Abstract: Aiming at the problem of black box adversarial attack in the field of image recognition, a black box adversarial attack algorithm is proposed based on the DDQN framework and Dueling network structure in reinforcement learning. The agent generates an adversarial sample by imitating human adjustment of the image, interacts with the attacked model to obtain misclassification results, and calculates the structural similarity of the clean sample and the adversarial sample to generate a reward. During the attack, only the label output information of the attacked model was obtained. The experimental results show that the success rate of attacking the four deep neural network models trained on the CIFAR10 and CIFAR100 datasets exceeds 90%. The quality of the generated adversarial samples is similar to the white box attack algorithm FGSM and the success rate is more advantageous.

Key words: adversarial samples, black box attacks, deep learning, reinforcement learning