# Boosting Targeted Black-Box Attacks via Ensemble Substitute Training and Linear Augmentation
## 1 Introduction  
Deep Neural Networks (DNNs) have been widely used in many areas today, such as self-driving [1], speech recognition [2], image recognition and so on. In addition, in the image recognition field, DNN performs much more efficiently than other machine learning algorithms like Support Vector Machine (SVM) [3] or logistic regression [4], and has achieved great success in the ImageNet Large Scale Visual Recognition Challenge (ILSVRC) [5]. However, some people [6] found that, for an image recognition system, when the adversary adds tiny perturbations purposefully on a clean image, the classifier may misclassify the synthetic image, which looks the same as the source image, into any other desired class [7]. In addition, they call these purposefully synthetic images _Adversarial Examples_[8]. According to the knowledge of the target classifier, we can divide the approaches of generating adversarial examples into two types: white-box attack and black-box attack. The white-box attackers craft the adversarial examples based on the internal information of DNN, which might include the training dataset, outputs, hyper-parameters, gradients and feature maps. This makes this kind of attack easier than black-box attacks. The widely accepted white-box attack methods are Deep-Fool [9],Jacobian-based Saliency Map Attack (JSMA) [10], Carlini and Wagner Attack (C&W) [11], Fast Gradient Sign Method (FGSM) [6], Iterative FGSM (I-FGSM) [12] and so on. For black-box attacks, we can only acquire the outputs responding to the paired inputs. This is a much stronger constraint for attackers. In addition, now there are One-Pixel Attacks [13], Boundary Attacks [14], and Jacobian-based Augmentation Attacks [15] well-known to adversarial attackers. In order to overcome the problem that black-box adversaries have no access to the target classifiers' internal information, some researchers came up with the idea of training a local substitute model of the targeted model via the dataset augmentation method. Then, the attackers can craft adversarial examples via these substitute models using a white-box method but in a black-box assumption. Famously, [PERSON] et al. generated the substitute training and attacks by augmenting a few initial images using the Jacobian matrix of the substitute model combined with the pairs of the target classifier's inputs and outputs [15], which we called Jacobian-based Augmentation. They crafted adversarial examples using FGSM [6] and JSMA [10], and successfully misled the deep learning systems on Amazon and Google with high confidence. Moreover, [PERSON] and [PERSON] [16] proposed a new dataset augmentation method named Schmidt Augmentation, and achieved a bit higher misclassification rate than the Jacobian-based Augmentation method. In addition, [PERSON] et al. [17] trained a substitute model and use its inside information for generating a black-box attack via GAN (Generative Adversarial Nets) [18], which we call advGAN. Despite the high misclassification rate, there is no sign that the substitute models [PERSON] [15] or [PERSON] [16] trained are able to generate targeted attacks. In order to perform high efficient targeted attacks, we improved the Jacobian-based augmentation by changing the augmenting dataset and reducing the information required from the Jacobian matrix to the single gradient value for every epoch. In this way which we named Gradient-Based Linear Dataset Augmentation, we successfully performed targeted attacks and largely decreased the times of querying black-box models. Moreover, to promote our success rate of black-box attacks, we think up the idea of ensemble attacks [19; 20; 21], which means that we train several substitute models respectively and generate adversarial examples by combining internal information of them. There is obvious elevation in success rates in this way.