Adversarial examples are inputs intentionally generated for fooling a deep
neural network. Recent studies have proposed unrestricted adversarial attacks
that are not norm-constrained. However, the previous unrestricted attack
methods still have limitations to fool real-world applications in a black-box
setting. In this paper, we present a novel method for generating unrestricted
adversarial examples using GAN where an attacker can only access the top-1
final decision of a classification model. Our method, Latent-HSJA, efficiently
leverages the advantages of a decision-based attack in the latent space and
successfully manipulates the latent vectors for fooling the classification
model.
With extensive experiments, we demonstrate that our proposed method is
efficient in evaluating the robustness of classification models with limited
queries in a black-box setting. First, we demonstrate that our targeted attack
method is query-efficient to produce unrestricted adversarial examples for a
facial identity recognition model that contains 307 identities. Then, we
demonstrate that the proposed method can also successfully attack a real-world
celebrity recognition service.

本文通过使用 GAN 生成无约束对抗样本并在潜空间中成功操纵潜向量以欺骗分类模型，提出了一个新的方法：Latent-HSJA，该方法在黑盒设置中只能访问分类模型的前 k 项决策，是对少量查询的分类模型强度评估的有效方法。

使用有限的查询和 GAN 进行无限制黑盒对抗攻击

Unrestricted Black-box Adversarial Attack Using GAN with Limited Queries

We propose a novel approach for generating unrestricted adversarial examples
by manipulating fine-grained aspects of image generation. Unlike existing
unrestricted attacks that typically hand-craft geometric transformations, we
learn stylistic and stochastic modifications leveraging state-of-the-art
generative models. This allows us to manipulate an image in a controlled,
fine-grained manner without being bounded by a norm threshold. Our approach can
be used for targeted and non-targeted unrestricted attacks on classification,
semantic segmentation and object detection models. Our attacks can bypass
certified defenses, yet our adversarial images look indistinguishable from
natural images as verified by human evaluation. Moreover, we demonstrate that
adversarial training with our examples improves performance of the model on
clean images without requiring any modifications to the architecture. We
perform experiments on LSUN, CelebA-HQ and COCO-Stuff as high resolution
datasets to validate efficacy of our proposed approach.

本文提出一种新的方法，通过操作图像生成的细节方面生成无限制的对抗性样本，使用最新的生成模型学习样式和随机修改，可用于分类、语义分割和物体检测模型的有目标和非有目标的无限制攻击，并在保证人类可分辨度的前提下，能够成功地规避经认证的防御措施，同时证明在仅使用原有模型结构的情况下，本文的对抗训练方法在增进原有模型在干净图像上表现方面也有很大提升。