Quantifying the Risk of Transferred Black Box Attacks
Not on the map. Why?
Abstract (arXiv)
Neural networks have become pervasive across various applications, including security-related products. However, their widespread adoption has heightened concerns regarding vulnerability to adversarial attacks. With emerging regulations and standards emphasizing security, organizations must reliably quantify risks associated with these attacks, particularly regarding transferred adversarial attacks, which remain challenging to evaluate accurately. This paper investigates the complexities involved in resilience testing against transferred adversarial attacks. Our analysis specifically addresses black-box evasion attacks, highlighting transfer-based attacks due to their practical significance and typically high transferability between neural network models. We underline the computational infeasibility of exhaustively exploring high-dimensional input spaces to achieve complete test coverage. As a result, comprehensive adversarial risk mapping is deemed impractical. To mitigate this limitation, we propose a targeted resilience testing framework that employs surrogate models strategically selected based on Centered Kernel Alignment (CKA) similarity. By leveraging surrogate models exhibiting both high and low CKA similarities relative to the target model, the proposed approach seeks to optimize coverage of adversarial subspaces. Risk estimation is conducted using regression-based estimators, providing organizations with realistic and actionable risk quantification.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 22 of its 33 references that are in the map. First posted on arXiv 7 Nov 2025.
Builds on
22 of 33 references.
References · 22
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2019Similarity of Neural Network Representations Revisitedcited by 1,695
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2016Universal adversarial perturbationscited by 774
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
- 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
- 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
- 2017The Space of Transferable Adversarial Examplescited by 156
10 more
- 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
- 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
- 2017Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compressioncited by 86
- 2019The Odds are Odd: A Statistical Test for Detecting Adversarial Examplescited by 75
- 2021Adversarial Attacks and Defenses for Speech Recognition Systemscited by 20
- 2021ADC: Adversarial attacks against object Detection that evade Context consistency checkscited by 12
- 2019Measuring the Transferability of Adversarial Examplescited by 6
- 2024Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolumecited by 3
- 2025The Relationship Between Network Similarity and Transferability of Adversarial Attackscited by 2
- 2020Defending SVMs against Poisoning Attacks: the Hardness and DBSCAN Approachcited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.