Research map / Adversarial robustness and security / Black-box and transfer attacks

Jailbreaking the Non-Transferable Barrier via Test-Time Data Disguising

CVPR 2025 · Adversarial robustness and security › Black-box and transfer attacks · approach: Data-free substitute training · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes JailNTL, a black-box attack that jailbreaks non-transferable learning (NTL) barriers by training a bidirectional adversarial disguising network that maps unauthorized test images to authorized-looking images, using only NTL output logits and 1% authorized samples.

Problem

Non-transferable learning models protect IP by blocking generalization from authorized to unauthorized domains, but existing attacks that restore unauthorized performance require fine-tuning model weights and are invalid when the NTL model is a black-box API.

Approach

Instead of modifying the NTL model, disguise unauthorized test data at test time with a learned disguising network (adversarial domain alignment plus feedback content-consistency and bidirectional mapping), guided by zeroth-order estimates of the black-box model's confidence-entropy and class-balance statistics.

Key results

• JailNTL raises unauthorized-domain accuracy on CIFAR10→STL10 by up to +55.7% (CUTI-domain) using 1% authorized samples in the black-box setting.
• JailNTL outperforms the white-box TransNTL attack by a large margin, up to 34.2% in unauthorized accuracy, while authorized accuracy drops by at most 1.1% (CUTI) and 0.8% (NTL) on the reported tasks.
• Combining JailNTL with TransNTL yields up to 6.5% extra unauthorized accuracy over TransNTL alone.

Measured effects reported in the paper

Surprising findings

• Black-box JailNTL outperforms existing white-box fine-tuning attacks, which is counter to the intuition that weight access is necessary for effective attacks.

Limitations

• Evaluated only on image classification benchmarks with small-scale domain shifts (CIFAR-10, STL-10, VisDA) and a few NTL variants.
• Assumes access to a small set of authorized samples and unlabeled unauthorized test data; treats all test data as unauthorized.
• Disguising is harder for higher-resolution targets (CIFAR10→STL10 less effective than reverse direction on some settings), and VisDA gains are smaller.

Experimental setup

Datasets: CIFAR-10 STL-10 VisDA-2017

Benchmarks: CIFAR-10 to STL-10 STL-10 to CIFAR-10 VisDA-T to VisDA-V

Metrics: Top-1 accuracy (authorized and unauthorized domains)

Baselines: RTAL FTAL TransNTL

Builds on: non-transferable learning TransNTL CycleGAN-style feedback/bidirectional adversarial training zeroth-order gradient estimation

Closest papers by meaning

• Your Transferability Barrier is Fragile: Free-Lunch for Transferring the Non-Transferable Learning (CVPR 2024 · similarity 0.91)
• When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need (ICML 2025 · similarity 0.83)
• Understanding and Enhancing the Transferability of Jailbreaking Attacks (ICLR 2025 · similarity 0.83)
• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.83)
• Protecting Model Adaptation from Trojans in the Unlabeled Data (AAAI 2025 · similarity 0.82)
• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks (ICML 2025 · similarity 0.82)