This work investigates efficient score-based black-box adversarial attacks with a high Attack Success Rate (ASR) and good generalizability. We design a novel attack method based on a Disentangled Feature space, called DifAttack, which differs significantly from the existing ones operating over the entire feature space. Specifically, DifAttack firstly disentangles an image's latent feature into an adversarial feature and a visual feature, where the former dominates the adversarial capability of an image, while the latter largely determines its visual appearance. We train an autoencoder for the disentanglement by using pairs of clean images and their Adversarial Examples (AEs) generated from available surrogate models via white-box attack methods. Eventually, DifAttack iteratively optimizes the adversarial feature according to the query feedback from the victim model until a successful AE is generated, while keeping the visual feature unaltered. In addition, due to the avoidance of using surrogate models' gradient information when optimizing AEs for black-box models, our proposed DifAttack inherently possesses better attack capability in the open-set scenario, where the training dataset of the victim model is unknown. Extensive experimental results demonstrate that our method achieves significant improvements in ASR and query efficiency simultaneously, especially in the targeted attack and open-set scenarios. The code is available at https://github.com/csjunjun/DifAttack.git.

翻译：本研究探索基于评分的高效黑盒对抗攻击方法，旨在实现高攻击成功率（ASR）与良好的泛化性。我们设计了一种基于解耦特征空间的新型攻击方法——DifAttack，该方法与现有基于整体特征空间的攻击方法有本质区别。具体而言，DifAttack首先将图像的潜在特征解耦为对抗特征与视觉特征，其中前者主导图像的对抗能力，后者则主要决定其视觉外观。我们利用干净图像及其通过白盒攻击方法从可用替代模型生成的对抗样本（AEs）对来训练自编码器实现解耦。最终，DifAttack在保持视觉特征不变的前提下，根据受害模型的查询反馈迭代优化对抗特征，直至生成成功的对抗样本。此外，由于在黑盒模型的对抗样本优化过程中避免了使用替代模型的梯度信息，本方法在开放集场景（即受害模型训练数据集未知）中天然具有更强的攻击能力。大量实验结果表明，我们的方法能够同时显著提升攻击成功率和查询效率，尤其在目标攻击与开放集场景中表现突出。相关代码见https://github.com/csjunjun/DifAttack.git。