THE TRANSFERABILITY

An attack built against one model fools another it never saw. Craft an FGSM step on a substitute linear model A — δ = ε·sign(wA) — then fire it at a target B you never queried. The loss increase on B is ε·(sign(wA)·wB); its sign is the alignment of the two weight vectors. Rendered, not quoted.

source Papernot, McDaniel & Goodfellow, Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples (2016) — arxiv.org/abs/1605.07277

Blue team · builds & defends
3
The model

Two linear scorers on the same 4-feature task. Score f(x)=w·x+b; predicted class = sign of the score. Both are honest, constructed classifiers with known integer weights, so every adversarial quantity is closed-form.

substitute A  wA = [ 2, -1, 3, 1 ]
∥wA∥1 = 7   ∥wA∥2 = √15 ≈ 3.873
L∞ optimum for a linear model is exactly ε·sign(w); the minimal L2 flip is the margin along w/∥w∥2. Both are used as ground truth — no fitting, no noise.
5
The lineage

Downstream of the-adversarial-example: a perturbation that generalizes across models. Because the attack transfers, a black-box target is not safe just for being unseen — you build the attack on a copy you control and fire it at the original.

the-adversarial-example → the-transferability: one crafted vector, two models, no query to the second.
7
The witness · live re-check

Re-derives the invariant on the current engine state: aligned target transfers, orthogonal target does not. Flips red the instant the tamper in window 6 is live.

…
The machine
4
in ↓Data in
substitute wA = [ 2, -1, 3, 1 ] (known)
target     wB = unseen / black-box
budget    ε = 0.1    L∞ ball
input    x₀ = [ 1, 0, 0, 0 ]
We only ever touch A. B is queried by nobody — the whole point.
↓ craft on A ↓
0
litThe panel · live engine

FGSM on the substitute, then transfer to each target B.

δ = ε·sign(wA) = … transfer(B) = δ·wB = ε·(sign(wA)·wB)
self-attack sanity: δ·wA = ε·∥wA∥1 = +0.7 (transfer to self always succeeds). Minimal L2 flip of A at x₀: |fA(x₀)|/∥wA∥2 = 2/√15 ≈ 0.516.
↓ measured on B ↓
8
out ↓Data out

Proven, per target — the sign of the transfer follows the weight cosine:

…
Red team · attacks & breaks
1
The adversary

wallTransfer is not guaranteed. It rides on weight alignment. A defender who decorrelates the target from any substitute the attacker can build (different features, gradient masking, ensembling) drives cos→0 and the transfer collapses toward zero.

Real limits: gradient masking gives a substitute with the wrong gradients; high-curvature or non-differentiable targets break the linear-surrogate assumption; large ε leaves the region where the local linearization holds.
2
The graveyard

“An unseen / black-box model is safe from attacks crafted elsewhere.”
→ False. A substitute aligned with the target transfers with no query to it.

“Transfer always works between any two models on the same task.”
→ Only when cos(wA,wB)>0. At cos=0 transfer≈0; at cos<0 the perturbation helps the target.

“A successful transfer proves the two models are identical.”
→ No — it only needs positive weight alignment, not equality.

6
The tamper · planted void

Disclosed planted defect: force the engine to report a HIT for the orthogonal target (cos=0, where sign(wA)·wB=0). A genuine non-transfer gets sold as a hit.

The witness in window 7 re-derives the invariant live and catches it immediately.