# A Distributed Biased Boundary Attack Method in Black-Box Attack
## 1 Introduction  
Deep learning is occupying the core of the rapidly developing field of machine learning and artificial intelligence research. It also demonstrates good performance on many tasks, especially in the field of computer vision. However, modern deep networks are very vulnerable to adversarial samples, which presents a great threat to the effectiveness and stabilization of the community [1, 2, 3, 4, 5]. It is shown that image classification methods based on deep neural networks (DNN) are always fragile. They will make mistakes when only small disturbances occur, which are invisible to the human eye. This indicates that many machine learning models trained with a large number of samples are still vulnerable to small adversarial disturbances. The algorithm to find this kind of anti-interference to the input image is usually called an anti-attack. The mathematical expression is as Equation (1). The \(C(x)\) is the classifier. In machine learning, the function of the classifier is to judge the category of a new input sample based on the labeled training data. Value \((x,y)\) is an input sample and its label. The attack is to produce an adversarial sample \(x^{adv}\) of \(x\). When \(x^{adv}\) ismisclassified by ML model. The \(L_{\text{p}}\) norm of the difference between it and the original one is below a set threshold \(\varepsilon\). It means that the attack succeeded. \[C\left(x^{adv}\right)\
eq y,\text{ s.t.}\|x^{adv}-x\|_{p}<\varepsilon \tag{1}\]  
where \(|\bullet|\mid|_{p}\) is \(L_{\text{p}}\) norm. The generation of adversarial samples of the image classification model is the process of adding subtle interference, which is difficult for humans to recognize in the original image. It is inputted into the deep neural network. The deep neural network methods make wrong classification results. In Figure 1, slight interferences are added to the original image. The deep neural network methods give wrong judgment. The monkey is identified as a hand sanitizer. Adversarial attack methods generally fall into two categories on the basis of attack effect and method. In the light of attack effects, these come in two classes: non-targeted and targeted attack methods. Non-targeted attack refers to the generation of adversarial samples by adding interference. It causes the classification algorithm to mistakenly classify the original image into images of different categories. Contrarily, targeted attack causes the classification algorithm to misclassify the original image as an image of a specified category. On the basis of methods, these come in two classes: white and black-box methods. The white-box attack methods know about attacking deep neural network methods and model parameters in advance, such as the construction of networks, the situation of layers, neurons, etc. Additionally, they know the kinds of hyperparameters about the neural network, and the weights of connected neurons, for example. The attacker can design a targeted adversarial sample on the basis of the known information with regard to the neural network. This can make the neural network method lose efficacy. Such methods comprise the fast gradient attack proposed by [PERSON] in 2014 ([PERSON] et al., 2014) (Fast Gradient  
Figure 1: An example of an image adversarial examples attack. Sign Method, FGSM), Basic Iterative Method [7] (BIM), and DeepFool [8], Jacobian-based Saliency Map [9] (JSMA), Houdini [10] and Carlini & Wagner [11], and so on. Such attack algorithms mainly rely on gradient-based attack strategies. Conversely, black-box attack methods do not know any information about the network, such as architecture or various hyperparameters. These only have the output results of the network and corresponding data labels. These ones are closer to the real application scenario than white ones. Such methods are harder to implement than white-box methods. Meanwhile, the attack effect is relatively poor. In terms of safety, the robustness of the neural network can be improved by the research of black-box methods.