Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differently
TL;DR
- Transferred attacks can cause different mistakes: Distinguishes whether source and target models predict the same wrong class.
- Similar models can still disagree under attack: Different mistakes occur even between similar models and across perturbation sizes.
- Non-robust features explain class-aware transfer: Models can use the same adversarial features differently, producing different wrong labels.
Type
Publication
Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2023.
Presentation Video
Presentation Poster
