Headless attacks bypass classification heads to fool transfer learning models.
problem Adversarial attacks against transfer learning models without access to the classification head.
method Label-blind adversarial attacks that do not require class-label information.
result Transfer attack lowers ResNet18 accuracy on CIFAR10 by over 40%.
This paper investigates why adversarial attacks can be effective against different models.
problem Understanding why adversarial attacks transfer between models.
method Developed a unifying optimization framework and formal definition for attack transferability.
result Identified two main factors: target model's vulnerability and surrogate model complexity.
New attack method makes poisoned images transferable without access to victim model.
problem Injecting poisoned images into training data to mislead deep nets.
method Designing poison images to surround targeted images in feature space, using Dropout.
result Achieves over 50% transferable success with only 1% poisoning of training set.
Bullseye Polytope improves clean-label poisoning attacks in transfer learning.
problem Poisoning neural networks with correctly labeled data.
method Creates poison images with centers close to target images in feature space.
result Improves attack success rate by 26.75% in end-to-end transfer learning.
Transfer learning improves model robustness against adversarial attacks.
problem Understanding how transfer learning affects model robustness against adversarial attacks.
method Extensive empirical evaluations of white-box and black-box attacks on fine-tuned transfer learning models.
result Adversarial examples are more transferable when fine-tuning is used than when networks are trained independently.
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
Paper creates universal adversarial attacks.
problem Creating universal, transferable, and targeted adversarial attacks.
method Learn a universal mapping to map sources to adversarial examples.
result Examples can fool networks into classifying all into one targeted class and have strong transferability.
New attacks exploit transfer learning to misclassify text models.
problem Misclassification attacks against transfer learned text classifiers.
method Novel attack algorithms using unintended features from teacher models.
result Transfer learning increases vulnerability to misclassification attacks.
Paper shows attacks on transfer learning models without target-specific info.
problem Security vulnerability in transfer learning models.
method Brute force attack on pre-trained models without target-specific data.
result Demonstrates effective and efficient attacks on transfer learning models.
New adversarial attack method based on deep feature distributions.
problem Adversarial attacks on CNN classifiers using output layer information.
method Modeling and exploiting class-wise and layer-wise deep feature distributions.
result Achieves state-of-the-art transfer-based attack results for undefended ImageNet models.
This paper explores how the generalization of substitute classifiers affects the success of black-box adversarial attacks.
problem Understanding the factors driving the transferability of black-box adversarial examples.
method Max-min adversarial example game framework and theoretical generalization bounds.
result Substitute NN with better generalization behavior results in more transferable adversarial examples.
New method improves blackbox attack transferability by perturbing feature hierarchy.
problem Improving transferability of blackbox attacks across different models and datasets.
method Perturbs representations throughout feature hierarchy to mimic other classes.
result Achieves 10x increase in targeted success rate compared to other methods.
This study evaluates how adversarial examples transfer between different models.
problem Transferability of adversarial examples across models poses a threat to machine learning reliability.
method Evaluation of three adversarial attacks (FGSM, Basic Iterative Method, Carlini & Wagner) on two model classes (VGG and Inception). Use of specific parameters and metrics (L-Infinity clipping, SSIM) for assessment.
result Adversarial examples can be transferred between models, indicating a vulnerability in machine learning systems.
This work studies adversarial transferability and proposes ensemble methods to improve robustness.
problem Adversarial transferability in neural networks and its implications for robustness.
method Investigates the effect of various factors on adversarial transferability and proposes ensemble attack methods.
result Transferability is significantly hampered by input quantization and architectural mismatch, but not by initialization.
New method improves model robustness against adversarial attacks.
problem Adversarial attacks can deceive models trained with transfer learning.
method Noisy feature distillation method for random initialization.
result Models trained with random initialization are more robust to attacks.
Improves black-box adversarial attacks with a transfer-based prior.
problem Low attack success rates and poor query efficiency in black-box adversarial attacks.
method P-RGF method that integrates a transfer-based prior and query information.
result Significantly reduces the number of queries needed for successful attacks.
Ensemble of models with uncorrelated loss functions improves adversarial robustness.
problem Adversarial attacks on deep neural networks.
method Diversity Training: training an ensemble of models with uncorrelated loss functions.
result Our method significantly improves adversarial robustness of ensembles.
FRA-Attack improves adversarial transferability for closed-source MLLMs by aligning visual focus across models.
problem Improving adversarial transferability for closed-source MLLMs, especially with high accuracy.
method Unified frequency-domain regularization approach: high-pass DCT objective for feature alignment and Frequency-domain Gradient Regularization (FGR) for gradient optimization.
result FRA-Attack achieves superior cross-model transferability, especially on GPT-5.4, Claude-Opus-4.6, and Gemini-3-flash.
Enhances adversarial examples for better transferability across models.
problem Adversarial examples often have limited black-box transferability.
method Fine-tunes existing adversarial examples by increasing perturbation on a pre-specified layer of the source model.
result Our method achieves greater black-box transferability of adversarial examples.
Paper evaluates membership inference attacks on transfer learning models.
problem Evaluating membership inference attacks on transfer learning models.
method Shadow model training strategy to derive data for membership inference classifier.
result Membership inference attacks can achieve effective performance against transfer learning models.
Enhances adversarial example transferability by fine-tuning existing examples.
problem Adversarial examples are often overfit to a source model, limiting black-box transferability.
method Intermediate Level Attack (ILA) fine-tunes adversarial examples on a pre-specified layer of the source model.
result ILAs achieve high transferability to target models without knowledge of their architecture.
The paper analyzes and minimizes transferability of adversarial attacks between models in an ensemble.
problem Adversarial attacks can transfer between models, posing security risks.
method Introduces a gradient-based measure to assess and reduce transferability, and uses it during training to increase robustness.
result Demonstrates that the gradient-based measure can be used to increase an ensemble's robustness to adversarial attacks.
New method for black-box adversarial attacks using pretrained model embeddings.
problem Efficiently attacking unknown target networks with high-level semantic patterns.
method Learn a low-dimensional embedding using a pretrained model, then search within the embedding space.
result Significant reduction in the number of queries for black-box adversarial attacks.
This paper improves attacks on recommender systems by solving optimization problems more precisely.
problem Adversarial injection attacks on recommender systems.
method Solving optimization problems for generating fake user interactions more accurately.
result The exact solution for generating fake users leads to a much larger impact on recommender systems.
DAmageNet generates universal adversarial samples with high transferability.
problem Vulnerability of deep neural networks to adversarial attacks.
method Generated 96,000 transferable adversarial samples from ImageNet.
result Adversarial samples misclassify various models with up to 90% error rate.
Simple regional perturbations maintain model transferability while reducing adversarial example distortion.
problem Comparing efficacy of regional adversarial attacks without complex methods.
method Developed a simple regional adversarial perturbation attack using cross-entropy sign.
result Localized adversarial examples require significantly less Lp norm distortion compared to non-local counterparts. LGV boosts adversarial attacks by improving surrogate models.
problem Improving the transferability of black-box adversarial attacks.
method LGV uses a pretrained surrogate model and multiple weight sets from additional training epochs to generate an effective surrogate ensemble.
result LGV outperforms other test-time transformations by significant margins.
New method improves adversarial transferability from Bayesian neural networks.
problem Improving the effectiveness of black-box evasion attacks.
method Sampling from the posterior distribution of neural network weights to build a surrogate.
result Significantly improved success rates of state-of-the-art attacks (up to 83.2 percentage points).
DVERGE diversifies adversarial vulnerabilities to enhance robust ensemble models.
problem Diverse adversarial vulnerabilities for robust ensemble models.
method Isolates and diversifies adversarial vulnerabilities through distillation and training.
result Achieves higher robustness against transfer attacks compared to previous methods.
Adversarial attacks on spectrograms can fool audio classifiers trained on waveforms.
problem Susceptibility of audio classifiers to adversarial attacks on spectrograms.
method Applying adversarial attacks to spectrograms and reconstructing audio waveforms.
result Perturbed spectrograms can fool 2D CNNs and 1D CNNs trained on audio waveforms.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
Paper proposes AoA, a new adversarial attack method that significantly increases transferability.
problem Developing universal adversarial attacks on deep neural networks.
method AoA attacks the semantic property of attention in DNNs, enhancing transferability by altering the loss function.
result AoA generates adversarial samples that defeat 13 well-trained DNNs, achieving over 85% error rate.
Paper presents strong black-box attacks on unsupervised clustering models.
problem Adversarial attacks on unsupervised machine learning models.
method Iterative black-box attack on clustering algorithms.
result Adversarial samples can fool clustering algorithms irrespective of the algorithm used.
New methods improve black-box adversarial attacks with fewer queries.
problem Efficiently craft adversarial examples without access to gradients.
method Prior-guided random gradient-free algorithms based on biased sampling and gradient averaging.
result Both methods require fewer queries and achieve higher success rates.
ODS improves adversarial attacks by maximizing output diversity.
problem Efficiency and effectiveness of adversarial attacks, especially black-box attacks.
method Output Diversified Sampling (ODS) that maximizes diversity in model outputs.
result ODS reduces the number of queries needed for black-box attacks on ImageNet by a factor of two.
Adversarial attacks pose a threat to deep neural networks, especially in safety-critical applications.
problem Adversarial attacks can misclassify deep neural networks, leading to safety issues.
method Adversarial attacks are categorized into white-box and black-box attacks based on the attacker's knowledge. They can be targeted or non-targeted.
result Adversarial attacks are effective and can transfer between different models and real-world scenarios.
Study shows mimicry attacks fail even with ASV-assisted target selection.
problem Can mimicry attacks be successful with ASV-assisted target selection?
method Used ASV to select target speakers for mimicry attacks and tested with x-vector system.
result Mimics did not succeed in spoofing the x-vector system, but relative ordering of targets was consistent.
Deep neural networks (DNNs) are one of the most prominent technologies of our time, as they achieve state-of-the-art performance in many machine learning tasks, including but not limited to image classification, text mining, and speech processing. However, recent research on DNNs has indicated ever-increasing concern o…
New snooping attacks exploit deep RL without access to environment.
problem Security vulnerabilities in deep reinforcement learning.
method Proposes snooping threat models and attacks on RL agents.
result Adversaries can launch attacks without interacting with the environment.
Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model'…
Fingerprint deep neural networks by conferrable adversarial examples.
problem Detecting model stealing attacks in machine learning as a service.
method Extract conferrable adversarial examples to fingerprint deep neural networks.
result First method to reach 1.0 ROC AUC in verifying surrogates.
Skip connections make adversarial examples more transferable in ResNets.
problem Transferability of adversarial examples in ResNets with skip connections.
method Skip Gradient Method (SGM) to craft more transferable adversarial examples.
result SGM improves transferability of adversarial examples in various DNNs.
Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black…
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
Face recognition models can be inferred from student models, posing privacy risks.
problem Privacy threats in transfer learning models for face recognition.
method Membership inference attacks and attribute inference from aggregate-level information.
result Sensitive attributes can be inferred from student models, even with limited auxiliary information.
Adversarial examples are malicious inputs designed to fool machine learning models. They often transfer from one model to another, allowing attackers to mount black box attacks without knowledge of the target model's parameters. Adversarial training is the process of explicitly training a model on adversarial examples,…
New attacks reveal membership in label-only ML models.
problem Vulnerability of ML models to membership inference attacks.
method Developed decision-based membership inference attacks.
result Label-only exposures are vulnerable to membership leakage.
Research explores how to make models more robust to adversarial attacks.
problem Vulnerability of convolutional neural networks to adversarial examples and their transferability.
method Investigates the impact of lp regularization, SVM top layer, and ensemble models on robustness and transferability. result Models trained with different regularizers and ensemble models exhibit barriers to transferability.