# Uncovering the Connections Between
Adversarial Transferability and Knowledge Transferability

Kaizhao Liang  Jacky Y. Zhang  Boxin Wang  Zhuolin Yang  Oluwasanmi Koyejo  Bo
Li

# Supplementary Material:
Uncovering the Connections Between
Adversarial Transferability and Knowledge Transferability

Kaizhao Liang  Jacky Y. Zhang  Boxin Wang  Zhuolin Yang  Oluwasanmi Koyejo  Bo
Li

###### Abstract

Knowledge transferability, or transfer learning, has been widely adopted to
allow a pre-trained model in the source domain to be effectively adapted to
downstream tasks in the target domain. It is thus important to explore and
understand the factors affecting knowledge transferability. In this paper, as
the first work, we analyze and demonstrate the connections between knowledge
transferability and another important phenomenon–adversarial transferability,
_i.e._ , adversarial examples generated against one model can be transferred
to attack other models. Our theoretical studies show that adversarial
transferability indicates knowledge transferability, and vice versa. Moreover,
based on the theoretical insights, we propose two practical adversarial
transferability metrics to characterize this process, serving as bidirectional
indicators between adversarial and knowledge transferability. We conduct
extensive experiments for different scenarios on diverse datasets, showing a
positive correlation between adversarial transferability and knowledge
transferability. Our findings will shed light on future research about
effective knowledge transfer learning and adversarial transferability
analyses. All code and data are available here.

Machine Learning, ICML

##  1 Introduction

Knowledge transfer is quickly becoming the standard approach for fast learning
adaptation across domains. Also known as transfer learning or learning
transfer, knowledge transfer has been a critical technology for enabling
several real-world applications, including object detection (Zhang et al.,
2014), image segmentation (Kendall et al., 2018), multi-lingual machine
translation (Dong et al., 2015), and language understanding evaluation (Wang
et al., 2019a), among others. For example, since the release of ImageNet
(Russakovsky et al., 2015), pretrained ImageNet models (e.g., on TensorFlow
Hub or PyTorch-Hub) have become the default option for the knowledge transfer
source due to its broad coverage of visual concepts and compatibility with
various visual tasks (Huh et al., 2016). Motivated by its importance, many
studies have explored the factors associated with knowledge transferability.
Most recently, Salman et al. (2020) showed that more robust pretrained
ImageNet models transfer better to downstream tasks, which reveals that
adversarial training helps to improve knowledge transferability.

In the meantime, adversarial transferability has been extensively studied—a
phenomenon that an adversarial instance generated against one model has high
probability attack another one without additional modification (Papernot et
al., 2016; Goodfellow et al., 2014; Joon Oh et al., 2017). Hence, adversarial
transferability is widely exploited in black-box attacks (Ilyas et al., 2018;
Liu et al., 2016; Naseer et al., 2019). A line of work has been conducted to
bound the adversarial transferability based on model (gradient) similarity
(Tramèr et al., 2017b). Given that both adversarial transferability and
knowledge transferability are impacted by certain model similarity and
adversarial ML properties, in this work, we aim to conduct the first study to
analyze the connections between them and ask,

What is the fundamental connection between knowledge transferability and
adversarial transferability? Can we measure one and indicate the other?

Technical Contributions. In this paper, we take the first step towards
exploring the fundamental relation between adversarial transferability and
knowledge transferability. We make contributions on both theoretical and
empirical fronts.

  * •

We formally define the adversarial transferability for the first time by
considering all potential adversarial perturbation vectors. We then conduct
thorough and novel theoretical analysis to characterize the precise connection
between adversarial transferability and knowledge transferability based on our
definition.

  * •

In particular, we prove that high adversarial transferability will indicate
high knowledge transferability, which can be represented as the distance in an
inner product space defined by the Hessian of the adversarial loss. In the
meantime, we prove that high knowledge transferability will indicate high
adversarial transferability.

  * •

Based on our theoretical insights, we propose two practical adversarial
transferability metrics that quantitatively measure the adversarial
transferability in practice. We then provide simulational results to verify
how these metrics connect with the knowledge transferability in a
bidirectional way.

  * •

Extensive experiments justify our theoretical insights and the proposed
adversarial transferability metrics, leading to our discussion on potential
applications and future research.

Related Work There is a line of research studying different factors that
affect knowledge transferability (Yosinski et al., 2014; Long et al., 2015;
Wang et al., 2019b; Xu et al., 2019; Shinya et al., 2019). Further, empirical
observations show that the correlation between learning tasks (Achille et al.,
2019; Zamir et al., 2018), the similarity of model architectures, and data
distribution are all correlated with different knowledge transfer abilities.
Interestingly, recent empirical evidence suggests that adversarially-trained
models transfer better than non-robust models (Salman et al., 2020; Utrera et
al., 2020), suggesting a connection between the adversarial properties and
knowledge transferability. On the other hand, several approaches have been
proposed to boost the adversarial transferability (Zhou et al., 2018; Demontis
et al., 2019; Dong et al., 2019; Xie et al., 2019). Beyond the above empirical
studies, there are a few existing analyses of adversarial transferability,
which explore different conditions that may enhance adversarial
transferability (Athalye et al., 2018; Tramèr et al., 2017b; Ma et al., 2018;
Demontis et al., 2019). In this work, we aim to bridge the connection between
adversarial and knowledge transferability, both of which reveal interesting
properties of ML model similarities from different perspectives.

##  2 Adversarial Transferability and Knowledge Transferability

This section introduces the preliminaries and the formal definitions of the
knowledge and adversarial transferability, and formally defines our problem of
interest.

Notation. Sets are denoted in blackboard bold, e.g., ${\mathbb{R}}$, and the
set of integers $\\{1\dots n\\}$ is denoted as $[n]$. Distributions are
denoted in calligraphy, e.g., ${\mathcal{D}}$, and the support of a
distribution ${\mathcal{D}}$ is denoted as $\text{supp}({\mathcal{D}})$.
Vectors are denoted as bold lower case letters, e.g.,
${\bm{x}}\in{\mathbb{R}}^{n}$, and matrices are denoted as bold uppercase
letters, e.g., ${\bm{W}}$. We denote the entry-wise product operator between
vectors or matrices as $\odot$. The Moore–Penrose inverse of a matrix
${\bm{W}}$ is denoted as ${\bm{W}}^{\dagger}$. We use $\|\cdot\|_{2}$ to
denote Euclidean norm induced by Euclidean inner product
$\langle\cdot,\cdot\rangle$. The standard inner product of two matrices is
defined as
$\langle{\bm{W}},{\bm{M}}\rangle=\operatorname{tr}({\bm{W}}^{\top}{\bm{M}})$,
where $\operatorname{tr}(\cdot)$ is the trace of a matrix. The Frobenius norm
$\|\cdot\|_{F}$ is induced by the standard matrix inner product. Moreover, in
the (semi-)inner product space defined by a positive (semi-)definite matrix
${\bm{S}}$, the (semi-)inner product of two vectors or matrices is defined by
$\langle{\bm{v}}_{1},{\bm{v}}_{2}\rangle_{\bm{S}}={\bm{v}}_{1}^{\top}{\bm{S}}{\bm{v}}_{2}$
or
$\langle{\bm{W}},{\bm{M}}\rangle_{\bm{S}}=\operatorname{tr}({\bm{W}}^{\top}{\bm{S}}{\bm{M}})$,
respectively. Given a vector ${\bm{v}}$, we define its normalization as
$\widehat{{\bm{v}}}={\bm{v}}/\|{\bm{v}}\|_{2}$. When using a denominator
$\|\cdot\|_{*}$ other than Euclidean norm, we denote the normalization as
$\widehat{{\bm{v}}}|_{*}$.

Given a (vector-valued) function $f$, we denote $f({\bm{x}})$ as its evaluated
value at ${\bm{x}}$, and $f$ represents the function itself in the
corresponding Hilbert space. Composition of functions is denoted as $g\circ
f({\bm{x}})=g(f({\bm{x}}))$. We use $\langle\cdot,\cdot\rangle_{\mathcal{D}}$
to denote the inner product induced by distribution ${\mathcal{D}}$ and
inherited from Euclidean inner product, i.e., $\langle
f_{1},f_{2}\rangle_{\mathcal{D}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\langle
f_{1}({\bm{x}}),f_{2}({\bm{x}})\rangle$. Accordingly, we use
$\|\cdot\|_{{\mathcal{D}}}$ to denote the norm induced by the inner product
$\langle\cdot,\cdot\rangle_{\mathcal{D}}$, i.e.,
$\|f\|_{{\mathcal{D}}}=\sqrt{\langle f,f\rangle_{\mathcal{D}}}$. When the
inherited inner product is defined by ${\bm{S}}$, we denote $\langle
f_{1},f_{2}\rangle_{{\mathcal{D}},{\bm{S}}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\langle
f_{1}({\bm{x}}),f_{2}({\bm{x}})\rangle_{\bm{S}}$, and similarly for
$\|f\|_{{\mathcal{D}},{\bm{S}}}$.

Knowledge Transferability Given a pre-trained source model
$f_{S}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{m}$ and a target domain
${\bm{x}}\in{\mathbb{R}}^{n}$ with data distribution
${\bm{x}}\sim{\mathcal{D}}$ and target labels
$y({\bm{x}})\in{\mathbb{R}}^{d}$, knowledge transferability is defined as the
performance of fine-tuning $f_{S}$ on ${\mathcal{D}}$ to predict $y$.
Concretely, knowledge transferability can be represented as a loss
$\mathcal{L}(\ \cdot\ ,y,{\mathcal{D}})$ after fine-tuning by composing the
fixed source model with a trainable function
$g:{\mathbb{R}}^{m}\to{\mathbb{R}}^{d}$, typically from a small function class
$g\in{\mathbb{G}}$, i.e.,

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\mathcal{L}(g\circ
f_{S},y,{\mathcal{D}}),$ (1)

where the loss function $\mathcal{L}$ measures the error between $g\circ
f_{S}$ and the ground truth $y$ under the target data distribution
${\mathcal{D}}$. For example, for neural networks it is usual to stack on and
fine-tune a linear layer; here ${\mathbb{G}}$ is the affine function class. We
will focus on the affine setting in this paper.

For our purposes, a more useful measure of transfer is to compare the quality
of the fine-tuned model to a model trained directly on the target domain
$f_{T}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{d}$. Thus, we study the following
surrogate of knowledge transferability, where the ground truth target is
replaced by a reference target model $f_{T}$:

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\mathcal{L}(g\circ
f_{S},f_{T},{\mathcal{D}}).$ (2)

(a)

(b)

Figure 1: (a) An illustration of the two proposed adversarial transferability
metrics $\alpha_{1},\alpha_{2}$ under different adversarial transferability
settings, _i.e._ , $\alpha_{1}^{f_{S}\to f_{T}},\alpha_{1}^{f_{T}\to
f_{S}},\alpha_{2}^{f_{S}\to f_{T}}$, and $\alpha_{2}^{f_{T}\to f_{S}}$. (b) An
overview of the theoretical analysis framework, and its practical
inspirations, where $\star,\diamond\in\\{T,S\\}$ and $\star\neq\diamond$. The
three blue double-headed arrows are the bidirectional indication relationships
proved in our theory section, and the dashed green arrow shows in practice how
the two proposed adversarial transferability metrics are measured as
representatives of the generalized adversarial transferability based on our
theory.

Adversarial Attacks. For simplicity we consider untargeted attacks that seeks
to maximize the deviation of model output as measured by a given adversarial
loss function $\ell_{adv}(\cdot,\cdot)$. The targeted attack can be viewed as
a special case. Without loss of generality, we assume the adversarial loss is
_non-negative_. Given a datapoint $\bm{x}$ and model $f$, an adversarial
example of magnitude $\epsilon$ is denoted by
$\bm{\delta}_{f,\epsilon}(\bm{x})$, computed as:

$\displaystyle\bm{\delta}_{f,\epsilon}(\bm{x})\ =\
\operatorname*{arg\,max}_{\|\bm{\delta}\|\leq\epsilon}\
\ell_{adv}(f({\bm{x}}),f({\bm{x}}+\bm{\delta})).$ (3)

We note that in theory $\bm{\delta}_{f,\epsilon}(\bm{x})$ may not be unique,
and its generalized definition and its discussion are provided in our
theoretical analysis (Section 3).

Adversarial Transferability. The process of adversarial transfer involves
applying the adversarial example generated against a model $f_{1}$ to another
model $f_{2}$. Thus, adversarial transferability from $f_{1}$ to $f_{2}$
measures how well $\bm{\delta}_{f_{1},\epsilon}$ attacks $f_{2}$. We propose
two metrics, namely, $\alpha_{1}$ and $\alpha_{2}$ that characterize
adversarial transferability from complementary perspectives. To provide a
visual overview of our definitions for the proposed adversarial
transferability metrics, we present an illustration in Figure 1 (a).

######  Definition 1 (The First Adversarial Transferability).

The first adversarial transferability from $f_{1}$ to $f_{2}$ at data sample
${\bm{x}}\sim{\mathcal{D}}$, is defined as

$\displaystyle\alpha_{1}^{f_{1}\to
f_{2}}({\bm{x}})=\frac{\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{1},\epsilon}(\bm{x})))}{\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{2},\epsilon}({\bm{x}})))}.$
(4)

Taking the expectation, the first adversarial transferability is defined as

$\displaystyle\alpha_{1}^{f_{1}\to
f_{2}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\alpha^{f_{1}\to
f_{2}}({\bm{x}})\right].$ (5)

Observe that the first adversarial transferability characterize how well the
adversarial attacks $\bm{\delta}_{f_{1},\epsilon}$ generated against $f_{1}$
perform on $f_{2}$, compared to $f_{2}$’s whitebox adversarial attacks
$\bm{\delta}_{f_{2},\epsilon}$. Thus, high $\alpha_{1}$ indicates high
adversarial transferability. Note that the two attacks use the same magnitude
constraint $\epsilon$.

Recall that $\ell_{adv}(f({\bm{x}}),f({\bm{x}}+\bm{\delta}))$ measures the
effect of the attack $\bm{\delta}$ on the model output $f({\bm{x}})$.
$\alpha_{1}$ characterizes the relative magnitude of this deviation. However,
this magnitude information is incomplete, as the direction of the deviation
also encodes information about the adversarial transfer process. To this end,
we propose the second adverserial metric, inspired by our theoretical
analysis, which characterizes adversarial transferability from the directional
perspective.

######  Definition 2 (The Second Adversarial Transferability).

The second adversarial transferability from $f_{1}$ to $f_{2}$, under data
distribution ${\bm{x}}\sim{\mathcal{D}}$, is defined as

$\displaystyle\alpha_{2}^{f_{1}\to f_{2}}$
$\displaystyle=\|\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}[\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}\widehat{\Delta_{f_{1}\to f_{2}}({\bm{x}})}^{\top}]\|_{F},$
(6)

where

$\displaystyle\Delta_{f_{1}\to f_{1}}({\bm{x}})$
$\displaystyle=f_{1}({\bm{x}}+\bm{\delta}_{f_{1},\epsilon}({\bm{x}}))-f_{1}({\bm{x}})$
(7) $\displaystyle\Delta_{f_{1}\to f_{2}}({\bm{x}})$
$\displaystyle=f_{2}({\bm{x}}+\bm{\delta}_{f_{1},\epsilon}({\bm{x}}))-f_{2}({\bm{x}})$
(8)

are deviations in model output given the adversarial attack
$\bm{\delta}_{f_{1},\epsilon}({\bm{x}})$ generated against $f_{1}$, and
$\widehat{\ \cdot\ }$ denotes the corresponding unit-length vector.

To further clarify the second adversarial transferability metric, consider the
following alternative form of $\alpha_{2}$.

######  Proposition 2.1.

The $\alpha_{2}^{f_{1}\to f_{2}}$ can be reformulated as

$\displaystyle(\alpha_{2}^{f_{1}\to
f_{2}})^{2}=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\theta_{f_{1}\to
f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})\theta_{f_{1}\to
f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})\right],$ (9)

where ${\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}$,
and

$\displaystyle\theta_{f_{1}\to f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})$
$\displaystyle=\langle\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to f_{1}}({\bm{x}}_{2})}\rangle$
(10) $\displaystyle\theta_{f_{1}\to f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})$
$\displaystyle=\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to f_{2}}({\bm{x}}_{2})}\rangle$
(11)

We can see that high $\alpha_{2}$ indicates that it is more likely for the two
inner products (_i.e._ , $\theta_{f_{1}\to f_{1}}$ and $\theta_{f_{1}\to
f_{2}}$) to have the same sign. Given that the direction of $f_{1}$’s output
deviation indicates its attack $\bm{\delta}_{f_{1},\epsilon}$, and the
direction of $f_{2}$’s output deviation indicates the transferred attack
$\bm{\delta}_{f_{1},\epsilon}$, high $\alpha_{2}$ implies that the two
directions will rotate by a similar angle as the data changes.

$\alpha_{1}$ and $\alpha_{2}$ represent complementary aspects of the
adversarial transferability: $\alpha_{1}$ can be understood as how often the
adversarial attack transfers, while $\alpha_{2}$ encodes directional
information of the output deviation caused by adversarial attacks. An example
is provided in the appendix section A to illustrate the necessity of both the
metrics in characterizing the relation between adversarial transferability and
knowledge transferability. To jointly take the two adversarial transferability
metrics into consideration, we propose the following metric as the combined
value of $\alpha_{1}$ and $\alpha_{2}$.

$\displaystyle(\alpha_{1}*\alpha_{2})^{f_{1}\to f_{2}}=$ (12)
$\displaystyle\qquad\big{\|}\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}[\alpha_{1}^{f_{1}\to
f_{2}}({\bm{x}})\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}})}^{\top}]\big{\|}_{F}.$ (13)

We defer the justification for the combined adversarial transferability metric
in the next section, and move on to state a useful proposition.

######  Proposition 2.2.

The adversarial transferabililty metrics $\alpha_{1}^{f_{1}\to f_{2}}$,
$\alpha_{2}^{f_{1}\to f_{2}}$ and $(\alpha_{1}*\alpha_{2})^{f_{1}\to f_{2}}$
are in $[0,1]$.

So far, we have defined knowledge transferability, and two adversarial
trasferability metrics. We can now analyze their connections more precisely.

Problem of Interest. Given a source model
$f_{S}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{m}$, the target data distribution
${\bm{x}}\sim{\mathcal{D}}$, the ground truth target
$y:{\mathbb{R}}^{n}\to{\mathbb{R}}^{d}$, and a target reference model
$f_{T}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{d}$, we aim to study how the
adversarial transferability between $f_{S}$ and $f_{T}$, characterized by the
two proposed adversarial transferability metrics, connects to the knowledge
transfer loss $\min_{g\in{\mathbb{G}}}\mathcal{L}(g\circ
f_{S},y,{\mathcal{D}})$ with affine functions $g\in{\mathbb{G}}$ (equation 1).

##  3 Theoretical Analysis

In this section, we present the theoretical analysis on how the adversarial
transferability and the knowledge transfer process are tied together. To
simplify the discussion, as the objects studied in this section are
specifically focused on the source domain $S$ and the target domain $T$, we
can use $\star$ or $\diamond$ as a placeholder for either $S$ or $T$
throughout this section.

Theoretical Analysis Overview. In subsection 3.1, we define the two
generalized adversarial transferabilities, (i.e., ${\bm{A}}_{1}$,
${\bm{A}}_{2}$), and present Theorem 3.1 showing that ${\bm{A}}_{1}$,
${\bm{A}}_{2}$ together determine a gradient matching distance
$\min_{g\in{\mathbb{G}}}\|\nabla f_{\star}-\nabla g\circ f_{\diamond}\|$,
between the Jacobian matrices of the source and target models in an inner
product space defined by the Hessian of the adversarial loss function. In the
same subsection, we also show that $\alpha_{1}$ and $\alpha_{2}$ represent the
most influential factors in ${\bm{A}}_{1}$ and ${\bm{A}}_{2}$, respectively.
Next, we explore the connection to knowledge transferability in subsection 3.2
via Theorem 3.2 which shows the gradient matching distance approximates the
function matching distance, _i.e._ ,
$\min_{g\in{\mathbb{G}}}\|f_{\star}-g\circ f_{\diamond}\|$, with a
distribution shift up to a Wasserstein distance. Finally, in subsection 3.3 we
complete the analysis by outlining the connection between the function
matching distance and the knowledge transfer loss. A visual overview is shown
in Figure 1 (b).

Setting. As adversarial perturbations are constrained in a small
$\epsilon$-ball, it is reasonable to approximate the deviation of model
outputs by its first-order Taylor approximation. Specifically, in this section
we consider the Euclidean $\epsilon$-ball. Therefore, the output deviation of
a function $f$ at ${\bm{x}}$ given a small perturbation
$\|\bm{\delta}_{\epsilon}\|_{2}\leq\epsilon$ can be approximated by

$\displaystyle f({\bm{x}}+\bm{\delta}_{\epsilon})-f({\bm{x}})\approx\nabla
f({\bm{x}})^{\top}\bm{\delta}_{\epsilon},$ (14)

where $\nabla f({\bm{x}})$ is the Jacobian matrix of $f$ at ${\bm{x}}$.

We consider a convex and twice-differentiable adversarial loss function
$\ell^{\star}_{adv}(\cdot)$ that measures the deviation of model output
$f_{\star}({\bm{x}}+\bm{\delta}_{\epsilon})-f_{\star}({\bm{x}})$, with minimum
$\ell^{\star}_{adv}(\bm{0})=0$, for $\star\in\\{S,T\\}$. We note that we
should treat the adversarial loss on $f_{S}$ and $f_{T}$ differently, as they
may have different output dimensions. Accordingly, the adversarial attack
(equation 3) can be written as

$\displaystyle\bm{\delta}_{f_{\star},\epsilon}({\bm{x}})\ =\
\operatorname*{arg\,max}_{\|\bm{\delta}\|_{2}\leq\epsilon}\
\ell^{\star}_{adv}(\nabla f_{\star}({\bm{x}})^{\top}\bm{\delta}).$ (15)

Another justification of the small-$\epsilon$ approximation follows the
literature; since the ideal attack defined in equation 3 is often intractable
to compute, much of the literature uses the proposed formulation (15) in
practice, _e.g._ , see (Miyato et al., 2018), with experimental results
suggesting similar behaviour as the standard definition.

The Small-$\epsilon$ Regime. Recall that the adversarial loss
$\ell^{\star}_{adv}(\cdot)$ studied in this section is convex, twice-
differentiable, and achieves its minimum at $\bm{0}$, thus in the small
$\epsilon$ regime:

$\displaystyle\ell^{\star}_{adv}(\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}_{\epsilon})$
$\displaystyle=\left(\bm{\delta}_{\epsilon}^{\top}\nabla
f_{\star}({\bm{x}}){\bm{H}}_{\star}\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}_{\epsilon}\right)^{1/2}$ (16)
$\displaystyle=\|\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}_{\epsilon}\|_{{\bm{H}}_{\star}},$ (17)

which is the norm of $f_{\star}$’s output deviation in the inner product space
defined by the Hessian ${\bm{H}}_{\star}$ of the squared adversarial loss
$(\ell_{adv}^{\star})^{2}$.

Accordingly, the adversarial attacks (15) can be written as

$\displaystyle\bm{\delta}_{f_{\star},\epsilon}({\bm{x}})\ =\
\operatorname*{arg\,max}_{\|\bm{\delta}\|_{2}\leq\epsilon}\ \|\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}\|_{{\bm{H}}_{\star}},$ (18)

and we can measure the output deviation of $f_{\diamond}$’s caused by
$f_{\star}$’s adversarial attack $\bm{\delta}_{f_{\star},\epsilon}({\bm{x}})$,
denoted as:

$\displaystyle\Delta_{f_{\star}\to f_{\diamond},\epsilon}({\bm{x}})=\nabla
f_{\diamond}({\bm{x}})^{\top}\bm{\delta}_{f_{\star},\epsilon}({\bm{x}}).$ (19)

Note that in the small-$\epsilon$ regime, the actual value of $\epsilon$
becomes trivial (_e.g., $\alpha_{1}$_), consequently we will omit the
$\epsilon$ for notational ease:

$\displaystyle\alpha_{1}^{f_{\star}\to f_{\diamond}}({\bm{x}})$
$\displaystyle=\frac{\|\Delta_{f_{\star}\to
f_{\diamond}}({\bm{x}})\|_{{\bm{H}}_{\diamond}}}{\|\nabla
f_{\diamond}({\bm{x}})\|_{{\bm{H}}_{\diamond}}}.$ (20)

Similarly, $\alpha_{2}$ can be computed using (19) in Definition 2, _i.e._ ,

$\displaystyle\alpha_{2}^{f_{\star}\to f_{\diamond}}$
$\displaystyle=\|\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}[\widehat{\Delta_{f_{\star}\to
f_{\star}}({\bm{x}})}\widehat{\Delta_{f_{\star}\to
f_{\diamond}}({\bm{x}})}^{\top}]\|_{F}.$ (21)

With these insights, next we will derive our first theorem.

###  3.1 Adversarial Transfer Indicates the Gradient Matching Distance, and
Vice Versa

We present an interesting finding in this subsection, _i.e._ , the generalized
adversarial transferabilities ${\bm{A}}_{1},{\bm{A}}_{2}$ have a direct
connection to the gradient matching distance between the source model
$f_{S}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{m}$ and target model
$f_{T}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{d}$. The gradient matching distance is
defined as the smallest distance an affine transformation can achieve between
their Jacobians $\nabla f_{T}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{n\times d}$ and
$\nabla f_{S}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{n\times m}$ in the inner
product space defined by ${\bm{H}}_{\star}$ and data sample distribution
${\bm{x}}\sim{\mathcal{D}}$, as shown below.

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}},$ (22)

where $g\in{\mathbb{G}}$ are affine transformations. Note that
$g:{\mathbb{R}}^{m}\to{\mathbb{R}}^{d}$ if $(\star,\diamond)=(T,S)$, and
$g:{\mathbb{R}}^{d}\to{\mathbb{R}}^{m}$ if $(\star,\diamond)=(S,T)$. We defer
the analysis of how the gradient matching distance approximates the knowledge
transfer loss, and focus on its connection to adversarial transfer.

A Full Picture of Adversarial Transferability. A key observation is that the
adversarial attack (equation 18) is the singular vector corresponding to the
largest singular value of the Jacobian $\nabla f_{\star}({\bm{x}})$ in the
${\bm{H}}_{\star}$ inner product space. Thus, information regarding other
singular values that are not revealed by the adversarial attack. Therefore, we
can consider other singular values, corresponding to smaller signals than the
one revealed by adversarial attacks, to complete the analysis. We denote
$\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})\in{\mathbb{R}}^{n}$ as the
descending (in absolute value) singular values of the Jacobian $\nabla
f_{\star}({\bm{x}})^{\top}\in{\mathbb{R}}^{\cdot\times n}$ in the
${\bm{H}}_{\star}$ inner product space. In other words, we denote
$\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})\in{\mathbb{R}}^{n}$ as the
square root of the descending eigenvalues of $\nabla
f_{\star}({\bm{x}}){\bm{H}}_{\star}\nabla f_{\star}({\bm{x}})^{\top}$, i.e.,

$\displaystyle\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})=[\sigma_{f_{\star}}^{(1)}({\bm{x}}),\dots,\sigma_{f_{\star}}^{(n)}({\bm{x}})]^{\top}.$
(23)

Note that the number of non-zero singular values may be less than $n$, in
which case we fill the rest with zeros such that vector is $n$-dimensional.

Since the adversarial attack $\bm{\delta}_{f_{\star},\epsilon}({\bm{x}})$
corresponds to the largest singular value
$\sigma_{f_{\star}}({\bm{x}})^{(1)}$, we can also generalize the adversarial
attack by including all the singular vectors. _i.e._ ,

$\displaystyle\bm{\delta}_{f_{\star}}^{(i)}({\bm{x}})\quad\text{ corresponds
to }\quad\sigma_{f_{\star}}^{(i)}({\bm{x}}),\quad\forall i\in[n].$ (24)

Loosely speaking, one could think $\bm{\delta}_{f_{\star}}^{(i)}({\bm{x}})$ as
the adversarial attack of $f_{\star}({\bm{x}})$ in the subspace orthogonal to
all the previous attacks, _i.e._ , $\bm{\delta}_{f_{\star}}^{(j)}({\bm{x}})$
for $\forall j\in[i-1]$.

Accordingly, for $\forall i\in[i]$ we denote the output deviation as

$\displaystyle\Delta^{(i)}_{f_{\star}\to f_{\diamond}}({\bm{x}})=\nabla
f_{\diamond}({\bm{x}})^{\top}\bm{\delta}_{f_{\star}}^{(i)}({\bm{x}}).$ (25)

As a consequence, we generalize the first adversarial transferability to be a
$n$-dimensional vector $\bm{A}_{1}^{\star,\diamond}({\bm{x}})$ including the
adversarial losses of all of the generalized adversarial attacks, where the
$i^{th}$ element in the vector is

$\displaystyle\bm{A}_{1}^{\star,\diamond}({\bm{x}})^{(i)}=\frac{\|\Delta_{f_{\star}\to
f_{\diamond}}^{(i)}({\bm{x}})\|_{{\bm{H}}_{\diamond}}}{\|\nabla
f_{\diamond}({\bm{x}})\|_{{\bm{H}}_{\diamond}}}.$ (26)

Note that the first entry of $\bm{A}_{1}^{\star,\diamond}({\bm{x}})$ is the
original adversarial transferability, _i.e._ ,
${{\bm{A}}}_{1}^{\star,\diamond}({\bm{x}})^{(1)}$ is the same as the
${\alpha}_{1}^{f_{\star}\to f_{\diamond}}({\bm{x}})$ in Definition 1.

With the above generalization that captures the full picture of the
adversarial transfer process, we able to derive the following theorem.

######  Theorem 3.1.

Given the target and source models $f_{\star},f_{\diamond}$, where
$(\star,\diamond)\in\\{(S,T),(T,S)\\}$, the gradient matching distance
(equation 22) can be written as

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}=$ (27)
$\displaystyle\sqrt{1-\frac{\mathbb{E}[{\bm{v}}^{\star,\diamond}({\bm{x}}_{1})^{\top}{{\bm{A}}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}}){\bm{v}}^{\star,\diamond}({\bm{x}}_{2})]}{\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}^{2}\cdot\|{\bm{J}}^{\dagger}\|^{-1}_{{\bm{H}}_{\diamond}}}}\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}},$ (28)

where the expectation is taken over
${\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}$, and

$\displaystyle{\bm{v}}^{\star,\diamond}({\bm{x}})$
$\displaystyle=\sigma^{(1)}_{f_{\diamond},{\bm{H}}_{\diamond}}({\bm{x}})\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})\odot{\bm{A}}_{1}^{\star,\diamond}({\bm{x}})$
(29) $\displaystyle{\bm{J}}$
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})].$ (30)

Moreover, ${{\bm{A}}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}})$ is a
matrix, and its element in the $i^{th}$ row and $j^{th}$ column is

$\displaystyle{{\bm{A}}}_{2}^{\star,\diamond}({\bm{x}}_{1},{\bm{x}}_{2}$
$\displaystyle)^{(i,j)}=\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\star}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\star}}\rangle$ (31)
$\displaystyle\cdot\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\diamond}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\diamond}}\rangle_{\widehat{{\bm{J}}^{\dagger}}|_{{\bm{H}}_{\diamond}}}.$
(32)

Recall the alternative representation of the second adversarial
transferability $\alpha_{2}$, and we can immediately observe that $\alpha_{2}$
is determined by ${\bm{A}}_{2}$. Therefore, both $\alpha_{1}$ and $\alpha_{2}$
appear in this relation. Let us interpret the theorem, and justify the two
proposed adversarial transferability metrics.

Interpretation of Theorem 3.1. First, we consider components that are not
directly related to the adversarial transfer in the RHS of (27). The $\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}$ outside represents the
overall magnitude of the loss. In the fraction, the $\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}$ in the denominator
normalizes the $\bm{\sigma}_{f_{\star}}$ in the numerator. Similarly, though
more complicated, the $\|{\bm{J}}^{\dagger}\|^{-1}_{2}$ in the denominator
corresponds to the $\sigma_{f_{\diamond}}^{(1)}$ in the numerator. We note
that these are properties of $f_{\star},f_{\diamond}$.

Next, observe that the components directly related to the adversarial transfer
process are the generalized adversarial transferability ${\bm{A}}_{1}$ and
${\bm{A}}_{2}$. Let us neglect the superscript (i) or (j) for now, so we can
see that their interpretations are the same as we introduced for $\alpha_{1}$
and $\alpha_{2}$ in section 2. That is, ${\bm{A}}_{1}$ captures the magnitude
of the deviation in model outputs caused by adversarial attacks, while
${\bm{A}}_{2}$ captures the direction of the deviation. A minor difference
between $\alpha_{2}$ and ${\bm{A}}_{2}$ is that the second inner product in
the elements of ${\bm{A}}_{2}$ is defined by a positive semi-definite matrix
$\widehat{{\bm{J}}^{\dagger}}$. For practical implementation, we choose to
neglect this term, and use the standard Euclidean inner product in
$\alpha_{2}$, which can be understood as a stretched version of the
$\widehat{{\bm{J}}^{\dagger}}$ inner product space.

Moreover, as the singular vector $\bm{\sigma}_{f_{\star}}$ has descending
entries, we can see that in the vector ${\bm{A}}_{1}$ and the matrix
${\bm{A}}_{2}$, the elements with superscript (1) have the most influence in
the relations. In other words, the two proposed adversarial transferability
metrics, $\alpha_{1}$ and $\alpha_{2}$, are the most influential factors in
equation 27. We can also see that the combined metric
$(\alpha_{1}*\alpha_{2})$ also stems from here by only considering the
components with the first superscript.

To interpret the relation between the gradient matching distance and the
adversarial transferabilities, we introduce the following proposition. This
shows that, in general, ${\bm{A}}_{1}$ and ${\bm{A}}_{2}$ with their elements
closer to $1$ can serve as a bidirectional indicator of a smaller gradient
matching distance.

######  Proposition 3.1.

In Theorem 3.1,

$\displaystyle
0\leq\frac{\mathbb{E}[{\bm{v}}^{\star,\diamond}({\bm{x}}_{1})^{\top}{\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}}){\bm{v}}^{\star,\diamond}({\bm{x}}_{2})]}{\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}^{2}\cdot\|{\bm{J}}^{\dagger}\|^{-1}_{{\bm{H}}_{\diamond}}}\leq
1.$ (33)

In conclusion, Theorem 3.1 reveals a bidirectional relation between the
adversarial transfer process and the gradient matching distance, where the
adversarial transfer process can be encoded by the generalized adversarial
transferabilities, _i.e._ , ${\bm{A}}_{1}$ and ${\bm{A}}_{2}$. Moreover,
$\alpha_{1}$ and $\alpha_{2}$ play the most influential role in their
generalization, i.e., ${\bm{A}}_{1}$ and ${\bm{A}}_{2}$.

###  3.2 The Gradient Matching Distance indicates the Function Matching
Distance, and Vice Versa

To bridge the gradient matching distance to the knowledge transfer loss, an
immediate step is to connect the gradient distance to the function distance
which directly serves as a surrogate knowledge transfer loss as defined in
(equation 2). Specifically, in this subsection, we present a connection
between the function matching distance, _i.e._ ,

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|f_{\star}-g\circ
f_{\diamond}\|_{{\mathcal{D}},{\bm{H}}_{\star}},$ (34)

and the gradient matching distance, _i.e._ ,

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|\nabla f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}},$ (35)

where $g\in{\mathbb{G}}$ are affine transformations.

For intuition, consider a point ${\bm{x}}_{0}$ in the input space
${\mathbb{R}}^{n}$, a path $\gamma_{\bm{x}}:[0,1]\to{\mathbb{R}}^{n}$ such
that $\gamma_{\bm{x}}(0)={\bm{x}}_{0}$ and $\gamma_{\bm{x}}(1)={\bm{x}}$.
Then, denoting $\gamma$ as the function of ${\bm{x}}$, we can write the
difference between the two functions as

$\displaystyle f_{\star}-{g}\circ f_{\diamond}=$
$\displaystyle\int_{0}^{1}(\nabla f_{\star}(\gamma(t))-\nabla(g\circ
f_{\diamond}(\gamma(t))))^{\top}\dot{\gamma}(t)\mathop{}\\!\mathrm{d}t$ (36)
$\displaystyle+(f_{\star}({\bm{x}}_{0})-g\circ f_{\diamond}({\bm{x}}_{0})).$
(37)

Noting that the function difference is a path integral of the gradient
difference, we should expect a distribution shift when characterizing their
connection, _i.e._ , the integral path affects the original data distribution
${\mathcal{D}}$. Accordingly, as the integral path may leave the support of
${\mathcal{D}}$, it is necessary to assume the smoothness of the function, as
shown below.

Denoting the optimal $g\in{\mathbb{G}}$ in (34) as $\tilde{g}$, and one of the
optimal $g\in{\mathbb{G}}$ in (35) as $\tilde{g}^{\prime}$, we define

$\displaystyle h_{\star,\diamond}:=f_{\star}-\tilde{g}\circ
f_{\diamond}\quad\text{and}\quad
h_{\star,\diamond}^{\prime}:=f_{\star}-\tilde{g}^{\prime}\circ f_{\diamond},$
(38)

and we can see that the gradient matching distance and the function matching
distance can be written as

$\displaystyle(\ref{def:function-matching-
dist})=\|h_{\star,\diamond}\|_{{\mathcal{D}},{\bm{H}}_{\star}}\quad\text{and}\quad(\ref{def:gradient-
matching-dist-
new})=\|\nabla{h^{\prime}_{\star,\diamond}}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}.$
(39)

######  Assumption 1 ($\beta$-smoothness).

We assume $h_{\star,\diamond}$ and $h^{\prime}_{\star,\diamond}$ are both
$\beta$-smooth, _i.e._ ,

$\displaystyle\|\nabla h_{\star,\diamond}^{\top}({\bm{x}}_{1})-\nabla
h_{\star,\diamond}^{\top}({\bm{x}}_{2})\|_{{\bm{H}}_{\star}}\leq\|{\bm{x}}_{1}-{\bm{x}}_{2}\|_{2},$
(40)

and similarly for $h^{\prime}_{\star,\diamond}$.

With this assumption, we can prove that the gradient matching distance and the
function matching distance can bound each other.

######  Theorem 3.2.

With the notation defined in equation 38, assume the $\beta$-smoothness
assumption holds. Given a data distribution ${\mathcal{D}}$ and $\tau>0$,
there exist distributions ${\mathcal{D}}_{1},{\mathcal{D}}_{2}$ such that the
type-1 Wasserstein distance $W_{1}({\mathcal{D}},{\mathcal{D}}_{1})\leq\tau$
and $W_{1}({\mathcal{D}},{\mathcal{D}}_{2})\leq\tau$ satisfying

$\displaystyle{\tfrac{1}{2B^{2}}}\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle\leq\|\nabla
h_{\star,\diamond}^{\prime\top}\|^{2}_{{\mathcal{D}}_{1},{\bm{H}}_{\star}}+\beta^{2}(B-\tau)_{+}^{2}$
(41) $\displaystyle\tfrac{1}{3n}\|\nabla
h_{\star,\diamond}^{\prime\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle\leq\tfrac{2}{\tau^{2}}\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}}_{2},{\bm{H}}_{\star}}+\beta^{2}\tau^{2},$
(42)

where $n$ is the dimension of ${\bm{x}}\sim{\mathcal{D}}$, and
$B=\inf_{{\bm{x}}_{0}\in{\mathbb{R}}^{n}}\sup_{{\bm{x}}\in\text{supp}({\mathcal{D}})}\|{\bm{x}}-{\bm{x}}_{0}\|_{2}$
is the radius of $\text{supp}({\mathcal{D}})$.

We note that the above theorem compromises some tightness in exchange for a
cleaner presentation without losing its core message, which is discussed in
the proof of the theorem.

Interpretation of Theorem 3.2. The theorem shows that under the smoothness
assumption, the gradient matching distance indicates the function matching
distance, and vice versa, with a distribution shift bounded in Wasserstein
distance. As the distribution shift is in general necessary, we conjecture
that using different data distributions for adversarial transfer and knowledge
transfer can also be applicable.

###  3.3 The Function Matching Distance Indicates Knowledge Transferability,
and Vice Versa

To complete the story, it remains to connect the function matching distance to
knowledge transferability. As the adversarial transfer is symmetric (_i.e._ ,
either from $f_{S}\to f_{T}$ or $f_{T}\to f_{S}$), we are able to use the
placeholders $\star,\diamond\in\\{S,T\\}$ all the way through. However, as the
knowledge transfer is asymmetric (_i.e._ , $f_{S}\to y$ to the target ground
truth), we need to instantiate the direction of adversarial transfer to
further our discussion.

Adversarial Transfer from $f_{T}\to f_{S}$. As we can see from the
${\bm{A}}_{1}^{\star,\diamond}$ in Theorem 3.1, this direction corresponds to
$(\star,\diamond)=(T,S)$. Accordingly, the function matching distance
(equation 34) becomes

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|f_{T}-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}.$ (43)

We can see that equation 43 directly translates to the surrogate knowledge
transfer loss that uses the “pseudo ground truth” from the target reference
model $f_{T}$.

In other words, the function matching distance serves as an approximation of
the knowledge transfer loss defined as their distance in the inner product
space of ${\bm{H}}_{T}$, _i.e._ ,

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|y-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}.$ (44)

The accuracy of the approximation depends on the performance of $f_{T}$, as
shown in the following theorem.

######  Theorem 3.3.

The surrogate transfer loss (43) and the true transfer loss (44) are close,
with an error of $\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}$.

$\displaystyle-\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}\leq(\ref{def:know-
transfer-dist})-(\ref{eq:function-distance-
S-T})\leq\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}$ (45)

Adversarial Transfer from $f_{S}\to f_{T}$. This direction corresponds to
$(\star,\diamond)=(S,T)$. Accordingly, the function matching distance
(equation 34) becomes

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|f_{S}-g\circ
f_{T}\|_{{\mathcal{D}},{\bm{H}}_{S}}.$ (46)

Since the affine transformation $g$ acts on the target reference model, it can
not be directly viewed as a surrogate transfer loss. However, interesting
interpretations can be found in this direction, depending on the output
dimension of $f_{S}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{m}$ and
$f_{T}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{d}$.

That is, when the direction of adversarial transfer is from $f_{S}\to f_{T}$,
the indicating relation between it and knowledge transferability would
possibly be unidirectional, depending on the dimensions. More discussion is
included in the appendix section B due to space limitation.

##  4 Synthetic Experiments

The synthetic experiment aims to bridge the gap between theory and practice by
verifying some of the theoretical insights that may be difficult to compute
for large-scale experiments. Specifically, the synthetic experiment aims to
verify: first, how influential are the two proposed adversarial
transferability metrics $\alpha_{1},\alpha_{2}$ comparing to the other factors
in the generalized adversarial attacks (equation 24); Second, how does the
gradient matching distance track the knowledge transfer loss. The dataset
($N=5000$) is generated by a Gaussian mixture of $10$ Gaussians. The ground
truth target is set to be the sum of $100$ radial basis functions. The
dimension of ${\bm{x}}$ is $50$, and the dimension of the target is $10$.
Details of the datasets are defer to appendix section F.

Models Both the source model $f_{S}$ and target model $f_{T}$ are one-hidden-
layer neural networks with sigmoid activation.

Methods First, sample $D=\\{({\bm{x}}_{i},{\bm{y}}_{i})\\}_{i=1}^{N}$ from the
distribution, where ${\bm{x}}$ is $50$-dimensional, ${\bm{y}}$ is
$10$-dimensional. Then we train a target model $f_{T}$ on $D$. To derive the
source models, we first train a target model on $D$ with width $m=100$.
Denoting the weights of a target model as ${\bm{W}}$, we randomly sample a
direction ${\bm{V}}$ where each entry of ${\bm{V}}$ is sampled from
$U(-0.5,0.5)$, and choose a scale $t\in[0,1]$. Subsequently, we perturb the
model weights of the clean source model as ${\bm{W}}’:={\bm{W}}+t{\bm{V}}$,
and define the source model $f_{S}$ to be a one-hidden-layer neural network
with weights ${\bm{W}}’$. Then, we compute each of the quantities we care
about, including $\alpha_{1}$, $\alpha_{2}$ from both $f_{S}\to f_{T}$ and
$f_{T}\to f_{S}$, the gradient matching distance (equation 22), and the actual
knowledge transfer distance (equation 44). We use the standard $\ell_{2}$ loss
as the adversarial loss function.

Results We present two sets of experiment in Figure 2. The indication
relations between adversarial transferability and knowledge transferability
can be observed. Moreover: 1. the metrics $\alpha_{1},\alpha_{2}$ are more
meaningful if using the regular attacks $\bm{\delta}_{f_{\star}}^{(1)}$; 2.
the gradient matching distance tracks the actual knowledge transferability
loss; 3. the directions of $f_{T}\to f_{S}$ and $f_{S}\to f_{T}$ are similar.

(a) $\bm{\delta}_{f_{\star}}^{(1)}$

(b) $\bm{\delta}_{f_{\star}}^{(2)}$

Figure 2:  As defined in equation 24, (a) corresponds to the regular
adversarial attacks, while (b) the secondary adversarial attack. That is, (b)
represents the other information in the adversarial transferring process
compared with the first. The x-axis shows the scale of perturbation
$t\in[0,1]$ that controls how much the source model deviates from the target
model. There are in total 6 quantities reported. Specifically,
$\alpha_{1}^{f_{T}\to f_{S}}$ is black solid; $\alpha_{1}^{f_{S}\to f_{T}}$ is
black dotted; $\alpha_{2}^{f_{T}\to f_{S}}$ is green solid;
$\alpha_{2}^{f_{S}\to f_{T}}$ is green dotted; the gradient matching loss is
red solid; and the knowledge transferability distance is blue solid.

##  5 Experimental Evaluation

We present the real-data experiments based on both image and natural language
datasets in this section, and discuss the potential applications.

Adversarial Transferability Indicating Knowledge Transferability.  In this
experiment, we show how to use adversarial transferability to identify the
optimal transfer learning candidates from a pool of models trained on the same
source dataset. We first train 5 different architectures (AlexNet, Fully
connected network, LeNet, ResNet18, ResNet50) on cifar10 (Krizhevsky et al.,
2009). Then we perform transfer learning to STL10 (Coates et al., 2011) to
obtain the knowledge transferability of each, measured by accuracy. At the
same time, we also train one ResNet18 on STL10 as the target model, which has
poor accuracy because of the lack of data. To measure the adversarial
transferability, we generate adversarial examples with PGD (Madry et al.,
2017) on the target model and use the generated adversarial examples to attack
each source model. The adversarial transferability is expressed in the form of
$\alpha_{1}$ and $\alpha_{2}$. Our results in Table 1 indicate that we can use
adversarial tarnsferability to forecast knowledge transferability, where the
only major computational overheads are training a naive model on the target
domain and generating a few adversarial examples. In the end, We further
evaluate the significance of our results by Pearson score. More details about
training and generation of adversarial examples can be found in the appendix
G.

Model | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
Fully Connected | 28.30 | 0.346 | 0.189 | 0.0258
LeNet | 45.65 | 0.324 | 0.215 | 0.0254
AlexNet | 55.09 | 0.337 | 0.205 | 0.0268
ResNet18 | 76.60 | 0.538 | 0.244 | 0.0707
ResNet50 | 77.92 | 0.614 | 0.234 | 0.0899

Table 1: Knowledge transferability (Knowledge Trans.) among different model
architectures. Our correlation analysis shows Pearson score of -0.51 between
the transfer loss and $\alpha_{1}$. Lower transfer loss corresponds to higher
transfer accuracy. More details can be found in fig 4 in the Appendix G

To further validate our idea, we also conduct experiments on the NLP domain.
We first finetune 5 different BERT classification models on different data
domain (IMDB, Moview Review (MR), Yelp, AG, Fake). We refer the models trained
on MR, Yelp, AG and Fake datasets as the source models, and take the model
trained on IMDB datset as the target model. To measure the knowledge
transferability, we fine-tune the source models with new linear layers on the
target dataset for one epoch. We report the accuracy of the transferred models
on the target test set as the metric to indicate the knowledge
transferability. In terms of the adversarial transferability, we generate
adversarial examples by the state-of-the-art whitebox attack algorithm T3
(Wang et al., 2020) against the target model and transfer the adversarial
examples to source models to evaluate the adversarial transferability.
Following our previous experiment, we also calculate $\alpha_{1}$ and
$\alpha_{2}$. Experimental results are shown in Table 2. We observe that
source models with larger adversarial transferability, measured by
$\alpha_{1}$, $\alpha_{2}$ and $\alpha_{1}*\alpha_{2}$, indeed tend to have
larger knowledge transferability.

Model | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
MR | 89.34 | 0.743 | 0.00335 | 3.00e-3
Yelp | 88.81 | 0.562 | 0.00135 | 8.87e-4
AG | 87.58 | 0.295 | 0.00021 | 8.56e-5
Fake | 84.06 | 0.028 | 0.00032 | 5.58e-6
Table 2: Knowledge transferability (Knowledge Trans.) from the Source Models (MR, Yelp, AG, Fake) to the Target Model (IMDB). Adversarial transferability is measured by using the adversarial examples generated against the Target Model (IMDB) to attack the Source Models and estimate $\alpha_{1}$ and $\alpha_{2}$. The correlation analysis shows Pearson Score of $0.27$ between the transfer confidence and $\alpha_{1}$. Higher transfer confidence indicates higher knowledge transferability. More details can be found in Figure 6 in Appendix §G. Similarity | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
0% | 45.00 | 0.310 | 0.146 | 0.0169
25% | 45.68 | 0.318 | 0.305 | 0.0383
50% | 59.09 | 0.338 | 0.355 | 0.0436
75% | 71.62 | 0.337 | 0.312 | 0.0402
100% | 81.84 | 0.358 | 0.357 | 0.0489
Table 3: Knowledge transferability (Knowledge Trans.) of different source model. Similarity indicates how similar the source distributions are with the target distribution. Our correlation analysis shows Pearson score of -0.06 between the transfer loss and $\alpha_{1}$. Lower transfer loss corresponds to higher knowledge transferability. More details can be found in fig 8 in the Appendix G. Model | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
MR | 89.34 | 0.584 | 0.00188 | 2.32e-3
Yelp | 88.81 | 0.648 | 0.00120 | 9.52e-4
AG | 87.58 | 0.293 | 0.00016 | 4.35e-6
Fake | 84.06 | 0.150 | 0.00073 | 3.55e-5
Table 4: Knowledge transferability (Knowledge Trans.) from the Source Models
(MR, Yelp, AG, Fake) to the Target Model (IMDB). Adversarial transferability
is measured by using the adversarial examples generated against the Source
Models to attack the Target Models and estimate $\alpha_{1}$ and $\alpha_{2}$.
The correlation analysis shows Pearson Score of $0.27$ between the transfer
confidence and $\alpha_{1}$. Higher transfer confidence indicates higher
knowledge transferability. More details can be found in Figure 9 in Appendix
§G.

Knowledge Transferability Indicating Adversarial Transferability. In addition,
we are interested in the impact of knowledge transferability on adversarial
transferability. As predicted by our theory, the more knowledge transferable a
source model is to the target domain, the more adversarial transferable it is.

We split cifar10 into 5 different subsets containing different percentages of
animals and vehicles. We train a resNet18 on each of them as source models,
which are later fine-tuned to obtained the knowledge transferability measured
by accuracy. Then we train another resNet18 on a subset of stl10 that only
contains vehicles. Different from the last experiment, we generate adversarial
examples with PGD on each of the source models and transfer them to the target
model. Table 3 shows, the source model that transfers knowledge better
generates more transferable adversarial examples. This implies we can use this
relation to facilitate blackbox attack against a hidden target model, given
some knowledge about the source and target domains. More details of training
and generation of adversarial examples can be found in the appendix.

We evaluate the impact of knowledge transferability to adversarial
transferability in the NLP domain as well. We mostly follow the setting
describe in the previous section, where we have four source models and one
target model, and the knowledge transferability from source models to the
target model is measured by the accuracy of the transferred models on the
target test set. The difference lies on the evaluation of the adversarial
transferability, where we generate adversarial examples against the source
models and evaluate their attack capability on the target model. As shown in
Table 4, we note that when the source data domain is getting closer to the
target data domain, the knowledge transferability grows, and the adversarial
transferability also increases. More experimental details can be found in
Appendix G.

Ablation Studies Following the settings in table 1, we conduct ablation
studies (table 5) on two additional attack methods, MI (Tramèr et al., 2017a),
PGD-L2 and two additional $\epsilon$ with PGD, 2/225, 4/255, we discover that
neither the attack method nor $\epsilon$ has significant impact on our
conclusion.

Model | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
Fully Connected | 28.30 | 0.0985 | 0.0196 | 0.00027
LeNet | 45.65 | 0.2106 | 0.0259 | 0.00158
AlexNet | 55.09 | 0.1196 | 0.0206 | 0.00037
ResNet18 | 76.60 | 0.2739 | 0.0413 | 0.00405
ResNet50 | 77.92 | 0.1952 | 0.0320 | 0.00172

$\epsilon=2/255$. Pearson score is -0.45.

Model | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
Fully Connected | 28.30 | 0.0974 | 0.0225 | 0.00029
LeNet | 45.65 | 0.2099 | 0.0309 | 0.00192
AlexNet | 55.09 | 0.1283 | 0.0230 | 0.00048
ResNet18 | 76.60 | 0.2853 | 0.0481 | 0.00496
ResNet50 | 77.92 | 0.2495 | 0.0414 | 0.00337

$\epsilon=4/255$. Pearson score is -0.49.

Model | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
Fully Connected | 28.30 | 0.1678 | 0.0379 | 0.0013
LeNet | 45.65 | 0.0997 | 0.0503 | 0.0005
AlexNet | 55.09 | 0.1229 | 0.0506 | 0.0009
ResNet18 | 76.60 | 0.2731 | 0.0630 | 0.0052
ResNet50 | 77.92 | 0.3695 | 0.0550 | 0.0081

Attack with MI. Pearson score is -0.45.

Model | Knowledge Trans. | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{1}*\alpha_{2}$
---|---|---|---|---
Fully Connected | 28.30 | 0.0809 | 0.0175 | 0.00018
LeNet | 45.65 | 0.2430 | 0.0190 | 0.00149
AlexNet | 55.09 | 0.1101 | 0.0188 | 0.00031
ResNet18 | 76.60 | 0.3619 | 0.0303 | 0.00464
ResNet50 | 77.92 | 0.2506 | 0.0237 | 0.00179

$\ell_{2}$ attack with $\epsilon=1$. Pearson score is -0.40.

Table 5: With varying attack methods and $\epsilon$, adversarial
transferability is still correlated with knowledge transferability.

##  6 Conclusion

We theoretically analyze the relation between adversarial transferability and
knowledge transferability. We provide empirical experimental justifications in
pratical settings. Both our theoretical and empirical results show that
adversarial transferability can indicate knowledge transferability and vice
versa. We expect our work will inspire future work on further exploring other
factors that impact knowledge transferability and adversarial transferability.

##### Acknowledgments

This work is partially supported by NSF IIS 1909577, NSF CCF 1934986, NSF CCF
1910100, NSF CNS 20-46726 CAR, Amazon Research Award, and the Intel RSA 2020.

## References

  * Achille et al. (2019) Achille, A., Lam, M., Tewari, R., Ravichandran, A., Maji, S., Fowlkes, C. C., Soatto, S., and Perona, P.  Task2vec: Task embedding for meta-learning.  In _Proceedings of the IEEE International Conference on Computer Vision_ , pp. 6430–6439, 2019.
  * Athalye et al. (2018) Athalye, A., Carlini, N., and Wagner, D.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  In _International Conference on Machine Learning_ , pp. 274–283, 2018.
  * Coates et al. (2011) Coates, A., Ng, A., and Lee, H.  An analysis of single-layer networks in unsupervised feature learning.  In _Proceedings of the fourteenth international conference on artificial intelligence and statistics_ , pp. 215–223, 2011.
  * Demontis et al. (2019) Demontis, A., Melis, M., Pintor, M., Jagielski, M., Biggio, B., Oprea, A., Nita-Rotaru, C., and Roli, F.  Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks.  In _28th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 19)_, pp. 321–338, 2019.
  * Dong et al. (2015) Dong, D., Wu, H., He, W., Yu, D., and Wang, H.  Multi-task learning for multiple language translation.  In _Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_ , pp. 1723–1732, 2015.
  * Dong et al. (2019) Dong, Y., Pang, T., Su, H., and Zhu, J.  Evading defenses to transferable adversarial examples by translation-invariant attacks.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , pp. 4312–4321, 2019.
  * Goodfellow et al. (2014) Goodfellow, I. J., Shlens, J., and Szegedy, C.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014.
  * Huh et al. (2016) Huh, M., Agrawal, P., and Efros, A. A.  What makes imagenet good for transfer learning?  _arXiv preprint arXiv:1608.08614_ , 2016.
  * Ilyas et al. (2018) Ilyas, A., Engstrom, L., Athalye, A., and Lin, J.  Black-box adversarial attacks with limited queries and information.  In _International Conference on Machine Learning_ , pp. 2137–2146, 2018.
  * Joon Oh et al. (2017) Joon Oh, S., Fritz, M., and Schiele, B.  Adversarial image perturbation for privacy protection–a game theory perspective.  In _Proceedings of the IEEE International Conference on Computer Vision_ , pp. 1482–1491, 2017.
  * Kariyappa & Qureshi (2019) Kariyappa, S. and Qureshi, M. K.  Improving adversarial robustness of ensembles with diversity training.  _arXiv preprint arXiv:1901.09981_ , 2019.
  * Kendall et al. (2018) Kendall, A., Gal, Y., and Cipolla, R.  Multi-task learning using uncertainty to weigh losses for scene geometry and semantics.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 7482–7491, 2018.
  * Krizhevsky et al. (2009) Krizhevsky, A., Hinton, G., et al.  Learning multiple layers of features from tiny images.  2009\.
  * Liu et al. (2016) Liu, Y., Chen, X., Liu, C., and Song, D.  Delving into transferable adversarial examples and black-box attacks.  _arXiv preprint arXiv:1611.02770_ , 2016.
  * Long et al. (2015) Long, M., Cao, Y., Wang, J., and Jordan, M.  Learning transferable features with deep adaptation networks.  In _International Conference on Machine Learning_ , pp. 97–105, 2015.
  * Ma et al. (2018) Ma, X., Li, B., Wang, Y., Erfani, S. M., Wijewickrema, S., Schoenebeck, G., Song, D., Houle, M. E., and Bailey, J.  Characterizing adversarial subspaces using local intrinsic dimensionality.  _arXiv preprint arXiv:1801.02613_ , 2018.
  * Madry et al. (2017) Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ , 2017.
  * Miyato et al. (2018) Miyato, T., Maeda, S.-i., Koyama, M., and Ishii, S.  Virtual adversarial training: a regularization method for supervised and semi-supervised learning.  _IEEE transactions on pattern analysis and machine intelligence_ , 41(8):1979–1993, 2018.
  * Naseer et al. (2019) Naseer, M. M., Khan, S. H., Khan, M. H., Khan, F. S., and Porikli, F.  Cross-domain transferability of adversarial perturbations.  In _Advances in Neural Information Processing Systems_ , pp. 12885–12895, 2019.
  * Papernot et al. (2016) Papernot, N., McDaniel, P., and Goodfellow, I.  Transferability in machine learning: from phenomena to black-box attacks using adversarial samples.  _arXiv preprint arXiv:1605.07277_ , 2016.
  * Russakovsky et al. (2015) Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al.  Imagenet large scale visual recognition challenge.  _International journal of computer vision_ , 115(3):211–252, 2015.
  * Salman et al. (2020) Salman, H., Ilyas, A., Engstrom, L., Kapoor, A., and Madry, A.  Do adversarially robust imagenet models transfer better?  _arXiv preprint arXiv:2007.08489_ , 2020.
  * Shinya et al. (2019) Shinya, Y., Simo-Serra, E., and Suzuki, T.  Understanding the effects of pre-training for object detectors via eigenspectrum.  In _Proceedings of the IEEE International Conference on Computer Vision Workshops_ , pp. 0–0, 2019.
  * Tramèr et al. (2017a) Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., and McDaniel, P.  Ensemble adversarial training: Attacks and defenses.  _arXiv preprint arXiv:1705.07204_ , 2017a.
  * Tramèr et al. (2017b) Tramèr, F., Papernot, N., Goodfellow, I., Boneh, D., and McDaniel, P.  The space of transferable adversarial examples.  _arXiv preprint arXiv:1704.03453_ , 2017b.
  * Utrera et al. (2020) Utrera, F., Kravitz, E., Erichson, N. B., Khanna, R., and Mahoney, M. W.  Adversarially-trained deep nets transfer better.  _arXiv preprint arXiv:2007.05869_ , 2020.
  * Wang et al. (2019a) Wang, A., Singh, A., Michael, J., Hill, F., Levy, O., and Bowman, S. R.  GLUE: A multi-task benchmark and analysis platform for natural language understanding.  In _International Conference on Learning Representations_ , 2019a.  URL https://openreview.net/forum?id=rJ4km2R5t7.
  * Wang et al. (2020) Wang, B., Pei, H., Pan, B., Chen, Q., Wang, S., and Li, B.  T3: Tree-autoencoder constrained adversarial text generation for targeted attack.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , pp. 6134–6150, Online, November 2020\. Association for Computational Linguistics.  doi: 10.18653/v1/2020.emnlp-main.495.  URL https://www.aclweb.org/anthology/2020.emnlp-main.495.
  * Wang et al. (2019b) Wang, Z., Dai, Z., Póczos, B., and Carbonell, J.  Characterizing and avoiding negative transfer.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , pp. 11293–11302, 2019b.
  * Xie et al. (2019) Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., and Yuille, A. L.  Improving transferability of adversarial examples with input diversity.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , pp. 2730–2739, 2019.
  * Xu et al. (2019) Xu, R., Li, G., Yang, J., and Lin, L.  Larger norm more transferable: An adaptive feature norm approach for unsupervised domain adaptation.  In _Proceedings of the IEEE International Conference on Computer Vision_ , pp. 1426–1435, 2019.
  * Yosinski et al. (2014) Yosinski, J., Clune, J., Bengio, Y., and Lipson, H.  How transferable are features in deep neural networks?  In _Advances in neural information processing systems_ , pp. 3320–3328, 2014.
  * Zamir et al. (2018) Zamir, A. R., Sax, A., Shen, W., Guibas, L. J., Malik, J., and Savarese, S.  Taskonomy: Disentangling task transfer learning.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , pp. 3712–3722, 2018.
  * Zhang et al. (2015) Zhang, X., Zhao, J., and LeCun, Y.  Character-level convolutional networks for text classification.  _arXiv preprint arXiv:1509.01626_ , 2015.
  * Zhang et al. (2014) Zhang, Z., Luo, P., Loy, C. C., and Tang, X.  Facial landmark detection by deep multi-task learning.  In _European conference on computer vision_ , pp. 94–108. Springer, 2014.
  * Zhou et al. (2018) Zhou, W., Hou, X., Chen, Y., Tang, M., Huang, X., Gan, X., and Yang, Y.  Transferable adversarial perturbations.  In _Proceedings of the European Conference on Computer Vision (ECCV)_ , pp. 452–467, 2018.

Contents Summary

  * •

Section A: An Example Illustrating the Necessity of both
$\alpha_{1},\alpha_{2}$ in Characterizing the Relation Between Adversarial
Transferability and Knowledge Transferability.

  * •

Section B: Detailed discussion about the direction of adversarial transfer
from $f_{S}\to f_{T}$ in subsection 3.3.

  * •

Section C: Proofs of the propositions in section 2.

    * –

C.1: Proof of Proposition 2.1

    * –

C.2: Proof of Proposition 2.2

  * •

Section D: Proofs of the theorems and propositions in section 3.

    * –

D.1: Proof of Theorem 3.1

    * –

D.2: Proof of Proposition 3.1

    * –

D.3: Proof of Theorem 3.2

    * –

D.4: Proof of Theorem 3.3

    * –

D.5: Proof of Theorem B.1

  * •

Section E: Auxiliary lemmas.

  * •

Section F: Details and additional results of the synthetic experiments.

  * •

Section G: Details of model training and adversarial examples generations in
the experiments section, and ablation study on controlling the adversarial
transferability.

##  Appendix A An Example Illustrating the Necessity of both
$\alpha_{1},\alpha_{2}$ in Characterizing the Relation Between Adversarial
Transferability and Knowledge Transferability

$\alpha_{1}$ and $\alpha_{2}$ (Definition 1&2) represent complementary aspects
of the adversarial transferability: $\alpha_{1}$ can be understood as how
often the adversarial attack transfers, while $\alpha_{2}$ encodes directional
information of the output deviation caused by adversarial attacks. Recall that
$\alpha_{1},\alpha_{2}\in[0,1]$ (higher values indicate better adversarial
transferability). As we show in our theoretical results reveal that high
$\alpha_{1}$ alone is not enough, i.e., both the proposed metrics are
necessary to characterize adversarial transferability and the relation between
adversarial and knowledge transferabilities.

We provide a one-dimensional example showing that large $\alpha_{1}$ only is
not enough to indicate high knowledge transferability. Suppose the ground
truth target function $f_{T}(x)=x^{2}$, and the source function
$f_{S}(x)=\texttt{sgn}(x)\cdot x^{2}$ where $\texttt{sgn}(\cdot)$ denotes the
sign function. Let the adversarial loss be the deviation in function output,
and the data distribution be the uniform distribution on $[-1,1]$. As we can
see, the direction that makes either $f_{T}$ or $f_{S}$ deviates the most is
always the same, i.e., in this example even with $\alpha_{1}=1$ achieves its
maximum and adversarial attacks always transfer, regardless of the choice of
$f_{1}\to f_{2}$ or $f_{2}\to f_{1}$. However, there does not exist an affine
function $g$ (i.e., fine-tuning) making $g\circ f_{S}$ close to $f_{T}$ on
$[-1,1]$. Indeed, one can verify that $\alpha_{2}=0$ in this case (either
$f_{1}\to f_{2}$ or $f_{2}\to f_{1}$), which contributes to the low knowledge
transferability. However, if we move the data distribution to $[0,2]$, we can
have $\alpha_{1}=\alpha_{2}=1$ (either $f_{1}\to f_{2}$ or $f_{2}\to f_{1}$)
indicating high adversarial transferability, and indeed it achieves
$f_{S}=f_{T}$ showing perfect knowledge transferability.

##  Appendix B Detailed Discussion About the Direction of Adversarial Transfer
From $f_{S}\to f_{T}$ in Subsection 3.3

In this section, we present a detailed discussion, in addition to subsection
3.3, about the connection between function matching distance and knowledge
transfer distance when the direction of adversarial transfer is from $f_{S}\to
f_{T}$.

Recall that, to complete the story, it remains to connect the function
matching distance to knowledge transferability. As the adversarial transfer is
symmetric (_i.e._ , either from $f_{S}\to f_{T}$ or $f_{T}\to f_{S}$), we are
able to use the placeholders $\star,\diamond\in\\{S,T\\}$ all the way through.
However, as the knowledge transfer is asymmetric (_i.e._ , $f_{S}\to y$ to the
target ground truth), we need to instantiate the direction of adversarial
transfer to further our discussion. We have discussed the direction of
adversarial transfer from $f_{T}\to f_{S}$ in the main paper, where we show
that the function matching distance of this direction, _i.e._ ,

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|f_{T}-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}},$ (43)

can both upper and lower bound the knowledge transfer distance, _i.e._ ,

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|y-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}.$ (44)

The direction of adversarial transfer from $f_{S}\to f_{T}$ corresponds to
$(\star,\diamond)=(S,T)$. Accordingly, the function matching distance
(equation 34) becomes

$\displaystyle\min_{g\in{\mathbb{G}}}\ \|f_{S}-g\circ
f_{T}\|_{{\mathcal{D}},{\bm{H}}_{S}}.$ (46)

Since the affine transformation $g$ acts on the target reference model, it can
not be directly viewed as a surrogate transfer loss. However, interesting
interpretations can be found in this direction, depending on the output
dimension of $f_{S}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{m}$ and
$f_{T}:{\mathbb{R}}^{n}\to{\mathbb{R}}^{d}$.

In this subsection in the appendix we provide detailed discussion on the
connection between the function matching distance of the direction of
adversarial transfer from $f_{S}\to f_{T}$ (equation 46) and the knowledge
transfer distance (equation 44). We build this connection by providing the
relationships between the two directions of function matching distance, _i.e._
, equation 43 and equation 46. That is being said, since we know equation 44
and equation 43 are tied together, we only need to provide relationships
between equation 43 and equation 46 to show the connection between equation 46
and equation 44.

Suppose $g:{\mathbb{R}}^{d}\to{\mathbb{R}}^{m}$ is full rank, and loosely
speaking we can derive the following intuitions.

  * •

If $d<m$, then $g$ is injective and there exists
$g^{-1}:{\mathbb{R}}^{m}\to{\mathbb{R}}^{d}$ such that $g^{-1}\circ g$ is the
identity function. That is, if $g$ can map $f_{T}$ to closely track $f_{S}$,
then reversely $g^{-1}$ can map $f_{S}$ to $f_{T}$, showing equation 46 upper
bounds equation 43 in some sense.

  * •

If $d>m$, then $g$ is surjective. By symmetry, equation 43 upper bounds
equation 46 in some sense.

  * •

It is when $m=d$ that equation 43 and equation 46 coincide.

Formally, we have the following theorem.

######  Theorem B.1.

Denote $\tilde{g}_{T,S}:{\mathbb{R}}^{m}\to{\mathbb{R}}^{d}$ as the optimal
solution of equation 43, and
$\tilde{g}_{S,T}:{\mathbb{R}}^{d}\to{\mathbb{R}}^{m}$ as the optimal solution
of equation 46. Suppose the two optimal affine maps
$\tilde{g}_{T,S},\tilde{g}_{S,T}$ are both full-rank. For
${\bm{v}}\in{\mathbb{R}}^{m}$, denote the matrix representation of
$\tilde{g}_{T,S}$ as
$\tilde{g}_{T,S}({\bm{v}})=\tilde{{\bm{W}}}_{T,S}{\bm{v}}+\tilde{{\bm{b}}}_{T,S}$.
Similarly, for ${\bm{w}}\in{\mathbb{R}}^{d}$, denote the matrix representation
of $\tilde{g}_{S,T}$ as
$\tilde{g}_{S,T}({\bm{w}})=\tilde{{\bm{W}}}_{S,T}{\bm{w}}+\tilde{{\bm{b}}}_{S,T}$.
We have the following statements.

If $d<m$, then $\tilde{g}_{S,T}$ is injective, and we have:

$\displaystyle\|f_{T}-\tilde{g}_{T,S}\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}\leq\sqrt{\|(\tilde{{\bm{W}}}_{S,T}^{\top}\tilde{{\bm{W}}}_{S,T})^{-1}\|_{F}\cdot\|{\bm{H}}_{T}\|_{F}}\cdot\|f_{S}-\tilde{g}_{S,T}\circ
f_{T}\|_{{\mathcal{D}}}.$ (47)

If $d>m$, then $\tilde{g}_{T,S}$ is injective, and we have:

$\displaystyle\|f_{S}-\tilde{g}_{S,T}\circ
f_{T}\|_{{\mathcal{D}},{\bm{H}}_{S}}\leq\sqrt{\|(\tilde{{\bm{W}}}_{T,S}^{\top}\tilde{{\bm{W}}}_{T,S})^{-1}\|_{F}\cdot\|{\bm{H}}_{S}\|_{F}}\cdot\|f_{T}-\tilde{g}_{T,S}\circ
f_{S}\|_{{\mathcal{D}}}.$ (48)

If $d=m$, then both $\tilde{g}_{S,T}$ and $\tilde{g}_{T,S}$ are bijective, and
we have both (47) and (48) stand.

That is, when the direction of adversarial transfer is from $f_{S}\to f_{T}$,
the indicating relation between the function matching distance if this
direction (equation 46) and knowledge transferability would possibly be
unidirectional, depending on the dimensions.

##  Appendix C Proofs in Section 2

In this section, we present proofs for Proposition 2.1 and Proposition 2.2.

###  C.1 Proof of Proposition 2.1

######  Proposition C.1 (Proposition 2.1 Restated).

The $\alpha_{2}^{f_{1}\to f_{2}}$ can be reformulated as

$\displaystyle(\alpha_{2}^{f_{1}\to
f_{2}})^{2}=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\theta_{f_{1}\to
f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})\theta_{f_{1}\to
f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})\right],$ (49)

where ${\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}$,
and

$\displaystyle\theta_{f_{1}\to f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})$
$\displaystyle=\langle\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to f_{1}}({\bm{x}}_{2})}\rangle$
(50) $\displaystyle\theta_{f_{1}\to f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})$
$\displaystyle=\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to f_{2}}({\bm{x}}_{2})}\rangle$
(51)

###### Proof.

Recall that we want to show

$\displaystyle\big{\|}\mathbb{E}_{{\bm{x}}}[\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}})}^{\top}]\big{\|}_{F}^{2}=(\alpha_{2}^{f_{1}\to
f_{2}})^{2}=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\theta_{f_{1}\to
f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})\theta_{f_{1}\to
f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})\right],$ (52)

and the proof of this proposition is done by applying some trace tricks, as
shown below.

$\displaystyle\theta_{f_{1}\to
f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})\theta_{f_{1}\to
f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})$
$\displaystyle=\langle\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}\rangle\cdot\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to f_{2}}({\bm{x}}_{2})}\rangle$
(53) $\displaystyle=\langle\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})},\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})}\rangle\cdot\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to f_{2}}({\bm{x}}_{2})}\rangle$
(54) $\displaystyle=\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}^{\top}\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})}^{\top}\widehat{\Delta_{f_{1}\to f_{2}}({\bm{x}}_{2})}$
(55) $\displaystyle=\operatorname{tr}\left(\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}^{\top}\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})}^{\top}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\right)$ (56)
$\displaystyle=\operatorname{tr}\left(\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})}^{\top}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}^{\top}\right)$ (57)

Plugging equation 57 into equation 79, we have

$\displaystyle(\alpha_{2}^{f_{1}\to f_{2}})^{2}$
$\displaystyle=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\operatorname{tr}\left(\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})}^{\top}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}^{\top}\right)\right]$ (58)
$\displaystyle=\operatorname{tr}\left(\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})}^{\top}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}^{\top}\right]\right)$ (59)
$\displaystyle=\operatorname{tr}\left(\mathbb{E}_{{\bm{x}}_{1}}\left[\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})}^{\top}\right]\cdot\mathbb{E}_{{\bm{x}}_{2}}\left[\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}^{\top}\right]\right),$ (60)

where the last equality is because that ${\bm{x}}_{1},{\bm{x}}_{2}$ are
$i.i.d.$ samples from the same distribution.

Therefore, we can re-write the ${\bm{x}}_{1},{\bm{x}}_{2}$ to be the same
${\bm{x}}\sim{\mathcal{D}}$ and realize that the two matrices are in fact the
same one.

$\displaystyle(\ref{eq:prop-1-3})=$
$\displaystyle\operatorname{tr}\left(\mathbb{E}_{{\bm{x}}}\left[\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}})}^{\top}\right]\cdot\mathbb{E}_{{\bm{x}}}\left[\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}})}\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}^{\top}\right]\right)$ (61)
$\displaystyle=\big{\|}\mathbb{E}_{{\bm{x}}}[\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}})}^{\top}]\big{\|}_{F}^{2}.$ (62)

∎

###  C.2 Proof of Proposition 2.2

######  Proposition C.2 (Proposition 2.2 Restated).

The adversarial transferability metrics $\alpha_{1}^{f_{1}\to f_{2}}$,
$\alpha_{2}^{f_{1}\to f_{2}}$ and $(\alpha_{1}*\alpha_{2})^{f_{1}\to f_{2}}$
are in $[0,1]$.

###### Proof.

Let us begin with

$\displaystyle\alpha_{1}^{f_{1}\to
f_{2}}({\bm{x}})=\frac{\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{1},\epsilon}(\bm{x})))}{\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{2},\epsilon}({\bm{x}})))}.$
(63)

Recall that $\ell_{adv}(\cdot)\geq 0$, and the definition of adversarial
attack:

$\displaystyle\bm{\delta}_{f,\epsilon}(\bm{x})\ =\
\operatorname*{arg\,max}_{\|\bm{\delta}\|\leq\epsilon}\
\ell_{adv}(f({\bm{x}}),f({\bm{x}}+\bm{\delta})),$ (64)

and we can see that by definition,

$\displaystyle
0\leq\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{1},\epsilon}(\bm{x})))\leq\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{2},\epsilon}({\bm{x}}))).$
(65)

Therefore,

$\displaystyle
0\leq\frac{\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{1},\epsilon}(\bm{x})))}{\ell_{adv}(f_{2}({\bm{x}}),f_{2}({\bm{x}}+\bm{\delta}_{f_{2},\epsilon}({\bm{x}})))}\leq
1,$ (66)

where we define $0/0=0$ if necessary.

Hence, $\alpha_{1}^{f_{1}\to
f_{2}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}[\alpha_{1}^{f_{1}\to
f_{2}}({\bm{x}})]$ is also in $[0,1]$.

Next, we use Proposition 2.1 to prove the same property for
$\alpha_{2}^{f_{1}\to f_{2}}$. Note that

$\displaystyle(\alpha_{2}^{f_{1}\to
f_{2}})^{2}=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\langle\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}\rangle\cdot\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\rangle\right]$ (67)

is the expectation of the product of two inner products, where each inner
product is of two unit-length vector. That is being said,
$\langle\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}\rangle\in[-1,1]$ and $\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\rangle\in[-1,1]$. Therefore, we know that

$\displaystyle\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\langle\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{2})}\rangle\cdot\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{2})}\rangle\right]\in[-1,1].$ (68)

In addition, we know from equation 67 that it is non-negative, and hence

$\displaystyle(\alpha_{2}^{f_{1}\to f_{2}})^{2}\in[0,1].$ (69)

As $\alpha_{2}^{f_{1}\to f_{2}}$ itself is also non-negative by definition, we
can see that $\alpha_{2}^{f_{1}\to f_{2}}\in[0,1]$.

Finally, we move to prove $(\alpha_{1}*\alpha_{2})^{f_{1}\to f_{2}}\in[0,1]$.
Recall that

$\displaystyle(\alpha_{1}*\alpha_{2})^{f_{1}\to
f_{2}}=\big{\|}\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}[\alpha_{1}^{f_{1}\to
f_{2}}({\bm{x}})\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}})}^{\top}]\big{\|}_{F}.$ (70)

If we see $\alpha_{1}^{f_{1}\to f_{2}}({\bm{x}})\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}})}$ as a whole, we can show exactly the same as the Proposition
2.1 that

$\displaystyle((\alpha_{1}*\alpha_{2})^{f_{1}\to
f_{2}})^{2}=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\theta_{f_{1}\to
f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})\theta_{f_{1}\to
f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})\right],$ (71)

where

$\displaystyle\theta_{f_{1}\to f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})$
$\displaystyle=\langle\alpha_{1}^{f_{1}\to
f_{2}}({\bm{x}}_{1})\widehat{\Delta_{f_{1}\to
f_{1}}({\bm{x}}_{1})},\alpha_{1}^{f_{1}\to
f_{2}}({\bm{x}}_{2})\widehat{\Delta_{f_{1}\to f_{1}}({\bm{x}}_{2})}\rangle$
(72) $\displaystyle\theta_{f_{1}\to f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})$
$\displaystyle=\langle\widehat{\Delta_{f_{1}\to
f_{2}}({\bm{x}}_{1})},\widehat{\Delta_{f_{1}\to f_{2}}({\bm{x}}_{2})}\rangle.$
(73)

Similarly, as $\alpha_{1}^{f_{1}\to f_{2}}({\bm{x}})\in[0,1]$, we can see that
$\theta_{f_{1}\to f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})\theta_{f_{1}\to
f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})\in[-1,1]$, and hence

$\displaystyle\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}}\left[\theta_{f_{1}\to
f_{1}}({\bm{x}}_{1},{\bm{x}}_{2})\theta_{f_{1}\to
f_{2}}({\bm{x}}_{1},{\bm{x}}_{2})\right]\in[-1,1].$ (74)

Noting that equation 71 is non-negative, we conclude that

$\displaystyle((\alpha_{1}*\alpha_{2})^{f_{1}\to f_{2}})^{2}\in[0,1].$ (75)

Since $(\alpha_{1}*\alpha_{2})^{f_{1}\to f_{2}}$ itself is non-negative as
well, we can see that $(\alpha_{1}*\alpha_{2})^{f_{1}\to f_{2}}\in[0,1]$.

Therefore, the three adversarial transferability metrics are all within
$[0,1]$. ∎

##  Appendix D Proofs in Section 3

In this section, we prove the two theorems and the two propositions presented
in section 3, which are our main theories.

###  D.1 Proof of Theorem 3.1

We introduce two lemmas before proving Theorem 3.1.

######  Lemma D.1.

The square of the gradient matching distance is

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}=\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}-\langle{\bm{P}}^{\top}{\bm{H}}_{\star}{\bm{P}},{\bm{J}}^{\dagger}\rangle,$
(76)

where $g\in{\mathbb{G}}$ are affine transformations, and

$\displaystyle{\bm{P}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\star}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}})\right],\qquad{\bm{J}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})\right].$ (77)

###### Proof.

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle=\min_{{\bm{W}}}\quad\|\nabla f_{\star}^{\top}-{\bm{W}}\nabla
f_{\diamond}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$ (78)
$\displaystyle=\min_{{\bm{W}}}\quad\mathbb{E}_{{\bm{x}}\in{\mathcal{D}}}\|\nabla
f_{\star}({\bm{x}})^{\top}-{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}},$ (79)

where ${\bm{W}}$ is a matrix.

We can see that (79) is a convex program, where the optimal solution exists in
a closed-form form, as shown in the following. Denote $l({\bm{W}})=\|\nabla
f_{\star}({\bm{x}})^{\top}-{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}$, we have

$\displaystyle l({\bm{W}})$
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\|\nabla
f_{\star}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\|{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}-2\langle\nabla
f_{\star}({\bm{x}})^{\top},{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\rangle_{{\bm{H}}_{\star}}\right]$ (80)
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\|\nabla
f_{\star}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\operatorname{tr}\left(\nabla
f_{\diamond}({\bm{x}}){\bm{W}}^{\top}{\bm{H}}_{\star}{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\right)-2\operatorname{tr}\left(\nabla
f_{\star}({\bm{x}}){\bm{H}}_{\star}{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\right)\right]$ (81)
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\|\nabla
f_{\star}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\operatorname{tr}\left({\bm{H}}_{\star}{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}}){\bm{W}}^{\top}\right)-2\operatorname{tr}\left({\bm{H}}_{\star}{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla f_{\star}({\bm{x}})\right)\right].$ (82)

Taking the derivative of $l(\cdot)$ w.r.t. ${\bm{W}}$, we have

$\displaystyle\frac{\partial l}{\partial{\bm{W}}}$
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[2{\bm{H}}_{\star}\left({\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}-\nabla f_{\star}({\bm{x}})^{\top}\right)\nabla
f_{\diamond}({\bm{x}})\right]$ (83)
$\displaystyle=2{\bm{H}}_{\star}\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[{\bm{W}}\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})-\nabla
f_{\star}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})\right]$ (84)
$\displaystyle=2{\bm{H}}_{\star}\left({\bm{W}}\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}})\right]-\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\star}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})\right]\right).$ (85)

Since $l(\cdot)$ is convex, if there exists a $\tilde{{\bm{W}}}$ such that
$\frac{\partial
l}{\partial{\bm{W}}}\big{|}_{{\bm{W}}=\tilde{{\bm{W}}}}=\bm{0}$ then we know
that $\tilde{{\bm{W}}}$ is an optimal solution. Luckily, we can find such
solution easily by using pseudo inverse, _i.e._ ,

$\displaystyle\tilde{{\bm{W}}}$
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\star}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}})\right]\left(\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}})\right]\right)^{\dagger}$ (86)
$\displaystyle={\bm{P}}{\bm{J}}^{\dagger},$ (87)

where we denote ${\bm{P}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\star}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})\right]$ and
${\bm{J}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})\right]$.

We can verify that such $\tilde{{\bm{W}}}$ indeed make the partial derivative
(equation 85) zero. In equation 85, we have

$\displaystyle\tilde{{\bm{W}}}\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}})\right]-\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\star}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}})\right]={\bm{P}}{\bm{J}}^{\dagger}{\bm{J}}-{\bm{P}}.$
(88)

To continue, we can see from Lemma E.2 that
$\ker({\bm{J}})\subseteq\ker({\bm{P}})$ which means
$\operatorname{rowsp}({\bm{P}})\subseteq\operatorname{rowsp}({\bm{J}})$, where
$\ker(\cdot)$ denotes the kernel of a matrix, and
$\operatorname{rowsp}(\cdot)$ denotes the row space of a matrix. Therefore, by
definition of the pseudo-inverse, we can see that
${\bm{P}}{\bm{J}}^{\dagger}{\bm{J}}={\bm{P}}$, _i.e._ ,
$(\ref{eq:1-1-1-nn})=\bm{0}$, and hence $\tilde{{\bm{W}}}$ is indeed the
optimal solution.

Plugging (87) into (79), we have the optimal value as

$\displaystyle(\ref{eq:1-1-1})$ $\displaystyle=l(\tilde{{\bm{W}}})$ (89)
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\|\nabla
f_{\star}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\operatorname{tr}\left({\bm{H}}_{\star}\tilde{{\bm{W}}}\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\diamond}({\bm{x}})\tilde{{\bm{W}}}^{\top}\right)-2\operatorname{tr}\left({\bm{H}}_{\star}\tilde{{\bm{W}}}\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla f_{\star}({\bm{x}})\right)\right]$ (90)
$\displaystyle=\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}+\operatorname{tr}\left({\bm{H}}_{\star}\tilde{{\bm{W}}}{\bm{J}}\tilde{{\bm{W}}}^{\top}-2{\bm{H}}_{\star}\tilde{{\bm{W}}}{\bm{P}}^{\top}\right)$
(91) $\displaystyle=\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}+\operatorname{tr}\left({\bm{H}}_{\star}{\bm{P}}{\bm{J}}^{\dagger}{\bm{J}}{\bm{J}}^{\dagger}{\bm{P}}^{\top}-2{\bm{H}}_{\star}{\bm{P}}{\bm{J}}^{\dagger}{\bm{P}}^{\top}\right)$
(92) $\displaystyle=\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}-\operatorname{tr}\left({\bm{H}}_{\star}{\bm{P}}{\bm{J}}^{\dagger}{\bm{P}}^{\top}\right)$
(93) $\displaystyle=\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}-\langle{\bm{P}}^{\top}{\bm{H}}_{\star}{\bm{P}},{\bm{J}}^{\dagger}\rangle.$
(94)

∎

Next, we present another lemma to analyze the term
${\bm{P}}^{\top}{\bm{H}}_{\star}{\bm{P}}$.

######  Lemma D.2.

In this lemma, we break down the matrix representation of
${\bm{P}}^{\top}{\bm{H}}_{\star}{\bm{P}}$ into pieces relating to the output
deviation caused by the generalized adversarial attacks (defined in equation
25)

$\displaystyle{\bm{P}}^{\top}{\bm{H}}_{\star}{\bm{P}}=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\sum_{i,j=1}^{n}\left(\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\right)\cdot\left(\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})^{\top}\right).$ (95)

###### Proof.

Denote a symmetric decomposition of the positive semi-definitive matrix
${\bm{H}}_{\star}$ as

$\displaystyle{\bm{H}}_{\star}={\bm{T}}^{\top}{\bm{T}},$ (96)

where ${\bm{T}}$ is of the same dimension of ${\bm{H}}_{\star}$. We note that
the choice of decomposition does not matter.

Then, plugging in the definition of ${\bm{P}}$, we can see that

$\displaystyle{\bm{P}}^{\top}{\bm{H}}_{\star}{\bm{P}}$
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\star}({\bm{x}})\right]\cdot{\bm{T}}^{\top}{\bm{T}}\cdot\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\star}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})\right]$ (97)
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\star}({\bm{x}}){\bm{T}}^{\top}\right]\cdot\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[{\bm{T}}\nabla
f_{\star}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})\right].$ (98)

A key observation to connect the above equation to the adversarial attack
(equation 18) is that,

$\displaystyle\bm{\delta}_{f_{\star},\epsilon}({\bm{x}})\ $
$\displaystyle=\quad\operatorname*{arg\,max}_{\|\bm{\delta}\|_{2}\leq\epsilon}\
\|\nabla f_{\star}({\bm{x}})^{\top}\bm{\delta}\|_{{\bm{H}}_{\star}}$ (99)
$\displaystyle=\
\operatorname*{arg\,max}_{\|\bm{\delta}\|_{2}\leq\epsilon}\quad\|\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}\|_{{\bm{H}}_{\star}}^{2}$ (100)
$\displaystyle=\
\operatorname*{arg\,max}_{\|\bm{\delta}\|_{2}\leq\epsilon}\quad\bm{\delta}^{\top}\nabla
f_{\star}({\bm{x}}){\bm{H}}_{\star}\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}$ (101) $\displaystyle=\
\operatorname*{arg\,max}_{\|\bm{\delta}\|_{2}\leq\epsilon}\quad\|{\bm{T}}\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}\|_{2}^{2}.$ (102)

That is being said, the adversarial attack is the right singular vector
corresponding to the largest singular value (in absolute value) of
${\bm{T}}\nabla f_{\star}({\bm{x}})^{\top}$.

Similarly, we can see the singular values
$\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})\in{\mathbb{R}}^{n}$,
defined as the descending (in absolute value) singular values of the Jacobian
$\nabla f_{\star}({\bm{x}})^{\top}\in{\mathbb{R}}^{\cdot\times n}$ in the
${\bm{H}}_{\star}$ inner product space (equation 23), are the singular values
of ${\bm{T}}\nabla f_{\star}({\bm{x}})^{\top}$.

With this perspective, if we write down the singular value decomposition of
${\bm{T}}\nabla f_{\star}({\bm{x}})^{\top}$, _i.e._ ,

$\displaystyle{\bm{T}}\nabla
f_{\star}({\bm{x}})^{\top}={\bm{U}}_{\star}({\bm{x}})\Sigma_{\star}({\bm{x}}){\bm{V}}_{\star}^{\top}({\bm{x}}),$
(103)

we can observe that:

  1. 1.

$\Sigma_{\star}({\bm{x}})$ is diagonalized singular values
$\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})$;

  2. 2.

The $i^{th}$ column of ${\bm{V}}_{\star}({\bm{x}})$ is the $i^{th}$
generalized attack $\bm{\delta}_{f_{\star}}^{(i)}({\bm{x}})$ (defined in
equation 24);

  3. 3.

The $i^{th}$ column of ${\bm{U}}_{\star}({\bm{x}})\Sigma({\bm{x}})$ is
${\bm{T}}\Delta^{(i)}_{f_{\star}\to f_{\star}}({\bm{x}})$ where
$\Delta^{(i)}_{f_{\star}\to f_{\star}}({\bm{x}})$ is the output deviation
(defined in equation 25);

  4. 4.

The $i^{th}$ column of $\nabla
f_{\diamond}({\bm{x}})^{\top}{\bm{V}}_{\star}({\bm{x}})$ is the output
deviation $\Delta^{(i)}_{f_{\star}\to f_{\diamond}}({\bm{x}})$ (defined in
equation 25).

With the four key observations, we can break down the Jacobian matrices as

$\displaystyle\nabla f_{\diamond}({\bm{x}})^{\top}\nabla
f_{\star}({\bm{x}}){\bm{T}}^{\top}$
$\displaystyle=\begin{pmatrix}\Delta^{(1)}_{f_{\star}\to
f_{\diamond}}({\bm{x}})\dots\Delta^{(n)}_{f_{\star}\to
f_{\diamond}}({\bm{x}})\end{pmatrix}\begin{pmatrix}\Delta^{(1)}_{f_{\star}\to
f_{\star}}({\bm{x}})^{\top}{\bm{T}}^{\top}\\\ \vdots\\\
\Delta^{(n)}_{f_{\star}\to
f_{\star}}({\bm{x}})^{\top}{\bm{T}}^{\top}\end{pmatrix}$ (104)
$\displaystyle=\sum_{i=1}^{n}\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}})\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}})^{\top}{\bm{T}}^{\top}.$ (105)

Therefore, plugging it into the equation 98, we have

$\displaystyle(\ref{eq:1-2-1})$
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\sum_{i=1}^{n}\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}})\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}})^{\top}{\bm{T}}^{\top}\right]\cdot\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left[\sum_{i=1}^{n}{\bm{T}}\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}})\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}})^{\top}\right]$ (106)
$\displaystyle=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\left[\sum_{i=1}^{n}\left(\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{T}}^{\top}\right)\sum_{j=1}^{n}\left({\bm{T}}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})^{\top}\right)\right]$ (107)
$\displaystyle=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\sum_{i,j=1}^{n}\left(\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})^{\top}\right)$ (108)
$\displaystyle=\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\sum_{i,j=1}^{n}\left(\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\right)\cdot\left(\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})^{\top}\right),$ (109)

where the last equality is due to that $\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})$ is a scalar value.

∎

Equipped with Lemma D.1 and Lemma D.2, we are able to prove the Theorem 3.1.

######  Theorem D.1 (Theorem 3.1 Restated).

Given the target and source models $f_{\star},f_{\diamond}$, where
$(\star,\diamond)\in\\{(S,T),(T,S)\\}$, the gradient matching distance
(equation 22) can be written as

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}=\left(1-\frac{\mathbb{E}[{\bm{v}}^{\star,\diamond}({\bm{x}}_{1})^{\top}{\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}}){\bm{v}}^{\star,\diamond}({\bm{x}}_{2})]}{\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}^{2}\cdot\|{\bm{J}}^{\dagger}\|^{-1}_{{\bm{H}}_{\diamond}}}\right)^{\frac{1}{2}}\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}},$ (110)

where the expectation is taken over
${\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}$, and

$\displaystyle{\bm{v}}^{\star,\diamond}({\bm{x}})$
$\displaystyle=\sigma^{(1)}_{f_{\diamond},{\bm{H}}_{\diamond}}({\bm{x}})\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})\odot{\bm{A}}_{1}^{\star,\diamond}({\bm{x}})$
(111) $\displaystyle{\bm{J}}$
$\displaystyle=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}[\nabla
f_{\diamond}({\bm{x}})^{\top}\nabla f_{\diamond}({\bm{x}})].$ (112)

Moreover, ${\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}})$ is a
matrix, and its element in the $i^{th}$ row and $j^{th}$ column is

$\displaystyle{\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}})^{(i,j)}=\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\star}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\star}}\rangle\cdot\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\diamond}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\diamond}}\rangle_{\widehat{{\bm{J}}^{\dagger}}|_{{\bm{H}}_{\diamond}}}.$
(113)

###### Proof.

Combining the result from Lemma D.1 and Lemma D.2, and applying the linearity
of the inner product, we have

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$ (114)
$\displaystyle=$ $\displaystyle\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}-\bigg{\langle}\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\sum_{i,j=1}^{n}\left(\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\right)\cdot\left(\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})^{\top}\right),{\bm{J}}^{\dagger}\bigg{\rangle}$
(115) $\displaystyle=$ $\displaystyle\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}-\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\sum_{i,j=1}^{n}\left(\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\right)\cdot\bigg{\langle}\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})^{\top},{\bm{J}}^{\dagger}\bigg{\rangle}$ (116)
$\displaystyle=$ $\displaystyle\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}-\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\sum_{i,j=1}^{n}\left(\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\right)\cdot\operatorname{tr}\left(\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})^{\top}{\bm{J}}^{\dagger}\right)$ (117)
$\displaystyle=$ $\displaystyle\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}-\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\sum_{i,j=1}^{n}\underbrace{\left(\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})^{\top}{\bm{H}}_{\star}\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})\right)}_{X_{1}}\cdot\underbrace{\left(\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})^{\top}{\bm{J}}^{\dagger}\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})\right)}_{X_{2}}.$ (118)

As the generalized first adversarial transferability ${\bm{A}}_{1}$ is about
the magnitude of the output deviation (defined in equation 26), and we can
separate the ${\bm{A}}_{1}$ out from the above equation. Then, what left
should be about the directions about the output deviation, which we will put
into the matrix ${\bm{A}}_{2}$, _i.e._ , the generalized second adversarial
transferability.

Recall that the generalized the first adversarial transferability is a
$n$-dimensional vector ${\bm{A}}_{1}^{\star,\diamond}({\bm{x}})$ including the
adversarial losses of all of the generalized adversarial attacks, where the
$i^{th}$ element in the vector is

$\displaystyle{\bm{A}}_{1}^{\star,\diamond}({\bm{x}})^{(i)}=\frac{\|\Delta_{f_{\star}\to
f_{\diamond}}^{(i)}({\bm{x}})\|_{{\bm{H}}_{\diamond}}}{\|\nabla
f_{\diamond}({\bm{x}})\|_{{\bm{H}}_{\diamond}}}.$ (119)

Moreover, to connect the magnitude of the output deviation to the generalized
singular values (equation 24), we have

$\displaystyle\|\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}})\|_{{\bm{H}}_{\star}}$ $\displaystyle=\|\nabla
f_{\star}({\bm{x}})^{\top}\bm{\delta}^{(i)}_{f_{\star}}({\bm{x}})\|_{{\bm{H}}_{*}}={\sigma}_{f_{\star},{\bm{H}}_{\star}}^{(i)}({\bm{x}}),$
(120)

and similarly,

$\displaystyle\|\nabla f_{\diamond}({\bm{x}})\|_{{\bm{H}}_{\diamond}}=\|\nabla
f_{\diamond}({\bm{x}})\bm{\delta}^{(1)}_{f_{\diamond}}({\bm{x}})\|_{{\bm{H}}_{\diamond}}={\sigma}_{f_{\diamond},{\bm{H}}_{\diamond}}^{(1)}({\bm{x}}).$
(121)

Therefore, we can finally rewrite the $X_{1},X_{2}$ in equation 118 as

$\displaystyle X_{1}$
$\displaystyle={\sigma}_{f_{\star},{\bm{H}}_{\star}}^{(i)}({\bm{x}}_{1}){\sigma}_{f_{\star},{\bm{H}}_{\star}}^{(j)}({\bm{x}}_{2})\cdot\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\star}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\star}}\rangle$ (122)
$\displaystyle X_{2}$
$\displaystyle={\bm{A}}_{1}^{\star,\diamond}({\bm{x}}_{1})^{(i)}{\bm{A}}_{1}^{\star,\diamond}({\bm{x}}_{2})^{(j)}\cdot\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\diamond}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\diamond}}\rangle_{\widehat{{\bm{J}}^{\dagger}}|_{{\bm{H}}_{\diamond}}}\cdot{\sigma}_{f_{\diamond},{\bm{H}}_{\diamond}}^{(1)}({\bm{x}}_{1}){\sigma}_{f_{\diamond},{\bm{H}}_{\diamond}}^{(1)}({\bm{x}}_{2})\|{\bm{J}}^{\dagger}\|_{{\bm{H}}_{\diamond}}.$
(123)

Recall the $(i,j)^{th}$ entry of the matrix ${\bm{A}}_{2}$ is

$\displaystyle{\bm{A}}_{2}^{\star,\diamond}({\bm{x}}_{1},{\bm{x}}_{2})^{(i,j)}=\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\star}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\star}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\star}}\rangle\cdot\langle\widehat{\Delta^{(i)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{1})}\big{|}_{{\bm{H}}_{\diamond}},\widehat{\Delta^{(j)}_{f_{\star}\to
f_{\diamond}}({\bm{x}}_{2})}\big{|}_{{\bm{H}}_{\diamond}}\rangle_{\widehat{{\bm{J}}^{\dagger}}|_{{\bm{H}}_{\diamond}}}.$
(124)

We can write

$\displaystyle
X_{1}X_{2}={\sigma}^{(1)}_{f_{\diamond},{\bm{H}}_{\diamond}}({\bm{x}}_{1}){\sigma}_{f_{\star},{\bm{H}}_{\star}}^{(i)}({\bm{x}}_{1}){\bm{A}}_{1}^{\star,\diamond}({\bm{x}}_{1})^{(i)}\cdot{\bm{A}}_{2}^{\star,\diamond}({\bm{x}}_{1},{\bm{x}}_{2})^{(i,j)}\cdot{\sigma}^{(1)}_{f_{\diamond},{\bm{H}}_{\diamond}}({\bm{x}}_{2}){\sigma}_{f_{\star},{\bm{H}}_{\star}}^{(j)}({\bm{x}}_{2}){\bm{A}}_{1}^{\star,\diamond}({\bm{x}}_{2})^{(j)}\|{\bm{J}}^{\dagger}\|_{{\bm{H}}_{\diamond}}.$
(125)

Plugging the above into equation 118, and rearranging the double summation, we
have

$\displaystyle(\ref{eq:1-3-1})=\|\nabla
f_{\star}^{\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$ (126)
$\displaystyle-\mathbb{E}_{{\bm{x}}_{1},{\bm{x}}_{2}\overset{\text{i.i.d.}}{\sim}{\mathcal{D}}}\left[(\sigma^{(1)}_{f_{\diamond},{\bm{H}}_{\diamond}}({\bm{x}}_{1})\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}}_{1})\odot{\bm{A}}_{1}^{\star,\diamond}({\bm{x}}_{1}))^{\top}{\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}})(\sigma^{(1)}_{f_{\diamond},{\bm{H}}_{\diamond}}({\bm{x}}_{2})\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}}_{2})\odot{\bm{A}}_{1}^{\star,\diamond}({\bm{x}}_{2}))\right]\|{\bm{J}}^{\dagger}\|_{{\bm{H}}_{\diamond}}.$
(127)

Denoting

$\displaystyle{\bm{v}}^{\star,\diamond}({\bm{x}})$
$\displaystyle=\sigma^{(1)}_{f_{\diamond},{\bm{H}}_{\diamond}}({\bm{x}})\bm{\sigma}_{f_{\star},{\bm{H}}_{\star}}({\bm{x}})\odot{\bm{A}}_{1}^{\star,\diamond}({\bm{x}}),$
(128)

and rearranging equation 127 give us the Theorem 3.1.

∎

###  D.2 Proof of Proposition 3.1

From the proof of Theorem 3.1 in the above subsection, we can see why this
proposition holds.

######  Proposition D.1 (Proposition 3.1 Restated).

In Theorem 3.1,

$\displaystyle
0\leq\frac{\mathbb{E}[{\bm{v}}^{\star,\diamond}({\bm{x}}_{1})^{\top}{\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}}){\bm{v}}^{\star,\diamond}({\bm{x}}_{2})]}{\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}^{2}\cdot\|{\bm{J}}^{\dagger}\|^{-1}_{{\bm{H}}_{\diamond}}}\leq
1.$ (129)

###### Proof.

Recall Theorem 3.1 states

$\displaystyle\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}=\left(1-\frac{\mathbb{E}[{\bm{v}}^{\star,\diamond}({\bm{x}}_{1})^{\top}{\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}}){\bm{v}}^{\star,\diamond}({\bm{x}}_{2})]}{\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}^{2}\cdot\|{\bm{J}}^{\dagger}\|^{-1}_{{\bm{H}}_{\diamond}}}\right)^{\frac{1}{2}}\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}.$ (130)

We can see that the $\leq 1$ part stands, since
$\min_{g\in{\mathbb{G}}}\quad\|\nabla f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}$ is always non-
negative.

The $\geq 0$ part can be proved by observing

$\displaystyle\left(1-\frac{\mathbb{E}[{\bm{v}}^{\star,\diamond}({\bm{x}}_{1})^{\top}{\bm{A}}_{2}^{\star,\diamond}({{\bm{x}}_{1},{\bm{x}}_{2}}){\bm{v}}^{\star,\diamond}({\bm{x}}_{2})]}{\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}^{2}\cdot\|{\bm{J}}^{\dagger}\|^{-1}_{{\bm{H}}_{\diamond}}}\right)^{\frac{1}{2}}\|\nabla
f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle=\min_{g\in{\mathbb{G}}}\quad\|\nabla
f_{\star}^{\top}-\nabla(g\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}$ (131)
$\displaystyle\leq\|\nabla f_{\star}^{\top}-\nabla(0\circ
f_{\diamond})^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle=\|\nabla f_{\star}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}$
(132)

∎

###  D.3 Proof of Theorem 3.2

We introduce two lemmas before proving Theorem 3.2.

######  Lemma D.3.

Assume that function $h(\cdot)$ satisfies the $\beta$-smoothness under
$\|\cdot\|_{{\bm{H}}_{\star}}$ norm (Assumption 1), and assume there is a
vector ${\bm{x}}_{0}$ in the same space as ${\bm{x}}\sim{\mathcal{D}}$ such
that $h({\bm{x}}_{0})=0$. Given $\tau>0$, there exists ${\bm{x}}^{\prime}$ as
a function of ${\bm{x}}$ such that
$\|{\bm{x}}-{\bm{x}}^{\prime}\|_{2}\leq\tau$, and

$\displaystyle\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}\leq 2\left(\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\beta^{2}\left(\|{\bm{x}}-{\bm{x}}_{0}\|_{2}-\tau\right)^{2}_{+}\right)\cdot\|{\bm{x}}-{\bm{x}}_{0}\|^{2}_{2},$
(133)

where the $(\cdot)_{+}$ is an operator defined by $\forall x\in{\mathbb{R}}$:
$(x)_{+}=x$ if $x\geq 0$ and $(x)_{+}=0$ otherwise.

###### Proof.

To begin with, we note that the assumption of $h({\bm{x}}_{0})=0$ is only used
for this lemma, and the assumption will be naturally guaranteed when we invoke
this lemma in the proof of Theorem 3.2.

With the smoothness assumption, we know that $h(\cdot)$ has continuous
gradient. Thus, we have

$\displaystyle\|h({\bm{x}})\|_{{\bm{H}}_{\star}}$
$\displaystyle=\|h({\bm{x}})-h({\bm{x}}_{0})\|_{{\bm{H}}_{\star}}=\|\nabla
h({\bm{x}}_{0}+\xi({\bm{x}}-{\bm{x}}_{0}))^{\top}({\bm{x}}-{\bm{x}}_{0})\|_{{\bm{H}}_{\star}},$
(134)

where the last equation is by mean value theorem and thus $\xi\in(0,1)$.

Then, noting that $\|\cdot\|_{{\bm{H}}_{\star}}$ and $\|\cdot\|_{2}$ are
compatible (Lemma E.1), we have

$\displaystyle\|\nabla h({\bm{x}}_{0}+$
$\displaystyle\xi({\bm{x}}-{\bm{x}}_{0}))^{\top}({\bm{x}}-{\bm{x}}_{0})\|_{{\bm{H}}_{\star}}\leq\|\nabla
h({\bm{x}}_{0}+\xi({\bm{x}}-{\bm{x}}_{0}))^{\top}\|_{{\bm{H}}_{\star}}\cdot\|({\bm{x}}-{\bm{x}}_{0})\|_{2}.$
(135)

Now we discuss two cases to define a random variable ${\bm{x}}^{\prime}$ as a
function of ${\bm{x}}$.

If $(1-\xi)\|{\bm{x}}-{\bm{x}}_{0}\|_{2}\leq\tau$, we define
${\bm{x}}^{\prime}$ as

$\displaystyle{\bm{x}}^{\prime}={\bm{x}}_{0}+\xi({\bm{x}}-{\bm{x}}_{0}),$
(136)

and we can see that $\|{\bm{x}}^{\prime}-{\bm{x}}\|_{2}\leq\tau$.

Otherwise, _i.e._ , $(1-\xi)\|{\bm{x}}-{\bm{x}}_{0}\|_{2}>\tau$, we apply
triangle inequality to derive

$\displaystyle\|\nabla h({\bm{x}}_{0}+$
$\displaystyle\xi({\bm{x}}-{\bm{x}}_{0}))^{\top}({\bm{x}}-{\bm{x}}_{0})\|_{{\bm{H}}_{\star}}$
(137) $\displaystyle=\|\nabla
h({\bm{x}}_{0}+\xi({\bm{x}}-{\bm{x}}_{0}))^{\top}-\nabla
h({\bm{x}}-\tau\widehat{({\bm{x}}-{\bm{x}}_{0})})^{\top}+\nabla
h({\bm{x}}-\tau\widehat{({\bm{x}}-{\bm{x}}_{0})})^{\top}\|_{{\bm{H}}_{\star}}$
(138) $\displaystyle\leq\underbrace{\|\nabla
h({\bm{x}}_{0}+\xi({\bm{x}}-{\bm{x}}_{0}))^{\top}-\nabla
h({\bm{x}}-\tau\widehat{({\bm{x}}-{\bm{x}}_{0})})^{\top}\|_{{\bm{H}}_{\star}}}_{X}+\|\nabla
h({\bm{x}}-\tau\widehat{({\bm{x}}-{\bm{x}}_{0})})^{\top}\|_{{\bm{H}}_{\star}},$
(139)

where we define

$\displaystyle{\bm{x}}^{\prime}={\bm{x}}-\tau\widehat{({\bm{x}}-{\bm{x}}_{0})}.$
(140)

By definition, in this case $\|{\bm{x}}^{\prime}-{\bm{x}}\|_{2}\leq\tau$ as
well. We then treat $X$: it can be bounded using $\beta$-smoothness, _i.e._ ,

$\displaystyle X$
$\displaystyle\leq\beta\|{\bm{x}}_{0}+\xi({\bm{x}}-{\bm{x}}_{0})-{\bm{x}}+\tau\widehat{({\bm{x}}-{\bm{x}}_{0})})\|_{2}$
(141)
$\displaystyle=\beta\|\tau\widehat{({\bm{x}}-{\bm{x}}_{0})}-(1-\xi)({\bm{x}}-{\bm{x}}_{0}))\|_{2}$
(142)
$\displaystyle=\beta\big{|}\tau-(1-\xi)\cdot\|({\bm{x}}-{\bm{x}}_{0})\|_{2}\big{|}$
(143)
$\displaystyle=\beta\left((1-\xi)\cdot\|({\bm{x}}-{\bm{x}}_{0})\|_{2}-\tau\right),$
(144)

where the last step is because we are exactly considering the case of
$(1-\xi)\cdot\|({\bm{x}}-{\bm{x}}_{0})\|_{2}>\tau$.

Therefore, combining the two cases together, we can write

$\displaystyle\|\nabla
h({\bm{x}}_{0}+\xi({\bm{x}}-{\bm{x}}_{0}))^{\top}\|_{{\bm{H}}_{\star}}\leq\beta\left((1-\xi)\cdot\|({\bm{x}}-{\bm{x}}_{0})\|_{2}-\tau\right)_{+}+\|\nabla
h({\bm{x}}^{\prime})^{\top}\|_{{\bm{H}}_{\star}},$ (145)

where $\|{\bm{x}}-{\bm{x}}^{\prime}\|\leq\tau$.

Combining the above, we have

$\displaystyle\|h({\bm{x}})\|_{{\bm{H}}_{\star}}\leq\left(\|\nabla
h({\bm{x}}^{\prime})^{\top}\|_{{\bm{H}}_{\star}}+\beta\left(\|{\bm{x}}-{\bm{x}}_{0}\|_{2}-\tau\right)_{+}\right)\cdot\|{\bm{x}}-{\bm{x}}_{0}\|_{2}.$
(146)

Take the square on both sides, and apply the Cauchy-Schwarz inequality, we
have the lemma proved.

$\displaystyle\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}$
$\displaystyle\leq\left(\|\nabla
h({\bm{x}}^{\prime})^{\top}\|_{{\bm{H}}_{\star}}+\beta\left(\|{\bm{x}}-{\bm{x}}_{0}\|_{2}-\tau\right)_{+}\right)^{2}\cdot\|{\bm{x}}-{\bm{x}}_{0}\|^{2}_{2}$
(147) $\displaystyle\leq 2\left(\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\beta^{2}\left(\|{\bm{x}}-{\bm{x}}_{0}\|_{2}-\tau\right)^{2}_{+}\right)\cdot\|{\bm{x}}-{\bm{x}}_{0}\|^{2}_{2}.$
(148)

∎

######  Lemma D.4.

Assume that function $h(\cdot)$ satisfies the $\beta$-smoothness under
$\|\cdot\|_{{\bm{H}}_{\star}}$ norm (Assumption 1). Given $\tau>0$, there
exists ${\bm{x}}^{\prime}_{i}$ as a function of ${\bm{x}}$ for $\forall
i\in[n]$ such that $\|{\bm{x}}-{\bm{x}}_{i}^{\prime}\|_{2}\leq\tau$, and

$\displaystyle\tau^{2}\cdot\|\nabla
h({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}\leq
3\left(\sum_{i=1}^{n}\|h({\bm{x}}^{\prime}_{i})\|^{2}_{{\bm{H}}_{\star}}+n\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}+n\tau^{4}\beta^{2}\right).$
(149)

###### Proof.

Denote the dimension of ${\bm{x}}$ as $n$, and let ${\bm{U}}$ be an orthogonal
matrix in ${\mathbb{R}}^{n\times n}$, where we denote its column vectors as
${\bm{u}}_{i}\in{\mathbb{R}}^{n}$ for $i\in[n]$. Applying the mean value
theorem, there exists $\xi_{i}\in(0,1)$ such that

$\displaystyle h({\bm{x}}+\tau{\bm{u}}_{i})-h({\bm{x}})$ $\displaystyle=\nabla
h({\bm{x}}+\tau\xi_{i}{\bm{u}}_{i})^{\top}\tau{\bm{u}}_{i}$ (150)
$\displaystyle=\tau\left(\nabla h({\bm{x}})^{\top}{\bm{u}}_{i}+(\nabla
h({\bm{x}}+\tau\xi_{i}{\bm{u}}_{i})^{\top}-\nabla
h({\bm{x}})^{\top}){\bm{u}}_{i}\right).$ (151)

Rearranging the equality, we have

$\displaystyle\nabla
h({\bm{x}})^{\top}{\bm{u}}_{i}=\frac{1}{\tau}\bm{\gamma}_{i},$ (152)

where we denote

$\displaystyle\bm{\gamma}_{i}=h({\bm{x}}+\tau{\bm{u}}_{i})-h({\bm{x}})-\tau(\nabla
h({\bm{x}}+\tau\xi_{i}{\bm{u}}_{i})^{\top}-\nabla
h({\bm{x}})^{\top}){\bm{u}}_{i}.$ (153)

Collecting each $\bm{\gamma}_{i}$ for $i\in[n]$ into a matrix
$\mathbf{\Gamma}=[\bm{\gamma}_{1}...\bm{\gamma}_{n}]$, we can re-formulate the
above equality as

$\displaystyle\tau\nabla h({\bm{x}})^{\top}{\bm{U}}$
$\displaystyle=\mathbf{\Gamma}$ (154) $\displaystyle\tau\nabla
h({\bm{x}})^{\top}$ $\displaystyle=\mathbf{\Gamma}{\bm{U}}^{\top},$ (155)

where the last equality is because that ${\bm{U}}$ is orthogonal.

Taking the $\|\cdot\|^{2}_{{\bm{H}}_{\star}}$ on both sides, with some linear
algebra manipulation we can derive

$\displaystyle\tau^{2}\cdot\|\nabla
h({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}$
$\displaystyle=\|\mathbf{\Gamma}{\bm{U}}^{\top}\|^{2}_{{\bm{H}}_{\star}}$
(156)
$\displaystyle=\operatorname{tr}({\bm{U}}\mathbf{\Gamma}^{\top}{\bm{H}}_{\star}\mathbf{\Gamma}{\bm{U}}^{\top})=\operatorname{tr}(\mathbf{\Gamma}^{\top}{\bm{H}}_{\star}\mathbf{\Gamma})=\operatorname{tr}({\bm{H}}_{\star}\mathbf{\Gamma}\mathbf{\Gamma}^{\top})$
(157)
$\displaystyle=\operatorname{tr}({\bm{H}}_{\star}\sum_{i=1}^{n}\bm{\gamma}_{i}\bm{\gamma}_{i}^{\top})=\sum_{i=1}^{n}\operatorname{tr}({\bm{H}}_{\star}\bm{\gamma}_{i}\bm{\gamma}_{i}^{\top})=\sum_{i=1}^{n}\operatorname{tr}(\bm{\gamma}_{i}^{\top}{\bm{H}}_{\star}\bm{\gamma}_{i})$
(158)
$\displaystyle=\sum_{i=1}^{n}\|\bm{\gamma}_{i}\|^{2}_{{\bm{H}}_{\star}}.$
(159)

Taking $\|\bm{\gamma}_{i}\|_{{\bm{H}}_{\star}}$ to work on further, we can
derive its upper bound as

$\displaystyle\|\bm{\gamma}_{i}\|_{{\bm{H}}_{\star}}$
$\displaystyle=\|h({\bm{x}}+\tau{\bm{u}}_{i})-h({\bm{x}})-\tau(\nabla
h({\bm{x}}+\tau\xi_{i}{\bm{u}}_{i})^{\top}-\nabla
h({\bm{x}})^{\top}){\bm{u}}_{i}\|_{{\bm{H}}_{\star}}$ (160)
$\displaystyle\leq\|h({\bm{x}}+\tau{\bm{u}}_{i})\|_{{\bm{H}}_{\star}}+\|h({\bm{x}})\|_{{\bm{H}}_{\star}}+\tau\|(\nabla
h({\bm{x}}+\tau\xi_{i}{\bm{u}}_{i})^{\top}-\nabla
h({\bm{x}})^{\top}){\bm{u}}_{i}\|_{{\bm{H}}_{\star}}$ (161)
$\displaystyle\leq\|h({\bm{x}}+\tau{\bm{u}}_{i})\|_{{\bm{H}}_{\star}}+\|h({\bm{x}})\|_{{\bm{H}}_{\star}}+\tau\|\nabla
h({\bm{x}}+\tau\xi_{i}{\bm{u}}_{i})^{\top}-\nabla
h({\bm{x}})^{\top}\|_{{\bm{H}}_{\star}}$ (162)
$\displaystyle\leq\|h({\bm{x}}+\tau{\bm{u}}_{i})\|_{{\bm{H}}_{\star}}+\|h({\bm{x}})\|_{{\bm{H}}_{\star}}+\tau^{2}\beta\xi_{i}$
(163)
$\displaystyle\leq\|h({\bm{x}}+\tau{\bm{u}}_{i})\|_{{\bm{H}}_{\star}}+\|h({\bm{x}})\|_{{\bm{H}}_{\star}}+\tau^{2}\beta,$
(164)

where the first inequality is by triangle inequality, the second inequality is
by Lemma E.1 and the fact that $\|{\bm{u}}_{i}\|_{2}=1$, the third inequality
is done by applying the $\beta$-smoothness assumption, and the last inequality
is by the fact that $\xi_{i}\in(0,1)$ from the mean value theorem.

Plugging the equation 164 into equation 159, we have

$\displaystyle\tau^{2}\cdot\|\nabla
h({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}\leq\sum_{i=1}^{n}\left(\|h({\bm{x}}+\tau{\bm{u}}_{i})\|_{{\bm{H}}_{\star}}+\|h({\bm{x}})\|_{{\bm{H}}_{\star}}+\tau^{2}\beta\right)^{2}$
(165)
$\displaystyle\leq\sum_{i=1}^{n}3\left(\|h({\bm{x}}+\tau{\bm{u}}_{i})\|^{2}_{{\bm{H}}_{\star}}+\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}+\tau^{4}\beta^{2}\right)$
(166)
$\displaystyle=3\sum_{i=1}^{n}\|h({\bm{x}}+\tau{\bm{u}}_{i})\|^{2}_{{\bm{H}}_{\star}}+3n\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}+3n\tau^{4}\beta^{2},$
(167)

where the inequality is done Cauchy-Schwarz inequality.

Denoting ${\bm{x}}_{i}^{\prime}={\bm{x}}+\tau{\bm{u}}_{i}$, we have the lemma
proved.

∎

######  Theorem D.2 (Theorem 3.2 Restated).

Given a data distribution ${\mathcal{D}}$ and $\tau>0$, there exist
distributions ${\mathcal{D}}_{1},{\mathcal{D}}_{2}$ such that the type-1
Wasserstein distance $W_{1}({\mathcal{D}},{\mathcal{D}}_{1})\leq\tau$ and
$W_{1}({\mathcal{D}},{\mathcal{D}}_{2})\leq\tau$ satisfying

$\displaystyle{\tfrac{1}{2B^{2}}}\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle\leq\|\nabla
h_{\star,\diamond}^{\prime\top}\|^{2}_{{\mathcal{D}}_{1},{\bm{H}}_{\star}}+\beta^{2}(B-\tau)_{+}^{2}$
(168) $\displaystyle\tfrac{1}{3n}\|\nabla
h_{\star,\diamond}^{\prime\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle\leq\tfrac{2}{\tau^{2}}\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}}_{2},{\bm{H}}_{\star}}+\beta^{2}\tau^{2},$
(169)

where $n$ is the dimension of ${\bm{x}}\sim{\mathcal{D}}$, and
$B=\inf_{{\bm{x}}_{0}\in{\mathbb{R}}^{n}}\sup_{{\bm{x}}\in\text{supp}({\mathcal{D}})}\|{\bm{x}}-{\bm{x}}_{0}\|_{2}$
is the radius of the $\text{supp}({\mathcal{D}})$. The $(\cdot)_{+}$ is an
operator defined by $\forall x\in{\mathbb{R}}$: $(x)_{+}=x$ if $x\geq 0$ and
$(x)_{+}=0$ otherwise.

###### Proof.

Let us begin with recalling the definition of $h_{\star,\diamond}$ and
$h_{\star,\diamond}^{\prime}$.

The optimal affine transformation $g\in{\mathbb{G}}$ in the function matching
distance (34) is $\tilde{g}$, and one of the optimal $g\in{\mathbb{G}}$ in the
gradient matching distance is (35) $\tilde{g}^{\prime}$. Accordingly, we
denote

$\displaystyle h_{\star,\diamond}:=f_{\star}-\tilde{g}\circ
f_{\diamond}\quad\text{and}\quad
h_{\star,\diamond}^{\prime}:=f_{\star}-\tilde{g}^{\prime}\circ f_{\diamond},$
(170)

and we can see that the gradient matching distance and the function matching
distance can be written as

$\displaystyle(\ref{def:function-matching-
dist})=\|h_{\star,\diamond}\|_{{\mathcal{D}},{\bm{H}}_{\star}}\quad\text{and}\quad(\ref{def:gradient-
matching-dist-
new})=\|\nabla{h^{\prime}_{\star,\diamond}}^{\top}\|_{{\mathcal{D}},{\bm{H}}_{\star}}.$
(171)

The first inequality. Then, we can prove the first inequality using Lemma D.3.

Let ${\bm{x}}_{0}\in{\mathbb{R}}^{n}$ be a free variable, and then set
${\bm{b}}=h_{\star,\diamond}^{\prime}({\bm{x}}_{0})$. Noting that
$\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$ by definition is
the minimum of this function distance, we have

$\displaystyle\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}\leq\|h^{\prime}_{\star,\diamond}-{\bm{b}}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}.$
(172)

Denoting $h:=h^{\prime}_{\star,\diamond}-{\bm{b}}$, we can see
$h({\bm{x}}_{0})=0$. Therefore, $h$ can be used to invoke Lemma D.3. That is,
there exists ${\bm{x}}^{\prime}$ as a function of ${\bm{x}}$ such that
$\|{\bm{x}}-{\bm{x}}^{\prime}\|_{2}\leq\tau$, and

$\displaystyle\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}\leq 2\left(\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\beta^{2}\left(\|{\bm{x}}-{\bm{x}}_{0}\|_{2}-\tau\right)^{2}_{+}\right)\cdot\|{\bm{x}}-{\bm{x}}_{0}\|^{2}_{2},$
(173)

Taking the expectation of ${\bm{x}}\sim{\mathcal{D}}$ of the both sides, and
denote the induced distribution for ${\bm{x}}^{\prime}$ as
${\mathcal{D}}_{1}$, we have

$\displaystyle\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}\leq
2\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left(\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\beta^{2}\left(\|{\bm{x}}-{\bm{x}}_{0}\|_{2}-\tau\right)^{2}_{+}\right)\cdot\|{\bm{x}}-{\bm{x}}_{0}\|^{2}_{2}.$
(174)

Recall that ${\bm{x}}_{0}$ is a free variable, we can tighten the bound by

$\displaystyle\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}\leq\inf_{{\bm{x}}_{0}\in{\mathbb{R}}^{n}}2\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left(\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\beta^{2}\left(\|{\bm{x}}-{\bm{x}}_{0}\|_{2}-\tau\right)^{2}_{+}\right)\cdot\|{\bm{x}}-{\bm{x}}_{0}\|^{2}_{2}.$
(175)

Note that we can have tighter but similar results if we keep the
$\inf{{\bm{x}}_{0}\in{\mathbb{R}}^{n}}$. However, by plugging in the radius

$B=\inf_{{\bm{x}}_{0}\in{\mathbb{R}}^{n}}\sup_{{\bm{x}}\in\text{supp}({\mathcal{D}})}\|{\bm{x}}-{\bm{x}}_{0}\|_{2}$

we can make the presentation much more simplified without losing its core
messages.

That is,

$\displaystyle(\ref{eq:2-3-2})\leq
2\left(\mathbb{E}_{{\bm{x}}^{\prime}\sim{\mathcal{D}}_{1}}\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\beta^{2}\left(B-\tau\right)^{2}_{+}\right)B^{2}.$
(176)

Combining the above inequality and equation 172, and noting that

$\displaystyle\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}$
$\displaystyle=\|h\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$ (177)
$\displaystyle\mathbb{E}_{{\bm{x}}^{\prime}\sim{\mathcal{D}}_{1}}\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}$ $\displaystyle=\|\nabla
h^{\top}\|^{2}_{{\mathcal{D}}_{1},{\bm{H}}_{\star}},$ (178)

we have

$\displaystyle\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$
$\displaystyle\leq\|h^{\prime}_{\star,\diamond}-{\bm{b}}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}=\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\|h({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}$
(179) $\displaystyle\leq
2\left(\mathbb{E}_{{\bm{x}}^{\prime}\sim{\mathcal{D}}_{1}}\|\nabla
h({\bm{x}}^{\prime})^{\top}\|^{2}_{{\bm{H}}_{\star}}+\beta^{2}\left(B-\tau\right)^{2}_{+}\right)B^{2}$
(180) $\displaystyle=2\left(\|\nabla
h^{\top}\|^{2}_{{\mathcal{D}}_{1},{\bm{H}}_{\star}}+\beta^{2}\left(B-\tau\right)^{2}_{+}\right)B^{2}$
(181)

Noting that $h$ and $h^{\prime}_{\star,\diamond}$ only differs by a constant
shift ${\bm{b}}$, we can see $\nabla h=\nabla h^{\prime}_{\star,\diamond}$.
Therefore, by replacing $\nabla h^{\top}$ by $\nabla
h_{\star,\diamond}^{\prime\top}$ we finally have the first inequality in
Theorem 3.2

$\displaystyle\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}\leq
2\left(\|\nabla
h_{\star,\diamond}^{\prime\top}\|^{2}_{{\mathcal{D}}_{1},{\bm{H}}_{\star}}+\beta^{2}\left(B-\tau\right)^{2}_{+}\right)B^{2}.$
(182)

It remains to show the Wasserstein distance between ${\mathcal{D}}_{1}$ and
${\mathcal{D}}$. As ${\bm{x}}^{\prime}$ is a function of the random variable
${\bm{x}}\sim{\mathcal{D}}$ with $\|{\bm{x}}^{\prime}-{\bm{x}}\|_{2}\leq\tau$,
and ${\mathcal{D}}_{1}$ is the induced distribution of ${\bm{x}}^{\prime}$ as
a function of ${\bm{x}}$, we can see that by the definition of type-1
Wasserstein distance between ${\mathcal{D}}$ and ${\mathcal{D}}_{1}$ is
bounded by $\tau$.

Denote ${\mathbb{J}}({\mathcal{D}},{\mathcal{D}}^{\prime})$ as the set of all
joint distributions that have marginals ${\mathcal{D}}$ and
${\mathcal{D}}^{\prime}$, and recall the definition of type-1 Wasserstein
distance is

$\displaystyle
W_{1}({\mathcal{D}},{\mathcal{D}}_{1})=\inf_{{\mathcal{J}}\in{\mathbb{J}}({\mathcal{D}},{\mathcal{D}}_{1})}\int\|{\bm{x}}-{\bm{x}}^{\prime}\|_{2}\mathop{}\\!\mathrm{d}{\mathcal{J}}({\bm{x}},{\bm{x}}^{\prime}).$
(183)

Denote ${\mathcal{J}}_{0}$ as the joint distribution such that in
$({\bm{x}},{\bm{x}}^{\prime})\sim{\mathcal{J}}$ we always have
${\bm{x}}^{\prime}$ being a function of ${\bm{x}}$ as how ${\bm{x}}^{\prime}$
is defined. We can see that

$\displaystyle W_{1}({\mathcal{D}},{\mathcal{D}}_{1})$
$\displaystyle=\inf_{{\mathcal{J}}\in{\mathbb{J}}({\mathcal{D}},{\mathcal{D}}_{1})}\int\|{\bm{x}}-{\bm{x}}^{\prime}\|_{2}\mathop{}\\!\mathrm{d}{\mathcal{J}}({\bm{x}},{\bm{x}}^{\prime})\leq\int\|{\bm{x}}-{\bm{x}}^{\prime}\|_{2}\mathop{}\\!\mathrm{d}{\mathcal{J}}_{0}({\bm{x}},{\bm{x}}^{\prime})\leq\int\tau\mathop{}\\!\mathrm{d}{\mathcal{J}}_{0}({\bm{x}},{\bm{x}}^{\prime})$
(184) $\displaystyle=\tau.$ (185)

Therefore, we have the first inequality in the theorem proved .

The second inequality. Invoking Lemma D.4 with $h_{\star,\diamond}$, and
rearranging the inequality, we have

$\displaystyle\tfrac{1}{3n}\|\nabla
h_{\star,\diamond}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}\leq\tfrac{2}{\tau^{2}}\left(\sum_{i=1}^{n}\tfrac{1}{2n}\|h_{\star,\diamond}({\bm{x}}^{\prime}_{i})\|^{2}_{{\bm{H}}_{\star}}+\tfrac{1}{2}\|h_{\star,\diamond}({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}\right)+\tau^{2}\beta^{2}.$
(186)

Taking the expectation on both sides, we have

$\displaystyle\tfrac{1}{3n}\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\|\nabla
h_{\star,\diamond}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}\leq\tfrac{2}{\tau^{2}}\underbrace{\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\left(\sum_{i=1}^{n}\tfrac{1}{2n}\|h_{\star,\diamond}({\bm{x}}^{\prime}_{i})\|^{2}_{{\bm{H}}_{\star}}+\tfrac{1}{2}\|h_{\star,\diamond}({\bm{x}})\|^{2}_{{\bm{H}}_{\star}}\right)}_{X}+\tau^{2}\beta^{2}.$
(187)

Note that $X$ can be reformulated to be the expectation of an induced
distribution from $x\sim{\mathcal{D}}$, since ${\bm{x}}_{i}^{\prime}$ is a
pre-defined function of ${\bm{x}}$. Denote ${\mathcal{D}}_{2}$ as the
distribution induced by the following sampling process: first, sample
${\bm{x}}\sim{\mathcal{D}}$; then,

$\displaystyle{\bm{x}}^{\prime}$ $\displaystyle={\bm{x}}\quad\text{with
probability }\tfrac{1}{2}$ (188) $\displaystyle{\bm{x}}^{\prime}$
$\displaystyle={\bm{x}}^{\prime}_{i}\quad\text{with probability
}\tfrac{1}{2n}\text{ for }\forall i\in[n].$ (189)

Therefore, we can write $X$ as

$\displaystyle
X=\|h_{\star,\diamond}\|^{2}_{{\mathcal{D}}_{2},{\bm{H}}_{\star}}.$ (190)

Similarly to equation 185, it also holds that
$W_{1}({\mathcal{D}},{\mathcal{D}}_{2})\leq\tau$.

To finally complete the proof, noting that $\|\nabla
h_{\star,\diamond}^{\prime\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}$ is the
minimum of this gradient distance (equation 171), we have

$\displaystyle\|\nabla
h_{\star,\diamond}^{\prime\top}\|^{2}_{{\mathcal{D}},{\bm{H}}_{\star}}\leq\mathbb{E}_{{\bm{x}}\sim{\mathcal{D}}}\|\nabla
h_{\star,\diamond}({\bm{x}})^{\top}\|^{2}_{{\bm{H}}_{\star}}.$ (191)

Combining equation 187, equation 190 and equation 191, we have the second
inequality proved.

Hence, we have proved Theorem 3.2. ∎

###  D.4 Proof of Theorem 3.3

######  Theorem D.3 (Theorem 3.3 Restated).

The surrogate transfer loss (43) and the true transfer loss (44) are close,
with an error of $\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}$.

$\displaystyle-\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}\leq(\ref{def:know-
transfer-dist})-(\ref{eq:function-distance-
S-T})\leq\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}$ (192)

###### Proof.

Let us begin by recall the definition of the surrogate transfer loss (43) and
the true transfer loss (44).

$\displaystyle(\ref{eq:function-distance-S-T})$
$\displaystyle:=\min_{g\in{\mathbb{G}}}\ \|f_{T}-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}$ (193) $\displaystyle(\ref{def:know-
transfer-dist})$ $\displaystyle:=\min_{g\in{\mathbb{G}}}\ \|y-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}.$ (194)

Denote

$\displaystyle\tilde{g}^{\prime}$
$\displaystyle:=\operatorname*{arg\,min}_{g\in{\mathbb{G}}}\ \|f_{T}-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}$ (195) $\displaystyle\tilde{g}$
$\displaystyle:=\operatorname*{arg\,min}_{g\in{\mathbb{G}}}\ \|y-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}.$ (196)

First, we show an upper bound for (43).

$\displaystyle(\ref{eq:function-distance-S-T})\leq\|f_{T}-\tilde{g}\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}\leq\|y-\tilde{g}\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}+\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}=(\ref{def:know-
transfer-dist})+\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}},$ (197)

where the last inequality is by triangle inequality.

Similarly, we can derive its lower bound.

$\displaystyle(\ref{eq:function-distance-S-T})$
$\displaystyle=\|f_{T}-\tilde{g}^{\prime}\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}\geq\|y-\tilde{g}^{\prime}\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}-\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}$
(198) $\displaystyle\geq\min_{g\in{\mathbb{G}}}\|y-g\circ
f_{S}\|_{{\mathcal{D}},{\bm{H}}_{T}}-\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}}=(\ref{def:know-
transfer-dist})-\|f_{T}-y\|_{{\mathcal{D}},{\bm{H}}_{T}},$ (199)

where the first inequality is by triangle inequality.

Combining equation 197 and equation 199, we have the proposition proved.

∎

###  D.5 Proof of Theorem B.1

######  Theorem D.4 (Theorem B.1 Restated).

Denote $\tilde{g}_{T,S}:{\mathbb{R}}^{m}\to{\mathbb{R}}^{d}$ as the optimal
solution of equation 43, and
$\tilde{g}_{S,T}:{\mathbb{R}}^{d}\to{\mathbb{R}}^{m}$ as the optimal solution
of equation 46. Suppose the two optimal affine maps
$\tilde{g}_{T,S},\tilde{g}_{S,T}$ are both full-rank. For