## 4 Discussion  
We proposed a simple method for generating UAPs under the black-box condition inspired by the SimBA method [18] and applied this method to DNN-based medical image classification. Overall, the results showed that small (almost imperceptible) UAPs are generatable under the black-box condition using only a simple hill-climbing search based on the model outputs (i.e., confidence scores) to perform both nontargeted and targeted attacks. The vulnerability of black-box UAPs was observed in several model architectures, indicating the versatility of our method; thus, the vulnerability may be a general property of a DNN. The results indicate that adversaries can foil or control DNN tasks even if they never use model parameters (e.g., loss gradients) and training data because target systems are operated under black-box conditions in terms of security. DNN-based medical image diagnoses may be easy to conduct in a realistic environment. It can be argued that the performance of black-box UAPs generated using our method compares favorably with that of white-box UAPs [12; 13]. In addition to the model parameters, the white-box UAPs were generated using a larger dataset (7-10 times) than that of the black-box UAPs. For instance, for the nontargeted UAPs with \(p=2\) and \(\zeta=4\%\) against the Inception V3 model for the skin lesion image dataset, \(R_{f}\) of the black-box UAP was \(\sim\)80% (Table 1), whereas that of the white-box UAP was \(\sim\)90% (see Table 1 in [14]), where 1000 test images and 7000 training images were used to generate the black-box and white-box UAPs, respectively. For nontargeted attacks, overall, the values of \(R_{f}\) of the black-box UAPs were 40% to 80% (Table 1, except for the nonsignificant cases in which \(R_{f}\) is almost similar to the random control), whereas \(R_{f}\) of the white-box UAPs was 70% to 90% [14]. For targeted attacks, the values of \(R_{s}\) of the black-box UAPs were 60% to 90% (Table 2, except for the controls), whereas those of the white-box UAPs were >90% (see Table 2 in [14]). Given that the DNNs for medical image classification are vulnerable to white-box (i.e., loss gradient-based) UAPs [14], it is expected that black-box UAPs can also be generated by estimating loss gradients from model outputs. The white-box methods for generating UAPs [12; 13], used in [14], iteratively update a UAP vector using loss-gradient-based methods (e.g., the fast gradient sign method [2] and DeepFool [29]). Thus, instead of such white-box methods, black-box methods that craft an input-dependent adversarial perturbation by estimating the loss gradient from model outputs (e.g., the ZOO method [15]) can be used in the iterative algorithms to generate black-box UAPs. However, this approach may be unrealistic in terms of computational time because crafting an adversarial perturbation while estimating loss gradients is time-consuming in black-box methods. Therefore, we considered an extension of SimBA (i.e., a simple hill-climbing approach) as an alternative approach. In general, the number of queries per fixed time is limited in terms of software and application programming interfaces in terms of security; thus, query-efficient methods are needed for input-dependent adversarial attacks. Our proposed method generated UAPs with a relatively high performance despite a small number of queries because it is based  
Figure 3: Effect of input dataset size on the fooling rates \(R_{f}\) (%) of UAPs against Inception V3 (**a**), ResNet50 (**b**), and VGG16 models (**c**) for skin lesion image dataset. The values of \(R_{f}\) for both the input and validation datasets are shown. on the SimBA method [18], which is a query-efficient approach. The upper of the overall number of queries is the same for the SimBA method when considering adversarial attacks on classification tasks for an image set; specifically, it is the product of the maximum number of iterations (\(i_{\max}\)) and the number of input images (\(N\)).