# A Distributed Biased Boundary Attack Method in Black-Box Attack
## 4 Experiments and Analysis  
This paper evaluates the effectiveness of the PSO_BBA on dataset ImageNet comparatively [26]. It consists of 1000 classes with 299 \(\times\) 299 size. Compared with the baseline algorithm, this paper adopts the same experiments and hyperparameter settings as those  
Figure 4: The process of particle swarm searching for optimal adversarial examples. published in previous studies [20]. The selected attack object model is a pre-trained InceptionV3 network. In order to ensure the effectiveness of the attack, the algorithms automatically skipped over the images that could not be correctly recognized by the model itself. In the experiments, 100 images are selected randomly from the verification dataset to attack. The average \(L_{2}\) distance is calculated for evaluating the effectiveness. The comparative methods attack on the same images to guarantee the effectiveness at the same time because the non targeted attack is relatively easy. This paper mainly focuses on the targeted attack task. The experimental results are shown in Table 2. It can be seen that our method needs less queries than BBA and BA for successful attacks. For details, the proposed method with BBA in the iteration step is compared. Figure 5 gives the variation of the average distortion relative to the original image with the number of queries. The ordinate decreases faster, the algorithm converges quicker. As shown in the figure, the improved algorithm needs to spend more queries to select the initial point for each particle in the early stage. As long as the initialization process is completed, the algorithm convergence is faster. The result is pretty well comparative to benchmarks. A comparative case of the specific display of the adversarial attack process is shown in \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Methods** &
\begin{tabular}{c} **Average Number of Queries on Successful** \\ **Attack (Per Image)** \\ \end{tabular} \\ \hline BA & \textgreater{}10,000 \\ BBA & 5432 \\
**Proposed PSO\_BBA** & **4596** \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison of the average query numbers. Figure 6. The proposed PSO-BBA and BBA algorithms are, respectively, applied on the same original image to better compare and show the improved effect of the algorithm in the paper. The experimental results show that the proposed PSO-BBA algorithm can generate adversarial samples more effectively. In addition to the \(L_{2}\) distance, this paper also uses the mean structural similarity (MSSIM) [27] to measure the similarity between the attacked image and the original one. MSSIM is a function of evaluating image fidelity based on human visual characteristics. \[MSSIM=\frac{1}{L}\sum_{i=1}^{L}\left[l(f,\hat{f})\right]^{d}g[c(f,\hat{f})]^{ b}g[s(f,\hat{f})]^{g} \tag{8}\]  
where \(L\) is the number of image blocks, \(l(\bullet)\), \(c(\bullet)\) and \(s(\bullet)\) represent the luminance, contrast and structural contrast functions, respectively. \(\alpha\), \(\beta\) and \(\gamma\) are the weight parameters to regulate the relative importance of the three components. MSSIM mainly considers the structure information of the image itself adequately, with a value range of [0, 1]. The closer the value of MSSIM is to 1, the higher the fidelity between images used to compare. In the experiment, the values of the relevant parameters of the evaluation index are recommended by the original paper [24]. A specific black-box attack example comparison experiment is shown in Figure 7. It can be seen that the improved PSO-BBA algorithm can effectively reduce the number of queries while ensuring the success rate of the attack. Although the similarity between the initial interference image generated by each particle and the original is poor. By expanding search space, the improved PSO-BBA algorithm generates a higher degree of similarity to the original image based on all particles. It also improves the convergence speed of the algorithm in comparison to the original method. The local optimal situation is avoided effectively.