Surrogate Model

The surrogate is trained on a synthetic dataset labeled by repeatedly querying the target model. The adversary sends crafted inputs and records the output decisions or confidence scores. This input-output mapping allows the surrogate to approximate the target's decision boundary. Label-only attacks are particularly stealthy, requiring only the hard-label prediction rather than continuous confidence scores. The fidelity of the replica depends directly on the query budget and the diversity of the synthetic input distribution.

A defining strength of surrogate models is that they do not require knowledge of the target's internal architecture. The adversary can select any differentiable model—often a standard architecture like a ResNet or a simple CNN—as the surrogate. Because adversarial examples exploit blind spots in the learned decision topology rather than specific weight configurations, the transferability property allows perturbations crafted on a structurally different surrogate to still fool the original black-box target.

Once the surrogate is fully trained, the adversary gains a critical asymmetric advantage: they can treat the replica as a white-box model. This grants full access to gradients, loss landscapes, and internal activations. The adversary can then apply powerful gradient-based attacks like Projected Gradient Descent (PGD) or the Carlini-Wagner (CW) attack to craft minimal-distortion adversarial examples. These examples are then transferred directly against the black-box target.

The primary objective of a surrogate model is to generate perturbations that are highly transferable. Techniques to enhance this include:

• Ensemble surrogates: Training multiple replica models and crafting perturbations that fool all of them simultaneously.
• Momentum-based optimization: Integrating momentum into iterative gradient attacks to escape poor local maxima and find more globally effective perturbation directions.
• Input diversity: Applying random resizing and padding to inputs during the attack generation phase to prevent overfitting to the surrogate's specific grid patterns.

The practical viability of a surrogate attack is bounded by the query budget. High-fidelity replicas require millions of queries, making the attack detectable or prohibitively expensive. Research focuses on query-efficient strategies:

• Active learning: Selecting the most informative inputs to query based on the surrogate's current uncertainty.
• Substitute training: Using Jacobian-based dataset augmentation to force the surrogate to query inputs near the target's decision boundary, maximizing information gain per query.
• Natural evolution strategies: Estimating gradients using finite differences with fewer queries than standard zeroth-order optimization.

Surrogate models are specifically designed to probe and bypass defenses. If the target model uses adversarial training, the surrogate must be trained on a dataset that reflects the defended decision boundary. However, surrogate attacks often exploit gradient masking, a phenomenon where a defended model presents a deceptively smooth surface to gradient-based attacks. By crafting attacks on a non-masked surrogate, the adversary can often circumvent defenses that rely on obfuscated gradients, revealing the target's true vulnerability.

An attack executed without internal knowledge of the target model's architecture, weights, or training data. The adversary interacts solely through input-output queries.

• Score-based: Attacker receives confidence scores or logits
• Decision-based: Attacker receives only the final hard-label prediction
• Surrogate models are the primary tool for crafting transferable examples in this setting
• Query efficiency is the critical performance metric

The property by which an adversarial example crafted to fool one model (the surrogate) also succeeds in fooling a different, independently trained model (the target).

• Exploits shared decision boundaries across architectures
• Higher transferability correlates with surrogate model fidelity
• Ensemble-based surrogate training amplifies this effect
• The foundational phenomenon that makes black-box attacks viable

A defensive technique that injects adversarial examples into the training dataset to improve model robustness. The model learns to correctly classify perturbed inputs.

• Formulated as a min-max optimization problem
• Most effective when adversarial examples are generated on-the-fly during training
• Defends against the exact attack used in training; generalization to unseen attacks varies
• Increases computational cost significantly

A powerful multi-step iterative attack that generates adversarial examples by repeatedly stepping in the gradient direction and projecting back onto an epsilon-ball constraint.

• Considered a first-order universal adversary
• Standard benchmark for evaluating empirical robustness
• Steps: x_{t+1} = Proj(x_t + α · sign(∇_x L))
• Surrogate models trained with PGD produce highly transferable perturbations

A security mechanism designed to distinguish between legitimate data samples and adversarial inputs before they reach the classification model.

• Primary methods: Feature squeezing, statistical divergence tests, and auxiliary detector networks
• Operates as a pre-classification gatekeeper
• Must avoid high false-positive rates on clean samples
• Often combined with rejection-based defenses

A formal guarantee that a classifier's prediction will not change for any input within a mathematically verified perturbation bound.

• Randomized Smoothing: Adds Gaussian noise and returns the most probable prediction
• Interval Bound Propagation: Propagates input bounds through the network
• Provides provable security, unlike empirical defenses
• Typically trades clean accuracy for guaranteed robustness