Invariance-Based Adversarial Examples

• Invariance-based adversarial examples are perturbations that keep a model’s output unchanged despite significant changes in semantic content, challenging traditional robustness metrics.
• They leverage transformation-averaged optimization techniques, averaging gradients over various transformations to enhance black-box transferability of attacks.
• Research reveals a tradeoff between achieving robustness to irrelevant perturbations and failing to detect meaningful semantic shifts, inspiring new defense strategies.

Invariance-based adversarial examples are adversarial phenomena organized around invariances of a model or of an attack objective rather than around local sensitivity alone. In one major line of work, attacks explicitly optimize perturbations to remain effective under families of transformations such as scale changes, translations, crops, affine warps, or structure-preserving local edits, primarily to improve black-box transferability (Lin et al., 2019, Xiang et al., 2021, Yang et al., 2021, Wang et al., 2023). In another, the same phrase denotes a complementary robustness failure: the model’s prediction or internal representation remains unchanged even though the oracle label or semantic content has changed (Jacobsen et al., 2018, Jacobsen et al., 2019, Tramèr et al., 2020). The subject therefore spans both offensive methodology and a broader critique of what it means for a model to be robust.

1. Definitions and scope

For a classifier $f : X \to Y$ and oracle $y^*$, sensitivity-based adversarial examples and invariance-based adversarial examples are complementary. A sensitivity-based example seeks a small perturbation $\delta$ such that $f(x+\delta) \neq f(x)$ while $y^*(x+\delta)=y^*(x)$. An invariance-based example seeks a small perturbation such that $f(x+\delta)=f(x)$ while $y^*(x+\delta)\neq y^*(x)$ (Tramèr et al., 2020). In the $\ell_p$-bounded form emphasized in robustness theory, the latter is

$$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$

A more representation-centric definition uses pre-images. For a deep network $F = f_L \circ \cdots \circ f_1$, one may define the $y^*$0-th layer pre-image $y^*$1, the logit pre-image $y^*$2, or the argmax pre-image $y^*$3, where $y^*$4 is the classifier induced by the logits. Invariance-based examples then alter oracle semantics while remaining in one of these pre-images (Jacobsen et al., 2018).

The transformation-based attack literature uses a related but distinct notion of invariance. There the objective is not semantic label change, but attack persistence under a transformation family. The generic mechanism is an expectation over transformations: gradients are averaged over transformed inputs, or are made invariant by operators such as convolution, so that the resulting perturbation does not overfit a single surrogate-model view of the input (Wang et al., 2023).

A nomenclature ambiguity has appeared in later work. In "Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks," NI-FGSM denotes Nesterov Iterative FGSM (Lin et al., 2019). In "A New Type of Adversarial Examples," NI-FGSM denotes Negative Iterative FGSM, which minimizes the loss while forcing the example to move far from the original input (Nie et al., 22 Oct 2025). The acronyms are identical, but the objectives are unrelated.

2. Transformation-averaged optimization

The technical core of transfer-oriented invariance attacks is the Expectation over Transformations principle. Given a transformation distribution $y^*$5, one estimates

$y^*$6

thereby shaping the perturbation toward directions that consistently increase loss across transformed inputs (Wang et al., 2023). This is the unifying template behind diverse-input, scale-invariant, admix-based, and structure-preserving attacks.

Different methods instantiate different invariance assumptions. DIM averages over random resize-and-pad transformations; TIM uses a convolution $y^*$7 to approximate translation averaging; SIM averages gradients over multiple scaled copies of the same image; Admix averages over images admixed with small portions of add-in images from other categories; SSA diversifies gradients in the frequency domain (Wang et al., 2023). The common motivation is that iterative white-box optimization can overfit surrogate-specific details, and transformation averaging reshapes the gradient toward features that are more model-agnostic.

This attack logic is explicitly tied to empirical invariances of modern architectures. The SIM work reports that CNN losses are approximately preserved over a broad scale range, roughly $y^*$8, and uses that observation to average gradients across scaled copies of the input (Lin et al., 2019). Later work extends the same logic to affine transformations in Cartesian and polar coordinates, to local blockwise structure-preserving transforms, to crop-and-pad families, and to local translations of the perturbation itself (Xiang et al., 2021, Wang et al., 2023, Yang et al., 2021, Liu et al., 8 Mar 2025).

3. Major transfer-oriented invariance methods

"Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks" introduced two influential building blocks. NI-FGSM computes gradients at a look-ahead point $y^*$9, then accumulates Nesterov-style momentum using $\delta$0-normalized gradients; SIM replaces single-scale gradients with

$\delta$1

Their integration, NI-SI-FGSM, evaluates scale-averaged gradients at the look-ahead point. On ImageNet, gains of $\delta$2 over baselines were common in black-box settings, white-box success remained near $\delta$3, SI-NI-TI-DIM reached an average $\delta$4 success rate against adversarially trained models, and the same method achieved $\delta$5 average success across advanced defenses including HGD, R&P, NIPS-r3, FD, ComDefend, and RS (Lin et al., 2019).

"Structure Invariant Transformation for better Adversarial Transferability" generalized the transformation family from global image operations to blockwise local operations under a global structure constraint. SIA partitions the image into $\delta$6 non-overlapping blocks, samples one of ten transformations per block, recomposes the transformed blocks, and averages gradients over $\delta$7 such transformed images at each iteration. The ten per-block transforms are vertical shift, horizontal shift, vertical flip, horizontal flip, $\delta$8 rotation, intensity scaling, additive noise, resize, DCT high-frequency suppression, and dropout. With $\delta$9 and $f(x+\delta) \neq f(x)$0, SIA consistently outperformed DIM, TIM, DEM, Admix, and SSA across CNNs and transformers; in ensemble-source transfer it achieved at least $f(x+\delta) \neq f(x)$1 success across all models, reached $f(x+\delta) \neq f(x)$2 on ViT and $f(x+\delta) \neq f(x)$3 on Swin from a CNN ensemble, achieved $f(x+\delta) \neq f(x)$4 on certified randomized smoothing, and reached at least $f(x+\delta) \neq f(x)$5 on eight other defenses (Wang et al., 2023).

"Improving the Robustness of Adversarial Attacks Using an Affine-Invariant Gradient Estimator" replaced explicit EOT sampling with a kernelized approximation. The affine-invariant estimator is

$f(x+\delta) \neq f(x)$6

where $f(x+\delta) \neq f(x)$7 handles translations in Cartesian coordinates and $f(x+\delta) \neq f(x)$8 handles rotation and scale in polar coordinates. This yields EOT-like robustness with a single gradient plus convolutions and coordinate transforms. AI-DIM averaged $f(x+\delta) \neq f(x)$9, $y^*(x+\delta)=y^*(x)$0, and $y^*(x+\delta)=y^*(x)$1 ASR on Inc-v3, Inc-v4, and Ens-AT, compared with EOT’s $y^*(x+\delta)=y^*(x)$2, $y^*(x+\delta)=y^*(x)$3, and $y^*(x+\delta)=y^*(x)$4, and on 1,000 ImageNet images AI-DIM required 566 seconds versus EOT’s 56,580 seconds (Xiang et al., 2021).

"Adversarial example generation with AdaBelief Optimizer and Crop Invariance" introduced CIM, which averages gradients over random crops with side length $y^*(x+\delta)=y^*(x)$5 and random padding back to $y^*(x+\delta)=y^*(x)$6, together with ABI-FGM, which uses AdaBelief rather than momentum or Adam-style updates. Under an ensemble source of Inc-v3, Inc-v4, IncRes-v2, and Res-101, CI-AB-SI-TI-DIM reached an average success rate of $y^*(x+\delta)=y^*(x)$7, exceeding CI-AB-SIM at $y^*(x+\delta)=y^*(x)$8 and SI-NI-TI-DIM at $y^*(x+\delta)=y^*(x)$9 (Yang et al., 2021).

"Boosting the Local Invariance for Better Adversarial Transferability" shifted the focus from transforming the input to translating the perturbation relative to a fixed clean image. It defined local invariance as

$f(x+\delta)=f(x)$0

and optimized a max-min objective over locally translated perturbations. LI-Boost used random translation sampling with default $f(x+\delta)=f(x)$1, $f(x+\delta)=f(x)$2, and logarithmic sampling. On ImageNet, MI-FGSM improved from $f(x+\delta)=f(x)$3 ASR with local invariance $f(x+\delta)=f(x)$4 to $f(x+\delta)=f(x)$5 with local invariance $f(x+\delta)=f(x)$6; DIM improved from $f(x+\delta)=f(x)$7 and $f(x+\delta)=f(x)$8 to $f(x+\delta)=f(x)$9 and $y^*(x+\delta)\neq y^*(x)$0; and LI-Boost-SIA raised ViT transfer from $y^*(x+\delta)\neq y^*(x)$1 to $y^*(x+\delta)\neq y^*(x)$2 and HGD transfer from $y^*(x+\delta)\neq y^*(x)$3 to $y^*(x+\delta)\neq y^*(x)$4 (Liu et al., 8 Mar 2025).

Taken together, these attacks show that invariance can be imposed at multiple levels: global transformations, local structure-preserving edits, explicit affine robustness, crop robustness, and perturbation-local robustness. The recurring empirical result is that the more the attack avoids surrogate-specific overfitting, the better its transfer.

4. Excessive invariance and semantic attacks

The semantic notion of invariance-based adversarial examples treats invariance itself as the vulnerability. "Excessive Invariance Causes Adversarial Vulnerability" showed that on MNIST and ImageNet one can manipulate class-specific content without changing hidden activations, and in invertible networks this can be done analytically by fixing the semantic part of the representation while replacing nuisance variables (Jacobsen et al., 2018). In non-bijective models such as ResNet152, the same paper used a logit-matching objective,

$y^*(x+\delta)\neq y^*(x)$5

optimized with Adam at learning rate $y^*(x+\delta)\neq y^*(x)$6 for 3000 iterations, to construct feature adversaries with matched logits but altered semantic appearance (Jacobsen et al., 2018).

"Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness" operationalized semantic change with human labeling and showed that invariance-based attacks can occur within the same $y^*(x+\delta)\neq y^*(x)$7 balls used for perturbation robustness. On MNIST, human studies found $y^*(x+\delta)\neq y^*(x)$8 success for $y^*(x+\delta)\neq y^*(x)$9 invariance attacks and $\ell_p$0 for $\ell_p$1 invariance attacks; clean images had $\ell_p$2 success by construction. Robust models often agreed with humans less than undefended baselines: for successful $\ell_p$3 invariance examples, the dedicated $\ell_p$4-robust sparse Fourier classifier agreed with humans only $\ell_p$5, versus $\ell_p$6 for the baseline model (Jacobsen et al., 2019).

"Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations" made the tradeoff more explicit. On MNIST, automatic $\ell_p$7 invariance attacks succeeded on $\ell_p$8 of examples at $\ell_p$9 and $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$0 at $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$1, while manual $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$2 editing reached $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$3 at $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$4 and $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$5 at $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$6. A certified model with certified $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$7 test accuracy under $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$8 retained its original predictions on these examples as required by certification, yet matched human-assigned labels on only $$\|\delta\|_p \le \epsilon,\qquad f(x+\delta)=f(x),\qquad y^*(x+\delta)\neq y^*(x).$$9 of automatically generated invariance examples and $F = f_L \circ \cdots \circ f_1$0 of manual ones (Tramèr et al., 2020). Prediction stability inside the ball therefore did not imply semantic correctness.

A more extreme extension appears in "A New Type of Adversarial Examples," where the objective is not bounded semantic change inside an $F = f_L \circ \cdots \circ f_1$1 ball but movement far away from the original input while preserving the same class: $F = f_L \circ \cdots \circ f_1$2 The paper introduced Negative Iterative FGSM, Negative Iterative FGM, and momentum variants. With perturbation size 10,000, $F = f_L \circ \cdots \circ f_1$3, and $F = f_L \circ \cdots \circ f_1$4, source Inc-v3 retained white-box recognition at about $F = f_L \circ \cdots \circ f_1$5 for NMI-FGSM and about $F = f_L \circ \cdots \circ f_1$6 for NMI-FGM, while black-box rates on other models were around $F = f_L \circ \cdots \circ f_1$7 (Nie et al., 22 Oct 2025). This supports the claim that far-away invariance regions can be extensive but highly model-specific.

5. Theoretical explanations

One theoretical account attributes adversarial sensitivity to topology. "Adversarial Examples from Dimensional Invariance" argues that models trained to behave approximately bijectively over data while mapping $F = f_L \circ \cdots \circ f_1$8 with $F = f_L \circ \cdots \circ f_1$9 must realize approximate discontinuities, by invariance of dimension. The paper quantified effective injectivity with

$y^*$00

reporting $y^*$01 on FashionMNIST, $y^*$02 on MNIST, $y^*$03 on CIFAR10, and $y^*$04 on CIFAR100 after removing duplicates. It also defined an output expansion ratio $y^*$05 comparing adversarial and random directions, and found that $y^*$06 increased substantially as $y^*$07 for classifiers and GANs, while overcomplete autoencoders and denoising diffusion autoencoders showed little or no such growth (Badger, 2023).

A second account studies architectural invariance directly. "Shift Invariance Can Reduce Adversarial Robustness" proved that a circular-shift-invariant linear classifier must use a weight vector $y^*$08, so the decision depends only on the DC component of the signal. The corresponding margin is

$y^*$09

and, under $y^*$10 perturbations with $y^*$11, the minimal adversarial threshold scales as $y^*$12. Empirically, increasing circular-padding-based shift invariance reduced robustness on MNIST, and similar trends were reported on Fashion-MNIST, SVHN, ImageNet, and CIFAR-10 (Ge et al., 2021).

A third line formalizes a robustness tradeoff induced by metric misalignment. "Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations" defined $y^*$13 as the smallest perturbation that changes the oracle label and argued that if a model is made robust for $y^*$14, then the closest different-class point becomes an invariance-based adversarial example. The same paper also proved that if a distance metric were perfectly aligned with the oracle, then a 1-NN classifier using that metric could exactly match the oracle, implying that oracle-aligned metrics are essentially as hard as the classification problem itself (Tramèr et al., 2020).

These theories are not identical, but they are compatible. The dimensional-invariance account emphasizes discontinuity pressure from unequal dimensions; the shift-invariance account emphasizes margin collapse onto invariant statistics; the metric-misalignment account emphasizes the impossibility of using simple geometric balls as proxies for semantics. All three explain why robustness to one family of perturbations can induce or reveal vulnerability elsewhere.

6. Training and defense responses

The most direct response to excessive invariance is to modify the objective. "Excessive Invariance Causes Adversarial Vulnerability" argued that standard cross-entropy maximizes predictiveness in the semantic coordinates $y^*$15 but does not penalize label information left in nuisance coordinates $y^*$16. It proposed independence cross-entropy, a min-max objective that adds a nuisance classifier and a maximum-likelihood factorization term to drive $y^*$17 toward zero. On binary shiftMNIST, shifted-test error fell from $y^*$18 for a CE-trained fi-RevNet to $y^*$19 for iCE; on textured shiftMNIST, it fell from $y^*$20 to $y^*$21 (Jacobsen et al., 2018).

A more recent defense perspective appears in "Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off." This paper argues that naive invariance regularization can itself create harmful invariance by inducing gradient conflict between classification and invariance objectives and by mixing clean and adversarial BatchNorm statistics. AR-AT addresses these issues with an asymmetric invariance loss, stop-gradient on clean features, a predictor applied only to adversarial features, and split-BN. On CIFAR-10 with ResNet-18, AR-AT achieved $y^*$22 clean and $y^*$23 AutoAttack robust accuracy, compared with AT at $y^*$24 and TRADES at $y^*$25; on Imagenette with ResNet-18, it reached $y^*$26 clean and $y^*$27 AutoAttack (Waseda et al., 2024).

"On the Effect of Adversarial Training Against Invariance-based Adversarial Examples" examined direct training on invariance-based examples. A key empirical finding was that algorithm-defined labels for such examples were often wrong, and human-determined labels were necessary. On MNIST, a standard-trained model had $y^*$28 clean accuracy, $y^*$29 perturbation robustness, and $y^*$30 invariance robustness; PGD adversarial training shifted this to $y^*$31, $y^*$32, and $y^*$33. Simultaneous training with PGD examples and human-labeled invariance examples yielded $y^*$34 clean accuracy, $y^*$35 perturbation robustness, and $y^*$36 invariance robustness, and dominated combined robustness over $y^*$37, where $y^*$38 is the fraction of invariance-based attacks in a mixed threat model (Rauter et al., 2023).

Related work on invariant representation learning treats robustness to transformation-based attacks as equivalent to invariance to the corresponding family of transformations. "A Cyclically-Trained Adversarial Network for Invariant Representation Learning" learned a single latent representation invariant to a specified factor such as identity or style, while preserving unspecified factors such as pose or illumination. It used image-space adversarial training plus forward and backward cycles, and reported state-of-the-art performance on 3D Chairs, YaleFace, and UPNA Synthetic (Chen et al., 2019). Although this work targets conditional generation rather than standard classifier robustness, it shows how transformation invariance can be deliberately built into a representation rather than only exploited by an attack.

7. Evaluation challenges and open directions

A recurrent difficulty is that prediction invariance and semantic correctness are different evaluation targets. Certified robustness methods typically certify statements of the form $y^*$39 for all $y^*$40; they do not certify $y^*$41. The invariance literature repeatedly shows that this distinction matters in practice (Tramèr et al., 2020). A closely related issue is labeling: for semantic invariance attacks, oracle labels cannot be inferred from the source label, and human labeling was found necessary because algorithm-defined labels were incorrect (Rauter et al., 2023).

A second challenge is computational. SIM requires roughly $y^*$42-times the forward and backward passes per iteration, with cost scaling linearly in the number of scales (Lin et al., 2019). SIA improves steadily up to $y^*$43 transformed images per iteration and then saturates (Wang et al., 2023). LI-Boost uses $y^*$44 random perturbation translations as a practical compromise (Liu et al., 8 Mar 2025). CIM uses $y^*$45 random crops per step (Yang et al., 2021). The affine-invariant estimator is notable because it reduced runtime from 56,580 seconds for EOT to 566 seconds on 1,000 ImageNet images while improving success rates (Xiang et al., 2021).

The scope of transformation families also remains open. The SIM paper explicitly notes that the invariance principle extends beyond $y^*$46 classification to other norms, tasks such as detection and segmentation, and richer expectation-over-transformations families including translations, rotations, and color jitter (Lin et al., 2019). The semantic-invariance literature adds a different open problem: far-away invariance regions appear to be extensive but model-specific, with very low transfer across architectures (Nie et al., 22 Oct 2025). This suggests that a complete robustness evaluation must combine transfer-oriented invariance attacks, semantic invariance attacks, and ordinary sensitivity-based attacks rather than treating any one of them as exhaustive.

The broader implication is that invariance is neither uniformly desirable nor uniformly harmful. In one regime it is the mechanism that makes black-box attacks transferable; in another it is the pathology that lets models ignore semantic change. The modern literature increasingly treats robustness as the problem of controlling both sides simultaneously: sensitivity to non-semantic perturbations and invariance to semantic ones.