{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T13:56:06Z","timestamp":1762005366251,"version":"build-2065373602"},"reference-count":43,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2022,3,15]],"date-time":"2022-03-15T00:00:00Z","timestamp":1647302400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U20B2050"],"award-info":[{"award-number":["U20B2050"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Youth Innovation Team of Shaanxi Universities","award":["2019-38"],"award-info":[{"award-number":["2019-38"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>The vulnerability of deep neural network (DNN)-based systems makes them susceptible to adversarial perturbation and may cause classification task failure. In this work, we propose an adversarial attack model using the Artificial Bee Colony (ABC) algorithm to generate adversarial samples without the need for a further gradient evaluation and training of the substitute model, which can further improve the chance of task failure caused by adversarial perturbation. In untargeted attacks, the proposed method obtained 100%, 98.6%, and 90.00% success rates on the MNIST, CIFAR-10 and ImageNet datasets, respectively. The experimental results show that the proposed ABCAttack can not only obtain a high attack success rate with fewer queries in the black-box setting, but also break some existing defenses to a large extent, and is not limited by model structure or size, which provides further research directions for deep learning evasion attacks and defenses.<\/jats:p>","DOI":"10.3390\/e24030412","type":"journal-article","created":{"date-parts":[[2022,3,16]],"date-time":"2022-03-16T03:34:13Z","timestamp":1647401653000},"page":"412","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["ABCAttack: A Gradient-Free Optimization Black-Box Attack for Fooling Deep Image Classifiers"],"prefix":"10.3390","volume":"24","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3985-0267","authenticated-orcid":false,"given":"Han","family":"Cao","sequence":"first","affiliation":[{"name":"Key Laboratory of Network Computing and Security, Xi\u2019an University of Technology, Xi\u2019an 710048, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chengxiang","family":"Si","sequence":"additional","affiliation":[{"name":"National Computer Network Emergency Response Technical Team\/Coordination Center of China (CNCERT\/CC), Beijing 100029, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2019-7886","authenticated-orcid":false,"given":"Qindong","family":"Sun","sequence":"additional","affiliation":[{"name":"Key Laboratory of Network Computing and Security, Xi\u2019an University of Technology, Xi\u2019an 710048, China"},{"name":"School of Cyber Science and Engineering, Xi\u2019an Jiaotong University, Xi\u2019an 710049, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yanxiao","family":"Liu","sequence":"additional","affiliation":[{"name":"Key Laboratory of Network Computing and Security, Xi\u2019an University of Technology, Xi\u2019an 710048, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shancang","family":"Li","sequence":"additional","affiliation":[{"name":"The Department of Computer Science and Creative Technology, University of the West of England, Bristol BS16 1QY, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2786-0273","authenticated-orcid":false,"given":"Prosanta","family":"Gope","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Sheffield, Sheffield S10 2TN, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,3,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"6690","DOI":"10.1109\/TGRS.2019.2907932","article-title":"Deep learning for hyperspectral image classification: An overview","volume":"57","author":"Li","year":"2019","journal-title":"IEEE Trans. Geosci Remote Sens."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"102985","DOI":"10.1016\/j.jnca.2021.102985","article-title":"DISTILLER: Encrypted traffic classification via multimodal multitask deep learning","volume":"183","author":"Aceto","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"10327","DOI":"10.1109\/JIOT.2020.3048038","article-title":"Adversarial Attacks Against Network Intrusion Detection in IoT Systems","volume":"8","author":"Qiu","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_4","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Sun, Q., Lin, K., Si, C., Xu, Y., Li, S., and Gope, P. (2022). A Secure and Anonymous Communicate Scheme over the Internet of Things. ACM Trans. Sen. Netw.","DOI":"10.1145\/3508392"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1102","DOI":"10.1109\/TIFS.2019.2934069","article-title":"Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications","volume":"15","author":"Flowers","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_7","unstructured":"Kurakin, A., Goodfellow, I., and Bengio, S. (2016). Adversarial Examples in the Physical World. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Tabacof, P., and Valle, E. (2016, January 24\u201329). Exploring the space of adversarial images. Proceedings of the 2016 International Joint Conference on Neural Networks (IJCNN), Vancouver, BC, Canada.","DOI":"10.1109\/IJCNN.2016.7727230"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., and Swami, A. (2017, January 2\u20136). Practical black-box attacks against machine learning. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, Abu Dhabi, United Arab Emirates.","DOI":"10.1145\/3052973.3053009"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Chen, P.Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.J. (2017, January 3). Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, Dallas, TX, USA.","DOI":"10.1145\/3128572.3140448"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Alzantot, M., Sharma, Y., Chakraborty, S., Zhang, H., Hsieh, C.J., and Srivastava, M.B. (2019, January 13\u201317). Genattack: Practical black-box attacks with gradient-free optimization. Proceedings of the Genetic and Evolutionary Computation Conference, Prague, Czech Republic.","DOI":"10.1145\/3321707.3321749"},{"key":"ref_12","unstructured":"Liu, X., Hu, T., Ding, K., Bai, Y., Niu, W., and Lu, J. (December, January 30). A black-box attack on neural networks based on swarm evolutionary algorithm. Proceedings of the Australasian Conference on Information Security and Privacy, Perth, WA, Australia."},{"key":"ref_13","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and Harnessing Adversarial Examples. arXiv."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Nguyen, A., Yosinski, J., and Clune, J. (2015, January 7\u201312). Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.","DOI":"10.1109\/CVPR.2015.7298640"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., and Frossard, P. (2016, January 27\u201330). Deepfool: A simple and accurate method to fool deep neural networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., and Swami, A. (2016, January 21\u201324). The limitations of deep learning in adversarial settings. Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P), Saarbruecken, Germany.","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref_17","unstructured":"Simonyan, K., Vedaldi, A., and Zisserman, A. (2013). Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps. arXiv."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 22\u201326). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. (2016, January 22\u201326). Distillation as a defense to adversarial perturbations against deep neural networks. Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2016.41"},{"key":"ref_20","unstructured":"Papernot, N., McDaniel, P., and Goodfellow, I. (2016). Transferability in Machine Learning: From Phenomena to Black-Box Attacks using Adversarial Samples. arXiv."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Biggio, B., Rieck, K., Ariu, D., Wressnegger, C., Corona, I., Giacinto, G., and Roli, F. (2014, January 7). Poisoning behavioral malware clustering. Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop, Scottsdale, AZ, USA.","DOI":"10.1145\/2666652.2666666"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Narodytska, N., and Prasad Kasiviswanathan, S. (2016). Simple Black-Box Adversarial Perturbations for Deep Networks. arXiv.","DOI":"10.1109\/CVPRW.2017.172"},{"key":"ref_23","unstructured":"Brendel, W., Rauber, J., and Bethge, M. (2017). Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. arXiv."},{"key":"ref_24","unstructured":"Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. (2018, January 10\u201315). Black-box adversarial attacks with limited queries and information. Proceedings of the International Conference on Machine Learning, PMLR, Stockholm, Sweden."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","article-title":"One pixel attack for fooling deep neural networks","volume":"23","author":"Su","year":"2019","journal-title":"IEEE Trans. Evol. Comput."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s41074-019-0053-3","article-title":"Attacking convolutional neural network using differential evolution","volume":"11","author":"Su","year":"2019","journal-title":"IPSJ Trans. Comput. Vis. Appl."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Mosli, R., Wright, M., Yuan, B., and Pan, Y. (2019). They Might NOT Be Giants: Crafting Black-Box Adversarial Examples with Fewer Queries Using Particle Swarm Optimization. arXiv.","DOI":"10.1007\/978-3-030-59013-0_22"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"158051","DOI":"10.1109\/ACCESS.2019.2948146","article-title":"Attacking black-box image classifiers with particle swarm optimization","volume":"7","author":"Zhang","year":"2019","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21\u201326). Universal adversarial perturbations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref_30","unstructured":"Mopuri, K.R., Garg, U., and Babu, R.V. (2017). Fast feature fool: A data independent approach to universal adversarial perturbations. arXiv."},{"key":"ref_31","unstructured":"Samangouei, P., Kabkab, M., and Chellappa, R. (2018). Defense-gan: Protecting classifiers against adversarial attacks using generative models. arXiv."},{"key":"ref_32","unstructured":"Dhillon, G.S., Azizzadenesheli, K., Lipton, Z.C., Bernstein, J., Kossaifi, J., Khanna, A., and Anandkumar, A. (2018). Stochastic activation pruning for robust adversarial defense. arXiv."},{"key":"ref_33","unstructured":"Guo, C., Rana, M., Cisse, M., and Van Der Maaten, L. (2017). Countering adversarial images using input transformations. arXiv."},{"key":"ref_34","unstructured":"Xiao, C., Zhong, P., and Zheng, C. (2019). Resisting adversarial attacks by k-winners-take-all. arXiv."},{"key":"ref_35","unstructured":"Karaboga, D. (2020, October 24). An Idea Based on Honey Bee Swarm for Numerical Optimization. Technical Report; Citeseer. Available online: https:\/\/abc.erciyes.edu.tr\/pub\/tr06_2005.pdf."},{"key":"ref_36","unstructured":"LeCun, Y. (2020, May 04). The MNIST Database of Handwritten Digits. Available online: http:\/\/yann.lecun.com\/exdb\/mnist\/."},{"key":"ref_37","unstructured":"Krizhevsky, A., and Hinton, G. (2021, January 11). Learning Multiple Layers of Features from Tiny Images. Available online: http:\/\/citeseerx.ist.psu.edu\/viewdoc\/summary?doi=10.1.1.222.9220."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., and Fei-Fei, L. (2009, January 20\u201325). Imagenet: A large-scale hierarchical image database. Proceedings of the 2009 IEEE Conference on Computer Vision and Pattern Recognition, Miami, FL, USA.","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Zhou, W., Hou, X., Chen, Y., Tang, M., Huang, X., Gan, X., and Yang, Y. (2018, January 8\u201314). Transferable adversarial perturbations. Proceedings of the European Conference on Computer Vision (ECCV), Munich, Germany.","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref_40","unstructured":"Athalye, A., Carlini, N., and Wagner, D. (2018, January 10\u201315). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. Proceedings of the International Conference on Machine Learning, Stockholm, Sweden."},{"key":"ref_41","unstructured":"Ma, X., Li, B., Wang, Y., Erfani, S.M., Wijewickrema, S., Schoenebeck, G., Song, D., Houle, M.E., and Bailey, J. (2018). Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv."},{"key":"ref_42","unstructured":"Tramer, F., Carlini, N., Brendel, W., and Madry, A. (2020). On adaptive attacks to adversarial example defenses. arXiv."},{"key":"ref_43","unstructured":"Pang, T., Xu, K., Du, C., Chen, N., and Zhu, J. (2019, January 9\u201315). Improving adversarial robustness via promoting ensemble diversity. Proceedings of the International Conference on Machine Learning, Long Beach, CA, USA."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/24\/3\/412\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:37:00Z","timestamp":1760135820000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/24\/3\/412"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,3,15]]},"references-count":43,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2022,3]]}},"alternative-id":["e24030412"],"URL":"https:\/\/doi.org\/10.3390\/e24030412","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2022,3,15]]}}}