---
title: 'SAFER: Semantic & Abstract Feature Disruption'
url: https://www.emergentmind.com/topics/semantic-and-abstract-features-disruption-safer
type: topic
---

# SAFER: Semantic & Abstract Feature Disruption

Searching arXiv for the specified SAFER paper and closely related acronym-overlap papers to ground the article in current arXiv records.
arxiv_search.query({"search_query":"all:\"Disrupting Semantic and Abstract Features for Better Adversarial Transferability\" OR id:2507.16052","start":0,"max_results":5})
arxiv_search.query({"search_query":"all:\"Semantic and Abstract FEatures disRuption\"","start":0,"max_results":10})
Semantic and Abstract FEatures disRuption (SAFER) is a transfer-based adversarial attack method for deep neural networks that is designed to improve black-box transferability by disrupting both semantic information in the spatial image domain and abstract, high-frequency information in the frequency domain when estimating feature importance [2507.16052]. The method is motivated by the observation that existing feature-level attacks primarily manipulate semantic information, even though CNNs also rely heavily on high-frequency components such as texture and edges. SAFER therefore computes a feature-importance weight matrix from transformed images produced by combining BlockMix and Self-Mix, and then uses that matrix in an MIM-style iterative optimization to generate adversarial examples with stronger cross-model transfer [2507.16052].

## 1. Research setting and motivating problem

SAFER is situated in the literature on transfer-based attacks, where adversarial examples are crafted on a surrogate model and then evaluated against unseen black-box models. The motivating difficulty is that adversarial perturbations often overfit to the source model and therefore fail to transfer reliably, especially to defended models or to models with different inductive biases [2507.16052].

The paper places SAFER within the family of feature-level attacks, including FIA, RPA, and NAA. In these methods, intermediate features are perturbed using a feature-importance weight matrix computed from transformed images. The critique advanced by SAFER is that prior feature-level attacks mostly rely on spatial-domain transformations such as masking, cropping, patch replacement, or pixel-wise occlusion. Those operations mainly alter semantic content, including object identity, shape, and category-level cues, but do not explicitly account for the high-frequency components on which CNNs are also known to depend [2507.16052].

Within this formulation, semantic features are treated as low-frequency, object/category-level information, while abstract features are treated as high-frequency information including edges, textures, and fine detail. The central hypothesis is that a feature-importance estimator derived from only one of these two views is incomplete. SAFER is proposed as a balanced alternative: it disrupts both semantic and abstract features before computing the weight matrix, and then uses that matrix to guide iterative adversarial optimization [2507.16052].

## 2. Semantic and abstract features as complementary attack targets

A defining claim of SAFER is that low-frequency and high-frequency components contribute different but complementary signals for transferability. The paper validates the relevance of frequency-space perturbation by performing an FIA-inspired experiment on a \(299\times 299\times 3\) input, where random perturbations are added to progressively larger regions in the high-frequency part of the DCT spectrum, using sizes \(\tau \in \{40,140,240\}\). With MIM as the backbone attack and adversarial examples generated on Inc-v3, perturbing the high-frequency region improves transferability over the baseline, and enlarging the perturbed high-frequency area further improves transferability on seven black-box models [2507.16052].

The paper also visualizes images reconstructed from only low-frequency or only high-frequency bands. In that analysis, low-frequency components preserve semantic structure, whereas high-frequency components reveal textures and edges. This supports the paper’s operational distinction between semantic and abstract features and motivates the use of both types of disruption in the feature-importance estimator rather than only spatial semantic perturbation [2507.16052].

A common misconception addressed by the method is that frequency-domain processing is itself the final attack objective. SAFER does not directly attack the frequency domain of the final adversarial image. Instead, frequency transformations are used to build a better feature-importance estimator, which is then used in a standard iterative adversarial update [2507.16052].

## 3. Method architecture: BlockMix, Self-Mix, and balanced feature disruption

SAFER has a three-stage structure: transformed images are first created so that both semantic and abstract features are disrupted; gradients from those transformed images are then accumulated to construct a feature-importance weight matrix \(\Delta\); and finally an adversarial example is optimized against the surrogate model using a feature-level objective weighted by \(\Delta\) [2507.16052].

| Component | Domain | Role |
|---|---|---|
| BlockMix | Spatial | Strengthens semantic disruption |
| Self-Mix | Frequency | Strengthens abstract/high-frequency disruption |
| Weight matrix \(\Delta\) | Intermediate features | Highlights crucial features for attack optimization |

BlockMix operates on the input image in the spatial domain. The image is partitioned into \(n_b \times n_b\) blocks, and some blocks are randomly replaced with corresponding blocks from a different-category image \(\tilde{x}\). The paper defines
$$
BlockMix(x, \tilde{x})_{i,j} =
\begin{cases}
\tilde{x}_{i,j}, & \text{with probability } 1-p,\\
x_{i,j}, & \text{with probability } p,
\end{cases}
$$
where \(p\) is the keep probability. This operator mainly changes semantic content by locally replacing object regions, thereby producing images whose category-level structure is disrupted while remaining usable for feature-importance estimation [2507.16052].

Self-Mix operates in the frequency domain. Let \(\mathcal{D}\) and \(\mathcal{D}^{-1}\) denote the discrete cosine transform and inverse DCT. Given an image \(x\), SAFER defines
$$
Self\text{-}Mix(x, \mu, \beta) = \mathcal{D}^{-1}[\mathcal{D}(x) + \mu \cdot \mathcal{R}(\mathcal{D}(x), \beta)],
$$
where \(\mu \in [0,1]\) is the mixing strength, \(\beta\) is the random rotation angle, and \(\mathcal{R}(\cdot,\beta)\) is the rotation operator in spectrum space. The intent is to perturb the whole spectrum while preserving enough structure that the reconstructed image still resembles the original [2507.16052].

The paper emphasizes that Self-Mix alone does not produce balanced disruption. Because the low-frequency part occupies a small portion of the spectrum, Self-Mix tends to emphasize abstract or high-frequency disturbance more strongly than semantic disturbance. BlockMix is therefore applied first to compensate by increasing semantic disruption. The combination is the basis of SAFER’s “balanced” formulation: BlockMix increases semantic disturbance, and Self-Mix increases abstract or high-frequency disturbance while preserving enough structure for meaningful gradient accumulation [2507.16052].

## 4. Weight-matrix construction and adversarial optimization

After generating transformed views, SAFER computes the feature-importance weight matrix \(\Delta\) in a manner analogous to FIA, but from inputs that have undergone both BlockMix and Self-Mix. For each ensemble sample, the procedure is: sample an image \(\tilde{x}\) from another class, compute \(x_B = BlockMix(x,\tilde{x})\), compute \(x_{SM} = Self\text{-}Mix(x_B,\mu,\beta)\), and accumulate the gradient of the classification loss with respect to the intermediate feature layer. The accumulation rule is
$$
\Delta \gets \Delta + \frac{\partial J(x_{SM}, y; \theta)}{\partial f_k(x)},
$$
followed by normalization
$$
\Delta \gets \Delta / \|\Delta\|_2.
$$
Here, \(J(\cdot)\) is the classification loss, \(f_k(x)\) is the feature map at target layer \(k\), and \(\theta\) denotes model parameters [2507.16052].

The resulting \(\Delta\) is then used in a feature-level loss
$$
L(x^{adv}) = \sum (\Delta \odot f_k(x^{adv})),
$$
where \(\odot\) denotes element-wise multiplication. This objective encourages the adversarial example to perturb feature positions deemed important under the transformed views that jointly disrupt semantic and abstract cues [2507.16052].

SAFER adopts MIM as its backbone optimizer. The iterative update is
$$
g_{t+1} = \mu \cdot g_t + \frac{\nabla_x L(x_t^{adv})}{\|\nabla_x L(x_t^{adv})\|_1},
$$
$$
x_{t+1}^{adv} = \text{Clip}_{x,\epsilon}\left(x_t^{adv} - \alpha \cdot \text{sign}(g_{t+1})\right),
$$
with \(\alpha = \epsilon/T\). The general adversarial objective remains the standard untargeted constrained optimization
$$
x^{adv} = \arg\max_{x'} J(x', y; \theta), \quad \text{s.t. } \|x' - x\|_p \le \epsilon,
$$
with \(p=\infty\) [2507.16052].

The paper’s interpretation is that a weight matrix estimated from both semantic and abstract disruption identifies intermediate features that are more universally used across models. This suggests why the resulting perturbations transfer better in black-box settings: they are less tied to a single feature type or a single surrogate-specific representation [2507.16052].

## 5. Experimental protocol, empirical performance, and ablations

The experimental evaluation uses an ImageNet-compatible dataset of 1,000 images of size \(299\times 299\times 3\). Source models include five CNNs—Inception-v3, Inception-v4, Inception-ResNet-v2, ResNet-v2-152, and VGG-16—and five vision transformers—PiT-B, CaiT-S, DeiT-B, Visformer-S, and Swin-T. The evaluation also includes ensemble adversarially trained models \(Inc\text{-}v3_{\mathrm{ens3}}\), \(Inc\text{-}v3_{\mathrm{ens4}}\), and \(IncRes\text{-}v2_{\mathrm{ens}}\), as well as defenses including HGD, R\&P, NIPS-r3, JPEG, Bit-Red, FD, RS, and NRP. The principal metric is attack success rate (ASR) [2507.16052].

For SAFER itself, the reported hyperparameters are \(n_b = 5\), keep probability \(p = 0.9\), mixing strength \(\mu = 0.4\), rotation angle \(\beta \in [-\pi/4, \pi/4]\), \(\epsilon = 16\), iterations \(T = 10\), step size \(\alpha = 1.6\), and ensemble number \(N = 30\). The target layer is chosen similarly to FIA and NAA; for Inc-v3 the selected layer is Mix5b [2507.16052].

In the single-model setting, SAFER outperforms FIA, RPA, and NAA across black-box models. When adversarial examples are generated on Inc-v3, SAFER improves average black-box performance and beats the strongest baseline, NAA, by about 3.1% on average. On vision transformers, it achieves at least 43.8% ASR on the five ViT targets and outperforms the best baseline by roughly 2.6%–5.9%, indicating that the method is not restricted to CNN-to-CNN transfer [2507.16052].

The paper also reports that SAFER gives the best transferability in ensemble-based attacks and consistently yields the highest ASR against the eight evaluated defenses. It is described as especially strong on JPEG, Bit-Red, and FD, while remaining better than the baselines on all tested defenses [2507.16052].

The ablation studies are central to the method’s interpretation. Using only BlockMix improves black-box transferability substantially over MIM; using only Self-Mix also improves it; and using both together yields the best result. This directly supports the claim that both semantic and abstract disruption matter, and that balanced disruption is preferable to focusing on only one. Transferability improves as \(p\) increases up to around \(0.8\)–\(0.9\), after which performance slightly drops; the chosen default is \(p=0.9\). Increasing \(\mu\) generally improves transferability, with the best balance reported around \(\mu=0.4\). Deeper target layers improve black-box transferability up to a point, but overly deep layers degrade performance, especially on adversarially trained models; for Inc-v3, Mix5b is selected as the best tradeoff [2507.16052].

## 6. Relation to adjacent methods, scope, and acronym overlap

SAFER is explicitly positioned against FIA, RPA, and NAA as a feature-level attack, and it is also evaluated in combination with DIM, Admix, SSA, SGM, LinBP, BPA, EMI, GMI, and VMI. In most such combinations, it either preserves or improves black-box transferability, even if white-box ASR sometimes drops slightly. This clarifies the method’s intended optimization target: transferability rather than maximal source-model attack success [2507.16052].

The comparison with SSA is particularly important because both methods use frequency-domain ideas. The paper distinguishes them sharply: SSA aims to generate diverse spectrum saliency maps, whereas SAFER aims to disrupt semantic and abstract features in order to compute a better feature-importance weight matrix. SAFER uses Self-Mix plus BlockMix, whereas SSA uses Gaussian noise and random scaling in spectrum space. The paper reports that SAFER performs better and can also be combined with SSA [2507.16052].

The reported practical constraints are limited but clear. SAFER still depends on selecting a reasonable target layer and on tuning hyperparameters such as \(p\) and \(\mu\). The evaluation is conducted mainly on ImageNet-scale classification models, and broader validation on other tasks is not shown. A plausible implication is that the method is best understood as a targeted contribution to transfer-based image classification attacks rather than a general account of adversarial transfer across all modalities or tasks [2507.16052].

The acronym “SAFER” is not unique in recent arXiv literature. Distinct methods include “Safe and Reliable Diffusion Models via Subspace Projection” [2503.16835], which uses concept-specific subspaces and projection for concept erasure in text-to-image diffusion models; “SAFER: Probing Safety in Reward Models with Sparse Autoencoder” [2507.00665], which uses sparse autoencoders to interpret and manipulate safety-relevant reward-model features; and “SAFER: Risk-Constrained Sample-then-Filter in Large Language Models” [2510.10193], which is a two-stage conformal risk-control framework for open-ended question answering. A related use of semantic-disruption terminology also appears in generalized AI-generated image detection, where pixel-level mapping is used to disrupt semantic cues and suppress abstract-feature shortcuts [2512.17350]. Within this broader acronym landscape, Semantic and Abstract FEatures disRuption denotes the specific adversarial-transfer method introduced in “Disrupting Semantic and Abstract Features for Better Adversarial Transferability” [2507.16052].

Source: https://www.emergentmind.com/topics/semantic-and-abstract-features-disruption-safer