Affine Transformation Attack (ATA)

• ATA is a class of domain-specific attacks that use affine transformations, combining linear mappings with additive offsets, to undermine diverse systems.
• In encrypted control and adversarial vision, ATA methods recover encryption keys or induce misclassification by leveraging known plaintexts or geometric perturbations.
• In robotic systems, coordinated affine modifications yield undetectable falsification of sensor and control signals, bypassing conventional defenses.

Affine Transformation Attack (ATA) denotes a set of attack constructions in which an affine relation is the operative mechanism of compromise. In the cited literature, ATA appears in several technically distinct settings: cryptanalysis of random affine transformation ciphers in encrypted control, adversarial image attacks based on geometric affine perturbations, and coordinated false-data-injection attacks on robotic control systems. The common algebraic pattern is a linear transformation together with an additive term, but the threat model, attack surface, and security objective differ sharply across domains (Schlüter et al., 2023, Echim et al., 8 Sep 2025, Ueda et al., 2024, Ueda et al., 2024). This suggests that ATA is best treated as a domain-specific class of affine-structured attacks rather than as a single canonical algorithm.

1. Core affine structure and scope

In the encrypted-control setting, the affine map is explicit in the cipher: $y(k) = R x(k) + r$ or, in the probabilistic variant,

$y(k) = R(k) x(k) + r(k).$

In adversarial vision, the affine component acts on image coordinates through a parameterized transform

$$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$

with translations $\delta_u,\delta_v$, rotation $\theta$, shear $\phi$, and scaling $s_u,s_v$. In robotic control, the same pattern appears as simultaneous affine corruption of commands and observables, for example

$$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$

or

$$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$

(Schlüter et al., 2023, Mayor, 2020, Ueda et al., 2024, Ueda et al., 2024).

Domain	Representative affine form	Reported effect
Encrypted control	$y(k)=Rx(k)+r$	Deterministic scheme breaks under known-plaintext attack
Vision ML	$y(k) = R(k) x(k) + r(k).$0 on image coordinates	Misclassification under rotation, translation, scaling, or shear
Robotic CPS	$y(k) = R(k) x(k) + r(k).$1, $y(k) = R(k) x(k) + r(k).$2	Perfectly undetectable trajectory manipulation under stated conditions

The acronym ATA is not unique across technical literatures. In acoustics, ATA also denotes Analogue Transformation Acoustics, a method for general spacetime transformations that is unrelated to adversarial or false-data-injection attacks (García-Meca et al., 2013).

2. ATA in encrypted control and random affine transformation ciphers

For encrypted control, the central object is the random affine transformation cipher over real numbers. The deterministic variant encrypts $y(k) = R(k) x(k) + r(k).$3 as $y(k) = R(k) x(k) + r(k).$4, with invertible $y(k) = R(k) x(k) + r(k).$5 and $y(k) = R(k) x(k) + r(k).$6; decryption is $y(k) = R(k) x(k) + r(k).$7. If an attacker obtains $y(k) = R(k) x(k) + r(k).$8 or more plaintext-ciphertext pairs $y(k) = R(k) x(k) + r(k).$9, the key $$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$0 can be recovered from the linear system

$$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$1

With exactly $$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$2 linearly independent pairs, the system is solved directly; with $$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$3, least squares is used: $$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$4 Once $$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$5 are recovered, all past and future ciphertexts can be decrypted (Schlüter et al., 2023).

The same work characterizes the deterministic scheme as perfectly distinguishable at the ciphertext level. The statistical distance between ciphertexts of different plaintexts is

$$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$6

so every ciphertext corresponds to one unique plaintext. This is the basis for the paper’s Affine Transformation Attack: once enough plaintext-ciphertext pairs are available, the affine key is determined. A second leakage channel arises from closed-loop structure. If plant dynamics are known, then

$$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$7

which removes the constant offset $$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$8 and leaks encrypted dynamics, including system properties such as eigenvalues (Schlüter et al., 2023).

The probabilistic variant changes the security picture by resampling at least $$A(\mathbf{t}) = \begin{bmatrix} s_u\cos\theta & -s_v\sin(\theta+\phi) & \delta_u \ s_u\sin\theta & s_v\cos(\theta+\phi) & \delta_v \ 0 & 0 & 1 \end{bmatrix},$$9 at each time step. For uniformly distributed $\delta_u,\delta_v$0, the statistical distance can be made negligible by taking $\delta_u,\delta_v$1 large; if both $\delta_u,\delta_v$2 and $\delta_u,\delta_v$3 are randomized, the distance is reduced further. The paper concludes that this makes successful attacks unlikely in theory, because known-plaintext equations become underdetermined and ATA becomes infeasible in the usual deterministic sense (Schlüter et al., 2023).

The practical qualification is severe. In floating-point realizations, finite precision introduces structure and non-uniformity: numbers are denser near zero, some ciphertexts become impossible or extremely rare, and the statistical-distance map becomes fragmented and non-smooth. The paper reports a “white cross” of insecurities for half precision and states that even using $\delta_u,\delta_v$4 of the representable range leaves statistical indistinguishability highly sensitive to plaintext values and floating-point idiosyncrasies. Its overall conclusion is that floating-point realization “suggests the impracticality of the scheme if a security guarantee is needed” (Schlüter et al., 2023).

3. Affine attacks in adversarial machine learning

In adversarial vision, affine transformations are treated as semantically meaningful perturbations that differ from the usual $\delta_u,\delta_v$5-bounded pixel-space attacks. The robust-training objective is formulated as

$\delta_u,\delta_v$6

where $\delta_u,\delta_v$7 is a bounded set of valid affine parameters. Because the loss with respect to affine parameters is described as highly non-concave and irregular, the cited work proposes zeroth-order optimization through evolution strategies, including $\delta_u,\delta_v$8-ES and CMA-ES, to search for worst-case transformations per input (Mayor, 2020).

On MNIST, the reported vulnerability gap between ordinary training and affine-robust training is large. Standard training achieved $\delta_u,\delta_v$9 natural accuracy, $\theta$0 under worst-of-10 evaluation, and $\theta$1 under grid search; data augmentation achieved $\theta$2, $\theta$3, and $\theta$4, respectively. By contrast, worst-of-10 adversarial training achieved $\theta$5 natural accuracy, $\theta$6 under worst-of-10, and $\theta$7 under grid search, while $\theta$8-ES-50 training achieved $\theta$9, $\phi$0, and $\phi$1 (Mayor, 2020).

A later black-box formulation uses the explicit name Affine Transformation Attack (ATA) for an iterative attack that samples random affine transformations and keeps the candidate batch with maximal attack score. The per-image sampling ranges are rotation $\phi$2, translation $\phi$3 as a fraction of image size, scaling $\phi$4, and shearing $\phi$5 radians. The attack score is a smoothed function of cross-entropy loss, and the algorithm supports both untargeted and targeted settings. In the paper’s qualitative comparison on 12 “core” example images, ATA succeeded on 6 of 12 examples, compared with 8 of 12 for the affine genetic attack, 5 of 12 for Square Attack, and 4 of 12 for Pixle. The same study reports better image-classification results than similar methods in the literature, “achieving an accuracy improvement of up to 8.82%” (Echim et al., 8 Sep 2025).

The significance of these results is that affine perturbations are global and plausibility-preserving rather than merely local in pixel space. This is also why they are attractive for adversarial evaluation and data augmentation: they often preserve image realism while still exposing model sensitivity (Mayor, 2020, Echim et al., 8 Sep 2025).

4. Transformation-conditioned and affine-invariant adversarial examples

A distinct line of work does not use affine transforms merely as perturbations; it uses them to index adversarial behavior. Transform-dependent adversarial attacks optimize a single additive perturbation $\phi$6 so that different transformations $\phi$7 trigger different target labels: $\phi$8 For affine-like geometric transforms, the main text emphasizes scaling, while supplementary experiments extend the method to flipping and perspective transformations. With scaling factors $\phi$9, the reported targeted attack success rates are approximately $s_u,s_v$0 on ResNet-50, $s_u,s_v$1 on VGG19, $s_u,s_v$2 on DenseNet-121, and $s_u,s_v$3 on ViT-L16. In black-box settings, the abstract reports that these transform-dependent perturbations outperform state-of-the-art transfer attacks by $s_u,s_v$4–$s_u,s_v$5 in targeted scenarios (Tan et al., 2024).

The converse problem is also studied: generating perturbations that remain adversarial after affine transformations. The affine-invariant gradient-estimator framework replaces repeated expectation-over-transformation sampling with a kernel-based approximation. Translation is handled as convolution in Cartesian coordinates, while rotation and scaling are reformulated in polar coordinates so that they become translation-like there. The full estimator is written as

$s_u,s_v$6

and can be used inside FGSM-, PGD-, MIM-, or DIM-style attacks (Xiang et al., 2021).

The reported performance gains are substantial. On the Ens-AT defense model at $s_u,s_v$7, AI-FGSM, AI-PGD, and AI-DIM reach $s_u,s_v$8, $s_u,s_v$9, and $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$0 attack success rate, compared with $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$1, $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$2, and $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$3 for FGSM, PGD, and DIM; EOT is reported at $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$4. For scale $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$5, AI-DIM reaches $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$6 on Ens-AT, and under translations AI-DIM reaches up to $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$7. For 1,000 examples, AI-DIM is reported at $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$8 seconds versus $$\tilde{\bm{u}} = \bm{S}_u \bm{u} + \bm{d}_u,\qquad \tilde{\bm{q}} = \bm{S}_x \bm{q} + \bm{d}_x$$9 seconds for EOT. In a physical experiment based on printing and recapturing adversarial images, AI-DIM reduces recognition accuracy on Inc-v3 to $$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$0 in the most extreme setting (Xiang et al., 2021).

Taken together, these two directions show that affine structure can be used both to condition attack outcomes and to stabilize attack efficacy under post-processing or physical transformations (Tan et al., 2024, Xiang et al., 2021).

5. Perfectly undetectable affine attacks on robotic control systems

In robotic manipulators, affine transformation attacks are formulated as coordinated false-data injection on both the command and observation channels: $$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$1 For the joint-velocity-driven manipulator $$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$2, perfect undetectability requires three conditions: multiplicative consistency,

$$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$3

initial-condition consistency,

$$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$4

and zero additive command bias,

$$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$5

The paper states that these conditions are necessary and sufficient. Experiments on a FANUC 6-degree-of-freedom manipulator validate scaling, reflection, and shearing scenarios. In the perfectly undetectable scaling case, the reported observed end-effector tracking error is indistinguishable from the nominal case, with average $$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$6 (Ueda et al., 2024).

For mobile robots, the attack is developed for a nonlinear affine plant

$$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$7

with controller $$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$8. The attack channel uses invertible static maps $$\tilde{\bm{p}}_c = \bm{S}_x \bm{p}_c + \bm{d}_x,\qquad \tilde{\bm{q}} = \bm{S}_u \bm{q} + \bm{d}_u$$9 and $y(k)=Rx(k)+r$0, instantiated as affine transformations

$y(k)=Rx(k)+r$1

For the non-holonomic robot with $y(k)=Rx(k)+r$2, perfect undetectability is characterized by initial-state matching

$y(k)=Rx(k)+r$3

and dynamics indistinguishability

$y(k)=Rx(k)+r$4

The paper notes that $y(k)=Rx(k)+r$5 is required for stealth in the attack cases considered. Turtlebot 3 experiments under ROS 2 demonstrate reflection and scaling attacks in which the controller perceives nominal tracking while the physical trajectory is mirrored or scaled (Ueda et al., 2024).

The central significance is that internal residual-based or model-following detection can be defeated when the plant-facing and controller-facing signals are warped consistently. In both the manipulator and mobile-robot papers, the controller sees a dynamically consistent counterfeit world rather than a noisy anomaly (Ueda et al., 2024, Ueda et al., 2024).

6. Detection, defenses, and recurrent misconceptions

One line of defense in vision uses metamorphic testing with affine transformations. The procedure classifies an image $y(k)=Rx(k)+r$6, records the original top-label confidence $y(k)=Rx(k)+r$7, applies an affine transform $y(k)=Rx(k)+r$8, measures the transformed confidence $y(k)=Rx(k)+r$9 on the original label, and tests whether

$y(k) = R(k) x(k) + r(k).$00

for any transformation step $y(k) = R(k) x(k) + r(k).$01. Rotation, shear, scale, and translation are applied in small increments, up to 60 steps. On unseen validation data, the reported average accuracies are $y(k) = R(k) x(k) + r(k).$02 for rotation, $y(k) = R(k) x(k) + r(k).$03 for shear, $y(k) = R(k) x(k) + r(k).$04 for scale, and $y(k) = R(k) x(k) + r(k).$05 for translation. The method does not require the true label, because it uses the model’s original prediction as the reference label (Mekala et al., 2019).

In robotic CPS, a different defense is required because the attack can preserve consistency between commands and observations. The proposed State Monitoring Signature Function (SMSF) evaluates a nonlinear state function $y(k) = R(k) x(k) + r(k).$06 at the plant and compares it with the value reconstructed at the controller. The paper recommends that $y(k) = R(k) x(k) + r(k).$07 be injective, nonlinear, and ideally non-invertible; it gives as an example

$y(k) = R(k) x(k) + r(k).$08

Detection occurs when the received signature no longer matches the controller-side evaluation beyond noise bounds. The same paper also notes a limitation: if an attacker can estimate the signature function from enough samples, the defense may eventually be circumvented (Ueda et al., 2024).

Several misconceptions recur across the literature. One is that ordinary data augmentation provides meaningful protection against affine attacks. The MNIST results contradict this directly: data augmentation still yielded $y(k) = R(k) x(k) + r(k).$09 accuracy under worst-of-10 affine attack and $y(k) = R(k) x(k) + r(k).$10 under grid search, whereas affine-aware adversarial training reached $y(k) = R(k) x(k) + r(k).$11 under worst-of-10 and up to $y(k) = R(k) x(k) + r(k).$12 under grid search (Mayor, 2020). A second is that theoretical indistinguishability automatically carries over to implementation; the floating-point analysis of random affine ciphers reaches the opposite conclusion, reporting fragile security and practical leakage despite favorable real-number theory (Schlüter et al., 2023). A third is that standard residual-based monitoring is sufficient for CPS; the manipulator and mobile-robot results show that coordinated affine falsification can keep the attacker “perfectly hidden” while altering the physical trajectory (Ueda et al., 2024, Ueda et al., 2024).

More broadly, the collected results indicate that affine structure is not merely a geometric nuisance. It can be the attack surface itself, the enabling mechanism for undetectable falsification, the source of cryptanalytic collapse, or a coordinate system for generating more persistent adversarial examples. That breadth is the defining feature of ATA across these literatures.