mlsanityData to 14 Oct 2026

Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness

arXiv 2311.06423 ↗First posted 10 Nov 2023cs.LG cs.CR cs.CVcited by 5

Not on the map. Why?

Abstract (arXiv)

A prevailing belief in attack and defense community is that the higher flatness of adversarial examples enables their better cross-model transferability, leading to a growing interest in employing sharpness-aware minimization and its variants. However, the theoretical relationship between the transferability of adversarial examples and their flatness has not been well established, making the belief questionable. To bridge this gap, we embark on a theoretical investigation and, for the first time, derive a theoretical bound for the transferability of adversarial examples with few practical assumptions. Our analysis challenges this belief by demonstrating that the increased flatness of adversarial examples does not necessarily guarantee improved transferability. Moreover, building upon the theoretical analysis, we propose TPA, a Theoretically Provable Attack that optimizes a surrogate of the derived bound to craft adversarial examples. Extensive experiments across widely used benchmark datasets and various real-world applications show that TPA can craft more transferable adversarial examples compared to state-of-the-art baselines. We hope that these results can recalibrate preconceived impressions within the community and facilitate the development of stronger adversarial attack and defense mechanisms. The source codes are available in <https://github.com/fmy266/TPA>.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 42 of its 50 references that are in the map. First posted on arXiv 10 Nov 2023.

Builds on

42 of 50 references.

References · 42

  1. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  2. 2016Adversarial examples in the physical worldcited by 1,769
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  4. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,432
  5. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
  6. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  7. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  8. 2017Sharp Minima Can Generalize For Deep Netscited by 466
  9. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  10. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  11. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  12. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 316
30 more
  1. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  2. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 193
  3. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  4. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  5. 2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examplescited by 167
  6. 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 163
  7. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  8. 2021Efficient Sharpness-aware Minimization for Improved Training of Neural Networkscited by 137
  9. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  10. 2022Penalizing Gradient Norm for Efficiently Improving Generalization in Deep Learningcited by 122
  11. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 105
  12. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 99
  13. 2022Sharpness-Aware Training for Freecited by 95
  14. 2023A Modern Look at the Relationship between Sharpness and Generalizationcited by 92
  15. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  16. 2018Learning Transferable Adversarial Examples via Ghost Networkscited by 70
  17. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
  18. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  19. 2023Gradient Norm Aware Minimization Seeks First-Order Flatness and Improves Generalizationcited by 57
  20. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  21. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  22. 2023The Implicit Regularization of Dynamical Stability in Stochastic Gradient Descentcited by 44
  23. 2023Sharpness Minimization Algorithms Do Not Only Minimize Sharpness To Achieve Better Generalizationcited by 39
  24. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 37
  25. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  26. 2019Information-Theoretic Local Minima Characterization and Regularizationcited by 14
  27. 2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
  28. 2023GNP Attack: Transferable Adversarial Examples via Gradient Norm Penaltycited by 8
  29. 2023On the Robustness of Split Learning against Adversarial Attackscited by 6
  30. 2022Hessian-Free Second-Order Adversarial Examples for Adversarial Learningcited by 3

Built on by

Cited by year

Citing papers per year: 2024: 3; 2025: 2.

5 papers.

  1. 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 7
  2. 2024Understanding Model Ensemble in Transferable Adversarial Attackcited by 7
  3. 2025Towards Transferable Defense Against Malicious Image Editscited by 3
  4. 2024RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defensescited by 2
  5. 2025Boosting Adversarial Transferability via Residual Perturbation Attackcited by 1