Transfer Attack

The attacker trains or obtains a surrogate model that approximates the target's decision boundary. Adversarial examples are generated using white-box methods on this accessible surrogate, then transferred to the black-box target. The attack succeeds because adversarial subspaces overlap across models trained on similar tasks. Key factors influencing transferability include:

• Model architecture similarity (e.g., ResNet to VGG)
• Training dataset overlap
• Task alignment (both models perform fraud classification)
• Gradient alignment between surrogate and target loss landscapes

Generating adversarial examples against multiple surrogate models simultaneously dramatically increases transferability. By optimizing perturbations that fool an ensemble of diverse architectures, the attacker finds more generalizable adversarial directions. This technique, known as ensemble adversarial training when used defensively, exploits the fact that perturbations surviving multiple decision boundaries are more likely to reside in the shared vulnerable subspace. Common ensemble strategies include:

• Logit averaging across surrogates
• Loss function fusion with weighted contributions
• Iterative attack rotation through different models

MI-FGSM enhances transferability by integrating a momentum term into the iterative gradient ascent process. This stabilizes update directions and helps escape poor local maxima during perturbation generation. The momentum accumulation dampens oscillations, producing adversarial examples that generalize better across model boundaries. The algorithm follows:

• Accumulate velocity: v_{t+1} = μ·v_t + ∇J/||∇J||₁
• Update perturbation: x_{t+1} = x_t + α·sign(v_{t+1})
• Decay factor μ typically set to 1.0 for maximum transferability This method consistently outperforms basic iterative attacks in black-box transfer scenarios.

Advanced transfer attacks incorporate input diversity techniques during adversarial generation. By applying random transformations—resizing, padding, rotation, or color shifts—to inputs at each iteration, the resulting perturbation becomes invariant to these variations. This scale-invariant property makes the adversarial example robust to the preprocessing pipelines and architectural differences of unknown target models. Key transformation strategies:

• Diverse Input Method (DIM): Random resizing and padding
• Translation-Invariant Method (TIM): Convolution with Gaussian kernel
• Scale-Invariant Method (SIM): Multi-scale gradient averaging

Instead of optimizing perturbations in pixel or input space, feature-level attacks target intermediate representations. By maximizing the distance between clean and adversarial feature vectors at specific layers, these attacks exploit the fact that different models often learn similar hierarchical features. The Neural Representation Distortion approach aligns adversarial perturbations with the semantic feature manifold, making them more transferable. This technique is particularly effective when:

• Surrogate and target share similar backbone architectures
• Intermediate layer activations exhibit high cosine similarity
• The attack targets layers known to encode task-relevant semantics

Sophisticated transfer attacks account for common defensive mechanisms during perturbation generation. By simulating adversarial training gradients, gradient masking bypasses, or denoising autoencoder preprocessing, the attacker crafts examples that survive defensive pipelines. Techniques include:

• Backward Pass Differentiable Approximation (BPDA): Approximates non-differentiable defense gradients
• Expectation over Transformation (EOT): Averages gradients over expected defensive transforms
• Adaptive attack frameworks: AutoAttack variants tuned for transfer scenarios This arms race drives continuous improvement in both attack sophistication and defensive robustness.

The foundational mechanism enabling transfer attacks. A carefully crafted, often imperceptible modification to an input sample—such as adding a specific noise pattern to a transaction feature vector—designed to cause a machine learning model to misclassify it. These perturbations exploit the high-dimensional, non-linear decision boundaries of neural networks. The transferability property arises because different models often learn similar decision boundaries when trained on comparable data distributions, making a perturbation generated for one model statistically likely to fool another.

The attack category into which transfer attacks fall. An adversary modifies a malicious sample at inference time to bypass a detection model without altering the model's internal parameters. In a transfer attack scenario, the adversary crafts an evasion sample against a locally trained surrogate model and then deploys it against the remote target model. This is the primary threat vector for financial fraud systems where attackers do not have direct access to the production model's architecture or training data.

The threat model that necessitates transfer attacks. A black-box attack relies solely on querying a model to observe its output decisions or confidence scores without any knowledge of its internal architecture, parameters, or training data. Transfer attacks are a specific subcategory of black-box attacks where the adversary avoids querying the target model entirely—eliminating the risk of detection by rate limiting or query monitoring systems—by generating adversarial examples against a surrogate model and transferring them.

The gold standard for evaluating defenses against transfer attacks. An adaptive attack is a white-box methodology specifically designed with full knowledge of a defense mechanism to circumvent it. When testing robustness against transfer attacks, evaluators must assume the adversary knows the defensive strategy—such as adversarial training or input preprocessing—and will optimize their surrogate model and perturbation generation process accordingly. Without adaptive evaluation, defenses often exhibit gradient masking, providing a false sense of security.

The most empirically robust defense against transfer attacks. This technique augments the training dataset with adversarial examples generated against the model being trained, forcing it to learn correct classifications even for perturbed inputs. For transfer attack resilience, adversarial training must use diverse attack methodologies during training—not just a single perturbation type—to avoid overfitting to a specific threat model. The TRADES loss function is particularly effective, trading off natural accuracy against adversarial robustness by minimizing the KL divergence between clean and adversarial output distributions.

A standardized, parameter-free ensemble of diverse adversarial attacks used as a reliable benchmark for evaluating empirical robustness, including transfer attack susceptibility. AutoAttack combines four complementary attack methodologies: APGD-CE (targeted projected gradient descent), APGD-DLR (difference of logits ratio), FAB (fast adaptive boundary), and Square Attack (a query-efficient black-box method). When evaluating a model's vulnerability to transfer attacks, AutoAttack provides a reproducible, rigorous protocol that avoids the common pitfalls of weak or misconfigured attack implementations.