On the Transferability of Adversarial Examples between Encrypted Models

TL;DR

This paper investigates whether encrypting models for adversarial robustness affects the transferability of adversarial examples, finding that encryption not only enhances robustness but also reduces transferability.

Contribution

It is the first study to analyze the transferability of adversarial examples between encrypted models, revealing encryption's impact on transferability and robustness.

Findings

Encrypted models are more robust against adversarial examples.

Encryption reduces the transferability of adversarial examples.

AutoAttack confirms robustness and transferability reduction.

Abstract

Deep neural networks (DNNs) are well known to be vulnerable to adversarial examples (AEs). In addition, AEs have adversarial transferability, namely, AEs generated for a source model fool other (target) models. In this paper, we investigate the transferability of models encrypted for adversarially robust defense for the first time. To objectively verify the property of transferability, the robustness of models is evaluated by using a benchmark attack method, called AutoAttack. In an image-classification experiment, the use of encrypted models is confirmed not only to be robust against AEs but to also reduce the influence of AEs in terms of the transferability of models.