---
title: 'Affine Genetic Attack: Black-Box Adversarial Method'
url: https://www.emergentmind.com/topics/affine-genetic-attack-aga
type: topic
---

# Affine Genetic Attack: Black-Box Adversarial Method

Searching arXiv for the cited papers to ground the article and disambiguate the term “AGA.”
Affine Genetic Attack (AGA) is a black-box adversarial attack for image classification introduced in “IGAff: Benchmarking Adversarial Iterative and Genetic Affine Algorithms on Deep Neural Networks” [2509.06459]. In that work, AGA is defined as a genetic algorithm that involves random noise and affine transformations, and is paired with a simpler companion method, the Affine Transformation Attack (ATA). AGA operates without access to gradients, weights, or internal model details, and searches for adversarial images by combining affine image warping, bounded random pixel noise, mutation, crossover, and selection. The acronym is not uniform across the literature: in other contexts, “AGA” may denote the Abstract Genetic Algorithm rather than Affine Genetic Attack, and several genetic adversarial methods are non-affine despite superficial terminological similarity [2009.05474].

## 1. Definition and nomenclature

In the IGAff framework, AGA is one of two new black-box adversarial methods benchmarked on deep neural networks. ATA is the iterative affine-only baseline; AGA augments adversarial exploration with genetic operators and random noise [2509.06459]. The perturbation family is explicitly affine: rotations, translations, scaling, and shearing. The search mechanism is explicitly genetic: population initialization, mutation, crossover, fitness evaluation, best-candidate selection, and reproduction.

The literature around the acronym is heterogeneous. That heterogeneity matters because several nearby papers concern genetic search or affine transformations but do not define the same object.

| Paper | Term used | Relation to AGA |
|---|---|---|
| [2509.06459] | Affine Genetic Attack | The image-classification method usually meant by AGA |
| [2009.05474] | Abstract Genetic Algorithm | Different meaning of AGA |
| [2110.01818] | Improved Genetic Algorithm | Genetic adversarial attack, but not affine |
| [2404.13948] | GARAG | Genetic attack on RAG, not affine |
| [2405.11047] | affine transformation attack | Affine, but not genetic and not image-classification AGA |

This disambiguation is substantive rather than terminological. The Affine Genetic Attack is specifically a black-box image attack over affine transformations plus noise; it is neither the binary-image confidence-maximization attack built from an Improved Genetic Algorithm [2110.01818], nor the multi-objective typo-based attack on RAG pipelines [2404.13948], nor the query-based clustering poisoning method inspired by the Abstract Genetic Algorithm [2009.05474].

## 2. Algorithmic construction

AGA operates on a population of candidate images. Given an input batch \(X\), the initial population is created by replication,
\[
\mathcal{P}\leftarrow\mathrm{repeat}(X,n_p),
\]
where \(n_p\) is the population size. Labels are set by
\[
\tilde y\leftarrow (c\ \text{if given else}\ y),
\]
so that untargeted attacks use the true label and targeted attacks use a chosen class \(c\) [2509.06459].

The iterative loop runs for \(n_i\) iterations. In the mutation stage, each population member is modified with probability \(p_m\). The paper samples affine parameters from fixed uniform ranges:
\[
\theta\sim\mathcal{U}(-3,3), \qquad \tau_{x,y}\sim\mathcal{U}(-0.05,0.05),
\]
\[
s\sim\mathcal{U}(0.95,1.05), \qquad \phi\sim\mathcal{U}(-1,1),
\]
and samples additive noise as
\[
\Delta\sim\mathcal{U}(0,\varepsilon)^{B\times 3\times 224\times 224}.
\]
The transformed image is then clamped to the valid range,
\[
\widetilde{\mathcal{P}[j]}\leftarrow\operatorname{clamp}(\widetilde{\mathcal{P}[j]}+\Delta,0,1).
\]

Crossover is applied to neighboring population members \(j\) and \(j+1\) with probability \(p_c\). The operator samples
\[
r\in\{1,\dots,223\}
\]
and swaps image rows \(0{:}r\) between the two individuals. This is a row-segment exchange operator rather than a latent-space or patchwise recombination.

Fitness evaluation uses model cross-entropy loss, passed through the attack score function. The candidate with maximal score is selected,
\[
k\leftarrow \arg\max_j \mathcal{S}_j,
\]
and the best image is replicated to reinitialize the population for the next generation:
\[
\mathcal{P}\leftarrow\mathrm{repeat}(\tilde X^\ast,n_p).
\]
After all iterations, the selected best image is returned [2509.06459].

The default AGA hyperparameters reported in the experiments are:
- \(n_i=7\)
- \(n_p=3\)
- \(p_m=0.3\)
- \(p_c=0.3\)
- \(\epsilon=0.1\)

A plausible implication is that AGA uses a highly compact evolutionary regime: the population is small, reproduction is elitist in the sense that the best candidate is repeatedly cloned, and attack strength is expected to depend more on mutation and iteration than on population diversity. The parameter study reported in the same paper is consistent with that interpretation.

## 3. Objective and attack model

The attack is black-box in the standard score-based sense. The method is evaluated without access to gradients, weights, or internal model details, and relies only on model outputs needed to compute the cross-entropy-derived attack score [2509.06459]. For untargeted attacks, the score is derived from the loss against the ground-truth label. For targeted attacks, it is derived from the loss against a chosen target class. The paper states that this maps the loss into a bounded score in \((0,1)\), which is then maximized over the candidate population.

The reported success statistic is the attack success rate \(SR\), defined as the relative drop in accuracy caused by the attack. The study distinguishes two evaluation regimes. In global untargeted attacks, the full input batch is mutated without steering toward a specific class. In targeted attacks, the optimization attempts to push examples toward one chosen class; targeted experiments are performed only on Caltech-256, using the first ten sorted classes as target classes [2509.06459].

AGA’s perturbation model is global and structured. Unlike square-noise or pixel-rearrangement attacks, it combines image-wide geometric warping with additive bounded noise. The paper’s qualitative comparison describes AGA outputs in terms of smoothened edges, rounded boundaries, brightness shifts, and accumulated noise. This places AGA within a class of black-box attacks that exploit weak but semantically broad perturbation families rather than localized norm-ball updates.

## 4. Experimental regime

The benchmark in which AGA is introduced spans three datasets, four architectures, untargeted and targeted attack modes, parameter-variation studies, and adversarially trained versus undefended models [2509.06459].

The datasets are:
- **Tiny ImageNet-200**: 100,000 training images, 10,000 validation images, 200 classes, image size \(64\times 64\), resized to \(224\times 224\)
- **Caltech-256**: 30,607 images, 257 categories, uneven class distribution
- **Food-101**: 101,000 images, 101 classes, 750 train / 250 test images per class

Each dataset is split into train/validation/test with a \(0.8/0.1/0.1\) ratio.

The evaluated architectures are:
- ResNet-18
- DenseNet-121 with dropout rate 0.4
- Swin Transformer V2 (SwinV2-T, with \(C=96\) and blocks \(\{2,2,6,2\}\))
- Vision Transformer (ViT)

Training uses 12 epochs, batch size 32, initial learning rate \(10^{-4}\), linear decay, 2 warm-up epochs, and the Adam optimizer. Each experiment is run five times and reported as mean \(\pm\) standard deviation. The experiments use a Tesla A100 40GB GPU. The paper notes that AGA is constrained by memory, which is why the population size is kept at 3 and batch size is limited to 32 [2509.06459].

The same study also reports clean-performance gains under its augmentation protocol. The best clean classification accuracy is obtained on Caltech-256, followed by Tiny ImageNet-200 and Food-101. Representative best results are:
- **Caltech-256**: average accuracy 90.16%, macro F1 90.74%, weighted F1 90.06%
- **Food-101**: average accuracy 84.88%
- **Tiny ImageNet-200**: average accuracy 85.42%

The paper further reports improvement over Sandru et al.’s baseline by up to 8.82% on Tiny ImageNet-200 with ViT and no augmentation [2509.06459].

## 5. Empirical behavior

In the reported benchmarks, AGA is the strongest attack in almost all settings, especially in the undefended case [2509.06459]. Representative untargeted results include:

- **Caltech-256, Swin Transformer V2, undefended**: Attack Acc. 51.30%, SR 43.10%
- **Caltech-256, Swin Transformer V2, defended**: Attack Acc. 74.77%, SR 16.67%
- **Food-101, Swin Transformer V2, undefended**: Attack Acc. 36.31%, SR 56.09%
- **Food-101, ViT, undefended**: Attack Acc. 41.21%, SR 49.83%
- **Tiny ImageNet-200, ViT, undefended**: Attack Acc. 30.77%, SR 63.97%
- **Tiny ImageNet-200, DenseNet-121, undefended**: Attack Acc. 29.43%, SR 60.86%

The paper emphasizes that transformers are especially vulnerable in the undefended setting. The highest average attack success rates reported for AGA are 43.1% on Caltech-256 for Swin Transformer V2, 56.09% on Food-101 for Swin Transformer V2, and 63.97% on Tiny ImageNet-200 for ViT [2509.06459].

Adversarial augmentation changes the ranking of robustness. The paper reports large SR reductions for defended models, including:
- **Caltech-256, Swin Transformer V2**: \(-26.43\%\) SR drop under AGA
- **Food-101, Swin Transformer V2**: \(-34.03\%\) SR drop under AGA
- **Food-101, ViT**: \(-34.18\%\) SR drop under AGA
- **Tiny ImageNet-200, ViT**: \(-49.6\%\) SR drop under AGA

Targeted attacks are substantially weaker. The paper states that targeted SR reaches at most 7.77%, with most values around 0–1%. Reported maxima are:
- ResNet-18: 1.17%
- DenseNet-121: 1.22%
- Swin Transformer V2: 7.77%
- ViT: 1.41%

These results delimit AGA’s operational profile. Its strength lies in untargeted black-box degradation of image classifiers, particularly undefended transformer models. Its weakness is precise class steering.

## 6. Parameter sensitivity, baselines, and related methods

The parameter-variation study identifies three dominant levers for AGA performance: number of iterations \(n_i\), mutation probability \(p_m\), and noise intensity \(\epsilon\). Increasing \(n_i\) generally increases SR, with a roughly monotonic growth trend. Higher \(p_m\) generally strengthens the attack. Increasing \(\epsilon\) has a pronounced effect, especially on Swin Transformer V2. By contrast, \(p_c\) has relatively low sensitivity; crossover contributes less than mutation, noise, and iteration count [2509.06459].

Within the IGAff paper, AGA is compared to ATA, Pixle, and Square Attack. ATA is the simpler affine-only method. It repeatedly clones the original batch, samples affine parameters, applies them, scores the result, and keeps the best candidate. AGA differs by adding a population, mutation probability, crossover probability, random pixel noise, and repeated reproduction of the best individual. Pixle is described as a black-box attack based on pixel interchange, while Square Attack uses square patches or stripes of perturbation. In the reported qualitative comparison on 12 examples from Swin Transformer V2 trained on Caltech-256, the success counts are:
- original images correct: 12/12
- ATA successful: 6/12
- AGA successful: 8/12
- Square Attack successful: 5/12
- Pixle successful: 4/12 [2509.06459]

The broader literature contains several genetically inspired attacks that are adjacent but distinct. The 2021 paper on an Improved Genetic Algorithm applies GA-based search to black-box neural network adversarial attack, but its search space is binary \(28\times 28\) images, its fitness is model confidence, and it does not use affine transformations or define an Affine Genetic Attack [2110.01818]. The GARAG framework applies NSGA-II to low-level textual perturbations in RAG systems and explicitly targets retrieval and grounding through typo-like noise rather than geometry [2404.13948]. In clustering security, “AGA” denotes the Abstract Genetic Algorithm, adapted into a query-based poisoning attack over perturbation masks \(\epsilon\), again unrelated to affine image warping [2009.05474]. Conversely, the manipulator-control FDIA literature studies affine transformation attacks on sensor and actuator channels, but those attacks are not genetic and are not image-classification attacks [2405.11047].

A common misconception is therefore to treat “AGA” as a generic synonym for any genetic adversarial procedure or any affine attack. In the specific sense established by the image-classification literature, Affine Genetic Attack denotes the method from IGAff: a black-box adversarial algorithm built from affine transformations, additive bounded noise, and a compact genetic search loop [2509.06459].

Source: https://www.emergentmind.com/topics/affine-genetic-attack-aga