Search papers, labs, and topics across Lattice.
This paper investigates the impact of Input Diversity (DI) on transfer-based adversarial attacks, revealing a regime-dependent phenomenon termed the Scissors Effect. While increasing DI probability enhances transfer success for standard surrogates, it conversely diminishes success for robustly trained surrogates, with empirical results showing an average attack success drop of 10.3% on robust models across multiple architectures. The authors introduce Local Gradient Consistency (LGC) as a metric to differentiate between the two surrogate types and propose a training-free rule (CG-DI) to optimize DI application based on LGC levels, effectively balancing the trade-off between robustness and transferability.
Increasing input diversity can significantly hinder adversarial attack success on robust models, highlighting a critical trade-off in attack strategies.
Input Diversity (DI), which applies random resizing and padding at each attack iteration, is a near-default ingredient of transfer-based adversarial attacks, widely assumed to improve transferability. We show this assumption is regime-dependent and, for robustly trained surrogates, often reversed. Varying only the surrogate, increasing the DI probability raises transfer success for standard surrogates but lowers it for robust ones: the two response curves separate like a pair of scissors, a pattern we call the Scissors Effect. The effect is strong and consistent on ImageNet, where blind DI costs the robust source 10.3% attack success on average across CNN, ViT, Swin, and ConvNeXt targets and across ten attacks spanning 2018-2024; it is smaller on CIFAR-10 unless DI is made aggressive. A controlled robustness-strength sweep that varies only the training budget shows the harm is graded rather than binary, crossing from beneficial to harmful already in the little-robustness regime. We trace it to gradient geometry: a resize/translation decomposition attributes roughly 67% of the harm to resize, and a direct source-target gradient-alignment measurement confirms the same resize operation improves alignment for standard surrogates but degrades it for robust ones. We summarize the regime with Local Gradient Consistency (LGC), a single input-space probe that separates the two surrogate types, and prove a bias-variance crossover theorem isolating where DI helps from where its resize bias dominates. A training-free rule (CG-DI) that disables diversity when LGC is high avoids the loss on robust surrogates while keeping DI's benefit on standard ones, positioning the Scissors Effect as a DI-specific manifestation of the broader robustness-transferability trade-off.
