# A Distributed Biased Boundary Attack Method in Black-Box Attack
## 2 Related Works  
### Boundary Attack (BA)  
Boundary attack algorithm is a kind of typical decision-based method. Starting from an initial adversarial image, a binary search is used to find a sample point, which is near the classification frontier. Random walk is performed along the frontier between two opposite areas. It reduces the distance from the target image. That is to say, the classification result obtained by input classifier query is always the category we want to misclassify. According to this step, we continue to iterate and gradually reduce the distance from the original image. The reason why this kind of algorithm is named \"boundary attack\" is that it generates adversarial samples by searching along the boundary until it converges to obtain the optimal or satisfactory solution. The results obtained by this kind of method can meet the requirements for misclassification of the black-box model. The overall disturbance that it increases relative to the original image varies with the performance of the algorithm. Therefore, the criterion for measuring a successful adversarial sample is that the difference \(\mid\mid x^{\text{adv}}-x\mid\mid_{p}\) between it and the original image should be less than the given threshold \(\varepsilon\). Take the ImageNet data set as an example: the image size is 299 \(\times\) 299. The pixel value interval is (0, 255). When \(p=2\) (that is, the \(L_{2}\) norm) \(\varepsilon\) takes 25.89. This measure is used in our research and experimental results. As shown in Figure 2a, the generation of optimal adversarial samples can be considered as a search and optimization problem along the classification boundary between adversarial space and original space. Those boundary points that are both close to the original image and on the adversarial sample space are the feasible solutions that we want to find. However, in the decision-based black-box adversarial scene, the position and gradient direction of the real classification boundary are unknown. Therefore, it can be regarded as a high-dimensional space search problem in an uncertain environment. In the context of this complex problem, the BA algorithm adopts the method of distributing P from an appropriate pixel space. An adversarial disturbance is found closer to the original image according to a given adversarial criterion. At the same time, in order to overcome the uncertainty of the classification boundary, it needs to consume several queries to obtain a successful adversarial disturbance. The basic flow of the algorithm is as follows. Figure 2: Schematic diagram of boundary attack algorithm. (**a**) Initial adversarial image optimization along boundary (**b**) Move along the orthogonal direction and close to the original image. The first step is initialization. In the non-target scene, each pixel in the initial image is sampled from the uniform distribution U (0, 255), while the non-adversarial samples are rejected. In the target scene, we start with any sample that the black-box model can recognize as the target class. The second step is to determine the disturbance. In order to ensure that the disturbance of each sampling is improved along the direction of the classification boundary as much as possible, as shown in Figure 2b, firstly the disturbance \(\eta_{\text{k}}\) with the sampling step size of \(\delta\) is sampled on the hypersphere with the original image as the ball center, which is called the orthogonal disturbance. The disturbance of one step length of \(\varepsilon\) is sampled towards the direction of the original input image. Then the next adversarial sample point is obtained. Boundary attack is easy to use. It just needs to adjust the two parameters of step size \(\delta\) and \(\varepsilon\). It has a good effect on target and non-target attack. This method can find adversarial samples that are similar to the effect of gradient-based white box attacks. It does not rely on the proxy model trained on the data, which is similar to the attack model.