  This work studies black-box adversarial attacks against deep neural networks
(DNNs), where the attacker can only access the query feedback returned by the
attacked DNN model, while other information such as model parameters or the
training datasets are unknown. One promising approach to improve attack
performance is utilizing the adversarial transferability between some white-box
surrogate models and the target model (i.e., the attacked model). However, due
to the possible differences on model architectures and training datasets
between surrogate and target models, dubbed "surrogate biases", the
contribution of adversarial transferability to improving the attack performance
may be weakened. To tackle this issue, we innovatively propose a black-box
attack method by developing a novel mechanism of adversarial transferability,
which is robust to the surrogate biases. The general idea is transferring
partial parameters of the conditional adversarial distribution (CAD) of
surrogate models, while learning the untransferred parameters based on queries
to the target model, to keep the flexibility to adjust the CAD of the target
model on any new benign sample. Extensive experiments on benchmark datasets and
attacking against real-world API demonstrate the superior attack performance of
the proposed method.
