Boosting Decision-Based Black-Box Adversarial Attack with Gradient Priors

1 Introduction

Deep neural networks have achieved great success on various of tasks, such as image classification [He et al., 2016; Pham et al., 2021], object detection [Wang et al., 2021; Wang et al., 2022] and speech recognition [Chiu et al., 2018; Park et al., 2019]. However, recent researches demonstrate that neural networks are significantly vulnerable to adversarial examples, which are almost indistinguishable from natural data in human perception and yet classified incorrectly by the models [Goodfellow et al., 2015; Cao et al., 2021; Zhong et al., 2022]. This phenomenon probably causes a large risk in many real-world applications, such as spam detection [Wu et al., 2017], automatic drive [Luo et al., 2021; Muhammad et al., 2021] and economic services [Cintas et al., 2020]. Investigating the generation rationale behind adversarial examples seems a promising way to improve the robustness of neural networks, which motivates the research of adversarial attacks. Based on the accessibility level of victim models, adversarial attacks can be categorized into whitebox attacks and black-box attacks. For white-box attacks [Moosavi-Dezfooli et al., 2016; Carlini and Wagner, 2017], the attackers are assumed to have full knowledge about the target model, including training data, model architecture and parameters. Therefore, it is easy to utilize gradient information to lead these methods to generate adversarial examples. However, these attack methods are overly idealistic and even impracticable in real application scenarios, as most model developers are impossible to release all the model and data information in public. For black-box attacks, the attackers only have extremely limited knowledge about the target model, e.g., the predicted labels or confidence scores, so this kind of adversarial attacks seems more promising and practical.

∗Corresponding author.

Existing black-box attacks mainly contain transfer-based methods, score-based methods and decision-based methods. Transfer-based methods [Guo et al., 2020; Wu et al., 2020; Qin et al., 2022] aim to train a surrogate model to imitate the behaviors of the target model and then conduct the whitebox attacks on it. This kind of attack needs a huge number of training data that are similar to the data used for training the target model, which is difficult to achieve in practice. Score-based attacks [Guo et al., 2019; Li and Chen, 2021; Li et al., 2020b] require that the target models provide the predicted scores, which is also impractical in real-world applications since they may only offer the predicted labels. Compared with transfer-based and score-based approaches, decision-based methods [Chen et al., 2020; Li et al., 2020a] can only use discrete predicted labels to attack the target model, thus seem more realistic and feasible. However, existing decision-based attack models are not perfect since they usually rely on a large number of queries to generate adversarial examples.

Gradient estimation is the key point in decision-based methods, as it consumes the majority of all the queries. Recently, [Ilyas et al., 2019] attempt to integrate two types of gradient priors, i.e., data-dependent prior and time-dependent prior, into score-based methods to facilitate them to obtain better performance. Nevertheless, these two priors are still difficult to simply extend to decision-based methods, as they suffer from the following drawbacks. (1) The data-dependent prior follows a strong assumption, that is, if two pixels are spatially close to each other, then their estimated gradients may have similar directions. This prior only takes spatial information into consideration but ignores the importance of the values of pixels. In fact, only the pixels have similar values and are spatially close, their estimated gradients may be similar. The sharp change of pixel values usually appears on the edge of objects. Therefore, to estimate the gradients accurately, it is essential to address the edge gradient discrepancy problem. (2) The time-dependent prior assumes that the gradients of successive steps are highly correlated and tend to be similar, which is suitable for score-based methods. This is because that in the iterative procedure of scorebased methods, the distances between successive adversarial samples keep small, so the gradient direction of successive steps will also be similar. However, in the iterative procedure of decision-based methods, the distances between successive adversarial samples will be relatively large in the beginning, but become small subsequently. This indicates that the gradient direction of successive steps should have a similar tendency. In addition, when the similarity between estimated gradients at current and previous iterations is very large, it means that decision-based methods have fully explored in the estimated gradient direction, so a new gradient direction is needed to accelerate the convergence speed. Based on the above analysis, we need to design a crafty strategy to adjust the successive iteration gradient direction, thus boosting the query efficiency.

In this paper, we propose a novel Decision-based Blackbox Attack framework with Gradient Priors (DBA-GP). To tackle the edge gradient discrepancy problem, we propose to leverage the data-dependent prior via the joint bilateral filter, which can not only smooth similar gradients for spatially close pixels with similar values, but also diversify gradients for pixels with different values. To deal with the successive iteration gradient direction problem, we simultaneously consider the distance between successive adversarial samples and the gradient direction of successive steps as additional judgment conditions, thus can generate a more appropriate gradient direction to improve the query efficiency. In summary, our contributions are as follows:

• We propose a new decision-based black-box adversarial attack framework with two simple yet effective gradient priors, thus can generate high-quality adversarial examples efficiently.
• We discover two fundamental drawbacks of existing gra-

dient priors, i.e., the edge gradient discrepancy issue and the successive iteration gradient direction issue. To overcome these limitations, we utilize the joint bilateral filter and two specially-designed gradient updating judgement conditions, and integrate them into decision-based attack models seamlessly.

• We conduct extensive experiments against both offline and online models to validate the superiority of the proposed method compared with other strong baselines.

2 RelatedWork

Decision-based methods only require discrete predicted labels to attack the target model, thus seem more feasible and promising in real-world applications. [Brendel et al., 2018] propose the first decision-based attack method (boundary attack), which starts with a large perturbation and then performs a random walk on the decision boundary to reduce the distance to the target image, but the use of the standard normal distribution affects the efficiency of the attack. Biased boundary attack [Brunner et al., 2019] uses some biases that can significantly reduce the number of queries. SIGN-OPT [Cheng et al., 2020] utilizes the gradient sign estimation to improve the query efficiency. EA [Dong et al., 2019] designs an evolutionary algorithm to carry out the attack. HSJA [Chen et al., 2020] utilizes the binary information on the decision boundary to estimate the gradient direction, which provides a fundamental and powerful framework for decisionbased methods. QEBA [Li et al., 2020a] employs three subspace optimization methods that can reduce the number of queries and further improve the performance. PSBA [Zhang et al., 2021] further improves the query efficiency via progressive scaling techniques. However, it requires to train the GAN model with more additional data. SurFree [Maho et al., 2021] attempts to move along diverse directions guided by the geometrical properties of the decision boundary. AHA [Li et al., 2021] utilizes historical query information to improve the random walk optimization. Although decision-based methods have shown to be effective in adversarial attacks, they are complicated and still require a large number of queries.

3 ProblemFormulation

Given an input image x ∈ [0, 1]dim, considering an m-class image classification model F : Rdim → Rm, we can get the prediction result by y = argmaxi [F (x)]i , where [F(x)]i represents the probability score belonging to the i-th class, and i ∈ {1, 2, ...,m}. Given an image x∗ with the true label y∗ , the targeted attack aims to find an adversarial image xadv such that the model outputs a pre-specified class yadv under the constraint that d (x∗ , xadv) is minimum, where d(·) is a distance measure function like l0, l2 or l∞ norm. Formally,

where ϕx∗(x) : [0, 1]dim -→ {-1, 1} is a sign function defined as:

Here Sx∗ : Rdim → R is a real-valued function defined as:

From Eq. (3), it is easy to observe that x is adversarial if and only if Sx∗ (x) > 0. When Sx∗ (x) = 0, x is exactly on the decision boundary. Note that in the decision-based black-box attack scenario, we can only get the value of function ϕx∗(x). For ease of representation, hereinafter we represent the functions Sx∗(x) and ϕx∗(x) as S(x) and ϕ(x) respectively.

In contrast, the untargeted attack aims to find an adversarial image with any incorrect category. It is worth noting that by simply treating all classes different from y∗ as the class yothers, we can convert an untargeted attack to a targeted attack, hence only considering the targeted attack is enough.

In terms of decision-based black-box adversarial attacks, the basic idea is to first select an initial adversarial image xinit with predicted category label yadv, then move xinit towards x∗ as close as possible and keep yadv unchanged simultaneously. In this paper, we focus on this type of method and attempt to improve this procedure with two simple yet effective gradient priors.

4 Decision-Based Black-Box Attack with Gradient Priors

4.1 The Overall Framework

The DBA-GP method utilizes a similar framework with the powerful decision-based boundary attack method HSJA [Chen et al., 2020]. It adopts a sampling-based gradient estimation component to guide the search direction. Specifically, it first selects xinit as an initial adversarial image, and then performs an iterative algorithm consisting of the following three parts: (1) Estimating the gradient direction of the current adversarial image; (2) Moving the current adversarial image along the direction of the estimated gradient; (3) Approaching the decision boundary via a binary search strategy.

Estimating the Gradient

Denote by x(t) adv the adversarial image on the decision boundary in the t-th iteration, the direction of the gradient ∇Sx∗ (x(t) adv ) can be approximated via the Monte Carlo estimation [Mooney, 1997]:

where {ub}Bb=1 are d-dimensional random perturbations with the unit length, and δt is a small positive parameter. As [Chen et al., 2020] state, this estimate is accurate only if x(t) adv is on the decision boundary.

Moving Along the Gradient Direction

When obtaining the estimated gradient, DBA-GP moves x(t) adv along the gradient direction with the following formula:

where ξt is the step size at the t-th step, and Eq. (5) should satisfy the constraint that ϕx∗ (˜x(t) adv ) = 1.

Approaching the Boundary

After moving along the gradient direction, ˜x(t) adv may be far from the decision boundary. To ensure that x(t+1) adv still approaches the decision boundary, DBA-GP pulls ˜x(t) adv towards the target image x∗ by:

where the coefficient αt ∈ [0, 1], which can be determined by a binary search method.

4.2 Gradient Estimation with Priors

In the overall framework shown in Section 4.1, estimating the gradient plays the most crucial role as its accuracy will directly affect the query efficiency of the method. Obviously, increasing the value of B is a straightforward way to improve the quality of gradient estimation. However, in adversarial attack scenarios, as the algorithm is iterative and limited by a fixed query budget, an excessively large B is unreasonable and impracticable.

Previous studies [Ilyas et al., 2019; Li et al., 2020a] attempt to use data-dependent and time-dependent gradient priors to obtain more accurate gradient estimation results, which have achieved promising performance. However, they still suffer from the edge gradient discrepancy issue and the successive iteration gradient direction issue. In the following, we will dissect the reasons behind the above issues and propose the corresponding solutions.

Gradient Estimation with the Data-Dependent Prior

The spatially local similarity (i.e, pixels that are close together tend to be similar) is a well-known prior in the image domain. Inspired by this fact, the data-dependent gradient prior means that the gradients of adjacent pixels tend to be similar. Specifically, if two coordinates (i, j) and (k, l) in ∇Sx∗(x) are close, then we have ∇Sx∗(x)i,j ≈ ∇Sx∗(x)k,l.

Existing works [Ilyas et al., 2019; Li et al., 2020a] attempt to utilize the average-pooling, bilinear interpolation or inverse discrete cosine transform techniques to ameliorate the accuracy of gradient estimation, and have shown to be effective in black-box adversarial attacks. However, they still suffer from the edge gradient discrepancy problem. Specifically, considering the image edge locations, it is easy to discover a phenomenon that although two coordinates are close, their pixel values are usually different, then their gradients also tend to be different.

To confirm our observation, we randomly select 50 images from ImageNet [Deng et al., 2009]. For each image, we first normalize all pixels into [0, 1], calculate the absolute values of adjacent pixel differences, and assign them into five intervals [0, 0.2], (0.2, 0.4], (0.4, 0.6], (0.6, 0.8] and (0.8, 1.0]. Then we calculate the ratio of similar adjacent pixel gradients averaged over all images. Here we treat the gradient values with the same positive and negative signs to be similar. Figure 1 (a) shows the statistic results about the ratio of similar adjacent pixel gradients in various adjacent pixel difference intervals. It can be seen that with the increase of the adjacent pixel difference, the ratio of similar adjacent pixel gradients tends to be small. That is to say, when the adjacent pixel values are close, the corresponding adjacent pixel gradients are inclined to be close. On the contrary, when the adjacent pixel values are large, the corresponding adjacent pixel gradients will be disparate. According to the above analysis, the data-dependent prior should be redefined as: the gradients of adjacent pixels tend to be similar if their pixel values are similar.

The joint bilateral filter [Petschnigg et al., 2004] is a nonlinear, edge-preserving, and noise-reducing smoothing filter, which has the following advantages. If nearby pixels are similar, it can replace the intensity of each pixel with a weighted average of intensity values from nearby pixels. If nearby pixels are diverse, it will not smooth these nearby pixels. To better leverage the data-dependent prior, we propose to use joint bilateral filter to deal with each random perturbation ub with x∗ as the guide image. Formally,

where ˜ub is the filtered perturbation which can be used to replace ub. x∗ is the original target image, which can provide abundant image characteristic information. J is the joint bilateral filter. In the following, we give the concrete computation formula of J.

Given an image A (n×n size) and a guided image G (n×n size), after passing through the joint bilateral filter J, the filter output of Ai,j can be calculated by:

where Ω represents a neighborhood of pixel coordinates (i, j). w(i, j) is a normalization term which can be obtained by:

The functions gs(i, j, k, l) and gr(Gi,j,Gk,l) are computed by:

where σs and σr are parameters which can be used to adjust the spatial similarity and the range (intensity/color) similarity respectively.

Gradient Estimation with the Time-Dependent Prior

The time-dependent prior means that the gradients of successive steps are heavily correlated and tend to be highly similar, which is also called the multi-step prior. [Ilyas et al., 2019] attempt to extend the time-dependent prior to score-based attack methods and have achieved impressive performance. However, it is difficult to be directly applied to decision-based attack methods. The reasons are as follows. For score-based attack methods, they start from the original image and then move along the gradient direction until an adversarial image is found. Thus, the distances between successive adversarial samples in the whole iterative procedure will keep small, and the gradient direction of successive steps will also be similar. However, for decision-based attack methods, they first select an adversarial image (outside the decision boundary) which is far away from the original image, and then gradually reduce its distance from the original image. Therefore, the distances between successive adversarial samples in the iterative procedure will be relatively large in the beginning, but become small later on. In the same manner, the gradient direction of successive steps should keep a similar tendency.

To validate our hypothesis, we randomly sample 50 target images from ImageNet and calculate the average cosine similarity of the gradients between successive steps based on the decision-based boundary attack method HSJA [Chen et al., 2020]. Figure 1 (b) shows the average cosine similarity of the gradients between the current and previous steps along the optimization trajectory of HSJA. It can be seen that in the first 50 steps the gradients between successive steps are not very similar, but after that they become closer and closer.

Based on the above analysis, we attempt to use the following formula to estimate the gradient:

where X (t) = {x(j) adv : max(1, t-k) ≤ j ≤ t-1,Dt,j < τ} is the set of intermediate-process generated adversarial images that satisfy some conditions. m is the number of images in X (t) . Dt,j = d (x(t) adv , x(j) adv ) is the distance between x(t) adv to x(j) adv . k represents that there are k iterations before the current iteration step. τ is a threshold parameter.

For Eq. (12), we first use X (t) to filter out the intermediateprocess adversarial images with large distances, and then utilize the remaining ones to facilitate the current gradient estimation. Obviously, it will increase the accuracy of the gradient estimation significantly. However, it cannot lead to an

Algorithm 1 Gradient Estimation with Priors

Input: An image x∗ , the number of random sampling B, the joint bilateral filter J, the time-dependent length k, the decision function ϕ, the perturbation size δt, the distance function d, the adversarial image x(t) adv in the t-th iteration, the adversarial image set {x(j) adv : max(1, t - k) ≤ j ≤ t - 1}, the gradient estimation result set {̂ ∇S (x(j) adv , δj ) : max(1, t - k) ≤ j ≤ t - 1}, the threshold parameters τ and ρ.

Output: The estimated gradient ̂ ∇S (x(t) adv , δt).

• 1: Sample B random perturbations {ub}Bb=1
• 2: Deal with perturbations using the joint bilateral filter: {˜ub}Bb=1 = {J(ub, x(t) adv )}B b=1
• 3: Estimate the gradient with the following formula: ˜ ∇S (x(t) adv , δt) = 1B ∑Bb=1 ϕ (x(t) adv + δt˜ub) ˜ub
• 4: ∇S(t) p = 0
• 5: for j in [max(1, t -k), t -1] do
• 6: Dt,j = d (x(t) adv , x(j) adv )

• 8: if Dt,j < τ and St,j > ρ then

• 10: end if
• 11: end for
• 12: if ∇S(t) p ̸= 0 then

• 14: else
• 15: ∇S(t) p = 0
• 16: end if

• 18: return̂ ∇S (x(t) adv , δt)

improvement in query efficiency. This is because in each iteration, decision-based attack methods will move a step along the estimated gradient direction as large as possible, which means that decision-based attack methods have fully explored in that gradient direction. Therefore, if the similarity between estimated gradients at current and previous iterations is very large, we need to generate a new gradient direction to speed up the algorithm convergence, thus improving the query efficiency.

To achieve the above goal, we define the set A(t) = {x(j) adv : max(1, t - k) ≤ j ≤ t - 1,Dt,j < τ, St,j > ρ}, which contains intermediate-process generated adversarial images that satisfy some conditions. Dt,j = d (x(t) adv , x(j) adv ) is the distance between x(t) adv to x(j) adv . St,j is the cosine similarity between ˜ ∇S (x(t) adv , δt) and ̂ ∇S (x(j) adv , δj ), where ˜ ∇S (x(t) adv , δt) is the estimated gradient in the t-th iteration with Eq. (4), and ̂ ∇S (x(j) adv , δj ) is the final estimated gradient in the j-th iteration. τ, ρ and k are hyperparameters. Based on the above definitions, in the t-th iteration we can first estimate the gradient ˜ ∇S (x(t) adv , δt) with Eq. (4), and then obtain the final gradient ̂ ∇S (x(t) adv , δt) with:

where ∇S(t) p is the average estimated gradient of adversarial images in A(t) , and it can be calculated by:

(1) If A(t) is not an empty set, we first compute ∇S(t) p by:

and then compute ∇S(t) p by:

(2) If A(t) is an empty set, we simply set ∇S(t) p = 0. By using ̂ ∇S (x(t) adv , δt) as the estimate of the gradient direction, we can better leverage the time-dependent prior to improve the query efficiency of decision-based attack methods.

Algorithm 1 summarizes the details about how to integrate data-dependent and time-dependent priors into the gradient estimation procedure.

5 Experiments

5.1 Datasets

For offline experiments, we first conduct preliminary experiments on a simple dataset MNIST [LeCun, 1998]. Then we make a comprehensive evaluation on ImageNet [Deng et al., 2009] and Celeba [Liu et al., 2015] datasets. For different datasets, we exactly follow [Li et al., 2020a] to randomly select 50 pairs of correctly classified images from the validation set of each dataset as the target images and the initial adversarial images. For online experiments, we attack the commercial face recognition API Face++ 1 .

5.2 VictimModels

For MNIST, we train a neural network consisting of two convolutional layers and two fully connected layers as the victim model. For ImageNet, we choose two well-known pre-trained models ResNet50 [He et al., 2016] and VGG16 [Simonyan and Zisserman, 2015] as the victim models. For Celeba, we utilize samples from 100 people to fine-tune the pre-trained models ResNet50 and VGG16 on ImageNet, and take the fine-tuned models as the victim models.

1 https://www.faceplusplus.com/face-comparing/.

5.3 Baselines

We compare the proposed method with the state-of-the-art targeted decision-based black-box attacks: EA [Dong et al., 2019], SIGN-OPT [Cheng et al., 2020], HSJA [Chen et al., 2020], QEBA [Li et al., 2020a], SURFREE [Maho et al., 2021], and AHA [Li et al., 2021].

5.4 Implementation Details

Evaluation metrics. The first evaluation metric is the average mean squared error (MSE) between the generated adversarial image and the target image as the number of queries increases. A smaller MSE means that the adversarial image is closer to the target image and also indicates that the attack quality is better. Under the same query budget, the lower the achieved MSE, the higher the query efficiency of the attack. The second evaluation metric is the attack success rate (ASR) of reaching a specified MSE threshold under a limited budget of queries. For the same query budget, a higher ASR indicates better attack quality.

Parameter settings. We develop our framework based on the FoolBox library [Rauber et al., 2017; Rauber et al., 2020]. The image size of MNIST is 28×28, we set the spacial sensitivity σs = 2 and the range sensitivity σr = 8/255. For other datasets, we resize their image size to 3×224×224, and set σs = 8 and σr = 32/255. We set the time-dependent length k = 5, the MSE threshold τ = 0.2 and the cosine similarity threshold ρ = 0.1 respectively. We set B = 100, which is the number of perturbations selected in each gradient estimation. We use the l2 norm as the distance measure function d(·). In addition, we set the step size ξt = ∥∥∥x(t) adv - x∗∥∥∥2 /√t and the perturbation size δt = ∥∥∥x(t) adv - x∗∥∥∥2 /dim, where t is the iteration number and dim is the input dimension.

5.5 Experimental Results

Contribution analysis of each gradient prior. To make a comprehensive analysis of different gradient priors, we conduct the ablation study on a simple dataset MNIST, which has a smaller image resolution of 28 × 28, thus can converge faster and demonstrate the contribution of each gradient prior clearly. Specifically, we compare the following five cases.

• DBA-GP means the DBA model with both timedependent prior and data-dependent prior.
• Without data-dependent prior (w/o DP) means the DBA model with only time-dependent prior.
• Without time-dependent prior (w/o TP) means the DBA model with only data-dependent prior.
• Without DP and TP (w/o DP & TP) means the DBA model without both gradient priors.
• With only naive time-dependent prior (Naive TP) means the DBA model with only the naive timedependent prior described in Eq. (12).

Figure 2 shows the curves of MSE versus the number of queries when using different gradient priors on MNIST. Xaxis represents the number of queries, and Y -axis denotes the average MSE value. From the results, we can get that w/o DP

and w/o TP perform better than w/o DP & TP, which indicates that using arbitrary gradient prior properly could improve the performance to some extent. We can also observe that the naive time-dependent prior described in Eq. (12) will bring some side effects on performance. The reason is that Eq. (12) ignores the gradient direction change at the current and previous iteration. In addition, it also can be seen that DBA-GP using both data-dependent and time-dependent gradient priors can achieve the best performance. The reason is that DBAGP utilizes the joint bilateral filter and two specially-designed judgement conditions to better leverage data-dependent and time-dependent gradient priors respectively, thus avoiding the edge gradient discrepancy issue and the successive iteration gradient direction issue.

Comparison with baselines. Table 1 shows the performance against different baselines on ImageNet and Celeba with 1K, 3K, and 5K queries respectively. The main results in the table are MSE values, and the results in parentheses represent ASR values when the MSE threshold is 0.001. The best results are highlighted in bold. It can be observed that DBA-GP performs much better than other strong baselines. Specifically, in terms of MSE under 3K queries, no matter attacking ResNet50 or VGG16, DBA-GP can have less than one-half of MSE values than other models on ImageNet, and even less than one-third of MSE values on Celeba. In terms of ASR with 3K queries, when attacking ResNet50 on ImageNet and Celeba, DBA-GP can improve the ASR values by 16% and 40% respectively compared with the best baseline. The reason is that DBA-GP utilizes more gradient prior information, which enables it can obtain better adversarial images within less number of queries. In addition, as the query number increases, each method tends to achieve a lower MSE and a higher ASR. But the convergence speed of DBA-GP is the fastest, which makes it more promising in real applications.

Attack the real-world API Face++. We also attack the real-world face recognition API Face++ from MEGVII. The API Face++ could give the prediction confidence score of whether two images contain the same person. In the experiment, when the returned confidence score is greater than 60%, we think the corresponding images are labeled as the same person. Note that since the pixel values of the images uploaded to the API are 8-bit floating point numbers that are not continuous in [0, 1], we follow QEBA [Li et al., 2020a] to discretize the images. Figure 3 shows the results of attacking Face++ API. The first column is the target image and the initial adversarial image, and the last four columns are the adversarial images produced by different attack methods under different query numbers. We can observe that the adversarial image attempts to get close to the target image gradually and keep the label unchanged. For HSJA, the MSE values do not decrease with increasing the number of queries, which indicates that it is difficult to find a better adversarial image. In addition, the right side of the generated adversarial image always contains the facial feature of the initial adversarial image, which also indicates HSJA works not well. QEBA performs much better, but it requires 5K queries to get a clean-looking adversarial image. DBA-GP could generate high-quality adversarial images at only 1K queries, and the MSE value decreases continually as the number of queries increases. All these phenomena validate the superiority of our proposed DBA-GP.

Attack results of defending with adversarial training. Adversarial training [Madry et al., 2018] has shown to be effective to defend against adversarial attacks. Therefore, we further compare the performance of different attacking models when attacking the ResNet-152 model with adversarial training on ImageNet. Table 2 gives the results, the main results are MSE values, and the results in parentheses represent Initial Adversarial Image MSE=0.00578

# Queries=150

MSE=0.00193 MSE=0.00088 MSE=0.00047

# Queries=1K # Queries=3K # Queries=5K

Figure 3: Comparison of different attack models when attacking against real-world API Face++.

ASR values when the MSE threshold is 0.01. The results in Table 2 show that our method DBA-GP can also obtain the best adversarial performance.

6 Conclusion

In this paper, we propose DBA-GP, a novel decision-based black-box attack framework with gradient priors. To better leverage the data-dependent gradient prior, DBA-GP exploits the joint bilateral filter to process each perturbation, which can mitigate the edge gradient discrepancy to some extent. To seamlessly integrate with the time-dependent gradient prior, DBA-GP introduces a new successive iteration gradient direction update strategy, which can speed up the convergence significantly. Extensive experiments confirm the superiority of our proposed method over other strong baselines, especially in query efficiency. In future work, we plan to investigate the theoretical underpinnings of the proposed method and extend it to other types of black-box adversarial attack methods.

Acknowledgments

The authors are grateful to the reviewers for their valuable comments. This work was supported by National Natural Science Foundation of China (No. 62106035, 62206038, 61972065) and Fundamental Research Funds for the Central Universities (No. DUT20RC(3)040, DUT20RC(3)066), and supported in part by Key Research Project of Zhejiang Lab (No. 2022PI0AC01), National Key Research and Development Program of China (2022YFB4500300) and CAAIHuawei Mindspore Open Fund. We also would like to thank Dalian Ascend AI Computing Center and Dalian Ascend AI Ecosystem Innovation Center for providing inclusive computing power and technical support.