AI Security
New Technique Improves How AI Attack Methods Transfer Across Different Models
Inverse Knowledge Distillation makes adversarial attacks crafted on one AI system more likely to fool other systems by strategically widening prediction gaps.
Researchers have developed a technique called Inverse Knowledge Distillation (IKD) that strengthens how adversarial attacks transfer between AI models. The method addresses a common limitation: attacks designed on a practice model—called a surrogate—often become overly tailored to that specific system and fail when applied to other targets.
How the approach works#
IKD operates by widening the gap between how a surrogate model predicts benign (legitimate) inputs versus adversarial ones. The technique uses soft-label objectives tied to cross-entropy or Kullback-Leibler divergence to push adversarial predictions away from a fixed baseline established by clean samples. This enriches attacks with directional guidance derived from the Fisher information matrix, a measure of model sensitivity.
The researchers proved a key equivalence: when applied with matched implementation parameters, cross-entropy and KL divergence produce identical gradients, Hessians, and optimization paths—despite different surface formulations. By contrast, mean squared error pulls in a different direction within probability space and underperforms.
Theoretical grounding#
The analysis connects IKD's focus on the Fisher matrix to actual cross-model transfer. The team derives bounds on how much the surrogate and target models overlap in their most sensitive directions, conditional on local stability and eigenvalue gaps. They also establish when a target model's decision margin will be crossed, given certain properties of gradient direction consistency and model smoothness.
Practical results#
Tests on ImageNet show consistent improvements across multiple architectures—CNNs, Vision Transformers, and defended models—when attacks are launched as black-box transfers. Ablation studies confirm the equivalence of cross-entropy and KL divergence and demonstrate the superiority over mean squared error. The method integrates directly into standard gradient-based attacks without requiring pipeline changes.
