# Man-in-the-Middle Attacks against Machine Learning Classifiers via Malicious Generative Models

arXiv: https://arxiv.org/abs/1910.06838 · HTML: https://mlsanity.com/paper/1910.06838/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Oct 2019.

## Built on by (most cited first, 19 of 19)

- [DENSE: Data-Free One-Shot Federated Learning](https://mlsanity.com/paper/2112.12371/) (2021)
- [Enhancing One-Shot Federated Learning Through Data and Ensemble Co-Boosting](https://mlsanity.com/paper/2402.15070/) (2024)
- [Unifying GANs and Score-Based Diffusion as Generative Particle Models](https://mlsanity.com/paper/2305.16150/) (2023)
- [The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attacks](https://mlsanity.com/paper/2305.14188/) (2023)
- [One-shot Federated Learning via Synthetic Distiller-Distillate Communication](https://mlsanity.com/paper/2412.05186/) (2024)
- [Preemptive Image Robustification for Protecting Users against Man-in-the-Middle Adversarial Attacks](https://mlsanity.com/paper/2112.05634/) (2021)
- [Be Careful with Rotation: A Uniform Backdoor Pattern for 3D Shape](https://mlsanity.com/paper/2211.16192/) (2022)
- [FedDBL: Communication and Data Efficient Federated Deep-Broad Learning for Histopathological Tissue Classification](https://mlsanity.com/paper/2302.12662/) (2023)
- [Personalized One-shot Federated Graph Learning for Heterogeneous Clients](https://mlsanity.com/paper/2411.11304/) (2024)
- [DFDG: Data-Free Dual-Generator Adversarial Distillation for One-Shot Federated Learning](https://mlsanity.com/paper/2409.07734/) (2024)
- [A Human-in-the-Middle Attack against Object Detection Systems](https://mlsanity.com/paper/2208.07174/) (2022)
- [Chaotic Variational Auto encoder-based Adversarial Machine Learning](https://mlsanity.com/paper/2302.12959/) (2023)
- [FedMHO: Heterogeneous One-Shot Federated Learning Towards Resource-Constrained Edge Devices](https://mlsanity.com/paper/2502.08518/) (2025)
- [Learning from Attacks: Attacking Variational Autoencoder for Improving Image Classification](https://mlsanity.com/paper/2203.07027/) (2022)
- [Federated Learning: Organizational Opportunities, Challenges, and Adoption Strategies](https://mlsanity.com/paper/2308.02219/) (2023)
- [Constructing Adversarial Examples for Vertical Federated Learning: Optimal Client Corruption through Multi-Armed Bandit](https://mlsanity.com/paper/2408.04310/) (2024)
- [Robust Vision Systems for Connected and Autonomous Vehicles: Security Challenges and Attack Vectors](https://mlsanity.com/paper/2602.09740/) (2026)
- [Provable Sparse Inversion and Token Relabel Enhanced One-shot Federated Learning with ViTs](https://mlsanity.com/paper/2605.10748/) (2026)
- [Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunities](https://mlsanity.com/paper/2609.28722/) (2026)

## Abstract (arXiv)

Deep Neural Networks (DNNs) are vulnerable to deliberately crafted adversarial examples. In the past few years, many efforts have been spent on exploring query-optimisation attacks to find adversarial examples of either black-box or white-box DNN models, as well as the defending countermeasures against those attacks. In this work, we explore vulnerabilities of DNN models under the umbrella of Man-in-the-Middle (MitM) attacks, which has not been investigated before. From the perspective of an MitM adversary, the aforementioned adversarial example attacks are not viable anymore. First, such attacks must acquire the outputs from the models by multiple times before actually launching attacks, which is difficult for the MitM adversary in practice. Second, such attacks are one-off and cannot be directly generalised onto new data examples, which decreases the rate of return for the attacker. In contrast, using generative models to craft adversarial examples on the fly can mitigate the drawbacks. However, the adversarial capability of the generative models, such as Variational Auto-Encoder (VAE), has not been extensively studied. Therefore, given a classifier, we investigate using a VAE decoder to either transform benign inputs to their adversarial counterparts or decode outputs from benign VAE encoders to be adversarial examples. The proposed method can endue more capability to MitM attackers. Based on our evaluation, the proposed attack can achieve above 95% success rate on both MNIST and CIFAR10 datasets, which is better or comparable with state-of-the-art query-optimisation attacks. At the meantime, the attack is 104 times faster than the query-optimisation attacks.