Transfer-based black-box adversarial attacks craft adversarial examples on an accessible surrogate model and deploy them against an unknown target model. The LGV method (Gubri et al., ECCV 2022) showed that collecting network weights along a high-constant-learning-rate stochastic gradient descent (SGD) trajectory - i.e., sampling surrogate models from a wide, flat vicinity of a loss minimum spanning several low-loss solutions - substantially increases transferability, and conjectured that flatness in weight space makes adversarial examples robust to the misalignment between surrogate and target loss functions. This conjecture, the identity of the flatness measures and subspace directions that help rather than hurt, the rule for scaling weight deviations when they are translated to other solutions, the explanation of observed incompatibilities with feature-level attack methods, and the relation between the volume of the low-loss weight region and transferability are all left open by the source paper. Later work has produced provable transferability bounds for input-space flatness of the attack over surrogate ensembles and a smoothness-gradient-similarity trade-off theory, but no formal account of which surrogate-target shifts weight-space flatness mitigates and no predictive mapping from weight-space geometric quantities to cross-architecture transfer. The problem is to develop and validate such a theory.

Background

An adversarial example is an input, typically a small deliberate perturbation of a natural input, that causes a deep neural network (DNN) to misclassify while appearing benign to humans. Adversarial examples often transfer: an example crafted on one model (the surrogate, which the attacker can access) also fools a different, unseen model (the target). This transferability enables transfer-based black-box attacks, which need no queries to the target.

LGV (Large Geometric Vicinity; Gubri et al., ECCV 2022) improves transferability by manipulating the geometry of the surrogate in the network weight space rather than the input space. Instead of attacking a single conventionally trained network, LGV continues training from a pretrained network for a few epochs with a constant and high learning rate (so that SGD, the stochastic gradient descent optimizer, wanders inside a low-loss region rather than converging to a sharp point), collects the weight sets along this trajectory, and attacks the ensemble of the collected models. Two geometric observations support the method. First, a minimum of the training loss is called flat (respectively sharp) when the loss varies little (respectively strongly) in a neighborhood of the minimizing weights; LGV weights sit in a flatter region than the original network, measured for example by the largest eigenvalue and the trace of the loss Hessian (the matrix of second derivatives of the loss with respect to the weights). Second, the deviations of the collected weights from their average (obtained by stochastic weight averaging, SWA) span a low-dimensional weight subspace whose principal components, computed by PCA (principal component analysis, which here produces an orthogonal basis of the deviation directions ordered by explained weight variance), are individually relevant to transferability: projecting the ensemble onto its leading principal components preserves most of the transfer gains, and the importance of components depends on how functionally similar the surrogate and target architectures are.

The paper explains these observations by the surrogate-target misalignment hypothesis: the surrogate and target loss landscapes, viewed in feature space, are shifted copies of each other, so adversarial examples lying at wide (flat) maxima of the surrogate loss are more robust to that shift than examples at sharp maxima - analogous to the classical argument that wide minima generalize better under a train-test shift. This is a conjecture supported by experiments, not a theorem. The authors explicitly flag what remains unexplained: not all flatness helps (a loss with entirely vanished gradients would be maximally flat but useless for gradient-based attacks); no theory predicts which flatness measures or which subspace directions benefit or harm transfer across architectures; when LGV weight deviations are translated onto a differently trained network they must be rescaled by a factor (empirically about 0.5), and no rule derives the correct scale from local geometric quantities; combining LGV with some feature-level transferability techniques (e.g., Ghost Networks, which perturb the surrogate model by dropout or skip-connection erosion, or SGM, the skip gradient method, which reweights attack gradients toward skip connections) can degrade transfer, for which the paper offers only an untested speculative explanation (that such feature perturbations are cheap and bad proxies for local weight geometry); and the volume of the weight-space region of near-constant low loss - a candidate alternative geometric predictor named in the paper's future work - has not been related quantitatively to transferability. A further caution for any such theory is that flatness measures in weight space are sensitive to parameter re-scalings that leave the network function unchanged (Zhang et al., 2021), so a satisfactory account must either use reparametrization-invariant quantities or explain why the parametrization at hand is the relevant one.

Since LGV, related theory has advanced on adjacent ground: provable bounds showing that adversarial examples at flat minima of the surrogate-ensemble attack loss transfer when a distributional surrogate-target discrepancy is controlled (Zheng et al., 2026), a proof that input-space average-case flatness of the attack minimizes cross-model discrepancies (Qiu et al., 2026), a trade-off theory between model smoothness and gradient similarity for surrogate training (Zhang et al., 2024), and ensemble error decompositions (Yao et al., 2024). None of these delivers the weight-space account LGV calls for. All of them, like LGV itself, ultimately aim at one objective: replacing empirical tricks for building transferable attacks with a predictive understanding of why they work.

Problem Statement

Develop a formal, predictive theory of why sampling surrogate model weights from a flat, wide vicinity of a loss minimum - possibly spanning several low-loss solutions, as LGV does - yields adversarial examples that transfer to models at other optima, and validate it empirically. The theory should answer, as parts of one objective: (1) Misalignment: make the surrogate-target misalignment hypothesis precise - define the class(es) of shifts between surrogate and target prediction functions for which weight-space flatness of the surrogate provably mitigates the loss of attack success, and identify the shifts it does not mitigate; any flatness notion used must address its known parameter re-scaling sensitivity. (2) Beneficial vs. harmful flatness and directions: characterize which measures of flatness and which directions or eigencomponents of the surrogate weight subspace (the span of deviations of LGV-style weights from their average) increase or decrease transferability, to the point of predicting cross-architecture transfer from these geometric quantities - noting that vanishing gradients show that maximal flatness can be harmful to gradient-based attacks. (3) Scaling rule: give a rule, derived from local geometric quantities of the receiving solution, for the scale factor required when weight-subspace deviations are translated onto a differently trained or differently initialized network (replacing LGV's cross-validated γ≈0.5\gamma \approx 0.5). (4) Compatibility: explain, within the same theory, why combining weight-space methods such as LGV with some feature-level transferability techniques (e.g., Ghost Networks, skip-gradient methods) can degrade transfer while other combinations help. (5) Volume: either establish or refute a quantitative relation between the volume of the low-loss weight region (the weight-space volume of near-minimal loss around the surrogate) and transferability. These five parts are jointly posed as parts of one objective; each part is independently open. The theory should replace LGV's empirical conjectures with predictive statements about which weight-space configurations of a surrogate transfer.

References

  1. Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, Koushik Sen. LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinity. ECCV 2022 (published version: DOI 10.1007/978-3-031-19772-7_35); arXiv:2207.13129, DOI 10.48550/arXiv.2207.13129. https://arxiv.org/abs/2207.13129
  2. Meixi Zheng, Kehan Wu, Yanbo Fan, Rui Huang, Baoyuan Wu. Seeking Flat Minima over Diverse Surrogates for Improved Adversarial Transferability: A Theoretical Framework and Algorithmic Instantiation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2026. arXiv:2504.16474, DOI 10.1109/TPAMI.2026.3679726. https://arxiv.org/abs/2504.16474
  3. Chunlin Qiu, Ang Li, Yiheng Duan, Shenyi Zhang, Yuanjie Zhang, Lingchen Zhao, Qian Wang. Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatness. IEEE Transactions on Information Forensics and Security, 2026. arXiv:2405.16181, DOI 10.1109/TIFS.2026.3658188. https://arxiv.org/abs/2405.16181
  4. Yechao Zhang, Shengshan Hu, Leo Yu Zhang, Junyu Shi, Minghui Li, Xiaogeng Liu, Wei Wan, Hai Jin. Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferability. IEEE Symposium on Security and Privacy 2024. arXiv:2307.07873, DOI 10.1109/SP54263.2024.00010. https://arxiv.org/abs/2307.07873
  5. Martin Gubri, Maxime Cordy, Yves Le Traon. Going Further: Flatness at the Rescue of Early Stopping for Adversarial Example Transferability. arXiv:2304.02688. https://arxiv.org/abs/2304.02688
  6. Jiahao Chen, Zhou Feng, Rui Zeng, Yuwen Pu, Chunyi Zhou, Yi Jiang, Yuyou Gan, Jinbao Li, Shouling Ji. Enhancing Adversarial Transferability with Adversarial Weight Tuning. arXiv:2408.09469. https://arxiv.org/abs/2408.09469
  7. Yilin Wang, Farzan Farnia. On the Role of Generalization in Transferability of Adversarial Examples. arXiv:2206.09238. https://arxiv.org/abs/2206.09238
  8. Wei Yao, Zeliang Zhang, Huayi Tang, Yong Liu. Understanding Model Ensemble in Transferable Adversarial Attack. arXiv:2410.06851. https://arxiv.org/abs/2410.06851
  9. Qizhang Li, Yiwen Guo, Wangmeng Zuo, Hao Chen. Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examples. arXiv:2302.05086. https://arxiv.org/abs/2302.05086
  10. Nils Philipp Walter, Linara Adilova, Jilles Vreeken, Michael Kamp. The Uncanny Valley: Exploring Adversarial Robustness from a Flatness Perspective. arXiv:2405.16918. https://arxiv.org/abs/2405.16918
  11. Shixin Li, Chaoxiang He, Xiaojing Ma, Bin Benjamin Zhu, Shuo Wang, Hongsheng Hu, Dongmei Zhang, Linchen Yu. Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training. CVPR 2025. DOI 10.1109/CVPR52734.2025.01926. https://doi.org/10.1109/CVPR52734.2025.01926
  12. Yan Fang, Zhongyuan Wang, Jikang Cheng, Ruoxi Wang, Chao Liang. Promoting adversarial transferability with enhanced loss flatness. IEEE International Conference on Multimedia and Expo (ICME) 2023. DOI 10.1109/ICME55011.2023.00212. https://doi.org/10.1109/ICME55011.2023.00212
  13. Jun-Qi Guo, Shi-Jia Yang, Wei Gao. On the flatness of model ensemble attacks with theoretical guarantees. Neurocomputing, 2026. DOI 10.1016/j.neucom.2026.134593. https://doi.org/10.1016/j.neucom.2026.134593
  14. Jindong Gu, Xiaojun Jia, Pau de Jorge, Wenqain Yu, Xinwei Liu, Avery Ma, Yuan Xun, Anjun Hu, Ashkan Khakzar, Zhijiang Li, Xiaochun Cao, Philip Torr. A Survey on Transferability of Adversarial Examples across Deep Neural Networks. arXiv:2310.17626. https://arxiv.org/abs/2310.17626
  15. Shuofeng Zhang, Isaac Reid, Guillermo Valle Perez, Ard Louis. Why flatness does and does not correlate with generalization for deep neural networks. arXiv:2103.06219. https://arxiv.org/abs/2103.06219