Universality and Transfer: Shared Representation Geometry as the Reason Suffixes Move

Early adversarial examples were bespoke: one perturbation for one input on one model. The unsettling discovery about language-model jailbreaks, sharpened by Zou and colleagues, is that a single optimized suffix can be universal — appended to almost any harmful request and still work — and transferable — optimized against open models yet effective against closed ones the attacker cannot even inspect. Neither property is an accident. Universality is engineered by optimizing over many prompts simultaneously; transfer is engineered by optimizing over an ensemble of models and is enabled by a deeper fact: models trained on similar data occupy similar representational geometry, so an adversarial direction found in one is close to an adversarial direction in another. This article explains both, and draws the defensive conclusion that secrecy cannot save you.

Two phenomena, one objective family

Universality and transfer are distinct generalizations of the same adversarial objective. Universality is generalization across inputs: a suffix that lowers the compliance loss not for one prompt but for a whole distribution of prompts. Transfer is generalization across models: a suffix that lowers the loss not only on the model it was optimized against but on others. Both are achieved by changing what the optimization averages over — prompts for universality, models for transfer — while the per-example objective stays the negative log-probability of a target completion.

This framing matters because it says the properties are designed, not discovered. An attacker who wants a universal suffix optimizes against many prompts at once; one who wants transfer optimizes against several models at once. The empirical strength of the result then depends on how much structure is shared across the things being averaged — a lot of shared structure across prompts and across similar models, which is exactly why the averages have low minima.

For the defender, the unified view is clarifying: the same monitoring and filtering that address a single-prompt attack apply, but the reusability of a universal, transferable suffix changes the economics. A blocklist of known-bad strings is weak against an attacker who can mint fresh universal suffixes offline and cheaply.

Universality: one suffix, many prompts

A universal suffix is the minimizer of the average adversarial loss over a set of prompts rather than a single one. Concretely, the objective sums the compliance loss across many harmful requests, each with the same shared suffix appended, and the search optimizes the suffix to lower that sum. Because the suffix must help on all of them at once, it cannot exploit the idiosyncrasy of any single prompt; it must find a manipulation that works on the shared structure of the whole set, which is precisely what makes it generalize to new prompts drawn from the same distribution.

This is the same principle by which training on many examples yields a model that generalizes: averaging over a set pushes the solution toward features common to the set. Here the roles are inverted — it is the attack that is being trained to generalize across prompts — but the mathematics of generalization is identical. The suffix that minimizes average loss over a broad prompt set is, in effect, a small program for defeating the model's refusal behavior in general.

Defensively, universality does not change the suffix's statistical footprint: it is still optimized for loss, not fluency, so it remains unnatural and perplexity-detectable. What it changes is reuse — one suffix serves many attacks — which argues for detection that does not depend on having seen the specific string before.

Transfer: one suffix, many models

Transfer is engineered the same way universality is, but averaging over models instead of prompts. The attacker assembles an ensemble of accessible models — typically open-weight ones whose gradients are available — and optimizes a single suffix to minimize the average compliance loss across all of them. A suffix forced to work on several models at once cannot rely on any one model's quirks; it must exploit what the models share, and what similarly-trained models share tends also to be present in models outside the ensemble, including closed ones.

The result is that an attacker can pay the entire white-box cost offline, against public models, and obtain a suffix with a good chance of working on a target it never queried. This is the single most important fact for realistic risk assessment: the query-and-gradient cost is paid once, in private, and the finished artifact is then applied to the black-box target with few or no revealing queries.

The pipeline is worth making explicit: harvest open models, optimize one suffix over the ensemble, and deploy the frozen suffix against unseen targets. Each stage is offline and invisible to the eventual victim until the final application, which is why input-time defenses at the victim must not assume they will witness the search.

Why transfer happens: shared representation geometry

Transfer would be a mystery if models were arbitrary functions, but they are not. Models trained on overlapping corpora with similar objectives learn overlapping internal features and similar decision boundaries. Goodfellow and colleagues gave the foundational explanation for adversarial transfer generally: because these models are locally near-linear and their learned directions are correlated, a perturbation aligned with the loss gradient of one model is often close to aligned with another's. The adversarial directions live in a shared subspace, so a suffix that pushes across one model's refusal boundary tends to push across another's.

Picturing the models as overlapping regions in representation space makes the point intuitive: the refusal boundaries of similar models are not identical but heavily overlapping, and the adversarial suffix aims for the shared region where all of them are vulnerable at once. Ensemble optimization is precisely the search for a point in that intersection. The more the models overlap — same family, similar data, similar scale — the larger the shared vulnerable region and the stronger the transfer.

This geometry is also why defenses that merely perturb the surface — a different system prompt, a renamed model — do not stop transfer: they do not move the underlying representation geometry the attack targets. Real robustness requires changing that geometry, which is expensive and partial.

The transfer spectrum

Transfer is not all-or-nothing; its strength runs along a spectrum set by how much source and target share. At one end, transfer within the same model family — same architecture and training lineage — is strongest, because the representation overlap is nearly total. In the middle, transfer across different families trained on broadly similar public data is weaker but real. At the far end, transfer to a model with a genuinely different architecture, data mix, or training objective is weakest, because the shared adversarial subspace shrinks.

This spectrum gives the defender a lever that surface tricks do not: the further a target sits from the attacker's likely ensemble in genuine representational terms, the weaker the transfer. Diversity that is real — different data, objectives, and training procedures across a fleet, not just different prompts — reduces the size of the common vulnerable region and therefore the transfer rate. It is a partial, probabilistic defense, but it operates on the actual mechanism.

The honest caveat is that most deployed models cluster toward the strong-transfer end of the spectrum because they share so much public training data and methodology. Genuine diversity is costly, so in practice defenders should assume meaningful transfer and plan detection accordingly rather than relying on being far enough away.

Threat model implications

Universality and transfer together rewrite the threat model in the attacker's favor on one axis: cost amortization. The expensive white-box optimization is performed once, offline, over public models, and produces an artifact that is reusable across prompts and effective across targets. In NIST taxonomy terms, the adversary's knowledge requirement collapses from per-target white-box access to one-time access to any sufficiently representative open ensemble. Secrecy of the victim model is therefore not a meaningful control.

The economics are the whole story. A defense that raises per-attack cost is undercut if the attacker pays once and reuses; a blocklist of known suffixes is undercut if fresh universal suffixes are cheap to mint. The defender must instead raise costs that do not amortize: input-time filtering that rejects the unnatural footprint of any optimized suffix, and behavior-time monitoring that catches the compliance regardless of which reusable suffix produced it.

This is why the strongest defenses in this space are footprint- and behavior-based rather than signature-based. They target properties the attacker cannot easily amortize away, whereas a signature list is defeated by the very reusability that makes the attack efficient.

Limits and honest framing

The picture is powerful but bounded. Transfer is probabilistic, not guaranteed: a suffix that defeats an ensemble may still fail on a particular target, and its success rate decays along the spectrum and over time as targets are retrained. Universality trades strength for breadth — a suffix tuned to work on everything is often weaker on any given prompt than a bespoke one — so an attacker balancing breadth and potency does not get both for free.

The defenses inherit matching limits. Genuine representational diversity shrinks the shared vulnerable region but is expensive and only partial, since mainstream models remain similar. Footprint filtering is strong against loss-only suffixes but weaker against fluency-constrained variants that sacrifice some transfer for naturalness. And behavior monitoring depends on being able to recognize compliance, which is itself a measurement problem with its own error.

Held honestly, the mechanism still guides the defense precisely. It explains why secrecy fails, why blocklists fail, and why the durable controls are the footprint and behavioral ones — and it quantifies the one real lever, genuine diversity, along a spectrum the defender can reason about rather than a single on-off switch.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

# DEFENSIVE / MOCK ONLY — evaluates transfer of an already-known suffix
# CANARY is a benign stand-in; no harmful target, no new attack is created.
function measure_transfer(captured_suffix, my_models):
    results = {}
    for m in my_models:
        comply_lp = m.logprob(AFFIRMATIVE_PREFIX, given=CANARY + captured_suffix)
        results[m.id] = {'adversarial_loss': -comply_lp,
                         'flagged_by_perplexity': reference_perplexity(captured_suffix) > PPL_T}
    return TransferReport(results, note='use to prioritize hardening, not to attack')

Glossary

Universality

The property that one adversarial suffix succeeds across many prompts, achieved by optimizing over a prompt set.

Transfer

The property that a suffix optimized on one or more models succeeds on other, unseen models.

Ensemble optimization

Minimizing the average adversarial loss across several models to produce a suffix that transfers.

Shared adversarial subspace

The overlapping set of directions along which similar models are vulnerable, where transferable attacks live.

Representation geometry

The structure of features and decision boundaries a model learns, which overlaps across similarly-trained models.

Amortization

Paying an attack's cost once (offline) and reusing the result across prompts and targets.

Footprint defense

Detection based on an attack's statistical signature (e.g. perplexity), which reuse does not remove.

References

1. Zou et al., Universal and Transferable Adversarial Attacks on Aligned Language Models (arXiv 2307.15043)
2. Goodfellow, Shlens & Szegedy, Explaining and Harnessing Adversarial Examples / FGSM (arXiv 1412.6572)
3. Szegedy et al., Intriguing properties of neural networks (arXiv 1312.6199)
4. NIST AI 100-2 e2023 — Adversarial Machine Learning: A Taxonomy and Terminology
5. OWASP Top 10 for LLM Applications: LLM01 Prompt Injection