Transferability of Evasion Attacks in Machine Learning Models

Natural language processing to computer vision is among the many applications of machine learning. Adversarial examples can cause models to misclassify inputs, despite the fact these models are resilient to attacks. One type of adversarial attack is an evasion attack, where the attacker modifies an input to cause a model to produce an incorrect output. The transferability of evasion attacks refers to the ability of an attack designed for one model to be effective against other models. This property is important because it implies that an attacker can launch a successful attack against a large number of models without having to design a separate attack for each individual model. This paper investigates whether evasion attacks are transferable to machine learning models. Analyzing various models and studying factors contributing to the transferability of attacks, we evaluate the performance of attacks against a variety of them. Our results show that transferability is a common property of evasion attacks and suggest that this property is due to the presence of similar features in the models being attacked. Our findings have implications for the security of machine learning models and suggest that transferability of attacks should be taken into account when designing and evaluating machine learning models for security-critical applications.