Transferability

Adversarial examples transfer most effectively between models with homogeneous architectures. A perturbation crafted for a ResNet-50 will transfer to another ResNet-50 with high probability, but transfer drops significantly when targeting a Vision Transformer (ViT). This occurs because similar architectures learn correlated decision boundaries and feature representations. Key architectural factors include:

• Depth and width: Deeper networks with similar capacity share more vulnerable subspaces.
• Activation functions: ReLU-based networks exhibit more transferable adversarial subspaces than smooth activations like GELU or Swish.
• Normalization layers: BatchNorm statistics create dataset-specific loss geometries that can either amplify or inhibit transferability.

Transferability is fundamentally a property of gradient correlation between source and target models. When the loss gradients of two models point in similar directions for a given input, perturbations crafted on one will deceive the other. This phenomenon is explained by the local linearity hypothesis: neural networks behave approximately linearly in the vicinity of training points, and these linear approximations overlap across independently trained models. Techniques that explicitly maximize gradient alignment—such as gradient matching attacks and intermediate feature attacks—can dramatically increase cross-model transfer rates by targeting shared representational subspaces rather than model-specific decision boundaries.

Models trained on overlapping or identical datasets exhibit significantly higher adversarial transferability. This is because shared training data induces convergent learning dynamics—both models converge toward similar Bayes optimal decision boundaries. The phenomenon is particularly pronounced when:

• Models are trained on the same benchmark datasets (ImageNet, CIFAR-10).
• Data augmentation strategies are identical or highly similar.
• Class label semantics and granularity are consistent.

Conversely, models trained on disjoint data distributions—even with identical architectures—show markedly reduced transferability. This has critical implications for black-box attack surface analysis: an attacker with knowledge of the training data distribution can select a surrogate model that maximizes expected transfer.

The Lp-norm perturbation budget (epsilon) directly modulates transferability. Larger perturbation magnitudes increase the likelihood of crossing decision boundaries in both source and target models, but at the cost of perceptual detectability. The relationship is non-linear:

• Small epsilon (e.g., 4/255): Transfer is highly architecture-dependent; only models with near-identical decision boundaries are fooled.
• Large epsilon (e.g., 16/255): Transfer rates plateau as perturbations enter universal adversarial subspaces—directions in input space that are orthogonal to data manifold variations.

Additionally, multi-step iterative attacks (PGD, MI-FGSM) generate more transferable examples than single-step methods (FGSM) by more precisely navigating the loss landscape. Momentum-based optimization (MI-FGSM) and input diversity techniques (DIM) further stabilize gradient directions, preventing overfitting to the surrogate model's specific geometry.

Crafting adversarial examples against an ensemble of surrogate models is the most reliable method for maximizing black-box transferability. By optimizing perturbations that simultaneously fool multiple architectures, the attack converges on shared vulnerable subspaces rather than model-specific weaknesses. The ensemble approach exploits the fact that while individual models have unique decision boundaries, the intersection of their adversarial regions often aligns with the target model's vulnerabilities. Effective ensemble strategies include:

• Logit fusion: Averaging output logits before computing the loss.
• Loss fusion: Summing individual model losses with equal or learned weighting.
• Feature-level attacks: Maximizing disruption of intermediate representations across all surrogate models.

This technique is the foundation of state-of-the-art black-box attacks and is a standard baseline in robustness evaluation benchmarks like RobustBench.

Transferability is not only a function of the source and target models—it is also influenced by input preprocessing pipelines and defensive mechanisms deployed at inference time. Defenses that randomize inputs (e.g., randomized smoothing, JPEG compression, bit-depth reduction) disrupt the precise perturbation patterns crafted on the surrogate model, reducing transfer rates. However, expectation-over-transformation (EOT) attacks can circumvent these defenses by optimizing adversarial examples to remain effective across a distribution of input transformations. This creates a continuous arms race: defenders deploy stochastic preprocessing to break transferability, while attackers incorporate those same transformations into their optimization loop to restore cross-model efficacy.