Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples

Abstract

The paper demonstrates the transferability of adversarial samples across machine learning models, even if they have different architectures or training sets, and introduces a black-box attack that uses the targeted model as an oracle to label a synthetic training set for a substitute model, which can then be used to craft adversarial samples that are misclassified by the original model.