## 6 Discussion and Concluding Remarks  
We presented an evolutionary, score-based, black-box attack, showing its superiority in terms of ASR (attack success rate) and number-of-queries over previously published work. QuEry Attack is a strong and fast attack that employs a gradient-free optimization strategy. We tested QuEry Attack against MNIST, CIFAR10, and ImageNet models, comparing it to other commonly used algorithms. We evaluated QuEry Attack's performance against non-differential transformations and robust models, and it proved to succeed in both scenarios.  
As noted, we discovered that the software scene in adversarial attacks is a tad bit muddy. We encourage researchers to place executable code on public repositories--code that can be used with ease. Furthermore, we feel that the field lacks standard means of measuring and comparing results. We encourage the community to establish common baselines for these purposes.  
We came to realize the importance of a strong initialization procedure. Although this is true of many optimization algorithms, it seems doubly so where adversarial optimization is concerned. Table 1 shows that successful attacks are sometimes found during initialization--the vertical-stripes initialization in particular proved highly potent--and even if not, the number of queries (and generations) is significantly curtailed.  
Figures 5 and 6 show that adversarial examples are barely distinguishable to the human eye. Clearly, neural networks function quite differently than humans, capturing entirely different features. More work is needed to create networks that are robust in a human sense.  
We think that evolutionary algorithms are well-suited for this kind of optimization problems and our findings imply that evolution is a potential research avenue for developing gradient-free black-box attacks. Furthermore, evolution needs to be evaluated against a fully black-box model.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Source Model \(\rightarrow\) Target Model** & \(\mathbf{\mathcal{E}}\) & **TSR** \\ \hline  & 24 & 67.0\% \\ Inception-v3 \(\rightarrow\) ResNet-50 & 18 & 47.5\% \\  & 12 & 33.5\% \\  & 6 & 13.5\% \\ \hline  & 24 & 90.0\% \\ ResNet-50 \(\rightarrow\) VGG-16-BN & 18 & 81.5\% \\  & 12 & 61.5\% \\  & 6 & 28.5\% \\ \hline  & 24 & 59.0\% \\ VGG-16-BN \(\rightarrow\) Inception-v3 & 18 & 46.5\% \\  & 12 & 30.0\% \\  & 6 & 12.5\% \\ \hline \hline \end{tabular}
\end{table}
Table 5: QuEry Attack’s transferability on ImageNet models. TSR: Transferability Success Rate.  
Evolution may also be a solution for rendering models more robust. In [57] it was shown that combining different activation functions could be used to increase model accuracy; this approach might also be used for obtaining robustness.  
Conceptualization, M.S.; Formal analysis, R.L.; Investigation, R.L. and Z.H.; Project administration, M.S.; Software, R.L. and Z.H.; Supervision, M.S.; Writing--original draft, R.L., Z.H. and M.S.; Writing--review & editing, R.L. and M.S. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Figure 5: Adversarial examples generated by QuEry Attack on MNIST, with \(\epsilon=60/255\). An image at \(row,col=i,i\) shows the original image for class \(i\). An image at \(row,col=i,j\), \(i\
eq j\) shows a targetted attack on class \(i\), with the target being class \(j\).  
Figure 6: Adversarial examples generated by QuEry Attack on CIFAR10, with \(\epsilon=12/255\). An image at \(row,col=i,i\) shows the original image for class \(i\). An image at \(row,col=i,j\), \(i\
eq j\) shows a targetted attack on class \(i\), with the target being class \(j\).