Deep Neural Networks (DNNs) are acknowledged as vulnerable to adversarial attacks, while the existing black-box attacks require extensive queries on the victim DNN to achieve high success rates. For query-efficiency, surrogate models of the victim are used to generate transferable Adversarial Examples (AEs) because of their Gradient Similarity (GS), i.e., surrogates' attack gradients are similar to the victim's ones. However, it is generally neglected to exploit their similarity on outputs, namely the Prediction Similarity (PS), to filter out inefficient queries by surrogates without querying the victim. To jointly utilize and also optimize surrogates' GS and PS, we develop QueryNet, a unified attack framework that can significantly reduce queries. QueryNet creatively attacks by multi-identity surrogates, i.e., crafts several AEs for one sample by different surrogates, and also uses surrogates to decide on the most promising AE for the query. After that, the victim's query feedback is accumulated to optimize not only surrogates' parameters but also their architectures, enhancing both the GS and the PS. Although QueryNet has no access to pre-trained surrogates' prior, it reduces queries by averagely about an order of magnitude compared to alternatives within an acceptable time, according to our comprehensive experiments: 11 victims (including two commercial models) on MNIST/CIFAR10/ImageNet, allowing only 8-bit image queries, and no access to the victim's training data. The code is available at https://github.com/Sizhe-Chen/QueryNet.

翻译：深度神经网络（DNNs）已被证实易受对抗攻击，而现有黑盒攻击方法需要向目标DNN发起大量查询才能达到较高成功率。为提升查询效率，研究者利用受害模型的替代模型生成可迁移的对抗样本（AEs），其依据在于梯度相似性（GS），即替代模型的攻击梯度与受害模型相似。然而，人们普遍忽视利用它们在输出上的相似性（即预测相似性PS），在不查询受害模型的情况下通过替代模型筛选低效查询。为联合利用并优化替代模型的GS与PS，我们提出统一攻击框架QueryNet，可显著减少查询次数。QueryNet创新性地采用多身份代理进行攻击，即为同一样本通过不同替代模型生成多个AEs，并由替代模型决定最具攻击潜力的查询样本。此后，受害模型的查询反馈被累积用于优化替代模型的参数乃至架构，从而同时增强GS与PS。尽管QueryNet无法获取预训练替代模型的先验知识，但根据我们在MNIST/CIFAR10/ImageNet上针对11个受害模型（含两个商业模型）的综合实验（仅允许8位图像查询且无法获取训练数据），其查询次数比现有方法平均降低约一个数量级，且时间开销可接受。代码已开源至https://github.com/Sizhe-Chen/QueryNet。