Abstract: Decisionbased blackbox adversarial attacks have become an important research direction in the field of artificial intelligence security. Existing methods primarily approximate the decision boundary through uniform random traversal type search, ignoring the correlation between the semantic structure of the image and the region of interest of the model, and there are problems of blind search direction, insensitive region, and low query efficiency. To this end, this paper proposes a saliencyguided adversarial decision boundary attack (SADBA) method, which is designed for blackbox image classification systems that only provide hardlabel predictions in query budgetconstrained scenarios, and guides the perturbation with saliency mask semanticsto act preferentially on key sensitive regions of the image, thereby reducing redundant queries and improving the efficiency of the attack.Experiments on the ImageNet dataset show that SADBA outperforms the baseline attack methods on several mainstream models, with the number of queries decreasing by 11.5%, 25.3%, 3.6%, 30.4%, and 8.8% respectively on VGG19, InceptionV3, EffcientNetB0, DenseNet161, and ViTB32 respectively, while maintaining or improving the attack success rate, maintaining good robustness and achieving an effective balance between query efficiency and attack stealth.

Key words: decision boundary, saliency detection, blackbox adversarial attack, hard label, adversarial sample

摘要： 基于决策的黑盒对抗攻击已成为人工智能安全领域的重要研究方向，现有方法多通过均匀随机遍历式搜索逼近决策边界，忽视了图像语义结构与模型关注区域之间的关联性，存在搜索方向盲目、区域不敏感、查询效率低下的问题.为此，提出了一种基于显著性检测的近似决策边界攻击(saliencyguided adversarial decision boundary attack, SADBA)方法，该方法适用于查询预算受限场景下仅提供硬标签预测的黑盒图像分类系统，以显著性掩码语义引导扰动优先作用于图像的关键敏感区域，从而减少冗余查询并提高攻击效率.在ImageNet数据集上的实验表明，SADBA在多个主流模型上优于基线的攻击方法，在保持或提升攻击成功率的前提下，查询次数在VGG19,InceptionV3,EffcientNetB0,DenseNet161,ViTB32上分别下降了11.5%,25.3%,3.6%,30.4%,8.8%，同时保持了良好的鲁棒性，实现了查询效率和攻击隐蔽性之间的有效平衡.

关键词: 决策边界, 显著性检测, 黑盒对抗攻击, 硬标签, 对抗样本