[CVPR/TPAMI Review] Decoding Adversarial Transferability: A New Standard for Black-Box Attacks

TL;DR

In the escalating arms race between Deep Learning and Adversarial Attacks, Adversarial Transferability represents the ultimate "skeleton key"—the ability of a perturbation crafted on a known surrogate model to deceive a completely unknown target. This paper provides the most exhaustive benchmark to date, categorizing hundreds of attacks and exposing the "dirty secrets" of unfair comparisons in existing literature. It reveals that the key to a successful attack lies not in raw power, but in finding flat local minima and model-agnostic features.

The Core Defect in Previous Benchmarking

Before this work, the community lacked a "Golden Standard." Researchers often compared their new methods against weak baselines or tuned their surrogates in ways that didn't reflect real-world constraints. As the authors point out, several "novel" gradient attacks (like AI-FGTM) actually performed worse than established methods like VMI-FGSM when tested under identical conditions.

The central challenge of transferability is overfitting: an attack that is too "sharp" works perfectly on the surrogate but fails to navigate the slightly different loss landscape of the victim.

Methodology: The Six Pillars of Attack

The authors dismantle the attack landscape into six logical categories, each targeting a different stage of the adversarial pipeline:

1. Gradient-based: Stabilizing the update direction using momentum and variance tuning.
2. Input Transformation: Creating a "synthetic diversity" by resizing, padding, or rotating inputs to ensure the perturbation survives various preprocessing steps.
3. Objective Functions: Moving beyond simple Cross-Entropy to target intermediate layer features that are shared across different architectures (CNNs vs. ViTs).
4. Generation-based: Training GANs or Diffusion models to learn the "manifold of adversarial noise."
5. Model-related: Modifying the surrogate itself (e.g., using Skip-Gradients or soft ReLU) to generate smoother, more transferable gradients.
6. Ensemble-based: Attacking multiple surrogates simultaneously to find the "intersection" of their vulnerabilities.

Technical Insight: Why Feature-Level Attacks Win

The most profound takeaway is the shift from Logit-targeting to Feature-targeting.

Deep neural networks, regardless of their architecture, tend to learn similar semantic representations in their middle layers. By using methods like FIA (Feature Importance-aware Attack) or BFA (Black-box Feature Attack), attackers can disrupt the "object-aware" regions of an image. If the surrogate and victim both recognize a "dog" by its ears and snout, disrupting those specific feature activations is far more effective than trying to flip the final classification layer, which is highly model-specific.

The Power of Flatness

A key finding is the correlation between Loss Landscape Flatness and transferability. Methods like MEF (Maximin Expected Flatness) intentionally seek out local maxima that are "flat" (insensitive to small parameter perturbations). These flat regions are more likely to exist across different models, allowing the adversarial example to "stay effective" even when the victim's decision boundary is slightly shifted.

Beyond Image Classification: The Horizon

The paper doesn't stop at 2D images. It explores how these principles transfer to:

• NLP: Where synonym substitution and prompt injection (Jailbreaking) capitalize on the shared linguistic embedding space of LLMs.
• Multimodal (VQA): Exploiting the "misalignment" between vision and language encoders.

The "Universal Trend" is clear: We are moving from Instance-specific optimization toward System-level exploitation.

Critical Analysis & Future Outlook

While this paper rectifies evaluation protocols, it also exposes a grim reality: Existing defenses are still fragile. Most targeted attacks, while harder to execute than untargeted ones, can still bypass state-of-the-art defenses like Randomized Smoothing or Adversarial Training if enough compute is used for input transformations.

The Takeaway for AI Safety: Developers cannot rely on the "security by obscurity" of their model architecture. To build truly robust systems, we must develop defenses that protect the intermediate feature manifold, as this is where the most potent transferable attacks are currently being waged.

Senior Editor's Note: This benchmark is a mandatory read for any ML Security researcher. It effectively resets the "SOTA" clock and provides a clean sandbox for future innovations in both attacks and defenses.