This work investigates efficient score-based black-box adversarial attacks
with a high Attack Success Rate (ASR) and good generalizability. We design a
novel attack method based on a Disentangled Feature space, called DifAttack,
which differs significantly from the existing ones operating over the entire
feature space. Specifically, DifAttack firstly disentangles an image's latent
feature into an adversarial feature and a visual feature, where the former
dominates the adversarial capability of an image, while the latter largely
determines its visual appearance. We train an autoencoder for the
disentanglement by using pairs of clean images and their Adversarial Examples
(AEs) generated from available surrogate models via white-box attack methods.
Eventually, DifAttack iteratively optimizes the adversarial feature according
to the query feedback from the victim model until a successful AE is generated,
while keeping the visual feature unaltered. In addition, due to the avoidance
of using surrogate models' gradient information when optimizing AEs for
black-box models, our proposed DifAttack inherently possesses better attack
capability in the open-set scenario, where the training dataset of the victim
model is unknown. Extensive experimental results demonstrate that our method
achieves significant improvements in ASR and query efficiency simultaneously,
especially in the targeted attack and open-set scenarios. The code will be
available at this https URL soon.

本研究致力于探索高攻击成功率（Attack Success Rate，ASR）和良好通用性的高效评分型黑盒对抗攻击。我们设计了一种基于解耦特征空间的新型攻击方法，称为 DifAttack，它与现有的在整个特征空间进行操作的方法有显著不同。具体而言，DifAttack 将图像的潜在特征解耦为对抗特征和视觉特征，前者主导图像的对抗能力，而后者主要决定其视觉外观。我们通过使用从可用的替代模型通过白盒攻击方法生成的对抗实例来训练一个自编码器进行解耦。最终，DifAttack 通过根据受害模型的查询反馈迭代优化对抗特征，从而生成成功的对抗实例，同时保持视觉特征不变。此外，在针对黑盒模型进行对抗实例优化时，由于避免使用替代模型的梯度信息，我们提出的 DifAttack 在开放场景（受害模型的训练数据集未知）中固有地具有更好的攻击能力。大量实验结果表明，我们的方法在 ASR 和查询效率上取得了显著的改进，尤其在有目标攻击和开放场景中。