# A Distributed Biased Boundary Attack Method in Black-Box Attack
## 3 The Proposed Distributed Framework  
### Improvement of Initial Point Generation Algorithm  
In BA methods, the generation of adversarial samples is equivalent to a search problem. One of the directions that can be improved in this problem is to define a heuristic information with a guiding function. The BBA is to introduce heuristic knowledge for the BA algorithm to speed up the search speed and efficiency. In addition, another important improvement direction is reducing the size of search space. In both BA and BBA algorithms, the approach taken begins with a single initial point. They search in a huge boundary space in a random or heuristic manner. This leads to the difficulty of too large search space, and the search gets stuck at local optimum easily. Therefore, this paper proposes the idea of combining particle swarm optimization (PSO) in the swarm intelligence algorithm to decompose the single-point search optimization into multiple points to search in their respective subspaces. Particle swarm optimization (PSO) algorithm is a random search algorithm based on group cooperation, which is developed by simulating the foraging behavior of birds. The purpose is to improve the possibility of searching for a practicable solution here. It can improve the success rate of adversarial attacks while speeding up the convergence rate. It can overcome shortcomings caused by the local optimal solution.  
In this part, the initial point selection is discussed regarding the influence on the BA algorithm. Experiments have proved that the performance of the BBA algorithm has different sensitivity to the initial point selection [23; 25]. Based on this, we further proposed a swarm intelligence search algorithm combined with multi-point starting.  
In Figure 3, the selection of the initial point for the BBA algorithm is to find the adversarial image corresponding to the minimum \(L_{2}\) norm. It is calculated between the adversarial image 1 and the red star (original image). It is used to perform a binary search for seeking out the point \(X\). It is the start of the BA algorithm. However, \(X\) is not the best start. In Figure 3, it can be seen that the boundary \(Y\) of the image 3 has a larger norm. It is nearer to the red star. That the \(Y\) converges to the best solution faster than \(X\) is very likely. It can be believed that the initial point calculation method of BBA may not find the best starting point.  
The improvement of the initial point selection algorithm is proposed. The steps are as below: At first, the boundary points are found with the origin of multiple samples, respectively. One or several (when the PSO is used) points are chosen as the start point. Theoretically, it is difficult to find the optimal method. One method is to seek out the \(L_{2}\) norm among boundary points with the original. The closest distance is selected. The pseudo code is shown as Algorithm 1.  
```
Input: Black-box classifier f, Adversarial image list X_adv, Step size d, Direction \(\mu\), Number of queries t, Threshold \(\epsilon\) Output: Initial adversarial image list X_start
1:\(d_{l}=d,d_{r}=d\);
2:for\(i=1\) to len(X_adv):
3:while\(f(X\_adv[i]+d_{r}u)=f(X\_adv[i])\) do
4:\(d_{r}=(1+t)d_{r}\);
5:while\(f(X\_adv[i]+d_{l}u)\
eq f(X\_adv[i])\) do
6:\(d_{l}=(1-t)d_{l}\);
7:while\(d_{r}-d_{l}>\epsilon\) do
8:\(d_{m}=(d_{r}+d_{l})/2\)
9:if\(f(X\_adv[i]+d_{m}\mu)=f(X\_adv[i])\) then
10:\(d_{l}=d_{m}\)
11:else
12:\(d_{r}=d_{m}\)
13:\(X\_start[i]=X\_adv[i]+d_{r}m\)
14:end
15:Output initial adversarial image list.
16:return X_start
```  
**Algorithm 1** Improved algorithm of initial point selection