# On the Transferability of Adversarial Examples Against CNN-Based Image Forensics

arXiv: https://arxiv.org/abs/1811.01629 · HTML: https://mlsanity.com/paper/1811.01629/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Nov 2018.

## Built on by (most cited first, 12 of 12)

- [Making DeepFakes more spurious: evading deep face forgery detection via trace removal attack](https://mlsanity.com/paper/2203.11433/) (2022)
- [Demystifying the Transferability of Adversarial Attacks in Computer Networks](https://mlsanity.com/paper/2110.04488/) (2021)
- [Deepfake Media Forensics: State of the Art and Challenges Ahead](https://mlsanity.com/paper/2408.00388/) (2024)
- [Resisting Deep Learning Models Against Adversarial Attack Transferability via Feature Randomization](https://mlsanity.com/paper/2209.04930/) (2022)
- [The Effect of Class Definitions on the Transferability of Adversarial Attacks Against Forensic CNNs](https://mlsanity.com/paper/2101.11081/) (2021)
- [Making Generated Images Hard To Spot: A Transferable Attack On Synthetic Image Detectors](https://mlsanity.com/paper/2104.12069/) (2021)
- [Attacking Image Splicing Detection and Localization Algorithms Using Synthetic Traces](https://mlsanity.com/paper/2211.12314/) (2022)
- [Transferable Adversarial Attack on Image Tampering Localization](https://mlsanity.com/paper/2309.10243/) (2023)
- [How to choose your best allies for a transferable attack?](https://mlsanity.com/paper/2304.02312/) (2023)
- [Spritz-PS: Validation of Synthetic Face Images Using a Large Dataset of Printed Documents](https://mlsanity.com/paper/2304.02982/) (2023)
- [Frequency Bias Matters: Diving into Robust and Generalized Deep Image Forgery Detection](https://mlsanity.com/paper/2511.19886/) (2025)
- [A Transferable Anti-Forensic Attack on Forensic CNNs Using A Generative Adversarial Network](https://mlsanity.com/paper/2101.09568/) (2021)

## Abstract (arXiv)

Recent studies have shown that Convolutional Neural Networks (CNN) are relatively easy to attack through the generation of so-called adversarial examples. Such vulnerability also affects CNN-based image forensic tools. Research in deep learning has shown that adversarial examples exhibit a certain degree of transferability, i.e., they maintain part of their effectiveness even against CNN models other than the one targeted by the attack. This is a very strong property undermining the usability of CNN's in security-oriented applications. In this paper, we investigate if attack transferability also holds in image forensics applications. With specific reference to the case of manipulation detection, we analyse the results of several experiments considering different sources of mismatch between the CNN used to build the adversarial examples and the one adopted by the forensic analyst. The analysis ranges from cases in which the mismatch involves only the training dataset, to cases in which the attacker and the forensic analyst adopt different architectures. The results of our experiments show that, in the majority of the cases, the attacks are not transferable, thus easing the design of proper countermeasures at least when the attacker does not have a perfect knowledge of the target detector.