In recent years, Deep Learning(DL) techniques have been extensively deployed for computer vision tasks, particularly visual classification problems, where new algorithms reported to achieve or even surpass the human performance . While many recent works demonstrated that DL models are vulnerable to adversarial examples.Fortunately, generating adversarial examples usually requires white-box access to the victim model, and real-world cloud-based image classification services are more complex than white-box classifier,the architecture and parameters of DL models on cloud platforms cannot be obtained by the attacker. The attacker can only access the APIs opened by cloud platforms. Thus, keeping models in the cloud can usually give a (false) sense of security.In this paper, we mainly focus on studying the security of real-world cloud-based image classification services. Specifically, (1) We propose two novel attack methods, Image Fusion(IF) attack and Fast Featuremap Loss PGD (FFL-PGD) attack based on Substitution model ,which achieve a high bypass rate with a very limited number of queries. Instead of millions of queries in previous studies, our methods find the adversarial examples using only two queries per image ; and (2) we make the first attempt to conduct an extensive empirical study of black-box attacks against real-world cloud-based classification services. Through evaluations on four popular cloud platforms including Amazon, Google, Microsoft, Clarifai, we demonstrate that Spatial Transformation (ST) attack has a success rate of approximately 100\% except Amazon approximately 50\%, IF and FFL-PGD attack have a success rate over 90\% among different classification services. (3) We discuss the possible defenses to address these security challenges in cloud-based classification services.Our defense technology is mainly divided into model training stage and image preprocessing stage.

翻译：近年来,Deep Learning(DL)技术被广泛用于计算机视觉任务,特别是视觉分类问题,据新算法报告可以实现甚至超过人类性能。虽然许多最近的工作表明DL模型容易成为对抗性实例。 可惜,产生对抗性实例通常需要使用受害者模型的白箱访问,而真实世界云基图像分类服务比白箱分类更为复杂,攻击者无法在云平台上获取DL模型的架构和参数。攻击者只能访问云平台所打开的API。因此,在云中保留模型通常能带来(假的)安全感。在本文件中,我们主要侧重于研究真实世界云基图像分类服务的安全性。具体地说,我们提出了两种新型攻击方法,即图像Fusion(IF)攻击和快速地磁损失PGD(FFL-PGD)模型(FFL-PGD)攻击性攻击,这些模型的绕行率高,在云平台上查询次数非常有限。因此,在前几百万次的搜索中,将云层模型显示(fal)安全性分析率(ST-Florevorld)的模型中,我们只能用两种方法来进行真正的研究。