## 5 Experiments and Results
### Attacking Defenses
#### 5.1.1 Attacking Non-Differentiable Transformations  
Gradient masking is achieved via non-differentiable input transformations, which rely on manipulating gradients to defeat gradient-based attackers [42; 43]. Further, randomized transformations make it more difficult for the attacker to be certain of success. It is possible to foil such a defense by altering the defense module that performs gradient masking, but this is not an option within the black-box scenario. Herein, we investigated three non-differentiable transformations against QuEry Attack: JPEG compression, bit-depth \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Conv Block** & \multicolumn{2}{c}{**Hyperparameters**} \\ \hline Layer & Layer type & Hyperparameter & Value \\ \hline
1 & Convolution & Epochs & 300 \\
2 & BatchNorm2d & Batch size & 64 \\
3 & ReLU & Optimizer & _Adam_ \\  & & Learning rate & 0.01 \\  & & Weight decay & \(1\times 10^{-6}\) \\ \hline \hline \multicolumn{4}{c}{**CNN Architecture**} \\ \hline Layer & Layer type & No. channels & Filter size & Stride \\ \hline
1 & Conv Block & 32 & \(3\times 3\) & 1 \\
2 & Max Pooling & N/A & \(2\times 2\) & 2 \\
3 & Conv Block & 64 & \(3\times 3\) & 1 \\
4 & Max Pooling & N/A & \(2\times 2\) & 2 \\
5 & Conv Block & 128 & \(3\times 3\) & 1 \\
6 & Max Pooling & N/A & \(2\times 2\) & 2 \\
7 & Dropout (\(p=0.5\)) & N/A & N/A & N/A \\
8 & Fully Connected & 128 & N/A & N/A \\
9 & Fully Connected & 10 & N/A & N/A \\ \hline \hline \end{tabular}
\end{table} 
Table 2: CNN used for MNIST. reduction (also known as feature squeezing), and spatial smoothing. We show that QuEry Attack can defeat these input modifications, due to its gradient-free nature. JPEG compression [44] tries to generate patterns in color values to minimize the amount of data that has to be captured, resulting in a smaller file size. Some color values are estimated to match those of surrounding pixels in order to produce these patterns. This compression means that slight imperfections in the quality of the image will not be as noticeable. The degree of compression may be tweaked, providing a customizable trade-off between image quality and storage space. An example of the different compression degrees is shown in Figure 2. The results in Table 3 were evaluated with image quality \(q=70\). Bit-depth reduction [45] can be done both by reducing the color depth of each pixel in an image and using spatial smoothing to smooth out individual pixel discrepancies. By merging samples that correspond to many different feature vectors in the original space into a single sample, bit-depth reduction decreases the search space accessible to an opponent. An example of different bit-depth values is shown in Figure 3. The results in Table 3 were evaluated with bit depth \(d=3\). The term \"spatial smoothing\" refers to the averaging of data points with their neighbors [46]. This has the effect of a low-pass filter, with high frequencies of the signal being eliminated from the data while low frequencies are enhanced. As a result, an image's crisp \"edges\" are softened, and spatial correlation within the data becomes more prominent, as shown in Figure 4. Data averaging is determined according to a given window size. The results in Table 3 were evaluated with window \(w=5\). Our results are delineated in Table 3. For this experiment we used a total budget of 82K queries to the model (\(N=70\), \(G=1200\))--which was Inception-v3. For each given image, we first checked that it was correctly classified after applying the defense on the image, then we applied QuEry Attack on it. The different input values for the transformations were chosen such that applying them would not be destructive. For these experiments we used the same budget of queries as in the previous experiments. For both CIFAR-10 and ImageNet, QuEry Attack has a high success rate against all non-differentiable transformations. Figure 3: Bit-depth compression examples, sorted from left to right by bit-depth values, ranging from \(1\) to \(8\) (original image).