Enhancing Adversarial Transferability via Information Bottleneck Constraints

TL;DR

This paper introduces IBTA, a novel framework that enhances the transferability of adversarial attacks by leveraging information bottleneck theory to focus on invariant features, supported by a new mutual information approximation method.

Contribution

It proposes a new IB-based framework for transferable adversarial attacks, including a mutual information lower bound and evaluation with neural estimators.

Findings

IBTA improves attack transferability on ImageNet

MILB efficiently approximates mutual information

Experimental results validate scalability and effectiveness

Abstract

From the perspective of information bottleneck (IB) theory, we propose a novel framework for performing black-box transferable adversarial attacks named IBTA, which leverages advancements in invariant features. Intuitively, diminishing the reliance of adversarial perturbations on the original data, under equivalent attack performance constraints, encourages a greater reliance on invariant features that contributes most to classification, thereby enhancing the transferability of adversarial attacks. Building on this motivation, we redefine the optimization of transferable attacks using a novel theoretical framework that centers around IB. Specifically, to overcome the challenge of unoptimizable mutual information, we propose a simple and efficient mutual information lower bound (MILB) for approximating computation. Moreover, to quantitatively evaluate mutual information, we utilize the Mutual Information Neural Estimator (MINE) to perform a thorough analysis. Our experiments on the ImageNet dataset well demonstrate the efficiency and scalability of IBTA and derived MILB. Our code is available at https://github.com/Biqing-Qi/Enhancing-Adversarial-Transferability-via-Information-Bottleneck-Constraints.