Disrupting adversarial transferability in deep neural networks.

Area of Science:

• Artificial Intelligence
• Machine Learning
• Deep Learning

Background:

• Adversarial attack transferability is a known phenomenon in deep learning.
• Existing explanations focus on common adversarial subspaces and decision boundary correlations, but are incomplete.

Purpose of the Study:

• To investigate the underlying reasons for adversarial attack transferability between different deep learning models.
• To propose a method for reducing adversarial attack transferability by encouraging semantically different feature representations.

Main Methods:

• Proposed that high linear correlation between extracted feature sets drives transferability.
• Introduced a feature correlation loss to decorrelate latent space features.
• Developed a dual-neck autoencoder (DNA) model incorporating this loss.

Main Results:

• Demonstrated that linear correlation between feature sets is a key factor in adversarial transferability.
• Showed that feature correlation loss effectively reduces adversarial attack transferability.
• The proposed DNA model generates meaningfully different encodings with reduced transferability.

Conclusions:

• Adversarial transferability is linked to shared feature extraction patterns, often connected by simple affine transformations.
• Manipulating feature correlation offers a viable strategy to enhance model robustness and differentiate model representations.
• The DNA model provides a novel approach for creating distinct feature encodings, impacting adversarial robustness.