Title: Boosting Adversarial Transferability with Spatial Adversarial Alignment
Venue: NeurIPS 2025
Accepted: yes
Keywords: adversarial transferability

model alignment
Abstract: Deep neural networks are vulnerable to adversarial examples that exhibit transferability across various models. Numerous approaches are proposed to enhance the transferability of adversarial examples, including advanced optimization, data augmentation, and model modifications. However, these methods still show limited transferability, partiovovocularly in cross-architecture scenarios, such as from CNN to ViT. To achieve high transferability, we propose a technique termed Spatial Adversarial Alignment (SAA), which employs an alignment loss and leverages a witness model to fine-tune the surrogate model. Specifically, SAA consists of two key parts: spatial-aware alignment and adversarial-aware alignment. First, we minimize the divergences of features between the two models in both global and local regions, facilitating spatial alignment. Second, we introduce a self-adversarial strategy that leverages adversarial examples to impose further constraints, aligning features from an adversarial perspective. Through this alignment, the surrogate model is trained to concentrate on the common features extracted by the witness model. This facilitates adversarial attacks on these shared features, thereby yielding perturbations that exhibit enhanced transferability. Extensive experiments on various architectures on ImageNet show that aligned surrogate models based on SAA can provide higher transferable adversarial examples, especially in cross-architecture attacks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper explores the transferability of adversarial examples across architectures. The core insight is that previous work doesn't perturb the common features between different models. Therefore, the authors propose a technique termed Spatial Adversarial Alignment (SAA), which employs an alignment loss and leverages a witness model to fine-tune the surrogate model. Through spatial-aware and adversarial-aware alignment, the surrogate model is trained to concentrate on the common features extracted by the witness model. This facilitates adversarial attacks on these shared features, thereby yielding perturbations that exhibit enhanced transferability. Experiments on 6 CNNs and 4 ViTs show that SAA has state-of-the-art adversarial transferability, especially in cross-model transferability. In addition, the authors also provide empirical guidance for model selection and release code in the supplementary material.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\nThis paper is of high value because exploring the transferability of adversarial examples across architectures has important security implications for the deployment of practical models. The authors further summarize the empirical guidance for the model selection in SAA, which is beneficial for practice.\nThe proposed aligned-based method is novel, focusing on the common features in space and adversarial space that were ignored in previous work, and can be seamlessly integrated with existing optimization and data augmentation-based methods to achieve stronger performance.\nExtensive experiments in the main body and appendix verify the effectiveness of SAA. The code released in the supplementary material provides reproducibility.\nWeaknesses:\n\nThere is a lack of description on the difference between alignment and direct ensemble model attack. From the perspective of model configuration, the two are very similar.\nWhy does the self-aligned strategy also achieve certain improvements?\nThe differences between SAA and other attacks on ViTs such as SGM, PNA, and TGR were not discussed.\n\nQUESTIONS:\nSee Weaknesses.\n\nLIMITATIONS:\nYes, this paper has chaimed its limitations and I think it is enough.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors tackle the problem of cross-architecture adversarial transferability of adversarial attacks. As different architectures have significantly different structures, existing methods are suboptimal when transfering from different model families (e.g., CNN to ViT). Thus, they propose a technique termed Spatial Adversarial Alignment (SAA) consisted of spatial-aware alignment and adversarial-aware alignment. SAA aims to adjust the surrogate model to extract features closely aligned with those of the witness model by aligning both the local and global features between a surrogate and a witness model. SSA performs such alignment both in the clean and adversarial setting. SSA demonstrates significant improvements compared to MA across a wide range of models and demonstrate improvements in transfer attacks and ensemble attacks.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n- Elegant yet practical idea – SAA keeps the training recipe minimal while still delivering substantial transfer-rate gains; the large, multi-model benchmark makes the effect hard to dismiss.\n- Clear exposition – the narrative flows logically from motivation through method to experiments, making the paper easy to read even for newcomers.\n- Comprehensive empirical evidence – the authors supply full ablations (loss terms, distance metrics, training length) and report results on six CNNs, four ViTs, ten attack variants, and a dozen defences, lending strong credibility to the claims.\n\n\n**Weaknesses**\n- Narrow comparative baseline – Table 2 pits SAA only against Model-Alignment (MA), an older 2022. Comparison to more modern methods is missing. \n\n- Limited insight in section 2.3 – the section merely restates that the loss drives global-feature similarity and then confirms that the learned features are, in fact, similar.\n\n- Weak qualitative evidence – the Grad-CAM comparison is based on just two images; furthermore, the surrogate heat-maps appear more diffused rather than genuinely mirroring the witness, so the visual argument feels anecdotal. A systematic, quantitative localisation metric would strengthen the case.\n\nQUESTIONS:\n- What can we learn from the fact that some architectures of ViT transfers better to some CNN architectures? e.g., Swin-B to VGG?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes Spatial Adversarial Alignment (SAA), a method that improves adversarial transferability by improving upon the model alignment method. Model alignment increases the transferability of adversarial examples by fine-tuning a source model to align its predictions with those of a fixed witness model, using an alignment loss that captures prediction divergence. SAA introduces two improvement: a spatial-aware alignment that encourages alignment across both global and local regions, and an adversarial-aware alignment that focuses the alignment on adversarially perturbed inputs. Experiments on ImageNet show that SAA achieves improved transferability than the original model alignment approach.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n1. Improving the transferability of adversarial perturbations is a practically relevant goal, and this paper builds on the recent model alignment framework. The proposed SAA method introduces two enhancements—spatial-aware and adversarial-aware alignment—that further improve adversarial transferability.\n\n2. The main experiment in this paper is extensive, including comparison with model alignment on the Imagenet dataset. The ablation study demonstrate the compatibility with various existing transfer-improving methods. Table 7 also helps understand how each component of the SAA method contribute to the overall improvement.\n\n**Weaknesses**\n\n1. Spatial-alignment component of SAA requires clearer motivation and explanation of its formulation.\n    1. Several claims in lines 48–61 require either citations or supporting evidence to justify the motivation. For instance, the paper mentions that cross-architecture transferability is limited because \"features are not aligned in space\" and that \"the spatial features of ViTs and CNNs are different.\" Without references or empirical evidence, these statements feel speculative and make it difficult to understand the spatial alignment component.\n    2. The claim that “MA only uses the final prediction of the model” is misleading. The alignment loss in Eq. (1) of Ma et al. can be applied to intermediate representations, and Table 4 in their paper explicitly explores alignment in the embedding space.\n    3. Section 2.2, particularly the spatial-aware alignment portion, lacks clarity. Several parts (e.g., lines 104–105, 108–112, and 115–122) should include citations.\n    4.  The use of the term “global features” to refer to logits is unconventional and potentially confusing. It is unclear why logits are considered “global” and how that definition helps in the context of alignment.\n    5.  The explanation in lines 136–146 is difficult to follow due to unspecified dimensions. For example, what is the dimensionality of $z$? Assuming $H$ and $W$ are image dimensions, does having $H\\times W$ local regions imply that each pixel is treated as a separate region? Clarifying these points would significantly improve the readability of the spatial alignment method.\n    6. It remains unclear how the proposed local/global feature perspective addresses the cross-architecture misalignment problem raised earlier. A more explicit connection between motivation and method would strengthen the argument. \n\n2. Section 2.3: It seems that “feature similarity” refers to logit similarity, but this should be clarified. Moreover, wouldn’t an increase in cosine similarity naturally be expected from any source model that has improved transferability? (i.e., unaligned model A vs unaligned model B, where perturbations from B has better transferablity.) Also, a comparison with MA could potentially better understand the improvement from SAA.\n\n3. Computational overhead: The paper does not discuss the computational cost introduced by the two new alignment components. A quantitative analysis (e.g., number of additional forward/backward passes or runtime comparison) would be helpful for understanding the trade-offs compared to the original MA method.\n\nQUESTIONS:\nSee weakness.\n\nLIMITATIONS:\nAlthough the paper briefly mentions computational complexity, it represents a major trade-off compared to the original MA method and deserves a more detailed discussion.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes Spatial Adversarial Alignment (SAA), a method for enhancing the transferability of adversarial examples across architectures, especially from CNNs to ViTs. The method leverages a witness model to fine-tune a surrogate model by aligning both global and local features (spatial-aware alignment) and adversarial representations (adversarial-aware alignment). Experiments show that SAA improves adversarial transferability significantly over prior model alignment (MA) methods and can enhance the performance of multiple transfer attacks under black-box and ensemble settings.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\nThe paper presents an array of novel contributions and new ideas. SAA integrates spatial-level and adversarial-level feature alignment, going beyond prior work that focused only on logits or global outputs. \n\nThere are strong empirical results supported by extensive experiments across 6 CNNs and 4 ViTs show substantial gains over existing methods, especially under cross-architecture black-box settings. \n\nSAA supports multiple attack types. Unlike many prior works that improve a single attack (e.g., I-FGSM), SAA shows gains when applied to multiple families: MI, DI, TI, PatchOut, GI, etc. \n\nSAA significantly boosts attack transferability between very different model families (e.g., CNN → ViT), which is a difficult and under-addressed problem. \n\nThe framework is designed as a training-time plug-in that does not change the attack itself — this modularity is appealing to practitioners. \n\nWeakenesses\n\nThe compute budget is not reported. Surrogate model retraining with adversarial alignment is costly. The paper lacks reporting on total training time, epochs, GPU hours, or number of adversarial examples generated. \n\nThe security implications are unexplored. By boosting black-box adversarial transferability, SAA may exacerbate real-world model vulnerabilities, however the paper doesn’t reflect on the responsible disclosure or ethical implications of this. \n\nThere appears to be an overreliance on cosine similarity as a metric: Feature similarity is evaluated only via cosine similarity, which may not correlate strongly with transferability. A deeper metric (e.g., centered kernel alignment or probing transfer success vs. feature similarity) would add insight. \n\nLabel correctness of adversarial examples is not verified. The method assumes that adversarial examples retain their semantic label under perturbation and alignment, but this is not validated with human or automatic checks. \n\nThe \"pseudo-labeling\" step for local features may introduce noise. Aligning local logits using pseudo-labels from a potentially miscalibrated witness model could misguide learning, but no analysis or ablation is presented. \n\nTraining the surrogate to mimic the witness may lead to overfitting, reducing diversity in learned features. There’s no metric to evaluate how independent or useful the aligned features are post-attack.\n\nQUESTIONS:\nHow robust is SAA to witness model choice? If the witness model is very weak (e.g., shallow CNN), does alignment still help? \n\nWhat is the compute cost of SAA training? How many GPU hours are needed per model alignment? This is especially relevant for large ViTs. \n\nWhat happens if the surrogate and witness have no architectural overlap (e.g., MobileNet and Swin-B)? Does SAA still improve transferability? \n\nHow often do pseudo-labels differ from the true labels? Have you analyzed the reliability of local feature alignment via argmax over logits? \n\nWhy use KL divergence for local logits? Did the authors try feature-matching (e.g., MSE between embeddings), or attention-head alignment as in recent interpretability work? \n\nIn transfer settings where the target model is known (but frozen), wouldn’t it make more sense to align to it directly rather than via a witness?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-03"}