Search papers, labs, and topics across Lattice.
This paper identifies a critical security risk in adversarial robustness optimization, revealing that improvements in defenses can lead to shared vulnerabilities across different methods. By employing stricter transfer-only protocols and a novel adaptive attack called PGDTransfer, the authors demonstrate that once one robustness-optimized defense is breached, others in the same family may also be compromised. The findings indicate that purification-based defenses are particularly susceptible, with an alarming average transfer attack success rate of 80.4%, highlighting the need for future defenses to prioritize vulnerability diversity and transfer-only isolation.
Breaching one robustness-optimized defense can expose an entire family of defenses, with purification methods showing an alarming 80.4% transfer attack success rate.
Adversarial robustness optimization aims to preserve correct prediction under adversarial perturbations, and has produced substantial robustness gains through methods such as adversarial training and adversarial purification. However, we identify a new security risk: these gains can create shared vulnerabilities across defenses. Once one representative robustness-optimized defense is effectively breached, the broader family may become exposed. Studying this risk requires separating genuine transferability from distortion-induced degradation and from the algorithmic gains of sophisticated attacks. We therefore introduce stricter transfer-only protocols and a deliberately simple adaptive attack, PGDTransfer, to test whether robustness-optimized defenses share transfer-only vulnerability under controlled conditions. We further introduce Adversarial Sensitivity Maps (AdvSMs) to visualize and quantify shared alignment beyond differentiable classifiers, including stochastic and non-differentiable defenses. Across adversarially trained classifiers, purification-based defenses, and LVLMs with robust visual encoders, we identify natural transferability within each robustness family, i.e., transfer that arises even with simple PGD-style optimization rather than specialized transferable-attack design. The risk is already severe for purification: PGDTransfer reaches an average transfer attack success rate of $80.4\%$ across filtering-, compression-, and diffusion-based purifiers under $\epsilon=4/255$, suggesting that purifier defenses may no longer provide reliable protection. As attacks improve, currently stronger robustness families may face the same risk. Future defenses should therefore treat vulnerability diversity and transfer-only isolation as security objectives, rather than optimizing only individual robustness.
