Adversarial transferability

Lens adapted to this topic: What leading research explains and measures

The mainstream research account treats transferability as a reproducible but conditional property of neural networks. It emphasizes shared geometry—such as overlapping adversarial subspaces and similar decision boundaries—alongside feature structure, substitute-model generalization, and attack design. This view supports black-box attack feasibility while stressing that transfer rates depend strongly on the models and evaluation protocol.

• Transferability can arise because different models have shared adversarial subspaces and decision boundaries that are close in many directions.
• Non-robust but predictive features offer an interpretation of why perturbations can generalize across models, although the experiments and interpretation have been subject to scrutiny.
• The substitute classifier’s generalization from training to unseen data is theoretically and empirically relevant to black-box attack transfer.
• Transfer-based attacks can be effective, but comparing methods requires careful choices of substitute and victim models and fair evaluation.
• Transferability is not guaranteed; formal limits and scenarios in which transfer does not occur have been identified.

Lens adapted to this topic: Dissenting interpretations and practical limits

A critical account argues against treating transferability as a single, reliably exploitable property. It highlights class-specific differences, inconsistent findings about which techniques help, sensitivity to failed attacks, and the possibility that weak attacks or narrow benchmarks inflate apparent success. This perspective accepts observed transfer while questioning how general and operationally dependable it is.

• Transferability should not be reduced to whether a target is fooled: the target may make the same wrong-class prediction as the source or a different one, reflecting different mechanisms.
• Some empirical guidance for producing highly transferable examples is confusing or inconsistent, suggesting that mechanisms are not yet fully understood.
• Studies can overstate practical attack effectiveness when they use weak attacks, unfair comparisons, or insufficiently diverse substitute and victim models.
• A probabilistic transfer rate may be inadequate for real attackers when the cost of a failed attack is high; practical threat assessment should account for that cost.
• Shared model properties may explain some transfer, but transfer is bounded and can fail even when models appear related.