Transfer Attack

Adversarial examples transfer most effectively between models that share similar architectural paradigms. A perturbation crafted on a ResNet-50 surrogate is highly likely to fool another ResNet variant or a DenseNet target, as they process features through analogous hierarchical structures.

• High Transferability: Convolutional networks sharing skip connections or depthwise separable convolutions.
• Low Transferability: Attacks moving from a CNN to a Vision Transformer (ViT), as the inductive biases differ fundamentally.
• Defense Implication: Ensemble adversarial training using diverse architectures reduces the attack surface.

The epsilon (ε) constraint in L-infinity norm attacks directly governs cross-model generalization. Larger perturbations create more pronounced, lower-frequency distortions that survive the feature extraction differences between models.

• Small ε (e.g., 4/255): Often brittle and model-specific; fails to transfer reliably.
• Large ε (e.g., 16/255): Generates highly visible but universally effective patterns.
• Optimal Strategy: Iterative methods like I-FGSM with momentum often find a sweet spot, maximizing transferability without exceeding the perceptual budget.

Surrogate models with obfuscated gradients produce poor transfer attacks. Techniques like input transformations (DIM) and translation-invariant methods (TIM) prevent the attack from overfitting to the specific loss landscape of the white-box surrogate.

• Momentum (MI-FGSM): Stabilizes the update direction, escaping sharp local minima that don't generalize.
• Variance Tuning: Further smooths the gradient space to target regions of the loss landscape common to multiple models.
• Key Insight: A smoother optimization path on the surrogate correlates with higher black-box transferability.

Attacks that target intermediate feature representations rather than final logits exhibit superior transferability. By maximizing the discrepancy in the surrogate's feature maps, the perturbation attacks a semantic level that is more universally shared across models.

• Logit-based attacks: Tend to overfit to the surrogate's final decision boundary.
• Feature disruption: Corrupts the fundamental shapes and textures recognized by all vision models.
• Application: This is why universal adversarial perturbations (UAPs) often resemble structured noise patterns rather than random static.

Crafting the attack on an ensemble of multiple surrogate models simultaneously is the most robust method for ensuring transferability. By fusing the logits or losses from diverse architectures during the attack generation, the resulting perturbation captures a generalized adversarial subspace.

• Logit Fusion: Averaging the predictions of ResNet, VGG, and Inception before computing the loss.
• Loss Fusion: Summing the individual cross-entropy losses.
• Result: The attack effectively learns to fool a 'virtual' model that represents the common denominator of the ensemble, drastically increasing the probability of breaching an unknown target.

A substitute model created by an attacker to mimic the target's decision boundary. Since the adversary lacks access to the target's architecture or weights, they train a surrogate on synthetically generated input-output pairs obtained via black-box querying. The adversarial examples crafted against this local copy are then transferred to the real target. The higher the fidelity of the surrogate, the higher the transferability.

An input sample modified with a minimal perturbation—often imperceptible to humans—that causes a model to misclassify it with high confidence. In a transfer attack, this perturbation is calculated on a surrogate model but exploits shared geometric vulnerabilities in the target's loss landscape. Common crafting methods include:

• FGSM: Fast Gradient Sign Method
• PGD: Projected Gradient Descent
• C&W: Carlini & Wagner Attack

An advanced transfer technique that crafts perturbations against multiple surrogate models simultaneously. By optimizing the adversarial example to fool a diverse committee of architectures (e.g., ResNet, VGG, DenseNet), the attacker increases the likelihood that the perturbation captures a more general, transferable weakness rather than a model-specific artifact. This significantly boosts the Attack Success Rate (ASR) against unknown black-box targets.

A primary defense strategy where the model is retrained on a mixture of clean and adversarial examples. By injecting transferred or PGD-generated perturbations into the training set and correctly labeling them, the model learns to flatten its loss landscape. This reduces the gradient alignment between models, directly diminishing the transferability of attacks. It remains one of the few empirically robust defenses.

A defensive preprocessing layer that destroys subtle adversarial perturbations before they reach the model. Techniques include:

• JPEG Compression: Quantization disrupts high-frequency noise.
• Total Variance Minimization: Smooths pixel-level perturbations.
• Random Resizing & Padding: Alters the spatial positioning of the attack. These non-differentiable operations break the transfer chain by changing the input geometry.

A deceptive phenomenon where a defense appears robust against transfer attacks but provides no real security. This occurs when a model's gradients are shattered or obfuscated (e.g., via defensive distillation or shattering), preventing the attacker from computing a useful perturbation on a surrogate. However, these models remain vulnerable to black-box decision-based attacks that bypass gradient calculations entirely.