mlsanityData to 7 Oct 2026

Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!

arXiv 2103.10013 ↗First posted 18 Mar 2021cs.CLcited by 51

Not on the map. Why?

Abstract (arXiv)

Natural language processing (NLP) tasks, ranging from text classification to text generation, have been revolutionised by the pre-trained language models, such as BERT. This allows corporations to easily build powerful APIs by encapsulating fine-tuned BERT models for downstream tasks. However, when a fine-tuned BERT model is deployed as a service, it may suffer from different attacks launched by malicious users. In this work, we first present how an adversary can steal a BERT-based API service (the victim/target model) on multiple benchmark datasets with limited prior knowledge and queries. We further show that the extracted model can lead to highly transferable adversarial attacks against the victim model. Our studies indicate that the potential vulnerabilities of BERT-based API services still hold, even when there is an architectural mismatch between the victim model and the attack model. Finally, we investigate two defence strategies to protect the victim model and find that unless the performance of the victim model is sacrificed, both model ex-traction and adversarial transferability can effectively compromise the target models

Key facts. Cited by 51 papers in the map (data through 7 Oct 2026). Builds on 23 of its 33 references that are in the map. First posted on arXiv 18 Mar 2021.

Builds on

23 of 33 references.

References · 23

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  3. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,801
  4. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  6. 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,201
  7. 2015Teaching Machines to Read and Comprehendcited by 1,039
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  9. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  10. 2018Born Again Neural Networkscited by 539
  11. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  12. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 376
11 more
  1. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
  2. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  3. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  4. 2018Exploring Connections Between Active Learning and Model Extractioncited by 84
  5. 2020Imitation Attacks and Defenses for Black-box Machine Translation Systemscited by 78
  6. 2020Adv-BERT: BERT is not robust on misspellings! Generating nature adversarial samples on BERTcited by 69
  7. 2020Differentially Private Representation for NLP: Formal Guarantee and An Empirical Study on Privacy and Fairnesscited by 66
  8. 2018Privacy-preserving Neural Representations of Textcited by 54
  9. 2020Towards Differentially Private Text Representationscited by 28
  10. 2020Natural Backdoor Attack on Text Datacited by 18
  11. 2019Generative Adversarial Networks for Black-Box API Attacks with Limited Training Datacited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 10; 2023: 13; 2024: 16; 2025: 4; 2026: 3.

51 papers.

Sort:

By area:

  1. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90
  2. 2023Protecting Language Generation Models via Invisible Watermarkingcited by 81
  3. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermarkcited by 78
  4. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  5. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
  6. 2024PAL: Proxy-Guided Black-Box Attack on Large Language Modelscited by 46
  7. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  8. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  9. 2022Distillation-Resistant Watermarking for Model Protection in NLPcited by 29
  10. 2023The Trickle-down Impact of Reward (In-)consistency on RLHFcited by 29
  11. 2023Training-free Lexical Backdoor Attacks on Language Modelscited by 27
  12. 2024Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queriescited by 25
38 more
  1. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attackscited by 24
  2. 2022A Survey of Adversarial Defences and Robustness in NLPcited by 22
  3. 2023Stealing the Decoding Algorithms of Language Modelscited by 19
  4. 2025A Survey on Model Extraction Attacks and Defenses for Large Language Modelscited by 18
  5. 2021Student Surpasses Teacher: Imitation Attack for Black-Box NLP APIscited by 16
  6. 2022On Robust Prefix-Tuning for Text Classificationcited by 15
  7. 2022A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Predictionscited by 15
  8. 2022Fooling MOSS Detection with Pretrained Language Modelscited by 12
  9. 2021Membership Inference Attacks on Knowledge Graphscited by 11
  10. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 9
  11. 2024Model Stealing for Any Low-Rank Language Modelcited by 9
  12. 2023TextShield: Beyond Successfully Detecting Adversarial Sentences in Text Classificationcited by 8
  13. 2024Revealing Vulnerabilities in Stable Diffusion via Targeted Attackscited by 8
  14. 2024Risks, Causes, and Mitigations of Widespread Deployments of Large Language Models (LLMs): A Surveycited by 8
  15. 2024A Middle Path for On-Premises LLM Deployment: Preserving Privacy Without Sacrificing Model Confidentialitycited by 8
  16. 2021Killing One Bird with Two Stones: Model Extraction and Attribute Inference Attacks against BERT-based APIscited by 7
  17. 2023MAWSEO: Adversarial Wiki Search Poisoning for Illicit Online Promotioncited by 7
  18. 2024Image-to-Text Logic Jailbreak: Your Imagination can Help You Do Anythingcited by 7
  19. 2023Army of Thieves: Enhancing Black-Box Model Extraction via Ensemble based sample selectioncited by 6
  20. 2021Virtual Data Augmentation: A Robust and General Framework for Fine-tuning Pre-trained Modelscited by 5
  21. 2023Revealing the Blind Spot of Sentence Encoder Evaluation by HEROScited by 5
  22. 2023Punctuation Matters! Stealthy Backdoor Attack for Language Modelscited by 5
  23. 2024WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarkscited by 5
  24. 2022Preserving Semantics in Textual Adversarial Attackscited by 4
  25. 2026CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attackscited by 4
  26. 2022A Girl Has A Name, And It's ... Adversarial Authorship Attribution for Deobfuscationcited by 3
  27. 2022Edge Security: Challenges and Issuescited by 3
  28. 2024Privacy Evaluation Benchmarks for NLP Modelscited by 3
  29. 2024The Impact of Quantization on the Robustness of Transformer-based Text Classifierscited by 2
  30. 2025Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removalcited by 2
  31. 2024VidModEx: Interpretable and Efficient Black Box Model Extraction for High-Dimensional Spacescited by 1
  32. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  33. 2022Model Extraction Attack against Self-supervised Speech Modelscited by 0
  34. 2023SenTest: Evaluating Robustness of Sentence Encoderscited by 0
  35. 2024Amplifying Training Data Exposure through Fine-Tuning with Pseudo-Labeled Membershipscited by 0
  36. 2024IDT: Dual-Task Adversarial Attacks for Privacy Protectioncited by 0
  37. 2025Coordinated Robustness Evaluation Framework for Vision-Language Modelscited by 0
  38. 2025Innocence in the Crossfire: Roles of Skip Connections in Jailbreaking Visual Language Modelscited by 0

50 most cited of 51 All 51 (JSON)