Query-EfficientCross-Domain Black-Box Adversarial Robustness Assessment Without Retraining via Differentiable Spatial-Channel Mapping and Bandit Optimization

Evaluating the adversarial robustness of deployed deep neural networks is critical for trustworthy AI, yet existing black-box assessment tools assume homogeneous input domains shared between surrogates and targets, an assumption rarely met in practice. Cross-domain transfer attacks are inherently ill-posed due to profound structural and semantic discrepancies between surrogate and target models. Conventional methods often fail due to gradient stagnation and label misalignment. We propose Cross-Domain Adversarial Optimization (CDAO), a training-free paradigm establishing high-fidelity adversarial guidance across heterogeneous domains without task-specific retraining. Differentiable Spatial-Channel Mapping (DSCM) reconciles physical dimension mismatches, preserving analytical differentiability across mismatched input dimensions. To resolve semantic disjointness, Target Proxy Distillation (TPD) casts proxy target selection as a multi-fidelity candidate-selection problem analogous to Best Arm Identification. Using multi-fidelity Successive Halving, TPD adaptively distills informative proxy classes with minimal query overhead, eliminating shared label assumptions. By unifying structural and semantic alignment into a plug-and-play pipeline, CDAO enables effective cross-domain guidance at inference time. Extensive evaluations across cross-dataset image-classification settings that differ in architecture, resolution, channel format, and label space demonstrate that CDAO achieves the best transferability and favorable query efficiency among the evaluated inference-time black-box baselines for cross-dataset image classification, reducing the end-to-end query budget to Q ∼ 103 (an order of magnitude below the Q ∼ 104 regime of pure query-driven attacks). Concretely, the end-to-end budget is only 1000 and 3000 queries for small- and large-scale datasets, respectively, yielding targeted ASR gains of 38.5% on CIFAR-10 and 43.7% on ImageNet-1K over the strongest baseline. These results highlight that even models deployed behind black-box APIs remain vulnerable to structured cross-domain probes, and that robustness evaluation tools must account for heterogeneous threat surfaces.