# A Self-Adaptive Approximated-Gradient-Simulation Method for Black-Box Adversarial Sample Generation
## 3 Our Proposed Algorithm
### Self-Adaptive Two-Step Perturbation  
Perturbation based on sign gradients is an effective method for adversarial attacks. However, the sign gradient method rejects the proportion among the raw gradients, resulting in components sharing the same coefficients. Therefore, after \(G\) iterations, perturbation based on a fixed step size \(\alpha\) may appear in two cases, as shown in Figure 3.  
In Figure 3, the blue and red dotted circles represent the probability contours of \(x\) and \(x^{\prime}\), the two black lines represent the perturbation distances \(\alpha\) and \(\beta\) in the gradient direction, and \(x_{g}\) is a perturbed image after \(g\) generation. Figure 3 shows that the perturbation image is not being converted into an adversarial image due to the small step size. Figure 3 shows that the perturbation image is converted into an adversarial image that is easily recognizable because of the big step size. The main reason for this condition Is that each pixel of the original image is adjusted at a fixed learning rate to achieve the purpose of the attack. Hence, each pixel with different gradients is updated at the same learning rate. In this case, it cannot be motivated to improve the efficiency of the attack. To deal with this problem, we propose an improved two-step adaptive perturbation method to improve its efficiency. The first step is to adaptively adjust \(\alpha\) to generate the temporary perturbation image \(x^{\prime}_{g+1}\), and the second step is to fine-tune \(x^{\prime}_{g+1}\) by adding a step size \(\beta\) to move toward the boundary of the adversarial image. In the first step, we leverage the optimal gradient in the past to guide the next-generation adaptive change of the pixel (Equation (8)). \[\delta^{\prime}_{i}=\delta^{\prime}_{i-1}+\frac{\delta_{i,best}}{\left\| \delta_{i,best}\right\|_{2}} \tag{8}\]  
where \(\delta_{i,best}\) is the optimal gradient for generation \(t\). Assuming that the initial optimal gradient \(\delta^{\prime}_{0}=0\), then the cumulative gradient of generation \(i\) can be written as the following (Equation (9)). \[\delta^{\prime}_{i}=\sum_{l=0}^{g-1}\frac{\delta_{i,best}}{\left\| \delta_{i,best}\right\|_{2}} \tag{9}\]  
Figure 3: Self-adaptive two-step perturbation. mutant vector through mutation strategies, the crossover is the process of recombination between the mutant vector and the target vector, and selection is to preserve the optimal individuals for the next generation according to the greedy choice method. In the SAGM, we utilize adaptive DE to explore the perturbed vectors. The initial perturbed vector between \(-1\) and \(1\) is generated using uniformly distributed randomization, and its dimension is consistent with the dimension of the input image. Each element of the initial vector \(\delta_{0}\) is generated by Equation (15). \[\delta_{0}=\min+rand(0,1)\cdot(\max-\min) \tag{15}\]  
where \(min\) and \(max\) are the minimum and maximum of the gradient, respectively, and \(rand(0,\ 1)\) is a random number between \(0\) and \(1\). After initialization, a mutant vector is produced with respect to the target vector. In each generation of mutation, the mutant vector can be generated by the following mutation strategy (Equation (16)),  
\[V_{i,g}=\delta_{r_{1},g}+F_{g}\cdot(\delta_{r_{2},g}-\delta_{r_{3},g}) \tag{16}\]  
where \(r_{1}\), \(r_{2}\), and \(r_{3}\) are three integers different from the index \(i\). The scaling factor \(F\) is a positive control parameter to scale the difference vector. The scaling factor in the mutation strategy enhances the diversity of the population by scaling the difference vectors. In the process of population evolution, the diversity of the population gradually decreases. To maintain the diversity of the population in the later stage of evolution, an adaptive mutation strategy based on fitness values is proposed. For individuals with poor fitness values, a larger \(F\) was used to stretch the difference vector to explore a larger space, otherwise, a smaller value is used.