Boosting the Local Invariance for Better Adversarial Transferability

Adversarial attacks are increasingly transferable across different AI systems: The paper demonstrates that adversarial examples created to fool one AI model can successfully fool other models, including commercial vision APIs and vision-language models, posing real security risks to deployed AI systems in the wild.

A technical property called "local invariance" is key to making attacks more transferable: The researchers found that adversarial perturbations (small, intentional changes to images) that remain consistent across slight spatial shifts are more likely to fool multiple different models, suggesting attackers can exploit this pattern to create more dangerous attacks.

The vulnerability affects multiple types of AI architectures and defenses: The transferability boost works across traditional neural networks (CNNs), newer transformer-based models (ViTs), systems with built-in defenses, and even real commercial AI services, indicating this is a widespread concern rather than a narrow technical issue.

This research highlights the need for more robust AI security practices: The ease with which attacks can transfer between models suggests that testing AI systems against adversarial examples in isolation is insufficient—developers need to consider how their models might fail when attacked by examples designed for other systems.

Understanding attack mechanisms is essential for building better defenses: By identifying that local invariance drives transferability, this work provides defenders with a specific property to target when developing more resilient AI systems against transfer-based attacks.