---
title: Transferred Adversarial Attacks
url: https://www.emergentmind.com/topics/transferred-adversarial-attacks
type: topic
---

# Transferred Adversarial Attacks

Transferred adversarial attacks, also referred to as transferability-based adversarial attacks or black-box transfer attacks, exploit the property that adversarial perturbations crafted for a specific (“source” or surrogate) neural network model can often cause misclassification in other (“target” or victim) models with different architectures, training data, or even domains. This phenomenon, originally observed in early adversarial machine learning literature and since extensively studied, underpins practical black-box threat models where the attacker cannot access the internals of the deployed (target) model.

## 1. Formal Definition and Threat Models

Transferred adversarial attacks are defined as the process in which adversarial examples $x^\text{adv} = x + \delta$—where $x$ is a clean input and $\delta$ obeys a specified norm bound, e.g., $\| \delta\|_p \leq \epsilon$—are generated to fool a surrogate model $f_s(\cdot)$ but are evaluated for their ability to alter predictions of an unknown target model $f_t(\cdot)$ [2210.05968][2109.11125][2204.04063][1907.06291][2501.18629][2511.05102].

The canonical setting is:
- **White-box attack on surrogate**: $\delta^* = \arg\max_{\delta\in\Delta} \mathcal{L}(f_s(x + \delta), y)$.
- **Transferability criterion**: $f_t(x + \delta^*) \neq y$ (untargeted) or $f_t(x + \delta^*) = y_t$ (targeted to $y_t$).

Transferability is quantified by the target model’s top-1 misclassification or targeted attack success rate, and is foundational in realizing query-free black-box attacks in both vision and non-vision domains [2311.03373][2110.04488].

## 2. Mechanistic Explanations and Theoretical Principles

The transferability of adversarial examples arises from overlapping adversarial subspaces and the structural similarities of learned representations between deep neural networks, even across models with different training or architectures [2210.05968][2501.18629][1907.06291]. Key mechanistic principles include:

- **Loss surface geometry**: Standard attacks often yield adversarial examples stuck in “sharp minima” of the surrogate’s loss landscape. These points are highly sensitive to decision boundary shifts, causing poor transfer [2210.05968].
- **Flatness-driven transfer**: Constraining adversarial examples to reside in flat regions of the surrogate’s loss surface (minimizing maximum loss in a local neighborhood) dramatically increases transfer success by making the perturbation robust to boundary shifts between models [2210.05968].
- **Shared low-/mid-level representations**: Many architectures share analogous features at early and intermediate layers, making attacks targeting these representations more likely to generalize [1811.08458][2004.12519].
- **Model and layer similarity**: Centered Kernel Alignment (CKA) and other similarity metrics can be used to predict transferability: networks that are more similar at the representational level exhibit higher transfer rates, though the relationship is non-linear and depends on attack type and architectural specifics [2501.18629][2511.05102].

## 3. Methodological Advances in Improving Transferability

Multiple algorithmic strategies have been developed to enhance the cross-model transferability of adversarial attacks:

### a) Loss Surface Manipulation

- **Reverse Adversarial Perturbation (RAP)**: RAP implements a min–max bi-level optimization, seeking adversarial examples in $L_\infty$ balls whose entire local $\epsilon_n$-neighborhood maintains low surrogate loss. This is solved by alternating inner maximization (worst-case local ascent) and outer descent (gradient sign update) [2210.05968].
- **Defense-guided Max–Min Optimization**: Input–affine transformations (translation, rotation, scaling) select the loss-minimizing (“defensive”) configuration at every iteration, forcing the adversarial candidate to be robust to diverse geometric variations [2010.11535].

### b) Input and Feature Diversification

- **Input transformations**: Randomized or optimized geometric transforms (including affine, resizing, cropping, or small rotations) are applied either during attack or post-attack to avoid overfitting and inject diversity into the perturbations, boosting transfer [2503.00932][2010.11535].
- **Feature-space attacks**: Perturbing intermediate (task/data-shared) features, via representation maximization or feature distribution alignment, improves transfer success—most notably in the Intermediate Level Attack (ILA) paradigm and feature-distribution attacks [1811.08458][2004.12519].

### c) Frequency-Domain and Semantic Augmentation

- **Centralized perturbation in the frequency domain**: Constraining optimization to dominant frequency coefficients with dynamic mask adaptation aligns perturbation support with model-agnostic features, reducing overfitting and improving both transferability and defense evasion [2312.06199].
- **Semantic injection/guided generation**: Generative approaches incorporating auxiliary guiding images or curated low-frequency patterns expand the transferable region of feature space, enabling targeted, universal, and even cross-domain transfer attacks [2501.01106][1905.11736][1908.11332].

### d) Directional and Output Space Aggregation

- **Direction-aggregated gradients**: Smoothing update directions through aggregation across neighborhood points in input space (e.g., via random noise or transformation) stabilizes optimization and increases the likelihood of “salient” transferable directions [2104.09172][2003.06878].

## 4. Empirical Results, Benchmarks, and Quantitative Trends

Extensive empirical studies document the landscape of transferability on ImageNet, CIFAR, cloud ML APIs, and security datasets [2204.04063][2210.05968][2312.06199][1907.06291][2010.11535][2109.11125][2110.04488][2311.03373]. Key results:

- **Transferability baseline**: Canonical I-FGSM or PGD attacks yield 15–50% untargeted transfer success between strong (ResNet, VGG, Inception) architectures under common $L_\infty$ budgets [1907.06291][2210.05968][2204.04063].
- **State-of-the-art with advanced methods**:
  - RAP and RAP-LS boost untargeted attack success by 8–17% and targeted attack success by 11–33% over matched baselines, reaching up to 99% on ensembles and major cloud APIs [2210.05968].
  - Direction-aggregated and defense-guided attacks reach 85–95% on adversarially trained and defended models, outperforming classic and momentum-based iterative methods [2104.09172][2010.11535].
  - Simple 1° input rotations yield +6.5pp average improvement, up to +26.5pp on black-box ImageNet, in over 84% of evaluated attack/model triples [2503.00932].
  - Centralized frequency attacks add +11.7% absolute transfer to black-box fooling, improving robustness under compression and quantization defenses [2312.06199].
  - Output-diversified sampling strategies halve query counts for black-box attacks on ImageNet [2003.06878].
- **Surrogate selection**: No single “best” architecture guarantees maximal transfer on real-world APIs; surrogate depth and diversity have non-monotonic, dataset-specific effects [2204.04063].
- **Posterior gap vs. logit gap**: Posterior gap (softmax margin) on the surrogate is a much stronger predictor of transfer than raw logit gap, with $R^2 \sim 0.8$ on real APIs [2204.04063].
- **Metric and norm effects**: $L_2$ perturbations, even those generated without gradients, sometimes outperform $L_\infty$-constrained attacks in cross-model settings [2204.04063]. SSIM-aligned constraints are more reliable for perceptual similarity than $L_\infty$ [1907.06291].

## 5. Applications and Domain-Specific Manifestations

### Vision
- Transfer attacks have been most intensively studied on classification, segmentation, and transfer learning tasks using ImageNet, CIFAR, PASCAL VOC, and Cityscapes. SegTrans demonstrates state-of-the-art transfer rates for segmentation via local semantic fragmentation [2510.08922].
- Transferability is unchanged or amplified under MLaaS APIs, where model, data, and pretraining diversity is further compounded [2204.04063].

### Non-Vision (Cybersecurity and Domains)
- Transferability also holds in non-image domains, including network intrusion detection and flow classification, but with major caveats: success is contingent on feature domain, model architecture, and attack style [2311.03373][2110.04488]. For CNN-based flow detectors, transfer is highest for JSMA and I-FGSM; PGD and DeepFool transfer poorly [2110.04488].
- Cross-domain generative domain-invariant attacks demonstrate that adversarial perturbations trained on non-overlapping domains (e.g., “Paintings”) retain strong fooling capability against ImageNet models, contingent on relativistic contrastive losses [1905.11736].

## 6. Risk Quantification, Predictive Modeling, and Defensive Implications

- **Exhaustive risk coverage is infeasible** due to the exponential size of high-dimensional input (adversarial) space [2511.05102].
- **Surrogate set selection via CKA**: Combining surrogates with high and low CKA similarity maximizes adversarial subspace coverage, allowing institutions to estimate true risk from a small but strategically chosen model pool [2511.05102][2501.18629].
- **Regression-based risk estimation**: Transfer success rates from surrogates, passed to a regression estimator, achieve $R^2\approx 0.85$ against actual target risk, offering a pragmatic solution for compliance and ML security evaluation in the face of transfer complexity [2511.05102].
- **Defensive recommendations**:
  - Address class and data overlap carefully—adversarial training assuming full overlap can decrease robustness if the actual overlap is less than 1 [2109.11125].
  - Shielding via adversarial fine-tuning on the most transferable attacks (MPAs), architectural diversity (e.g., LSTM + CNN), or CKA-targeted adversarial training show high efficacy [2110.04488][2511.05102].
  - Diversity-driven, non-aligned ensembles and input transformations can suppress the cross-architecture alignment that enables high transferability [2010.11535][2510.08922].

## 7. Open Problems and Future Directions

- **Theoretical bounds**: Tight theoretical characterizations of surrogate-to-target boundary alignment and subspace overlap under various loss landscapes (flatness, sharpness) remain underdeveloped [2210.05968][2501.18629].
- **Adaptive and certifiable defenses**: Dynamic defenses that adapt to feature-space adversarial subspaces, or that provide certified guarantees against perturbed regions shared by diverse families, are highly sought after [2010.11535][1905.11736][2312.06199].
- **Attack extensions**: Extending transfer attack methodologies to new norms (e.g., $L_2$ or perceptual), modalities (audio, text), generative models, and other complex output tasks (detection, language) is an active direction [2210.05968][2510.08922][2501.01106].
- **Surrogate diversity vs. computational cost tradeoffs**: Optimal balancing of surrogate pool diversity and attack coverage, especially under constraints on attack or test-time resources, requires further investigation [2511.05102][2204.04063].
- **Semantic and domain-invariant approaches**: Plug-and-play semantic injection and unsupervised domain alignment promise new trans-domain security risks but also create new opportunities for characterizing universal adversarial directions [2501.01106][1905.11736][1908.11332].

Transferred adversarial attacks remain central to practical ML red teaming, robust network evaluation, and adversarial risk certification. The design of transfer-resistant models and comprehensive testing procedures continues to be both a technical and regulatory imperative for machine learning security research.

Source: https://www.emergentmind.com/topics/transferred-adversarial-attacks