Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systems
Organizations: University of South Florida, USA · Missouri University of Science and Technology, USA · Michigan State University, USA · University of Mississippi, USA ·
Abstract
Transferable attacks allow adversarial manipulations or learned attack mechanisms constructed in one setting to compromise other AI systems, potentially reducing attack costs and amplifying security and privacy risks. Yet fragmented terminology and evaluation practices hinder understanding of what transfers, why it transfers, and where transfer fails. This survey synthesizes representative research and develops a unified taxonomy spanning six complementary axes: cross-instance, cross-domain, cross-modality, cross-model, cross-task, and cross-deployment. By separating source-target configuration changes from attacker access and adaptation budgets, the taxonomy provides a common framework for comparing transfer across evasion, poisoning, backdoors, privacy inference, model stealing, and prompt-based attacks. We connect transfer mechanisms, including gradient alignment, shared representations, training persistence, and deployment invariances, to enhancement methods based on augmentation, disentanglement, and optimization. Our synthesis identifies inconsistent transfer, incompatible metrics, and gaps between simulated and physical evaluations, and establishes a research agenda for compositional transfer, configuration differences, temporal persistence, and reproducible benchmarking. Together, this work supports systematic investigation of shared vulnerabilities and guides transfer-aware security assessment and defense.
Figures & tables
| Attack family | Objective |
|---|---|
| Evasion | Manipulate inference inputs to induce incorrect predictions ( Goodfellow et al., 2015 ; Dai et al., 2018 ; Kreuk et al., 2018 ) . |
| Backdoor | Implant a trigger-dependent behavior through poisoned data or model modification while retaining normal behavior on clean inputs ( Pan et al., 2022 ; Liu et al., 2023 ; Li et al., 2022b ) . |
| Data poisoning | Corrupt training data to alter learned behavior, including targeted failures or performance degradation ( Liu et al., 2022a ; Jiang et al., 2023b ; Cinà et al., 2023 ) . |
| Model stealing | Replicate a model’s functionality or recover its parameters ( Orekondy et al., 2019 ; Liu et al., 2022d ; Krishna et al., 2019 ) . |
| Model inversion | Reconstruct sensitive attributes or training data from a model ( Fredrikson et al., 2015 ; Zhang et al., 2020b ; He et al., 2019 ) . |
| Membership inference | Determine whether a sample belonged to a model’s training set ( Shokri et al., 2017 ; Hu et al., 2022a ; Carlini et al., 2022 ) . |
| Setting | Target internals | Target feedback | Transfer interpretation |
|---|---|---|---|
| White-box | Available | Optional | Direct optimization; source attacks can subsequently be tested for transfer. |
| Zero-query transfer | Unavailable | None | Reuse without target adaptation. |
| Query-assisted transfer | Unavailable | Used | Reuse with reported source construction, selection, or refinement. |
| Target-optimized black-box | Unavailable | Iterative | Separate initial transfer from victim-specific optimization. |
| Axis | Source-to-target change |
|---|---|
| Cross-instance | New inputs with comparable distribution, model, and task; includes universal perturbations and triggers ( Huang et al., 2020a ; Zhang et al., 2021b ) . |
| Cross-domain | A different data distribution within comparable modality and task ( Chen and Li, 2019 ; Li et al., 2018 ) . |
| Cross-modality | A different sensing modality, temporal format, or input representation ( Tu et al., 2022 ; Wei et al., 2022 ; Zhang et al., 2024d ) . |
| Cross-model | Different learned weights, architecture, or model adaptation ( Sun et al., 2022b ; Cai et al., 2022 ; Li et al., 2020b ) . |
| Cross-task | A different prediction objective or output structure ( Wei et al., 2019 ; Zhang et al., 2022c ; Zeng et al., 2024 ) . |
| Cross-deployment | Different sensing hardware, preprocessing, or inference implementation ( Jiang et al., 2023a ; Ji et al., 2021 ) . |
| Focus | Typical scope | Representative surveys |
|---|---|---|
| Evasion | Vision, networks, graphs, language | ( Badjie et al., 2024 ; Wang et al., 2023c ; Sun et al., 2022a ; Zhang et al., 2020a ; Rosenberg et al., 2021 ; Akhtar and Mian, 2018 ) |
| Backdoors | General learning and language | ( Cheng et al., 2025 ; Zhang et al., 2024b ; Li et al., 2022b ; Li et al., 2023a ; Goldblum et al., 2022 ; Kaviani and Sohn, 2021 ) |
| Data poisoning | Training and recommendation | ( Chaalan et al., 2024 ; Nguyen et al., 2024 ; Cinà et al., 2023 ; Tian et al., 2022 ; Wang et al., 2022 ) |
| Membership inference | Privacy and federated learning | ( Bai et al., 2024 ; Hu et al., 2022a ; Hu et al., 2023 ; Zhang et al., 2021c ) |
| Model inversion | Reconstruction and privacy | ( Xu et al., 2024a ; Zhang et al., 2022b ; Liu et al., 2021a ; Dibbo, 2023 ) |
| Model stealing | General models and graphs | ( Zhang et al., 2024c ; Oliynyk et al., 2023 ; Genç et al., 2023 ; Gong et al., 2020 ) |
| Mechanism | Strategy and representative evidence | Axes | Support |
|---|---|---|---|
| Gradient alignment | Momentum ( Dong et al., 2018 ) , variance tuning ( Wang and He, 2021 ) , and ensembles ( Cai et al., 2022 ; Li et al., 2020b ) seek shared sensitive directions ( Demontis et al., 2019 ) . | F | A+E |
| Representation overlap | Intermediate-feature disruption and importance weighting target shared features ( Huang et al., 2019 ; Inkawhich et al., 2019 ; Wang et al., 2021b ; Zhang et al., 2022a ; Xu et al., 2024b ) . | F, T | E |
| Local loss flatness | Neighborhood and curvature objectives reduce dependence on narrow source-specific optima ( Wu and Zhu, 2020 ; Qin et al., 2022 ; Long et al., 2025 ; Peng et al., 2025 ) . | F | E |
| Input invariance | Resize, translate, scale, and mix inputs during optimization ( Xie et al., 2019 ; Dong et al., 2019 ; Lin et al., 2019 ; Wang et al., 2021a ; Zou et al., 2020 ; Wu et al., 2021 ) . | I, F, E d | E |
| Domain-invariant features | Generative perturbations, contrastive objectives, and style manipulation reduce source-distribution dependence ( Naseer et al., 2019 ; Li et al., 2023b ; Liang and Xiao, 2023 ; Qi et al., 2021 ) . | D, F | E |
| Semantic alignment | Vision–language objectives, image-to-video transfer, and downstream-agnostic attacks exploit reused semantic features ( Wang et al., 2024 ; Zhang et al., 2024a ; Wei et al., 2022 ; Chen et al., 2023a ; Zhou et al., 2023 ) . | M, F, T | E / H |
Adversarial Attacks
Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.
See all 447 papers