# Boosting Targeted Black-Box Attacks via Ensemble Substitute Training and Linear Augmentation
## 3 Related Work
### Carlini and Wagner Attack  
Once the substitute models have been trained, the next step we take is to craft the adversarial examples. Thus, the methods for generating adversarial examples are very related to our works. Before introducing the method for crafting samples, we want to emphasize our adversarial goal first, which is different from the non-targeted attacks:  
\[minimize\ \delta_{x}\qquad s.t.\ O(x+\delta_{x})=t, \tag{4}\]  
where \(t\) is the target class to which we want this adversarial example to be classified.  
In this paper, we mainly use the famous C&W ([PERSON] et al., 2017)\(L_{2}\) attack, which was proposed by [PERSON], [PERSON] and [PERSON], and [PERSON] in 2017. In addition, we will simply introduce this method in this following.  
Given a source image \(x\) and the target class \(t\) (ensure that \(t\
eq O^{*}(x)\)), we search for \(z\) that solves  
\[\underset{z}{\text{minimize}}\left\|\frac{1}{2}(\tanh(z)+1)-x\right\|_{2}^{ 2}+c\cdot f(\frac{1}{2}(\tanh(z)+1)), \tag{5}\]  
with \(f\) defined as  
\[f(x)=\max(\max\{O(x)_{i}:i\
eq t\}-O(x)_{t},-\mathcal{K}). \tag{6}\]  
This \(f\) is based on the best objective function found earlier, and by adjusting \(\mathcal{K}\) we can adjust the confidence that target model \(O\) has to classify our adversarial examples to target class \(t\). The bigger \(\mathcal{K}\) is, the higher confidence \(O\) has to classify the adversarial example into a target class or misclassify the adversarial examples, but, on the other hand, the perturbation and the speed may be worse.  
Notice that here \(z\) does not mean the real perturbation while it has the same changing trend with the perturbation. Authors propose \(z\) and \(tanh\) function here to guarantee the box constraint of the each pixel of the real adversarial samples \(x^{*}\), which, in Equation (5), is denoted as \(\frac{1}{2}(\tanh(z)+1)\). In addition, the main idea of C&W \(L_{2}\) attack is to minimize the \"perturbation\" \(z\) through an optimizer. In addition, the most important contribution in this algorithm is that they successfully translate the adversarial goal of misclassification to a mathematical formula, which in Equation (5) is denoted as the function \(f\).  
In the following part of the experiments, we mostly generate adversarial examples in this method. The clean images \(x\) are all chosen from the test dataset. We define the hyper-parameter \(\mathcal{K}\) as 10 because it has the best effect of our attacks. As for \(c\), as is described in the original paper, the algorithm uses Binary Search to find the best value automatically. As a whole, we only give the clean image \(x\) and the hyper-parameter \(\mathcal{K}\), and the algorithm will begin to minimize the objective function. The initial value of variable \(z\) is a zero vector that has the same shape with \(x\). Finally, we get the adversarial examples \(\frac{1}{2}(\tanh(z)+1)\) according to the best value \(z\).  
These works about substitute training have achieved a high success rate in non-targeted black-box attacks. However, the weakest point is that they don't limit the size of perturbations, and the adversarial examples they craft are mostly unrecognized and meaningless. Thus, there's a big space for promoting these kinds of attacks. In addition, the query times of their methods are huge and unacceptable in some situations.