T OWARDS A U NIFIED U NDERSTANDING AND I MPROVEMENT OF A DVERSARIAL T RANSFERABILITY
Anonymous authors
Paper under double-blind review
A BSTRACT
In this paper we use the interaction inside adversarial perturbations to explain and boost the adversarial transferability.
We discover and prove the negative correlation between the adversarial transferability and the interaction inside adversarial perturbations.
The negative correlation is further veriﬁed through different
DNNs with various inputs.
Moreover, this negative correlation can be regarded as a uniﬁed perspective to understand current transferability-boosting methods.
To this end, we prove that some classic methods of enhancing the transferability essentially decease interactions inside adversarial perturbations.
Based on this, we propose to directly penalize interactions during the attacking process, which signiﬁcantly improves the adversarial transferability.
We will release the code when the paper is accepted
I NTRODUCTION
Adversarial examples of deep neural networks (DNNs) have attracted increasing attention in recent years (Carlini & Wagner, 2017; Madry et al., 2018).
Goodfellow et al.
; Liu et al.
(2016) explored the transferability of adversarial perturbations, and used perturbations generated on a source
DNN to attack other target DNNs.
Although many methods have been proposed to enhance the transferability of adversarial perturbations (Dong et al., 2018; Wu et al., 2018; 2020), the essence of the improvement of the transferability is still unclear.
This paper considers the interaction inside adversarial perturbations as a new perspective to interpret adversarial transferability.
Interactions inside adversarial perturbations are deﬁned using the Shapley interaction index proposed in game theory (Michel & Marc, 1999; Shapley, 1953).
Given an input sample x ∈ R n , the adversarial attack aims to fool the DNN by adding an imperceptible perturbation δ ∈ R n on x .
Each unit in the perturbation map is termed a perturbation unit .
Let φ i denote the importance of the i -th perturbation unit δ i to attacking.
φ i is implemented as the Shapley value, which will be explained later.
The interaction between perturbation units δ i , δ j is deﬁned as the change of the i -th unit’s importance φ i when the j -th unit is perturbed w.r.t the case when the j -th unit is not perturbed.
If the perturbation δ j on the j -th unit increases the importance φ i of the ith unit, then there is a positive interaction between δ i and δ j .
If the perturbation δ j decreases the importance φ i , it indicates a negative interaction.
In this paper, we discover and partially prove the strong negative correlation between the transferability and the interaction between adversarial perturbation units, i.e. adversarial perturbations with lower transferability tend to exhibit larger interactions between perturbation units.
We verify such a correlation based on both the theoretical proof and comparative studies.
Furthermore, based on the correlation, we propose to penalize interactions during attacking to improve the transferability.
The background for us to investigate the correlation between adversarial transferability and the interaction is as follows.
First, we prove that multi-step attacking usually generates perturbations with larger interactions than single-step attacking.
Second, according to (Xie et al., 2019), multi-step attacking tends to generate more over-ﬁtted adversarial perturbations with lower transferability than single-step attacking.
We consider that the more dedicated interaction reﬂects more over-ﬁtting towards the source DNN, which hurts adversarial transferability.
In this way, we propose the hypothesis that the transferability and the interaction are negatively correlated.
• Comparative studies are conducted to verify this negative correlation through different DNNs.
• Uniﬁed explanation.
Such a negative correlation provides a uniﬁed view to understand current transferability-boosting methods.
We theoretically prove that some classic transferability-boosting methods (Dong et al., 2018; Wu et al., 2018; 2020) essentially decrease interactions between perturbation units, which also veriﬁes the hypothesis of the negative correlation.
• Boosting adversarial transferability.
Based on above ﬁndings, we propose a loss to decrease interactions between perturbation units during attacking, namely the interaction loss, in order to enhance the adversarial transferability.
The effectiveness of the interaction loss further proves the negative correlation between the adversarial transferability and the interaction inside adversarial perturbations.
Furthermore, we also try to only use the interaction loss to generate perturbations without the loss for the classiﬁcation task.
We ﬁnd that such perturbations still exhibit moderate adversarial transferability for attacking.
Such perturbations may decrease interactions encoded by the DNN, thereby damaging the inference patterns of the input.
Our contributions are summarized as follows.
(1) We reveal the negative correlation between the transferability and the interaction inside adversarial perturbations.
(2) We provide a uniﬁed view to understand current transferability-boosting methods.
(3) We propose a new loss to penalize interactions inside adversarial perturbations and enhance the adversarial transferability.
R ELATED WORK
Adversarial transferability.
Attacking methods can be roughly divided into two categories, i.e. white-box attacks (Szegedy et al., 2013; Goodfellow et al., 2014; Papernot et al., 2016; Carlini &
Wagner, 2017; Kurakin et al., 2017; Su et al., 2017; Madry et al., 2018) and black-box attacks (Liu et al., 2016; Papernot et al., 2017; Chen et al., 2017a; Bhagoji et al., 2018; Ilyas et al., 2018; Jiang et al., 2019).
A speciﬁc type of the black-box attack is based on the adversarial transferability (Dong et al., 2018; Wu et al., 2018; Xie et al., 2019; Wu et al., 2020), which transfers adversarial perturbations on a surrogate/source DNN to a target DNN.
Thus, some previous studies focused on the transferability of adversarial attacking.
Liu et al.
(2016) demonstrated that non-targeted attacks were easy to transfer, while the targeted attacks were difﬁcult to transfer.
Wu et al.
(2018) and Demontis et al.
(2019) explored factors inﬂuencing the transferability, such as network architectures, model capacity, and gradient alignment.
Several methods have been proposed to enhance the transferability of adversarial perturbations.
The momentum iterative attack (MI Attack) (Dong et al., 2018) incorporated the momentum of gradients to boost the transferability.
The variance-reduced attack (VR Attack) (Wu et al., 2018) used the smoothed gradients to craft perturbations with high transferability.
The diversity input attack (DI Attack) (Xie et al., 2019) applied the adversarial attacking to randomly transformed input images, which included random resizing and padding with a certain probability.
The skip gradient method (SGM Attack) (Wu et al., 2020) used the gradients of the skip connection to improve the transferability.
Dong et al.
(2019) proposed the translation-invariant attack (TI Attack) to evade robustly trained DNNs.
Li et al.
(2020) used the dropout erosion and the skip connection erosion to improve the transferability.
In comparison, we explain the transferability based on game theory, and discover the negative correlation between the transferability and interactions as a uniﬁed explanation for some above methods.
Interaction.
The interaction between input variables has been widely investigated.
Michel & Marc (1999) proposed the Shapley interaction index based on the Shapley value (Shapley, 1953) in game theory.
Daria Sorokina (2008) deﬁned the interaction of K input variables of additive models.
Scott Lundberg (2017) quantiﬁed interactions between each pair of input variables for tree-ensemble models.
Some studies mainly focused on interactions to analyze DNNs.
Tsang et al.
(2018) measured statistical interactions based on DNN weights.
Murdoch et al.
(2018) proposed to extract interactions in LSTMs by disambiguating information of different gates, and Singh et al.
(2019) extended this method to CNNs.
Jin et al.
(2020) quantiﬁed the contextual independence of words to hierarchically explain the LSTMs.
Janizek et al.
(2020) extended the method of Integrated Gradients (Sundararajan et al., 2017) to quantify pairwise interactions of input features based on the
Hessian matrix, which required the DNN to use the SoftPlus operation replace the ReLU operation.
Chen et al.
(2020) extended the attribution in (Chen & Ji, 2020) to use the Shapley interaction index to generate hierarchical explanations of NLP tasks.
In comparison, in this study, we use the Shapley interaction index to explain and improve the transferability of adversarial perturbations.
T HE RELATIONSHIP BETWEEN TRANSFERABILITY AND INTERACTIONS
Preliminaries: the Shapley value.
The Shapley value was ﬁrst proposed in game theory (Shapley, 1953).
Considering multiple players in a game, each player aims to win a high reward.
The Shapley value is considered as a unique and unbiased approach to fairly allocating the total reward gained by all players to each player (Weber, 1988).
The Shapley value satisﬁes four desirable properties, i.e. the linearity , dummy , symmetry , and efﬁciency (please see the Appendix A.1 for details).
Let Ω = { 1 , 2 , . .
. , n } denote the set of all players, and let v ( · ) denote the reward function.
v ( S ) represents the reward obtained by a set of players S ⊆ Ω .
The Shapley value φ ( i | Ω) unbiasedly measures the contribution of the i -th player to the total reward gained by all players in Ω , as follows.
[Equation]
Adversarial attack.
Given an input sample x ∈ [0 , 1] n with the true label y ∈ { 1 , 2 , . . .
, C } , we use h ( x ) ∈ R C to denote the output of the DNN before the softmax layer.
To simplify the story, in this study, we mainly focus on the untargeted adversarial attack.
The goal of the untargeted adversarial attack is to add a human-imperceptible perturbation δ ∈ R n on the sample x , and make the DNN classify the perturbed sample x (cid:48)
=
x + δ into an incorrect category, i.e. arg max y (cid:48)
h y (cid:48)
( x (cid:48) ) (cid:54) =
y .
The objective of adversarial attacking is usually formulated as follows.
[Equation]
where (cid:96) ( h ( x + δ ) , y ) is referred to as the classiﬁcation loss, and (cid:15) is a constant of the norm constraint.
Please see Appendix C for technical details of solving Equation (2).
3. T HEORETICAL UNDERSTANDING OF THE ADVERSARIAL ATTACK IN GAME THEORY .
In adversarial attacking, given the perturbation δ ∈ R n , we use Ω = { 1 , 2 , . . . , n } to denote all units/dimensions in the perturbation.
We use the Shapley value in Equation (1) to measure the contribution of each perturbation unit i ∈
Ω to the attack.
To this end, it requires us to deﬁne the utility of a subset of perturbation units S ⊆ Ω for attacking, which can be formulated as v ( S ) = max y (cid:48) (cid:54) =
y h y (cid:48)
( x + δ ( S ) )
− h y
( x + δ ( S ) ) , according to Equation (2).
h y ( · ) is the value of the y -th element of h ( · ) ∈ R C .
δ ( S ) ∈
R n is the perturbation which only contains perturbation units in S , i.e. ∀ i ∈ S , δ ( S ) i
= δ i ; ∀ i / ∈ S , δ ( S ) i = 0 .
In this way, v (Ω) = max y
[Equation]
(cid:54) =
y h y (cid:48)
( x + δ )
− h y
( x + δ ) denotes the utility of all perturbation units, and v ( ∅ )
= max y (cid:48) (cid:54) =
y h y (cid:48)
( x ) − h y ( x ) denotes the baseline score without perturbations.
Thus, the overall contribution of perturbation units can be measured as v (Ω) − v ( ∅ ) .
We apply the Shapley value in Equation (1) to assign the overall contribution to each perturbation unit as (cid:80) i φ ( i | Ω) = v (Ω) − v ( ∅ ) , where φ ( i | Ω) denotes the contribution of the i -th perturbation unit.
Interactions.
Perturbation units do not contribute to the adversarial utility independently.
For example, perturbation units may form a certain pattern, e.g. an edge in the image.
Thus, perturbations units in the edge must appear together.
The absence of a few units in the pattern may invalidate this pattern.
Let us consider two perturbation units i, j .
According to (Michel & Marc, 1999), the
Shapley interaction index between units i, j is deﬁned as the additional contribution as follows.
[Equation]
where φ ( i | Ω \ { j } ) and φ ( j | Ω \ { i } ) represent the individual contributions of units i and j , respectively, when the perturbation units i, j work individually.
Note that φ ( i | Ω \ { j } ) is computed in the scenario of considering the unit j always absent.
(cid:80) i φ ( i | Ω \ { j } )
= v (Ω \ { j } ) − v ( ∅ ) , due to the absence of perturbation unit
j . φ ( S ij | Ω (cid:48) ) denotes the joint contribution of i, j , when perturbation units i, j are regarded as a singleton unit S ij = { i, j } .
In this case, units i, j are supposed to be always perturbed or not perturbed simultaneously, and we can consider that there are only n − 1 players in the game.
Thus, the set of all perturbation units is considered as Ω (cid:48)
=
Ω \ { i, j } ∪ S ij .
The joint contribution of S ij is denoted by φ ( S ij | Ω (cid:48) ) , s.t. (cid:80) i (cid:48)
∈ Ω (cid:48) \{ S ij } φ ( i (cid:48) | Ω (cid:48) )
+ φ ( S ij | Ω (cid:48) )
= v (Ω (cid:48) ) − v ( ∅ ) .
The interaction deﬁned in Equation (3) is equivalent to the change of the i -th unit’s importance φ i when the unit j exists w.r.t the case when the unit j is absent.
Please see Appendix D for the proof.
[Figure]
Interaction
Interaction
T r an s f e r U t ili t y
T r an s f e r U t ili t y
Interaction
T r an s f e r U t ili t y T r an s f e r U t ili t y
Interaction
[Figure]
Interaction
T r an s f e r U t ili t y T r an s f e r U t ili t y
Interaction T r an s f e r U t ili t y T r an s f e r U t ili t y
Interaction
T r an s f e r U t ili t y T r an s f e r U t ili t y
T r an s f e r U t ili t y T r an s f e r U t ili t y
T r an s f e r U t ili t y
T r an s f e r
[Figure]
t ili t y
T r an s f e r U t ili t y T r an s f e r U t ili t y
Interaction Interaction
Interaction Interaction
Interaction Interaction
Interaction Interaction
S e tt
i ng
If I ij ( δ ) > 0 , it means δ i and δ j cooperate with each other, i.e. the interaction is positive; if
I ij ( δ ) < 0 , it means δ i and δ j conﬂict with each other, i.e. the interaction is negative.
The absolute value of | I ij ( δ ) | indicates the interaction strength.
The interaction is symmetric that I ij ( δ )
=
I ji ( δ ) .
We are given an input sample x ∈ R n and a DNN h ( · ) trained for classiﬁcation.
With the deﬁnition of interactions, in adversarial attacking, we have the following propositions:
Proposition 1.
(Proof in Appendix E)
The adversarial perturbation generated by the multi-step attack via gradient descent is given as δ m multi =
α (cid:80) m − 1 t =0 ∇ x (cid:96) ( h ( x + δ t multi ) , y ) , where δ t multi denotes the perturbation after the t -th step of updating, and m is referred to as the total number of steps.
The adversarial perturbation generated by the single-step attack is given as δ single = αm ∇ x (cid:96) ( h ( x ) , y ) .
Then, the expectation of interactions between perturbation units in δ m multi , E a,b
[ I ab ( δ m multi )] , is larger than E a,b
[ I ab ( δ single )] , i.e. E a,b [ I ab ( δ m multi )] ≥ E a,b
[ I ab ( δ single )] .
Note that when we compare interactions inside different perturbations, magnitudes of these perturbations should be similar.
It is because the comparison of interactions between adversarial perturbations of different magnitudes is not fair.
Therefore, we use the step size αm in the single-step attack to roughly (not accurately) balance the magnitude of perturbations.
The fairness is further discussed in Appendix E.1.
Proposition 1 shows that, in general, adversarial perturbations generated by the multi-step attack tend to exhibit larger interactions than those generated by the single-step attack.
In addition, Appendix E.4 shows that the multi-step attack usually generates perturbations with larger interactions than noisy perturbations of the same magnitude.
Besides, Xie et al.
(2019) demonstrated that the multi-step attack tends to over-ﬁt the source DNN, which led to low transferability.
Intuitively, large interactions mean a strong cooperative relationship between perturbation units, which indicates the signiﬁcant over-ﬁtting towards adversarial perturbations oriented to the source DNN.
In this way, we propose the hypothesis that the adversarial transferability and the interactions inside adversarial perturbations are negatively correlated.
3. E MPIRICAL VERIFICATION OF THE NEGATIVE CORRELATION
To verify the negative correlation between the transferability and interactions, we conduct experiments to examine whether adversarial perturbations with low transferability tend to exhibit larger interactions than those perturbations with high transferability.
Given a source DNN and an input sample x , we generate the adversarial example x (cid:48)
=
x + δ .
Then, given a target DNN h ( t ) , we measure the transfer utility of δ as Transfer Utility = [max y (cid:48) (cid:54) =
y h ( t ) y (cid:48)
( x + δ ) − h
( t ) y ( x + δ )] − [max y (cid:48)
(cid:54) =
y h ( t ) y (cid:48)
( x ) − h ( t ) y
( x )] as mentioned in Section 3.1.
The interaction is given as Interaction =
E i,j
[ I ij ( δ )] , which is computed on the source DNN.
Note that the computational cost of I ij ( δ ) is NP-hard.
However, we prove that we can simplify the computation of the average interaction over all pairs of units as follows, which signiﬁcantly reduces the computational cost.
Please see Appendix F for the proof.
[Equation]
Using the validation set of the ImageNet dataset (Russakovsky et al., 2015), we generate adversarial perturbations on four types of DNNs, including ResNet-34/152(RN-34/152)
(He et al., 2016) and
DenseNet-121/201(DN-121/201) (Huang et al., 2017).
We transfer adversarial perturbations generated on each ResNet to DenseNets.
Similarly, we also transfer adversarial perturbations generated on each DenseNet to ResNets.
Figure 1 shows the negative correlation between the transfer utility and the interaction.
Each subﬁgure corresponds to a speciﬁc pair of source DNN and target DNN.
In each subﬁgure, each point represents the average transfer utility and the average interaction of adversarial perturbations through all testing images.
Different points represent the average interaction and the average transfer utility computed using different hyper-parameters.
Given an input image x , adversarial perturbations are generated by solving the relaxed form of Equation (2) via the gradient descent, i.e. min δ − (cid:96) ( h ( x + δ ) , y )
+ c · (cid:107) δ (cid:107) pp s.t. x + δ ∈ [0 , 1] n , where c ∈ R is a scalar.
In this way, we gradually change the value of c and set different values of p 1 as different hyper-parameters to generate different adversarial perturbations, thereby drawing different points in each subﬁgure.
Fair comparisons require adversarial perturbations generated with different hyper-parameters c to be comparable with each other.
Thus, we select a constant τ and take (cid:107) δ (cid:107) 2 = τ as the stopping criteria of all adversarial attacks.
The selection of τ is discussed in Appendix G.
U NIFIED UNDERSTANDING OF TRANSFERABILITY - BOOSTING ATTACKS
In this section, we prove that some classical methods of improving the adversarial transferability essentially decrease interactions between perturbation units, although these methods are not originally designed to decrease the interaction.
Without loss of generality, let us be given an input sample x ∈ R n and a DNN h ( · ) trained for classiﬁcation.
• VR Attack (Wu et al., 2018) smooths the classiﬁcation loss with the Gaussian noise during attacking
In the VR Attack, the gradient of the input sample is computed as follows.
g t =
E ξ ∼N (0 ,σ 2 I ) [ ∇ x (cid:96) ( h ( x + δ t + ξ ) , y )] .
The following proposition proves that the VR Attack is prone to decrease interactions inside perturbation units.
Proposition 2.
(Proof in Appendix H)
The adversarial perturbation generated by the multi-step attack is given as δ m multi = α (cid:80) m − 1 t =0 ∇ x (cid:96) ( h ( x + δ t multi ) , y ) .
The adversarial perturbation generated by the VR Attack is computed as δ m vr = α (cid:80) m
− 1 t =0 ∇ x ˆ (cid:96) ( h ( x + δ t vr ) , y ) , where ˆ (cid:96) ( h ( x + δ t vr ) , y ) =
E ξ ∼N (0 ,σ 2 I ) [ (cid:96) ( h ( x + δ t vr + ξ ) , y )] .
Perturbation units of δ m vr tend to exhibit smaller interactions than δ multi , i.e. E x E a,b
[ I ab ( δ m vr )] ≤ E x E a,b
[ I ab ( δ m multi )] .
Besides the theoretical proof, we also conduct experiments to compare interactions of perturbation units generated by the baseline multi-step attack (implemented as (Madry et al., 2018)) with those of perturbation units generated by the VR Attack.
Table 5 shows that the VR Attack exhibits lower interactions between perturbation units than the baseline multi-step attack.
• MI Attack (Dong et al., 2018) incorporates the momentum of gradients when updating the adversarial perturbation.
In the MI Attack, the gradient used in step t is computed as
follows
[Equation]
Note that the original MI Attack and the multi-step attack cannot be directly compared, since that magnitudes of the generated perturbations cannot be fairly controlled.
The value of interactions is sensitive to the magnitude of perturbations.
Comparing perturbations with different magnitudes is not fair.
Thus, we slightly revise the MI Attack as ∀ t > 0 , g t mi = µg t − 1 mi + (1 − µ ) ∇ x (cid:96) ( h ( x + δ t − 1 mi ) , y ); g 0 mi = 0 , where µ = ( t − 1) /t .
We investigate the interaction of adversarial perturbations generated by the original multi-step attack and the MI Attack.
We prove the following proposition, which shows that the MI Attack decreases the interaction between perturbation units in most cases.
Proposition 3.
(Proof in Appendix I)
The adversarial perturbation generated by the multi-step attack is given as δ m multi = α (cid:80) m − 1 t =0 ∇ x (cid:96) ( h ( x + δ t multi ) , y ) .
The adversarial perturbation generated by the multi-step attack incorporating the momentum is computed as δ m mi = α (cid:80) m
− 1 t =
g t mi .
Perturbation units of δ m mi exhibit smaller interactions than δ m multi , i.e. E a,b
[ I ab ( δ m mi )] ≤ E a,b [ I ab ( δ m multi )] .
[Figure]
where N i denotes the set of adjacent perturbation units of the perturbation unit i .
Here, we ignore interactions between non-adjacent units to simplify the visualization.
It is because adjacent units usually encode much more signiﬁcant interactions than other units.
The interaction loss forces the perturbation to encode more negative interactions
• SGM Attack (Wu et al., 2020) exploits the gradient information of the skip connection in ResNets to improve the transferability of adversarial perturbations.
The SGM Attack revises the gradient in the backpropagation, which can be considered as to add a speciﬁc dropout operation in the backpropagation.
We notice that Zhang et al.
(2020) prove that the dropout operation can decrease the signiﬁcance of interactions, so as to decrease the signiﬁcance of the over-ﬁtting of DNNs.
Thus, this also proves that the SGM Attack decreases interactions between perturbation units.
Besides the theoretical proof, we also conduct experiments to compare interactions of perturbation units generated by the baseline multi-step attack (implemented as Madry et al
(2018)) with
those
of perturbation units generated by the SGM Attack.
Table 5 shows that the SGM Attack exhibits lower interactions than the baseline multi-step attack.
T HE INTERACTION LOSS FOR TRANSFERABILITY ENHANCEMENT
Interaction loss.
Based on ﬁndings in previous sections, we propose a loss to directly penalize interactions during attacking, in order to improve the transferability of adversarial perturbations.
Based on Equation (2), we jointly optimize the classiﬁcation loss and the interaction loss to generate adversarial perturbations.
This method is termed the interaction-reduced attack (IR Attack).
max
[Equation]
(cid:96) (
[Equation] [Equation]
where (cid:96) interaction is the interaction loss, and λ is a constant weight for the interaction loss.
Although the computation of the interaction loss can be simpliﬁed according to Equation (4), the computational cost of the interaction loss is intolerable, when the dimension of images is high.
Therefore, as a trade-off between the accuracy and the computational cost, we divide the input image into 16 ×grids.
We measure and penalize interactions at the grid level, instead of the pixel level.
Figure 2 visualizes interactions between adjacent perturbation units at the grid level generated with and without the interaction loss.
Experiments.
For implementation, we generated adversarial perturbations on six different source
DNNs, including Alexnet (Krizhevsky et al., 2012), VGG-16 (Simonyan & Zisserman, 2015),
ResNet-34/152 (RN-34/152) (He et al., 2016) and DenseNet-121/201 (DN-121/201) (Huang et al., 2017).
For each source DNN, we tested the transferability of the generated perturbations on seven target DNNs, including VGG-16, ResNet-152 (RN-152), DenseNet-201 (DN-201), SENet-154 (SE154) (Hu et al., 2018), InceptionV3 (IncV3) (Szegedy et al., 2016), InceptionV4 (IncV4) (Szegedy et al., 2017), and Inception-ResNetV2 (IncResV2) (Szegedy et al., 2017).
In addition, three stateof-the-art DNNs, including the Dual-Path-Network (DPN-68) (Chen et al., 2017b), the NASNetLARGE (NASN-L) (Zoph et al., 2018), and the Progressive NASNet (PNASN) (Liu et al., 2018), were used as target DNNs to evaluate the ensemble source model (will be introduced in the next paragraph).
Besides unsecured target DNNs mentioned above, we also used three secured target models for testing, which were learned via ensemble adversarial training: IncV3 ens 3 (ensemble of three IncV3 networks), IncV3 ens 4 (ensemble of four IncV3 networks), and IncResV2 ens 3 (ensemble of three IncResV2 networks), which were released by Tram`er et al.
Ensemble source model: Besides above adversarial transferring from a single-source model, we also conducted the proposed IR Attack in the scenario of the ensemble-based attacking (Liu et al., 2016), in order to generate adversarial perturbations on the ensemble of RN-34, RN-152, and DN-121.
[Table] [Table]
Baselines.
The ﬁrst baseline method, the PGD Attack (Madry et al., 2018), directly solved the
Equation (2), which was widely used for adversarial attacks.
Besides this baseline attack, the other four baselines were the MI Attack (Dong et al., 2018), the VR Attack (Wu et al., 2018), the SGM
Attack (Wu et al., 2020), and the TI Attack (Dong et al., 2019).
Our method was implemented according to Equation (5), namely the IR Attack.
Because the SGM Attack was one of the top-ranked methods of boosting the adversarial transferability, we further added the interaction loss (cid:96) interaction to the SGM Attack as another implementation of our method (namely the SGM+IR Attack).
We also used the interaction loss to boost the performance of the MI Attack and the VR Attack (namely
MI+IR and VR+IR, respectively).
Please see Appendix N.1 for details.
Moreover, as Sectionstates, the MI Attack, VR Attack, and SGM Attack also decrease interactions during attacking.
Thus, we combined the IR Attack with all these interaction-reducing techniques together as a new implementation of our method, namely the HybridIR Attack.
All attacks were conducted withsteps 2 on randomly selected 1000 images of the validation set in the ImageNet dataset.
We set (cid:15) = 16 / 255 for the L ∞ attack, and set (cid:15) = 16 / 255 √ n following the setting in (Dong et al., 2018) for the L 2 attack.
The step size was set to 2 / 255 for all attacks.
Considering the efﬁciency of signal processing in DNNs with different depths, we set λ = 1 for the IR Attack, when the source DNN was ResNet.
We set λ = 2 , for other source DNNs.
To enable fair comparisons, the transferability of each baseline was computed based on the best adversarial perturbation during the 100 steps via the leave-one-out (LOO) validation.
Please see the Appendix K for the motivation and the evidence of the LOO evaluation of transferability.
All attacks were conducted with three different random samplings of grids or different initial perturbations.
trained via adversarial training.
Thus, we applied the TI Attack to the secured models in Table 3.
[Table] [Table]
Table 1 reports the success rates of the baseline attack (PGD (Madry et al., 2018)) and the IR Attack, namely PGD L ∞ +IR of L ∞ attacks and PGD L 2 +IR of L 2 attacks.
Compared with the baseline attack, the transferability was signiﬁcantly improved by the interaction loss on various source models against different target models.
Let us focus on the L ∞ attack.
For most source models and target models, the transferability enhancement brought by the interaction loss was more than 10%.
In particular, when the source DNN and the target DNN were DN-201 and IncV4, respectively, the baseline attack achieved the transferability of 36.5%.
With the interaction loss, the transferability was improved to 63.7% ( > 27% gain).
As Table 2 shows, in most cases, the IR Attack on the ensemble model generated more transferable perturbations than the PGD Attack.
Besides, as Table 3 shows, our interaction loss also improved the transferability against the secured target DNNs.
Such improvement further veriﬁed the negative correlation between transferability and interactions.
Table 4 shows the improvement of the transferability obtained by the interaction loss on other attacking methods.
The interaction loss could further boost the transferability of state-of-the-art transfer attacks.
Without the interaction loss, the highest transferability made by the SGM Attack against the IncResV2 was 68.8% (when the source is DN-201).
When the interaction loss was added, the transferability was improved to 81.5% ( > 12% gain).
Moreover, the HybridIR Attack, which combined all methods of reducing interactions together, improved success rates from the range of 54.6% ∼ 98.8% to the range of 70.2% ∼ 99.1%.
We can understand behaviors of the proposed interaction loss as follows.
Different methods generate adversarial perturbations in different manifolds, thereby exhibiting different transferability.
Based on the current perturbation, the interaction loss can point out the optimization direction towards further decrease of interactions in a local manner due to its optimization power.
Thus, the interaction loss further boosts the transferability.
[Figure]
T r an s f e r ab ili t y T r an s f e r ab ili t y
T r an s f e r ab ili t y T r an s f e r ab ili t y (
[Figure]
To further demonstrate the broad applicability of the interaction loss, besides untargeted attacks on the ImageNet dataset, we also conducted targeted attacks on the CIFAR-10 dataset (Krizhevsky &
Hinton, 2009).
Experimental results consistently showed that the adversarial transferability can be enhanced by reducing interactions in targeted attacks.
Please see Appendix.
N.2 for details.
Effects of the interaction loss.
We tested the transferability of perturbations generated by the IR
Attack with different weights of the interaction loss λ .
In particular, the baseline attack (PGD) can be considered as the IR Attack when λ = 0 .
We conducted attacks on two source DNNs (RN-34,
DN-121), and transferred adversarial perturbations to seven target DNNs (VGG16, RN-152, DN201, SE-154, IncV3, IncV4, IncResV2).
The attacks were conducted with 100 steps 2 on validation images in ImageNet .
Figure 3 (a) shows the black-box success rates with different values of λ .
The transferability of the IR Attack increased along with the increase of the weight λ .
Attack only with the interaction loss.
To further understand the effects of the interaction loss, we generated perturbations by exclusively using the interaction loss (without the classiﬁcation loss).
We used the RN-34 and DN-121 as source DNNs and tested the transferability on seven target DNNs.
The attacks were conducted with 100 steps 2 on ImageNet validation images.
Figure 3 (b) shows the curve of the transferability in different epochs.
We compared such adversarial perturbations with noise perturbations generated as (cid:15) · sign ( noise ) , where noise ∼ N (0 , σ 2 I ) , and (cid:15) = 16 / 255 , which was the same as the value used in the L ∞ attack.
We found that perturbations generated by only using the interaction loss still exhibited moderate adversarial transferability.
This phenomenon may be explained as that such perturbations decrease most interactions in the DNN, thereby damaging the inference patterns in the input image.
C ONCLUSION
In this paper, we have analyzed the transferability of adversarial perturbations from the perspective of interactions based on game theory.
We have proved that the multi-step attack tends to generate adversarial perturbations with large interactions.
We have discovered and partially proved the negative correlation between the transferability and interactions inside adversarial perturbations.
I.e. adversarial perturbations with higher transferability usually exhibit more negative interactions.
We have proved that some classical methods of enhancing the transferability essentially decrease interactions between perturbation units, which provides a uniﬁed view to understand the enhancement of transferability.
Moreover, we propose a new loss to directly penalize interactions between perturbation units during attacking, which signiﬁcantly improves the transferability of previous methods.
Furthermore, we have found that adversarial perturbations generated only using the interaction loss without the classiﬁcation loss still exhibited moderate transferability, which provides a new perspective to understand the transferability of adversarial perturbations.
A M OTIVATIONS FOR USING THE S HAPLEY INTERACTION INDEX
In this section, we discuss the motivations of using the Shapley interaction index to deﬁne the interaction.
A. F OUR P ROPERTIES OF S HAPLEY V ALUES
Let Ω = { 1 , 2 , . . . , n } denote the set of all players, and the reward function is v .
Without ambiguity, we use φ ( i | Ω) to denote the Shapley value of the player i in the game with all players Ω and reward function v , which is given as follows.
[Equation]
The Shapley value satisﬁes the following four properties (Weber, 1988):
• Linearity property: If there are two games and the corresponding reward functions are v and w ,
i
e. v ( S ) and w ( S ) measure the reward obtained by players in S in these two games.
Let φ v ( i | Ω) and φ w ( i | Ω) denote the Shapley value of the player i in the game v and game w , respectively.
If these two games are combined into a new game, and the reward function becomes reward ( S )
= v ( S )+ w ( S ) , then the Shapley value comes to be φ v + w ( i | Ω)
=
φ v ( i | Ω) + φ w
i | Ω) for each player i in Ω .
• Dummy property: A player i ∈ Ω is referred to as a dummy player if ∀ S
⊆ Ω \{ i } , v ( S ∪ { i } )
= v ( S )
+ v ( { i } ) .
In this way, φ ( i | Ω) = v ( { i } ) − v ( ∅ ) , which means that player i plays the game independently.
• Symmetry property:
If ∀ S ⊆ Ω \{ i, j } , v ( S ∪{ i } )
= v ( S ∪{ j } ) , then Shapley values of player i and j are equal, i.e. φ ( i | Ω) =
φ ( j | Ω) .
• Efﬁciency property: The sum of each individual’s Shapley value is equal to the reward won by the coalition N ,
i
e. (cid:80) i φ ( i | Ω) = v (Ω) − v ( ∅ ) .
This property guarantees the overall reward can be allocated to each player in the game.
A. M OTIVATIONS
Theoretical rigor .
We use the Shapley interaction index deﬁned based on the Shapley value, because the Shapley value has a solid theoretical foundation in the game theory, which is the unique attribution satisfying the above four desirable axioms.
Whether the metric depends on network architectures.
Because adversarial transferability is a general property for the attack, a convincing metric for adversarial transferability is supposed not to be directly related to the network architecture.
To this end, the computation of the interaction deﬁned on the Shapley value does not depend on the network architecture.
In comparison, previous deﬁnitions of the interaction are usually oriented to model architectures.
For example, the interaction proposed by Tsang et al.
(2018) requires the DNN to be fully-connected.
The two interaction metrics proposed by Murdoch et al.
(2018) and Jin et al.
(2020) are designed for LSTMs.
The Hessian-based interaction (Janizek et al., 2020) requires the DNN to use the softPlus operation to replace the ReLU operation.
Computational cost.
The computational cost of the Shapley-based interaction-reduction loss is relatively low.
Because of the efﬁciency axiom of the Shapley value, we prove that the time cost of computing the interaction loss (cid:96) interaction = 1 n − 1 E i [ v (Ω) − v (Ω \{ i } ) − v ( { i } ) + v ( ∅ )] is linear, i.e. O ( n ) , where n is the dimension of features.
The linear complexity makes it possible to apply the interaction to high-dimensional data and deep neural networks.
In contrast, the complexity of computing all possible pairwise interactions deﬁned in (Daria Sorokina, 2008) is O ( n 2 ) .
B C OMPARISONS BETWEEN I NTERACTIONS INSIDE P ERTURBATIONS OF D IFFERENT A TTACKS
We have theoretically proved that some classical attacking methods of boosting the adversarial transferability essentially decrease interactions inside perturbations.
Besides the theoretical proof in Ap-
[Table]
pendix I and Appendix H, we also conduct experiments to compare interactions of perturbation units when we generate adversarial perturbations with and without these attacking methods.
Such experiments further verify that these methods of boosting the transferability essentially decrease interactions.
We conduct attacks with the validation set in the ImageNet dataset on four DNNs, and measure the average interaction inside perturbation units.
As Table 5 shows, the SGM Attack and the VR Attack decrease interactions inside perturbations.
C A DVERSARIAL A TTACK
In general, the objective of adversarial attacking can be formulated as the following optimization problem.
[Equation]
where (cid:96) ( h ( x + δ ) , y ) is the classiﬁcation loss.
There are many ways to solve the above optimization problem under different norm constraints (cid:107)·(cid:107) p (Goodfellow et al., 2014; Carlini & Wagner, 2017;
Kurakin et al., 2017; Madry et al., 2018; Chen et al., 2018b).
Optimization-based approach.
One approach to approximately solving Equation (7) is to solve the following relaxed form:
[Equation]
where c > 0 is a scalar constant to balance the classiﬁcation loss and the norm constraint.
Szegedy et al.
; Carlini & Wagner (2017) have demonstrated the effectiveness of this method.
Projected gradient descent (PGD) (Madry et al., 2018).
The PGD Attack is usually considered as one of the simplest and the most widely used baseline for adversarial attacking.
In this paper, this method is called the Baseline .
The PGD Attack directly optimizes the classiﬁcation loss in
Equation (7).
Considering the norm constraint, after each step of updating, the PGD Attack projects the adversarial perturbation δ back to the (cid:15) -ball, if the perturbation goes beyond the ball.
PGD updates adversarial perturbations in each step with the following equation:
[Equation]
[Equation]
where δ t denotes the perturbation of the t -th step.
Π ( ∞ ) (cid:15) and Π (2) (cid:15) are projection operations, which project the perturbation δ back to the (cid:15) -ball, if the perturbation goes beyond the ball.
α is the step size.
Given δ ∈ R n , we have:
[Equation]
Interaction-reduced attack (IR Attack).
Note that our interaction-reduced attack (IR Attack) uses the similar way as PGD Attack to iteratively update perturbations.
The objective function of IR
Attack is given as follows.
[Equation]
We optimize the objective of IR Attack as follows.
[Equation]
D E QUIVALENT FORMS OF THE INTERACTION
In Section 3.1, the interaction between units i, j is deﬁned as the additional contribution as follows.
[Equation]
12) where φ ( i | Ω \ { j } ) and φ ( j | Ω \ { i } ) represent the individual contributions of units i and j , respectively, when the perturbation units i, j work individually.
φ ( S ij | Ω (cid:48) ) denotes the joint contribution of i, j , when perturbation units i, j are regarded as a singleton unit S ij = { i, j } .
Note that (cid:80) i φ ( i | Ω \ { j } )
= v (Ω \ { j } ) − v ( ∅ ) , due to the absence of perturbation unit j .
In Section 1, the interaction between perturbation units δ i , δ j is deﬁned as the change of the importance φ i of the i -th unit when the j -th unit δ j is perturbed w.r.t the case when the j -th unit δ j is not perturbed.
If the perturbation δ j on the j -th unit increases the importance φ i of the i -th unit, then there is a positive interaction between δ i and δ j .
If the perturbation δ j decreases the importance φ i , it indicates a negative interaction.
Mathematically, this deﬁnition can be written as follows.
[Equation]
(13) where φ i,w/j represents the importance of δ i , when δ j is always present; φ i,w/oj represents the importance of δ i , when δ j is always absent.
In this section, we aim to prove that the interaction in Equation (12) is equal to the interaction in
Equation (13), i.e. I ij ( δ ) = I (cid:48) ij ( δ )
[Equation]
Proof.
In Equation (12), the interaction is give as φ ( S ij | Ω (cid:48) )
− [ φ ( i | Ω \ { j } )
+ φ ( j | Ω \ { i } )] , where φ ( S ij | Ω (cid:48) ) , φ ( i | Ω \ { j } ) , and φ ( j | Ω \ { i } ) are implemented as Shapley values.
[Equation]
where S ij = { i, j } represents the coalition of perturbation units i, j .
In this game, because perturbation units i, j are regarded as a singleton player, we can consider there are only n − 1 players in the game, and consequently the set of players changes to Ω (cid:48)
=
Ω \ { i, j } ∪ S ij .
The individual contribution of perturbation unit i , when perturbation unit j is absent, is given as follows.
[Equation]
In this game, because the perturbation unit j is always absent, we can consider there are only n −players in the game.
Consequently the set of players changes to Ω \ { j } .
The individual contribution of perturbation unit j , when perturbation unit i is absent, is given as follows.
[Equation]
In this game, because the perturbation unit i is always absent, we can consider there are only n −players in the game.
Consequently the set of players changes to Ω \ { i } .
In this way,
[Equation]
In Equation (13), the interaction is given as φ i,w/j − φ
i,w/oj .
Here, φ i,w/j represents the speciﬁc game, in which the unit j is always present.
In this case, we only need to consider the presence and absence of other n − 1 players, except for the unit j .
φ i,w/oj represents the speciﬁc game, in which the unit j is always absent.
In this case, we also only need to consider the presence and absence of other n − 1 players, except for the unit j .
φ i,w/j and φ i,w/oj are also implemented as Shapley values.
When perturbation unit j is always present, the contribution of perturbation unit i is given as follows.
[Equation]
In this game, because the perturbation unit j is always present, we can consider there are only n −players.
When perturbation unit j is always absent, the contribution of perturbation unit i is given as follows.
[Equation]
In this game, because the perturbation unit j is always absent, we can consider there are only n −players.
In this way,
[Equation]
Therefore, we have
[Equation]
E P ROOF OF P ROPOSITION
To simplify the problem setting, we do not consider some tricks in adversarial attacking, such as gradient normalization and the clip operation.
In multi-step attacking, the ﬁnal perturbation generated after t steps is given as follows.
[Equation]
where α represents the step size, and (cid:96) ( h ( x ) , y ) is referred as the classiﬁcation loss.
To simplify the notation, we use g ( x ) to denote ∇ x (cid:96) ( h ( x ) , y ) , i.e. g ( x ) def = ∇ x (cid:96) ( h ( x ) , y ) .
Furthermore, we deﬁne the update of the perturbation with the multi-step attack at each step t as follows.
[Equation]
In this way, the perturbation can be written as follows.
[Equation]
Lemma 1.
Given the sample x ∈ R n and the adversarial perturbation δ ∈ R n , we use Ω = { 1 , 2 , . . . , n } to denote the set of all perturbation units.
The score function is denoted by v ( S ) =
L ( x + δ ( S ) ) , where δ ( S ) satisﬁes ∀ i ∈ S, δ ( S ) i =
[Equation]
= 0 .
The Shapley interaction between perturbation units a, b can be written as I ab =
δ a H ab ( x ) δ b + ˆ R 2 ( δ ) , where H ab ( x ) =
∂L ( x ) ∂x a ∂x b represents the element of the Hessian matrix, and ˆ R 2 ( δ ) denotes terms with elements in δ of higher than the second order.
Proof.
The Shapley interaction between perturbation units a, b is
[Equation]
| S | !
( n − | S |− 2)!
( n − 1)!
[ v ( S ∪ { a, b } ) − v ( S ∪ { b } ) − v ( S ∪ { a } ) + v ( S )] , where v ( S )
=
L ( x + δ ( S ) ) .
Here, the classiﬁcation loss can be approximated as L ( x + δ ) =
L ( x ) + g T ( x ) δ + 12 δ T H ( x ) δ + R 2 ( δ ) using Taylor series.
Thus, ∀ S (cid:48) ⊆
Ω ,
[Equation]
δ
[Equation]
where R S (cid:48) 2 ( δ ) denotes terms with elements in δ ( S (cid:48) ) of higher than the second order.
In this way, the Shapley interaction I ab is given as
I
[Equation]
δ
[Equation]
=   n
[Equation] [Equation]
S ⊆ Ω \{ a,b } , | S | =
s s !
( n − s − 2)!
( n − 1)!
[ δ a H ab ( x ) δ b ]   + ˆ R 2 ( δ ) =
(cid:40)
n − 2 (cid:88) s =
( n − 2)!
s !
( n − s − 2)!
s !
( n − s − 2)!
( n − 1)!
[ δ a H ab ( x ) δ b ] (cid:41) + ˆ R 2 ( δ ) =
δ a H ab ( x ) δ b + ˆ R 2 ( δ ) , where ˆ R 2 ( δ ) denotes terms with elements in δ of higher than the second order.
Lemma 2.
The update of the perturbation with the multi-step attack at step t deﬁned in Equation (14) can be written as ∆ x t multi = α
[ I + αH ( x )] t − 1 g
( x ) + ˆ R t 1 , where g ( x ) def = ∇ x (cid:96) ( h ( x ) , y ) represents the gradient, and H ( x ) def = ∇ 2 x (cid:96) ( h ( x ) , y ) represents the Hessian matrix.
ˆ R t 1 denotes terms with elements in δ t − 1 multi of higher than the ﬁrst order.
Proof.
If t = 1 , ∆ x 1 multi = α · g ( x ) .
Let ∀ t (cid:48) <
t, ∆ x t (cid:48)
multi =
α
[ I + αH ( x )] t (cid:48) − 1 g
( x ) + ˆ R t (cid:48) 1 , then we have
[Equation]
Equation
[Equation] [Equation]
where ˆ R t (cid:48) 1 denotes terms of elements in δ t (cid:48) − 1 multi of higher than the ﬁrst order.
Using the Taylor series, we get
[Equation]
where R t − 1denotes terms with elements δ t − 1 multi of higher than the ﬁrst order.
T ( x ) in Equation (16) is given as follows.
[Equation]
Multiply ( I + αH ( x )) on both sides of Equation (17), and we get
[Equation]
[Equation]
Then, according to Equation (18) and Equation (17), we get
[Equation]
[Equation]
Substituting Equation (19) back to Equation (16), we have
[Equation]
In this way, we have proved that ∀ t ≥ 1 , ∆ x
[Equation]
multi =
[Equation]
+
[Equation]
x
[Equation]
1 g
[Equation]
x
[Equation]
+ ˆ R t
[Equation]
Proposition 1.
The adversarial perturbation generated by the multi-step attack via gradient descent is given as δ m multi =
α (cid:80) m − 1 t =0 ∇ x (cid:96) ( h ( x + δ t multi ) , y ) , where δ t multi denotes the perturbation after the t -th step of updating, and m is referred to as the total number of steps.
The adversarial perturbation generated by the single-step attack is given as δ single = αm ∇ x (cid:96) ( h ( x ) , y ) .
The expectation of interactions between perturbation units in δ m multi , E a,b
[ I ab ( δ m multi )] , is larger than E a,b
[ I ab ( δ single )] , i.e. E a,b [ I ab ( δ m multi )] ≥ E a,b
[ I ab ( δ single )] .
E. F AIRNESS OF COMPARISONS OF INTERACTIONS INSIDE DIFFERENT PERTURBATIONS
Proposition 1 is valid for different loss functions of generating of adversarial perturbations.
In this section, we discuss the fairness of comparisons of interactions inside different perturbations.
When we compare interactions inside different perturbations, magnitudes of these perturbations should be similar, because the comparison of interactions between adversarial perturbations of different magnitudes is not fair.
For fair comparisons, in Section 3.1, this paper controls the magnitude of the single-step attack by setting the step size of the single-step attack as αm , where α and m denotes the step size and the total number of steps of the multi-step attack, respectively.
The equivalent step size αm makes the magnitude of perturbations generated by the single-step attack to be similar to that of perturbations generated by the multi-step attack, when we use the target score before the softmax layer to generate adversarial perturbations, such as ˜ (cid:96) ( h ( x ) , y ) = max y (cid:48) (cid:54) =
y h ( x ) − h y ( x ) .
In this case, the magnitude of the gradient ∇ x ˜ (cid:96) ( h ( x ) , y ) is relatively stable.
In particular, this type of loss has been widely used.
For example, one of the most widely used attacking (Carlini & Wagner, 2017), uses the score before the softmax layer for targeted attacking.
E. P ROOF OF P ROPOSITION
Proof.
According to Lemma 2, the update of the perturbation with the multi-step attack at the step t is given as follows.
[Equation]
where ˆ R t 1 denotes terms with elements in δ t − 1 multi of higher than the ﬁrst order, and α represents the step size.
To simplify the notation without causing ambiguity, we write g ( x ) and H ( x ) as g and H , respectively.
In this way, according to Equation (15) and Equation (20), δ m multi can be written as follows.
[Equation]
where m represents the total number of steps.
According to Lemma 1, the Shapley interaction between perturbation units a, b in δ m multi is given as follows.
[Equation]
(22) where ˆ R 2 ( δ m multi ) denotes terms with elements in δ m multi of higher than the second order.
According to Equation (21) and Equation (22)
[Equation]
we have
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
23) where R multi( H ) represents terms with elements in H of higher than the second order, and ˆ R (cid:48)
( δ m multi ) represents terms with elements in δ m multi of higher than the second order.
Let us consider the single-step attack.
When we compare interactions inside different perturbations, magnitudes of these perturbations should be similar, because the comparison of interactions between adversarial perturbations of different magnitudes is not fair.
For fair comparisons, in Section 3.1, this paper controls the magnitude of the single-step attack, as follows.
The single-step attack only uses the gradient information on the original input x , which generates adversarial perturbations as:
[Equation]
Therefore, according to Lemma 1, the interaction between perturbation units a, b of δ single is given as follows.
[Equation]
) where ˆ R 2 ( δ single ) denotes terms with elements in δ single of higher than the second order.
In this way, according to Equation (23) and Equation (24), the expectation of the difference between I ab ( δ m multi ) and I ab ( δ single ) is given as follows.
[Figure] [Figure]
[Equation]
[Figure]
[Equation] [Equation]
b g a (cid:48) )
(cid:124) (cid:123)(cid:122) (cid:125)
U ab + g b H ab n (cid:88) b (cid:48)
=
( H ab (cid:48)
g b (cid:48) )
(cid:124) (cid:123)(cid:122) (cid:125)
U ba 
 + E a,b [ R ab ] , where
[Equation]
Assumption 1 : Magnitudes of elements in the Hessian matrix H ( x ) is small that | H ab ( x ) |(cid:28) 1 , where 1 ≤ a, b ≤ n .
Therefore, H k ( x ) ≈ 0 , if k > 2 .
We verify the assumption by directly measuring the value of H ab ( x ) .
As Figure 4 (a) shows, the value of H ab ( x ) is very small that | H ab ( x ) |(cid:28) 1 .
According to Assumption 1, we have R multi( H ) ≈ 0 .
Note that the magnitude of δ m multi and the magnitude of δ single are small, then ˆ R (cid:48) 2 ( δ m multi ) ≈ 0 , and R 2 ( δ single )
≈ 0 .
In this way, we have
E a,b [ R ab ] =
E a,b [ ˆ R (cid:48) 2 ( δ m multi ) + R 2 ( δ single ) + R multi( H )] ≈ 0 .
Moreover, for the expectation of U ab , we have
E a,b [ U ab ] = n ( n − 1) n (cid:88)
b = (cid:88) a (cid:54)
=
b g a H ab n (cid:88) a (cid:48) =
( g a (cid:48) H a (cid:48) b )
[Figure]
[Equation]
B  
[Equation]
a (cid:48) =
[Equation]
b (cid:33) (cid:124) (cid:123)(cid:122) (cid:125)
A  
Let us focus on terms of A and B .
Note that A is the sum of n terms ( n is large).
In comparisons, B is just a single term in A .
Therefore, the sign of A − B is usually dominated by the term A .
In this way, we get Prob [ sign ( A − B )
= sign ( A )]
≈ 1 .
Therefore, Prob [( A − B )
A ≥ 0]
≈ 1 .
We verify this assumption by measuring the value of
[Equation]
[Equation] [Equation]
≈ 1 , then we have Prob [ sign ( A − B )
=
sign ( A )]
≈ 1 .
As Figure 4 (b) shows, the value of
[Equation]
is very small that |
[Equation]
1 g a H ab |(cid:28) 1 .
To this end, we have ( A − B ) B ≥ 0 , and we get
[Equation]
Due to the symmetry of a, b , we have E a,b
[ U ba ]
= E a,b [ U ab ] .
Therefore,
[Equation] [Equation]
E. V ERIFICATION OF P ROPOSITION
We verify that perturbations generated by the multi-step attack tend to exhibit larger interaction than those generated by the single-step attack by measuring the value of E b [ I ab ] .
As shown in
Appendix F, we prove that E b [ I ab ] = v (Ω) − v (Ω \ { a } ) − v ( { a } ) + v ( ∅ ) .
Because the image data is high-dimensional, the cost of computing
E b
[ I ab ] is high.
As Appendix J.1 demonstrates, given the input image, we can measure the interaction at the grid level, instead of the pixel level, to reduce the computational cost.
Therefore, we divide the input image into 16 ×
( L = 16 ) grids, and use
Equation (40) to compute the interaction as E ( p (cid:48) ,q (cid:48) ) (cid:2) I ( p,q ) , ( p (cid:48) q (cid:48) )
( δ ) (cid:3)
= v (Λ) − v (Λ \ { Λ pq } ) − v ( { Λ pq } ) + v ( ∅ ) , where ( p, q ) denotes the coordinate of a grid.
The experiments were conducted with ImageNet validation images on ResNet-32 and DenseNet-121.
For fair comparisons, the magnitude of perturbations generated by the single-step attack is controlled to be same as that generated by the multi-step attack.
As Figure 5 (left) shows, perturbations generated by the multi-step attack tend to exhibit larger interaction than those generated by the single-step attack.
E. P ERTURBATIONS GENERATED BY THE MULTI - STEP ATTACK TEND TO EXHIBIT LARGER INTERACTION THAN G AUSSIAN NOISE
Moreover, we compare the interaction inside perturbation units generated by the multi-step attack with the Gaussian noise perturbation.
Similarly, for fair comparisons, the magnitude of the Gaussian noise is controlled to be same as that generated by the multi-step attack.
As Figure 5 (right) shows, perturbations generated by the multi-step attack tend to exhibit larger interaction than Gaussian noise.
F E XPECTATION OF THE S HAPLEY I NTERACTION
In Equation (3), the Shapley interaction between two perturbation units i, j is given as follows.
[Equation]
where φ ( S ij | Ω \ { i, j } ∪ S ij ) is the Shapley value of the singleton unit S ij = { i, j } , when perturbation units i, j form a coalition.
φ ( i | Ω \ { j } ) and φ ( j | Ω \ { i } ) are Shapley values of perturbation units i, j , when these two perturbation units work individually.
In this way, we can write the Shapley interaction in a closed form as follows.
[Equation] [Equation]
where ∀ S ⊆ Ω , v ( S ) = max y (cid:48) (cid:54) =
y h ( s ) y (cid:48)
( x + δ ( S ) )
− h
( s ) y
( x + δ ( S ) ) .
The expectation of interaction is given as follows.
[Equation] [Equation]
which is proved as follows.
Proof.
As proved in Appendix D
[Equation]
I ij ( δ ) =
I (cid:48) ij ( δ ) .
Therefore, the interaction between players i and j is given as follows.
[Equation]
The expectation of the interaction can be written as follows.
[Equation]
According to the efﬁciency property of Shapley values (please refer to Appendix A.1 for details):
[Equation]
In this way
[Equation]
E
[Equation]
G D ETAILS OF OBSERVING THE NEGATIVE CORRELATION BETWEEN THE TRANSFERABILITY AND THE INTERACTION
In Section 3.2, we directly measure the transfer utility and interactions of different adversarial perturbations.
Here, we give more details of the experiments.
We measure the transfer utility as
Transfer Utility = [max y (cid:48) (cid:54) =
y h ( t ) y (cid:48)
( x + δ ) − h
( t ) y ( x + δ )] − [max y (cid:48)
(cid:54) =
y h ( t ) y (cid:48)
( x ) − h ( t ) y
( x )] .
We measure the interaction as E i,j
[ I ij ( δ )]
= 1 n − 1 E i [ v (Ω) − v (Ω \ { i } ) − v ( { i } ) + v ( ∅ )] .
As Appendix J. demonstrates, to reduce the computational cost, given the input image, we can measure the interaction at the grid level, instead of the pixel level.
Therefore, we divide the input image into 16 ×( L = 16 ) grids, and use Equation (40) to compute the interaction as E ( p,q ) , ( p (cid:48) ,q (cid:48) ) (cid:2)
I ( p,q ) , ( p (cid:48) q (cid:48) )
( δ ) (cid:3) =
L 2 − 1 E ( p,q ) [ v (Λ) − v (Λ \ { Λ pq } ) − v ( { Λ pq } ) + v ( ∅ )] , where ( p, q ) denotes the coordinate of a grid.
Using the validation set of the ImageNet dataset (Russakovsky et al., 2015), we generate adversarial perturbations on four types of DNNs, including ResNet-34/152(RN-34/152)
(He et al., 2016) and
DenseNet-121/201(DN-121/201) (Huang et al., 2017).
We transfer adversarial perturbations generated on each ResNet to DenseNets.
Similarly, we also transfer adversarial perturbations generated on each DenseNet to ResNets.
Given an input image x , adversarial perturbations are generated using
Equation (8), i.e. min δ − (cid:96) ( h ( x + δ ) , y ) + c · (cid:107) δ (cid:107) pp s.t. x + δ ∈ [0 , 1] n , where c ∈ R is a scalar constant.
In this way, we gradually change the value of c as different hyper-parameters to generate different adversarial perturbations.
For fair comparisons, we need to ensure adversarial perturbations generated with different hyper-parameters c to be comparable with each other.
Thus, we select a constant τ and let (cid:107) δ (cid:107) 2 = τ as the stopping criteria of all adversarial attacks.
We set the number of steps as 1000.
The threshold τ is set to ensure that attacks with different hyper-parameters τ are almost converged when the L 2 norm of the perturbation (cid:107) δ (cid:107) 2 reaches τ .
H P ROOF OF P ROPOSITION
To simplify the problem setting, we do not consider some tricks in adversarial attacking, such as gradient normalization and the clip operation.
In VR attack (Wu et al., 2018) , the ﬁnal perturbation generated after t steps is given as follows.
[Equation]
where
[Equation]
According to Equation (28), the gradient and the Hessian matrix of ˆ (cid:96) ( h ( x ) , y ) is given as follows.
[Equation]
where α represents the step size.
Lemma 3.
Given the Gaussian smoothed loss ˆ
[Equation]
=
E
[Equation]
[ (cid:96) ( h ( x ) , y )] , where (cid:96) ( h ( x ) , y ) is the original classiﬁcation loss, ∀ a (cid:54)
= b, ∀ c (cid:54) =
a , we have
E x (cid:104) ˆ g 2 a ( x ) ˆ H 2 ab ( x ) − g 2 a ( x ) H 2 ab ( x ) (cid:105) ≤ 0 , E x (cid:104)
ˆ g a ( x )ˆ g b ( x ) ˆ H ab ( x ) − g a ( x ) g b ( x ) H ab ( x ) (cid:105) = 0 , and E x (cid:104) ˆ g a ( x )ˆ g c ( x ) ˆ H ab ( x ) ˆ H cb
( x ) − g a ( x ) g c ( x ) H ab ( x ) H cb ( x ) (cid:105) = 0 .
Proof.
According to Equation (29), we have ˆ g a
x ) =
E ξ ∼N (0 ,σ 2 I )
[ g a ( x + ξ )]
=
E x (cid:48)
∼N ( x,σ 2 I ) [ g a ( x (cid:48) )] , ˆ H ab ( x ) =
E ξ ∼N (0 ,σ 2 I ) (cid:20) ∂g a ( x + ξ ) ∂x b (cid:21) =
E x (cid:48)
∼N ( x,σ 2 I ) (cid:20) ∂g
a ( x (cid:48) )
∂x b (cid:21) =
E x (cid:48)
∼N ( x,σ 2 I )
[ H ab ( x (cid:48) )] .
This indicates that the gradient and the Hessian matrix in the VR attack are both smoothed by the Gaussian noise.
Because the Lipschitz constants of g a ( x ) and H ab ( x ) are usually limited to a certain range, we can ignore the tiny probability of large gradients and large elements in the Hessian matrix, and roughly assume that g a ( x ) ∼ N (ˆ g a ( x ) , σ 2 g a ) , and H ab ( x ) ∼ N ( ˆ H ab ( x ) , σ 2 H ab ) , where σ g a , σ H ab ∈ R are tow constants denoting the standard deviation.
Thus, g a ( x ) and H ab ( x ) can be written as follows.
[Equation]
To simplify the notation without causing ambiguity, we write ˆ g ( x ) and ˆ H ( x ) as ˆ g and ˆ H , respectively.
Moreover, we write g ( x ) and H ( x ) as g and H , respectively.
In this way, we have
[Equation]
According to Equation (30)
[Equation]
we have g a =
ˆ g a + (cid:15) g a , g b
= ˆ g b + (cid:15) g b .
Thus
[Equation]
we have
[Equation]
Moreover
[Equation]
according to Equation (30)
[Equation]
we have
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation] [Table] [Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
=
[Equation]
Proposition 2.
The adversarial perturbation generated by multi-step attack is denoted by δ m multi = α (cid:80) m − 1 t =0 ∇ x (cid:96) ( h ( x + δ t multi ) , y ) .
The adversarial perturbation generated by VR Attack is denoted by δ m vr = α (cid:80) m
− 1 t =0 ∇ x ˆ (cid:96) ( h ( x + δ t vr ) , y ) , where ˆ (cid:96) ( h ( x + δ t vr ) , y ) =
E ξ ∼N (0 ,σ 2 I ) [ (cid:96) ( h ( x + δ t vr + ξ ) , y )] .
Perturbation units of δ m vr tend to exhibit smaller interaction than δ m multi , i.e. E x E a,b
[ I ab ( δ m vr )] ≤ E x E a,b
[ I ab ( δ m multi )] .
Proof.
To simplify the notation without causing ambiguity, we write ˆ g ( x ) and ˆ H ( x ) as ˆ g and ˆ H , respectively.
Moreover, we write g ( x ) and H ( x ) as g and H , respectively.
Just like the conclusion in Equation (23), we can write the interaction between δ m vr ,a and δ m vr ,b as follows.
[Equation]
where α denotes the step size, and m denotes the total number of steps.
To enable fair comparisons, we use the same step size α and number of steps m as multi-step attack to make the magnitude of δ vr match the magnitude of δ multi .
R vr 2 ( ˆ H ) represents terms with elements in ˆ H of higher than the second order, and ˆ R vr 2 ( δ m vr ) represents terms with elements in δ m vr of higher than the second order.
In this way, according to Equation (31) and Equation (23), the expectation of the difference between
I ab ( δ m vr ) and I ab ( δ m multi ) is given as follows.
[Equation]
where
[Equation]
The expectation of R vr ab is give as follows.
[Equation]
According to Assumption
[Equation]
we have R vr 2 ( H ) ≈ 0 , and R multi( H ) ≈ 0 .
Note that the magnitude of δ m mi and the magnitude of δ multi are small, then ˆ R (cid:48) 2 ( δ m vr ) ≈ 0 , and R 2 ( δ m multi ) ≈ 0 .
According to
Lemma 3, we have E x (cid:104)
ˆ g a ˆ g b ˆ H ab − g a g b H ab (cid:105) = 0 , E x (cid:104) (ˆ g a ˆ g a (cid:48)
ˆ H ab
ˆ H a (cid:48)
b − g a g a (cid:48)
H ab H a (cid:48) b ) (cid:105) = 0 .
Therefore, we get E x [ V ab ] = 0 .
In this way, E x E a,b [ R vr ab ] ≈ 0 .
Furthermore, according to Lemma 3, we have E x (cid:104) ˆ g 2 a ˆ H 2 ab (cid:105) − E x (cid:2) g 2 a H 2 ab (cid:3) ≤ 0 .
Therefore,
[Equation]
I P ROOF OF P ROPOSITION
To simplify the problem setting, we do not consider some tricks in adversarial attacking, such as gradient normalization and the clip operation.
Note that the original MI Attack and the multi-step attack cannot be directly compared, since that magnitudes of the generated perturbations cannot be fairly controlled.
The value of interactions is sensitive to the magnitude of perturbations.
Comparing perturbations with different magnitudes is not fair.
Thus, we slightly revise the MI Attack as
[Equation] [Equation]
where t denotes the step and µ = ( t − 1) /t .
(cid:96) ( h ( x ) , y ) is referred as the classiﬁcation loss.
To simplify the notation, we use g ( x ) to denote ∇ x (cid:96) ( h ( x ) , y ) , i.e. g ( x ) def = ∇ x (cid:96) ( h ( x ) , y ) .
In MI attack, the ﬁnal perturbation generated after t steps is given as follows.
[Equation]
where α represents the step size.
Furthermore, we deﬁne the update of perturbation with the MI attack at each step t as follows.
[Equation]
In this way, the perturbation can be written as follows.
[Equation]
Lemma 4.
The update of the perturbation with the MI attack at step t deﬁned in Equation (33) can be written as ∆ x t mi = α (cid:2)
I + α t − 12 H ( x ) + R t 1 ( H ( x )) (cid:3) g ( x ) + ˜ R t 1 , where R t 1 ( H ( x )) denotes terms of elements in H ( x ) higher than the ﬁrst order, and ˜ R t 1 denotes terms with elements in δ t − 1 mi of higher than the ﬁrst order.
Proof.
If t = 1 , ∆ x 1 mi = α · g ( x ) .
Let ∀ t
[Equation]
[Equation]
According to Equation (32) and Equation (33), we have
[Equation]
Applying the Taylor series to the term of g ( x + δ t − 1 mi ) , we get
[Equation]
where r t − 1denotes terms of elements in δ t − 1 mi of higher than the ﬁrst order.
According to Equation (34) and Equation (35), we get ∆ x t mi = α · (cid:26) t −t g
[Equation]
∆
[Equation]
− 1(cid:27) .
Because ∀ t (cid:48) < t ∆ x t (cid:48) mi
= α (cid:104)
I + α t (cid:48) − 1 2 H ( x ) + R t (cid:48)
( H ( x ))
(cid:105) g
( x ) + ˜ R t (cid:48) 1 , we have ∆ x t − 1 mi = α · (cid:2)
I + α t − 22 H ( x ) + R t − 1 1 ( H ( x )) (cid:3) g
( x ) + ˜ R t − 1 2 .
According to Equation (33), we get g t − 1 mi = (cid:2)
I + α t − 2 2 H ( x ) + R t − 1 1 ( H ( x )) (cid:3) g ( x ) + ˜ R t − 1 2 .
In this way, we get
[Equation]
where R t 1 ( H ( x )) denotes terms of elements in H ( x ) higher than the ﬁrst order, and ˜ R t 1 denotes terms with elements in δ t − 1 mi of higher than the ﬁrst order.
In this way, we have proved that ∀ t ≥ 1 , ∆ x t mi = α (cid:2)
I + α t − 12 H ( x ) + R t 1 ( H ( x )) (cid:3) g ( x ) + ˜ R t 1 .
Proposition 3.
The adversarial perturbation generated by multi-step attack is denoted by δ m multi = α (cid:80) m − 1 t =0 ∇ x (cid:96) ( h ( x + δ t multi ) , y ) .
The adversarial perturbation generated by multi-step attack incorporating the momentum is computed as δ m mi = α (cid:80) m
− 1 t =
g t mi Perturbation units of δ m mi exhibit smaller interactions than δ m multi , i.e. E ij [ I ij ( δ m mi )] ≤ E ij [ I ij ( δ m multi )] .
Proof.
According to Lemma 4, the update of the perturbation with the MI attack at the step t is given as follows.
[Equation]
where R t 1 ( H ( x )) denotes terms of elements in H ( x ) of higher than the ﬁrst order.
˜ R t 1 denotes terms with elements in δ t − 1 mi of higher than the ﬁrst order.
To simplify the notation without causing ambiguity, we write g ( x ) and H ( x ) as g and H , respectively.
In this way, according to Equation (34) and Equation (36), δ m mi can be written as follows.
[Equation]
where m represents the total number of steps.
According to Lemma 1, the Shapley interaction between perturbation units a, b in δ m mi is given as follows.
[Equation] [Equation]
where ˜ R 2 ( δ m mi ) denotes terms with elements in δ mi of higher than the second order.
According to Equation (37) and Equation (38)
[Equation]
we get
[Equation]
terms of
[Equation]
a
[Table]
higher than
[Table]
order,
[Table]
˜ R t 1 in Equation (
[Table]
[Equation]
t =
[Table]
[Equation]
terms
[Table]
[Equation]
[Table] [Table]
[Equation]
r
[Equation]
[Table]
[Equation]
[Table]
[Equation]
where R mi 2 ( H ) denotes terms of elements in H higher than the second order
[Equation]
and ˜ R (cid:48) 2 ( δ m mi ) denotes terms of elements in δ m mi higher than the second order
According to Equation (23) and Equation (39)
[Equation]
the expectation of the difference between I ab ( δ m mi ) and I ab ( δ m multi ) is given as follows.
[Equation]
H a (cid:48)
b g a (cid:48) )
(cid:124) (cid:123)(cid:122) (cid:125)
U ab + g b H ab n (cid:88) b (cid:48)
=
( H ab (cid:48)
g b (cid:48) )
(cid:124) (cid:123)(cid:122) (cid:125)
U ba (cid:105) + E a,b (cid:2) R mi ab (cid:3) , where
[Equation]
According to Assumption 1, we have R mi 2 ( H ) ≈ 0 , and R multi( H ) ≈ 0 .
Note that the magnitude of δ m mi and the magnitude of δ m multi are small, then ˜ R (cid:48) 2 ( δ m mi ) ≈ 0 , and R 2 ( δ m multi ) ≈ 0 .
Therefore,
E a,b (cid:2) R mi ab (cid:3) =
E a,b [ ˆ R (cid:48) 2 ( δ m mi ) − ˜ R (cid:48)
( δ m multi ) + R mi 2 ( H ) − R multi
( H )]
≈ 0 .
Moreover, similar to Equation (25) in the proof of Proposition 1, we have E a,b
[ U ab ] =
E a,b
[ U ba ] ≥ 0 .
Therefore,
[Equation] [Equation]
Note that Proposition 3 just shows the revised MI Attack usually decreases the interaction between perturbation units.
The proof towards all types of MI Attacks is still a challenge.
J I MPLEMENTATION OF THE I NTERACTION -R EDUCED A TTACK (IR A TTACK ) J. G RID - LEVEL INTERACTIONS FOR IMAGE DATA
Although the computation of E i,j [ I ij ( δ )] can be simpliﬁed using Equation (27), the computational cost of E i,j [ I ij ( δ )] is still high.
Therefore, as Figure 6 shows, using the local property of images (Chen et al., 2018a), we can divide the entire image into L × L grids, and compute interactions at the grid level, instead of the pixel level.
Let Λ = { Λ 11 , Λ 12 , . . .
, Λ LL } denote the set of grids.
We use ( p, q ) to denote the coordinate of a grid.
In this way, the expectation of interactions between perturbation grids is given as follows.
[Equation]
[Figure]
J. S AMPLING METHOD
As Appendix J.1 mentions, to reduce the computational cost, we can measure interactions between grids, instead of input units (pixels).
We divide the entire input image x into L × L grids, denoted by Λ = { Λ 11 , Λ 12 , . . .
, Λ LL } .
Moreover, we use a sampling method to further reduce the computational cost in a batch manner.
In each batch, we approximate the expectation of the interaction as follows.
E
[Equation]
In this way
[Equation]
Equation (5) can be approximated as
[Equation]
where K denotes the sampling times, and Λ batch
⊆ Λ is a random set with batchsize grids.
As a toy example, Λ batch = { Λ 11 , Λ 35 , Λ 97 } has batchsize = 3 .
In our experiments, we set L = 16 ,
K = 32 , and batchsize = 32 .
Note that we omit the constant 1 L 2 − 1 in the interaction loss for simplicity.
J. S CALABILITY OF THE INTERACTION LOSS
In this section, we discuss about two kinds of scalability of the interaction loss.
• Is the computational cost of the interaction loss affordable when the number of players is large?
To this end, we have
proved
in Equation (
that the computational complexity of the expectation of the interaction is linear, which is scalable.
In fact, we do not directly compute interaction using Equation (3).
Instead, we compute the expectation of interactions with Equation (4).
As Equation (42) shows, the computational cost of the IR Attack can be further reduced by calculating the grid-level interactions of images and using the sampling method
We further conducted experiments to measure the time cost of generating perturbations using the
IR Attack.
We conducted the IR attack for 100 steps on the ImageNet dataset.
The time cost was measured using PyTorch 1.6 (Paszke et al., 2019) on Ubuntu 18.04, with the Intel(R) Core(TM) i7-9800X CPU @ 3.80GHz and a Titan RTX GPU.
Table 6 shows the average computational cost of generating adversarial perturbations on an input image with size 224 × 224 by the IR Attack for 100 steps.
It shows that the IR Attack is computationally applicable to high-dimensional data and deep neural networks.
[Table]
• Is the computation cost of the interaction loss affordable when we
consider the continuous space of adversarial perturbations?
It has been widely discussed (Ancona et al., 2019; Sundararajan & Najmi, 2019) that when applying the Shapley value, the feature space is regarded as binary.
It is because as (Sundararajan & Najmi, 2019) shows that although there exist the Shapley-value-like attribution in a continuous space, only the Shapley value in the binary space is the unique attribution that satisﬁes the linearity axiom, the dummy axiom, the symmetry axiom, and the efﬁciency axiom that only in the binary space.
Thus, when we compute the interaction, the perturbation can be regarded in the binary space, i.e., whether the perturbation unit is added to the input or not, which enables scalability.
K E VALUATION OF THE TRANSFERABILITY VIA LEAVE - ONE - OUT VALIDATION
As Figure 7 shows, the highest transferability of the MI Attack is achieved in an intermediate step, rather than in the last step.
This phenomenon presents a challenge for fair comparisons of the transferability between different attacking methods.
To this end, in order to enable fair comparisons of transferability between different methods, we estimate the adversarial perturbations with the highest transferability for each input image via the leave-one-out (LOO) validation as follows.
Given a set of clean examples { ( x i , y i ) } Ni =1 , where y i ∈ { 1 , 2 , . . .
, C } , we use x ti to denote the adversarial example at step t w.r.t.
the clean example x i , where t ∈ { 1 , 2 , . .
. , T } , and T is the number of total step.
Given a target DNN h ( · ) and an input example x , where h ( · ) denotes the output before the softmax layer, we use
C ( x ) =
arg max k h k ( x ) , k ∈ { 1 , . . .
, C } to denote the prediction of the example x .
[Equation]
where 1 [ · ] is the indicator function.
Then the average transferability is given as follows.
[Equation]
[Figure]
L A DDITIONAL R ELATED W ORK
Some studies paid attention to intermediate features to improve transferability.
Activation Attack (Inkawhich et al., 2019) forced the intermediate features of the input image to be similar with the intermediate features of a target image, in order to generate highly transferable targeted example.
Distribution Attack (Inkawhich et al., 2020) explicitly modeled the feature distribution of each class, and improve the targeted transferability by driving the feature of perturbed input image into the distribution of a speciﬁc target class.
Intermediate Level Attack (Huang et al., 2019) improved the transferability of an adversarial example by maximizing the feature perturbation of a pre-speciﬁed layer.
In comparison, we explain and improve the transferability based on game theory.
Moreover, we discover the negative correlation between the transferability and interactions.
M A DDITIONAL V ISUALIZATIONS OF I NTERACTIONS
Figure 2 visualizes interactions between adjacent perturbation units generated with and without the interaction loss.
Here, Figure 8 provides more visualization results of interactions between adjacent perturbation units.
[Figure]
where N i denotes the set of adjacent perturbation units of the perturbation unit i .
Here, we ignore interactions between non-adjacent units to simplify the visualization.
It is because adjacent units usually encode much more signiﬁcant interactions than other units.
The interaction loss forces the perturbation to encode more negative interactions.
N A DDITIONAL E XPERIMENTS ON I NTERACTION -R EDUCED L OSS N. I NTERACTION R EDUCTION ON O THER A TTACKS
To further demonstrate the effectiveness of the interaction loss, we have applied the interaction loss on other attacks besides the PGD Attack, including the MI Attack, the SGM Attack, and the
VR Attack.
More speciﬁcally, we added the interaction loss on the MI Attack (namely the MI+IR
Attack), the SGM Attack (namely the SGM+IR Attack), and the VR Attack (namely the VR+IR
Attack), respectively.
For the MI Attack and the SGM Attack, we directly applied Equation (7) to these attacks, because these attacks were compatible with the interaction loss.
Besides, for the VR Attack, its objective function is given as follows.
[Equation]
Therefore, the VR+IR Attack was implemented via sampling as follows.
[Equation]
where the interaction loss was computed by considering the input image as x + ξ k , rather than x in Equation (27).
The VR Attack reported in Table 4 followed the original paper (Wu et al., 2018) to set K = 20 .
However, a crucial issue for applying the interaction loss to the VR attack was its extremely high computational cost.
Therefore, for the implementation of the VR+IR Attack, we set
K = 5 and reduce the number of steps from 100 to 50.
Just like experiments in Table 1, we also used the LOO strategy for evaluation.
Table 7, Table
[Table]
and Table 9 compare the success rates of attacks with and without the interaction loss.
The results demonstrated that the performance of the MI Attack, the SGM Attack, and the VR
Attack can be further enhanced by directly adding the interaction loss to reduce interactions inside perturbations.
[Table]
[Table] [Table]
N. A TTACKS ON THE CIFAR-10 DATASET
In Table 1, we have shown that reduction of interactions could improve the adversarial transferability on the ImageNet dataset (Russakovsky et al., 2015).
To further demonstrate the broad applicability of such a negative correlation, we also conducted the targeted attack on the CIFARdataset (Krizhevsky & Hinton, 2009) to test the transferability of perturbations generated with the interaction loss.
Following Wu et al.
(2018), we chose three DNNs as the source DNN or the target DNN, which included: LeNet (LeCun et al., 1998), RN-20 (He et al., 2016), and DN-121 (Huang et al., 2017).
We conducted the targeted attack under the L ∞ norm constraint, and chose he plane class as the target category.
The norm constraint (cid:15) was set to 16/255, and the step size was set to 2/255.
The transferability was computed based on the best adversarial perturbation during 50 steps via the leaveone-out (LOO) validation., which has been introduced in Appendix K.
As Table 10 shows, the transferability could be enhanced by reducing interactions on the targeted attack on the CIFAR-10 dataset.
Particularly, when the source DNN is RN-20 and the target DNN is DN-121, the transferability improvement was about 30%, which was a considerable gain.
[Table]
[Table]
O E MPIRICAL V ERIFICATION OF O THER T RANSFERABILITY - BOOSTING A TTACKS
We have theoretically analyzed the MI Attack, the VR Attack [Table] and the SGM Attack.
However, for other methods of improving adversarial transferability, such as Diversity Input (DI) (Xie et al., 2019), which uses random data augmentation during attacking, it is difﬁcult to mathematically prove that they essentially reduce interactions.
Nevertheless, as Table 11 shows, we empirically demonstrated that two widely-used transferability-boosting attacks, DI and TI (Dong et al., 2019), also reduced interactions.
P A DDITIONAL E XPERIMENTS ON E FFECTS OF THE I NTERACTION L OSS
We conducted additional experiments to test the effects of the interaction loss.
We conducted attacks on two source DNNs (RN-34, DN-121), and transferred adversarial perturbations to seven target
DNNs (VGG16, RN-152, DN-201, SE-154, IncV3, IncV4, IncResV2).
We used the following two experimental settings to compare the transferability of adversarial perturbations generated with different λ values.
First, we re-drew the curves in Figure 3(a) by extending the λ from the range [0 , 1 . 2] to the range of [0 , 2 . 0] , in order to show the performance of different λ values.
We simply changed the λ value in the objective function (i.e. Equation (5)) without any other revisions.
This was the most direct way to test the effects of λ .
Experimental results are shown in Figure 9.
Besides above experimental settings, we also compared adversarial perturbations generated with different λ values, when we controlled each perturbation to have the same attacking utility.
The attacking utility was deﬁned as follows.
[Equation]
where y denote the label of the input image x .
This setting also ensured the fairness of comparisons from a new perspective.
Please see Figure 10 for experimental results.
In sum, under both experimental settings, we found that the large λ value usually yielded a high adversarial transferability in our experiments.
[Figure]
[Figure]
IR Attack different values of λ under second