# Measuring the Transferability of Adversarial Examples

arXiv: https://arxiv.org/abs/1907.06291 · HTML: https://mlsanity.com/paper/1907.06291/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jul 2019.

## Built on by (most cited first, 6 of 6)

- [A Transfer Learning and Optimized CNN Based Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2201.11812/) (2022)
- [Noise Optimization for Artificial Neural Networks](https://mlsanity.com/paper/2102.04450/) (2021)
- [How to choose your best allies for a transferable attack?](https://mlsanity.com/paper/2304.02312/) (2023)
- [Quantifying the Risk of Transferred Black Box Attacks](https://mlsanity.com/paper/2511.05102/) (2025)
- [Connecting adversarial attacks and optimal transport for domain adaptation](https://mlsanity.com/paper/2205.15424/) (2022)
- [Multi-step domain adaptation by adversarial attack to H Delta H-divergence](https://mlsanity.com/paper/2207.08948/) (2022)

## Abstract (arXiv)

Adversarial examples are of wide concern due to their impact on the reliability of contemporary machine learning systems. Effective adversarial examples are mostly found via white-box attacks. However, in some cases they can be transferred across models, thus enabling them to attack black-box models. In this work we evaluate the transferability of three adversarial attacks - the Fast Gradient Sign Method, the Basic Iterative Method, and the Carlini & Wagner method, across two classes of models - the VGG class(using VGG16, VGG19 and an ensemble of VGG16 and VGG19), and the Inception class(Inception V3, Xception, Inception Resnet V2, and an ensemble of the three). We also outline the problems with the assessment of transferability in the current body of research and attempt to amend them by picking specific "strong" parameters for the attacks, and by using a L-Infinity clipping technique and the SSIM metric for the final evaluation of the attack transferability.