Research on Black‐Box Local Attack Methods Based on Improved <scp>BANA</scp> Algorithm

ABSTRACT In order to improve the capability of black‐box local attack, a black‐box local attack method based on the improved BANA algorithm is proposed. First, based on the BANA algorithm, an autoencoder is introduced to generate an initial population of random perturbations. Then, by improving the crossover and mutation operations of the BANA algorithm, high‐quality adversarial samples are generated, achieving fast and effective black‐box local attacks. Simulation results reveal that the average fooling rate, average L2 norm length, average query time, average peak signal‐to‐noise ratio, and average structural similarity of the black‐box local attack method based on the improved BANA algorithm are 100%, 1.26, 92.00, 0.94 dB, and 33.70%, respectively. The fooling rate, average L2 norm length, average query times, peak signal‐to‐noise ratio of adversarial examples, and average structural similarity of the adversarial examples of the neural network model for distillation defense are 98.33%, 1.32, 98.63, 0.92 dB, and 30.14%, respectively. Therefore, the black‐box local attack method based on the improved BANA algorithm has a high black‐box local attack ability.