Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks

Abstract

Transferability captures the ability of an attack against a machine-learning model to be effective against a different, potentially unknown, model. Empirical evidence for transferability has been shown in previous work, but the underlying reasons why an attack transfers or not are not yet well understood. In this paper, we present a comprehensive analysis aimed to investigate the transferability of both test-time evasion and training-time poisoning attacks. We provide a unifying optimization framework for evasion and poisoning attacks, and a formal definition of transferability of such attacks. We highlight two main factors contributing to attack transferability: the intrinsic adversarial vulnerability of the target model, and the complexity of the surrogate model used to optimize the attack. Based on these insights, we define three metrics that impact an attack's transferability. Interestingly, our results derived from theoretical analysis hold for both evasion and poisoning attacks, and are confirmed experimentally using a wide range of linear and non-linear classifiers and datasets.

References in corpus (14)

• Scikit-learn: Machine Learning in Python
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Understanding Black-box Predictions via Influence Functions
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Poisoning Attacks against Support Vector Machines
• The Space of Transferable Adversarial Examples
• Is feature selection secure against training data poisoning?
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Adversarial Feature Selection against Evasion Attacks
• Robust Large Margin Deep Neural Networks
• Evasion and Hardening of Tree Ensemble Classifiers

Cited by in corpus (11)

• Training Data Influence Analysis and Estimation: A Survey
• POTs: Protective Optimization Technologies
• WAF-A-MoLE: Evading Web Application Firewalls through Adversarial Machine Learning
• Physical Adversarial Attacks for Surveillance: A Survey
• Enhancing Robustness of Deep Neural Networks Against Adversarial Malware Samples: Principles, Framework, and AICS'2019 Challenge
• ModSec-AdvLearn: Countering Adversarial SQL Injections with Robust Machine Learning
• Defense against adversarial attacks on deep convolutional neural networks through nonlocal denoising
• Robustness Tokens: Towards Adversarial Robustness of Transformers
• Adversarial Transfer Attacks With Unknown Data and Class Overlap
• BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability
• Robust Vision-Based Cheat Detection in Competitive Gaming