# A Distributed Biased Boundary Attack Method in Black-Box Attack
## 1 Introduction
The network is trained with the corresponding adversarial samples. It is very helpful in improving the security of the network application. The black-box attack methods can be generally divided into three categories: score-based attack, transfer-based attack and decision-based attack methods. Score-based attacks rely on predicted scores, such as the class probability or distribution of the model. These attacks use predicted values to estimate the gradient, mainly including the black-box variants of JSMA [12], zero-order Optimization attacks [13], predictive adversarial generative networks [14], and simple black-box attacks [15; 16; 17]. The disadvantage of this type of method is that it is difficult to obtain the score and probability distribution of the output sample in real applications, so it cannot be practically used. A transfer-based attack does not rely on model information. It requires information about training data, which are used to train a fully observable agent model. The adversarial disturbances can be synthesized [18]. It relies on empirical observations. The adversarial examples are often transferred between models. If adversarial examples are created on a set of proxy models, the success rate of attacking models can reach 100% in some cases [19]. [PERSON] proposed a prior stochastic gradient free method [20] to improve the performance of black-box adversarial attacks. The algorithm also uses transfer based on the priori and score-based information. The attack success rate is higher than only one method. If the data sets are inconsistent, the attack effect may decrease a lot, and the stability is not robust [21]. Decision-based attacks are direct attacks that only rely on the final decision of the model, such as Top-1 classification labels. These attack methods are aimed at the situation where the black-box output classification results can be obtained. In an actual situation, the confidence scores or model distribution are difficult to obtain. Compared with score-based attacks, decision-based attacks are more consistent with real applications. Decision-based attacks are more robust to standard defenses than other types of attacks, such as gradient masking, inherent randomness or robustness training. Compared with transfer-based attacks, decision-based attacks require much less information about the model: neither architecture nor training data. They are simpler to apply. The disadvantage of such methods is that the queries are much higher than in other scenarios. At present, decision-based attacks mainly include the boundary attack proposed by [PERSON] et al. in 2018 [12] (Boundary Attack, BA) and its variants [22]. [PERSON] is equivalent to the biased boundary attack proposed in 2019 [13] (Biased Boundary Attack, BBA). On the basis of the attack algorithm, low-frequency disturbance and surrogate model disturbance are added. The cutting plane attack proposed by [PERSON] [23] (Cutting plane attack) improves the convergence method based on the boundary attack algorithm. Comparative analysis of the above three types of black-box attack methods is shown in Table 1.  
Comprehensive comparison of various black-box attack methods shows that black-box adversarial methods can accomplish targeted and non-targeted scenarios. However, in score and transfer-based methods, information on training data and models are required. Strictly speaking, they are not a complete black-box method. By contrast, decision-based boundary methods are simple and flexible concepts. They simply need to know about the labels of results. These are a type of \"complete black-box attack method\", and keep pace with real scenarios. They have good performance in target and non-target attacks with great application potential. Currently, boundary attack methods and improved ones are best performance decision-based methods. A boundary attack algorithm is a black-box attack algorithm that meets the requirements of the real environment.