SBA: Black Box Attack Method Based on Sphere Geometric Properties

doi:10.3778/j.issn.1673-9418.2407054

Abstract

Abstract: Deep neural networks (DNNs) are susceptible to attacks with adversarial examples generated by tiny perturbations, which now pose a great threat to DNNs-based applications. Decision-based attacks are a class of black-box attacks that rely only on the target model to predict hard labels. Current decision-based attack methods usually use gradient estimation to launch attacks near the decision boundary of the target model, but require costly queries. Therefore, this research proposes a black-box attack method based on the geometric properties of the ball, called sphere-based black-box attack (SBA). It utilizes the spatial geometric properties of the ball to find optimal adversarial examples points, avoids gradient estimation, and achieves high attack success rate and low quality loss of adversarial examples. Firstly, initial adversarial examples are obtained by adding random large noise and linear lookup. Then, the input samples and adversarial examples are transformed to a two-dimensional frequency space using the discrete cosine transform and sampling a three-dimensional subspace using their relative position relations. Next, the frequency space decision boundary is approximated as a hyperplane and the geometric properties of the ball are used to iteratively update the better adversarial examples in the frequency space, and this step is repeated for continuous updating. Finally, the inverse discrete cosine transform is utilized to transform it back to the input space to finally obtain the best adversarial examples. Experimental results on the ImageNet dataset show that SBA achieves better performance in terms of attack success rate, and the PSNR and SSIM results indicate that SBA generates better quality images.

Key words: adversarial examples, black-box attack, decision-based attack, image processing

摘要： 深度神经网络（DNN）很容易受到微小扰动生成的对抗样本的攻击，它对基于DNN的应用构成极大威胁。基于决策的攻击是一类仅依赖目标模型预测硬标签的黑盒攻击。目前基于决策的攻击方法通常采用梯度估计在目标模型决策边界附近发动攻击，但需要高昂的查询代价。因此，该研究提出一种基于球几何性质的黑盒攻击方法，称为球攻击（SBA）。它利用球的空间几何性质寻找最优对抗样本点，避免了梯度估计，实现了高攻击成功率和低质量损失的对抗样本。通过添加随机大噪声和线性查找得到初始对抗样本。利用离散余弦变换将输入样本和对抗样本变换到频率空间并利用几何位置关系采样三维子空间。将频率空间决策边界近似为超平面并利用球的几何性质迭代更新频率空间内更优的对抗样本，重复此步骤不断更新。利用逆离散余弦变换将其变换回输入空间最终得到最佳对抗样本。在ImageNet数据集上的实验结果表明，SBA的攻击成功率取得了较优效果，并且PSNR和SSIM结果表明，SBA生成的图像质量更佳。

关键词: 对抗样本, 黑盒攻击, 决策攻击, 图像处理

ZHENG Desheng, TIAN Ye, KE Wuping, LI Xiaoyu, YIN Hao, WANG Cong. SBA: Black Box Attack Method Based on Sphere Geometric Properties[J]. Journal of Frontiers of Computer Science and Technology, 2025, 19(8): 2188-2202.

郑德生, 田野, 柯武平, 李晓瑜, 殷浩, 王聪. SBA：基于球几何性质的黑盒攻击方法[J]. 计算机科学与探索, 2025, 19(8): 2188-2202.

References

[1] LI S, LIU F, HAO Z H, et al. Unsupervised few-shot image classification by learning features into clustering space[C]// Proceedings of the 17th European Conference on Computer Vision. Cham: Springer, 2022: 420-436.
[2] ZHANG Z D, XUE Z Y, CHEN Y, et al. Boosting verified training for robust image classifications via abstraction[C]//Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2023: 16251-16260.
[3] FANG S C, XIE H T, WANG Y X, et al. Read like humans: autonomous, bidirectional and iterative language modeling for scene text recognition[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2021: 7094-7103.
[4] SHEN S, ZHAO W L, MENG Z B, et al. DiffTalk: crafting diffusion models for generalized audio-driven portraits animation[C]//Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2023: 1982-1991.
[5] 郭峰. 面向深度学习语音识别系统的对抗攻防方法研究[D]. 济南: 山东大学, 2023.
GUO F. Research on adversarial attack and defense methods for deep learning speech recognition systems[D]. Jinan: Shandong University, 2023.
[6] 王曙燕, 金航, 孙家泽. GAN图像对抗样本生成方法[J]. 计算机科学与探索, 2021, 15(4): 702-711.
WANG S Y, JIN H, SUN J Z. Method for image adversarial samples generating based on GAN[J]. Journal of Frontiers of Computer Science and Technology, 2021, 15(4): 702-711.
[7] 黄震. 基于模型检测的自动驾驶领域安全攸关对抗样本识别方法[D]. 上海: 华东师范大学, 2023.
HUANG Z. A model checking based approach to detect safety-critical adversarial examples on autonomous driving systems[D]. Shanghai: East China Normal University, 2023.
[8] 蔺琛皓, 沈超, 邓静怡, 等. 虚假数字人脸内容生成与检测技术[J]. 计算机学报, 2023, 46(3): 469-498.
LIN C H, SHEN C, DENG J Y, et al. Digitally forged face content creation and detection[J]. Chinese Journal of Computers, 2023, 46(3): 469-498.
[9] AHMED N, NATARAJAN T, RAO K R. Discrete cosine transform[J]. IEEE Transactions on Computers, 1974(1): 90-93.
[10] SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[EB/OL]. [2024-04-16]. https://arxiv.org/abs/1312.6199.
[11] BRENDEL W, RAUBER J, BETHGE M. Decision-based adversarial attacks: reliable attacks against black-box machine learning models[EB/OL]. [2024-04-16]. https://arxiv.org/abs/1712.04248.
[12] CHENG M H, LE T, CHEN P Y, et al. Query-efficient hard-label black-box attack: an optimization-based approach[EB/OL]. [2024-04-16]. https://arxiv.org/abs/1807.04457.
[13] CHENG M H, SINGH S, CHEN P, et al. Sign-OPT: a query-efficient hard-label adversarial attack[EB/OL]. [2024-04-16]. https://arxiv.org/abs/1909.10773.
[14] CHEN J B, JORDAN M I, WAINWRIGHT M J. HopSkipJumpAttack: a query-efficient decision-based attack[C]//Proceedings of the 2020 IEEE Symposium on Security and Privacy. Piscataway: IEEE, 2020: 1277-1294.
[15] LI H C, XU X J, ZHANG X L, et al. QEBA: query-efficient boundary-based blackbox attack[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 1218-1227.
[16] LIU Y J, MOOSAVI-DEZFOOLI S M, FROSSARD P. A geometry-inspired decision-based attack[C]//Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2019: 4889-4897.
[17] SHUKLA S N, SAHU A K, WILLMOTT D, et al. Simple and efficient hard label black-box adversarial attacks in low query budget regimes[C]//Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. New York: ACM, 2021: 1461-1469.
[18] RAHMATI A, MOOSAVI-DEZFOOLI S M, FROSSARD P, et al. GeoDA: a geometric framework for black-box adversarial attacks[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 8443-8452.
[19] MAHO T, FURON T, LE MERRER E. SurFree: a fast surrogate-free black-box attack[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2021: 10425-10434.
[20] WANG X S, ZHANG Z L, TONG K H, et al. Triangle attack: a query-efficient decision-based adversarial attack[C]//Proceedings of the 17th European Conference on Computer Vision. Cham: Springer, 2022: 156-174.
[21] SELVARAJU R R, COGSWELL M, DAS A, et al. Grad-CAM: visual explanations from deep networks via gradient-based localization[J]. International Journal of Computer Vision, 2020, 128(2): 336-359.
[22] FAWCETT J A. Inversion of N-dimensional spherical averages[J]. SIAM Journal on Applied Mathematics, 1985, 45(2): 336-341.
[23] RUSSAKOVSKY O, DENG J, SU H, et al. ImageNet large scale visual recognition challenge[J]. International Journal of Computer Vision, 2015, 115(3): 211-252.
[24] SIMONYAN K, ZISSERMAN A. Very deep convolutional networks for large-scale image recognition[EB/OL]. [2024-04-17]. https://arxiv.org/abs/1409.1556.
[25] HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2016: 770-778.
[26] SZEGEDY C, VANHOUCKE V, IOFFE S, et al. Rethinking the inception architecture for computer vision[C]//Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2016: 2818-2826.
[27] HOWARD A, SANDLER M, CHEN B, et al. Searching for MobileNetV3[C]//Proceedings of the 2019 IEEE/CVF Inter-national Conference on Computer Vision. Piscataway: IEEE, 2019: 1314-1324.
[28] KOLESNIKOV A, BEYER L, ZHAI X H, et al. Big transfer (BiT): general visual representation learning[C]//Proceedings of the 16th European Conference on Computer Vision. Cham: Springer, 2020: 491-507.
[29] DOSOVITSKIY A. An image is worth 16×16 words: transformers for image recognition at scale[EB/OL]. [2024-04-17]. https://arxiv.org/abs/2010.11929.