# A Hybrid Adversarial Attack for Different Application Scenarios +
## 3 Methods  
### Black-Box Attack on Text  
In the black-box attack, we adopt the method based on a differential evolution (DE) algorithm to generate an adversarial example, a differential evolution algorithm with a genetic algorithm (GA) has some similarities. It has the choice stage to keep a population diversity mechanism; therefore, in practice, it is expected to be more effective than other types of group evolution algorithms to find a higher quality solution. In a black-box setting, the attacker does not know the model architecture and parameters. They can only use the input provided to query the target model to get prediction results and corresponding confidence scores. The whole algorithm of black-box attack is described in Algorithm 1, which basically follows the idea of differential evolution algorithms. The overall structure of the differential evolution algorithm is similar to the genetic algorithm. It also has mutation, crossover, and selection operations, but it is different from the genetic algorithm. The main difference from the basic genetic algorithm is the mutation operation. For example, in the genetic algorithm, two children are generated by the intersection of two parent individuals, and, in the differential evolution algorithm, the difference vector of two or several individuals is used to perturb. Then, we will get the new individuals. In traditional genetic algorithms, offspring individuals replace their parent individuals with a certain probability, and newly generated individuals in differential evolution only replace individuals in a population when they are better than individuals in the population. The algorithm consists of the following steps:  
**Step 1: Mutation** Given a text of \(n\) words \(X=\{w_{1},w_{2},...,w_{n}\}\), we look for the most similar word to replace one of them, then we get the mutated text. We use the counter-fitting method as word embedding from [24]. We use Euclidean distance to calculate the N nearest neighbors of the word to replace, whose cosine similarity with the word to be replaced are smaller than \(\delta\), and this word embedding ensures that the neighbors we find are synonyms. Then, we use the Google language model [25] to select the most context-appropriate K words, and replace a word in the original text with these words respectively. Finally, we choose the word with the lowest confidence score of the model to replace, and get the replaced text. We can get an initial population \(\mathcal{P}^{0}\) of S individuals by repeating this process of mutation S times. The prediction score of each individual can be obtained by querying the victim model function f. In each generation of evolution, we select the individual with the lowest prediction score of the target model and make it the first individual \(\mathcal{P}^{\delta+1}_{1}\) in the next generation. If the prediction tag of one of the members of the population is not the original tag, the attack is completed. However, it is rare that only one word can change the model's prediction, and most of the examples go to the next step. If there is no sample in the initial population that can change the prediction of the target model, we do a different operation. For all individuals of the g-th generation, \(\mathcal{P}s=\{\mathcal{P}^{S}_{1},\mathcal{P}^{S}_{2},...,\mathcal{P}^{S}_{n}\}\). For each individual, the algorithm continues to generate mutants according to the following formula:  
\[\mathcal{P}^{\delta^{\prime}}_{i}=\mathcal{P}^{S}_{i}+F\cdot(\mathcal{P}^{S}_{ j}-\mathcal{P}^{S}_{k})\qquad i=1,2,...,n \tag{2}\]  
where \(\mathcal{P}^{S}_{j}\) and \(\mathcal{P}^{S}_{k}\) are two randomly selected individuals in the population, and \(i\
eq j\
eq k\), and \(F\) is the mutation factor, which is generally 0 to 2, so as to obtain the mutant \(\mathcal{P}^{S^{\prime}}_{i}\). If the prediction tag of one of the individuals after differential operation is not the original tag, the attack is completed. Otherwise, the algorithm proceeds to the next step.