SAFER: Semantic & Abstract Feature Disruption

• The paper introduces SAFER, a method that disrupts both semantic content and high-frequency features to improve adversarial transferability.
• SAFER combines BlockMix for spatial semantic disruption with Self-Mix for abstract (frequency-domain) perturbation to build a balanced feature-importance estimator.
• Empirical results on CNNs and vision transformers show SAFER achieves up to a 3.1% higher attack success rate against black-box models compared to prior methods.

Searching arXiv for the specified SAFER paper and closely related acronym-overlap papers to ground the article in current arXiv records. arxiv_search.query({"^^^^^^^^7search_query7 Semantic and Abstract Features for Better Adversarial Transferability\"^^^^^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^^^^^"," arxiv_search.query({"^^^^^^^^7search_query7 and Abstract FEatures disRuption\"","^^^^^^^^7start7 Semantic and Abstract FEatures disRuption (SAFER) is a transfer-based adversarial attack method for deep neural networks that is designed to improve black-box transferability by disrupting both semantic information in the spatial image domain and abstract, high-frequency information in the frequency domain when estimating feature importance (&&&^^^^7search_query7^^^^&&&). The method is motivated by the observation that existing feature-level attacks primarily manipulate semantic information, even though CNNs also rely heavily on high-frequency components such as texture and edges. SAFER therefore computes a feature-importance weight matrix from transformed images produced by combining BlockMix and Self-Mix, and then uses that matrix in an MIM-style iterative optimization to generate adversarial examples with stronger cross-model transfer (&&&^^^^7search_query7^^^^&&&).

^^^^7all:\7^^^^. Research setting and motivating problem

SAFER is situated in the literature on transfer-based attacks, where adversarial examples are crafted on a surrogate model and then evaluated against unseen black-box models. The motivating difficulty is that adversarial perturbations often overfit to the source model and therefore fail to transfer reliably, especially to defended models or to models with different inductive biases (&&&^^^^7search_query7^^^^&&&).

The paper places SAFER within the family of feature-level attacks, including FIA, RPA, and NAA. In these methods, intermediate features are perturbed using a feature-importance weight matrix computed from transformed images. The critique advanced by SAFER is that prior feature-level attacks mostly rely on spatial-domain transformations such as masking, cropping, patch replacement, or pixel-wise occlusion. Those operations mainly alter semantic content, including object identity, shape, and category-level cues, but do not explicitly account for the high-frequency components on which CNNs are also known to depend (&&&^^^^7search_query7^^^^&&&).

Within this formulation, semantic features are treated as low-frequency, object/category-level information, while abstract features are treated as high-frequency information including edges, textures, and fine detail. The central hypothesis is that a feature-importance estimator derived from only one of these two views is incomplete. SAFER is proposed as a balanced alternative: it disrupts both semantic and abstract features before computing the weight matrix, and then uses that matrix to guide iterative adversarial optimization (&&&^^^^7search_query7^^^^&&&).

^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^. Semantic and abstract features as complementary attack targets

A defining claim of SAFER is that low-frequency and high-frequency components contribute different but complementary signals for transferability. The paper validates the relevance of frequency-space perturbation by performing an FIA-inspired experiment on a PRESERVED_PLACEHOLDER_^^^^7search_query7^^^^ input, where random perturbations are added to progressively larger regions in the high-frequency part of the DCT spectrum, using sizes PRESERVED_PLACEHOLDER_^^^^7all:\7^^^^. With MIM as the backbone attack and adversarial examples generated on Inc-v^^^^7start7^^^^, perturbing the high-frequency region improves transferability over the baseline, and enlarging the perturbed high-frequency area further improves transferability on seven black-box models (&&&^^^^7search_query7^^^^&&&).

The paper also visualizes images reconstructed from only low-frequency or only high-frequency bands. In that analysis, low-frequency components preserve semantic structure, whereas high-frequency components reveal textures and edges. This supports the paper’s operational distinction between semantic and abstract features and motivates the use of both types of disruption in the feature-importance estimator rather than only spatial semantic perturbation (&&&^^^^7search_query7^^^^&&&).

A common misconception addressed by the method is that frequency-domain processing is itself the final attack objective. SAFER does not directly attack the frequency domain of the final adversarial image. Instead, frequency transformations are used to build a better feature-importance estimator, which is then used in a standard iterative adversarial update (&&&^^^^7search_query7^^^^&&&).

^^^^7start7^^^^. Method architecture: BlockMix, Self-Mix, and balanced feature disruption

SAFER has a three-stage structure: transformed images are first created so that both semantic and abstract features are disrupted; gradients from those transformed images are then accumulated to construct a feature-importance weight matrix PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^; and finally an adversarial example is optimized against the surrogate model using a feature-level objective weighted by PRESERVED_PLACEHOLDER_^^^^7start7^^^^ (&&&^^^^7search_query7^^^^&&&).

Component	Domain	Role
BlockMix	Spatial	Strengthens semantic disruption
Self-Mix	Frequency	Strengthens abstract/high-frequency disruption
Weight matrix PRESERVED_PLACEHOLDER_^^^^7max_results7^^^^	Intermediate features	Highlights crucial features for attack optimization

BlockMix operates on the input image in the spatial domain. The image is partitioned into PRESERVED_PLACEHOLDER_^^^^7search_query7^^^^ blocks, and some blocks are randomly replaced with corresponding blocks from a different-category image PRESERVED_PLACEHOLDER_^^^^7all:\7^^^^. The paper defines

$$BlockMix(x, \tilde{x})_{i,j} = \begin{cases} \tilde{x}_{i,j}, & \text{with probability } 1-p,\ x_{i,j}, & \text{with probability } p, \end{cases}$$

where $p$ is the keep probability. This operator mainly changes semantic content by locally replacing object regions, thereby producing images whose category-level structure is disrupted while remaining usable for feature-importance estimation (&&&^^^^7search_query7^^^^&&&).

Self-Mix operates in the frequency domain. Let $\mathcal{D}$ and PRESERVED_PLACEHOLDER_^^^^7all:\7search_query7^^^^ denote the discrete cosine transform and inverse DCT. Given an image PRESERVED_PLACEHOLDER_^^^^7all:\7all:\7^^^^, SAFER defines

PRESERVED_PLACEHOLDER_^^^^7all:\7 OR id:(Luo et al., 21 Jul 2025)7^^^^

where PRESERVED_PLACEHOLDER_^^^^7all:\7start7^^^^ is the mixing strength, PRESERVED_PLACEHOLDER_^^^^7all:\7max_results7^^^^ is the random rotation angle, and PRESERVED_PLACEHOLDER_^^^^7all:\7search_query7^^^^ is the rotation operator in spectrum space. The intent is to perturb the whole spectrum while preserving enough structure that the reconstructed image still resembles the original (&&&^^^^7search_query7^^^^&&&).

The paper emphasizes that Self-Mix alone does not produce balanced disruption. Because the low-frequency part occupies a small portion of the spectrum, Self-Mix tends to emphasize abstract or high-frequency disturbance more strongly than semantic disturbance. BlockMix is therefore applied first to compensate by increasing semantic disruption. The combination is the basis of SAFER’s “balanced” formulation: BlockMix increases semantic disturbance, and Self-Mix increases abstract or high-frequency disturbance while preserving enough structure for meaningful gradient accumulation (&&&^^^^7search_query7^^^^&&&).

^^^^7max_results7^^^^. Weight-matrix construction and adversarial optimization

After generating transformed views, SAFER computes the feature-importance weight matrix PRESERVED_PLACEHOLDER_^^^^7all:\7all:\7^^^^ in a manner analogous to FIA, but from inputs that have undergone both BlockMix and Self-Mix. For each ensemble sample, the procedure is: sample an image PRESERVED_PLACEHOLDER_^^^^7all:\77^^^^ from another class, compute PRESERVED_PLACEHOLDER_^^^^7all:\7^^^^8, compute PRESERVED_PLACEHOLDER_^^^^7all:\7^^^^9, and accumulate the gradient of the classification loss with respect to the intermediate feature layer. The accumulation rule is

PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7search_query7^^^^

followed by normalization

PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7all:\7^^^^

Here, PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7 OR id:(Luo et al., 21 Jul 2025)7^^^^ is the classification loss, PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7start7^^^^ is the feature map at target layer PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7max_results7^^^^, and PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7search_query7^^^^ denotes model parameters (&&&^^^^7search_query7^^^^&&&).

The resulting PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7all:\7^^^^ is then used in a feature-level loss

PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)77^^^^

where PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^8 denotes element-wise multiplication. This objective encourages the adversarial example to perturb feature positions deemed important under the transformed views that jointly disrupt semantic and abstract cues (&&&^^^^7search_query7^^^^&&&).

SAFER adopts MIM as its backbone optimizer. The iterative update is

PRESERVED_PLACEHOLDER_^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^9

PRESERVED_PLACEHOLDER_^^^^7start7search_query7^^^^

with PRESERVED_PLACEHOLDER_^^^^7start7all:\7^^^^. The general adversarial objective remains the standard untargeted constrained optimization

PRESERVED_PLACEHOLDER_^^^^7start7 OR id:(Luo et al., 21 Jul 2025)7^^^^

with PRESERVED_PLACEHOLDER_^^^^7start7start7^^^^ (&&&^^^^7search_query7^^^^&&&).

The paper’s interpretation is that a weight matrix estimated from both semantic and abstract disruption identifies intermediate features that are more universally used across models. This suggests why the resulting perturbations transfer better in black-box settings: they are less tied to a single feature type or a single surrogate-specific representation (&&&^^^^7search_query7^^^^&&&).

^^^^7search_query7^^^^. Experimental protocol, empirical performance, and ablations

The experimental evaluation uses an ImageNet-compatible dataset of ^^^^7all:\7^^^^,^^^^7search_query7search_query7search_query7^^^^ images of size PRESERVED_PLACEHOLDER_^^^^7start7max_results7^^^^. Source models include five CNNs—Inception-v^^^^7start7^^^^, Inception-v^^^^7max_results7^^^^, Inception-ResNet-v^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^, ResNet-v^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^-^^^^7all:\7search_query7 OR id:(Luo et al., 21 Jul 2025)7^^^^, and VGG-^^^^7all:\7all:\7^^^^—and five vision transformers—PiT-B, CaiT-S, DeiT-B, Visformer-S, and Swin-T. The evaluation also includes ensemble adversarially trained models PRESERVED_PLACEHOLDER_^^^^7start7search_query7^^^^, PRESERVED_PLACEHOLDER_^^^^7start7all:\7^^^^, and PRESERVED_PLACEHOLDER_^^^^7start77^^^^, as well as defenses including HGD, R&P, NIPS-r^^^^7start7^^^^, JPEG, Bit-Red, FD, RS, and NRP. The principal metric is attack success rate (ASR) (&&&^^^^7search_query7^^^^&&&).

For SAFER itself, the reported hyperparameters are PRESERVED_PLACEHOLDER_^^^^7start7^^^^8, keep probability PRESERVED_PLACEHOLDER_^^^^7start7^^^^9, mixing strength PRESERVED_PLACEHOLDER_^^^^7max_results7search_query7^^^^, rotation angle PRESERVED_PLACEHOLDER_^^^^7max_results7all:\7^^^^, PRESERVED_PLACEHOLDER_^^^^7max_results7 OR id:(Luo et al., 21 Jul 2025)7^^^^, iterations PRESERVED_PLACEHOLDER_^^^^7max_results7start7^^^^, step size PRESERVED_PLACEHOLDER_^^^^7max_results7max_results7^^^^, and ensemble number PRESERVED_PLACEHOLDER_^^^^7max_results7search_query7^^^^. The target layer is chosen similarly to FIA and NAA; for Inc-v^^^^7start7^^^^ the selected layer is Mix^^^^7search_query7^^^^b (&&&^^^^7search_query7^^^^&&&).

In the single-model setting, SAFER outperforms FIA, RPA, and NAA across black-box models. When adversarial examples are generated on Inc-v^^^^7start7^^^^, SAFER improves average black-box performance and beats the strongest baseline, NAA, by about ^^^^7start7^^^^.^^^^7all:\7 on average. On vision transformers, it achieves at least ^^^^7max_results7start7^^^^.8% ASR on the five ViT targets and outperforms the best baseline by roughly ^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^.^^^^7all:\7^^^^%– indicating that the method is not restricted to CNN-to-CNN transfer (&&&^^^^7search_query7^^^^&&&).

The paper also reports that SAFER gives the best transferability in ensemble-based attacks and consistently yields the highest ASR against the eight evaluated defenses. It is described as especially strong on JPEG, Bit-Red, and FD, while remaining better than the baselines on all tested defenses (&&&^^^^7search_query7^^^^&&&).

The ablation studies are central to the method’s interpretation. Using only BlockMix improves black-box transferability substantially over MIM; using only Self-Mix also improves it; and using both together yields the best result. This directly supports the claim that both semantic and abstract disruption matter, and that balanced disruption is preferable to focusing on only one. Transferability improves as PRESERVED_PLACEHOLDER_^^^^7max_results7all:\7^^^^ increases up to around PRESERVED_PLACEHOLDER_^^^^7max_results77^^^^–PRESERVED_PLACEHOLDER_^^^^7max_results7 after which performance slightly drops; the chosen default is PRESERVED_PLACEHOLDER_^^^^7max_results7^^^^9. Increasing PRESERVED_PLACEHOLDER_^^^^7search_query7search_query7^^^^ generally improves transferability, with the best balance reported around PRESERVED_PLACEHOLDER_^^^^7search_query7all:\7^^^^. Deeper target layers improve black-box transferability up to a point, but overly deep layers degrade performance, especially on adversarially trained models; for Inc-v^^^^7start7^^^^, Mix^^^^7search_query7^^^^b is selected as the best tradeoff (&&&^^^^7search_query7^^^^&&&).

^^^^7all:\7^^^^. Relation to adjacent methods, scope, and acronym overlap

SAFER is explicitly positioned against FIA, RPA, and NAA as a feature-level attack, and it is also evaluated in combination with DIM, Admix, SSA, SGM, LinBP, BPA, EMI, GMI, and VMI. In most such combinations, it either preserves or improves black-box transferability, even if white-box ASR sometimes drops slightly. This clarifies the method’s intended optimization target: transferability rather than maximal source-model attack success (&&&^^^^7search_query7^^^^&&&).

The comparison with SSA is particularly important because both methods use frequency-domain ideas. The paper distinguishes them sharply: SSA aims to generate diverse spectrum saliency maps, whereas SAFER aims to disrupt semantic and abstract features in order to compute a better feature-importance weight matrix. SAFER uses Self-Mix plus BlockMix, whereas SSA uses Gaussian noise and random scaling in spectrum space. The paper reports that SAFER performs better and can also be combined with SSA (&&&^^^^7search_query7^^^^&&&).

The reported practical constraints are limited but clear. SAFER still depends on selecting a reasonable target layer and on tuning hyperparameters such as PRESERVED_PLACEHOLDER_^^^^7search_query7 OR id:(Luo et al., 21 Jul 2025)7^^^^ and PRESERVED_PLACEHOLDER_^^^^7search_query7start7^^^^. The evaluation is conducted mainly on ImageNet-scale classification models, and broader validation on other tasks is not shown. A plausible implication is that the method is best understood as a targeted contribution to transfer-based image classification attacks rather than a general account of adversarial transfer across all modalities or tasks (&&&^^^^7search_query7^^^^&&&).

The acronym “SAFER” is not unique in recent arXiv literature. Distinct methods include “Safe and Reliable Diffusion Models via Subspace Projection” (&&&^^^^7 OR id:(Luo et al., 21 Jul 2025)7search_query7^^^^&&&), which uses concept-specific subspaces and projection for concept erasure in text-to-image diffusion models; “SAFER: Probing Safety in Reward Models with Sparse Autoencoder” (&&&^^^^7 OR id:(Luo et al., 21 Jul 2025)7all:\7^^^^&&&), which uses sparse autoencoders to interpret and manipulate safety-relevant reward-model features; and “SAFER: Risk-Constrained Sample-then-Filter in LLMs” (&&&^^^^7 OR id:(Luo et al., 21 Jul 2025)77^^^^&&&), which is a two-stage conformal risk-control framework for open-ended question answering. A related use of semantic-disruption terminology also appears in generalized AI-generated image detection, where pixel-level mapping is used to disrupt semantic cues and suppress abstract-feature shortcuts (&&&^^^^7 OR id:(Luo et al., 21 Jul 2025)7^^^^8&&&). Within this broader acronym landscape, Semantic and Abstract FEatures disRuption denotes the specific adversarial-transfer method introduced in “Disrupting Semantic and Abstract Features for Better Adversarial Transferability” (&&&^^^^7search_query7^^^^&&&).