Mina Remeli posted a dissertation on arXiv on 30 October that set out to break a core assumption in transfer learning, the technique behind nearly every modern AI model that starts from a pretrained backbone S¹. Her hypothesis: a model that performs well on its original task does not necessarily transfer that skill to a new one. Three types of adversarial attacks later, her own evidence refused to cooperate.
My read: The reversal is the story. Remeli expected adversarial attacks to expose cases where source-task accuracy and target-task transferability diverge. Instead, all three attack types showed a strong relationship between the two S¹. The paper is a non-peer-reviewed dissertation, and the results come from specific adversarial setups that may not generalise, but a link that holds under active attack is exactly the kind of negative result that gets overlooked.
Transfer learning takes a model trained on one task, say classifying photos on ImageNet, and adapts it to another, like flagging defects on a factory line. Facebook AI Research described ImageNet classification as the default pretraining task for visual perception models across a wide range of applications P⁴. The open-source Transfer Learning Library, with 3,942 stars on GitHub, provides tools for domain adaptation and task adaptation P⁵. Its adoption reflects how central this approach has become for practitioners.
Yet the conditions that make knowledge transfer actually work remain poorly understood.
Remeli frames the gap directly in her dissertation, arguing that researchers still lack a clear picture of what must hold true for knowledge to move from one task to another S¹.
Attacks targeted the transfer assumption itself
Remeli's central question was whether strong performance on a source task guarantees that a model will adapt well to a related target task S¹. She hypothesized the answer was no, and attempted to find counterexamples through adversarial attacks on the transfer learning procedure itself.
This approach connects to a broader line of work on adversarial optimization. The GitHub repository chao1224/BadGlobalMinima, tied to a NeurIPS 2020 paper, demonstrates that bad global minima exist in neural network training and that stochastic gradient descent can reach them P³. If adversarial conditions can push a model toward bad minima during training, the same principle might expose cracks in transfer learning.
Source accuracy and transfer stayed coupled under attack
Across three types of adversarial attacks, Remeli found that models performing well on their original task also tended to perform well after transfer, with the attacks failing to separate the two S¹. The attacks did not produce the counterexamples Remeli was looking for.
She acknowledges that these findings do not eliminate the possibility that source-task generalization alone is enough to ensure successful transfer S¹. The link held, but the experiments do not prove it must always hold. The distance between "we couldn't break it" and "it can't be broken" is where the work stops.
This matters for teams that build on pretrained models. If source-task performance reliably predicts transferability, model selection gets simpler: pick the strongest backbone and adapt. If it doesn't, every target domain needs its own validation pipeline. For a machine-learning engineer choosing between two ImageNet-pretrained backbones for a medical imaging task, the dissertation suggests the higher-scoring backbone on the source benchmark is the safer bet — at least under adversarial conditions, which could shorten the model-selection phase from days of transfer-validation runs to a quick leaderboard check.
The dissertation's limits are plain. It is a preprint, not peer-reviewed S¹. The results come from specific adversarial attack configurations that may not cover the full space of transfer learning scenarios. No error bars, confidence intervals, or released code accompanied the reported results, and the strong-relationship claim rests on Remeli's own experimental setup. The arXiv categories, cs.CR and q-fin.GN, appear mismatched with the deep learning content, which points to a classification error rather than a deliberate cross-disciplinary submission. The practical takeaway is narrow: under adversarial pressure, source-task accuracy and target-task performance stayed linked.
A model shop adapting a vision backbone to a new dataset should still run its own transfer validation. But Remeli's dissertation suggests the source benchmark is a better predictor than she expected. Peer review or a follow-up study extending these findings beyond the three attack types tested here is the next checkpoint to watch.
Sources: S1 — Exploring Bad Minima in Transfer Learning · P2 — Exploring Bad Minima in Transfer Learning · P3 — chao1224/BadGlobalMinima · P4 — Exploring the Limits of Weakly Supervised Pretraining | Facebook AI Re · P5 — thuml/Transfer-Learning-Library
Written from 5 sourced items, 4 of them primary.
