# Partial Retraining Substitute Model for Query-Limited Black-Box Attacks
## 3 Proposed Method
### Crafting Adversarial Examples  
After pre-training, the substitute model is used to craft adversarial examples. This involves a white-box attack and exploits two previous well-known algorithms: Iterative fast gradient sign method (I-FGSM) [25] and Carlini and Wagner (C&W)'s attack [24]. These two algorithms have been extensively used in previous black-box attacks because they have distinct advantages respectively. I-FGSM is simple and fastest algorithm and C&W provides highest attack success ratio among white-box attack algorithms.  
FGSM computes the gradient only once to generate an adversarial example. For a targeted attack applied to a specific class, FGSM craft adversarial example as  
\[x^{\prime}\gets x-\epsilon\cdot sign(\
abla_{x}J(\theta,x,y^{\prime})) \tag{1}\]  
Figure 1: Overall process of the proposed method.  
where \(x\) is the original input data, \(x^{\prime}\) is an adversarial example, \(y^{\prime}\) is the target class, \(J\) is a loss function, and \(\epsilon\in[0,1]\) is a constant value used to constrain the perturbation.  
I-FGSM extends the FGSM algorithm to craft more precise adversarial examples using iterations. I-FGSM generates a targeted adversarial example as  
\[x^{\prime}_{0}=x \tag{2}\] \[x^{\prime}_{n+1}=Clip_{x,\epsilon}\{x^{\prime}_{n}-a\cdot sign( \
abla_{x^{\prime}_{n}}J(\theta,x^{\prime}_{n},y^{\prime}))\}\]  
where \(a\) is a small constant value. We set \(a=\frac{\epsilon}{N}\) where \(N\) is an upper bound of iteration. I-FGSM avoids making large changes to each pixel during each iteration by clipping pixel values. In other words, \(Clip_{x,\epsilon}\) limits the change of the generated adversarial image in each iteration so that the result will be into the range of \([max(0,x-\epsilon),min(1,x+\epsilon)]\). Note that, typically, each pixel is normalized to be within \([0,1]\).  
C&W's attack is a high-performance targeted attack and can defeat defensive distillation [14]. They define generating a targeted adversarial example as optimization problem with a given input \(x\) to determine perturbation \(\delta\) as follows.  
\[\begin{split} minimize&\left\|\delta\right\|_{p}+c \cdot f\left(x+\delta\right)\\ &\text{such that}\quad x+\delta\in[0,1]^{n}\end{split} \tag{3}\]  
where \(\left\|\delta\right\|_{p}\) is \(l_{p}\) norm, \(c\) is a constant to balance constraints, and an adversarial example \(x^{\prime}=x+\delta\). They also define seven objective functions, but one of the most effective functions, \(f\), is obtained as  
\[f(x^{\prime})=max(\ max(Z(x^{\prime}_{i}):i\
eq t)-Z(x^{\prime})_{t},-k\ ) \tag{4}\]  
where \(Z\) denotes the softmax function (so \(Z(x)\) are the logits), \(k\) is a constant for controlling the confidence, and \(t\) is a target class. Instead of \(\delta\), they apply a new variable \(w\) by \(\delta=\frac{1}{2}(tanh(w)+1)-x_{i}\) and optimize over \(w\) for iteration and smoothing of clipped gradient descent. Among three possible distance metrics, most effective \(L_{2}\) norm is applied, and then, the optimization problem can be described by  
\[minimize\ \ ||\frac{1}{2}(tanh(w)+1)-x||_{2}+c\cdot f(\frac{1}{2}(tanh(w)+1)) \tag{5}\]