Consensus-Robust Transfer Attacks via Parameter and Representation Perturbations
Authors: Shixin Li
Zewei Li
Xiaojing Ma
Xiaofan Bai
Pingyi Hu
Dongmei Zhang
Bin Benjamin Zhu
Venue: NeurIPS 2025 poster ()
Keywords: Black-box adversarial attack; Transferability
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Adversarial examples crafted on one model often exhibit poor transferability to others, hindering their effectiveness in black-box settings. This limitation arises from two key factors: (i) \emph{decision-boundary variation} across models and (ii) \emph{representation drift} in feature space. We address these challenges through a new perspective that frames transferability for \emph{untargeted attacks} as a \emph{consensus-robust optimization} problem: adversarial perturbations should remain effective across a neighborhood of plausible target models. To model this uncertainty, we introduce two complementary perturbation channels: a \emph{parameter channel}, capturing boundary shifts via weight perturbations, and a \emph{representation channel}, addressing feature drift via stochastic blending of clean and adversarial activations. We then propose \emph{CORTA} (COnsensus--Robust Transfer Attack), a lightweight attack instantiated from this robust formulation using two first-order strategies: (i) sensitivity regularization based on the squared Frobenius norm of logits’ Jacobian with respect to weights, and (ii) Monte Carlo sampling for blended feature representations. Our theoretical analysis provides a certified lower bound linking these approximations to the robust objective. Extensive experiments on CIFAR-100 and ImageNet show that CORTA significantly outperforms state-of-the-art transfer-based methods---including ensemble approaches---across CNN and Vision Transformer targets. Notably, CORTA achieves a \emph{19.1 percentage-point gain in transfer success rate over the best prior method} while using only a single surrogate model.

Consensus-Robust Transfer Attacks via Parameter and Representation Perturbations
Shixin Li", Zewei Li', Xiaojing Ma Xiaofan Bai', Pingyi Hu', Dongmei Zhang", Bin Benjamin Zhu
Huuzhhon University of Science and Technology Miicosooft Corporation ([siiiinii lizewei, lindahust, xiaofanbai, pingyinu) edu cn [(dongmeiz, binzhu] @eichusottrrrr.t.cooo
Abstract
Adversarial examples crafted on one model often exhibit poor transferability others, hindering their effectiveness in black-box settings. This limitation arises from key factors: (i) Deccssinnbbuudaryy variation across models and (ii) rep- resentation drift in feature space. We address these challenges through a new perspective that frames transfcrability for untargeted attacks consensus-robust optimization problem: adversarial perturbations should remain effective across a neighborhood of plausible target models. To model this uncertainty, we intro- duce two complementary perturbation channels: parameter channel, capturing boundary shifts via weight perturbations, and a representation chunnel, addressing feature drift via stochastic blending of clean and adversarial activations. We then propose CORTA (COnsensus-Rodl Robust Transfer Attack), lightweight attack instan- tiated from this robust formulation using two first-order strategies: (i) sensitivity regularization based on the squared Frobenius norm of logits' Jacobian with respect to weights, and (ii) Monte Carlo sampling for blended feature representations. Our theoretical analysis provides a certified lower bound linking these approximations the robust objective. Extensive experiments CIFAR- 1-0 and ImageNet show that CORTA significantly outperforms sate-offthe--ane transfer- methods including ensemble approaches- across CNN and Vision Transformer targets. Notably, CORTA achieves a 19. / percentage-poin gain in transfer success rale over the best prior method while using only single surrogate model.
1 Introduction
Adversarial attacks pose a serious threat to deep neural networks (DNNs), as small, often imperceptible perturbations to input data can cause models to produce incorrect predictions. The risks are particularly severe in safety-critical domains such as facial recognition, autonomous driving, and medical diagnosis [ Although numerous defenses have been proposed, black-box attacks remain especially concerning because they require no knowledge of the target model's architecture or parameters. Developing more effective black-box attacks therefore critical for exposing model vulnerabilities and advancing robust evaluation practices.
Most black-box attacks rely on transferability: adversarial examples generated on a surrogate model are expected to fool an unknown target model [5]. Transfcrability has therefore become a focal point for exposing cross-model vulnerabilities. Recent progress spans multiple directions grratiiossggradient
refinements 6 7 g
input transformations [10
12 [3]. model ensembles [14 15. 16 17].
and feature- objectives [8
20 21 22
23 While feature-level approaches begin to address
"Coresponning authors: Xiaojing Ma (lindahust @ hust.edu.cr) and Bin Benjamin Zhu (binzhu microsoft.com)
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

deeper causes of transfer failure- such as differences in internal representations -ostt existing methods do not explicitly or jointly tackle the full range of factors that limit transferability. Conse- quently, state-of-the-art success rates still drop sharply when the target's 8 architecture diverges from the surrogate's 's, due to overfitting to cerrogate-specifie characteristics and limited generalization to unseen black-box models.
Two Sources of Transfer Failure. Our analysis identifies two independent factors that hinder
adversarial transferability:
pecision-boundar variation. The local classification boundary can shift significantly between the surrogate and target models due to differences in initialization, training procedures, or architecture. As result, sample located the same position in decision space may still yield different predictions.
Representation drift. The latent representations produced by different models for the same input can diverge, placing the sample at different locations in feature space. This shift can cause the imput to fall on opposite sides of an otherwise similar decision boundary, leading to inconsistent outputs.
None of the existing attacks explicitly addresses both factors, leading limited transferability.
Consensus-Roie Robust Approach. We view transferability through a consensus-robute lens: any black- box target can be modeled as a perturbed version of single surrogate, with uncertainty injected along two independent axes:
Parumeter channel. We model decision-boundann shifts-are from differences in initialization, training, or architecture- as weight perturbations AW to the surrogate's parameters W. The perturbed model fW+AW simulates local boundary variation between the surrogate and target models.
Representation channel. Because an adversarial example resembles its clean counterpart, target especlesp one with a different architecture may preserve clean features that the surrogate suppresses. To emulate such variations, we blend the surrogate's s clean and adversarial latent representations at selected layers, simulating feature-level deviations.
These two perturbation modes jointly define an uncertainty set T over plausible target models. We therefore pose transferability as set-robust objective for untargeted attacks: choose input per- turbations that maximize the minimum (worst-case) loss across T-that is, raise the loss even for the worst-case target induced by bounded parameter perturbations, while taking expectation over stochastic feature blending. To make this tractable, we use two lightweight, first-order approxima- tions: linearizing the logits with respect to parameter changes and Monte Carlo sampling to estimate the expectation over feature blends. Our theoretical analysis then provides a certified lower bound on this robust objective in terms of two estimable quantities the expected blended loss and the squared Frobenius norm of the logits' Jacobian with respect to parameters offering principled guarantees for consensus-robus! transferability, We instantiate this formulation CORTA, a query- free, optimizer-agnostt attack on a single surrogate that maximizes the expected blended loss while regularizing the squured Frobenius norm of the logits' Jacobian, jointly addressing representation drift and decision- boundaryy variation.
Our Major Contributions:
Consensus-robee r formulation. We frame black-box transferability set-robust objective for untargeted attacks: choose perturbations that maximize the minimum loss across an uncertainty set of plausible targets, induced by bounded parameter perturbations Drecision-boundayy variation) and stochastic feature blending (representation drift).
Dual-channel surrogate modeling. We propose a unified transfer-based framework that emulates target variability via two channels on the surrogate: (i) the parameter channel, modeling boundary shifts through weight perturbations; and (ii) the representation channel, simulating feature-level discrepancies by blending clean and adversarial representations.
Principled first-order optimization with certified guarantees. We develop lightweight, scalable approximations for each channel-lon linearization for parameter perturbations and Monte Carlo estimation for feature blends-and provide theoretical analysis yielding a certified lower bound on the robust target objective in terms of two estimable quantities: the expected blended loss and the squared Frobenius norm of the logits' Jacobian with respect parameters.

---

Superior empirical results. Our CORTA consistently surpasses state-of-the-an transfer-based black-box attacks-ing antacks-including ensemble-based methods- diverse architectures (CNNs and ViTs) on ImageNet and CIFAR-100. For example, when transferring from ResNet-18 to Swin-B on CIFAR- 100, CORTA achieves a 97.9% transfer success rate, outperforming Ens- the strongest existing method- by 19.1 percentage points (78.8%), while using only single surrogate model (ResNet-18) compared to Ens's ensemble of four surrogates (two CNNs and two ViTs).
2 Related Work
Transfer-based adversarial attacks seek to enhance the effectiveness of surrogatee-ennerate examples on unseen models. Existing approaches can be grouped as follows:
Gradient-based refinements: Momentum
6 advanced optimizers 7
99 24 and skip-gradient
or linearized backpropagation 25 26 aim stabilize updates and escape local minima.
Input transformations: Random resizing, translation, and image mixing (c.g.. DI [1O], TI
Admix (12) increase input diversity to reduce overfitting to the surrogate.
Model ensembles: These attacks improve transferability by ensembling surrogate models with
diverse architectures [4 15 16]. To avoid training multiple models, Ghost Networks [27] and LGV [28] generate variants from single network via dropout perturbation high-learning-rate fine-tuning, while others ensemble checkpoints from one training trajectory [17]. Although these methods vary in how they introduce diversity, all require generating adversarial examples for multiple network instances, resulting in substantial computational overhead.
Feature-level attacks: These methods manipulate intermediate representations to promote trans- ferability. For example, TAP [8] and ILA [19] maximize the distance between clean and adversarial features at selected layers. FIA 20 BFA [29], and NAA (21] estimate feature im- portance using gradient-basee based attribution techniques. FPA (30) relies on permutation at a feature layer of CNN-based surrogate model. CFM (22) mixes adversarial features with those of benign samples, while DHF 23 mixes adversarial and original features during attack generation.
Existing methods fail to directly address both Most inject diversity to bridge the surrogate-targe gap without tackling these root causes. DHF the closest to our approach representation drift, but it remains heuristic and lacks principled formulation. Consequently, these methods consistently underperform compared to our approach, which explicitly and jointly targets both sources of transferability failure.
variation and representation drift.
3 Transferability as Consensus Robustness
3.1 Modeling Transferability via Parameter and Representation Perturbations
In Section [ we argued that adversarial examples generated surrogate model fw may fail to transfer to an unseen target f/ because of (i) decision-boundary boundary variation and (ii) representation drift. We formalize these two factors parameter and representation perturbations of the surrogate.
Decision Boundary Variation as Parameter Perturbation. Both fw and f solve the same task, so their decision boundaries are generally similar despite differences in initialization, optimization, or We model the target as a parameter- partueeer-perturbee version of the surrogate:
even architecture [31 32
(x) R (w))
where | & represents "nearby" models, and æ denotes an input with true label y. This gives an architecture-agnostie abstraction of decision-boundai shifts.
Representation Drift as Feature Blending. Adversarial examples usually remain visually and semantically similar to their originals, yet targets may retain features suppressed by the surrogate, causing intermediate mismatch. To capture this uncertainty, we stochastically blend, at chosen set of layers S, the activations from the adversarial and clean inputs
>blend (Xe) de adv + (1 Xx) oris,
de E Dmmia 1], e S,
(2)
where zædv ze(x + 6: W) and 2i orig << W) are computed at layer using the same weights W. This stochastic blending abstracts representation uncertainty across models.
3

---

Robust Target Objective (Set-Robust Formulation). We define the uncertainty set over targets as the product of bounded parameter and representation variations:
T { (AW; A): ||WW|| S p, À E Amin 1J|s1
(3)
Maximizing untargeted transferability reduces to the consensus-robus' optimization:
max BEB, (AWA))T
min
AJw+aw(1 + o; { blend (Xx)3; v).
This "consensus-rofee robustt objective requires an adversarial perturbation å to induce high loss uniformly across nearby parameterizations and a range of representation blends.
3.2 Practical Approximations for Consensus Robustness
Direct optimization of Eq. (4) intractable as T spans infinitely many perturbations. We approximate it via two first-order channels.
Parameter Channel: Parameter Channel: Linearization. For small AW, first-order Taylor expansion of the loss around W yields
C(fw+aw ()),) = C(fw(())))))) (-), 3) + (w AW,
(5)
where "." denotes the Frobenius inner product: A B A (), = (r(TB) = E; A:B. Sensitivity to AW satisfies V/ L S Coutl/Jwlle & W
where Jw Vw sw. Hence the worst-case linearized loss shift under ||WW]|r S P is at most Cout V fw llp.. This identifies W fw [e as a key quantity governing sensitivity parameter perturbations and motivates its use as a regularization term in our practical formulation described later.
Representation Channel: Monte Carlo Feature Blending. We approximate robustness to repre- sentation drift by averaging the loss under random feature blends. At each step, for each é we optionally enable blending and, if enabled, draw d uniformly from [Amia 1] and form 2 Eq. 2 This Monte Carlo procedure provides an unbiased estimator the gradient of the consensus (expected) loss with respect to 6, and will serve building block in our practical formulation introduced later.
hlend as in
3.3 Theoretical Analysis: A Lower-Bound Certificate for the Robust Target
We show that the approximation in Section 3.2llon3.. a computable lower bound- up to constants on the robust target in Eq. 44. linking our practical surrogate to the original worst-case objective.
Notation. Let Lw (2r, 8; X) == [w (x= blennd (Ae))), u) and denote the loss gradient with respect to parameters by gw (x. 8; A) == V w Lw (x, 5; A). Let Jw (a, 6; A) = fw (x + 8; {=blend (Ae) be the Jacobian of the logits.
Assumptions. Fix P > 0 and Amin E (0, 1). We assume: (i) Twice- differentiabilityy in W and
uniform Hessian spectral bound along W - W + AW: || (æ, 8; A) S M for all á E B., ||W||r S p, À E [Amin, 1]|s| and some n W + layer 8 E S, the task loss is Lipschitz in the blended feature with constant Li: |Ew (z,, 8; A) Lw (x, 5; X)) < L || (blend(d)) - =t (X))]] when À and X' differ only in coordinate l. (iii) The feature drift layer E is uniformly bounded for 5 Be: ||ee( W) =e(x;; W)ll & Be(e). A sufficient condition is that the layer mapping to ze is Li-Lipschitz in the input, in which case (E) < L,e. (iv) The loss gradient with respect to logits is bounded: ,/V L(f. w)ll < Cout (e.g.. Cont I 2 for cross-entropy with softmax).
(0, 1). (ii) For each blended
Parameter Channel: Lower Bound for the Min over AW. For any À and any 8 E Be, Taylor's theorem and Assumption (i) give, for all ||W]]| S
Lw+Aw (z, 8; A) 2 (x 6; [|9w (z, 6; A) | - fM
Taking the minimum over ||Wl|| S p and using Assumption (iv) and the chain rule, |!gw S
Cont Jwwll, [|. yields
SP (2,4AW2,,6;) 2 Lw(x,,;1) - C (l (| 6;)1 _MP, (6)
min

---

Representation Channel: Min-Mean Bound for Blending. By Assumptions (ii) (ii), the loss
Lipschitz in each A₂ with constant C₃ := L (r))), since || 2 (A₂) 2/ 2plend (x²) [
X/ I|æg.v 2t corig] metric,
- Ae X/l Be(). Hence, over the hypercube À E [mmnn 1|1s1 endowed with the
(2; - (x, & Σ Cclee - X/1-
RES
follows that the range of Lw (x, o;-) over (Ammn 1]|s| is at most (1 - 11-Amiu) Eees Ce, and therefore,
for any probability distribution Px supported on [Amin 1]
Lw (xx, A) 2 Ex-Py (x, {; | X
min
-11-Amin)
-mmi)))
Σ
(8)
tES
In particular, this holds for the layer-wise wise Bernoulli Bemoulli-plus-ee lllspplllluonnano sampling scheme used by CORTA. Combined Certificate. Combining Eqs. (6 and (8) and then taking expectation over PA yields, for any 8 E Be.
(fw++aw(e (z 8: (2 (Ae)t), u) 2 ExuPa [a[w (xx (x+ 88; 12 (2e)), w)]
min ||WW|l Sp.
poutt BANPA (1 M (1 Amin)
Σ LE Be(s). EES
Finally, by Jensen's 's inequality, ExIl ||r < VEAl so controlling the second moment of the Jacobian suffices bound its expected norm; hence -quared-norm regularizer is principled surrogate.
Interpretation. The bound in Eq. 9 shows that maximizing the expected blended loss and penalizing the Jacobian norm || Vw I provably increases a certified lower bound on the true robust objective, up to additive terms that depend only on model smoothness, p. and blending/feature-drift constants.
4 COnsensus-Robus Transfer Attack (CORTA)
Guided by the lower-bound certificate in Eq. (9) CORTA constructs an input perturbation å that simul- taneously (i) forces the surrogate to misclassify, (ii) maintains a high loss under random representation blends, and (iii) limits sensitivity of the logits parameter perturbations ddeiisoon-boundary variation). After presenting the optimization objective, we detail its practical realization Parameter- Stabiility wettiiiiaatooooollloeoooee by the iterative generation of adversarial examples.
4.1 Optimization Objective
Let () Ww denote the logits' Jacobian with respect to parameters. For untargeted attacks CORTA solves
arg min JEB.
E un [Cn + 6; (=hlend)) }),u] + B || (x + +01 (10)
=
representation channel
parameter channel
where U denotes the uniform distribution and Amin E (0, 1) is a hyperparameter. The first term maximizes the expected cross-entropy loss under random feature blends (estimated via Monte Carlo), encouraging robustness representation drift. The second term penalizes the squared Frobenius norm of the logits' Jacobian with respect to parameters, reducing sensitivity to decision-boundary variation. The trade-off coefficient B > 0 is tuned empirically.
'The targeted variant removes the negative sign in front of the expectation and replaces LcE with the
target-class loss.
5

---

4.2
Representation Channel: Stochastic Feature Blending
Let be set of latent layers whose activations are exposed for blending. During each attack iteration we perform the following Monte-Carlo procedure:
For every E S, sample a Bernoulli variable Tz Bernoullipp;) with blending probability Pb E {0, 1].
2. If
1, draw de- Ae 1] and mix the adversarial and clean activations:
hlend 2g = de zadv + (1 Ar) 2
orig.
(11)
otherwise set 2blend =adv
The stochastic switch explores a neighborhood of possible representation drifts while preserving adversarial signal when blending disabled. As ph -0 1, CORTA reduces to ordinary PGD or full feature blending, respectively.
4.3 Adversarial Example Generation
Starting from random initialization 6g ~1([[[,,, E], we refine the perturbation for T iterations. For clarity we present the basic I-FGSM update, but any gradient-based refinement, such MI-FGSM 6 or NI-FGSM 77, can be plugged in unchanged, as CORTA is optimizer-agnostic.
6.+1 clip, 55 + sign 5., [Ce (fw (x: + 6;; {2t
blend }). v) - [[ (oe + d)1l)))). (12)
where is the step size and clip, projects the perturbation onto the foc ball of radius centered at x. The blended features in Eq. [T] are recomputed at each iteration, so the optimization implicitly minimizes the expectation in Eq. (TO). By jointly penalizing parameter sensitivity and injecting stochastic feature blending, CORTA generates adversarial examples that transfer reliably across diverse architectures and training procedures.
Experiments
5.1
Experimental Setting
Datasets. We follow [16 and evaluate on two benchmarks: an ImageNet-compatible datase 2 and CIFAR-100 100 [3]. All reported results are averaged over the entire ImageNet-coompatbble dataset and the full CIFAR-100 100 test set.
Models. Target models: We use diverse architectures, including CNNs (ResNet-50 34 WideResNet- 101 [35], BiT-M-R50 (36,, BiT-M-R101 (36)) and vision transformers (ViT-Base 37 DeiT-Base 38),
Swin-Base (39]
Swin- Small (39].
Surrogate models: For both CORTA and other non-ensemble baselines, we use a single surrogate model--ReNNe-- for CNN-based attacks and ViT-Tiny for ViT-based attacks. For checkpoint- ensemble attacks, we follow [17. which also adopts a single surrogate (either ResNet-18 or ViT-Tiny) but aggregates multiple checkpoints from the same model architecture. For ensemble-based attacks such as Ens and AdaEA, we follow [40] and adopt multi-architecture surrogate setup comprising four models: ResNet-18, Inception-v3, ViT-Tiny, and DeiT-Tiny. All models are pretrained and obtained from PyTorch Image Models [41]
Attack Baselines. We compare against strong transfer-basse black-box attacks: ensemble based (Ens [14, AdaEA (16), Checkpoints (17)), feature-level (DHF (3), BFA (29). input transformation (Admix (12), and gradient-baas (ANDA 24)). Official code and default settings are used unless
otherwise specified.
Defenses. We evaluate CORTA against adversarial training 42
and input transformation-basee
defenses, including JPEG compression 44 Randomized Resizing and Padding (R&P) 45 Bit

---

Table 1: TSRs (%) CIFAR-100 and ImageNet with I-FGSM, using ResNet- 18 as the surrogate except for Ens and AdaEA, which use 2 CNN and 2 VIT surrogates. Bold indicates best performance.
CNN
VIT
Dataset
Attack
RN-50
WRN-101
BTT-50
BTT 101
VrT-B
Deit-B
Swin-Is
Swin-S
Avg.
Admix
81.5
72.4
72.4
78.7
31.3
33.0
41.6
57.1
40.8
Ens
92.0
87.4
83.3
73.3
84.0
75.2
89.1
78.8
85.4
82.1
AdałAA
86.3
82.6
76.3
67.0
78.
64.0
79.0
68.7
81.3
73.3
DHF
90.2
92.3
79.1
75.0
84.1
39.3
33.7
36,5
57.9
41,9
CIFAR-100
BFA
89.9
92.5
77.0
73.2
83.2
40.6
36.5
39,9
58.5
43,9
ANDA
77.9
77.6
40.3
39.5
44.6
58.3
45.7
Checkpoints
90.3
97.7
94.7
91.3
93.5
64.0
61.7
54.7
73.0
63.4
Ours
97.3
98.8
98.2
96.2
97.6
96.8
93.5
97.9
97.1
96.3
Admix
91.9
83.6
79.5
71.1
81.5
26.4
38.6
29.6
36.3
32.7
Ens
62.5
62.9
26.6
36.6
42.3
AdaEA
73.5
59.1
50.9
61.2
36.9
53.8
25.0
33.4
37.3
DHF
96.8
92.8
90.8
84.6
91.3
37.8
51.3
43.5
$2.6
46.3
ImageNet
BFA
97.9
95.8
93.6
89.6
94.2
43.0
53.2
47.8
57.3
50.3
ANDA
94.4
86.1
81.7
73.3
83.9
36.8
52.2
38.8
47.0
43.7
Checkpoints
95.5
95.9
90.6
56.0
40.4
51.2
48.2
98.5
95.8
95.5
92.4
95.5
47.6
63.8
54.2
64.1
57.4
Table TSRs (%) on ImageNet with I-FGSM, using ViT-Tiny as the surrogate, except for Ens and AdaEA, which 2 CNN and VIT surrogates. Bold indicates best performance.
CNN
VIT
Attack
RN-50
WRN-101
BiT-50
BiT-101
Avg.
VIT-B
Deit-B
Swin-B
Swin-S
Avg.
Admix
37.7
43.9
49.7
42.7
43.5
48.5
63.9
26.6
31.9
42.7
Ens
71.2
63.2
62.5
54.9
63.0
42.9
62.9
26.6
36.6
42.3
AdaEA
61.4
59.1
50.9
61.2
25.0
37.3
DHF
46.0
52.4
55.6
49.4
50.9
64.0
76.5
32.9
40.8
53.6
BFA
51.1
56.3
59.5
52.8
54.9
72.9
85.8
34.5
44.9
59.5
ANDA
58.4
65.5
68.5
62.0
63.6
65.0
74.3
39.7
47.4
56.6
Checkpoints
41.0
42.9
49.8
41.0
43.7
54.9
81.9
26.7
34.9
49.6
Ours
70.4
74.4
69.2
87.8
50.7
Depth Reduction (Bit-R) (46). Feature Distillation (FD) (NRP) (88).
47 and Neural Representation Purifier
Evaluation Metrics. We report Transfer Success Rate (TSR): the attack success rate the target model for adversarial examples that are misclassified by the surrogate.
Implementation Details. All attacks are untargeted and evaluated under an L.e bound of e 16/255 for T' 100 iterations with step size of a 1.6/255, The regularization weight is chosen to balance the magnitudes of the two loss terms in Eq. 10 on the surrogate model. The blending probability is set Р6 0.5 based on surrogate optimization performance, and the blending proportion À is sampled from 2/ 00.25. 1] to ensure sufficient feature mixing without reducing generation success. Stochastic feature blending is applied to all layers for CNN surrogates and to all linear layers for VIT surrogates. I-FGSM is used as the default method for generating adversarial examples. All experiments are implemented PyTorch and conducted on two NVIDIA RTX 3090 GPUs.
0.1.
5.2 Adversarial Transferability
Attack on Standard Target Models. T compares CORTA and baselines on CIFAR-100 and ImageNet across CNN and ViT targets, using ResNer-18 as the surrogate for all methods except ensemble-bare Ens and AdaEA, which use two CNN plus two ViT surrogates (see Section 5.I]
CORTA achieves the highest TSRs for every target model, across both CNN and VIT targets. On CNN targets, it attains average TSRs of 97.6% (CIFAR-100) and 95.5% (ImageNet), outperforming the best basclines by 13.0% and 1. 1.1, respectively. On ViT targets, despite using only single

---

CNN surrogate, CORTA achieves 96.3% (CIFAR-100) and 57.4% (ImageNet), surpassing even the ensemble-basee methods-white which utilize ViT surrogates by 14.2% and 7.1%. Notably, when transferring from ResNet- 18 to Swin-B on CIFAR-100, CORTA achieves 19. % higher TSR (97.9% vs. 78.8%) compared to ensemble-hased Ens, the strongest baseline.
These results demonstrate CORTA's strong transferability across datasets and model families, As most prior work focuses on ImageNet [22 23 24), subsequent experiments primarily report ImageNet results for consistency.
Table reports TSRs on ImageNet using ViT-Tiny as the surrogate for all methods, except for ensemble- onsemele-based Ens and AdaEA, which continue to use two CNN plus two ViT surrogates. CORTA consistently achieves the best overall performance, with average TSR gains of 5.6% on CNN targets and 9.2% on VIT targets over the strongest alternatives. Furthermore, CORTA outperforms all baselines nearly every individual target model, with the only exception being RN-50, where it remains competitive and is surpassed only by the ensemble-based Ens and AdaEA. These results underscore CORTA's robustness and effectiveness across different surrogate architectures. We also report error bars in Appendix
Table 3: TSRs (%) on ImageNet with I-FGSM against various defenses, using ResNet- 18 as surrogate except for Ens and AdaEA (2 CNN and 2 VIT surrogates). Bold indicates best performance. Left: TSRs for adversarially trained models. Right: average TSRs for input transformation defenses.
Attack
Adversarial Training Defense
Input Transformation Based Defenses
Ine-v3ens3
Inc-v3ens4
Inc-v2ens
Avg.
R&P
Bit-R
JPEG
NRP
FD
Avg.
Admix
54.1
52.6
38.9
48.5
59.2
56.5
52.1
25.2
57.8
50.2
Ens
37.3
36.0
22.7
32.0
48.3
46.6
43.6
24.4
50.7
42.7
AdaEA
30.6
30.1
19.4
26.7
45.5
50.4
39.4
23.9
47.0
41.2
DHF
63.3
60.6
45.4
56.4
70.5
68.1
58.3
28.4
68.2
58.7
BFA
69.3
62.8
49.4
60.5
76.2
72.0
62.7
33.1
72.6
63.3
ANDA
55.7
53.2
39.5
49.5
67.6
62.6
58.2
26.0
63.9
55.7
Checkpoints
73.9
72.4
57.4
71.8
28.9
72.2
63.7
Ours
76.5
72.8
60.1
69.8
78.1
75.6
70.8
41.2
76.3
68.4
Table 4: CORTA's TSRs (%) on ImageNet with ResNet-18 as surrogate, using different adversarial example generation methods. indicates improvement over I-FGSM.
CNN
VIT
Base
RN-50
WRN-101
BiT-50
BiT-101
Avg. (A)
VIT-B
DeiT: B
Swin-B
Swin-S
Avg. (A)
I-FOSM
98.5
95.8
95.5
92.4
95.5
47.6
63.8
54.2
64.1
57.4
MI-FGSM
98.7
96.3
95.7
93.3
96.0
52.7
68.2
56.8
67.0
61.2 (+3.8)
DIM DIM-FGSM
(7.05)
67.1
(+16.9)
Attack on Defended Target Models. To further assess practical effectiveness, we evaluate all methods against two categories of defenses: (i) adversarial training, using three adversarially trained models, and (ii) input transformation-basee based defenses. The results are summarized in Table 3
CORTA achieves the highest TSRs across both defense types. Specifically, it obtains an average TSR of 69. 8% against adversarially trained models and 68.4 68.4% against input transformation defenses. In comparison to the strongest baseline methods, these results represent improvements of 1.9% and 4.7%, respectively.
These gains demonstrate that CORTA not only transfers effectively under standard conditions but also maintains strong robustness against advanced defense strategies.
Table 5: Generation success rates ImageNet with ResNet-18 surrogate.
Dataset
Admix
Ens
AdaEA
DHF
BFA
ANDA
Checkpoints
Ours
ImageNet
97.0
100
100
99.4
99.4
96.3
100
69.9

---

Table 6: Computation time (s) per adversarial sample on ImageNet with ResNet-18 surrogate.
Dataset
Admix
Ens
AdaEA
DHF
BFA
ANDA
Checkpoints
Ours
ImageNet
1.3
5.2
18.8
2.0
1.8
2.1
17.2
1.7
Generating Adversarial Examples with Advanced Strategies. CORTA uses I-FGSM as the default method, but it is compatible with stronger adversarial example generation methods. We compare I-FGSM with two enhanced variants: MI-FGSM [6] and DI [TO), on ImageNet with ResNer-18 18 as the surrogate. As shown in Table 4 integrating MI-FGSM improves average TSRs from 95.5% to 96.0% on CNN targets and from 57.4% to 61.2% on VIT targets. Combining MI-FGSM with input diversity (DIM-FGSM) further boosts transferabillty, achieving 97.0% CNN and 74.3% on ViT targets- absolute aurgeus-absolute gains of 1.5% and 16.9% respectively. These results demonstrate that CORTA benefits from stronger gradient-basee attacks, further enhancing transferability across both CNN and ViT models.
5.3 Generation Success Rate on Surrogate
In addition to the TSRs reported above, we evaluate the generation success rate (GSR), defined as the proportion of adversarial examples that successfully mislead the surrogate model during attack generation. Table 5 presents the results: most baselines (Ens, AdaEA, DHF, BFA, Checkpoint)
achieve nearly 100% success, whereas CORTA attains lower rate of 69.9%.
Why is CORTA's surrogate success lower? This reduction mainly stems from two factors intrinsic to its set-robust formulation:
1. Dual-objective optimization. Unlike most baselines that optimize a single loss, CORTA jointly optimizes two Srpectives--epreeenneee and parameter channels channels-making the optimization problem more challenging.
2. Feature blending interference. The feature blending operation integrates the original sample's latent features, which can partially conflict with the adversarial perturbation objective, reducing surrogate success rates.
Is this lower surrogate success practical problem? Not really- the key metric is transfer success rate (TSR), not surrogate success. In practice, attackers can simply discard unsuccessful examples on the surrogate and retain only those that succeed. This adds only modest overhead: generating the same number of successful examples requires optimizing about 1 1.43 times more samples (e.g., 100/69.9 compared to attacks achieving 100% surrogate success).
5.4 Computational Cost
Beyond transfer success rates and surrogate generation success rates, computational efficiency is also crucial. rrepots the average time to generate an adversarial example. CORTA, requiring only a single surrogate, matches the speed of other single-model attacks and is significantly faster than ensemble-bat methods. Thus, CORTA achieves superior transferability without additional computational overhead.
5.5 Ablation Study
CORTA Components. We evaluate the contributions of Parameter-Stee Stabbility Regularization and Stochastic Feature Blending by comparing CORTA with: both components, each component individ- ually, and neither (i.c., standard I-FGSM). Table shows that both components are essential, with the best TSRs achieved when combined.
Hyperparameter Sensitivity. We assess the impact of three hyperparameters parameter stability weight 3, blending lower bound Amin- and blending probability Po-by generating adversarial examples on ImageNet (ResNet-18 surrogate) and evaluating TSRs on CNN and ViT targets. As shown in Figs. [13]] CORTA maintains stable performance for 3 in [0.01, 0.1], ps in [0.5, 1J. and Amin in 0.33. These results indicate moderate sensitivity and robust performance across a range of hyperparameter values.

---

Table 7: Impact of CORTA components ImageNet (ResNet- 18 surrogate). Bold indicates best performance.
used; absent.
Ablation
CNN
VIT
Representation Parumeter
RN-50
WRN-101
BIT-50
BIT-101
Avg.
VIT-B
Deit-B
Swin-B
Swin-S
Avg.
61.1
48.2
41.7
33.3
46.1
10.8
16.5
12.9
15.7
14.0
65.3
58.2
46.4
39.0
52.2
12.1
19.3
14.1
15.4
15.2
97.1
92.8
91.3
85.0
91.5
44.6
58.0
48.3
58.4
52.3
98.5
95.8
95.5
92.4
95.5
47.6
63.8
54.2
64.1
57.4
RN-58
WRN-101
Avcrige T3R.55)
D1I-00
DeT--I
Averge
40
40
Stata-I
20
20-
0.00
0.25
0.50 Weight
0.75
1.00
92
Blending Probability
Blending Lower Bound
Figure 1: Weight (3).
Figure 2: Blend probability Figure 3: Blend lower bound (Amin).
Limitation
potential limitation of our method is the need compute second-order derivatives for each sample independently during backpropagation. Although frameworks like PyTorch and TensorFlow support automatic differentiation, their second-order computations typically aggregate curvature across batch rather than compute per-sample values, limiting batch parallelization and increasing computational overhead, Nevertheless, shown in Section 5.4. CORTA's single-surrogate optimization keeps the overall time cost practical.
Another limitation is that optimizing adversarial examples the surrogate model with CORTA be more challenging than with other single-mode methods. For example, on ImageNet, CORTA achieves generation success rate of 69.9%, compared 96.3% for ANDA. However, this reflects performance on the surrogate model, while our goal is to generate adversarial examples that successfully attack the target model. As long the generation cost the surrogate is low and the resulting examples are effective against the target model, a reasonably lower generation success rate on the surrogate model does not diminish the practical effectiveness our approach.
Conclusion
We introduced consensus-robust framework for transfer-based untargeted adversarial attacks, explicitly addressing two underexplored factors limiting transfcrability: decision-boundarr variation and feature representation drift. Our formulation models a neighborhood of plausible targets through parameter perturbations and representation blending, leading to a principled set-robust objective tailored for untargeted transfer attacks.
To make this objective tractable, we proposed two scalable first-order approximations with theoretical guarantees and instantiated them as CORTA, an efficient attack requiring only single surrogate. CORTA integrates sensitivity regularization with stochastic feature blending, enabling attacks that are significantly more transferable across model families and training variations.
Extensive experiments on CIFAR-IO1 100 and ImageNet show that CORTA surpasses both single- surrogate and ensemble-based attacks while requiring only one surrogate model. For example, on CIFAR-100, transferring from ResNet-13 18 to Swin-B, CORTA achieves a 97.9% TSR, exceeding the strongest baseline by 19.1 points despite using far fewer resources.
Looking ahead, key direction extending this framework to targeted attacks, which imposes much stricter requirements: crafting perturbations that not only transfer but also steer predictions toward a specific target class under significant model variability. This extension poses challenging but critical step toward building comprehensive evaluations of adversarial robustness.
10

---

Acknowledgements
This work was supported in part by the National Natural Science Foundation of China (Grant No. 62272175), the Major Research Plan of Hubei Province (Grant/Awart No. 2023BAA027), the Key Research & Development Plan of Hubei Province of China (Grant No. 2024BAB049), and the project of Science, Technology and Innovation Commission of Shenzhen Municipality of China (Grant No.
GJHZ202402181 (EE2118111669277)
References
[1] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. January 2014. 2nd International Conference on Learning Representations (ICLR) 2014.
[2] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun, editors, 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
[3] Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1625-1634 2018.
[4] Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac S Kohane. Adversarial attacks on medical machine learning. Science, 363(643)) 1289, 2019.
[5] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black- box attacks against deep learning systems using adversarial examples. arXiv preprint arXiv: 02697, 1())3, 2016.
[6] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 9185-9193 2018.
[7] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In 8th International Conference Learning Representations, ICLR 2020, Addis Ababo, Ethiopia, April 26-30, 2020. OpenReview.net, 2020.
[8] Xiaosen Wang, Jiadong Lin, Han Hu, Jingdong Wang, and Kun He. Boosting adversarial transferability through enhanced momentum. In 32nd British Machine Vision Conference 2021, BMVC 1021, Online, November 22-25, 2021, page 272. BMVA Press, 2021.
[9] Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1924-1933, 2021.
[10] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2730-2739, 2019.
[11] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invarian attacks. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 4312-4321, 2019.
[12] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEL/CVF International Conference on Computer Vision, pages 16158-16167, 2021.
[13] Kunyu Wang. Xuanran He, Wenxuan Wang, and Xiaosen Wang. Boosting adversarial transferability by block shuffle and rotation. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 24336-24346. 2024.
[14] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and blx attacks. In 5th International Conference on Learning Representutions, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
[15] Yifeng Xiong. Jiadong Lin, Min Zhang, John E Hopcroft, and Kun He. Stochastic variance reduced ensemble adversaria attack for boosting the adversarial transferability. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages
2022.
11

---

[16] Bin Chen, Jiali Yin, Shukai Chen, Bohao Chen, and Ximeng Liu. An adaptive model ensemble adversarial attack for boosting adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vixion, pages 4489-4498, 2023.
[17] Shixin Li, Chaoxiang He, Xiaojing Ma, Bin Benjamin Zhu, Shuo Wang, Hongsheng Hu, Dongmei Zhang, and Linchen Yu. Enhancing adversarial transferability with checkpoints of a single model's training. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 20685-20694, 2025.
[18] Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. Transferable adversarial perturbations. In Proceedings the European Conference Computer Vision (ECCV), pages 452-467, 2018.
[19] Qian Huang. Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4733 4723-44422222 2019.
[20] Zhibo Wang, Hengchang Guo, Zhifei Zhang. Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance- aware transferable adversarial attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7639-7648, 2021.
[21] Jianping Zhang, Weibin Wu, Jen-tse Huang. Yizhan Huang, Wenxuan Wang. Yuxin Su, and Michael Lyu. Improving adversarial transferability via neuron attribution-ban based attacks. In Proceedings of the IEEE/CVF conference on compiter vision and pattern recognition, pages 14993-15002, 2022.
[22] Junyoung Byun, Myung-Joon Kwon, Seungju Cho, Yoonji Kim, and Changick Kim. Introducing com- petition to boost the transferability of targeted adversarial examples through clean feature mixup. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 24648-24657, 2023.
[23] Zhiyuan Wang. Zeliang Zhang. Siyuan Liang, and Xiaosen Wang. Diversifying the high-level features for better adversarial transferability. In 34th British Machine Vision Conference 2023, BMVC 2023, Aberdeen, UK, November 20-24, 2023, pages 70-76. BMVA Press, 2023.
[24] Zhengwei Fang, Rui Wang. Tao Huang, and Liping Jing. Strong transferable adversarial attacks via ensembled asymptotically normal distribution learning. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24841-22 24850, 2024.
[25] Dongxian Wu, Yisen Wang, Shu-Tar Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. arXiv preprint arXiv:2002.05990, 2020.
[26] Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of adversarial examples. Advances neural information processing systems, 33:85-95, 2020.
[27] Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille. Learning transferable adversarial examples via ghost networks. In Proceedings of the AAAI conference on artificial intellignnce volume 34, pages 11458-1 11458-11465,1 11465, 2020.
[28] Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Lgv: Boosting adversarial example transferability from large geometric vicinity. In European Conference Computer Vision, pages 603-618. Springer, 2022.
[29] Manyuan Wang. Jinwei Wang. Bin Ma, and Xiangyang Luo. Improving the transferability of adversarial examples through black-box feature attacks. Neurocomputing. 595:127863, 2024.
[30] Tao Wu and Tie Luo. Enabling heterogeneous adversarial transfcrability via feature permutation attacks. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 39-51. Springer, 2025.
[31] Yixuan Li, Jason Yosinski, Jeff Clune, Hod Lipson, and John E. Hoperoft. Convergent learning: Do different neural networks learn the same representations? In Yoshua Bengio and Yann LeCun, editors, 4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Rico, May 2-4, 2016, Conference Track Proceedings, 2016.
[32] Maithra Raghu, Justin Gilmer, Jason Yosinski, and Jascha Sohl- Dicksteei.. Sveea: Singular vector canonical correlation analysis for deep learning dynamics and interpretabilityy Advances in neural information processing systems, 30, 2017.
[33] Alex Krizhevsky. Learning multiple layers of features from tiny images. In University of Toronto, 2009.
12

---

[34] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 770-778. 2016.
[35] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference
2016. British Machine Vision Association, 2016.
[36] Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23 28, 2020, Proceedings, Part 16. pages 497-507. Springer, 2020.
[37] Alexey Dosovitskiy. Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words:
Transformers for image recognition at scalc. arXiv preprint arXiv:2010.1 /9000..//9999/... 2020.
[38] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pages 10347-10357. PMLR, 2021.
[39] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11112-0022,, 2021.
[40] Bowen Tang, Zheng Wang. Yi Bin, Qi Dou, Yang Yang. and Heng Tao Shen. Ensemble diversity facilitates adversarial transferability. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24377-24388 2024.
[41] Ross Wightman. Pytorch image models. 2019.
modelss
[42] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 0rXiv:/706.06083 2017.
[43] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint
2017.
[44] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00111 2017.
[45] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint 1...0999,, 2017.
[46] Weilin Xu. David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples deep neural networks. arXiv preprint arXiv:1704.00) 155, 2017.
[47] Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. Feature distillation: Dnn- oriented jpeg compression against adversarial examples. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 860- 868. IEEE, 2019.
[48] Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. self- supervised approach for adversarial robustness. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pages 262 271, 2020.
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The claims made in abstract and introduction are supported by theoretical
analysis in Section and experimental results in Section 5
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We have discussed the limitations of this work in Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
14

---

Justification:
We have provided detailed assumptions and proofs in Section 3
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proof' can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
The paper provides comprehensive details on the experimental setup, including hyperparameters, datasets, and evaluation metrics in the Section [] upon publication of this paper.
Justification:
Our code will be released
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
15

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
Our code will be released when the paper is published.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ "cipps.c/ppulli//guu /tto://uuuddeeoooouuuubmiiiiia ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Our training setup is described in detail in Section
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
We report error bars in Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
16

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We have detailed the computer resources in Section 5
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http::/:/haarrpp..cc//o////////t
Answer: [Yes]
Justification: We have reviewed the NeurIPS Code of Ethics, and our research complies with the guidelines outlined therein.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Our proposed method offers unified transfer-based framework that emulates target variability, addressing a critical need in the field of adversarial machine learning.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification: Our work poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The code used in the paper is properly attributed to its original sources, with references provided the original papers and code repositories.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the Datasets.papersstt
package should be provided. For popular datasets, paperswi thcode. cww/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
18

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Our work does release assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our work does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Our work does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
19

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: Our work does not involve LLMs any important, original, non-standard components.
Guidelines:
The answer NA means that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
20

---

A Error Bars
Reporting confidence intervals offers greater transparency into the reliability of experimental results, particularly given the inherent randomness in adversarial attack evaluations. To capture this variability, we repeated the experiments from Tad Ta 100 randomly selected samples, running each setting 20 times with different random seeds. All reported values are presented as mean + standard deviation. The corresponding results with error bars are summarized Table and Table 9
Table 8: Mean + standard deviation of TSRs (%) CIFAR-100 and ImageNet with I-FGSM, using ResNet- 18 as the surrogate except for Ens and AdaEA, which use CNN and 2 VIT surrogates.
CNN Models
VT Models
Dataset
Attack
RN-50
WRN-101
BTT:50
BFF-101
Avg.
VITB
DelT-B
Swin-B
Swin-S
Avg.
Admix
84.21:41
92.5122.5
75.614.3
75.6.19
82.01199
39.3.44.3
33.03228
37.01..00
52.714.0
40.512.3
91.021111
86.21111
7688409
70.24007
84.6:0.5
70.021.3
85.3+2.7
17.520.8
AdaEA
88.02:17
80.21:11
82.121.8
71911.
80.610.77
61.811.
79.8
63.012.1
78.0124
70.7&122
CIFAR-100
DHIF
90.8:00.8
89.1
77.0
72.3&19
82.3.1099
37.0.12.2
27.5
1.
52.0
1..
BFA
86.2:00.8
89.4....8
70.2+:1.0
68.24066
79.5++0.5
34.0:+0.7
30.7=:0.9
27.1=00.4
50.9+1.00
36.6+0..5
77.91:1.2
82.510.8
Ours
98.8
100.0=0.00
9:.8
96.81099
98.7100.6
98.8.11.4
95.4
93.3
94,911.5
95.41006
Admix
91,4=117
83.3+:2.7
81.8+
67.3+33.0
81.0+1.1
21.8+334
34,3=2244
24.1#3300
31.6+
28.0+:177
Fas
09.6++1.1
65.9+1.7
65-0+-2.1
52.2+1.2
63.2404
44,8+200
66.8+0.77
24.9+119
36.0+14
43.1+005
AdaBA
73.8=222
66.6+::22
00:30
46.4+3388
62.041.6
36.6:2222
54.242244
23.25188
28442277
35.6+114
ImtgeNet
BFA
99.5+0.6
97.5+00.6
95.5+0.6
902+10
95.9+044
39.0+08
52,5+066
44.2+1.7
56.2+15
49.6+04
ANDA
95.3:00.5
87.9
86.61:122
70.3+00.
85. 1:0.5
37,911.1
$3.420.9
35.921.
46.81:10
43.52006
Ours
99.9=0.4
98.1#:144
97.5114
89.3+2.0
96.0#1.0
45.6134
65.9228
52/12299
65.2424
56.91188
Table 9; Mcan + standard deviation of TSRs (%) ImageNet using ViT-Tiny the surrogate, except for Ens and AdaEA, which use 2 CNN and ViT surrogates.
CNN Models
VIT Models
Attack
RN-50
WRN-101
BTT-50
BIT-101
Avg.
VIT-B
DeñT-B
Swin-B
Swin-S
Avg.
Ens
69.611.1
65.9
65.0:12.1
52.21122
63.210.4
44.81200
66.8-0.7
24.9199
36.0=114
43.110.5
AdaEA
73.8+2.2
66.6+2.2
61.0+330
46.4+388
62.0+:166
36.6+2222
54.2=2.4
23.241.8
28.4-2.7
35.64:1.4
Admix
3988128
48.8.124
47.4.14.1
39.4124
43.911.6
48.6.1255
66.6 2.3
23.8.119
28.41.2.1
41.8:11.3
DHF
43.81225
51.6:12.
55.8.1.77
45.71.3
49.2.1
71.01266
79.0
30.0.1..5
38.1144.1
$4.5.118
BFA
55.0+0.0
60.6+0.5
63.74-10
50.6++0.5
57.540.0
75.440.5
90.6-0.5
40.74-1.0
46.4-005
63.340.44
ANDA
55.610.8
64.320.5
73.240.9
62.8:0.4
64.0:1.3
68.910.6
78.0=0.2
42.610.5
54.7=088
61.0:0.2
Ours
62.713388
71.2:24.0
73.143.0
63.423.7
67.6:12.0
82.8114.8
90,5=3.0
52.31443
63.924.2
72.422.3
21


Reviews:
[{"review_id": "Z6UUuv9vLw", "reviewer": "Reviewer_Gq3G", "summary": "The paper introduces CORTA, a consensus-robust transfer attack for adversarial examples in black-box settings. The key innovation lies in modeling two primary sources of transfer failure—decision-boundary variation and representation drift—as parameter and representation perturbations on a surrogate model. The authors formalize transferability as a distributionally robust optimization (DRO) problem over an uncertainty set of plausible target models and provide efficient first-order approximations with theoretical guarantees. Experiments on ImageNet and CIFAR-100 demonstrate that CORTA outperforms state-of-the-art transfer-based attacks, including ensemble methods, across diverse architectures (CNNs and transformers). Notably, CORTA achieves a 19.1% higher transfer success rate than the strongest baseline when transferring from ResNet-18 to Swin-B on CIFAR-100.", "questions": "1. How does CORTA’s computational cost scale with model size (e.g., ViT-Large)? Could approximations mitigate this?\n\n2. Optimization Trade-off: Why does CORTA’s surrogate success rate drop compared to baselines? Is this inherent to the DRO formulation?\n\n3. Hyperparameter generalization:\n(1) Are the chosen hyperparameters (e.g., β=0.1) task-specific, or can they be generalized? An analysis on additional datasets would help.\n(2) eps = 16/255 is quite large in AEs. What are the results for typical, smaller values of eps?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n\n- Formulation: The dual-channel perturbation framework (parameter and representation) is a new perspective on adversarial transferability. The DRO formulation is theoretically grounded and well-motivated. The first-order approximations (linearization for parameters, Monte Carlo for representation blending) are computationally efficient and supported by provable bounds.\n- Experiments: CORTA consistently outperforms baselines, including ensemble methods, across diverse architectures (CNNs, transformers) and datasets (ImageNet, CIFAR-100). It is also effective against defended models (e.g., adversarial training, input transformations) highlight robustness.\n- Analysis: The paper provides formal guarantees (Eq. 6) for the worst-case loss upper bounds. Ablation studies validate the contributions of each component (parameter regularization, feature blending).\n\nWeaknesses\n- CORTA requires second-order derivatives (per-sample Hessians), which limits batch parallelization. While the authors argue the cost is manageable, this could hinder scalability for very large models.\n- CORTA’s optimization success rate on the surrogate (69.9%) is lower than baselines (e.g., ANDA: 96.3%). The authors justify this by emphasizing target-model success, but this trade-off deserves deeper analysis.\n- Although the performance is stable within tested ranges (e.g., β∈[0.01,0.1]), the paper does not explore why these ranges work best or how they generalize to other tasks.", "was_revised": true, "final_justification": "The review is fair. I've responded to authors' rebuttal as well.", "rebuttal": "**Q.1** How does CORTA's computational cost scale with model size (e.g., ViT-Large)? Could approximations mitigate this?\n\n**A.1** The computational cost of CORTA is closely related to the model size. As the model size increases, the time required to optimize each image also increases. The following table illustrates the optimization time per image using various surrogate models on ImageNet:\n\n|         | ResNet-18 | ResNet-50 | ResNet-152 | ViT-Tiny | ViT-Base | ViT-Large |\n| --------| ----------| ----------| -----------| ---------| ---------| ----------|\n| Time(s) | 1.7       | 2.3       | 4.8        | 2.3      | 2.6      | 5.1       | \n\nAs shown in the table, the smallest model (ResNet-18) requires only 1.7 seconds of optimization time per image, while the largest model (ViT-Large) requires 5.1 seconds. Notably, even with the ViT-Large model, CORTA’s computational time remains within an acceptable range compared to ensemble methods that utilize multiple smaller models (Ensemble: 5.2s, AdaEA: 18.8s). Furthermore, CORTA achieves high transfer success rates even when using smaller models.\n\nThank you for the valuable suggestion regarding the use of approximations to mitigate computational costs. Reducing computational overhead is indeed a central focus of our ongoing research. In particular, we are actively exploring gradient approximation techniques to minimize computational expenses. Our goal is to develop a more lightweight approach for generating adversarial examples, while still maintaining high effectiveness.\n\n\n**Q.2** Optimization Trade-off: Why does CORTA's surrogate success rate drop compared to baselines? Is this inherent to the DRO formulation?\n\n**A.2** CORTA’s surrogate success rate is lower than that of baseline attacks mainly due to two factors inherent to its DRO formulation: (1) CORTA optimizes two objectives—representation and parameter channels—rather than a single objective, increasing optimization difficulty; and (2) the feature blending operation, which incorporates the original sample’s latent features, can interfere with the adversarial objective and further reduce success rates on the surrogate model.\n\nHowever, this lower surrogate success rate is not a practical issue. Attackers can simply discard unsuccessful adversarial examples using the surrogate model and retain only those that succeed, which tend to have higher transfer success rates. In practice, this only slightly increases computational cost, as generating the same number of successful examples requires optimizing about 1.43 times more samples (e.g., 100/69.9 compared to attacks with 100\\% surrogate success rate).\n\n\n**Q.3** Hyperparameter generalization: (1) Are the chosen hyperparameters (e.g., $\\beta$=0.1) task-specific, or can they be generalized? An analysis on additional datasets would help. (2) eps = 16/255 is quite large in AEs. What are the results for typical, smaller values of eps?\n\n**A.3**  (1) $\\beta$ is chosen to balance the magnitudes of the two optimization losses in the surrogate model, ensuring that their contributions are comparable. Consequently, $\\beta$ is not **task- or dataset-specific**, but rather related to the model architecture. For example, we used $\\beta = 0.1$ for ResNet-18 on both ImageNet and CIFAR-100. Additionally, our hyperparameter sensitivity analysis (see Figure 1 and Line 297 of the paper) demonstrates that $\\beta$ yields stable results within the range [0.01, 0.1].\n\n(2) We selected $\\epsilon = 16/255$ in our main experiments to align with baseline methods such as Admix, DHF, and BFA, since black-box attacks are considerably more challenging than white-box attacks. To further assess the robustness and generalizability of our method, we also conducted experiments with a smaller, more typical value of $\\epsilon$ ($\\epsilon = 8/255$).\n\nFor these experiments, we used ResNet-18 as the surrogate model on the ImageNet dataset, setting $\\epsilon = 8/255$, step size $\\alpha = 0.8/255$, and number of iterations $T = 100$. The table below presents the Transfer Success Rate (TSR) of CORTA and various baseline methods under these settings:\n\n| Method      | RN-50 | WRN-101 | BiT-50 | BiT-101 | Avg(CNN)  | ViT-B | Deit-B | Swin-B | Swin-S | Avg(ViT) |\n|-------------|-------|---------|--------|---------|-----------|-------|--------|--------|--------|----------|\n| Admix       | 68.8  | 60.9    | 58.2   | 48.3    | 59.1      | 13.3  | 18.8   | 15.6   | 19.3   | 16.8     |\n| Ens         | 47.0  | 43.3    | 44.5   | 37.2    | 43.0      | 26.7  | 39.7   | 15.5   | 20.9   | 25.7     |\n| AdaEA       | 48.7  | 43.8    | 43.2   | 35.4    | 42.8      | 23.6  | 39.0   | 15.2   | 20.0   | 24.5     |\n| DHF         | 86.8  | 79.2    | 75.5   | 65.5    | 76.8      | 21.3  | 31.2   | 22.6   | 31.5   | 26.7     |\n| BFA         | 87.3  | 80.6    | 70.8   | 63.3    | 75.5      | 14.0  | 23.5   | 20.0   | 26.6   | 21.0     |\n| ANDA        | 77.4  | 65.9    | 64.6   | 52.2    | 65.0      | 17.8  | 27.4   | 19.4   | 22.5   | 21.8     |\n| CORTA(Ours) | 86.9  | 83.8    | 84.3   | 72.6    | 81.9      | 25.3  | 39.2   | 28.2   | 36.5   | 32.3     |\n\nThe results show that even with a reduced perturbation budget ($\\epsilon = 8/255$), CORTA consistently outperforms baseline methods. This demonstrates that our approach maintains strong attack effectiveness within a smaller perturbation range, further validating the robustness and generalization capability of CORTA."}, {"review_id": "YZUn7RrpgL", "reviewer": "Reviewer_wbsA", "summary": "The paper introduces CORTA, a novel transfer-based black-box adversarial attack that enhances transferability by addressing decision-boundary variation and representation drift. It frames transferability as a distributionally robust optimization problem, modeling target model variability through parameter and representation perturbations on a single surrogate model. CORTA employs lightweight first-order approximations with theoretical guarantees to ensure robust misclassification. Extensive experiments on ImageNet and CIFAR-100 demonstrate CORTA’s superior performance, achieving a 19.1% higher transfer success rate compared to state-of-the-art baselines, including ensemble methods, across diverse architectures like ResNet-18 and Swin-B. The paper’s key contributions include a consensus-robust formulation, dual-channel surrogate modeling, principled optimization, and the CORTA attack itself, setting a new benchmark for black-box adversarial evaluation.", "questions": "Given the paper’s strong theoretical foundation and impressive empirical results with CORTA, no glaring issues stand out.", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths\nThe paper presents a highly innovative approach with CORTA, effectively addressing adversarial transferability by modeling decision-boundary variation and representation drift through a consensus-robust optimization framework. Its dual-channel surrogate modeling, combining parameter and representation perturbations, is both novel and theoretically grounded, with first-order approximations ensuring scalability and provable guarantees. CORTA’s superior empirical performance, achieving higher transfer success rate over state-of-the-art baselines on ImageNet and CIFAR-100, demonstrates its robustness across diverse architectures like ResNet-18 and Swin-B. The clear articulation of contributions and rigorous experimental validation make this work a significant advancement in black-box adversarial attacks.\nWeaknesses\nNo significant weaknesses were identified in the paper. The theoretical analysis is convincing, the methodology is robust, and the experimental results are compelling, leaving little room for critique.", "was_revised": true, "final_justification": "This paper exceeds the standards for acceptance, offering novelty, strong empirical results, and theoretical depth. It is a valuable addition to the literature and is recommended for publication in its current form.", "rebuttal": "Thank you for your thoughtful review and positive feedback. We are glad to hear that the theoretical foundation and empirical results of CORTA were well-received. We appreciate your recognition of the strengths of the paper, and we will continue to refine and expand on the ideas presented in future work."}, {"review_id": "SfVI4xZIiP", "reviewer": "Reviewer_Z58m", "summary": "The authors propose a novel method to generate the transferrable black-box adversarial attacks by incorporating the so called distributionally robust optimization technique leading to the following ingredients: 1) $W+\\Delta W$ analysis; 2) layer-wise feature perturbations. As a result, they proposed a very competing results on top of both singular and ensemble-based attack methods.", "questions": "Questions:\n* Why is stochastic feature blending applied when the output size is $\\leq 1/16$ of the input (lines 244-245)? No reason behind it, no ablations\n  * What about transformers?\n* Unclear why the blending probability $\\rho=0.5$ is chosen from the ablation study (Figure 2), because it seems that the best is somewhere around 0.8?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n* The very fast speed - see Table 5\n* Performance on the well-known datasets like CIFAR-100 and Imagenet is significantly higher than of the competitors numbers\n\nWeaknesses:\n* Theoretical analysis is quite weak, mainly because:\n  * Line 148: \"small $\\Delta W$\" - a very weak hypothesis as the setup is a black-box and targeting any neural network\n  * Line 173: a Lipschitz constant $L_{l}$ can be quite huge so the last term in the optimization objective (6) can be much higher than the $||g_{W}(x, \\delta)||_{F}$ \n* No real data (e.g., a comparison table) for the optimization success rate - it was briefly mentioned in lines 308-309, but no the real analysis\n* Minor remarks:\n  * line 127: better to use another letter than round $L$ for a set of selected layers - because it is also the notation of the loss function\n  * line 184: the incorrect superscript 1 in here: $||g_{W}(x, \\delta)||_{F}^{1}$ \n  * line 206: the blending probability $\\rho$ should use the different notation - the same letter stands for the upper bound on $|\\Delta W|$\n\n[1] Szegedy, Christian, et al. \"Intriguing properties of neural networks.\" arXiv preprint arXiv:1312.6199 (2013).", "was_revised": true, "final_justification": "**Update** Increasing the score based on authors' comments.", "rebuttal": "**W.1.1** Line 148: \"small $\\Delta W$ - a very weak hypothesis as the setup is a black-box and targeting any neural network \n\n**A.1** For $\\Delta W$, we lower the upper bound to minimize loss variations across models (see Eq. at line 170 of the paper, which holds for all $\\|\\Delta W\\|_{F} \\leq \\rho$, note that $\\rho$ can be large). This approach addresses the worst-case scenario, ensuring the DRO objective is satisfied even under the most adverse conditions. We have made a minor correction to the equation at line 170 in the revised paper, but the underlying idea remains unchanged.\n \n\n**W.1.2** Line 173: a Lipschitz constant $L_l$ can be quite huge so the last term in the optimization objective (6) can be much higher than the $||g_{W}(x, \\delta)||_{F}$\n\n**A.2** The Lipschitz constant $L_{l}$ is a model-dependent term that appears in the upper bound of the optimization objective, but it does not directly participate in the optimization of adversarial samples. It is independent of the gradient term $||g_{W}(x, \\delta)||_{F}$, which is minimized during optimization. Therefore, even if $L_l$ is large, CORTA only optimizes components directly related to the perturbation $\\delta$, and does not rely on $L_l$. As a result, the magnitude of the Lipschitz constant has no impact on our optimization process.\n\n**W.2** No real data (e.g., a comparison table) for the optimization success rate - it was briefly mentioned in lines 308-309, but no the real analysis.\n\n**A.3**  We present the following comparison table, which shows the optimization success rates of baseline methods on ImageNet using ResNet-18 as the surrogate model:\n\n|                           | Admix | Ens  | AdaEA | DHF  | BFA  | ANDA | Ours |\n|---------------------------|-------|------|-------|------|------|------|------|\n| Optimization Success Rate | 97.0  | 100  | 100   |99.4  | 99.4 | 96.3 | 69.9 |\n\n\nAs shown in the table, most baseline methods (Ens, AdaEA, DHF, BFA) achieve optimization success rates close to 100\\%, whereas our method (CORTA) achieves a success rate of 69.9\\%.\n\nCORTA’s surrogate success rate is lower than that of baseline attacks mainly due to two factors inherent to its DRO formulation: (1) CORTA optimizes two objectives—representation and parameter channels—rather than a single objective, increasing optimization difficulty; and (2) the feature blending operation, which incorporates the original sample’s latent features, can interfere with the adversarial objective and further reduce success rates on the surrogate model.\n\nHowever, this lower surrogate success rate is not a practical issue. Attackers can simply discard unsuccessful adversarial examples using the surrogate model and retain only those that succeed, which tend to have higher transfer success rates. In practice, this only slightly increases computational cost, as generating the same number of successful examples requires optimizing about 1.43 times more samples (e.g., 100/69.9 compared to attacks with 100\\% surrogate success rate).\n\nWe will include these updated results and explanations in the revised version.\n\n**W.3** Minor remarks\n\n**A.4** We will make all necessary revisions in accordance with your valuable suggestions.\n\n**Q.1** Why is stochastic feature blending applied when the output size is $\\leq 1/16$ of the input (lines 244-245)? No reason behind it, no ablations\nWhat about transformers?\n\n**A.5** \nWe adopted the \"output size $\\leq 1/16$ of the input\" setting to align with the CFM method ([21] in the paper), which is similar to DHF but focusing on targeted adversarial attacks.\n\nHowever, this constraint is not essential. Our experiments show that applying stochastic feature blending to all layers—using ResNet-18 as the surrogate—still outperforms baseline methods, as shown in the table below:\n\n\n| Blending layer             | RN-50 | WRN-101 | BiT-50 | BiT-101 | Avg(CNN)   | ViT-B | DeiT-B | Swin-B | Swin-S | Avg(ViT)   |\n|----------------------------|-------|---------|--------|---------|------------|-------|--------|--------|--------|------------|\n| $\\leq 1/16$ of the input   | 98.5  | 95.8    | 95.5   | 92.4    | 95.5       | 47.6  | 63.8   | 54.2   | 64.1   | 57.4       |\n| All layer                  | 97.2  | 96.0    | 94.1   | 90.8    | 94.5       | 47.4  | 64.3   | 56.0   | 64.0   | 57.9       |\n\nor Transformer architectures, we apply stochastic feature blending to all linear layers. This setting will be clearly explained in the revised version of the paper.\n\nOverall, this parameter is not critical, and we will update its description accordingly in the revision.\n\n**Q.2** Unclear why the blending probability $\\rho = 0.5$ is chosen from the ablation study (Figure 2), because it seems that the best is somewhere around 0.8?\n\n**A.6** Thank you for this insightful question. Our choice of $\\rho = 0.5$ was based on optimization performance on the surrogate model. When $\\rho$ is too high (e.g., 0.8), the feature perturbation can overly disrupt gradient signals, reducing optimization success on the surrogate. Conversely, when $\\rho$ is too low (e.g., 0.2), the perturbation is insufficient, limiting transferability. Thus, $\\rho = 0.5$ was selected as a balanced value.\n\nWhile the ablation study indicates that $\\rho = 0.8$ achieves better performance on the target model, our choice of $\\rho = 0.5$ does not yield the highest transfer success rate on the target. However, as black-box attackers, we cannot tune hyperparameters based on the target model. Therefore, we selected $\\rho = 0.5$ based on the optimization success rate on the surrogate model, even though it may not be optimal for the target model."}, {"review_id": "bF3iZ6QXE8", "reviewer": "Reviewer_bSRq", "summary": "The paper introduces CORTA, a novel transfer-based black-box adversarial attack designed to enhance the transferability of adversarial examples across deep neural networks (DNNs). It identifies two primary sources of transfer failure—decision-boundary variation and representation drift—and proposes a unified framework to address these through parameter perturbations and feature blending on a surrogate model. The approach is formalized as a Distributionally Robust Optimization (DRO) problem, with practical first-order approximations for scalability. The authors claim that CORTA outperforms state-of-the-art methods, achieving, for instance, a 19.1% higher transfer success rate (TSR) when transferring from ResNet-18 to Swin-B on CIFAR-100. Extensive experiments on ImageNet and CIFAR-100 across convolutional and transformer architectures are presented to support these claims.", "questions": "See weaknesses for details.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The authors provide a rigorous theoretical analysis, deriving upper bounds on the worst-case adversarial loss using Lipschitz continuity and first-order approximations. This enhances the credibility of the proposed approximations for parameter linearization and Monte Carlo sampling for feature blending.\n\n2. The paper's conceptualization of transferability as a consensus-robust optimization problem is innovative. By modeling target models as perturbed versions of the surrogate via parameter and representation channels, it provides a principled approach to tackle both decision-boundary variation and representation drift. The DRO formulation is a strong theoretical contribution, aligning well with the goal of robust transferability.\n\nWeaknesses:\n1. The paper explicitly states that it follows prior work in reporting only average results without error bars or statistical significance tests. This is a significant methodological flaw, as it hinders the assessment of result reliability, especially given the variability inherent in adversarial attack experiments. For example, Table 1 and Table 2 report TSRs without confidence intervals, making it difficult to evaluate the consistency of CORTA's performance across runs or datasets.\n\n2. While CORTA is tested with ResNet-18 and ViT-Tiny as surrogates, the baselines Ens and AdaEA use multiple surrogates (2 CNNs and 2 ViTs). This discrepancy makes direct comparisons less fair, as ensemble methods inherently leverage more diverse surrogate information. The paper would benefit from evaluating CORTA with multiple surrogates to better align with these baselines and demonstrate its robustness.\n\n3. This paper briefly mentions hyperparameters (e.g., perturbation probability $\\rho=0.5$, blending proportion $\\lambda$ sampled from U[0.25,1], and trade-off coefficient $\\beta$ tuned empirically), but lacks a detailed ablation study to justify these choices. For instance, the choice of $\\lambda_{min}=0.25 for feature blending is not explained, nor is there an analysis of how sensitive CORTA's performance is to variations in $\\beta$ or $\\rho$. This omission limits the understanding of the method's robustness to hyperparameter settings.", "was_revised": true, "final_justification": "The authors addressed my major concerns. I also paid attention to the other reviewers' questions and the replies by the authors. I consider this paper to be of high quality and useful for community development. Therefore I increase my rating by 1 point.", "rebuttal": "**W.1** The paper explicitly states that it follows prior work in reporting only average results without error bars or statistical significance tests. This is a significant methodological flaw, as it hinders the assessment of result reliability, especially given the variability inherent in adversarial attack experiments. For example, Table 1 and Table 2 report TSRs without confidence intervals, making it difficult to evaluate the consistency of CORTA's performance across runs or datasets.\n\n**A.1**  Thank you for highlighting the importance of reporting error bars or statistical significance tests. While prior papers do not include error bars, we appreciate your suggestion, as providing confidence intervals offers a clearer assessment of result reliability—particularly given the inherent variability in adversarial attack experiments. \n\nWe re-ran the experiments from Table 1 and Table 2 on 100 randomly selected samples, repeating each experiment 20 times with different random seeds. The results are now reported as mean ± standard deviation. Please note that these are preliminary results; full experimental results will be included in the revised paper.\n\nTable.1 :\n\n| Dataset   | Attack | RN-50    | WRN-101   | BiT-50   | BiT-101  | Avg      | ViT-B    | Deit-B   | Swin-B   | Swin-S   | Avg      |\n|-----------|--------|----------|-----------|----------|----------|----------|----------|----------|----------|----------|----------|\n|           | Admix  | 84.2±4.1 | 92.5±2.5  | 75.6±4.3 | 75.6±3.9 | 82.0±1.9 | 39.3±4.3 | 33.0±2.8 | 37.0±5.0 | 52.7±4.0 | 40.5±2.3 |\n|           | Ens    | 91.0±1.1 | 82.0±0.4  | 86.2±1.1 | 76.8±0.9 | 84.0±0.7 | 70.2±0.7 | 84.6±0.5 | 70.0±1.3 | 85.3±2.7 | 77.5±0.8 |\n|           | AdaEA  | 88.0±1.7 | 80.2±1.1  | 82.1±1.8 | 71.9±1.5 | 80.6±0.7 | 61.8±1.3 | 79.8±1.7 | 63.0±2.1 | 78.0±2.4 | 70.7±1.2 |\n| CIFAR-100 | DHF    | 90.8±0.8 | 89.1±1.4  | 77.0±2.5 | 72.3±1.9 | 82.3±0.9 | 37.0±2.2 | 27.5±2.3 | 25.4±1.8 | 52.0±2.1 | 35.5±1.1 |\n|           | BFA    | 86.2±0.8 | 89.4±0.8  | 70.2±1.0 | 68.2±0.6 | 79.5±0.5 | 34.0±0.7 | 30.7±0.9 | 27.1±0.4 | 50.9±1.0 | 36.6±0.5 |\n|           | ANDA   | 94.8±1.3 | 97.3±0.8  | 77.9±1.2 | 82.5±0.8 | 88.1±0.5 | 42.0±1.8 | 34.6±0.9 | 35.7±1.6 | 49.0±1.8 | 40.3±0.8 |\n|           | Ours   | 98.8±1.4 | 100.0±0.0 | 99.8±0.7 | 96.8±0.9 | 98.7±0.6 | 98.8±1.4 | 95.4±1.4 | 93.3±1.3 | 94.9±1.5 | 95.4±0.6 |\n|           |        |          |           |          |          |          |          |          |          |          |          |\n|           | Admix  | 91.4±1.7 | 83.3±2.7  | 81.8±2.9 | 67.3±3.0 | 81.0±1.1 | 21.8±3.4 | 34.3±2.4 | 24.1±3.0 | 31.6±2.9 | 28.0±1.7 |\n|           | Ens    | 69.6±1.1 | 65.9±1.7  | 65.0±2.1 | 52.2±1.2 | 63.2±0.4 | 44.8±2.0 | 66.8±0.7 | 24.9±1.9 | 36.0±1.4 | 43.1±0.5 |\n| ImageNet  | AdaEA  | 73.8±2.2 | 66.6±2.2  | 61.0±3.0 | 46.4±3.8 | 62.0±1.6 | 36.6±2.2 | 54.2±2.4 | 23.2±1.8 | 28.4±2.7 | 35.6±1.4 |\n|           | DHF    | 98.8±0.6 | 96.2±1.0  | 95.4±1.6 | 88.3±2.0 | 94.7±0.7 | 38.8±2.4 | 52.6±2.8 | 40.1±2.2 | 52.4±2.6 | 46.0±1.5 |\n|           | BFA    | 99.5±0.6 | 97.5±0.6  | 95.5±0.6 | 90.2±1.0 | 95.9±0.4 | 39.0±0.8 | 52.5±0.6 | 44.2±1.7 | 56.2±1.5 | 49.6±0.4 |\n|           | ANDA   | 95.5±0.5 | 87.9±0.6  | 86.6±1.2 | 70.3±0.7 | 85.1±0.5 | 37.9±1.1 | 53.4±0.9 | 35.9±1.5 | 46.8±1.0 | 43.5±0.6 |\n|           | Ours   | 99.9±0.4 | 98.1±1.4  | 97.5±1.4 | 89.3±2.0 | 96.0±1.0 | 45.6±3.4 | 65.9±2.8 | 52.4±2.9 | 65.2±2.4 | 56.9±1.8 |\n\nTable.2:\n\n| Attack | RN-50    | WRN-101  | BiT-50   | BiT-101  | Avg      | ViT-B    | Deit-B   | Swin-B   | Swin-S   | Avg      |\n|--------|----------|----------|----------|----------|----------|----------|----------|----------|----------|----------|\n| Ens    | 69.6±1.1 | 65.9±1.7 | 65.0±2.1 | 52.2±1.2 | 63.2±0.4 | 44.8±2.0 | 66.8±0.7 | 24.9±1.9 | 36.0±1.4 | 43.1±0.5 |\n| AdaEA  | 73.8±2.2 | 66.6±2.2 | 61.0±3.0 | 46.4±3.8 | 62.0±1.6 | 36.6±2.2 | 54.2±2.4 | 23.2±1.8 | 28.4±2.7 | 35.6±1.4 |\n| Admix  | 39.8±2.8 | 48.8±2.4 | 47.4±4.1 | 39.4±2.4 | 43.9±1.6 | 48.6±2.5 | 66.6±2.3 | 23.8±1.9 | 28.4±2.1 | 41.8±1.3 |\n| DHF    | 43.8±2.5 | 51.6±2.6 | 55.8±3.7 | 45.7±3.5 | 49.2±1.8 | 71.0±2.6 | 79.0±2.3 | 30.0±3.5 | 38.1±4.1 | 54.5±1.8 |\n| BFA    | 55.0±0.0 | 60.6±0.5 | 63.7±1.0 | 50.6±0.5 | 57.5±0.0 | 75.4±0.5 | 90.6±0.5 | 40.7±1.0 | 46.4±0.5 | 63.3±0.4 |\n| ANDA   | 55.6±0.8 | 64.5±0.5 | 73.2±0.9 | 62.8±0.4 | 64.0±0.3 | 68.9±0.6 | 78.0±0.2 | 42.6±0.5 | 54.7±0.8 | 61.0±0.2 |\n| Ours   | 62.7±3.8 | 71.2±4.0 | 73.1±3.0 | 63.4±3.2 | 67.6±2.0 | 82.8±4.1 | 90.5±3.0 | 52.3±4.3 | 63.9±4.2 | 72.4±2.3 |\n\n\n**W.2** While CORTA is tested with ResNet-18 and ViT-Tiny as surrogates, the baselines Ens and AdaEA use multiple surrogates (2 CNNs and 2 ViTs). This discrepancy makes direct comparisons less fair, as ensemble methods inherently leverage more diverse surrogate information. The paper would benefit from evaluating CORTA with multiple surrogates to better align with these baselines and demonstrate its robustness.\n\n**A.2** To ensure a fair comparison, we implemented \"CORTA-ensemble\" using the exact same surrogate set as Ens and AdaEA—ResNet-18, Inception-v3, ViT-Tiny, and DeiT-Tiny. The results on ImageNet are shown below:\n\n| Method          | RN-50 | WRN-101 | BiT-50 | BiT-101 | Avg (CNN) | ViT-B | DeiT-B | Swin-B | Swin-S | Avg (ViT) |\n|-----------------|-------|---------|--------|---------|-----------|-------|--------|--------|--------|-----------|\n| Ours (ResNet-18)    | 98.5  | 95.8    | 95.5   | 92.4    | 95.5      | 47.6  | 63.8   | 54.2   | 64.1   | 57.4      |\n| Ours (ViT-Tiny)    | 63.6  | 70.4    | 74.4   | 68.3    | 69.2      | 77.8  | 87.8   | 50.7   | 58.4   | 68.7      |\n| Ens             | 71.2  | 63.2    | 62.5   | 54.9    | 63.0      | 42.9  | 62.9   | 26.6   | 36.6   | 42.3      |\n| AdaEA           | 73.5  | 61.4    | 59.1   | 50.9    | 61.2      | 36.9  | 53.8   | 25.0   | 33.4   | 37.3      |\n| Ours (Ensemble) | 96.9  | 94.5    | 94.2   | 91.5    | 94.3      | 82.5  | 94.7   | 71.7   | 77.1   | 81.5      |\n\n\nIn the identical 4-model ensemble setting, CORTA significantly outperforms both Ens and AdaEA, demonstrating its effectiveness in multi-surrogate scenarios and its ability to further enhance cross-architecture transfer.\n\nLeveraging multiple surrogate models increases transfer success rates across both CNN-based and ViT-based target models. For example, CORTA improves transfer performance to ViT targets by 24.1\\% compared to using a single ResNet-18 surrogate. Similarly, compared to a single ViT-Tiny surrogate, transfer performance to CNN and ViT targets increases by 25.1\\% and 12.8\\%, respectively. This demonstrates that using multiple, diverse surrogates helps bridge the gap in transferability between very different model architectures.\n\n**W.3** This paper briefly mentions hyperparameters (e.g., perturbation probability $\\rho = 0.5$, blending proportion $\\lambda$ sampled from U[0.25,1], and trade-off coefficient $\\beta$ tuned empirically), but lacks a detailed ablation study to justify these choices. For instance, the choice of $\\lambda_{min}=0.25$ for feature blending is not explained, nor is the reananalysis of how sensitive CORTA's performance is to variations in $\\beta$ or $\\rho$. This omission limits the understanding of the method's robustness to hyperparameter settings.\n\n**A.3** In the following, we provide a more comprehensive explanation of the reasoning behind the selection of the key hyperparameters: $\\rho$, $\\lambda_{min}$, and $\\beta$ -- we will revise the paper to better explain our selection of these hyperparameters.\n\n1. **Choice of $\\rho$:** We set $\\rho = 0.5$ based on optimization success on the surrogate model. If $\\rho$ is too high (e.g., 0.8), the feature perturbation becomes overly strong, disrupting gradient signals and reducing optimization success. Conversely, if $\\rho$ is too low (e.g., 0.2), the perturbation is too weak, resulting in limited transferability to the target model. Therefore, we selected $\\rho = 0.5$ for **all experiments** to achieve a balanced trade-off.\n\n2. **Choice of $\\lambda_{min}$:** Similarly, setting $\\lambda_{min}$ too high or too low degrades optimization success on the surrogate model. We observed stable performance with $\\lambda_{min}$ in the range [0.1, 0.3], and thus chose $\\lambda_{min} = 0.25$ for **all experiments** in the paper.\n\n3. **Choice of trade-off coefficient $\\beta$:** $\\beta$ is chosen to balance the magnitudes of the two optimization losses in the surrogate model, ensuring that their contributions are comparable. Consequently, $\\beta$ is not **task- or dataset-specific**, but rather related to the model architecture. For example, we used $\\beta = 0.1$ for ResNet-18 on both ImageNet and CIFAR-100. Additionally, our hyperparameter sensitivity analysis (see Figure 1 and Line 297 of the paper) demonstrates that $\\beta$ yields stable results within the range [0.01, 0.1].\n\nWe address the sensitivity of these hyperparameters in Lines 294–299 of the paper and provide visualizations in Figures 1, 2, and 3 of the paper, which illustrate the effects of varying $\\beta$, $\\rho$, and $\\lambda_{min}$. As shown, CORTA maintains stable performance for $\\beta$ in the range [0.01, 0.1], $\\rho$ in [0.5, 1], and $\\lambda_{min}$ in [0.1, 0.3].\n\nWe hope this clarifies our hyperparameter choices and their sensitivity. We will ensure this discussion is included in the revised paper."}]

Author rebuttal:

Meta-review: This paper proposes 
a transfer attack method named *CORTA* (consensus-robust transfer attack) 
to mitigate the two factors that hinder transfer attack: decision-boundary variation and representation drift.

The reviewers appreciate the **strengths** of the paper: 
(Gq3G) dual-channel perturbation framework is a new perspective, DRO formulation is theoretically grounded, CORTA outperforms baselines, provides formal guarantees,
(wbsA)  effectively addressing adversarial transferability by (dual-channel surrogate modeling) through a consensus-robust optimization framework, novel and theoretically grounded, first-order approximations ensuring scalability and provable guarantees,
(Z58m) fast, significant performance, 
(bSRq) rigorous theoretical analysis, innovative conceptualization of transferability,

The reviewers also find the **weaknesses** of the paper: 
(Gq3G) second-order derivative, lower success rate on the surrogate than baselines, superior empirical performance,
(Z58m) weak theoretical analysis, no real data,
(bSRq) no error bars, discrepancy between the surrogate models, no ablation study.


**After the discussion**, many concerns seem resolved and clarified(e.g, ImageNet evaluation, error bars, ablation study), and the reviewers agreed upon accepting the paper as its dual-channel framework and DRO formalization are expected to make a clear contribution of the community.
Decision: Accept (poster)