A Unified Approach to Interpreting and Boosting Adversarial Transferability

In this paper, we use the interaction inside adversarial perturbations to explain and boost the adversarial transferability. We discover and prove the negative correlation between the adversarial transferability and the interaction inside adversarial perturbations. The negative correlation is further verified through different DNNs with various inputs. Moreover, this negative correlation can be regarded as a unified perspective to understand current transferability-boosting methods. To this end, we prove that some classic methods of enhancing the transferability essentially decease interactions inside adversarial perturbations. Based on this, we propose to directly penalize interactions during the attacking process, which significantly improves the adversarial transferability. Adversarial examples of deep neural networks (DNNs) have attracted increasing attention in recent years (Carlini & Wagner, 2017; Madry et al., 2018). Goodfellow et al. (2014); Liu et al. (2016) explored the transferability of adversarial perturbations, and used perturbations generated on a source DNN to attack other target DNNs. Although many methods have been proposed to enhance the transferability of adversarial perturbations (Dong et al., 2018; Wu et al., 2018; 2020), the essence of the improvement of the transferability is still unclear. This paper considers the interaction inside adversarial perturbations as a new perspective to interpret adversarial transferability. Interactions inside adversarial perturbations are defined in game theory (Michel & Marc, 1999; Shapley, 1953). Each unit in the perturbation map is termed a perturbation unit. In this paper, we discover and partially prove the strong negative correlation between the transferability and the interaction between adversarial perturbation units, i.e. adversarial perturbations with lower transferability tend to exhibit larger interactions between perturbation units.