mlsanityData to 14 Oct 2026

The Space of Transferable Adversarial Examples

arXiv 1704.03453 ↗First posted 11 Apr 2017stat.ML cs.CR cs.LGcited by 158

Not on the map. Why?

Abstract (arXiv)

Adversarial examples are maliciously perturbed inputs designed to mislead machine learning (ML) models at test-time. They often transfer: the same adversarial example fools more than one model. In this work, we propose novel methods for estimating the previously unknown dimensionality of the space of adversarial inputs. We find that adversarial examples span a contiguous subspace of large (~25) dimensionality. Adversarial subspaces with higher dimensionality are more likely to intersect. We find that for two different models, a significant fraction of their subspaces is shared, thus enabling transferability. In the first quantitative analysis of the similarity of different models' decision boundaries, we show that these boundaries are actually close in arbitrary directions, whether adversarial or benign. We conclude by formally studying the limits of transferability. We derive (1) sufficient conditions on the data distribution that imply transferability for simple model classes and (2) examples of scenarios in which transfer does not occur. These findings indicate that it may be possible to design defenses against transfer-based attacks, even for models that are vulnerable to direct attacks.

Key facts. Cited by 158 papers in the map (data through 14 Oct 2026). First posted on arXiv 11 Apr 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 48; 2022: 35; 2023: 33; 2024: 17; 2025: 18; 2026: 7.

158 papers.

Sort:

By area:

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
  3. 2021Partial success in closing the gap between human and machine visioncited by 185
  4. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  5. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 69
  6. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 66
  7. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 61
  8. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 58
  9. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 45
  10. 2022LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinitycited by 39
  11. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 38
  12. 2021Trivial or impossible -- dichotomous data difficulty masks model differences (on ImageNet and beyond)cited by 35
38 more
  1. 2021GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularizationcited by 34
  2. 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 33
  3. 2021Attacking Adversarial Attacks as A Defensecited by 32
  4. 2021Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domaincited by 29
  5. 2021Reliably fast adversarial training via latent adversarial perturbationcited by 29
  6. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  7. 2021BASAR:Black-box Attack on Skeletal Action Recognitioncited by 26
  8. 2023Differentially Private Attention Computationcited by 25
  9. 2021Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attackcited by 24
  10. 2021ANCER: Anisotropic Certification via Sample-wise Volume Maximizationcited by 23
  11. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 23
  12. 2021Mixed Nash Equilibria in the Adversarial Examples Gamecited by 22
  13. 2021Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differentlycited by 22
  14. 2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIPcited by 21
  15. 2021Exploring Robustness of Unsupervised Domain Adaptation in Semantic Segmentationcited by 20
  16. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  17. 2022REAP: A Large-Scale Realistic Adversarial Patch Benchmarkcited by 18
  18. 2021Adversarial Robustness in Multi-Task Learning: Promises and Illusionscited by 17
  19. 2021Mutual Adversarial Training: Learning together is better than going alonecited by 17
  20. 2021Security and Privacy for Artificial Intelligence: Opportunities and Challengescited by 16
  21. 2022Existence and Minimax Theorems for Adversarial Surrogate Risks in Binary Classificationcited by 15
  22. 2023A LLM Assisted Exploitation of AI-Guardiancited by 15
  23. 2022Foiling Explanations in Deep Neural Networkscited by 14
  24. 2022Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attackscited by 14
  25. 2021On the Robustness of Domain Constraintscited by 11
  26. 2022D4: Detection of Adversarial Diffusion Deepfakes Using Disjoint Ensemblescited by 11
  27. 2021Adversarial Attack Framework on Graph Embedding Models with Limited Knowledgecited by 10
  28. 2022AS2T: Arbitrary Source-To-Target Adversarial Attack on Speaker Recognition Systemscited by 10
  29. 2023Attacking Perceptual Similarity Metricscited by 10
  30. 2024Hard-label based Small Query Black-box Adversarial Attackcited by 10
  31. 2024Medical MLLM is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Modelscited by 10
  32. 2021Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attackscited by 9
  33. 2021Fairness Properties of Face Recognition and Obfuscation Systemscited by 9
  34. 2021Demystifying the Transferability of Adversarial Attacks in Computer Networkscited by 9
  35. 2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9
  36. 2022How many perturbations break this model? Evaluating robustness beyond adversarial accuracycited by 9
  37. 2021Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimationcited by 8
  38. 2021Adversarial Transfer Attacks With Unknown Data and Class Overlapcited by 8

50 most cited of 158 All 158 (JSON)