## 5 Attacks
### Decision-Based Attacks against Neural Networks  
In this subsection, we summarise practical adversarial example generation attacks that can be carried out by an adversary in fully black-box settings, i.e., when the adversary does not have access to the AI/ML model deployed. In addition, we assume that the target model output includes only hard labels, i.e., no score values can be derived. Assuming the adversary has access to samples from the training dataset, the most straight-forward approach is to train a substitute model and then use one of the aforementioned white-box algorithms to craft a perturbation. Such an attack approach is based on the transferability property of adversarial examples which states that the perturbation crafted to fool a specific model can also fool another model with high probability. In [155], this attack approach is employed. The target model in this case is used by the adversary to provide labels for the training samples. Even though the adversary does not need to have full knowledge of the target model, it must at least have some partial knowledge of the model input and expected output. The adversary also should have access to a small set of training data samples that can act as an initial set for training the substitute model. The algorithm efficiency can be improved via periodical step size selection and reservoir sampling [133]. Study [156] proposes another attack approach which does not involve training a substitute model. The attack starts from an adversarial point \(\tilde{x}\) calculated for an input sample \(x\) and tries to keep it in the adversarial region while reducing the distance to \(x\) by adjustingthe step size using a trust region method. The proposal distribution \(P\) may significantly affect the efficiency of the algorithm. This distribution defines random directions the algorithm explores at each iteration. The optimal proposal distribution depends on the target neural network. The following is the algorithm procedure in general. In the \(t\)-th step a perturbation \(\delta_{t}\) is drawn for an adversarial sample \(\hat{x}_{t-1}\) from such a maximum entropy distribution that the following constraints are satisfied: \(\hat{x}_{t-1}+\delta_{t}\) is a feasible sample, \(||\delta_{t}||=\alpha||\hat{x}-\hat{x}_{t-1}||\), and \(||\hat{x}-\hat{x}_{t-1}||-||\hat{x}-(\hat{x}_{t-1}+\hat{x}_{t})||=\beta||\hat{x },\hat{x}_{t-1}||\). In practice, the first two constraints are satisfied by sampling from a Gaussian distribution and then rescaling and clipping the sample accordingly. After that, the sample is projected on the ball with the centre being equal to the original adversarial sample \(\tilde{x}\) such that the third and the first constraints hold. The resulting perturbation is denoted as the orthogonal perturbation. A half of such orthogonal perturbations is expected to still be adversarial. If the percentage of adversarial samples is less than half, the length of the perturbation is reduced, otherwise, if more than half of perturbations are adversarial, the length is increased. Similarly, if the success rate is too small the step size is reduced, if it is too large, the size is increased. Although the boundary attack can find adversarial examples with distortion comparable to white-box attacks, it suffers from exponential search time and lacks convergence guarantees. More query-efficient algorithm for attacking a classifier \(f\) by generating an adversarial perturbation for a given sample \(x\) with label \(y\) is proposed in [157]. Instead of searching for an adversarial example, the approach proposed searches such a direction \(\theta\) that minimises the distortion \(F(\theta)\) which in case of an non-targeted attack can be obtained as follows:  
\[F(\theta)=\arg\min_{\lambda>0}(f(x+\lambda\frac{\theta}{||\theta||}\
eq y)) \tag{27}\]  
The adversarial example can be found as \(\tilde{x}=x+F(\tilde{\theta})\frac{\tilde{\theta}}{||\theta||}\), where \(\tilde{\theta}=\arg\min_{\theta}F(\theta)\).