mlsanityData to 14 Oct 2026

Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systems

arXiv 2311.11796 ↗First posted 20 Nov 2023cs.CR cs.AI cs.CLcited by 6

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

As Artificial Intelligence (AI) systems increasingly underpin critical applications, from autonomous vehicles to biometric authentication, their vulnerability to transferable attacks presents a growing concern. These attacks, designed to generalize across instances, domains, models, tasks, modalities, or even hardware platforms, pose severe risks to security, privacy, and system integrity. This survey delivers the first comprehensive review of transferable attacks across seven major categories, including evasion, backdoor, data poisoning, model stealing, model inversion, membership inference, and side-channel attacks. We introduce a unified six-dimensional taxonomy: cross-instance, cross-domain, cross-modality, cross-model, cross-task, and cross-hardware, which systematically captures the diverse transfer pathways of adversarial strategies. Through this framework, we examine both the underlying mechanics and practical implications of transferable attacks on AI systems. Furthermore, we review cutting-edge methods for enhancing attack transferability, organized around data augmentation and optimization strategies. By consolidating fragmented research and identifying critical future directions, this work provides a foundational roadmap for understanding, evaluating, and defending against transferable threats in real-world AI systems.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 174 of its 311 references that are in the map. First posted on arXiv 20 Nov 2023.

Builds on

174 of 311 references.

Closest ancestors · 11

Same direction, newest first

  1. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review12 Sep
  2. 2023A Comprehensive Overview of Backdoor Attacks in Large Language Models within Communication Networks28 Aug
  3. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Models28 May
  4. 2023Backdoor Learning for NLP: Recent Advances, Challenges, and Future Research Directions14 Feb
  5. 2022A Survey on Backdoor Attack and Defense in Natural Language Processing22 Nov
  6. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning13 May
  7. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning4 May
  8. 2022Poisoning Attacks and Defenses on Artificial Intelligence: A Survey21 Feb
  9. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  10. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models6 Oct
  11. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning1 Aug

Other references · 163

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2013Intriguing properties of neural networkscited by 5,155
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2016Pointer Sentinel Mixture Modelscited by 3,096
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  7. 2017Arbitrary Style Transfer in Real-time with Adaptive Instance Normalizationcited by 2,010
  8. 2016Adversarial examples in the physical worldcited by 1,769
  9. 2018Deep Clustering for Unsupervised Learning of Visual Featurescited by 1,028
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  11. 2021Membership Inference Attacks From First Principlescited by 878
  12. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
38 more
  1. 2016Universal adversarial perturbationscited by 784
  2. 2023A Watermark for Large Language Modelscited by 725
  3. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  4. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  5. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  6. 2018Exploring the Limits of Weakly Supervised Pretrainingcited by 605
  7. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  8. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  9. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  10. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  11. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  12. 2020Backdoor Learning: A Surveycited by 426
  13. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 397
  14. 2020Label-Only Membership Inference Attackscited by 388
  15. 2023A Comprehensive Survey on Pretrained Foundation Models: A History from BERT to ChatGPTcited by 368
  16. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  17. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  18. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
  19. 2023Are aligned neural networks adversarially aligned?cited by 315
  20. 2018Adversarial Attack on Graph Structured Datacited by 301
  21. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  22. 2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 286
  23. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  24. 2020Transfer Learning in Deep Reinforcement Learning: A Surveycited by 265
  25. 2018Adversarial Attacks and Defences: A Surveycited by 259
  26. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 246
  27. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  28. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
  29. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  30. 2020Reformulating Unsupervised Style Transfer as Paraphrase Generationcited by 183
  31. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 180
  32. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 167
  33. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  34. 2018Physical Adversarial Examples for Object Detectorscited by 163
  35. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  36. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  37. 2017Generative Adversarial Perturbationscited by 153
  38. 2021Investigating Bi-Level Optimization for Learning and Vision from a Unified Perspective: A Survey and Beyondcited by 153

50 most cited of 163 All 163 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 2; 2026: 3.

6 papers.

  1. 2024A Survey on Adversarial Robustness of LiDAR-based Machine Learning Perception in Autonomous Vehiclescited by 3
  2. 2026Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Countingcited by 1
  3. 2025Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learningcited by 0
  4. 2025Can You Trust What You See? Alpha Channel No-Box Attacks on Video Object Detectioncited by 0
  5. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  6. 2026Improving Adversarial Transferability on Vision-Language Pre-training Models via Surrogate-Specific Bias Correctioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization
  2. 2026AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion
  3. 2025Offensive Security for AI Systems: Concepts, Practices, and Applications
  4. 2025Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning
  5. 2025Jailbreak Transferability Emerges from Shared Representations
  6. 2026AVISE: Framework for Evaluating the Security of AI Systems
  7. 2026Understanding Adversarial Transferability in Vision-Language Models for Autonomous Driving: A Cross-Architecture Analysis
  8. 2026Phantom Transfer: Data Poisoning can Survive Data-Level Defences