Similarity between CNN architectures does not robustly predict transferred adversarial attack success, and the reported high-accuracy decision-tree predictor likely relies on a data-splitting artifact.
Measuring the Transferability of Adversarial Examples
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
abstract
Adversarial examples are of wide concern due to their impact on the reliability of contemporary machine learning systems. Effective adversarial examples are mostly found via white-box attacks. However, in some cases they can be transferred across models, thus enabling them to attack black-box models. In this work we evaluate the transferability of three adversarial attacks - the Fast Gradient Sign Method, the Basic Iterative Method, and the Carlini & Wagner method, across two classes of models - the VGG class(using VGG16, VGG19 and an ensemble of VGG16 and VGG19), and the Inception class(Inception V3, Xception, Inception Resnet V2, and an ensemble of the three). We also outline the problems with the assessment of transferability in the current body of research and attempt to amend them by picking specific "strong" parameters for the attacks, and by using a L-Infinity clipping technique and the SSIM metric for the final evaluation of the attack transferability.
citation-role summary
background 1
citation-polarity summary
fields
cs.CR 1years
2025 1verdicts
REJECT 1roles
background 1polarities
unclear 1representative citing papers
citing papers explorer
-
The Relationship Between Network Similarity and Transferability of Adversarial Attacks
Similarity between CNN architectures does not robustly predict transferred adversarial attack success, and the reported high-accuracy decision-tree predictor likely relies on a data-splitting artifact.