Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluation

Transferable attacks allow adversarial manipulations or learned attack mechanisms constructed in one setting to compromise other AI systems, potentially reducing attack costs and amplifying security and privacy risks. Yet fragmented terminology and evaluation practices hinder understanding of what transfers, why it transfers, and where transfer fails. This survey synthesizes representative research and develops a unified taxonomy spanning six complementary axes: cross-instance, cross-domain, cross-modality, cross-model, cross-task, and cross-deployment. By separating source-target configuration changes from attacker access and adaptation budgets, the taxonomy provides a common framework for comparing transfer across evasion, poisoning, backdoors, privacy inference, model stealing, and prompt-based attacks. We connect transfer mechanisms, including gradient alignment, shared representations, training persistence, and deployment invariances, to enhancement methods based on augmentation, disentanglement, and optimization. Our synthesis identifies inconsistent transfer, incompatible metrics, and gaps between simulated and physical evaluations, and establishes a research agenda for compositional transfer, configuration differences, temporal persistence, and reproducible benchmarking. Together, this work supports systematic investigation of shared vulnerabilities and guides transfer-aware security assessment and defense.

Transfer-based attacks pose a significant threat to real-world applications by directly targeting victim models with adversarial examples generated on surrogate models. While numerous approaches have been proposed to enhance adversarial transferability, existing works often overlook the intrinsic relationship between adversarial perturbations and input images. In this work, we find that the adversarial perturbations often exhibit poor translation invariance for a given clean image and model, which is attributed to local invariance. Through empirical analysis, we demonstrate a positive correlation between the local invariance of adversarial perturbations w.r.t. the input image and their transferability across models. Based on this finding, we propose a general adversarial transferability boosting technique called the Local Invariance Boosting approach (LI-Boost). Extensive experiments on the standard ImageNet dataset demonstrate that LI-Boost significantly enhances five categories of transfer-based attacks, i.e., gradient-based, input transformation-based, model-related, advanced objective function, and ensemble attacks. The improvements hold not only on conventional CNNs, ViTs, and defense mechanisms, but also on real-world commercial vision API systems and vision-language models. Our approach provides a promising direction for future research on improving adversarial transferability across models. Our code is available at https://github.com/Trustworthy-AI-Group/TransferAttack.

Transfer-based adversarial attacks craft adversarial examples using surrogate models to mislead black-box victim models. Beyond perturbation generation, transferability is fundamentally governed by the coupling of initialization, surrogate adaptation, and gradient dynamics. We revisit this challenge from a bilevel-minimax perspective and propose BMAT (Bilevel-Minimax Adversarial Transfer). The bilevel formulation captures the dependency between initialization and perturbation, while the inner minimax problem promotes surrogate robustness for cross-architecture generalization. Algorithmically, we develop an integrated bottom-up solver that combines a Soft Weight Modulator and an Implicit Gradient Approximator to enable ternary coupling among initialization, surrogate adaptation, and perturbation optimization. We further provide theoretical insights into the optimization dynamics of the proposed bilevel-minimax framework. Extensive experiments on classification and segmentation benchmarks show that BMAT outperforms more than 10 strong baselines across more than 30 victim models, improving both intra- and cross-architecture transfer and yielding up to a 2x reduction in mIoU. Code is available at https://github.com/callous-youth/BMAT.