Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systems

TL;DR

This paper provides a comprehensive survey of transferable attacks on AI systems, categorizing them with a new taxonomy, analyzing their mechanics, and reviewing methods to improve attack transferability, highlighting future research directions.

Contribution

It introduces a unified six-dimensional taxonomy for transferable attacks, consolidates fragmented research, and offers a foundational roadmap for understanding and defending against these threats.

Findings

Seven major categories of transferable attacks identified

Unified taxonomy systematically captures transfer pathways

Review of data augmentation and optimization methods for attack transferability

Abstract

As Artificial Intelligence (AI) systems increasingly underpin critical applications, from autonomous vehicles to biometric authentication, their vulnerability to transferable attacks presents a growing concern. These attacks, designed to generalize across instances, domains, models, tasks, modalities, or even hardware platforms, pose severe risks to security, privacy, and system integrity. This survey delivers the first comprehensive review of transferable attacks across seven major categories, including evasion, backdoor, data poisoning, model stealing, model inversion, membership inference, and side-channel attacks. We introduce a unified six-dimensional taxonomy: cross-instance, cross-domain, cross-modality, cross-model, cross-task, and cross-hardware, which systematically captures the diverse transfer pathways of adversarial strategies. Through this framework, we examine both the underlying mechanics and practical implications of transferable attacks on AI systems. Furthermore, we review cutting-edge methods for enhancing attack transferability, organized around data augmentation and optimization strategies. By consolidating fragmented research and identifying critical future directions, this work provides a foundational roadmap for understanding, evaluating, and defending against transferable threats in real-world AI systems.