# Blocking Transferability of Adversarial Examples in Black-Box Learning Systems

arXiv: https://arxiv.org/abs/1703.04318 · HTML: https://mlsanity.com/paper/1703.04318/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Mar 2017.

## Built on by (most cited first, 19 of 19)

- [Machine Learning with a Reject Option: A survey](https://mlsanity.com/paper/2107.11277/) (2021)
- [Adversarial Example Detection for DNN Models: A Review and Experimental Comparison](https://mlsanity.com/paper/2105.00203/) (2021)
- [ML Attack Models: Adversarial Attacks and Data Poisoning Attacks](https://mlsanity.com/paper/2112.02797/) (2021)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)
- [Stratified Adversarial Robustness with Rejection](https://mlsanity.com/paper/2305.01139/) (2023)
- [Machine Learning in Access Control: A Taxonomy and Survey](https://mlsanity.com/paper/2207.01739/) (2022)
- [Adversarial Robustness in Unsupervised Machine Learning: A Systematic Review](https://mlsanity.com/paper/2306.00687/) (2023)
- [Generating Black-Box Adversarial Examples in Sparse Domain](https://mlsanity.com/paper/2101.09324/) (2021)
- [Oriole: Thwarting Privacy against Trustworthy Deep Learning Models](https://mlsanity.com/paper/2102.11502/) (2021)
- [Beyond Categorical Label Representations for Image Classification](https://mlsanity.com/paper/2104.02226/) (2021)
- [Mitigating Gradient-based Adversarial Attacks via Denoising and Compression](https://mlsanity.com/paper/2104.01494/) (2021)
- [Deep Bayesian Image Set Classification: A Defence Approach against Adversarial Attacks](https://mlsanity.com/paper/2108.10217/) (2021)
- [Detecting Adversaries, yet Faltering to Noise? Leveraging Conditional Variational AutoEncoders for Adversary Detection in the Presence of Noisy Images](https://mlsanity.com/paper/2111.15518/) (2021)
- [Adversarial Patterns: Building Robust Android Malware Classifiers](https://mlsanity.com/paper/2203.02121/) (2022)
- [Btech thesis report on adversarial attack detection and purification of adverserially attacked images](https://mlsanity.com/paper/2205.07859/) (2022)
- [Detecting and Recovering Adversarial Examples from Extracting Non-robust and Highly Predictive Adversarial Perturbations](https://mlsanity.com/paper/2206.15128/) (2022)
- [Adversarial Attacks on Transformers-Based Malware Detectors](https://mlsanity.com/paper/2210.00008/) (2022)
- [On The Relationship Between Universal Adversarial Attacks And Sparse Representations](https://mlsanity.com/paper/2311.08265/) (2023)
- [The Double-Edged Nature of the Rashomon Set for Trustworthy Machine Learning](https://mlsanity.com/paper/2511.21799/) (2025)

## Abstract (arXiv)

Advances in Machine Learning (ML) have led to its adoption as an integral component in many applications, including banking, medical diagnosis, and driverless cars. To further broaden the use of ML models, cloud-based services offered by Microsoft, Amazon, Google, and others have developed ML-as-a-service tools as black-box systems. However, ML classifiers are vulnerable to adversarial examples: inputs that are maliciously modified can cause the classifier to provide adversary-desired outputs. Moreover, it is known that adversarial examples generated on one classifier are likely to cause another classifier to make the same mistake, even if the classifiers have different architectures or are trained on disjoint datasets. This property, which is known as transferability, opens up the possibility of attacking black-box systems by generating adversarial examples on a substitute classifier and transferring the examples to the target classifier. Therefore, the key to protect black-box learning systems against the adversarial examples is to block their transferability. To this end, we propose a training method that, as the input is more perturbed, the classifier smoothly outputs lower confidence on the original label and instead predicts that the input is "invalid". In essence, we augment the output class set with a NULL label and train the classifier to reject the adversarial examples by classifying them as NULL. In experiments, we apply a wide range of attacks based on adversarial examples on the black-box systems. We show that a classifier trained with the proposed method effectively resists against the adversarial examples, while maintaining the accuracy on clean data.