benchmark arXiv Dec 2, 2025 · Dec 2025
Mohamed Awad, Mahmoud Akrm, Walid Gomaa · MBZUAI · Egypt Japan University of Science and Technology +1 more
Adversarially trained models paradoxically become stronger attack surrogates, producing more transferable adversarial examples than standard models.
Input Manipulation Attack vision
Deep learning has achieved great success in computer vision, but remains vulnerable to adversarial attacks. Adversarial training is the leading defense designed to improve model robustness. However, its effect on the transferability of attacks is underexplored. In this work, we ask whether adversarial training unintentionally increases the transferability of adversarial examples. To answer this, we trained a diverse zoo of 36 models, including CNNs and ViTs, and conducted comprehensive transferability experiments. Our results reveal a clear paradox: adversarially trained (AT) models produce perturbations that transfer more effectively than those from standard models, which introduce a new ecosystem risk. To enable reproducibility and further study, we release all models, code, and experimental scripts. Furthermore, we argue that robustness evaluations should assess not only the resistance of a model to transferred attacks but also its propensity to produce transferable adversarial examples.
cnn transformer MBZUAI · Egypt Japan University of Science and Technology · Alexandria University