# Partial Retraining Substitute Model for Query-Limited Black-Box Attacks
## 4 Experimental Evaluation
### Experimental Results (Mnist)  
The performance metrics, attack success ratio and the number of queries, are average values obtained from multiple experiments. As mentioned previously, the attack success ratio is proportional to the number of queries, and thus, we have to analyze two metrics simultaneously. For each sample, the target classes were the other 9 classes. The maximum upper limit on the number of queries is 1000. Table 1 presents the network architectures of the target model and substitute models using the following abbreviations: C: convolutional layer, M: max-pooling layer, F: fully connected layer with sigmoid function, S: softmax layer. Substitute models sub1-sub4 are deformed from the target model, and this test strategy is referred to as the previous method [17]. All substitute models are trained using different training data obtained from the target model. Sub1 uses the same architecture as the target model to evaluate the impact of different training data. In one experiment, e.g., sub2-C&W, the parameters of the previous method and proposed method are the same. In Table 2, the attack success ratios of the proposed method are shown to be higher than those of the previous method. The proposed method does not perform queries when the substitute model is pre-trained. Furthermore, it performs only partial retraining using failed adversarial examples. In contrast, the previous method uses the query process for training the substitute model from the beginning and attempts to emulate the entire target model. These differences are the main reasons behind the results. Note that the attack success ratio may increase if the upper limit of the number of queries increases. The results indicate that performance is significantly more affected by the network architecture than by the attack algorithm used. Furthermore, the differences in the results between the substitute models using the same attack algorithm are greater than those between the algorithms using the same substitute model. Sub1 achieves the highest success ratio and lowest number of queries because its architecture is the same as that of the target model (although the training data are different). Sub3, which has fewer layers in comparison with other models, achieves the worst results. I-FGSM is the faster attack algorithm, while C&W is slower but more precise; thus, the attack success ratio of C&W is higher in normal white-box environments. However, in our query-limited environments, I-FGSM provides slightly better performance than C&W owing to its faster attack. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**Models** & **C** & **C** & **M** & **C** & **C** & **M** & **F** & **F** & **S** \\ \hline Target & 32 & 32 & 2 \(\times\) 2 & 64 & 64 & 2 \(\times\) 2 & 128 & 128 & 10 \\ Sub1 & 32 & 32 & 2 \(\times\) 2 & 64 & 64 & 2 \(\times\) 2 & 128 & 128 & 10 \\ Sub2 & 32 & 32 & 2 \(\times\) 2 & 64 & 64 & 2 \(\times\) 2 & 200 & 200 & 10 \\ Sub3 & 32 & 64 & 2 \(\times\) 2 & & & & 128 & 128 & 10 \\ Sub4 & 28 & 28 & 2 \(\times\) 2 & 48 & 48 & 2 \(\times\) 2 & 128 & 128 & 10 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Network architectures (MNIST). Note that if the attacker keeps attacking the target model with other samples, the previous method may achieve better results than the proposed method. The substitute model of the previous model can be more powerful as the number of sample attacks increases because it tries to emulate the entire target model. However, if the target model is query-limited, the previous method will have difficulty attacking the target even when considering any-sample attacks. In Table 2, # query refers to the average number of queries of only successful attacks and failed attacks (using 1000 queries) are ignored. This metric cannot fully represent query efficiency, even though it can show general trends, because it depends on the attack success ratio. This little insufficiency remains even if # query includes the number of queries associated with failed attacks.