Adversarial examples (AEs) crafted for one deep neural network (DNN) often fool other networks, but Waseda et al. (WACV 2023) were the first to analyze this transferability in a class-aware way: does the fooled target model make the same mistake (predict the same wrong class as the source model) or a different one? Their evidence indicates that both same and different mistakes are consistent with non-robust features — predictive but human-imperceptible input patterns — with different mistakes arising when two models use an AE's non-robust features differently. This open problem collects the questions those authors explicitly left open, unified by one objective, a complete mechanistic account of class-aware adversarial transferability: (1) whether non-robust features fully account for all same-mistake and different-mistake cases or another mechanism exists; (2) how to characterize, discover, or construct the non-robust features that are commonly used across diverse DNNs — the features whose presence makes AEs highly transferable; and (3) why targeted attacks produce AEs whose non-robust features are more model-specific than those produced by non-targeted attacks. The problem is open.

Background

Deep neural networks (DNNs) trained for image classification are vulnerable to adversarial examples (AEs): inputs obtained by adding small, human-imperceptible perturbations to natural images so that the network misclassifies them. AEs created against one model frequently fool a different model that was never attacked — the property of adversarial transferability — and this is what makes black-box attacks feasible: an attacker can craft AEs on a local surrogate model and deploy them against a system whose internals are unknown. An attack is called non-targeted if any misclassification counts as success, and targeted if it must induce a specific attacker-chosen class; targeted transfer is empirically much harder than non-targeted transfer. Classical partial explanations relate transferability to the target model's intrinsic vulnerability and the surrogate model's complexity (Demontis et al., USENIX Security 2019), or prove the existence of transferable adversarial directions for simple network architectures (Charles et al., AISTATS 2019). The explanation at the heart of this problem is the non-robust-feature theory of Ilyas et al. (NeurIPS 2019): standard training causes DNNs to rely on non-robust features — input patterns that carry genuinely predictive signal for the class label but are imperceptible or meaningless to humans — and AEs fool models largely by perturbing these features. The theory's canonical demonstration relabels a dataset using only non-robust features; classifiers trained on the relabeled data still reach high accuracy and are still fooled by AEs, indicating that the features are real and shared across models rather than random noise. Benz et al. (ICCV 2021) added that batch normalization, a standard training technique, increases a model's reliance on non-robust features while decreasing how well the AEs it generates transfer. Waseda et al. (WACV 2023) then made transferability class-aware: instead of asking only whether the target model is fooled, they asked which wrong class it predicts, distinguishing same mistakes (the target predicts the same wrong class as the source model) from different mistakes (a different wrong class). Across pairs of CNN architectures on CIFAR-10, STL-10, and FGVC-Aircraft, they found that AEs tend to cause same mistakes (correlating with ordinary non-targeted transferability), that different mistakes nevertheless occur even between similar models regardless of perturbation size, and that both regularities are consistent with non-robust features: same mistakes arise when the two models use an AE's non-robust features the same way, different mistakes when they use them differently. In the targeted setting they observed fewer same mistakes than non-targeted attacks produce, and conjectured that the difficulty of forcing a specific class makes targeted attacks exploit non-robust features specific to the source model, which other models do not perceive the same way. The authors present these findings as evidence, not a completed theory: they explicitly do not conclude that all same and different mistakes are due to non-robust features, they leave open which non-robust features are commonly used across diverse DNNs and how to exploit that for transferable attacks, and they state that the mechanism and nature of the targeted versus non-targeted difference is not fully understood.

Problem Statement

The problem is to complete the mechanistic account of class-aware adversarial transferability — explaining not just whether adversarial examples (AEs) transfer between deep neural networks (DNNs), but to which wrong class the target model is misled — as left open by Waseda et al. (WACV 2023). Three linked questions constitute the problem, jointly serving this one objective: (1) Completeness of the non-robust-feature explanation. The source's evidence is consistent with same mistakes arising when source and target models use an AE's non-robust features (predictive but human-imperceptible input patterns) in the same way, and different mistakes when they use them differently, but the authors explicitly do not conclude that all same-mistake and different-mistake cases are due to non-robust features. Determine whether this mechanism fully accounts for observed class-aware transferability, or whether another mechanism exists; the operationalization of 'non-robust feature' must be made explicit, since it is itself part of what is at stake. (2) Characterization of commonly-used non-robust features. Identify which non-robust features are commonly used across diverse DNNs — the features whose presence in an AE makes it transfer to many architectures — and how such features could be discovered or constructed. (3) The targeted/non-targeted asymmetry. Explain mechanistically why targeted attacks (which force a specific wrong class) produce AEs whose effects are more model-specific than those of non-targeted attacks — in the source's conjecture, because the difficulty of the targeted objective makes the attack rely on non-robust features specific to the source model — and test that conjecture. The three components are scientific faces of one account: (2) is the constructive program that the mechanism in (1) predicts, and (3) is the same question under the stress condition where feature specificity is amplified.

References

  1. Futa Waseda, Sosuke Nishikawa, Trung-Nghia Le, Huy H. Nguyen, Isao Echizen. Closer Look at the Transferability of Adversarial Examples: How They Fool Different Models Differently. WACV 2023. arXiv:2112.14337, DOI: 10.48550/arXiv.2112.14337 (published version: DOI 10.1109/WACV56688.2023.00141). https://arxiv.org/abs/2112.14337
  2. Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, Aleksander Madry. Adversarial Examples Are Not Bugs, They Are Features. NeurIPS 2019. arXiv:1905.02175, DOI: 10.48550/arXiv.1905.02175. https://arxiv.org/abs/1905.02175
  3. Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, Fabio Roli. Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks. USENIX Security Symposium 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/demontis
  4. Zachary Charles, Harrison Rosenberg, Dimitris S. Papailiopoulos. A Geometric Perspective on the Transferability of Adversarial Directions. AISTATS 2019, PMLR 89. https://proceedings.mlr.press/v89/charles19a.html
  5. Philipp Benz, Chaoning Zhang, In So Kweon. Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspective. ICCV 2021, DOI: 10.1109/ICCV48922.2021.00772. arXiv:2010.03316, DOI: 10.48550/arXiv.2010.03316. https://arxiv.org/abs/2010.03316
  6. Jindong Gu, Xiaojun Jia, Pau de Jorge, Wenqian Yu, Xinwei Liu, Avery Ma, Yuan Xun, Anjun Hu, Ashkan Khakzar, Zhijiang Li, Xiaochun Cao, Philip Torr. A Survey on Transferability of Adversarial Examples across Deep Neural Networks. Transactions on Machine Learning Research, 2024. arXiv:2310.17626, DOI: 10.48550/arXiv.2310.17626. https://arxiv.org/abs/2310.17626
  7. Wenqian Yu, Jindong Gu, Zhijiang Li, Philip Torr. Reliable Evaluation of Adversarial Transferability. IEEE SaTML 2025. arXiv:2306.08565, DOI: 10.1109/SaTML64287.2025.00049. https://arxiv.org/abs/2306.08565
  8. Ruijie Yang, Yuanfang Guo, Junfu Wang, Jiantao Zhou, Yunhong Wang. Common Knowledge Learning for Generating Transferable Adversarial Examples. Frontiers of Computer Science, 2024. arXiv:2307.00274, DOI: 10.1007/s11704-024-40533-4 (published online January 2025; journal issue 2024). https://arxiv.org/abs/2307.00274
  9. Ang Li, Yifei Wang, Yiwen Guo, Yisen Wang. Adversarial Examples Are Not Real Features. NeurIPS 2023. arXiv:2310.18936, DOI: 10.48550/arXiv.2310.18936. https://arxiv.org/abs/2310.18936
  10. Isha Gupta, Rylan Schaeffer, Joshua Kazdan, Ken Ziyu Liu, Sanmi Koyejo. Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeed. 2025. arXiv:2510.01494, DOI: 10.48550/arXiv.2510.01494. https://arxiv.org/abs/2510.01494
  11. Jennifer Crawford, Amol Khanna, Fred Lu, Amy R. Wagoner, Stella Biderman, Andre T. Nguyen, Edward Raff. Adversarial Samples Are Not Created Equal. 2026. arXiv:2601.00577, DOI: 10.48550/arXiv.2601.00577. https://arxiv.org/abs/2601.00577
  12. Juanjuan Weng, Zhiming Luo, Zhun Zhong, Shaozi Li, Nicu Sebe. Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibration. IEEE Transactions on Multimedia, 2025, DOI: 10.1109/TMM.2025.3565673. arXiv:2303.03680, DOI: 10.48550/arXiv.2303.03680. https://arxiv.org/abs/2303.03680