Adversarial Example Transferability

Transferability is highest between models sharing similar architectural paradigms. An adversarial example crafted on a ResNet-50 will transfer more effectively to a ResNet-101 than to a Vision Transformer (ViT). This occurs because similar architectures learn comparable decision boundary geometries and feature hierarchies. Key factors include:

• Depth and width of the feature extractor
• Activation functions (ReLU vs. GELU)
• Presence of skip connections or attention mechanisms
• Training paradigm (supervised vs. self-supervised)

Transferability depends on the cosine similarity between the loss gradients of the source and target models. When the gradient vectors of two independently trained models point in similar directions in the input space, a perturbation computed on one model will also increase the loss of the other. Gradient alignment is often high because distinct models trained on the same data distribution converge to similar loss landscape geometries near the data manifold.

The attack algorithm dramatically impacts transfer rates. Iterative methods like PGD often overfit to the source model's specific loss surface, reducing transferability. In contrast, momentum-based methods (MI-FGSM) and input diversity techniques (DIM) escape poor local optima, finding perturbations that align with the broader decision boundaries shared across models. Key strategies:

• Momentum integration to stabilize update directions
• Random resizing and padding during optimization
• Translation-invariant attack formulations
• Ensemble attacks over multiple source models

Models trained on identical or highly overlapping training datasets exhibit stronger adversarial transferability. This is because the learned feature representations and the induced priors are statistically correlated. Even with different architectures, training on the same data distribution creates shared blind spots in the input space. Transferability drops significantly when the target model is trained on a disjoint data domain or uses heavy data augmentation.

Crafting adversarial examples against an ensemble of diverse source models is the most reliable method for achieving black-box transferability. By optimizing a perturbation that simultaneously fools multiple architectures, the attack converges on a universal vulnerability subspace rather than a model-specific weakness. This technique is standard in evaluating the true robustness of proprietary, black-box APIs where internal gradients are inaccessible.

The transferability of an adversarial example correlates with its invariance to input transformations. Perturbations that survive common image processing operations—such as JPEG compression, resizing, or Gaussian blurring—are more likely to transfer. This property is exploited by scale-invariant attacks that optimize over a distribution of transformed inputs, forcing the perturbation to reside in a region of the input space where decision boundaries are consistently vulnerable across models.

Transferability bridges the gap between these two threat models. In a white-box attack, the adversary has full access to the target model's architecture, parameters, and gradients, enabling precise computation of worst-case perturbations using methods like Projected Gradient Descent (PGD). In a black-box attack, the adversary has no internal access and must rely on querying outputs or transferring attacks from a surrogate model. Transferability is the property that makes black-box attacks viable: an adversary trains a local surrogate, crafts adversarial examples against it, and deploys them against the unknown target model. The higher the transferability, the more dangerous the black-box threat.

Transferability is fundamentally a consequence of shared decision boundary geometry across independently trained models. Despite different architectures and random initializations, models trained on similar data distributions learn decision boundaries that occupy overlapping regions of the input space. Adversarial examples exploit directions of high curvature where these boundaries are closely aligned. Key geometric factors include:

• Boundary proximity: Models with closer decision boundaries exhibit higher transfer rates
• Loss landscape sharpness: Sharp, non-smooth loss surfaces correlate with vulnerability to transferred perturbations
• Gradient alignment: The cosine similarity between gradients of the surrogate and target models predicts transfer success

Attackers can significantly boost transferability by crafting adversarial examples against an ensemble of surrogate models simultaneously. The ensemble in logits approach averages the loss across multiple architectures—such as ResNet, DenseNet, and VGG—during perturbation generation. This forces the adversarial example to fool diverse decision boundaries, increasing the likelihood that it will also fool an unseen target model. Advanced techniques include:

• Input diversity: Applying random transformations (resizing, padding) during attack generation to avoid overfitting to surrogate-specific features
• Momentum iterative methods: Accumulating gradient directions across iterations to escape poor local optima and find more transferable perturbations
• Translation-invariant attacks: Convolving gradients with a kernel to generate perturbations robust to spatial shifts

Adversarial training—injecting adversarial examples into the training set with correct labels—is the most effective defense against both direct and transferred attacks. Models trained with adversarial examples learn smoother decision boundaries that are less aligned with standard surrogate models. However, a critical nuance exists: adversarial training against one attack type (e.g., FGSM) may not confer robustness against transferred C&W or PGD attacks. This has led to ensemble adversarial training, where models are hardened against perturbations generated from multiple attack algorithms and surrogate architectures, explicitly targeting the transferability property.

Gradient masking occurs when a defense causes a model's gradients to become uninformative or misleading—either through non-differentiable preprocessing, randomized transformations, or shattered gradients. While this may appear to block white-box attacks, it does not eliminate adversarial vulnerabilities. Transferred attacks from an unprotected surrogate model will still succeed, exposing the defense as security through obscurity. True robustness requires genuinely smooth decision boundaries, not obfuscated gradients. The transferability property serves as a litmus test: if a defense fails against transferred attacks, it likely relies on gradient masking rather than genuine robustness.

Transferability is not uniform across all model pairs. Architectures that learn similar feature representations exhibit higher mutual transferability. Convolutional neural networks trained on ImageNet share low-level edge and texture detectors, making them highly susceptible to cross-model transfer. However, transferring attacks between fundamentally different paradigms—such as from a CNN to a Vision Transformer (ViT)—often yields lower success rates due to divergent inductive biases. ViTs rely on self-attention over patches rather than local convolutional filters, creating distinct vulnerability patterns. Understanding these feature space relationships is critical for designing defense-in-depth strategies.