mlsanityData to 7 Oct 2026

Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?

arXiv 2103.09916 ↗First posted 17 Mar 2021cs.LGcited by 3

Not on the map. Why?

Abstract (arXiv)

We design blackbox transfer-based targeted adversarial attacks for an environment where the attacker's source model and the target blackbox model may have disjoint label spaces and training datasets. This scenario significantly differs from the "standard" blackbox setting, and warrants a unique approach to the attacking process. Our methodology begins with the construction of a class correspondence matrix between the whitebox and blackbox label sets. During the online phase of the attack, we then leverage representations of highly related proxy classes from the whitebox distribution to fool the blackbox model into predicting the desired target class. Our attacks are evaluated in three complex and challenging test environments where the source and target models have varying degrees of conceptual overlap amongst their unique categories. Ultimately, we find that it is indeed possible to construct targeted transfer-based adversarial attacks between models that have non-overlapping label spaces! We also analyze the sensitivity of attack success to properties of the clean data. Finally, we show that our transfer attacks serve as powerful adversarial priors when integrated with query-based methods, markedly boosting query efficiency and adversarial success.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 34 of its 41 references that are in the map. First posted on arXiv 17 Mar 2021.

Builds on

34 of 41 references.

References · 34

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  9. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  10. 2019Learning Robust Global Representations by Penalizing Local Predictive Powercited by 1,010
  11. 2016Adversarial Machine Learning at Scalecited by 934
  12. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 774
22 more
  1. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  2. 2015Towards Open Set Deep Networkscited by 533
  3. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  4. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  5. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  6. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  7. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  8. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  9. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  10. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  11. 2018Adversarial Attacks and Defences Competitioncited by 96
  12. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  13. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  14. 2017Measuring the tendency of CNNs to Learn Surface Statistical Regularitiescited by 87
  15. 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
  16. 2020Transferable Perturbations of Deep Feature Distributionscited by 51
  17. 2019Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reductioncited by 47
  18. 2020Yet Another Intermediate-Level Attackcited by 35
  19. 2020Adversarial Example Gamescited by 34
  20. 2020Practical No-box Adversarial Attacks against DNNscited by 32
  21. 2021Removing Undesirable Feature Contributions Using Out-of-Distribution Datacited by 23
  22. 2016LOTS about Attacking Deep Featurescited by 14

Built on by

Cited by year

Citing papers per year: 2021: 1; 2022: 0; 2023: 2.

3 papers.

  1. 2023Adversarial Attacks on Foundational Vision Modelscited by 13
  2. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  3. 2021Adversarial Attack across Datasetscited by 2