Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks

By Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, Fabio Roli. 2018

477 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, background): “Similarly, bilevel optimizationbased poisoning attacks are also conducted on linear regression [51] and logistic regression [27].”
GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models (2023, background): “While the feature extractors may still be similar because of the well-known transferability property between large models [18, 58, 79, 84, 101], their differences could reduce the efficacy of cloaking.”
Adversarial Examples on Object Recognition (2020, background): “[36] showed that transferability is dependent on the input gradient’s size (for the target classifier) and on the loss variance for the base base classifier.”
Towards Adversarial Malware Detection (2018, methodology): “7However, it has been shown that if the surrogate data is well representative of the training data used by the target system, the relabeling procedure is not even required [8, 29].”
Membership Leakage in Label-Only Exposures (2020, background): “Almost all related works [15, 33, 37, 39] focus on the transferability of adversarial examples, i.”
Fawkes: Protecting Privacy against Unauthorized Deep Learning Models (2020, background): “fectiveness of cloaking against any tracker models relies on the transferability effect, the property that models trained for similar tasks share similar properties and vulnerabilities, even when they were trained on different architectures and different training data [13, 38, 49, 69].”
secml: A Python Library for Secure and Explainable Machine Learning (2019, methodology): “The optim package provides an implementation of the projected gradient descent (PGD) algorithm, and a more eﬃcient version of it that runs a bisect line search along the gradient direction (PGD-LS) to reduce the number of gradient evaluations (for more details, see Demontis et al., 2019).”
Invisible Backdoor Attacks on Deep Neural Networks Via Steganography and Regularization (2019, background): “The former is referred to as backdoor attacks, while the latter is known as poisoning availability attacks [20].”
Data Poisoning Attacks Against Federated Learning Systems (2020, methodology): “Several poisoning attacks were developed for popular ML models including SVM [6,12,44,45,50,52], regression [19], dimensionality reduction [51], linear classifiers [12,23,57], unsupervised learning [7], and more recently, neural networks [12,30,42,45,53,58].”
MetaPoison: Practical General-purpose Clean-label Data Poisoning (2020, unknown): “, 2012], logistic regression [Demontis et al., 2019] or linear regression [Jagielski et al.”
Exploring Backdoor Poisoning Attacks Against Malware Classifiers (2020, background): “Gradient-based poisoning availability attacks have been shown against regression [27] and neural networks [38], and the transferability of these attacks has been demonstrated [23].”