Evasion attacks are a threat to machine learning models, where adversaries attempt to affect classifiers by injecting malicious samples. An alarming side-effect of evasion attacks is their ability to transfer among different models: this property is called transferability. Therefore, an attacker can produce adversarial samples on a custom model (surrogate) to conduct the attack on a victim’s organization later. Although literature widely discusses how adversaries can transfer their attacks, their experimental settings are limited and far from reality. For instance, many experiments consider both attacker and defender sharing the same dataset, balance level (i.e., how the ground truth is distributed), and model architecture. In this work, we propose the DUMB attacker model. This framework allows analyzing if evasion attacks fail to transfer when the training conditions of surrogate and victim models differ. DUMB considers the following conditions: Dataset soUrces, Model architecture, and the Balance of the ground truth. We then propose a novel testbed to evaluate many state-of-the-art evasion attacks with DUMB; the testbed consists of three computer vision tasks with two distinct datasets each, four types of balance levels, and three model architectures. Our analysis, which generated 13K tests over 14 distinct attacks, led to numerous novel findings in the scope of transferable attacks with surrogate models. In particular, mismatches between attackers and victims in terms of dataset source, balance levels, and model architecture lead to non-negligible loss of attack performance.

Ground borne vibrations generated by the passage of underground trains may change over time due to objective causes, such as increasing weight and speed of trains or ageing of the infrastructure components, as well as a variation in the dynamic response of the soil surrounding the tunnel. Among the possible causes of changes in the soil dynamic response, its hydrologic state has been seldom investigated. In this contribution, the role played by the conditions of the soil above the water table is addressed, starting from a case history in the city of Milano. Two-dimensional plane strain numerical models have been developed for the infrastructure. The models were calibrated on the results of two geophysical investigations performed at the same site in the city centre, but at two different times, which allowed distinguishing different dynamic responses. The system was excited by a synthetic load time history, matching a reference dynamic load spectrum included in Italian recommendations. Limitations of using this input on a 2D plane strain model were assessed by comparing the computed vibrations with experimental acceleration records collected on the tunnel. The results of the two numerical models are compared with those of a simulation performed assuming fully dry conditions above the water table. Overall, the set of analyses shows that even small changes in the dynamic response of the soil, interpretated as a consequence of variable saturation, may result in a change of a few decibels in the acceleration levels. Much larger accelerations are predicted on average with the simpler dry model, clearly showing the advantages of a more accurate modelling strategy.