Abstract: Deep Neural Networks (DNNs) are vulnerable to adversarial examples, Simply adding a small perturbation to a clean image can cause the classifier to produce a misclassification. Decision-based attacks are a class of black-box attacks that rely only on the target model to predict hard labeled outputs. It considers the target model as a black box, and the attack simply queries the results of the target model without needing access to the internal structure or parameter information of the model. This feature poses a serious threat to real-world applications. Current decision-based attack methods usually utilize gradient estimation to launch attacks near the decision boundary of the target model, but it requires high query cost and generates poor quality of adversarial examples with more serious distortion. In this paper, we find that the low-frequency information in the frequency space of an image can effectively capture important features of the image. Performing decision attack in low-frequency space not only helps to reduce the number of queries, but also generates high-quality adversarial samples. To this end, this research proposes a black-box attack method based on the geometric properties of circles, called CBA. The method utilizes the discrete cosine transform to obtain the adversarial examples in the frequency space by using the geometric properties of circles near the decision boundary in a continuous iteration. Finally, the inverse discrete cosine transform transforms them back into the input space. It avoids gradient estimation and significantly reduces the number of queries while guaranteeing the success rate of the attack. Experimental results on the ImageNet dataset show that the attack success rate of CBA for generating adversarial examples is higher than that of the latest black-box attack methods that utilize the geometric nature of the decision boundaries for query volumes of 500,1000,2000, respectively. And also, CBA has a higher attack success rate under different constraints for the same query volume. The above results show that CBA reduces the amount of queries required to generate adversarial examples and generates adversarial examples with less distortion and better image quality. In addition to this, the effectiveness of CBA was tested in a real-world model.

摘要： 深度神经网络（Deep Neural Networks, DNNs）容易受到对抗样本的攻击，仅需在干净图像中添加微小扰动就能导致分类器产生错误分类。基于决策的攻击是一类只依赖目标模型预测硬标签输出的黑盒攻击。它将目标模型视为黑匣子，攻击时只需对目标模型结果进行查询，而无需了解模型内部结构和参数信息，这种特性对现实世界的应用程序构成了严重的威胁。目前基于决策的攻击方法通常利用梯度估计在目标模型决策边界附近发动攻击，但需要高昂的查询代价且生成的对抗样本质量效果不佳，失真较为严重。本文研究发现，图像在频率空间中的低频信息能够有效表征其重要特征。在低频空间执行决策攻击，不仅有助于降低查询次数，还能生成高质量的对抗样本。为此，该研究提出一种基于圆几何性质的黑盒攻击方法，称为CBA。该方法利用离散余弦变换，将攻击位置选择在频率空间中进行，利用低频信息在其决策边界附近利用圆的几何性质不断迭代得到低频空间中的对抗样本。最后，逆离散余弦变换将其变换回输入空间。它避免了梯度估计，在保证攻击成功率的同时显著降低查询次数。在ImageNet数据集上的实验结果表明，CBA在查询量分别为500,1000,2000的情况下，生成对抗样本的攻击成功率均比最新利用决策边界的几何性质的黑盒攻击方法高。同时，CBA在相同查询量不同约束条件下，也具有更高的攻击成功率。以上结果表明，CBA减少了生成对抗样本所需的查询量，且生成的对抗样本失真更小，图像质量更佳。除此之外，还在现实世界模型中测试了CBA的有效性。