## 5 Attacks
### Decision-Based Attacks against Neural Networks
In [158], another black-box attack based on estimating gradient direction at the decision boundary based solely on access to model decisions is proposed. It is also essentially an advanced version of the boundary attack described earlier. At each iteration of the algorithm, the following three steps are carried out: estimation of the gradient direction, step-size search via geometric progression, and boundary search via a binary search. Study [159] proposes zeroth order optimization (ZOO) attacks against a black-box classifier. The attack approach is based on C&W attack [144], similarly it uses the following loss function:  
\[F(x)=\max\{\max_{k\
eq\tilde{\theta}}(z(x))_{k}-(z(x))_{\tilde{y}},-K\}, \tag{28}\]  
where \(z(x)\)\(K\) is a hyperparameter that guarantees a constant gap between \(\max_{k\
eq\tilde{\theta}}(z(x))_{k}\) and \((z(x))_{\tilde{y}}\). The gradient \(g_{i}=\frac{\partial F(x)}{\partial x_{i}}\) is estimated as follows:  
\[g_{i}=\frac{F(x+he_{i})-F(x-he_{i})}{2h}, \tag{29}\]  
where \(h\) is a small constant and \(e_{i}\) is a standard basis vector with only the \(i\)-th component as 1. Similarly, Hessian \(h_{i}=\frac{\partial^{2}F(x)}{\partial x_{i}^{2}}\) can be estimated as follows:  
\[h_{i}=\frac{F(x+he_{i})-2F(x)+F(x-he_{i})}{h^{2}}. \tag{30}\]  
In [160], adversarial examples are generated in black-box settings with the help of a geometric framework under the restriction that only a small number of queries is allowed. The resulting GeoDA attack approach is based on the fact that the mean curvature of the decision boundaries in the neighbourhood of an input sample is quite low for many frequently used deep learning models [161]. As a result, it can be locally approximated by a hyperplane passing through a boundary point \(b\) close to data sample \(x\), with a normal vector \(w\). In this case, an adversarial perturbation \(\delta\) can be derived by solving the following optimization problem:  
\[ \begin{split}&\underset{\delta}{\text{min}}\,||\delta||\\ &\text{subject to }w^{T}(x+\delta)-w^{T}b=0\end{split}  \tag{31}\]  
Assuming \(\tilde{x}\) is a boundary point, value of \(w\) can be derived by querying the target classifier \(f\)\(N_{t}\) times using samples \(\tilde{x}+\eta_{i}\) where \(i=1,\ldots,N_{t}\). After that, \(w\) can be estimated as follows:  
\[w=\frac{\frac{1}{N_{t}}\sum_{i=1}^{N_{t}}\rho_{i}\eta_{i}}{||\frac{1}{N_{t}} \sum_{i=1}^{N_{t}}\rho_{i}\eta_{i}||}, \tag{32}\]  
where \(\rho_{i}=1\) if \(f(\tilde{x}+\eta_{i})\
eq f(\tilde{x})\) and \(\rho_{i}=-1\) otherwise. Study [162] attacks a black-box classifier in a query-limited partial-information setting. The former means that the adversary has a limited number of queries to the classifier, and the latter means the adversary has access only to a list of \(k\) returned labels sorted according to their probabilities predicted. The attack approach is based on estimating the gradient with natural estimation strategies (NES). The authors introduce the following function to estimate the score of a sample:  
\[S(x)=\frac{1}{n}\sum_{i=1}^{n}R(x+\mu u_{i}), \tag{33}\]  
where \(n\) is a number of samples, \(\sigma\) is a search variance, \(u_{i}\) is a random perturbation, and function \(R(x)=k-\text{rank}(\hat{y}|x)\). There are several studies that propose to use GANs [105] to generate adversarial perturbations. For example, study [163] focuses on bypassing a machine learning based malware detection model by training a GAN. The target model \(f(x)\) classifies each sample as either benign \(y\) or malicious \(\hat{y}\). The GAN's generator network \(G_{\theta_{g}}\) with parameters \(\theta_{g}\) transforms an input sample from the malicious class into its adversarial version, whereas the substitute discriminator \(D_{\theta_{d}}\) with parameters \(\theta_{d}\) is used to fit the target model and at the same time it provides gradient information to train the generator.