Notes on the transferability of adversarial examples

Adversarial examples represent perturbed data instances that can be used to evaluate the robustness of classifiers by exposing vulnerabilities. Although they are usually crafted for specific applications, there is a lot of emphasis on their transferability to different models. This paper evaluates the transferability of adversarial examples generated using two distinct procedures, a white-box and a black-box model, and discusses their attack efficiency. The results show that while the white-box method transfers slightly better across models, the black-box attack produces comparable results in transfer scenarios and proves more effective on the source model. A new indicator based on the steepest drop in accuracy is also proposed, helping identify regions where attacks have the most impact.