mlsanityData to 7 Oct 2026

Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differently

arXiv 2112.14337 ↗First posted 29 Dec 2021cs.LG cs.CVcited by 22

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are vulnerable to adversarial examples (AEs), which have adversarial transferability: AEs generated for the source model can mislead another (target) model's predictions. However, the transferability has not been understood in terms of to which class target model's predictions were misled (i.e., class-aware transferability). In this paper, we differentiate the cases in which a target model predicts the same wrong class as the source model ("same mistake") or a different wrong class ("different mistake") to analyze and provide an explanation of the mechanism. We find that (1) AEs tend to cause same mistakes, which correlates with "non-targeted transferability"; however, (2) different mistakes occur even between similar models, regardless of the perturbation size. Furthermore, we present evidence that the difference between same mistakes and different mistakes can be explained by non-robust features, predictive but human-uninterpretable patterns: different mistakes occur when non-robust features in AEs are used differently by models. Non-robust features can thus provide consistent explanations for the class-aware transferability of AEs.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Builds on 24 of its 34 references that are in the map. First posted on arXiv 29 Dec 2021.

Builds on

24 of 34 references.

References · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  10. 2016Adversarial examples in the physical worldcited by 1,762
  11. 2013Fine-Grained Visual Classification of Aircraftcited by 1,701
  12. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
12 more
  1. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  2. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  3. 2018Robustness May Be at Odds with Accuracycited by 873
  4. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  5. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  6. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  7. 2017The Space of Transferable Adversarial Examplescited by 156
  8. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  9. 2017Measuring the tendency of CNNs to Learn Surface Statistical Regularitiescited by 87
  10. 2021On Generating Transferable Targeted Perturbationscited by 65
  11. 2021Analysis and Applications of Class-wise Robustness in Adversarial Trainingcited by 33
  12. 2018A Geometric Perspective on the Transferability of Adversarial Directionscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 10; 2024: 2; 2025: 6; 2026: 3.

22 papers.

Sort:

By area:

  1. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  2. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  3. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
  4. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
  5. 2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
  6. 2023Improving Adversarial Transferability via Model Alignmentcited by 10
  7. 2022Similarity of Neural Architectures using Adversarial Attack Transferabilitycited by 4
  8. 2025On the Robustness of Tabular Foundation Models: Test-Time Attacks and In-Context Defensescited by 3
  9. 2023Evasion Adversarial Attacks Remain Impractical Against ML-based Network Intrusion Detection Systems, Especially Dynamic Onescited by 2
  10. 2024Clean Label Attacks against SLU Systemscited by 2
  11. 2025Merge Now, Regret Later: The Hidden Cost of Model Merging Is Adversarial Transferabilitycited by 2
  12. 2023Adversarial-Aware Deep Learning System based on a Secondary Classical Machine Learning Verification Approachcited by 1
10 more
  1. 2023Common Knowledge Learning for Generating Transferable Adversarial Examplescited by 1
  2. 2023Towards Understanding Adversarial Transferability in Federated Learningcited by 1
  3. 2023On the Computational Entanglement of Distant Features in Adversarial Machine Learningcited by 0
  4. 2025A Framework for Adversarial Analysis of Decision Support Systems Prior to Deploymentcited by 0
  5. 2025Exploring Cross-Stage Adversarial Transferability in Class-Incremental Continual Learningcited by 0
  6. 2025IGAff: Benchmarking Adversarial Iterative and Genetic Affine Algorithms on Deep Neural Networkscited by 0
  7. 2025Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeedcited by 0
  8. 2026Adversarial Vulnerability Transcends Computational Paradigms: Feature Engineering Provides No Defense Against Neural Adversarial Transfercited by 0
  9. 2026Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximizationcited by 0
  10. 2026Exploring Solver-Level Warmstarting for Neural Network Verificationcited by 0