低クエリ予算でクエリ効率の良い決定ベースの敵対的攻撃

Today's deep neural networks have excellent performance on a variety of tasks. However, the emergence of adversarial examples has raised concerns about the security of the models. Attacks on real-world models are difficult because real-world models only return the final decision. While the decision-based attacks can generate adversarial examples solely based on the model's hard-label information, which makes it closest to real-world. However, existing decision-based attacks still require thousands of queries to generate good quality adversarial examples. Therefore, in order to generate high-quality adversarial examples with low query budget, we present a novel decision-based attack one plane one query attack (OPOQA). The main idea of the OPOQA is to generate more candidate examples in each iteration for random exploration of the decision boundary and select the most suitable adversarial example for the next iteration. In each iteration, we sample from the low-frequency discrete cosine transform (DCT) space and transform it back to the pixel space via inverse DCT (iDCT). This generates a set of random vectors in the pixel space which form a two-dimensional (2D) plane. Only one candidate sample is generated on this plane to reduce the number of queries. Non-target attacks on six mainstream models-Inception-v3, ResNet, VGG, Vit, and others-performed on the ImageNet validation set (200 randomly selected images) show that, with a query budget of 1000 and RMSE thresholds of 0.05 and 0.01(where RMSE ≤ 0.05 represents disturbances that are virtually imperceptible to the human eyes), the attack success rates of our method against Inception-v3 achieves 94% and 49%, compared to the state-of-the-art EPCA algorithm, the attack success rates increased by 4.5% and 11.5%, respectively. Code is available at https://github.com/tttyz9/OPOQA.