CBA: 基于圆几何性质的黑盒攻击方法

doi:10.19678/j.issn.1000-3428.0070476

计算机工程 ›› 2026, Vol. 52 ›› Issue (7): 313-330. doi: 10.19678/j.issn.1000-3428.0070476

CBA: 基于圆几何性质的黑盒攻击方法

郑德生¹^,², 郑舜天¹, 李晓瑜²^,³, 殷浩⁴, 王聪⁵^,*()

1. 西南石油大学计算机与软件学院, 四川成都 610500
2. 喀什地区电子信息产业技术研究院, 新疆喀什 844000
3. 电子科技大学信息与软件工程学院, 四川成都 610054
4. 电子科技大学物理学院, 四川成都 610054
5. 四川警察学院智能警务四川省重点实验室, 四川泸州 646000

收稿日期:2024-10-12 修回日期:2025-01-20 出版日期:2026-07-15 发布日期:2025-03-25
通讯作者: 王聪
作者简介:
郑德生(CCF会员), 男, 副研究员、博士, 主研方向为工业物联网、人工智能
郑舜天, 硕士研究生
李晓瑜, 副教授、博士
殷浩, 硕士研究生
基金资助:
智能警务四川省重点实验室开放课题(ZNJW2023KFM8005); 公安部科技计划(2022JSM04)

CBA: Black Box Attack Method Based on Circular Geometric Properties

ZHENG Desheng¹^,², ZHENG Shuntian¹, LI Xiaoyu²^,³, YIN Hao⁴, WANG Cong⁵^,*()

1. School of Computer Science and Software Engineering, Southwest Petroleum University, Chengdu 610500, Sichuan, China
2. Kashi Institute of Electronics Information Industry, Kashi 844000, Xinjiang, China
3. School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu 610054, Sichuan, China
4. School of Physics, University of Electronic Science and Technology of China, Chengdu 610054, Sichuan, China
5. Intelligent Policing Key Laboratory of Sichuan Province, Sichuan Police College, Luzhou 646000, Sichuan, China

Received:2024-10-12 Revised:2025-01-20 Online:2026-07-15 Published:2025-03-25
Contact: WANG Cong

摘要/Abstract

摘要：

深度神经网络(DNN)容易受到对抗样本的攻击, 在干净图像中添加微小扰动就使分类器产生错误分类。基于决策的攻击是一类只依赖目标模型预测硬标签输出的黑盒攻击, 将目标模型视为黑匣子, 攻击时只需对目标模型结果进行查询, 而无需了解模型内部结构和参数信息, 这种特性对现实世界的应用程序构成了严重的威胁。目前, 基于决策的攻击方法通常利用梯度估计在目标模型决策边界附近发动攻击, 但需要高昂的查询代价且生成的对抗样本质量效果不佳, 失真较为严重。由于图像在频率空间中的低频信息能够有效表征其重要特征, 在低频空间执行决策攻击, 不仅有助于降低查询次数, 还能生成高质量的对抗样本, 因此提出一种基于圆几何性质的黑盒攻击方法CBA。该方法利用离散余弦变换(DCT), 选择在频率空间中进行攻击, 低频信息在其决策边界附近根据圆的几何性质不断迭代得到低频空间中的对抗样本。最后, 逆离散余弦变换将其变换回输入空间, 可以避免梯度估计, 在保证攻击成功率的同时显著减少查询次数。在ImageNet数据集上的实验结果表明, CBA在查询量分别为500、1 000、2 000次的情况下, 生成对抗样本的攻击成功率均比最新利用决策边界的几何性质的黑盒攻击方法高。同时, CBA在相同查询量不同约束条件下, 也具有更高的攻击成功率。因此, CBA减少了生成对抗样本所需的查询量, 生成的对抗样本失真更小, 图像质量更佳, 除此之外, 还在现实世界模型中测试了CBA的有效性。

关键词: 深度神经网络, 对抗样本, 决策攻击, 低频空间, 图像处理

Abstract:

Deep Neural Networks (DNNs) are vulnerable to adversarial examples and adding even a small perturbation to a clean image can cause a misclassification. Decision-based attacks are a class of black-box attacks that rely only on a target model to predict hard-label outputs. They consider the target model as a black box, and the attack queries the results of the target model without requiring access to its internal structure or parameter information. This poses a significant threat in real-world applications. Current decision-based attacks typically utilize gradient estimation to launch attacks near the decision boundary of the target model; however, they require high query costs and generate poor-quality adversarial examples with more severe distortion. The results of this study show that low-frequency information in the frequency space of an image can effectively capture important features of an image. A decision-based attack in a low-frequency space not only helps reduce the number of queries but also generates high-quality adversarial samples. To this end, this study proposes a black-box attack method based on the geometric properties of circles, called CBA. This method utilizes a Discrete Cosine Transform (DCT) to obtain adversarial examples in the frequency space using the geometric properties of circles near the decision boundary in a continuous iteration. Finally, the Inverse Discrete Cosine Transform (IDCT) changes them back into input space. This avoids gradient estimation and significantly reduces the number of queries while guaranteeing the success rate of the attack. Experimental results on the ImageNet dataset show that the attack success rate of CBA for generating adversarial examples is higher than that of the latest black-box attack methods, which utilize the geometric nature of the decision boundaries for query volumes of 500, 1 000, 2 000, respectively. Additionally, CBA has a higher attack success rate under different constraints for the same query volume. These results show that CBA reduces the number of queries required to generate adversarial examples and generates adversarial examples with less distortion and better image quality. Additionally, the effectiveness of CBA is tested using a real-world model.

Key words: Deep Neural Network(DNN), adversarial examples, decision-based attack, low-frequency space, image processing

郑德生, 郑舜天, 李晓瑜, 殷浩, 王聪. CBA: 基于圆几何性质的黑盒攻击方法[J]. 计算机工程, 2026, 52(7): 313-330.

ZHENG Desheng, ZHENG Shuntian, LI Xiaoyu, YIN Hao, WANG Cong. CBA: Black Box Attack Method Based on Circular Geometric Properties[J]. Computer Engineering, 2026, 52(7): 313-330.

https://www.ecice06.com/CN/Y2026/V52/I7/313

图/表 23

图1 不同查询量下CBA攻击VGG-16时生成的对抗样本

Fig.1 Adversarial examples generated by CBA when attacking VGG-16 with different query volumes

图2 DCT后的频谱信息分布

Fig.2 Distribution of spectral information after DCT

图3 低频特征和高频特征经过IDCT后的差异

Fig.3 Difference between low-frequency features and high-frequency features after IDCT

图4 CBA攻击总体框架

Fig.4 General framework of CBA attack

图5 频率空间基向量采样过程

Fig.5 Frequency space basis vector sampling process

图6 圆上迭代搜索对抗样本过程示意图

Fig.6 Schematic diagram of the process of iterative search for adversarial examples on a circle

图7 SurFree、TA和CBA在VGG-16、ResNet-18和DenseNet-121上的攻击成功率

Fig.7 Attack success rate of SurFree, TA and CBA on VGG-16, ResNet-18 and DenseNet-121

图8 SurFree、TA和CBA在ResNet-18上SSIM百分比随查询量变化趋势

Fig.8 Change trend of SSIM percentage with query volume for SurFree, TA, and CBA on ResNet-18

图9 SurFree、TA和CBA在ResNet-18上PSNR随查询量变化趋势

Fig.9 Change trend of PSNR with query volume for SurFree, TA, and CBA on ResNet-18

图10 图片随查询量变化的具体表现

Fig.10 Specific performance of images as query volume changes

图11 3种RMSE扰动阈值下不同低频系数在ResNet-18上CBA的攻击成功率

Fig.11 Attack success rate of CBA on ResNet-18 with different low-frequency coefficients at three RMSE perturbation thresholds

图12 CBA在ResNet-18上使用不同的λ和θ_start进行1 000次查询时的攻击成功率

Fig.12 Attack success rate of CBA on ResNet-18 for 1 000 queries using different λ and θ_start

图13 阿里云API打标结果

Fig.13 AliCloud API marking results

参考文献 33

1	LIU S, LIU F, HAO Z H, et al. Unsupervised few-shot image classification by learning features into clustering space[C]//Proceedings of European Conference on Computer Vision. Berlin, Germany: Springer, 2022: 420-436.
2	ZHANG Z D, XUE Z Y, CHEN Y, et al. Boosting verified training for robust image classifications via abstraction[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Vancouver, Canada: IEEE Press, 2023: 16251-16260.
3	KERR J, KIM C M, GOLDBERG K, et al. Lerf: language embedded radiance fields[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. Washington D.C., USA: IEEE Press, 2023: 19729-19739.
4	SHEN S, ZHAO W L, MENG Z B, et al. DiffTalk: crafting diffusion models for generalized audio-driven portraits animation[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D.C., USA: IEEE Press, 2023: 1982-1991.
5	陈子民, 关志涛. 基于条件扩散模型的图像分类对抗样本防御方法. 计算机工程, 2024, 50(12): 296- 305. doi: 10.19678/j.issn.1000-3428.0068512
	CHEN Z M , GUAN Z T . Image classification adversarial example defense method based on conditional diffusion model. Computer Engineering, 2024, 50(12): 296- 305. doi: 10.19678/j.issn.1000-3428.0068512
6	赵宏, 宋馥荣, 李文改. 基于SE-AdvGAN的图像对抗样本生成方法研究. 计算机工程, 2025, 51(2): 300- 311. doi: 10.19678/j.issn.1000-3428.0068481
	ZHAO H , SONG F R , LI W G . Research on image adversarial example generation method based on SE-AdvGAN. Computer Engineering, 2025, 51(2): 300- 311. doi: 10.19678/j.issn.1000-3428.0068481
7	黄震. 基于模型检测的自动驾驶领域安全攸关对抗样本识别方法[D]. 上海: 华东师范大学, 2023: 44-47.
	HUANG Z. A model checking based approach to detect safety-critical adversarial examples on autonomous driving systems[D]. Shanghai: East China Normal University, 2023: 44-47. (in Chinese)
8	蔺琛皓, 沈超, 邓静怡, 等. 虚假数字人脸内容生成与检测技术. 计算机学报, 2023, 46(3): 469- 498.
	LIN C H , SHEN C , DENG J Y , et al. Digitally forged face content creation and detection. Journal of Computing, 2023, 46(3): 469- 498.
9	MAHO T, FURON T, LE MERRER E. SurFree: a fast surrogate-free black-box attack[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D.C., USA: IEEE Press, 2021: 10430-10439.
10	WANG X S, ZHANG Z L, TONG K H, et al. Triangle attack: a query-efficient decision-based adversarial attack[EB/OL]. [2024-09-02]. https://arxiv.org/pdf/2112.06569.
11	AHMED N , NATARAJAN T , RAO K R . Discrete cosine transform. IEEE Transactions on Computers, 1974, 100(1): 90- 93.
12	RAHMATI A, MOOSAVI-DEZFOOLI S M, FROSSARD P, et al. GeoDA: a geometric framework for black-box adver- sarial attacks[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2020: 8446-8455.
13	SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[EB/OL]. [2024-09-02]. https://www.arxiv.org/pdf/1312.6199.
14	BRENDEL W, RAUBER J, BETHGE M. Decision-based adversarial attacks: reliable attacks against black-box machine learning models[EB/OL]. [2024-09-02]. https://arxiv.org/pdf/1712.04248.
15	CHENG M H, LE H, CHEN P Y, et al. Query-efficient hard-label black-box attack: an optimization-based approach[EB/OL]. [2024-09-02]. https://arxiv.org/pdf/1807.04457.
16	CHENG M H, SINGH S, CHEN P, et al. Sign-OPT: a query-efficient hard-label adversarial attack[EB/OL]. [2024-09-02]. https://arxiv.org/pdf/1909.10773.
17	CHEN J B, JORDAN M I, WAINWRIGHT M J. HopSkipJumpAttack: a query-efficient decision-based attack[C]//Proceedings of 2020 IEEE Symposium on Security and Privacy (S & P). Washington D.C., USA: IEEE Press, 2020: 1277-1294.
18	LI H C, XU X J, ZHANG X L, et al. QEBA: query-efficient boundary-based blackbox attack[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D.C., USA: IEEE Press, 2020: 1221-1230.
19	LIU Y, MOOSAVI-DEZFOOLI S M, FROSSARD P. A geometry-inspired decision-based attack[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. Washington D.C., USA: IEEE Press, 2019: 4890-4898.
20	SELVARAJU R R, COGSWELL M, DAS A, et al. Grad-CAM: visual explanations from deep networks via gradient-based localization[C] //Proceedings of the IEEE International Conference on Computer Vision. Washington D.C., USA: IEEE Press, 2017: 618-626.
21	RUSSAKOVSKY O , DENG J , KRAUSE J , et al. ImageNet large scale visual recognition challenge. International Journal of Computer Vision, 2015, 115, 211- 252. doi: 10.1007/s11263-015-0816-y
22	LECUN Y , BOTTOU L , BENGIO Y , et al. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 1998, 86(11): 2278- 2324. doi: 10.1109/5.726791
23	KRIZHEVSKY A, NAIR V, HINTON G. CIFAR-10 (canadian institute for advanced research)[EB/OL]. [2024-09-02]. http://www.cs.toronto.edu/kriz/cifar.Html.
24	KRIZHEVSKY A , HINTON G . Learning multiple layers of features from tiny images. Handbook of Systemic Autoimmune Diseases, 2009, 1(4): 10- 19.
25	SIMONYAN K, ZISSERMAN A. Very deep convolutional networks for large-scale image recognition[C]//Proceedings of International Conference on Learning Representations. Washington D.C., USA: [s. n], 2015: 1-14.
26	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. Washington D, C., USA: IEEE Press, 2016: 770-778.
27	SZEGEDY C, VANHOUCKE V, IOFFE S, et al. Rethinking the inception architecture for computer vision[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. Washington D, C., USA: IEEE Press, 2016: 2818-2826.
28	HOWARD A, SANDLER M, CHEN B, et al. Searching for MobileNetV3[C]// Proceedings of the IEEE/CVF International Conference on Computer Vision. Washington D, C., USA: IEEE Press, 2019: 1314-1324.
29	HUANG G, LIU Z, VAN DER MAATEN L, et al. Densely connected convolutional networks[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. Washington D, C., USA: IEEE Press, 2017: 4700-4708.
30	SHUKLA S N, SAHU A K, WILLMOTT D, et al. Simple and efficient hard label black-box adversarial attacks in low query budget regimes[C]//Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. New York, USA: ACM Press, 2021: 1461-1469.
31	KOLESNIKOV A, BEYER L, ZHAI X H, et al. Big Transfer (BiT): general visual representation learning[C]//Proceedings of the 16th European Conference on Computer Vision. Berlin, Germany: Springer 2020: 491-507.
32	DOSOVITSKIY A, BAYER L, KOLESNIKOV A. An image is worth 16×16 words: transformers for image recognition at scale[EB/OL]. [2024-09-02]. https://arxiv.org/pdf/2010.11929.
33	CHENG M H, LE T, CHEN P Y, et al. Query-efficient hard-label black-box attack: an optimization-based approach[EB/OL]. [2024-09-02]. https://arxiv.org/pdf/1807.04457.

[1]	孙宇, 王红杰, 杜彦辉, 刘楠. 基于字形和语义的多级中文对抗样本生成方法[J]. 计算机工程, 2026, 52(7): 287-301.
[2]	向海昀, 周垚, 陈曦. 面向目标检测的可迁移对抗样本生成算法[J]. 计算机工程, 2026, 52(6): 238-248.
[3]	秦颖鑫, 张可佳, 潘海为, 巨亚昊. 计算机视觉对抗攻击研究综述[J]. 计算机工程, 2026, 52(2): 46-68.
[4]	董方和, 石琼, 师智斌. 基于集成学习与异常检测的对抗流量检测方法[J]. 计算机工程, 2026, 52(2): 275-286.
[5]	王熠, 李智, 张丽, 石雪丽, 刘登波, 卢妤. 基于遥感图像场景分类的频域量化对抗攻击[J]. 计算机工程, 2026, 52(1): 266-281.
[6]	耿荣, 孙钦东, 曹晗, 王艳. 空频域联合优化的通用对抗扰动生成方法[J]. 计算机工程, 2026, 52(1): 176-187.
[7]	王春东, 赵智航, 杨伟杰, 方顺尧. 基于字词重现的中文文本对抗样本生成方法[J]. 计算机工程, 2026, 52(1): 303-313.
[8]	夏倪明, 张洁. 基于自适应集束搜索算法的中文对抗样本生成[J]. 计算机工程, 2025, 51(8): 131-140.
[9]	田青, 王斌, 周子枭. 无监督行人重识别研究综述[J]. 计算机工程, 2025, 51(7): 12-30.
[10]	侯彦, 车蕾, 李慧. 面向中文的多层次扰动定位文本对抗样本生成方法[J]. 计算机工程, 2025, 51(7): 232-243.
[11]	郭佩林, 张德, 王怀秀. 基于特征可视化探究跳跃连接结构对深度神经网络特征提取的影响[J]. 计算机工程, 2025, 51(4): 149-157.
[12]	张肇鑫, 黄世泽, 张兵杰, 沈拓. 面向交通场景的运动模糊伪装对抗样本生成方法[J]. 计算机工程, 2025, 51(3): 45-53.
[13]	赵宏, 宋馥荣, 李文改. 基于SE-AdvGAN的图像对抗样本生成方法研究[J]. 计算机工程, 2025, 51(2): 300-311.
[14]	黄舒怡, 谭光. 基于分区的高效视频目标检测[J]. 计算机工程, 2025, 51(2): 65-77.
[15]	刘婷, 董理, 严迪群, 王让定. 基于先验分布的抗JPEG压缩的鲁棒图像隐写[J]. 计算机工程, 2025, 51(11): 235-245.

选择文件类型/文献管理软件名称

选择包含的内容

CBA: 基于圆几何性质的黑盒攻击方法

CBA: Black Box Attack Method Based on Circular Geometric Properties

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 23

参考文献 33

相关文章 15

编辑推荐

Metrics

本文评价

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

CBA: 基于圆几何性质的黑盒攻击方法

CBA: Black Box Attack Method Based on Circular Geometric Properties

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 23

参考文献 33

相关文章 15

编辑推荐

Metrics

本文评价