BO-DBA: Query-Efficient Decision-Based Adversarial Attacks Based on Bayesian Optimization

The researchers propose BO-DBA, which models decision-based adversarial attacks as a Bayesian optimization problem and generates adversarial examples by searching perturbation directions, greatly reducing the number of queries. On ImageNet pretrained classifiers, BO-DBA converges within 200 queries, whereas state-of-the-art decision-based attacks require more than 15000 queries to reach the same perturbation distortion. Compared with score-based attacks based on Bayesian optimization, its attack success rate is similar and its perturbation distortion is smaller.