{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/towards-understanding-adversarial","title":"Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferability","arxiv_id":"2307.07873","date":"2023-07-15","proceeding":null,"authors":["Yechao Zhang","Shengshan Hu","Leo Yu Zhang","Junyu Shi","Minghui Li","Xiaogeng Liu","Wei Wan","Hai Jin"],"abstract":"Adversarial examples (AEs) for DNNs have been shown to be transferable: AEs that successfully fool white-box surrogate models can also deceive other black-box models with different architectures. Although a bunch of empirical studies have provided guidance on generating highly transferable AEs, many of these findings lack explanations and even lead to inconsistent advice. In this paper, we take a further step towards understanding adversarial transferability, with a particular focus on surrogate aspects. Starting from the intriguing little robustness phenomenon, where models adversarially trained with mildly perturbed adversarial samples can serve as better surrogates, we attribute it to a trade-off between two predominant factors: model smoothness and gradient similarity. Our investigations focus on their joint effects, rather than their separate correlations with transferability. Through a series of theoretical and empirical analyses, we conjecture that the data distribution shift in adversarial training explains the degradation of gradient similarity. Building on these insights, we explore the impacts of data augmentation and gradient regularization on transferability and identify that the trade-off generally exists in the various training mechanisms, thus building a comprehensive blueprint for the regulation mechanism behind transferability. Finally, we provide a general route for constructing better surrogates to boost transferability which optimizes both model smoothness and gradient similarity simultaneously, e.g., the combination of input gradient regularization and sharpness-aware minimization (SAM), validated by extensive experiments. In summary, we call for attention to the united impacts of these two factors for launching effective transfer attacks, rather than optimizing one while ignoring the other, and emphasize the crucial role of manipulating surrogate models.","url_abs":"https://arxiv.org/abs/2307.07873v7","url_pdf":"https://arxiv.org/pdf/2307.07873v7.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"towards-understanding-adversarial","repo_url":"https://github.com/cgcl-codes/transferattacksurrogates","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"attribute","task_name":"Attribute"},{"task_slug":"data-augmentation","task_name":"Data Augmentation"}],"methods":[{"method_slug":"focus","method_name":"Focus"},{"method_slug":"sharpness-aware-minimization","method_name":"Sharpness-Aware Minimization"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2307.07873","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2307.07873"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/cgcl-codes/transferattacksurrogates","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_draft_wrong":1,"ran":11,"unverified":3},"by_repo_kind":{"official":{"samples":15,"ran":12,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"11d8e1b97b2f5801","entry":"clip_by_tensor","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/imagenet_attack.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/imagenet_attack.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":2,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"11d8e1b97b2f5801"}},{"code_sha256_prefix":"4304a326c593f8db","entry":"drop_connect","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/efficientnet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/efficientnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4304a326c593f8db"}},{"code_sha256_prefix":"424b4090e4679330","entry":"make_layers","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/vgg.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/vgg.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"424b4090e4679330"}},{"code_sha256_prefix":"33b1291f4ed17ae8","entry":"resnet18","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/resnet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"33b1291f4ed17ae8"}},{"code_sha256_prefix":"ef2cb901ccb65deb","entry":"resnet20","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/resnet_cifar.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ef2cb901ccb65deb"}},{"code_sha256_prefix":"580a194529286f83","entry":"resnet32","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/resnet_cifar.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"580a194529286f83"}},{"code_sha256_prefix":"7a0631b66b62efa7","entry":"resnet44","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/resnet_cifar.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7a0631b66b62efa7"}},{"code_sha256_prefix":"8a672b592867c614","entry":"resnet50","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/resnet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8a672b592867c614"}},{"code_sha256_prefix":"8737c82de631cffc","entry":"swish","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/efficientnet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/efficientnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8737c82de631cffc"}},{"code_sha256_prefix":"acc8c58f222a7df0","entry":"vgg11_bn","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/vgg.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/vgg.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"acc8c58f222a7df0"}},{"code_sha256_prefix":"573861d5c02def4d","entry":"vgg13","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/vgg.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/vgg.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"573861d5c02def4d"}},{"code_sha256_prefix":"91926dac2d2c5373","entry":"wrn34_10","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/resnet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"91926dac2d2c5373"}},{"code_sha256_prefix":"7510d0bcd890c346","entry":"densenet121","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/densenet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/densenet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7510d0bcd890c346"}},{"code_sha256_prefix":"8fc5580681158f30","entry":"densenet161","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/densenet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/densenet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8fc5580681158f30"}},{"code_sha256_prefix":"54ca014637609170","entry":"densenet169","repo":"cgcl-codes/transferattacksurrogates","repo_kind":"official","path":"TransferAttack/models/densenet.py","file_url":"https://github.com/cgcl-codes/transferattacksurrogates/blob/HEAD/TransferAttack/models/densenet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"54ca014637609170"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}