Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries

Hao Lin; Wenqiang Wang; Xiaochun Cao; Yangshijie Zhang; Yan Xiao

REVIEW 3 major objections 6 minor 13 references

Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries

T0 review · 3 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CEMA claims that a substitute classifier trained on binary cluster labels of concatenated input-output vectors can craft adversarial texts that transfer across unrelated tasks in a black-box multi-task model, using as few as 100 queries.

desk verdict Plausible, useful black-box multi-task attack with a weakly supported central mechanism; the random-label ablation is the thing to demand in review. read the letter →

arxiv 2508.10039 v1 pith:VZC5Z4XD submitted 2025-08-10 cs.CR cs.AI

Wenqiang Wang , Yan Xiao , Hao Lin , Yangshijie Zhang , Xiaochun Cao This is my paper

classification cs.CRcs.AI

keywords adversarialtextattackmulti-tasklearningblack-boxtransferabilityfew-shotqueriessubstitutemodelbinaryclusteringLLMsecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes CEMA (Cluster and Ensemble Multi-task Text Adversarial Attack), an attack that turns a black-box multi-task text model into a single classification problem. CEMA takes a small set of auxiliary texts, queries the victim once per text, embeds each text together with all its task outputs, concatenates those embeddings, and runs binary clustering to create pseudo-labels. A substitute classifier trained on those pseudo-labels is then attacked with standard text-classification methods, and the candidate perturbation that fools the largest number of independently retrained substitutes is chosen as the final adversarial text. The paper's central claim is that this 'deep-level' substitute transfers adversarial examples to unrelated downstream tasks: with 100 black-box queries, CEMA reports classification attack success above 59% (up to 80.80%) and translation BLEU scores as low as 0.14. If the claim holds, multi-task attacks no longer need shared internal features, task-specific labels, or large query budgets.

What carries the argument

The central mechanism is the deep-level substitute model: a binary text classifier trained on cluster labels obtained by spectral clustering of concatenated input-output embeddings. It converts a multi-task black-box attack into a white-box classification attack and supplies the transferability channel. The second mechanism is the transferability-oriented selection rule: among candidates generated by Hotflip, FD, and TextBugger, the one that flips the most independently retrained substitutes wins, with output-probability shift as the tie-breaker.

What would settle it

Run CEMA's full pipeline with the same auxiliary texts, victim outputs, embeddings, and attack methods, but replace the spectral-cluster labels with random binary labels. If attack success rates and BLEU scores stay close to the reported values, the 'deep-level' labels carry no causal information and the hypothesis is refuted. A complementary check is whether cluster assignments align with any interpretable semantic partition of the victim outputs; if they do not, the transfer is better explained by input-space artifacts.

Watch

Extended reading notes

Core claim

CEMA's load-bearing discovery is the deep-level attack hypothesis (Assumption 4.1): if a substitute model $f_s$ trained on deep-level labels misclassifies an adversarial example, the victim multi-task model $f_v$ will also change its output, i.e. $f_s(x^*)\neq f_s(\tilde{x})$ implies $f_v(x^*)\neq f_v(\tilde{x})$ for downstream tasks. The deep-level labels are obtained without task supervision: auxiliary inputs and their victim outputs are embedded with a pre-trained model, concatenated, and split into two clusters by spectral clustering. Those binary cluster labels replace the unknown task labels, and a binary classifier is trained as the substitute. CEMA then generates candidate adversaria

Load-bearing premise

The load-bearing premise is that binary cluster labels over concatenated input-output embeddings encode a deep shared property of all downstream tasks, so that a substitute trained on those labels produces adversarial examples that transfer to tasks whose labels and objectives were never seen.

Editorial extensions

If this is right

With 100 black-box queries, CEMA reports classification ASR above 59% (up to 80.80%) and translation BLEU scores as low as 0.14 across the reported victim models and datasets.
With only 10 queries, average ASR is around 43% and average BLEU around 0.22, so query budgets far smaller than prior multi-task attacks suffice.
The attack transfers across task types: six-task setups mixing four classification and two translation tasks, plus summarization and text-to-image settings, all show degradation.
Commercial closed APIs (Baidu Translate, Ali Translate) and large language models (ChatGPT-4o, Claude 3.5) are reported as vulnerable using 100 auxiliary texts and black-box outputs.
Increasing the number of candidate-generating attack methods improves attack success, while increasing the number of clusters above two reduces reported performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the deep-level hypothesis is right, the same concatenate-and-cluster recipe may extend to multimodal multi-task systems by clustering embeddings of inputs concatenated with their outputs; this is a direct extension CEMA itself does not claim.
A random-label control would test whether the cluster labels themselves carry information: if replacing spectral-cluster labels with random binary labels preserves attack success, transfer is driven by input-space geometry rather than by any 'deep' semantic property.
The reported invariance of performance across clustering and vectorization methods (spectral/K-means/BIRCH, mT5/XLM-R/one-hot) suggests the mechanism is robust to embedding choice, which in turn points toward a defensive strategy: disrupt the input-output concatenation structure rather than attempt to remove task information.
If cluster labels merely reflect formatting or distributional artifacts of the outputs, the attack should fail on tasks whose output distributions differ sharply from the auxiliary data; testing on out-of-distribution auxiliary texts would reveal this boundary.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague — quick take on arXiv:2508.10039. The paper does something genuinely new: CEMA is the first text multi-task black-box attack, and the recipe — cluster concatenated input/output embeddings into binary pseudo-labels, train a substitute classifier, generate candidates with Hotflip/FD/TextBugger, then pick the candidate that fools the most re-trained substitutes — is clever and easy to reuse. The empirical footprint is broad: 2/3/6-task setups, classification plus translation, commercial APIs, LLMs, summarization, text-to-image, and a low-quality auxiliary data test. If the numbers are reproducible, it's a useful result.

The soft spot is exactly where the reader put it. Assumption 4.1 is the load-bearing claim: adversarials from a substitute trained on "deep-level labels" transfer across tasks. But those labels are just a two-cluster partition of the concatenated vectors. The ablations vary cluster count, clustering algorithm, vectorization, and number of attack methods, but never test whether the labels matter. A random-label control and an input-only-label control would settle whether the transfer comes from the deep-level structure or from generic perturbation degrading any NLP model. Given the LLM baseline is only random character deletion, the generic-perturbation explanation is not ruled out. The paper overstates in the abstract when it says it "demonstrates" the hypothesis; it demonstrates the attack, not the hypothesis.

Other issues are smaller. The proof of Theorem 4.2 for dependent events uses a questionable inequality direction, though the theorem itself is just monotonicity of unions and is fine. No error bars and no discussion of seeds, which matters because clustering and subsampling inject variance. The main setup uses "unlabeled victim texts" as auxiliary data, which may or may not overlap the test set; the low-quality-data section explicitly uses the validation set, which is better. The LLM comparison to random deletion is too weak to call the results SOTA on LLMs.

None of this sinks the paper. The method is new, the experiments are substantial, and the commercial API results are independent evidence that something transfers in 100 queries. But the central mechanism is unfalsified, so the paper should not be accepted as-is. A serious referee should ask for the random-label ablation, a stronger LLM baseline (e.g., a standard word-level attack), and error bars over multiple runs. With that, it could be a solid venue paper. I would engage with it in review; it's the kind of paper that benefits from one round of substantive revision. Bring it to reading group if you want to discuss how much mechanism a security paper needs.

Referee Report

3 major / 6 minor

Summary. The paper proposes CEMA, a black-box multi-task textual adversarial attack. It uses 100 auxiliary texts, queries the victim model to obtain outputs, concatenates input/output embeddings, applies binary spectral clustering to create 'deep-level labels', and trains a substitute binary classifier. It then generates candidate adversarial examples with Hotflip, FD, and TextBugger, and selects the candidate that fools the largest number of ensemble substitute models. Experiments on M3TL models, commercial APIs, LLMs, and six-task setups report ASR above 59% for classification and BLEU below 0.16 for translation with 100 total queries, plus extensions to summarization and text-to-image. The central load-bearing assertion is Assumption 4.1 (the deep-level attack hypothesis), which is stated as an assumption rather than derived or directly validated.

Significance. The framework is simple, query-efficient, and potentially general: converting a multi-task attack into a classification attack with a plug-and-play substitute model. The breadth of evaluation—two, three, and six tasks, commercial APIs, LLMs, and image generation—is a strength, and the reported few-shot performance is impressive if the mechanism holds. However, the central mechanism is asserted as an assumption and is not isolated by control experiments; the evaluation lacks error bars and uses a weak LLM baseline. If the deep-level hypothesis is validated, this is a significant result; as it stands, the evidence is suggestive but incomplete. The paper does not appear to ship code, which limits reproducibility.

major comments (3)

[Sec. 4.1, Assumption 4.1 / Eq. (1); Sec. 5.3] The central claim rests on Assumption 4.1, which is asserted via a bird/cat analogy rather than derived or directly tested. The contribution list (Sec. 1) says the hypothesis is 'demonstrated', but the paper only shows that CEMA as a whole works; no experiment isolates whether the cluster labels carry task-relevant 'deep-level' structure. The ablations in Sec. 5.3 vary cluster number, clustering algorithm, vectorization, and attack-method count, but never compare against a random-label substitute trained on the same inputs with arbitrary binary labels, nor against input-only labels (without victim outputs). If a random-label control yields similar ASR/BLEU, Eq. (1) is not the operative mechanism and the results reduce to generic text corruption. This control is essential before the transfer claim can be accepted.
[Sec. 5.1 and Tables 2-3] The query-budget comparison is ambiguous. CEMA's Total-Qry=100 appears to be a global budget for querying the victim on 100 auxiliary texts, after which all test-set attacks are performed via transfer with zero additional victim queries. Baseline Total-Qry entries (e.g., 47360 for BAE) are totals over the full test set, while the text says baselines are 'limited to 55 queries per victim text'. These are incompatible units. In addition, the main setup says only 'we select 100 unlabeled victim texts' without stating whether these auxiliary texts are disjoint from the test set; if they are test-set instances or sampled from the same distribution without exclusion, the comparison is not a clean few-shot evaluation. The low-quality auxiliary experiment (Sec. K) uses cross-dataset data, but the main tables need an explicit statement of auxiliary/test overlap.
[Sec. 5.2, Tables 1-3] All reported numbers are single runs with no error bars or significance tests. CEMA involves random 80% subsampling of auxiliary pairs, w random substitute initializations, and stochastic search in the candidate attacks, so run-to-run variance is expected. For example, Table 2 reports ASR 73.57% for CEMA vs 46.11% for HQA; without variance it is impossible to know whether the gap is meaningful. Further, the only LLM baseline in Table 1 is Random-Del (random character deletion), which is not a standard adversarial baseline; claiming 'state-of-the-art' performance against such a baseline is unsupported. Please report means and standard deviations over at least 5 seeds and compare against established black-box text attacks (e.g., TextFooler, BERT-ATTACK, or HLGA) where applicable.

minor comments (6)

[Appendix H] The proof of Theorem 4.2 for dependent events is invalid: from P(A_u) ≤ Π(1-p_i) and P(A_{u+1}) ≤ Π(1-p_i) one cannot conclude P(A_{u+1}) ≥ P(A_u). The theorem itself is trivially true because A_u ⊆ A_{u+1} for any events, so the proof should be replaced by this simple argument. The stress-test concern about dependence therefore does not undermine the conclusion, but the formal proof needs correction.
[Sec. 2.3] Heading contains a typo: 'Mutil-task Adversarial Attack' should be 'Multi-task Adversarial Attack'.
[Sec. 4.2.2] The claim that two clusters capture the 'most fundamental deep-level label' because three- or four-cluster labels 'would ultimately merge into two' is unclear and needs a concrete justification.
[Figures 1 and 3] The figures are low resolution; equations embedded in Figure 1 are not legible and should be typeset separately or enlarged.
[Table 12] Header typos: 'dis-emoton' should be 'dis-emotion' and 'opumt' should be 'opus-mt'.
[Reproducibility] No code or data release statement is provided. Given the number of hyperparameters (ϵ, number of clusters, w, l, subsampling ratio), a release or at least a detailed pseudocode would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: attack success is measured externally on the victim model, and the deep-level label is an empirical assumption rather than a derived result.

full rationale

CEMA's central claim is that adversarial examples crafted against a substitute model trained on binary cluster labels of concatenated input/output vectors transfer to a black-box multi-task victim. This is an empirical hypothesis (Assumption 4.1), not a derivation: the victim model is used only to obtain auxiliary outputs (Eq. 2) and to measure final attack success (Eq. 4 condition), while candidate generation (Eq. 4) and selection (Eqs. 6-7) are internal to the substitute ensemble. No equation defines the target result in terms of the fit, and no fitted parameter is renamed as a prediction. The only self-citation (Wang et al., 2023, Appendix E.1) concerns a defense baseline and is not load-bearing. The absence of a random-label control is a validity concern about the 'deep-level' interpretation, not a circularity: the attack metrics (ASR, BLEU) are measured on the victim, not on the substitute used to construct the attack.

Assumptions & free parameters 5 free parameters · 4 assumptions · 1 invented entities

The method depends on the unproven Deep-level Attack Hypothesis, standard transferability assumptions, and the choice of clustering as a source of pseudo-labels. The free parameters (epsilon, number of clusters, attack methods, auxiliary size) are selected by the authors to maximize reported performance, and the number of substitute models w is not disclosed.

free parameters (5)

similarity threshold epsilon = 0.8
Chosen by the authors for candidate selection; not derived.
number of clusters = 2
Set to 2 based on ablation showing best empirical performance.
number of attack methods l = 3
Hotflip, FD, TextBugger; ablation shows 3 outperforms 1.
auxiliary data size = 100
Fixed query budget; paper reports 10 to 2000 shot results.
number of substitute models w
Used in selection but the exact value is not reported.

assumptions (4)

ad hoc to paper Deep-level Attack Hypothesis (Assumption 4.1)
The paper asserts that adversarial examples against a substitute trained on binary cluster labels of input-output pairs transfer to multiple downstream tasks; no proof is given, only the bird-cat analogy.
domain assumption Transferability of adversarial examples across models
Standard in the field, relied on throughout.
domain assumption Spectral clustering produces meaningful deep-level labels
The method assumes cluster assignments capture fundamental properties; not proven.
domain assumption Victim outputs for auxiliary texts are obtainable with queries
Requires black-box access to the victim for 100 auxiliary inputs.

invented entities (1)

deep-level labels
purpose: Binary pseudo-labels from clustering input-output vectors, used to train the substitute model
The concept is operationalized only within the paper; no external falsifiable handle beyond reported attack success, which is the paper's own evaluation.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries." pith.science (2026). https://pith.science/paper/VZC5Z4XD

@misc{pith2026250810039,
  author       = {Pith},
  title        = {Pith review of: Multi-task Adversarial Attacks against Black-box Model with Few-shot Queries},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VZC5Z4XD}},
  note         = {Machine review of arXiv:2508.10039}
}

read the original abstract

Current multi-task adversarial text attacks rely on abundant access to shared internal features and numerous queries, often limited to a single task type. As a result, these attacks are less effective against practical scenarios involving black-box feedback APIs, limited queries, or multiple task types. To bridge this gap, we propose \textbf{C}luster and \textbf{E}nsemble \textbf{M}ulti-task Text Adversarial \textbf{A}ttack (\textbf{CEMA}), an effective black-box attack that exploits the transferability of adversarial texts across different tasks. CEMA simplifies complex multi-task scenarios by using a \textit{deep-level substitute model} trained in a \textit{plug-and-play} manner for text classification, enabling attacks without mimicking the victim model. This approach requires only a few queries for training, converting multi-task attacks into classification attacks and allowing attacks across various tasks. CEMA generates multiple adversarial candidates using different text classification methods and selects the one that most effectively attacks substitute models. In experiments involving multi-task models with two, three, or six tasks--spanning classification, translation, summarization, and text-to-image generation--CEMA demonstrates significant attack success with as few as 100 queries. Furthermore, CEMA can target commercial APIs (e.g., Baidu and Google Translate), large language models (e.g., ChatGPT 4o), and image-generation models (e.g., Stable Diffusion V2), showcasing its versatility and effectiveness in real-world applications.

Figures

Figures reproduced from arXiv: 2508.10039 by the authors.

**Figure 1.** The Overview of CEMA. ❶ During deep-level substitute model training, CEMA vectorizes the auxiliary data and labels using pre-trained models, concatenates the vectors, and applies binary clustering to generate deeplevel labels, which are used to train the substitute model fs . ❷ For candidate adversarial example generation, l text classification attack methods are used to create l examples. Examples exceeding a simi… view at source ↗

**Figure 2.** The average ASR and BLUE of different clusters’ number. Fewer clusters result in the better attack results. Clustering and vectorization methods. As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

**Figure 3.** The average ASR and BLUE of CEMA under various clustering and vectorization methods. choice of vectorization methods leads to slight fluctuations in both classification and translation, but none achieves SOTA performance. The average ASR for mT5, XLM-R, and one-hot encoding is around 67.7%, with BLEU scores ranging from 0.21 to 0.22, indicating the random impact of vectorization methods. In summary, clustering and… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: The results of Preceding Language Modifier [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]

**Figure 5.** Figure 5: The results of adversarial training. i.e., the probability of at least one success increases as the number of attack methods u increases. Proof Process Step 1: Probability of Failure with u Attack Methods The probability of failure with u attack methods is given by: …

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

13 extracted references · 11 canonical work pages

[1]

Success Probability of Attack Methods: - Let pj i be the success probability of the j-th attack method of the victim text x∗ i

work page
[2]

Event Au: - Au denotes the event that at least one of the u attack methods succeeds, i.e., Au = A1 ∪ A2 ∪ · · · ∪Au, (10) where Ai is the event that the i-th attack method succeeds

work page
[3]

(11) Therefore, the probability of at least one success is: P (Au) = 1 − P (Au)

Event Au: - Au denotes the event where none of the u attack methods succeeds, i.e., Au = A1 ∩ A2 ∩ · · · ∩Au. (11) Therefore, the probability of at least one success is: P (Au) = 1 − P (Au). (12)

work page
[4]

(14) Therefore, the probability of at least one success with u + 1 attack methods is: P (Au+1) = 1 − P (Au+1)

Event Au+1: - Similarly, for u + 1 attack methods, Au+1 is defined as: Au+1 = A1 ∪ A2 ∪ · · · ∪Au+1, (13) and Au+1 represents the event where none of the u + 1 attack methods succeeds: Au+1 = A1 ∩ A2 ∩ · · · ∩Au+1. (14) Therefore, the probability of at least one success with u + 1 attack methods is: P (Au+1) = 1 − P (Au+1). (15) Goal We want to prove that...

work page 2000
[5]

Cambodian Journal of Educational Re- search, 4(1):35–56

Chatgpt-4o for english language teaching and learning: Features, applications, and future prospects. Cambodian Journal of Educational Re- search, 4(1):35–56. Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami

work page
[33]

Wang Xiaosen, Kangheng Tong, and Kun He

IEEE. Wang Xiaosen, Kangheng Tong, and Kun He. 2023. Rethinking the backward propagation for adversarial transferability. NeurIPS, 36:1905–1922. L Xue. 2020. mt5: A massively multilingual pre- trained text-to-text transformer. arXiv preprint arXiv:2010.11934. Zhewei Yao, Amir Gholami, Sheng Shen, Mustafa Mustafa, Kurt Keutzer, and Michael Mahoney. 2021. A...

arXiv 2023
[1996]

Adversarial Attacks on Hidden Tasks in Multi-Task Learning

Birch: an efficient data clustering method for very large databases. ACM sigmod record, 25(2):103– 114. Yinghua Zhang, Yangqiu Song, Jian Liang, Kun Bai, and Qiang Yang. 2020. Two sides of the same coin: White-box and black-box attacks for transfer learning. In SIGKDD, pages 2989–2997. Yu Zhe, Rei Nagaike, Daiki Nishiyama, Kazuto Fukuchi, and Jun Sakuma. ...

work page Pith review arXiv 2020
[2017]

In CCS, pages 506–519

Practical black-box attacks against machine learning. In CCS, pages 506–519. Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. 2016. Crafting adversarial in- put sequences for recurrent neural networks. In MIL- COM, pages 49–54. Martin Pineda, Qianlong Wang, Weixian Liao, Michael McGuire, and Wei Yu. 2022. A multi-model multi- task ...

work page 2016

Show all 13 references

[2018]

K Krishna and M Narasimha Murty

Google translate in academic writing courses? The EuroCALL Review, 26(2):50–57. K Krishna and M Narasimha Murty. 1999. Genetic k-means algorithm. IEEE Transactions on Sys- tems, Man, and Cybernetics, Part B (Cybernetics) , 29(3):433–439. Huda Mohammed Lateef, Ahmad Muter Awaad...

1999
[2019]

In ACL, pages 1085–1097

Generating natural language adversarial exam- ples through probability weighted word saliency. In ACL, pages 1085–1097. Luke E Richards, André Nguyen, Ryan Capps, Steven Forsyth, Cynthia Matuszek, and Edward Raff. 2021. Adversarial transfer attacks with unknown data and class ...

2021 arXiv
[2021]

arXiv preprint arXiv:2107.04187

A multi-modal and multi-task learning method for action unit and expression recognition. arXiv preprint arXiv:2107.04187. Yan Kang, Jianjun Zhao, Xuekun Yang, Baochen Fan, and Wentao Xie. 2024. A hybrid style transfer with whale optimization algorithm model for textual ad- ver...

2024 arXiv
[2022]

Information Processing & Management, 59(6):103097

Multi-label emotion classification based on ad- versarial multi-task learning. Information Processing & Management, 59(6):103097. Han Liu, Zhi Xu, Xiaotong Zhang, Xiaoming Xu, Feng Zhang, Fenglong Ma, Hongyang Chen, Hong Yu, and Xianchao Zhang. 2023. Sspattack: a simple and sw...

2023 arXiv
[2024]

Multimedia Tools and Applica- tions, 83(4):11215–11227

Reversible attack based on local visible adver- sarial perturbation. Multimedia Tools and Applica- tions, 83(4):11215–11227. Minhao Cheng, Jinfeng Yi, Pin-Yu Chen, Huan Zhang, and Cho-Jui Hsieh. 2020. Seq2sick: Evaluating the robustness of sequence-to-sequence models with ad- ...

2020 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Success Probability of Attack Methods: - Let pj i be the success probability of the j-th attack method of the victim text x∗ i

work page

[2] [2]

Event Au: - Au denotes the event that at least one of the u attack methods succeeds, i.e., Au = A1 ∪ A2 ∪ · · · ∪Au, (10) where Ai is the event that the i-th attack method succeeds

work page

[3] [3]

(11) Therefore, the probability of at least one success is: P (Au) = 1 − P (Au)

Event Au: - Au denotes the event where none of the u attack methods succeeds, i.e., Au = A1 ∩ A2 ∩ · · · ∩Au. (11) Therefore, the probability of at least one success is: P (Au) = 1 − P (Au). (12)

work page

[4] [4]

(14) Therefore, the probability of at least one success with u + 1 attack methods is: P (Au+1) = 1 − P (Au+1)

Event Au+1: - Similarly, for u + 1 attack methods, Au+1 is defined as: Au+1 = A1 ∪ A2 ∪ · · · ∪Au+1, (13) and Au+1 represents the event where none of the u + 1 attack methods succeeds: Au+1 = A1 ∩ A2 ∩ · · · ∩Au+1. (14) Therefore, the probability of at least one success with u + 1 attack methods is: P (Au+1) = 1 − P (Au+1). (15) Goal We want to prove that...

work page 2000

[5] [5]

Cambodian Journal of Educational Re- search, 4(1):35–56

Chatgpt-4o for english language teaching and learning: Features, applications, and future prospects. Cambodian Journal of Educational Re- search, 4(1):35–56. Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami

work page

[6] [33]

Wang Xiaosen, Kangheng Tong, and Kun He

IEEE. Wang Xiaosen, Kangheng Tong, and Kun He. 2023. Rethinking the backward propagation for adversarial transferability. NeurIPS, 36:1905–1922. L Xue. 2020. mt5: A massively multilingual pre- trained text-to-text transformer. arXiv preprint arXiv:2010.11934. Zhewei Yao, Amir Gholami, Sheng Shen, Mustafa Mustafa, Kurt Keutzer, and Michael Mahoney. 2021. A...

arXiv 2023

[7] [1996]

Adversarial Attacks on Hidden Tasks in Multi-Task Learning

Birch: an efficient data clustering method for very large databases. ACM sigmod record, 25(2):103– 114. Yinghua Zhang, Yangqiu Song, Jian Liang, Kun Bai, and Qiang Yang. 2020. Two sides of the same coin: White-box and black-box attacks for transfer learning. In SIGKDD, pages 2989–2997. Yu Zhe, Rei Nagaike, Daiki Nishiyama, Kazuto Fukuchi, and Jun Sakuma. ...

work page Pith review arXiv 2020

[8] [2017]

In CCS, pages 506–519

Practical black-box attacks against machine learning. In CCS, pages 506–519. Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. 2016. Crafting adversarial in- put sequences for recurrent neural networks. In MIL- COM, pages 49–54. Martin Pineda, Qianlong Wang, Weixian Liao, Michael McGuire, and Wei Yu. 2022. A multi-model multi- task ...

work page 2016