这篇论文讲了一个反直觉的现象：给攻击加随机缩放，对标准模型有用，对鲁棒模型反而有害。还给出了简单补救方法，搞对抗攻击的可以看看。
这篇论文发现，输入多样性（DI）通过随机调整大小和填充来提升迁移性，但这种假设依赖于替代模型的类型。在标准替代模型上增加DI概率可提高攻击成功率，但在鲁棒训练的替代模型上反而降低，形成剪刀曲线。在ImageNet上，盲目使用DI导致鲁棒源模型在CNN、ViT、Swin和ConvNeXt等目标上的平均攻击成功率下降10.3%。通过梯度几何分析，约67%的伤害来自resize操作，且直接梯度对齐测量证实resize对标准模型有利而对鲁棒模型有害。作者提出一种无需训练的规则CG-DI，在局部梯度一致性高时禁用DI，避免鲁棒替代模型的损失。
The Scissors Effect: When Resize-Based Input Diversity Helps or Hurts Transfer Attacks
Input Diversity (DI), which applies random resizing and padding at each attack iteration, is a near-default ingredient of transfer-based adversarial attacks, widely assumed to improve transferability. We show this assumption is regime-dependent and, for robustly trained surrogates, often reversed. Varying only the surrogate, increasing the DI probability raises transfer success for standard surrogates but lowers it for robust ones: the two response curves separate like a pair of scissors, a pattern we call the Scissors Effect. The effect is strong and consistent on ImageNet, where blind DI costs the robust source 10.3% attack success on average across CNN, ViT, Swin, and ConvNeXt targets and across ten attacks spanning 2018-2024; it is smaller on CIFAR-10 unless DI is made aggressive. A controlled robustness-strength sweep that varies only the training budget shows the harm is graded rather than binary, crossing from beneficial to harmful already in the little-robustness regime. We trace it to gradient geometry: a resize/translation decomposition attributes roughly 67% of the harm to resize, and a direct source-target gradient-alignment measurement confirms the same resize operation improves alignment for standard surrogates but degrades it for robust ones. We summarize the regime with Local Gradient Consistency (LGC), a single input-space probe that separates the two surrogate types, and prove a bias-variance crossover theorem isolating where DI helps from where its resize bias dominates. A training-free rule (CG-DI) that disables diversity when LGC is high avoids the loss on robust surrogates while keeping DI's benefit on standard ones, positioning the Scissors Effect as a DI-specific manifestation of the broader robustness-transferability trade-off.