mlsanityData to 7 Oct 2026

Transfer Attacks Revisited: A Large-Scale Empirical Study in Real Computer Vision Settings

arXiv 2204.04063 ↗First posted 7 Apr 2022cs.CV cs.AI cs.CRcited by 11

Not on the map. Why?

Abstract (arXiv)

One intriguing property of adversarial attacks is their "transferability" -- an adversarial example crafted with respect to one deep neural network (DNN) model is often found effective against other DNNs as well. Intensive research has been conducted on this phenomenon under simplistic controlled conditions. Yet, thus far, there is still a lack of comprehensive understanding about transferability-based attacks ("transfer attacks") in real-world environments. To bridge this critical gap, we conduct the first large-scale systematic empirical study of transfer attacks against major cloud-based MLaaS platforms, taking the components of a real transfer attack into account. The study leads to a number of interesting findings which are inconsistent to the existing ones, including: (1) Simple surrogates do not necessarily improve real transfer attacks. (2) No dominant surrogate architecture is found in real transfer attacks. (3) It is the gap between posterior (output of the softmax layer) rather than the gap between logit (so-called kappa value) that increases transferability. Moreover, by comparing with prior works, we demonstrate that transfer attacks possess many previously unknown properties in real-world environments, such as (1) Model similarity is not a well-defined concept. (2) L2 norm of perturbation can generate high transferability without usage of gradient and is a more powerful source than L_∞ norm. We believe this work sheds light on the vulnerabilities of popular MLaaS platforms and points to a few promising research directions.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Builds on 30 of its 50 references that are in the map. First posted on arXiv 7 Apr 2022.

Builds on

30 of 50 references.

References · 30

  1. 2017Attention Is All You Needcited by 59,932
  2. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  3. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2014Going Deeper with Convolutionscited by 4,231
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,801
  12. 2016Adversarial examples in the physical worldcited by 1,762
18 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  2. 2016Adversarial Machine Learning at Scalecited by 934
  3. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  4. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  5. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  6. 2016Universal adversarial perturbationscited by 774
  7. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  8. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  9. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  10. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  11. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  12. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  13. 2020Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNetcited by 45
  14. 2018Understanding and Enhancing the Transferability of Adversarial Examplescited by 41
  15. 2022Seeing is Living? Rethinking the Security of Facial Liveness Verification in the Deepfake Eracited by 26
  16. 2020AdvMind: Inferring Adversary Intent of Black-Box Attackscited by 12
  17. 2019Adversarial Examples Versus Cloud-based Detectors: A Black-box Empirical Studycited by 8
  18. 2021On the Security Risks of AutoMLcited by 7

Built on by

Cited by year

Citing papers per year: 2022: 1; 2023: 7; 2024: 2; 2025: 1.

11 papers.

  1. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  2. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  3. 2024GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Searchcited by 20
  4. 2023Efficient Query-Based Attack against ML-Based Android Malware Detection under Zero Knowledge Settingcited by 10
  5. 2023QFA2SR: Query-Free Adversarial Transfer Attacks to Speaker Recognition Systemscited by 9
  6. 2022"Is your explanation stable?": A Robustness Evaluation Framework for Feature Attributioncited by 7
  7. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  8. 2023Your Attack Is Too DUMB: Formalizing Attacker Scenarios for Adversarial Transferabilitycited by 5
  9. 2025On the Security Risks of ML-based Malware Detection Systems: A Surveycited by 1
  10. 2023The Ultimate Combo: Boosting Adversarial Example Transferability by Composing Data Augmentationscited by 0
  11. 2024On the Robustness of Distributed Machine Learning against Transfer Attackscited by 0