Scaling Laws for Black-box Adversarial Attacks

Adversarial examples exhibit cross-model transferability, en-abling threatening black-box attacks on commercial models. Model en-sembling, which attacks multiple surrogates, is a known strategy to im-prove this transferability. However, prior studies typically use small, fixedensembles, which leaves open an intriguing question of whether scalingthe number of surrogate models can further improve black-box attacks.In this work, we conduct the first large-scale empirical study of thisquestion. We show that by resolving gradient conflict with advanced op-timizers, we overcome the quantitative limitations of idealized theoreticalbounds to empirically discover a robust log-linear scaling law, demon-strating that the Attack Success Rate scales linearly with the logarithmof the ensemble size T . We rigorously verify this law across standardclassifiers, SOTA defenses, and MLLMs, and find that scaling distills ro-bust, semantic features of the target class. Consequently, we apply thisfundamental insight to benchmark SOTA MLLMs. This reveals both theattack’s devastating power and a clear robustness hierarchy, as evidencedby achieving an over 80% transfer attack success rate on proprietarymodels like GPT-4o, while also highlighting the exceptional resilienceof Claude-3.5-Sonnet. Our findings urge a shift in focus for robustnessevaluation: from designing intricate algorithms on small ensembles tounderstanding the principled and powerful threat of scaling.