Understanding Model Ensemble in Transferable Adversarial Attack