Existing black-box attacks have demonstrated promising potential in creating adversarial examples (AE) to deceive deep learning models. Most of these attacks need to handle a vast optimization space and require a large number of queries, hence exhibiting limited practical impacts in real-world scenarios. In this paper, we propose a novel black-box attack strategy, Conditional Diffusion Model Attack (CDMA), to improve the query efficiency of generating AEs under query-limited situations. The key insight of CDMA is to formulate the task of AE synthesis as a distribution transformation problem, i.e., benign examples and their corresponding AEs can be regarded as coming from two distinctive distributions and can transform from each other with a particular converter. Unlike the conventional \textit{query-and-optimization} approach, we generate eligible AEs with direct conditional transform using the aforementioned data converter, which can significantly reduce the number of queries needed. CDMA adopts the conditional Denoising Diffusion Probabilistic Model as the converter, which can learn the transformation from clean samples to AEs, and ensure the smooth development of perturbed noise resistant to various defense strategies. We demonstrate the effectiveness and efficiency of CDMA by comparing it with nine state-of-the-art black-box attacks across three benchmark datasets. On average, CDMA can reduce the query count to a handful of times; in most cases, the query count is only ONE. We also show that CDMA can obtain $>99\%$ attack success rate for untarget attacks over all datasets and targeted attack over CIFAR-10 with the noise budget of $\epsilon=16$.

翻译：现有黑盒攻击在生成对抗样例（AE）以欺骗深度学习模型方面展现出显著潜力。然而，多数攻击方法需处理庞大的优化空间并消耗大量查询次数，导致其在真实场景中实际应用受限。本文提出一种新型黑盒攻击策略——条件扩散模型攻击（CDMA），旨在提升查询受限条件下生成AE的查询效率。CDMA的核心思想在于将AE合成任务转化为分布变换问题，即良性样本与其对应AE可被视为来自两种不同分布，并通过特定转换器实现相互转化。不同于传统的"查询-优化"范式，我们利用上述数据转换器直接进行条件变换生成合格AE，从而大幅减少所需查询次数。CDMA采用条件去噪扩散概率模型作为转换器，该模型可学习从干净样本到AE的变换过程，并确保对抗扰动能够平滑发展以抵御多种防御策略。通过在三组基准数据集上与九种最先进黑盒攻击方法进行对比，我们验证了CDMA的有效性和高效性。平均而言，CDMA可将查询次数降至个位数，且在多数情况下仅需一次查询。实验表明，在噪声预算ε=16条件下，CDMA在全部数据集上的非定向攻击成功率超过99%，在CIFAR-10数据集上的定向攻击同样达到该指标。