In generating adversarial examples, the conventional black-box attack methods rely on sufficient feedback from the to-be-attacked models by repeatedly querying until the attack is successful, which usually results in thousands of trials during an attack. This may be unacceptable in real applications since Machine Learning as a Service Platform (MLaaS) usually only returns the final result (i.e., hard-label) to the client and a system equipped with certain defense mechanisms could easily detect malicious queries. By contrast, a feasible way is a hard-label attack that simulates an attacked action being permitted to conduct a limited number of queries. To implement this idea, in this paper, we bypass the dependency on the to-be-attacked model and benefit from the characteristics of the distributions of adversarial examples to reformulate the attack problem in a distribution transform manner and propose a distribution transform-based attack (DTA). DTA builds a statistical mapping from the benign example to its adversarial counterparts by tackling the conditional likelihood under the hard-label black-box settings. In this way, it is no longer necessary to query the target model frequently. A well-trained DTA model can directly and efficiently generate a batch of adversarial examples for a certain input, which can be used to attack un-seen models based on the assumed transferability. Furthermore, we surprisingly find that the well-trained DTA model is not sensitive to the semantic spaces of the training dataset, meaning that the model yields acceptable attack performance on other datasets. Extensive experiments validate the effectiveness of the proposed idea and the superiority of DTA over the state-of-the-art.

翻译：在生成对抗样本时，传统黑盒攻击方法需通过反复查询待攻击模型直至攻击成功，依赖其充分反馈，这通常导致一次攻击需数千次尝试。然而在真实应用中，机器学习即服务平台（MLaaS）通常仅向客户端返回最终结果（即硬标签），且配备防御机制的系统可轻易检测恶意查询，因此此类方法可能难以接受。相比之下，可行的方案是采用仅允许有限次查询的硬标签攻击模拟攻击行为。为实现这一构想，本文绕过对目标模型的依赖，利用对抗样本分布特性，以分布变换方式重新构建攻击问题，并提出基于分布变换的攻击方法（DTA）。该方法通过处理硬标签黑盒设置下的条件似然，构建从良性样本到其对抗样本的统计映射，从而无需频繁查询目标模型。训练完备的DTA模型可直接高效地为特定输入生成批量对抗样本，并基于可迁移性假设攻击未知模型。此外，我们意外发现训练完备的DTA模型对训练数据集的语义空间不敏感，即该模型对其他数据集仍保持可接受的攻击性能。大量实验验证了所提思路的有效性及DTA相比现有最优方法的优越性。