💻 computer science

Shared Vulnerabilities in Robustness-Optimized Defenses: One Breach Exposes the Family

This paper reveals that robustness-optimized defenses, including adversarial training and purification methods, share inherent vulnerabilities where breaching one representative defense can compromise an entire family, a risk quantified by the new PGDTransfer attack and Adversarial Sensitivity Maps that demonstrate high transfer success rates even without specialized attack designs.

Original authors: Hanrui Wang, Ruihao Zheng, Shuo Wang, Isao Echizen, Xingbo Dong, Zhe Jin

Published 2026-07-22

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Hanrui Wang, Ruihao Zheng, Shuo Wang, Isao Echizen, Xingbo Dong, Zhe Jin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your phone, your car, and even your medical devices are run by super-smart AI brains. These brains are great at recognizing faces or reading X-rays, but they have a secret weakness: a tiny, almost invisible smudge on a picture can trick them into seeing something completely different. It's like drawing a single, tiny dot on a stop sign that makes a self-driving car think it's a speed limit sign. To stop this, scientists have built "bodyguards" for these AI brains. Some bodyguards train the AI to be tough by showing it thousands of tricky pictures (Adversarial Training), while others act like a filter, scrubbing the picture clean before the AI sees it (Adversarial Purification). Everyone hopes these bodyguards make the AI unbreakable. But what if all these bodyguards, despite looking different, were actually wearing the same secret uniform? What if breaking one of them accidentally gave the bad guys the keys to break them all?

This is exactly the scary discovery made by Hanrui Wang and his team in their new paper. They found that when different AI defenses are optimized to be "robust" (tough against attacks), they accidentally end up sharing the same hidden weaknesses. It's like a family of superheroes who all trained in the same dojo; if a villain figures out how to defeat one of them, they might be able to defeat the whole family without even trying to learn their specific moves. The researchers didn't just guess this; they built a simple, clever test called "PGDTransfer" and a special map called "Adversarial Sensitivity Maps" to prove it. They found that once you break one type of "cleaning" defense, the attack often works on almost every other cleaning defense, with a success rate of over 80% in some cases. This suggests that making AI tougher isn't enough; we also need to make sure different defenses don't share the same secret cracks.

The Family Secret: One Breach, Everyone Exposed

Think of AI defenses like different brands of high-tech locks. Some locks use a fingerprint scanner, others use a retinal scan, and some use a voice code. You'd assume that if a thief picks the fingerprint lock, they can't open the retinal one. But this paper reveals a twist: if all these locks were designed by the same "security philosophy" (trying to be super robust), they might all have the same tiny, invisible flaw in their gears.

The researchers call this a "Shared Vulnerability." They found that when AI systems are trained to be super tough against attacks, they all tend to ignore the same parts of an image and focus on the same "safe" parts. This means that if a hacker creates a trick picture to fool one specific tough AI, that same trick picture often works on other tough AIs, even if they look completely different on the inside. It's as if a master thief found a master key that fits every lock in a neighborhood because all the locks were made by the same factory, even if they have different colors and shapes.

The Detective Work: How They Found the Crack

To prove this, the team had to be very careful. In the past, people tested if attacks could "transfer" (work on a different AI) by using huge, obvious changes to the pictures. The researchers realized this was cheating; if you smudge a picture enough, any AI will get confused, not just because they share a weakness, but because the picture is just ruined.

So, they invented stricter rules for their test:

Tiny Changes Only: They used very small, barely visible changes (a budget of $\epsilon = 4/255$ ) to make sure the attack wasn't just breaking the picture.
No Cheating: They used a "single-surrogate" rule. The hacker gets to train on one AI (the surrogate) but has to attack a different one (the target) without seeing its secrets.
The Simple Attack: Instead of using a super-complex, fancy hacking tool, they used a very simple method called PGDTransfer. It's like using a basic screwdriver instead of a laser cutter. If a simple screwdriver can break multiple locks, it proves the locks themselves are the problem, not the tool.

They also created Adversarial Sensitivity Maps (AdvSMs). Imagine looking at a map of a city to see which streets are busy. These maps show exactly which pixels (tiny dots) in an image an AI is paying attention to. The researchers found that "tough" AIs all pay attention to the same specific pixels and ignore the same others. It's like all the bodyguards in the family decided to stand guard at the front door and ignore the back window. If a thief knows how to sneak in through the back window of one bodyguard, they know exactly where to go for all the others.

The Results: A Wake-Up Call

The numbers they found are quite startling. When they tested these simple attacks against "purification" defenses (the ones that try to clean the image):

The attack succeeded on average 80.4% of the time across different types of cleaners (filtering, compression, and diffusion-based).
Even though these defenses looked strong individually, they were all vulnerable to the same simple trick.
This happened even with Diffusion-based defenses, which are currently considered some of the strongest and most complex in the world.

The paper explicitly rules out the idea that this is just because the AI models look similar (like having the same architecture). They tested models with the exact same design but different training, and found that if one wasn't "robust," the attack didn't transfer. The transfer only happened when both were optimized to be robust. This proves it's the "robustness optimization" itself that creates the shared weakness.

What This Means for the Future

The big takeaway isn't that AI is doomed, but that our way of making it safe needs a change. Right now, we focus on making each individual AI as tough as possible. This paper suggests that we also need to focus on diversity. We need to make sure that different defenses don't all learn to ignore the same things. If we keep training them all to be "perfectly robust" in the same way, we are just building a family of locks that all share the same master key.

The authors suggest that future security should treat "vulnerability diversity" as a goal. Instead of just asking, "Is this AI tough?", we should ask, "Is this AI's weakness different from the others?" If we can make sure that when one AI is tricked, it doesn't mean the whole family is exposed, we can build a much safer digital world. For now, the paper serves as a warning: one breach might expose the whole family, so we need to stop treating these defenses as isolated islands and start seeing them as a connected ecosystem.

Technical Summary: Shared Vulnerabilities in Robustness-Optimized Defenses

Problem Statement
Adversarial robustness optimization, achieved through methods like adversarial training and adversarial purification, aims to preserve correct predictions under perturbations. While these methods yield substantial individual robustness gains, this paper identifies a critical, previously under-explored security risk: the emergence of shared vulnerabilities across defenses optimized toward similar robust behaviors.

The core issue is that when multiple defenses within the same "family" (e.g., different adversarial purifiers or robust classifiers) are optimized for similar robust outcomes, they may develop aligned adversarial sensitivities. Consequently, an adversarial example crafted against one representative defense can transfer effectively to other defenses in the same family without requiring target gradients, queries, or adaptation. This phenomenon, termed defense-isolation risk, implies that breaching a single public or representative defense could expose an entire family of private or diverse systems.

Current evaluation protocols often overestimate genuine transferability due to two main pitfalls:

Distortion-induced degradation: High transfer success rates under large perturbation budgets (e.g., $\epsilon=16/255$ ) often reflect general image distortion rather than shared adversarial directions.
Algorithmic confounding: Sophisticated transferable attacks use specialized objectives or transformations, making it difficult to distinguish whether transferability arises from the attack's design or from inherent shared vulnerabilities in the defenses.

Methodology
To rigorously investigate this risk, the authors introduce a controlled evaluation framework and new analytical tools:

Stricter Transfer-Only Protocols: The authors propose evaluation protocols designed to isolate genuine transferability from distortion and architectural artifacts. These include:
- Small-budget untargeted transfer ( $\epsilon=4/255$ ) to minimize distortion-driven success.
- Targeted transfer to ensure attacks induce specific misclassifications rather than general degradation.
- Robustness-mismatch transfer to decouple architectural similarity from robustness-induced transfer.
- Clean-correct subsets to exclude pre-existing errors from attack success metrics.
PGDTransfer Attack: A deliberately simple adaptive attack is introduced to test if transferability arises naturally from shared vulnerabilities. PGDTransfer utilizes Projected Gradient Descent (PGD) with Expectation over Transformation (EOT) and a suitable surrogate (e.g., DDIM for purification) but avoids specialized transferable-attack mechanisms. It is applied to three system types:
- Adversarially trained classifiers.
- Purification-based defenses (filtering, compression, diffusion).
- Large Vision-Language Models (LVLMs) with robust visual encoders.
Adversarial Sensitivity Maps (AdvSMs): To visualize and quantify shared alignment beyond differentiable classifiers, the authors introduce AdvSMs.
- For differentiable systems, AdvSMs convert input gradients into ternary maps (positive, negative, or insensitive) to measure spatial alignment of sensitive regions.
- For stochastic/non-differentiable purifiers, AdvSMs are derived from output responses to random input perturbations, identifying regions where the purified output remains unstable or sensitive.

Key Results
The evaluation across adversarially trained classifiers, purification-based defenses, and LVLMs yields the following findings:

Natural Transferability in Robust Families: Under strict protocols, robust models exhibit significantly higher transferability among themselves compared to non-robust models or mixed pairs. For instance, PGD (a standard attack) achieves transfer success rates comparable to sophisticated transferable baselines (like OPS) when attacking robust classifiers, suggesting the transfer stems from shared sensitivity rather than attack complexity.
Severe Risk in Purification Defenses: The risk is particularly acute for purification-based defenses. PGDTransfer achieves an average Transfer Attack Success Rate (TASR) of 80.4% across filtering-, compression-, and diffusion-based purifiers under $\epsilon=4/255$ . Notably, a simple PGD-style attack using a DDIM surrogate outperforms specialized adaptive attacks (e.g., DiffAttack, DiffHammer) designed specifically for diffusion purifiers.
AdvSM Alignment: AdvSMs reveal that robust defenses within the same family share aligned sensitive regions, whereas non-robust defenses exhibit noisy, unaligned sensitivity. This alignment provides a measurable basis for why one breach exposes the family.
Surrogate Selection: Transfer is strongest when the surrogate system exposes a compact set of sensitive regions that are preserved by the target. Using a "weaker" surrogate (e.g., Mean/Gaussian) against a "stronger" target (e.g., Diffusion) often leads to lower transfer because the target purifies regions the surrogate relied on. Conversely, a compact surrogate (like DDIM) effectively targets shared sensitive regions across the family.

Significance and Claims
The paper claims that robustness optimization, while improving standalone robustness, can inadvertently weaken defense isolation. The authors argue that:

Shared Vulnerability is a Family-Level Risk: Once a representative defense is breached, the broader family may be exposed without the need for target-side adaptation.
Current Defenses are Vulnerable: Even defenses that appear robust against standard attacks may fail against transfer-only attacks crafted on a suitable surrogate within the same family.
Future Directions: Security objectives for future defenses should expand beyond individual robustness to include vulnerability diversity and transfer-only isolation. The authors suggest that defenses should be evaluated not just on their standalone performance but on their ability to resist transfer-only attacks and maintain distinct adversarial sensitivity profiles.

The work concludes that the field must address the "shared vulnerability" dimension, treating the diversity of adversarial sensitivities as a critical security metric alongside traditional robustness gains.

The Family Secret: One Breach, Everyone Exposed

The Detective Work: How They Found the Crack

The Results: A Wake-Up Call

What This Means for the Future

Technical Summary: Shared Vulnerabilities in Robustness-Optimized Defenses

More like this