CoChat
Sign Up
PreprintCited by 1,326Adversarial Robustness in Machine LearningSecurity and Verification in ComputingSoftware Testing and Debugging Techniques

Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples

Open access
Papernot, Nicolas, McDaniel, Patrick, Goodfellow, Ian·2016·arXiv
DOI 10.48550/arxiv.1605.07277arXiv 1605.07277
Open this paper in CoChat — free accountOpen PDF

Abstract

Many machine learning models are vulnerable to adversarial examples: inputs that are specially crafted to cause a machine learning model to produce an incorrect output. Adversarial examples that affect one model often affect another model, even if the two models have different architectures or were trained on different training sets, so long as both models were trained to perform the same task. An attacker may therefore train their own substitute model, craft adversarial examples against the substitute, and transfer them to a victim model, with very little information about the victim. Recent work has further developed a technique that uses the victim model as an oracle to label a synthetic training set for the substitute, so the attacker need not even collect a training set to mount the attack. We extend these recent techniques using reservoir sampling to greatly enhance the efficiency of the training procedure for the substitute model. We introduce new transferability attacks between previously unexplored (substitute, victim) pairs of machine learning model classes, most notably SVMs and decision trees. We demonstrate our attacks on two commercial machine learning classification systems from Amazon (96.19% misclassification rate) and Google (88.94%) using only 800 queries of the victim model, thereby showing that existing machine learning approaches are in general vulnerable to systematic black-box attacks regardless of their structure.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1605.07277

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 19

  1. [1][1] M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar. Can machine learning be secure? In Proceedings of the 2006 ACM Symposium on Information, computer and communications security , pages 16-25. ACM, 2006. -
  2. [3][3] J. Bergstra, O. Breuleux, F. Bastien, P. Lamblin, and al. Theano: a cpu and gpu math expression compiler. In Proceedings of the Python for scientific computing conference (SciPy) , volume 4, page 3. Austin, TX, 2010. -
  3. [4][4] B. Biggio, I. Corona, and al. Evasion attacks against machine learning at test time. In Machine Learning and Knowledge Discovery in Databases , pages 387-402. Springer, 2013. -
  4. [5][5] B. Biggio, G. Fumera, and F. Roli. Security evaluation of pattern classifiers under attack. Knowledge and Data Engineering, IEEE Transactions on , 26(4):984-996, 2014. -
  5. [6][6] B. Biggio, B. Nelson, and P. Laskov. Support vector machines under adversarial label noise. In ACML , pages 97-112, 2011. -
  6. [7][7] B. Biggio, B. Nelson, and L. Pavel. Poisoning attacks against support vector machines. In Proceedings of the 29th International Conference on Machine Learning , 2012. -
  7. [9][9] C. Bucila, R. Caruana, and A. Niculescu-Mizil. Model compression. In Proceedings of the 12th ACM SIGKDD international conference on Knowledge discovery and data mining , pages 535-541. ACM, 2006. -
  8. [10][10] T. Chen, I. Goodfellow, and J. Shlens. Net2net: Accelerating learning via knowledge transfer. In Proceedings of the 2016 International Conference on Learning Representations . Computational and Biological Learning Society, 2016. -
  9. [11][11] I. Goodfellow, Y. Bengio, and A. Courville. Deep learning. Book in preparation for MIT Press, 2016. -
  10. [12][12] I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In Proceedings of the 2015 International Conference on Learning Representations . Computational and Biological Learning Society, 2015. -
  11. [13][13] G. Hinton, O. Vinyals, and J. Dean. Distilling the knowledge in a neural network. In Deep Learning and Representation Learning Workshop at NIPS 2014 . arXiv preprint arXiv:1503.02531, 2014. - · arXiv
  12. [14][14] L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. Tygar. Adversarial machine learning. In Proceedings of the 4th ACM workshop on Security and artificial intelligence , pages 43-58. ACM, 2011. -
  13. [15][15] M. Kloft and P. Laskov. Online anomaly detection under adversarial impact. In International Conference on Artificial Intelligence and Statistics , pages 405-412, 2010. -
  14. [17][17] P. McDaniel, N. Papernot, and Z. B. Celik. Machine Learning in Adversarial Settings. IEEE Security & Privacy Magazine , 14(3), May/June 2016. -
  15. [18][18] K. P. Murphy. Machine learning: a probabilistic perspective . MIT press, 2012. -
  16. [20][20] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, and al. Practical black-box attacks against deep learning systems using adversarial examples. arXiv preprint arXiv:1602.02697 , 2016. - · arXiv
  17. [21][21] N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In Proceedings of the 37th IEEE Symposium on Security and Privacy . IEEE, 2016. -
  18. [22][22] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, , et al. Intriguing properties of neural networks. In Proceedings of the 2014 International Conference on Learning Representations . Computational and Biological Learning Society, 2014. -
  19. [23][23] J. S. Vitter. Random sampling with a reservoir. ACM Transactions on Mathematical Software (TOMS) , 11(1):37-57, 1985. -

Cited by

Sorted by citations

Authors
Papernot, N., McDaniel, P., & Goodfellow, I.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2016
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.1605.07277
arXiv
1605.07277
OpenAlex
W2408141691
Cited by
1,326
References
1
Citations by year
2026: 1 · 2025: 50 · 2024: 105 · 2023: 141 · 2022: 126 · 2021: 249 · 2020: 269 · 2019: 200 · 2018: 128 · 2017: 51 · 2016: 6
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
Keywords
adversarial examples, black-box attacks, substitute model, reservoir sampling, synthetic training data, support vector machine, decision tree, query-based attacks, model robustness

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review