{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/flatness-aware-adversarial-attack","title":"Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness","arxiv_id":"2311.06423","date":"2023-11-10","proceeding":null,"authors":["Mingyuan Fan","Xiaodan Li","Cen Chen","Wenmeng Zhou","Yaliang Li"],"abstract":"A prevailing belief in attack and defense community is that the higher flatness of adversarial examples enables their better cross-model transferability, leading to a growing interest in employing sharpness-aware minimization and its variants. However, the theoretical relationship between the transferability of adversarial examples and their flatness has not been well established, making the belief questionable. To bridge this gap, we embark on a theoretical investigation and, for the first time, derive a theoretical bound for the transferability of adversarial examples with few practical assumptions. Our analysis challenges this belief by demonstrating that the increased flatness of adversarial examples does not necessarily guarantee improved transferability. Moreover, building upon the theoretical analysis, we propose TPA, a Theoretically Provable Attack that optimizes a surrogate of the derived bound to craft adversarial examples. Extensive experiments across widely used benchmark datasets and various real-world applications show that TPA can craft more transferable adversarial examples compared to state-of-the-art baselines. We hope that these results can recalibrate preconceived impressions within the community and facilitate the development of stronger adversarial attack and defense mechanisms. The source codes are available in <https://github.com/fmy266/TPA>.","url_abs":"https://arxiv.org/abs/2311.06423v3","url_pdf":"https://arxiv.org/pdf/2311.06423v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"flatness-aware-adversarial-attack","repo_url":"https://github.com/fmy266/tpa","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"diversity","task_name":"Diversity"}],"methods":[{"method_slug":"sharpness-aware-minimization","method_name":"Sharpness-Aware Minimization"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2311.06423","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2311.06423"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/fmy266/TPA","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/fmy266/tpa","reach":{"status":"ok"}}],"summary":{"ran":4,"ran_fixture":2,"ran_draft_wrong":2,"unverified":4},"by_repo_kind":{"official":{"samples":12,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":12,"samples":[{"code_sha256_prefix":"6fbe88d522599801","entry":"BaseAttack","repo":"fmy266/tpa","repo_kind":"official","path":"toolkit/adv/attack.py","file_url":"https://github.com/fmy266/tpa/blob/HEAD/toolkit/adv/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6fbe88d522599801"}},{"code_sha256_prefix":"6c7dce372a94f4eb","entry":"TAEFEP","repo":"fmy266/tpa","repo_kind":"official","path":"toolkit/adv/attack.py","file_url":"https://github.com/fmy266/tpa/blob/HEAD/toolkit/adv/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6c7dce372a94f4eb"}},{"code_sha256_prefix":"fd638ce21929b00d","entry":"accuracy","repo":"fmy266/tpa","repo_kind":"official","path":"FAA/acc_validate.py","file_url":"https://github.com/fmy266/tpa/blob/HEAD/FAA/acc_validate.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fd638ce21929b00d"}},{"code_sha256_prefix":"2a80220dabcb742a","entry":"conv1x1","repo":"fmy266/TPA","repo_kind":"official","path":"FAA/resnet.py","file_url":"https://github.com/fmy266/TPA/blob/HEAD/FAA/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2a80220dabcb742a"}},{"code_sha256_prefix":"600ff2c45e0de056","entry":"conv3x3","repo":"fmy266/TPA","repo_kind":"official","path":"FAA/resnet.py","file_url":"https://github.com/fmy266/TPA/blob/HEAD/FAA/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"600ff2c45e0de056"}},{"code_sha256_prefix":"ad370ce5d85797b6","entry":"densenet121","repo":"fmy266/TPA","repo_kind":"official","path":"FAA/densenet.py","file_url":"https://github.com/fmy266/TPA/blob/HEAD/FAA/densenet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ad370ce5d85797b6"}},{"code_sha256_prefix":"864a6cf3c90af3e5","entry":"resnet18","repo":"fmy266/TPA","repo_kind":"official","path":"FAA/resnet.py","file_url":"https://github.com/fmy266/TPA/blob/HEAD/FAA/resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"864a6cf3c90af3e5"}},{"code_sha256_prefix":"90b8bf86c8334fb7","entry":"unnormalize","repo":"fmy266/tpa","repo_kind":"official","path":"FAA/acc_validate.py","file_url":"https://github.com/fmy266/tpa/blob/HEAD/FAA/acc_validate.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"90b8bf86c8334fb7"}},{"code_sha256_prefix":"2e5c4fc85c6ed610","entry":"clip_based_on_inf_norm_","repo":"fmy266/tpa","repo_kind":"official","path":"toolkit/adv/attack.py","file_url":"https://github.com/fmy266/tpa/blob/HEAD/toolkit/adv/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2e5c4fc85c6ed610"}},{"code_sha256_prefix":"4db35ea5c8cdf3e0","entry":"densenet161","repo":"fmy266/TPA","repo_kind":"official","path":"FAA/densenet.py","file_url":"https://github.com/fmy266/TPA/blob/HEAD/FAA/densenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4db35ea5c8cdf3e0"}},{"code_sha256_prefix":"c200a9855de96b29","entry":"densenet169","repo":"fmy266/TPA","repo_kind":"official","path":"FAA/densenet.py","file_url":"https://github.com/fmy266/TPA/blob/HEAD/FAA/densenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c200a9855de96b29"}},{"code_sha256_prefix":"0936271379c79ffa","entry":"validate","repo":"fmy266/TPA","repo_kind":"official","path":"FAA/acc_validate.py","file_url":"https://github.com/fmy266/TPA/blob/HEAD/FAA/acc_validate.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0936271379c79ffa"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}