# Avengers Ensemble! Improving Transferability of Authorship Obfuscation

arXiv: https://arxiv.org/abs/2109.07028 · HTML: https://mlsanity.com/paper/2109.07028/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 54 references that are in the map.
- First posted on arXiv 15 Sep 2021.

## Builds on (most cited first, 17 of 17)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Practical Black-Box Attacks against Machine Learning](https://mlsanity.com/paper/1602.02697/) (2016)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment](https://mlsanity.com/paper/1907.11932/) (2019)
- [Delving into Transferable Adversarial Examples and Black-box Attacks](https://mlsanity.com/paper/1611.02770/) (2016)
- [Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples](https://mlsanity.com/paper/1605.07277/) (2016)
- [TextBugger: Generating Adversarial Text Against Real-world Applications](https://mlsanity.com/paper/1812.05271/) (2018)
- [Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers](https://mlsanity.com/paper/1801.04354/) (2018)
- [BAE: BERT-based Adversarial Examples for Text Classification](https://mlsanity.com/paper/2004.01970/) (2020)
- [Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks](https://mlsanity.com/paper/1803.06975/) (2018)
- [A4NT: Author Attribute Anonymity by Adversarial Training of Neural Machine Translation](https://mlsanity.com/paper/1711.01921/) (2017)
- [Character-level and Multi-channel Convolutional Neural Networks for Large-scale Authorship Attribution](https://mlsanity.com/paper/1609.06686/) (2016)
- [The Case for Being Average: A Mediocrity Approach to Style Masking and Author Obfuscation](https://mlsanity.com/paper/1707.03736/) (2017)
- [Greedy Feature Selection for Subspace Clustering](https://mlsanity.com/paper/1303.4778/) (2013)
- [A New Ensemble Adversarial Attack Powered by Long-term Gradient Memories](https://mlsanity.com/paper/1911.07682/) (2019)
- [Regularized Ensembles and Transferability in Adversarial Learning](https://mlsanity.com/paper/1812.01821/) (2018)

## Built on by (most cited first, 8 of 8)

- [Attribution and Obfuscation of Neural Text Authorship: A Data Mining Perspective](https://mlsanity.com/paper/2210.10488/) (2022)
- [StyleRemix: Interpretable Authorship Obfuscation via Distillation and Perturbation of Style Elements](https://mlsanity.com/paper/2408.15666/) (2024)
- [JAMDEC: Unsupervised Authorship Obfuscation using Constrained Decoding over Small Language Models](https://mlsanity.com/paper/2402.08761/) (2024)
- [ALISON: Fast and Effective Stylometric Authorship Obfuscation](https://mlsanity.com/paper/2402.00835/) (2024)
- [Unveiling Unicode's Unseen Underpinnings in Undermining Authorship Attribution](https://mlsanity.com/paper/2508.15840/) (2025)
- [UPTON: Preventing Authorship Leakage from Public Text Release via Data Poisoning](https://mlsanity.com/paper/2211.09717/) (2022)
- [Defending Against Authorship Identification Attacks](https://mlsanity.com/paper/2310.01568/) (2023)
- [Personalized Author Obfuscation with Large Language Models](https://mlsanity.com/paper/2505.12090/) (2025)

## Abstract (arXiv)

Stylometric approaches have been shown to be quite effective for real-world authorship attribution. To mitigate the privacy threat posed by authorship attribution, researchers have proposed automated authorship obfuscation approaches that aim to conceal the stylometric artefacts that give away the identity of an anonymous document's author. Recent work has focused on authorship obfuscation approaches that rely on black-box access to an attribution classifier to evade attribution while preserving semantics. However, to be useful under a realistic threat model, it is important that these obfuscation approaches work well even when the adversary's attribution classifier is different from the one used internally by the obfuscator. Unfortunately, existing authorship obfuscation approaches do not transfer well to unseen attribution classifiers. In this paper, we propose an ensemble-based approach for transferable authorship obfuscation. Our experiments show that if an obfuscator can evade an ensemble attribution classifier, which is based on multiple base attribution classifiers, it is more likely to transfer to different attribution classifiers. Our analysis shows that ensemble-based authorship obfuscation achieves better transferability because it combines the knowledge from each of the base attribution classifiers by essentially averaging their decision boundaries.