Affine Genetic Attack: Black-Box Adversarial Method

• Affine Genetic Attack (AGA) is a black-box adversarial attack that combines affine transformations, bounded noise, and genetic operations to perturb images without model internals.
• AGA employs mutation, crossover, and elitist reproduction over a small candidate population, optimizing adversarial examples iteratively via score-based fitness evaluation.
• Empirical studies show AGA achieves high success rates against undefended models, notably transformers, while its targeted attack performance remains limited.

Searching arXiv for the cited papers to ground the article and disambiguate the term “AGA.” Affine Genetic Attack (AGA) is a black-box adversarial attack for image classification introduced in “IGAff: Benchmarking Adversarial Iterative and Genetic Affine Algorithms on Deep Neural Networks” (Echim et al., 8 Sep 2025). In that work, AGA is defined as a genetic algorithm that involves random noise and affine transformations, and is paired with a simpler companion method, the Affine Transformation Attack (ATA). AGA operates without access to gradients, weights, or internal model details, and searches for adversarial images by combining affine image warping, bounded random pixel noise, mutation, crossover, and selection. The acronym is not uniform across the literature: in other contexts, “AGA” may denote the Abstract Genetic Algorithm rather than Affine Genetic Attack, and several genetic adversarial methods are non-affine despite superficial terminological similarity (Cinà et al., 2020).

1. Definition and nomenclature

In the IGAff framework, AGA is one of two new black-box adversarial methods benchmarked on deep neural networks. ATA is the iterative affine-only baseline; AGA augments adversarial exploration with genetic operators and random noise (Echim et al., 8 Sep 2025). The perturbation family is explicitly affine: rotations, translations, scaling, and shearing. The search mechanism is explicitly genetic: population initialization, mutation, crossover, fitness evaluation, best-candidate selection, and reproduction.

The literature around the acronym is heterogeneous. That heterogeneity matters because several nearby papers concern genetic search or affine transformations but do not define the same object.

Paper	Term used	Relation to AGA
(Echim et al., 8 Sep 2025)	Affine Genetic Attack	The image-classification method usually meant by AGA
(Cinà et al., 2020)	Abstract Genetic Algorithm	Different meaning of AGA
(Yang et al., 2021)	Improved Genetic Algorithm	Genetic adversarial attack, but not affine
(Cho et al., 2024)	GARAG	Genetic attack on RAG, not affine
(Ueda et al., 2024)	affine transformation attack	Affine, but not genetic and not image-classification AGA

This disambiguation is substantive rather than terminological. The Affine Genetic Attack is specifically a black-box image attack over affine transformations plus noise; it is neither the binary-image confidence-maximization attack built from an Improved Genetic Algorithm (Yang et al., 2021), nor the multi-objective typo-based attack on RAG pipelines (Cho et al., 2024), nor the query-based clustering poisoning method inspired by the Abstract Genetic Algorithm (Cinà et al., 2020).

2. Algorithmic construction

AGA operates on a population of candidate images. Given an input batch $X$, the initial population is created by replication,

$\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$

where $n_p$ is the population size. Labels are set by

$\tilde y\leftarrow (c\ \text{if given else}\ y),$

so that untargeted attacks use the true label and targeted attacks use a chosen class $c$ (Echim et al., 8 Sep 2025).

The iterative loop runs for $n_i$ iterations. In the mutation stage, each population member is modified with probability $p_m$. The paper samples affine parameters from fixed uniform ranges: $$\theta\sim\mathcal{U}(-3,3), \qquad \tau_{x,y}\sim\mathcal{U}(-0.05,0.05),$$

$$s\sim\mathcal{U}(0.95,1.05), \qquad \phi\sim\mathcal{U}(-1,1),$$

and samples additive noise as

$$\Delta\sim\mathcal{U}(0,\varepsilon)^{B\times 3\times 224\times 224}.$$

The transformed image is then clamped to the valid range,

$\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$0

Crossover is applied to neighboring population members $\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$1 and $\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$2 with probability $\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$3. The operator samples

$\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$4

and swaps image rows $\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$5 between the two individuals. This is a row-segment exchange operator rather than a latent-space or patchwise recombination.

Fitness evaluation uses model cross-entropy loss, passed through the attack score function. The candidate with maximal score is selected,

$\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$6

and the best image is replicated to reinitialize the population for the next generation: $\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$7 After all iterations, the selected best image is returned (Echim et al., 8 Sep 2025).

The default AGA hyperparameters reported in the experiments are:

• $\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$8
• $\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),$9
• $n_p$0
• $n_p$1
• $n_p$2

A plausible implication is that AGA uses a highly compact evolutionary regime: the population is small, reproduction is elitist in the sense that the best candidate is repeatedly cloned, and attack strength is expected to depend more on mutation and iteration than on population diversity. The parameter study reported in the same paper is consistent with that interpretation.

3. Objective and attack model

The attack is black-box in the standard score-based sense. The method is evaluated without access to gradients, weights, or internal model details, and relies only on model outputs needed to compute the cross-entropy-derived attack score (Echim et al., 8 Sep 2025). For untargeted attacks, the score is derived from the loss against the ground-truth label. For targeted attacks, it is derived from the loss against a chosen target class. The paper states that this maps the loss into a bounded score in $n_p$3, which is then maximized over the candidate population.

The reported success statistic is the attack success rate $n_p$4, defined as the relative drop in accuracy caused by the attack. The study distinguishes two evaluation regimes. In global untargeted attacks, the full input batch is mutated without steering toward a specific class. In targeted attacks, the optimization attempts to push examples toward one chosen class; targeted experiments are performed only on Caltech-256, using the first ten sorted classes as target classes (Echim et al., 8 Sep 2025).

AGA’s perturbation model is global and structured. Unlike square-noise or pixel-rearrangement attacks, it combines image-wide geometric warping with additive bounded noise. The paper’s qualitative comparison describes AGA outputs in terms of smoothened edges, rounded boundaries, brightness shifts, and accumulated noise. This places AGA within a class of black-box attacks that exploit weak but semantically broad perturbation families rather than localized norm-ball updates.

4. Experimental regime

The benchmark in which AGA is introduced spans three datasets, four architectures, untargeted and targeted attack modes, parameter-variation studies, and adversarially trained versus undefended models (Echim et al., 8 Sep 2025).

The datasets are:

• Tiny ImageNet-200: 100,000 training images, 10,000 validation images, 200 classes, image size $n_p$5, resized to $n_p$6
• Caltech-256: 30,607 images, 257 categories, uneven class distribution
• Food-101: 101,000 images, 101 classes, 750 train / 250 test images per class

Each dataset is split into train/validation/test with a $n_p$7 ratio.

The evaluated architectures are:

• ResNet-18
• DenseNet-121 with dropout rate 0.4
• Swin Transformer V2 (SwinV2-T, with $n_p$8 and blocks $n_p$9)
• Vision Transformer (ViT)

Training uses 12 epochs, batch size 32, initial learning rate $\tilde y\leftarrow (c\ \text{if given else}\ y),$0, linear decay, 2 warm-up epochs, and the Adam optimizer. Each experiment is run five times and reported as mean $\tilde y\leftarrow (c\ \text{if given else}\ y),$1 standard deviation. The experiments use a Tesla A100 40GB GPU. The paper notes that AGA is constrained by memory, which is why the population size is kept at 3 and batch size is limited to 32 (Echim et al., 8 Sep 2025).

The same study also reports clean-performance gains under its augmentation protocol. The best clean classification accuracy is obtained on Caltech-256, followed by Tiny ImageNet-200 and Food-101. Representative best results are:

• Caltech-256: average accuracy 90.16%, macro F1 90.74%, weighted F1 90.06%
• Food-101: average accuracy 84.88%
• Tiny ImageNet-200: average accuracy 85.42%

The paper further reports improvement over Sandru et al.’s baseline by up to 8.82% on Tiny ImageNet-200 with ViT and no augmentation (Echim et al., 8 Sep 2025).

5. Empirical behavior

In the reported benchmarks, AGA is the strongest attack in almost all settings, especially in the undefended case (Echim et al., 8 Sep 2025). Representative untargeted results include:

• Caltech-256, Swin Transformer V2, undefended: Attack Acc. 51.30%, SR 43.10%
• Caltech-256, Swin Transformer V2, defended: Attack Acc. 74.77%, SR 16.67%
• Food-101, Swin Transformer V2, undefended: Attack Acc. 36.31%, SR 56.09%
• Food-101, ViT, undefended: Attack Acc. 41.21%, SR 49.83%
• Tiny ImageNet-200, ViT, undefended: Attack Acc. 30.77%, SR 63.97%
• Tiny ImageNet-200, DenseNet-121, undefended: Attack Acc. 29.43%, SR 60.86%

The paper emphasizes that transformers are especially vulnerable in the undefended setting. The highest average attack success rates reported for AGA are 43.1% on Caltech-256 for Swin Transformer V2, 56.09% on Food-101 for Swin Transformer V2, and 63.97% on Tiny ImageNet-200 for ViT (Echim et al., 8 Sep 2025).

Adversarial augmentation changes the ranking of robustness. The paper reports large SR reductions for defended models, including:

• Caltech-256, Swin Transformer V2: $\tilde y\leftarrow (c\ \text{if given else}\ y),$2 SR drop under AGA
• Food-101, Swin Transformer V2: $\tilde y\leftarrow (c\ \text{if given else}\ y),$3 SR drop under AGA
• Food-101, ViT: $\tilde y\leftarrow (c\ \text{if given else}\ y),$4 SR drop under AGA
• Tiny ImageNet-200, ViT: $\tilde y\leftarrow (c\ \text{if given else}\ y),$5 SR drop under AGA

Targeted attacks are substantially weaker. The paper states that targeted SR reaches at most 7.77%, with most values around 0–1%. Reported maxima are:

• ResNet-18: 1.17%
• DenseNet-121: 1.22%
• Swin Transformer V2: 7.77%
• ViT: 1.41%

These results delimit AGA’s operational profile. Its strength lies in untargeted black-box degradation of image classifiers, particularly undefended transformer models. Its weakness is precise class steering.

6. Parameter sensitivity, baselines, and related methods

The parameter-variation study identifies three dominant levers for AGA performance: number of iterations $\tilde y\leftarrow (c\ \text{if given else}\ y),$6, mutation probability $\tilde y\leftarrow (c\ \text{if given else}\ y),$7, and noise intensity $\tilde y\leftarrow (c\ \text{if given else}\ y),$8. Increasing $\tilde y\leftarrow (c\ \text{if given else}\ y),$9 generally increases SR, with a roughly monotonic growth trend. Higher $c$0 generally strengthens the attack. Increasing $c$1 has a pronounced effect, especially on Swin Transformer V2. By contrast, $c$2 has relatively low sensitivity; crossover contributes less than mutation, noise, and iteration count (Echim et al., 8 Sep 2025).

Within the IGAff paper, AGA is compared to ATA, Pixle, and Square Attack. ATA is the simpler affine-only method. It repeatedly clones the original batch, samples affine parameters, applies them, scores the result, and keeps the best candidate. AGA differs by adding a population, mutation probability, crossover probability, random pixel noise, and repeated reproduction of the best individual. Pixle is described as a black-box attack based on pixel interchange, while Square Attack uses square patches or stripes of perturbation. In the reported qualitative comparison on 12 examples from Swin Transformer V2 trained on Caltech-256, the success counts are:

• original images correct: 12/12
• ATA successful: 6/12
• AGA successful: 8/12
• Square Attack successful: 5/12
• Pixle successful: 4/12 (Echim et al., 8 Sep 2025)

The broader literature contains several genetically inspired attacks that are adjacent but distinct. The 2021 paper on an Improved Genetic Algorithm applies GA-based search to black-box neural network adversarial attack, but its search space is binary $c$3 images, its fitness is model confidence, and it does not use affine transformations or define an Affine Genetic Attack (Yang et al., 2021). The GARAG framework applies NSGA-II to low-level textual perturbations in RAG systems and explicitly targets retrieval and grounding through typo-like noise rather than geometry (Cho et al., 2024). In clustering security, “AGA” denotes the Abstract Genetic Algorithm, adapted into a query-based poisoning attack over perturbation masks $c$4, again unrelated to affine image warping (Cinà et al., 2020). Conversely, the manipulator-control FDIA literature studies affine transformation attacks on sensor and actuator channels, but those attacks are not genetic and are not image-classification attacks (Ueda et al., 2024).

A common misconception is therefore to treat “AGA” as a generic synonym for any genetic adversarial procedure or any affine attack. In the specific sense established by the image-classification literature, Affine Genetic Attack denotes the method from IGAff: a black-box adversarial algorithm built from affine transformations, additive bounded noise, and a compact genetic search loop (Echim et al., 8 Sep 2025).