---
title: Transfer Attacks in Adversarial ML
url: https://www.emergentmind.com/topics/transfer-attacks
type: topic
---

# Transfer Attacks in Adversarial ML

Transfer attacks are adversarial attacks where perturbations crafted to fool a source (“surrogate”) model are deployed against a distinct, usually black-box, target model. Transfer attacks exploit the transferability property of adversarial examples—the empirical phenomenon that adversarial examples generated with respect to one model’s inputs and learned decision boundaries often cause misclassification by other, even architecturally unrelated, models. As the dominant practical threat vector in black-box settings where direct access to victim model internals is unavailable, transfer attacks have become a central focus in the evaluation of the robustness of machine learning systems, affecting computer vision, natural language processing, and code models.

## 1. Formal Definitions and Theoretical Foundations

A transfer attack is defined as a two-stage process: 
1. **Attack generation:** Given a surrogate model \(f_s\) (fully accessible to the attacker), an adversarial example \(x' = x + \delta\) is computed such that \(f_s(x') \neq y\) for original label \(y\) and norm-constrained perturbation \(\|\delta\|_p \leq \epsilon\).
2. **Attack transfer:** The adversarial example is then evaluated on a target black-box model \(f_t\); the attack is successful if \(f_t(x') \neq y\).

The **transferability** of such attacks can be formalized as the target model’s loss induced by the surrogate’s adversarial perturbation:
\[
T(\hat{\delta}; f_s \rightarrow f_t) = \ell(y, x + \hat{\delta}, w)
\]
where \(w\) denotes the parameters of the target and \(\hat{\delta}\) is optimal for the surrogate [1809.02861].

Key quantitative metrics include:
- **Attack Success Rate (ASR):** Fraction of adversarial examples that induce misclassification on the target.
- **Transfer ASR (T-ASR):** Evaluated across all attacks and models, reflecting black-box robustness [2503.01865].

Transferability is fundamentally governed by:
- The **intrinsic adversarial vulnerability** (norm of input gradients) of the target.
- The **gradient alignment** (cosine similarity) and complexity between surrogate and target.
- The **loss-landscape variability** of the surrogate, indicating attack stability [1809.02861].

These provide a basis for bounding (or explaining) black-box vs. white-box effect asymptotics and suggest practical strategies for attacker surrogate selection and defensive regularization. Notably, the size of the L2-norm of perturbations, not the L-infinity norm, proves most predictive for real-world success [2204.04063].

## 2. Methodologies for Transfer Attack Generation

Transfer attacks subsume a variety of families ([2211.09565], [2303.15754], [2505.19613]):

| Category                | Representative Methods              | Key Principles             |
|-------------------------|-------------------------------------|----------------------------|
| Gradient Stabilization  | MI-FGSM, NI-FGSM                    | Momentum, Nesterov steps   |
| Input Augmentation      | DI, TI, SI, VT, Admix               | Diverse transforms         |
| Feature Disruption      | TAP, FIA, ILA, NAA                  | Intermediate-layer targeting|
| Surrogate Refinement    | SGM, LinBP, RFA, IAA, DSM           | Surrogate model tweaks     |
| Generative Modeling     | GAP, CDA, GAPF, Dual-Flow           | One-shot generator-based   |

Iterative methods such as MI-FGSM accumulate gradient momentum, early stopping at ~10 iterations for transfer. Augmentation approaches (DI, TI) diversify gradients by random resizing and translations, capturing transformations the target may encounter. Feature disruption attacks optimize feature activations at selected layers, with the choice of layer (e.g., conv3_x for ResNet) critical for transfer. Generative methods like Dual-Flow [2502.02096] and GAP [2211.09565] produce instance-agnostic, multi-target perturbations with explicit conditioning and distribution-shift training, exhibiting notable cross-model and cross-task generalization.

Specialist frameworks handle transfer in other domains:
- **Transferable availability poisoning** attacks optimize over both cross-entropy and contrastive (alignment/uniformity) objectives to degrade accuracy of any possible victim model trained on poisoned data [2310.05141].
- **Transferable adversarial prompting** is central to jailbreaking LLMs, where transfer is determined by prompt region overlap; loss-based constraints on source models often severely restrict transferability to target LLMs [2503.01865]. 

## 3. Architectural and Domain-Specific Transfer

Transferability varies by domain, task granularity, and model class:
- **Vision Transformers (ViTs):** Specialized attacks (e.g., Token Gradient Regularization [2303.15754], TESSER [2505.19613]) leverage token-wise importance, spectral regularization, and variance reduction, yielding large ASR gains over classical CNN-based methods in both ViT-to-ViT and ViT-to-CNN transfer.
- **Object Detection and Segmentation:** Transfer attacks must account for inter-object context, spatial dependencies, and per-pixel or per-instance predictions. Context-aware plans and translation-invariance/ensemble approaches have yielded significant success rate improvements for black-box detector attacks and semantic segmentation [2112.03223] [2307.16572].
- **Code Models and LLMs:** Transferable code attacks use semantics-preserving mutators applied on white-box surrogates, with perturbations disrupting code understanding in GPT-4, Claude, and Llama-family models [2311.13445]. Prompt-based defenses (few-shot, explicit reverse instructions) are effective countermeasures.

Transfer learning introduces specific avenues for transfer attacks, such as **headless** attacks, which perturb feature extractors alone, bypassing the downstream classifier head entirely [2004.09007]. Downstream transfer attacks target fine-tuned models (e.g., via ViTs), using similarity-based objectives at internal layers [2408.01705].

## 4. Empirical Insights, Limitations, and Defense

Empirical studies have revealed several nontrivial findings:
- **Intermediate model complexity** surrogates (e.g., ResNet-34, VGG-16) exhibit greater transfer than shallow or deep variants [2204.04063].
- **Model family** is not a universal predictor of transfer; no architecture consistently dominates [2204.04063].
- **Architectural mismatch** between surrogate and victim induces the largest drop in transferability (up to 95%→15%) [2306.15363].
- **L2 norm dominance:** L2-constrained perturbations yield higher transfer rates than L-infinity, and even random search can outperform certain gradient-based algorithms [2204.04063].
- **Data characteristics** influence transfer: dataset origin, class balance, and training distributions have additive penalties. For example, mismatches in training balance or data source can decrease ASR by ~20%, but are less significant than architecture [2306.15363].
- **Stealthiness** trade-offs must be addressed in practice: high-transfer attacks tend to be less perceptually subtle, with FID, SSIM, and LPIPS scores offering complementary evaluation to traditional norm-bounded metrics [2211.09565].

Recent defenses against transfer attacks include:
- **Minimax, game-theoretic training:** PubDef trains models against transfer attacks from a diverse set of public surrogates, outperforming classical adversarial training by 20–26pp on robust accuracy in ImageNet settings [2310.17645].
- **Data-centric one-shot augmentation:** DRL generates a diverse pool of adversarial examples on a surrogate before target model fitting, matching or exceeding robustness of iterative AT methods with much lower computational cost [2310.09891].
- **Prompt-based LLM defenses:** Inclusion of adversarial code pairs and restoration instructions in prompts mitigates transferability of code attacks [2311.13445].

## 5. Open Challenges and Future Directions

Open research directions include:
- **Optimally choosing surrogates** for black-box transfer, and formalization of capacity/similarity metrics beyond gradient alignment.
- **Frequency domain and spectral approaches**: Centralized perturbation attacks focus on low/mid-frequency components, aligning with shared model representations [2312.06199].
- **Algorithmic frameworks** such as bilevel optimization (BETAK), which coordinate initialization and hypergradient response to explicitly maximize transferability subject to surrogate adaptation [2406.02064].
- **Physical-world and context-driven attacks:** Extending transferability to real-world and context-dependent settings (e.g., physically realizable object detector attacks, jailbreaking LLMs under safety layers) [2112.03223] [2503.01865].
- **Defense-evasion arms race:** Most current defenses are not robust to unknown, unconstrained transfer attacks, especially where non-L-infinity norms or novel domain transfer mechanisms are used.

A plausible implication is that as models, training data, and attack algorithms continue to diversify, both attackers and defenders must move towards ensemble and structure-aware strategies that reflect the practical heterogeneity of real-world deployment scenarios.

## 6. Comprehensive Evaluation and Best Practices

A systematic evaluation of transfer attacks should consider both transferability and stealthiness using diverse metrics (ASR, PSNR, SSIM, LPIPS, FID), sweeping hyperparameters (iteration count, augmentation multiplicity, target layers) [2211.09565]. Best practices include:
- Early stopping in iterative attacks for optimal transfer.
- Hyperparameter fairness across categories (e.g., same step-size/copy count for augmentation methods).
- Defense evaluation against unseen attack types and attack signature analysis (e.g., using diagnostic classifiers to fingerprint attack generation processes).
- Release of code, standardized benchmarks, and attack lists to promote reproducibility [2211.09565].

## References

- [2204.04063] Transfer Attacks Revisited: A Large-Scale Empirical Study in Real Computer Vision Settings
- [2211.09565] Towards Good Practices in Evaluating Transfer Adversarial Attacks
- [2303.15754] Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization
- [2310.05141] Transferable Availability Poisoning Attacks
- [2503.01865] Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints
- [2502.02096] Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimization
- [2312.06199] Towards Transferable Adversarial Attacks with Centralized Perturbation
- [2307.16572] Transferable Attack for Semantic Segmentation
- [2311.13445] Transfer Attacks and Defenses for Large Language Models on Coding Tasks
- [2408.01705] Downstream Transfer Attack: Adversarial Attacks on Downstream Models with Pre-trained Vision Transformers
- [2505.19613] TESSER: Transfer-Enhancing Adversarial Attacks from Vision Transformers via Spectral and Semantic Regularization
- [2310.17645] PubDef: Defending Against Transfer Attacks From Public Models
- [2306.15363] Your Attack Is Too DUMB: Formalizing Attacker Scenarios for Adversarial Transferability
- [2310.09891] Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learning

These works collectively define the state of the art and theory in transfer attacks, their practical methodologies, empirical properties, and countermeasures.

Source: https://www.emergentmind.com/topics/transfer-attacks