# A Self-Adaptive Approximated-Gradient-Simulation Method for Black-Box Adversarial Sample Generation
## 3 Our Proposed Algorithm
### Self-Adaptive Two-Step Perturbation
The \(F\) for each individual is adjusted according to Equation (17). \[F_{i,g}=\gamma\cdot\frac{f_{i,g}}{\max(f_{g})} \tag{17}\]  
where \(F_{i,g}\) is the scaling factor corresponding to the \(i\)th individual in the \(g\) generation, \(f_{g}\) is the fitness value in the \(g\) generation, \(f_{i,g}\) is the fitness value corresponding to the \(i\)th individual in the \(G\) generation, and \(\gamma\) is a constant between \(0\) and \(1\). After the mutant vector generation by mutation, a trial vector is generated by performing a binomial crossover on the target vector and the mutant vector (Equation (18)). \[U_{g}=\left\{ \begin{array}{ll}V_{g},\ if(rand(0,1)\leq CR\ or\ j=j_{rand}\ )\\ \delta_{g},\ otherwise\end{array} \right. \tag{18}\]  
Figure 4: The exploration process of perturbed image. where \(rand\) is a uniformly distributed random number, \(j_{rand}\) is a randomly chosen index, and condition \(j=j_{rand}\) ensures that the trial vector gets at least one variable from the mutant vector \(CR\in[0,\,1]\). The crossover operation improves the inherent diversity of the population by exchanging individual elements. To preserve the optimal individuals for the next generation with the highest probability, a fitness-value-based method is used to modify the \(CR\) corresponding to each individual. In other words, individuals with optimal fitness values were given a smaller \(CR\) value for the cross-operation. The \(CR\) for each individual is computed according to the normalization method (Equation (19)). \[CR_{i,g}=\varepsilon\cdot\frac{f_{i,g}-\min\bigl{(}f_{i,g}\bigr{)}}{\max\bigl{(} f_{i,g}\bigr{)}-\min\bigl{(}f_{i,g}\bigr{)}} \tag{19}\]  
where \(CR_{i,g}\) is the crossover probability corresponding to the \(i\)th individual in the \(g\) generation, \(f_{i,g}\) is the fitness value corresponding to the \(i\)th individual in the \(g\) generation, and \(\varepsilon\) is a constant between 0 and 1. Finally, a greedy selection scheme is used to choose the best vector to survive to the next generation. A greedy selection scheme is described in Equation (20)  
\[\delta_{i,g+1}=\left\{ \begin{array}{ll}U_{i,g},&if\bigl{(}f(U_{i,G})\leq f \bigl{(}X_{i,g}\bigr{)}\bigr{)}\\ \delta_{i,g},&otherwise\end{array} \right. \tag{20}\]  
where \(f\left(.\right)\) is Equation (7). Therefore, if the new trial vector yields an equal or lower value of the objective function, it replaces the corresponding target vector in the next iteration; otherwise, the target vector is retained in the next generation. In the SAGM, we use self-adaptive DE to simulate the approximate gradient, and then the clean image is perturbed in the gradient direction with an adaptive step size. The pseudo-code of the self-adaptive approximated gradient search (\(SaGS\)) is shown in Algorithm 1. ```
Input: image: \(I\). \(\delta_{0}\) = Parameters: \(F\), \(CR\), \(\alpha_{0}\), and \(\lambda\). The objective function: \(f\left(.\right)\). Output: the adversarial image \(I_{G}\). 1. \(I_{0}=I+\alpha_{0}\cdot sign\langle\delta_{0}\rangle\);
2. \(f_{0}\gets f\left(I_{0}\right)\);
3. for \(g\gets 1\) to \(G\)do
4. \(f_{max}=max(f_{g-1})\) and \(f_{min}=min(f_{g-1})\);
5. \(F\gets F\cdot f_{g-1}/f_{max}\)
6. \(CR\gets CR\cdot(f_{g-1}-f_{min})/(f_{max}-f_{min})\)
7. Generate vector \(\delta_{g}\) according to Equations (16) and (18);
8. \(k\leftarrow\text{sort}(f_{g-1}(I_{g-1}))\)
9. \(\delta_{g}^{\prime}=\delta_{g-1}^{\prime}+\delta(k(1))/\parallel\delta(k(1)) \parallel_{2}\);
10. \(\delta^{\prime}=\theta_{1}^{\prime}\cdot\delta_{g}+\theta_{2}\cdot\delta_{g}^ {\prime}\)
11. \(\alpha=\lambda\cdot\delta^{\prime}/max(\delta^{\prime})\);
12. if\(|\,\alpha|<1\)then
13. \(I_{g}=I_{g-1}+\alpha_{0}\cdot sign(\alpha)\)
14. else
15. \(I_{g}=I_{g-1}+\alpha_{0}\cdot round(\alpha)\)
16. end if
17. \(f_{g}\gets f\left(I_{g}\right)\);
18. Compare\(f_{g}\) and \(f_{g-1}\) and preserve \(\delta_{g}\)
19. end for
20.