# A Distributed Biased Boundary Attack Method in Black-Box Attack
## 1 Introduction
It has superior effects in scenarios where only the input image label is obtained, and it is simple, easy to implement and robust. The improved one won the runner-up in the 2018 NeurIPS competition, named Biased Boundary Attack (BBA). It showed the BBA's superiority in actual adversarial scenarios. However, BBA still has the following two challenges: (1) query numbers are high on the premise of guaranteeing the success rate; (2) The algorithm converges slowly. This paper studies and analyzes the advantages and disadvantages of various current black-box attack methods. The decision-based methods are the research focus. The paper combines this with the swarm intelligence algorithm based on the biased boundary attack black-box adversarial method. A biased boundary attack adversarial algorithm based on particle swarm optimization is proposed. The methods mainly have the following innovations:  
Firstly, the method of initial point generation is proposed for improvement. Initial point selection has great influence on the properties of BA and BBA. The original method for selection of the initial point cannot achieve the optimal effect. This paper proposes a new algorithm for the generation of the initial attack point. The experiment shows that it can reduce the number of attack queries and the convergence speed of the algorithm. Secondly, the particle swarm optimization algorithm is used to search the optimal adversarial samples from multiple initial points. In the framework of the BA algorithm, the generation of optimal adversarial samples can be modeled as a regional search optimization problem. The swarm intelligence algorithm has advantages of fast convergence and a good optimization effect on this kind of problem. It is feasible to introduce swarm intelligence algorithms as the direction of improvement. We try to apply the particle swarm optimization algorithm to the algorithm-updating process. Multiple initial points are adopted to find the best adversarial sample points. It can not only expand the search space of the algorithm, but also improve the convergence rate. It avoids falling into a local optimal solution effectively. It also promotes the dependability and robustness of attack applications. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Black-Box Attack Methods** & **Attack Target** & **Attack Conditions** & **Algorithm Characteristics** \\ \hline Score-based attack & With target/no target & The class probability or distribution of the model is required. & Use predicted values to estimate the gradient. \\  & & Does not rely on model information, but requires information on model training data. & Train a fully observable agent model from which adversarial disturbances can be synthesized. \\ Decision-based attacks & With target/no target & Only need the output labels & The number of queries required for the attack may be higher. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparative analysis of three types black-box attack methods. With the above corrective measure, on the premise of complete black-box with only input sample query labels, the proposed algorithm achieves target/non-target attack. Compared with BA, BBA and other baseline algorithms, query numbers are reduced. The success rate of adversarial attacks is improved. The convergence speed of the algorithm is better. The rest of the paper is organized as follows. In Section 2, the related works on Boundary Attack (BA) and Biased boundary attack algorithm (BBA) are introduced. Section 3 proposes a distributed framework for adversarial attack methods. The experimental analysis is also given in Section 4. Finally, the disadvantages and future development directions are discussed concerning future work.