|  Hyperbranched DNA clusters†
---|---
|  Enrico Lattuada,a Debora Caprara,a Vincenzo Lamberti,a and Francesco
Sciortinoa
|  Taking advantage of the base-pairing specificity and tunability of DNA
interactions, we investigate the spontaneous formation of hyperbranched
clusters starting from purposely designed DNA tetravalent nanostar monomers,
encoding in their four sticky-ends the desired binding rules. Specifically, we
combine molecular dynamics simulations and Dynamic Light Scattering
experiments to follow the aggregation process of the DNA nanostars at
different concentrations and temperatures. At odd with the Flory-Stockmayer
predictions, we find that, even when all possible bonds are formed, the system
does not reach percolation due to the presence of intracluster bonds. We
present an extension of the Flory-Stockmayer theory that properly describes
the numerical and the experimental results.

##

††footnotetext: a Physics Department, Sapienza University, P.le Aldo Moro 5,
00185, Rome, Italy.††footnotetext: † Electronic Supplementary Information
(ESI) available: [details of any supplementary information available should be
included here]. See DOI: 00.0000/00000000.

In recent years, the relation between reversible self-assembly of patchy
colloidal particles and irreversible aggregation of chemical units is
receiving a renewed interest 1, 2. This connection has been nourished by the
observation that the clusters considered in the Wertheim theory for
associating liquids 3, 4 are the same loopless clusters considered in the
Flory-Stockmayer (FS) theory of polyfunctional condensation 5, 6. For example,
the conditions for the formation of infinite networks, valid for describing
the self-condensation of $f$-functional $A_{f}$ monomers, are identical to the
ones for identical colloids with $f$ patches. In contrast to the chemical
case, for which equilibrium conditions are assumed – but hardly realizable in
experiments due to the covalent nature of the bonds –, colloidal aggregation
may proceed to equilibrium, allowing for a more accurate control of the
theoretical FS predictions.

For the case of identical colloids with $f$ patches, there are evidences that
the range of validity of the FS predictions becomes wider and wider on
decreasing $f$ 7, 8. For binary mixtures of very small average “valence”
$\langle f\rangle$, the FS predictions provide a quite accurate description of
the cluster size distribution, except for bond probabilities very close to the
percolation threshold (itself properly predicted theoretically) 1. For this
reason, patchy colloidal particles have become a test ground for revisiting
the old FS predictions in proper equilibrium conditions. Furthermore, they
provided a way to access the role of the bonding loops (_i.e._ close paths of
bonds), which are commonly neglected both in FS and Wertheim theories.

An interesting aggregation phenomenon takes place in one-component systems
made of monomers of $AB_{f-1}$ type∗††footnotetext: ∗ The $AB_{f-1}$ monomer
can also be indicated as $A-R-B_{f-1}$ or $ARB_{f-1}$., where the $A$ site
condenses with $B$ but reactions between like functional groups ($AA$ and
$BB$) are forbidden. The clusters resulting from this aggregation process are
commonly known as _hyperbranched_ polymers, a term introduced by Kim and
Webster in their works on the synthesis of highly branched polymers 9, 10. In
the last decades, the interest towards the synthesis and understanding of
these materials has continuously grown, representing a challenge for
innovative applications. Hyperbranched polymers constitute an appealing
alternative to dendrimers, owing to their facile synthesis and high tunability
11, 12. Similarly to other branched polymers, they are characterized by high
exposure of functional groups, three-dimensional globular structure, low
viscosity, and good solubility 13, 14. Potential applications include surface
coating 15, use as filler in composite materials to increase the thermal and
mechanical stability 16, drug and gene delivery 17, 18, 19, 20, 21, grafting
on nanoparticles for diagnostic imaging to reduce the toxicity 22, 23, and
sensors 24, 25, 26.

From the theoretical standpoint, the aggregation of $AB_{f-1}$ units is
particularly interesting for several reasons: (i) it is analytically tractable
(neglecting the formation of closed bond loops); (ii) the cluster size
distributions for branched polymers are requested as an intermediate step in
the evaluation of several polyfunctional condensation processes; (iii) it
gives rise, according to the FS theory, to an aggregation phenomenon in which
the fully bonded case (when all $A$ sites have reacted) corresponds to the
percolation transition. Therefore, hyperbranched polymers do not have a gel
phase, but only a sol one.

Despite its interest, an accurate comparison between FS theoretical
predictions and numerical and experimental results in the case of hyperbrached
polymers has rarely been attempted 27, 28. Actually, the hypothesis of absence
of intramolecular reactions is expected to get progressively worse for large
degrees of polymerization. In fact, an unreacted $A$ will most likely interact
with one of the (nearby) $B$ sites belonging to the same cluster, hence
forming closed loops. As a result, the cluster size distribution of
hyperbranched polymers may not follow the FS predictions.

In line with the conceptual framework of colloids/reacting monomers, we
present here a combined numerical and experimental study of a colloidal analog
of the $AB_{f-1}$ hyperbranching condensation. In particular, we design
specific DNA oligomers able to self-assemble into bulk quantities of identical
four-armed particles which can interact in a controlled way 29, 30, 31, 32. We
exploit molecular dynamics (MD) simulations based on the oxDNA2 coarse-grained
interaction potential 33, 34 to follow the particle aggregation process and to
compare the numerical results with theoretical predictions. This numerical
study allows us to estimate the role of intramolecular binding and how the
presence of closed loops modifies the cluster size distribution. We then
demonstrate that a cluster-based thermodynamic treatment, which includes also
intracluster bonds, can be developed to extend the FS theory in order to
accurately describe the simulation data and to provide a significant guide to
the experimental results. Finally, we realize the same system in the
laboratory and follow the aggregation process via Dynamic Light Scattering
(DLS) to provide evidence that the presence of intracluster bonds prevents the
formation of a percolating state, even in the limit of full bonding.

## The DNA particle

Fig. 1: (a) Oligonucleotide composition of the strands comprising the
tetravalent monomer. Colors correspond to sequence pairings forming the
double-stranded monomer arms, shown in (b). The last 9 bases are the $A$ (red)
and $B$ (blue) sticky-end sequences, respectively. (c) NS-NS binding via the
9-base long DNA sequences, located at the tips. (d-e) Corresponding images
generated from oxDNA configurations.

In the last years, the ideas born with DNA nanotechnology 35, 36 have been
borrowed by the soft matter community to synthesize bulk quantities of
nanometric particles with controlled shape and binding properties 37, 29, 30,
32, 38, including dendrimers 12. The particles we envision in this study are
assembled starting from four distinct DNA oligomers, each composed by 52
nucleotides, containing properly designed sequences of complementary groups
(see Fig. 1a). The self-assembly of these strands generates a well-defined
nanostar (NS), composed of four double-stranded arms of 20 base pairs
departing from a flexible core of 8 unpaired adenines, which provides
flexibility to the particles (Fig. 1b,d). Each arm terminates with a 9-base
long single-stranded sticky sequence preceded by an additional unbonded
adenine, which is inserted to ease the linking between different NSs.

Most of previous works on DNA NSs focused on the $A_{4}$ case, tetra-armed NSs
with identical self-complementary sticky sequences, originating all identical
$AA$ bonds 29, 30, 31, 39, 40, 41. The $A_{4}$ system displays the analog of
the gas-liquid phase separation at low temperatures, driven by the association
of the self-complementary sticky-ends. For concentrations larger than the
“liquid” coexistence value, the system forms a reversible equilibrium gel,
which exhibits the static and dynamic features expected for colloidal
particles of valence four 29, 30.

With the specific design here presented, an individual NS possesses one
sticky-end of type $A$ and three of type $B$ in order to mimic a tetravalent
monomer of the form $AB_{3}$. The $A$ and $B$ sticky regions have been
adequately selected to allow only $AB$ bonds between different NSs (Fig.
1c,e).

The temperature response of the system is strictly related to the number of
nucleotides in the complementary sequences, whose length allows to distinguish
different hierarchical self-assembly processes. As reported in Fig. S1 of the
ESI†, above $T=T_{\text{NS}}\approx 77\mathrm{{}^{\circ}C}$ the sample is
composed of single and freely-diffusing DNA strands. Around $T_{\text{NS}}$,
the complementary sequences comprising the double-stranded arms start to self-
assemble, giving rise to a solution of unbonded NSs. On further cooling,
around $T=T_{b}\approx 42\mathrm{{}^{\circ}C}$, the sticky-ends start to pair
forming inter-, and possibly intra-, NSs $AB$ bonds. At ambient temperature
and below, essentially all possible bonds are formed.

## Materials and methods

### Numerical methods

To simulate the aggregation kinetics of $AB_{3}$ DNA NSs, we employ the
coarse-grained model oxDNA2, which is able to reproduce the structural and
thermodynamic properties of single- and double-stranded DNA molecules 33, 34.
The interactions between nucleotides account for excluded volume, backbone
connectivity, Watson-Crick hydrogen bonding, stacking, cross-stacking,
coaxial-stacking, and for electrostatic interactions at salt concentrations
$c_{\text{Na}^{+}}>0.1\mathrm{\,M}$. The model parameters have been adjusted
to reproduce the experimental melting temperature data 42, 43, 33. A code
implementing the oxDNA2 model is freely available 44.

Initial configurations are generated by randomly placing copies of an already
assembled DNA tetramer in the simulation box, fulfilling basic steric excluded
volume requirements. The volume is computed for the different values of $N$
and concentrations ($c=2\mathrm{\,mg/ml}$, $10\mathrm{\,mg/ml}$, and
$20\mathrm{\,mg/ml}$, equal to those experimentally investigated), using a
tetramer molecular weight of $M_{w}=63893\mathrm{\,g/mol}$. We perform MD
simulations in the $NVT$ ensemble with systems consisting of $N=300$, 1000,
and 2000 DNA NSs of $AB_{3}$ type. The largest system corresponds to $\sim
4\times 10^{5}$ interaction sites. The temperature in the simulation, kept at
$T=45\mathrm{{}^{\circ}C}$, is enforced by an Anderson-like thermostat that
emulates a Brownian motion 45. For the selected temperature, we are able to
follow the equilibration of the system for up to $10^{10}$ MD timesteps
(corresponding to $\sim 30\mathrm{\,\mu s}$ of real time and six-months of
continuous computation per run), taking advantage of the computational power
of modern Graphic Processing Units (GPU).

### Experimental methods

DNA sequences are purchased from Integrated DNA Technologies (IDT) with PAGE
purification. Lyophilized samples are initially dispersed in a filtered,
DNAse-free, $50\mathrm{\,mM}$ NaCl solution. Tetravalent particles are pre-
assembled by mixing equimolar quantities of the single-stranded components to
a final NS concentration $c=22\mathrm{\,mg/ml}$ ($344\mathrm{\,\mu M}$). The
mixture is heated up to $90\mathrm{{}^{\circ}C}$, incubated for 20 minutes,
and slowly cooled down to room temperature overnight. The NS anneling is
carried out using a Memmert oven.

We experimentally investigate three samples at different NS concentrations:
$2\mathrm{\,mg/ml}$, $10\mathrm{\,mg/ml}$, and $20\mathrm{\,mg/ml}$. The
samples are prepared into borosilicate glass capillaries (inner diameter
$2.4\mathrm{\,mm}$, Hilgenberg GmbH). We dilute the NS batch suspension with a
NaCl solution at a proper molarity, in order to obtain $30\mathrm{\,\mu l}$ of
each sample at a final NaCl concentration of $250\mathrm{\,mM}$. Finally, we
cover the suspension with $20\mathrm{\,\mu l}$ of silicon oil and seal the
capillary using UV resin to avoid sample evaporation.

DLS measurements are carried out at a fixed angle $\theta=90^{\circ}$ with a
custom-made setup consisting of a $633\mathrm{\,nm}$ He-Ne Laser
($17\mathrm{\,mW}$, Newport Corp.) and a multi-tau digital correlator
(Brookhaven Inst.) connected to an optical fiber. Samples are immersed in a
water bath connected to a thermostat. The actual temperature of the bath near
the sample is measured using a thermocouple probe with a $\Delta T=\pm
0.05\mathrm{{}^{\circ}C}$ accuracy.

For each selected temperature, within the interval $10\mathrm{{}^{\circ}C}\leq
T\leq 50\mathrm{{}^{\circ}C}$ every $\Delta T\simeq 5\mathrm{{}^{\circ}C}$,
the sample is thermalized for 40 minutes before starting the acquisition. Each
measurement lasts 10 minutes. The autocorrelation functions of the scattered
intensity $g_{2}(t)$ are calculated from the correlator output and converted
into the field correlation functions $g_{1}(t)$ using the Siegert relation.

## Results

### Numerical results

We start by examining the number of bonds $\\#_{b}(t)$ as a function of time.
We consider two NSs to be bound when at least 5 complementary bases of the
$AB$ sticky sequences hybridize. Since the maximum number of possible bonds
(fully bonded state) is equal to the number of particles $N$, the fraction of
bonds $\\#_{b}(t)/N$ coincides with the probability $p_{b}(t)$ that an
arbitrary $A$ sticky-end is engaged in a bond with a $B$ overhang at time $t$.
At long times, when equilibrium is reached, $p_{b}$ approaches the
(concentration-dependent) value fixed by the binding equilibrium constant 46.

The FS mean-field theory 5, 47 provides a prediction for the number of
clusters $N_{c}(n)$ of size $n$

$N_{c}(n)=N(1-p_{b})F(n,p_{b}),$ (1)

where

$F(n,p_{b})=\frac{[(f-1)n]!}{n![(f-2)n+1]!}\frac{p_{b}^{n-1}(f-1-p_{b})^{(f-2)n+1}}{(f-1)^{(f-1)n}}$
(2)

and the distribution is normalized such that

$\sum_{n}nN_{c}(n)=N.$ (3)

The FS theory, which is formally equivalent to a constrained maximization of
the combinatorial entropy 48, is based on the evaluation of the number of
distinct cluster arrangements, with the restriction that the $N$ monomers are
connected by $Np_{b}$ bonds to form polydisperse loopless clusters. In Eq.
(1), the term $N(1-p_{b})$ is equal to the total number of clusters and
clearly reveals the mean-field approximation, being the number of clusters
equal to the number of particles minus the number of bonds ($Np_{b}$).

Fig. 2: The main graphs show the number distribution of clusters (symbols,
panel a) and the number distribution of clusters in the FS subset (b) of size
$n$ for different simulation times (_i.e._ different bonding probabilities)
for the simulation at $c=20\mathrm{\,mg/ml}$, $N=2000$. The lines are the
theoretical predictions given by Eq. (1) using $p_{b}$ (panel a) and
$p_{b}^{\text{FS}}$ (panel b), respectively, whose evolution over the
simulation time is displayed in the insets (symbols and colors correspond to
the timestep relative to the curves in the main graphs).  Fig. 3: Same
quantities as the ones presented in Fig. 2, but for the simulation at
$c=2\mathrm{\,mg/ml}$, $N=1000$.

Figs. 2a and 3a show the cluster size distribution $N_{c}(n)/N$ at three
different values of $p_{b}$ (three different times during the simulation) for
two different NS concentrations ($c=20\mathrm{\,mg/ml}$ and
$c=2\mathrm{\,mg/ml}$, respectively). The insets show the corresponding time
evolution of $p_{b}$. As can be seen, the FS theoretical predictions, with no
fit parameter, become incapable of representing the numerical data when
$p_{b}\gtrsim 0.5$. This is very clear for the data at $20\mathrm{\,mg/ml}$,
for which the FS predictions underestimate the distribution of small clusters
by more than a factor of two. Disagreement between theoretical predictions and
numerical data at finite times could originate from kinetic pathways and/or
due to the presence of closed loops, neglected in the FS approach. At long
times, however, when thermodynamic equilibrium is approached, disagreement can
only be ascribed to the presence of intracluster bonds.

To double-check the role of intracluster bonds – facilitated by the
flexibility of the NS and by the growing density of $B$ sites on increasing
the cluster size –, we calculate the number of clusters with no reactive $A$
strands, which is equal to the number of intracluster bonds. We also separate
the clusters into two groups: the proper FS loopless clusters and the ones
with intracluster bonds. The latter violate the hypothesis of the FS theory,
which assumes that each cluster has one and only one reactive $A$ site. For
the clusters with no loops (NL), we calculate the total number of existing
bonds $\\#_{b}^{\text{NL}}$ and the total number of particles composing these
clusters $N_{\text{NL}}$. The ratio between these two numbers provides the
bond probability $p_{b}^{\text{FS}}=\\#_{b}^{\text{NL}}/N_{\text{NL}}$ for the
subset of clusters satisfying the FS hypotheses. The size distributions of the
FS-compatible NL clusters for different simulation times are shown in Figs. 2b
and 3b and compared with the FS predictions Eq. (1), identifying $N$ with
$N_{\text{NL}}$ and $p_{b}$ with $p_{b}^{\text{FS}}$. The quality of the
agreement confirms that for the NL clusters, where the FS hypotheses hold by
default, the mean-field predictions properly represent the data, suggesting
that the time evolution of the aggregation process is sufficiently well-
described by the equilibrium solutions 49.

Fig. 4: Average squared radius of gyration as a function of the cluster size
$n$ for different simulations. Dashed lines are power law fits for $n\leq 5$
and $n>5$. Legend: triangles, $c=20\mathrm{\,mg/ml}$ for $N=300$ (green) and
$N=2000$ (blue, open and full); red squares, $c=10\mathrm{\,mg/ml}$, $N=2000$;
circles, $c=2\mathrm{\,mg/ml}$ for $N=300$ (dark green) and $N=2000$ (black).
In the top-left portion: a small cluster ($n=3$). In the bottom-right portion:
a large cluster ($n=49$).

Additionally, we provide a quantification of the structural properties of the
clusters. We evaluate the mean squared radius of gyration

$\langle
R_{g}^{2}\rangle(n)=\frac{1}{2n^{2}}\left\langle\sum_{j=1}^{n}\sum_{k=1}^{n}({\bf
r}_{j}-{\bf r}_{k})^{2}\right\rangle,$ (4)

where ${\bf r}_{j}$ is the position of the center of mass of the $j$-th NS
belonging to an aggregate of size $n$ and the angular parentheses indicate an
ensemble average over all the clusters with the same size $n$ and over time.
For fractal objects,

$\langle R_{g}^{2}\rangle(n)\sim n^{\frac{2}{d_{f}}},$ (5)

where $d_{f}$ is the fractal exponent. A power law fit of the data presented
in Fig. 4 shows that clusters larger than 3-4 monomers grow with $d_{f}\approx
2$.

Going back to the cluster size distribution, we next provide an extension of
the FS theory to account for intracluster bonds. We recall that, formally, for
weakly-interacting clusters, the probability of formation of a cluster of size
$n$ in equilibrium is proportional 50, 48 to its partition function $Q_{n}$
multiplied by a (concentration-dependent) activity $z^{n}$. As shown in
Section B of the ESI†, the FS equation can indeed be recast in this ideal-gas
of clusters thermodynamic formalism as

$N_{c}^{\text{NL}}(n)=Q_{n}^{\text{NL}}z^{n},$ (6)

where the partition function of a loopless cluster

$Q_{n}^{\text{NL}}=\frac{V}{V_{\text{ref}}}\frac{[(f-1)n]!}{n![(f-2)n+1]!}\left(\mathrm{e}^{-\beta\mathcal{F}_{\text{bond}}}\right)^{n-1}$
(7)

is proportional to the system volume, measured in units of a reference volume
$V_{\text{ref}}$, and is composed of a free-energy dependent term
$\exp{[-\beta\mathcal{F}_{\text{bond}}(V_{\text{ref}},T)]}$, modelling the
contribution of the formation of $n-1$ bonds, and the FS combinatorial
entropic term. $\beta=1/k_{\text{B}}T$ as usual. The term $z$ plays the role
of an activity and its value controls the concentration of the system. Being
$Q_{1}^{\text{NL}}=V/V_{\text{ref}}$, it is possible to identify $z$ with the
nondimensional concentration of _unbonded_ particles
$N_{c}^{\text{NL}}(1)V_{\text{ref}}/V$. The mapping between $p_{b}$ and
$\mathcal{F}_{\text{bond}}$ is provided in Section B of the ESI†.

To include the possibility of intracluster bonds, we add the partition
function associated with the configurations _with_ loops as

$N_{c}(n)=\left(Q_{n}^{\text{NL}}+Q_{n}^{\text{L}}\right)z^{n}.$ (8)

The partition function $Q_{n}^{\text{L}}$, compared to $Q_{n}^{\text{NL}}$,
must include two terms: (i) an additional factor
$\exp{(-\beta\mathcal{F}_{\text{bond}})}$, which accounts for the presence of
the intracluster extra bond, and (ii) a model-dependent factor $g(n,\beta)$,
which quantifies the free-energy gain of forming an intracluster bond. The
factor $g(n,\beta)$ includes the relative number of microscopic configurations
with an intracluster loop (with respect to a loopless cluster). It may also
include the free-energy cost of bringing the selected $B$ site close to the
unbonded $A$ site and thus it could, in principle, (weakly) depend on $T$ if
the monomer arms are not quite flexible. The partition function
$Q_{n}^{\text{L}}$ can then be written as

$Q_{n}^{\text{L}}=g(n,\beta)\,Q_{n}^{\text{NL}}\,\mathrm{e}^{-\beta\mathcal{F}_{\text{bond}}}.$
(9)

The unknown $g(n,\beta)$ can be estimated by evaluating the ratio between the
number of clusters of size $n$ with and without loops from the simulated
configurations at long time, when equilibrium has been reached,

$\frac{N_{c}^{\text{L}}(n)}{N_{c}^{\text{NL}}(n)}=\frac{Q_{n}^{\text{L}}}{Q_{n}^{\text{NL}}}=g(n,\beta)\,\mathrm{e}^{-\beta\mathcal{F}_{\text{bond}}}.$
(10)

We note on passing that the ratio $N_{c}^{\text{L}}(n)/N_{c}^{\text{NL}}(n)$
depends only on the temperature but not on the concentration.

Fig. 5: Comparison of the prediction of Eqs. (8) and (9) (lines) with the
simulation equilibrium data (symbols). The data are obtained by averaging the
cluster size distribution from two simulations at the same simulation time.
Full symbols refer to the data for $c=20\mathrm{\,mg/ml}$ ($t\simeq
2.85\mathrm{\,\mu s}$). Open symbols refer to $c=2\mathrm{\,mg/ml}$ ($t\simeq
6.9\mathrm{\,\mu s}$). Legend: circles, $N_{c}(n)/N$; squares,
$N_{c}^{\text{L}}(n)/N$; triangles, $N_{c}^{\text{NL}}(n)/N$.  Fig. 6: Main:
Predicted number distribution of clusters $N_{c}(n)/N$ in the limit of fully
bonded system (Eq. (12)). Top inset: mean cluster size
($\text{MCS}=\sum_{n}n^{2}N_{c}(n)/\sum_{n}nN_{c}(n)$) as a function of the NS
concentration. The line is obtained by analytically computing the mean cluster
size from the low temperature cluster distribution of Eq. (12). Bottom inset:
radius of gyration of the mean cluster $R_{g}^{(\text{MC})}$ as a function of
the NS concentration. The line is obtained by combining the MCS dependence
with the fit of the radius of gyration shown in Fig. 4.

Fig. 5 compares the predictions of Eqs. (8) and (9) with the numerical data at
long times, close to (if not at) equilibrium. In the comparison, $g(n,\beta)$
and $\exp{(-\beta\mathcal{F}_{\text{bond}})}$ are the only fit parameters
($\beta$ is fixed), identical for all the densities. The values of $z$ are
fixed by the concentration of loopless monomers. Despite the intrinsic noise
of the data, the theoretical predictions well-represent the numerical values
at all densities. The fit suggests that $g(n,\beta)$ is essentially constant
already for $n\gtrsim 2$ (_i.e._ for clusters composed by two monomers or
more). This confirms that the unbonded $A$ site essentially binds with a $B$
site on the same particle or, at most, with one of its neighbor monomers. To
provide additional support for this statement, we investigate the distribution
of loop sizes∗††footnotetext: ∗The loop size is defined as the number of
monomers in a cluster that form a closed cycle of bonds., confirming that the
average loop size is quite small ($\simeq 1.7\pm 1$).

Even at the coarse-grained level of the oxDNA model, simulations are still too
demanding to access lower temperatures than the one we have studied. However,
the previous model allows us to predict the expected cluster size distribution
at low-$T$, when the driving force for bonding becomes quite strong and all
$A$ sites have reacted. Under these conditions, $Q^{NL}$ is negligible
compared to $Q^{L}$ for all $n$. The cluster size distribution will coincide
with the distribution of the clusters with an intracluster bond and,
therefore, will be given by

$N_{c}(n)=\frac{V}{V_{\text{ref}}}g(n,\beta)\frac{[(f-1)n]!}{n![(f-2)n+1]!}\left(\mathrm{e}^{-\beta\mathcal{F}_{\text{bond}}}\right)^{n}z^{n},$
(11)

which can be recast in the form

$N_{c}(n)=\frac{V}{V_{\text{ref}}}g(n,\beta)\frac{[(f-1)n]!}{n![(f-2)n+1]!}\left(\frac{V_{\text{ref}}N_{c}(1)}{Vg(1,\beta)}\right)^{n}.$
(12)

The term $[V_{\text{ref}}N_{c}(1)/Vg(1,\beta)]$ acts as a renormalized
activity. Its value can be tuned to fix the average concentration. The
predicted low-$T$ cluster size distributions for the three different
investigated densities are shown in Fig. 6. The insets of the same figure show
the associated mean cluster size (MCS) and the relative radius of gyration of
the mean cluster $R_{g}^{(\text{MC})}$ as a function of the NS concentration,
respectively. From these results, we can formulate three important
considerations. First, Eq. (12) shows that the temperature (apart from the
weak dependence entering in $g(n,\beta)$) does not play any role: once all
possible bonds are formed, the equilibrium distributions are the ones that
maximize the entropy. Second, the same equation shows that the NS
concentration modulates the cluster size distribution, at odd with the FS
predictions which suggest the formation of an infinite percolating cluster
incorporating all monomers. Third, and more important, the cluster size
distribution remains finite at all physical values of the NS concentrations.
Hence, the chance to form intracluster bonds eliminates the possibility to
approach the percolation transition. In a more physical way, Eq. (12) tells us
that, when particles can satisfy all their bonds within the same cluster, the
fully bonded (low-$T$) configuration is not the percolating one. Rather, the
equilibrium low-$T$ state exploits the entropic gain provided by the
exploration of the system volume by a multiplicity of clusters, modulated by a
slightly modified – by $g(n,\beta)$ – FS combinatorial term.

### Experimental results

The simulation study has revealed that the presence of intracluster bonds
strongly limits the formation of larger clusters in the system, preventing the
possibility to reach the percolation point even when all possible bonds are
formed ($p_{b}=1$). In this case, it has also shown that the cluster size
distribution is strongly concentration-dependent, with a MCS (inset of Fig. 6)
that is predicted to remain finite at all experimentally accessible NS
concentrations.

To test the numerical findings, we realize the very same system in the
laboratory and examine it via DLS. With experiments, we are not limited to the
investigation of one single temperature. Instead, by changing $T$ we can probe
different $p_{b}$ values and even explore the $T$ window where all bonds are
formed ($p_{b}=1$ for $T\lesssim 20\mathrm{{}^{\circ}C}$), as shown by the
melting profile of the sticky sequences reported in Section A of the ESI†. In
addition, experiments allow to probe the equilibrium properties of the system.
Samples are let equilibrate for several minutes ($\sim 40\mathrm{\,min}$), a
time sufficiently long to break and reform several of the bonds between the
$A$ and $B$ sticky-ends. We checked that all results are reproducible upon
increasing and decreasing $T$ scans and are not affected by aging nor by the
previous history.

Fig. 7: Upper panels: DLS results ($g_{1}(t)$) showing the $T$-behavior of the
system for the three different investigated NS concentrations: (a)
$2\mathrm{\,mg/ml}$, (b) $10\mathrm{\,mg/ml}$, and (c) $20\mathrm{\,mg/ml}$.
Lower panels: snapshots obtained from simulations performed at the same
concentrations of panels a-c. The boxes are displayed on the same scale (box
side is $L\simeq 220\mathrm{\,nm}$). Different clusters are indicated with
different colors.

Figs. 7a-c show the autocorrelation functions of the scattered field
$g_{1}(t)$ for the three investigated NS concentrations
($c=2\mathrm{\,mg/ml}$, $10\mathrm{\,mg/ml}$, and $20\mathrm{\,mg/ml}$) and
for the explored $T$s. For all samples and temperatures, the correlation
functions decay to zero within the experimental accessible time window
($10\mathrm{\,s}$), confirming the sample ergodicity. For all studied
concentrations, the system if far from a percolation transition, consistent
with the numerical simulations and the proposed theoretical extension of the
FS theory.

To quantify the slowing down of the dynamics and to extract a typical (slow)
relaxation time, the correlation curves are fitted to a double stretched
exponential function (see Section C of the ESI†for comparison with the fit
function)

$g_{1}(t)=(1-A_{s})\exp{(-t/\tau_{f})}+A_{s}\exp{(-t/\tau_{s})^{\beta_{s}}},$
(13)

where $\tau_{f}$ and $\tau_{s}$ are the relaxation times of the fast and slow
relaxation processes, respectively, $A_{s}$ is the amplitude of the slow
process, and $\beta_{s}$ its stretching exponent. The slow relaxation time is
better represented by its average value, defined as

$\langle\tau_{s}\rangle=\frac{\int_{0}^{\infty}t\exp{(-t/\tau_{s})^{\beta_{s}}}\,\textrm{d}t}{\int_{0}^{\infty}\exp{(-t/\tau_{s})^{\beta_{s}}}\,\textrm{d}t}=\frac{\tau_{s}}{\beta_{s}}\,\Gamma\left(\frac{1}{\beta_{s}}\right),$
(14)

where $\Gamma$ is the gamma function.

The insets of Figs. 7a-c display the values of $\beta_{s}$, which is
associated with the slow relaxation process. For all the measurements, the
values lie within the range $0.4\lesssim\beta_{s}\lesssim 0.6$. The values of
the slow relaxation time are reported in Fig. 8 for all the concentrations and
temperatures. To eliminate the trivial effect of the temperature dependence of
the solvent viscosity, the times are rescaled to the viscosity
$\eta_{\text{solv}}$ of the NaCl $250\mathrm{\,mM}$ solvent at the highest
investigated temperature ($T_{\text{ref}}\simeq 48.5\mathrm{{}^{\circ}C}$) as

$\tau_{s}^{*}(T)=\langle\tau_{s}\rangle(T)\frac{\eta_{\text{solv}}(T_{\text{ref}})}{\eta_{\text{solv}}(T)}.$
(15)

Fig. 8: $T$-dependence of the (viscosity rescaled) slow decay time
$\tau_{s}^{*}$ for samples at the three different concentrations:
$20\mathrm{\,mg/ml}$ (blue), $10\mathrm{\,mg/ml}$ (orange), and
$2\mathrm{\,mg/ml}$ (magenta). The lines are the two estimated bond lifetimes,
calculated according to Eq. (16) using $\alpha=0.5$ (red) and $\alpha=1$
(black), to provide support to the assumption that the relaxation process
takes place at fixed bonding pattern.

In general, two distinct processes – which can only be disentangled in
particular conditions – contribute to the relaxation process probed by DLS:
cluster _restructuring_ and cluster _diffusion_. The cluster restructuring
times, which are related to the breaking and coalescence of different
aggregates, are slaved to the bond-breaking times. In our DNA design,
explicitly selected to generate a fully bonded system for $T\lesssim
20\mathrm{{}^{\circ}C}$, 9 base pairs take part to the $AB$ bond, resulting in
an enthalpic $\Delta H$ and entropic $\Delta S$ contribution to the binding
free-energy $\Delta G$ equal to $\Delta H=-61.5\mathrm{\,kcal/mol}$ and
$\Delta S=-178.3\mathrm{\,cal/mol\,K}$, evaluated using the web application
DINAMelt 51 based on SantaLucia 46. A reasonable estimate of the bond lifetime
is 41

$\tau=\tau_{0}\,\mathrm{e}^{\alpha\Delta G/RT},$ (16)

where $\tau_{0}$ is of the order of a few ms and
$R=1.987\mathrm{\,cal/mol\,K}$. The value of the coefficient $\alpha$ is
between 0.5 and 2, depending on the degree of cooperativity of the bond-
breaking process 52. Here, we use $\tau_{0}=3\mathrm{\,ms}$, as found in Ref.
41. In Fig. 8, we show the expected $T$-dependence of the bond lifetime as
predicted by Eq. (16) for $\alpha=0.5$ and $\alpha=1$. In both cases, the
experimental times are faster than the bond-breaking time, even when the most
conservative estimate of the bond lifetime is selected ($\alpha=0.5$). This
leaves the cluster diffusion as the main mechanism for the decorrelation of
the density fluctuations in this system.

At the lowest density ($c=2\mathrm{\,mg/ml}$, Fig. 7a), where the hypothesis
of independent clusters is more realistic, the relaxation process is quite
fast and it does not show a clear hint of two-step relaxation, suggesting that
the experiments are probing the free diffusion of limited-size clusters. The
relaxation time grows only by a factor of $\approx 5$ when $T$ varies from
$50\mathrm{{}^{\circ}C}$ to $10\mathrm{{}^{\circ}C}$ (corresponding to $p_{b}$
from $\approx 0$ to $\approx 1$). At $c=10\mathrm{\,mg/ml}$ (Fig. 7b), a weak
additional relaxation process appears, signalling the onset of interactions
between clusters. The image from the simulation (Fig. 7e), which we can use as
a visual aid to interpret the DLS data, suggests that it may become
appropriate to tentatively interpret the fast decay as originating from the
clusters free diffusion, while the slow one comes from the confinement induced
by the presence of nearby clusters. This hypothesis is supported by the data
at $c=20\mathrm{\,mg/ml}$ (Fig. 7c) – and again by the simulation snapshot in
Fig. 7f –, where the excluded-volume interactions between clusters are
significant, as illustrated by the pronounced two-step decay of the
correlation functions.

We then intend to compare the simulation results with the experiments for
sample at $c=2\mathrm{\,mg/ml}$. We evaluate the intensity-
averaged∗††footnotetext: ∗ The intensity average for the simulation data is
obtained by performing the average weighted by distribution $n^{2}N_{c}(n)$.
hydrodynamic radius from the cluster size distribution obtained from the
simulations at $T=45\mathrm{{}^{\circ}C}$ (_cf._ Fig. 5) and from the low-$T$
theory (_cf._ Fig. 6). For each cluster of size $n$, we calculate the
hydrodynamic radius following the recipe described in Ref. 53, which provides
the equivalent ellipsoid associated with the cluster. The actual hydrodynamic
radius is then computed from known formulae 54. Finally, as done for the
radius of gyration, we evaluate the cluster size dependence of the ensemble
average of $R_{h}$. The power law fit to the data gives $\langle
R_{h}\rangle(n)\simeq R_{0}\,n^{\gamma}$, with

$R_{0}\simeq\begin{cases}5.0\mathrm{\,nm}\quad\text{if }n\leq 5\\\
6.5\mathrm{\,nm}\quad\text{if }n>5\end{cases}$ (17)

and

$\gamma=\begin{cases}0.68\quad\text{if }n\leq 5\\\ 0.53\quad\text{if
}n>5.\end{cases}$ (18)

For further details, see Section D of the ESI†. At high temperature, equal to
the one numerically investigated ($T=45\mathrm{{}^{\circ}C}$), we obtain from
the simulations an intensity-averaged hydrodynamic radius of $\langle
R_{h}\rangle_{z}\simeq 9.3\mathrm{\,nm}$ (using the radius of gyration, one
obtains $\langle R_{g}\rangle_{z}\simeq 8.1\mathrm{\,nm}$). By analyzing the
correlation time associated with the fast relaxation $\tau_{f}$, we estimate a
mean hydrodynamic radius $R_{h}\simeq 5.5\mathrm{\,nm}$. At low temperature,
instead, the numerical prediction (see Fig. 6) provides an expected radius
$\langle R_{h}\rangle_{z}\simeq 14.9\mathrm{\,nm}$ ($\langle
R_{g}\rangle_{z}\simeq 13.2\mathrm{\,nm}$), to be compared to the experimental
value of $R_{h}\simeq 22.5\mathrm{\,nm}$.

The discrepancy between the experimental values and the ones estimated from
the simulations – which is about 50% at low temperature and grows to a factor
of $\sim 0.7$ at $T=45\mathrm{{}^{\circ}C}$ –, can be mainly ascribed to the
approximate model we used for the calculation of the hydrodynamic radius.
Another possible source of error can be related to the numerical noise of the
data used in the fit to obtain $g(n,\beta)$.

## Conclusions

This article, based on a combined numerical, theoretical, and experimental
study, reports numerous relevant findings.

  * •

It shows that DNA-made NSs with precise binding topologies can be nowadays
produced in bulk quantities and exploited as highly precise model systems to
tackle the physics of aggregating particles, either directional colloids or
functional polymers. Here, we studied the aggregation behavior of $AB_{3}$
monomers made of DNA NSs with the aim of clarifying the behavior of
hyperbranched aggregation when intracluster bonds are present.

  * •

It reports an extensive MD simulations study, based on a high-quality coarse-
grained potential for the DNA interactions, to investigate the equilibrium
cluster size distribution at fixed temperature and at different initial
monomer concentrations. We found that the mean cluster size increases with the
particle concentration, from a suspension of monomers and small clusters, at
low $c$, to a highly polydisperse solution at large concentrations.
Simulations also suggested that the presence of intracluster bonds eliminates
the possibility to reach the percolation transition.

  * •

It reports a novel theoretical way to include the presence of intracluster
bonds in the formalism. First, the FS approach is translated in an ideal-gas
of clusters formalism, which is then extended to include also clusters with
intracluster bonds. Including a model-dependent (but concentration-
independent) quantity $g(n,\beta)$ – which can be determined as a fit
parameter –, it becomes possible to predict the cluster size distribution
without limiting assumptions. The theory explains why percolation is avoided
when intracluster bonds are possible. Comparison with MD simulation data
supports the quality of the modelling.

  * •

It reports DLS measurements of the same system studied numerically and
theoretically to provide evidence that, at odd with the FS predicitions,
percolation is not encountered in this system. Indeed, by decreasing the
temperature, and exploiting the reversibility of the sticky-end pairing, it is
possible to investigate the effect of bonding, up to the point where all bonds
in the system are formed. The data we collected strongly support the idea that
the polydispersity of the aggregates remains finite at low temperatures.
Additionally, it suggests that the equilibrium cluster size distribution only
depends on the initial monomer concentration.

We believe that these results will also be valuable for the community
interested in the biotechnological applications of hyperbranched polymers, due
to the biocompatibility and versatility of DNA as a building-block for complex
and innovative materials.

## Conflicts of interest

There are no conflicts to declare.

## Acknowledgements

We acknowledge support from MIUR-PRIN (Grant No. 2017Z55KCW) and from Regione
Lazio (Grant No. 85857-0051-0085). We thank L. Rovigatti for his help with the
oxDNA code.

## Notes and references

  * Bianchi _et al._ 2007 E. Bianchi, P. Tartaglia, E. L. Nave and F. Sciortino, _J. Chem. Phys. B_ , 2007, 111, 11765.
  * Corezzi _et al._ 2008 S. Corezzi, C. D. Michele, E. Zaccarelli, D. Fioretto and F. Sciortino, _Soft Matter_ , 2008, 4, 1173.
  * Wertheim 1984 M. Wertheim, _J. Stat. Phys._ , 1984, 35, 19–34.
  * Wertheim 1986 M. Wertheim, _J. Stat. Phys._ , 1986, 42, 459–476.
  * Flory 1941 P. Flory, _J. Am. Chem. Soc._ , 1941, 63, 3083.
  * Stockmayer 1943 W. Stockmayer, _J. Chem. Phys._ , 1943, 11, 45–55.
  * Bianchi _et al._ 2006 E. Bianchi, J. Largo, P. Tartaglia, E. Zaccarelli and F. Sciortino, _Phys. Rev. Lett._ , 2006, 97, 168301.
  * Sciortino _et al._ 2007 F. Sciortino, E. Bianchi, J. Douglas and P. Tartaglia, _J. Chem. Phys._ , 2007, 126, 194903.
  * Kim and Webster 1990 Y. Kim and O. Webster, _J. Am. Chem. Soc._ , 1990, 112, 4592.
  * Kim and Webster 1992 Y. Kim and O. Webster, _Macromolecules_ , 1992, 25, 5561.
  * Cuneo and Gao 2020 T. Cuneo and H. Gao, _WIREs Nanomed Nanobiotechnol._ , 2020, e1640.
  * Jochum _et al._ 2019 C. Jochum, N. Adžić, E. Stiakakis, T. Derrien, D. Luo, G. Kahl and C. Likos, _Nanoscale_ , 2019, 11, 1604–1617.
  * Zhou _et al._ 2010 B. Zhou, W. Huang, J. Liu, X. Zhu and D. Yan, _Adv. Mater._ , 2010, 22, 4567.
  * Liu _et al._ 2015 J. Liu, W. Huang, Y. Pang and D. Yan, _Chem. Soc. Rev._ , 2015, 44, 3942.
  * van Benthem 2000 R. van Benthem, _Prog. Org. Coat._ , 2000, 40, 203–214.
  * Zotti _et al._ 2019 A. Zotti, S. Zuppolini, A. Borriello and M. Zarrelli, _Nanomaterials_ , 2019, 9, 418.
  * Paleos _et al._ 2010 C. Paleos, D. Tsiourvas, Z. Sideratou and L.-A. Tziveleka, _Expert Opin. Drug Deliv._ , 2010, 7, 1387.
  * Gajbhiye _et al._ 2013 V. Gajbhiye, L. Escalante, G. Chen, A. Laperle, Q. Zheng, B. Steyer, S. Gong and K. Saha, _Nanoscale_ , 2013, 6, 521–531.
  * Qi _et al._ 2016 M. Qi, S. Duan, B. Yu, H. Yao, W. Tian and F. Xu, _Polym. Chem._ , 2016, 7, 4334.
  * Zhao _et al._ 2017 L. Zhao, X. Wu, X. Wang, C. Duan, H. Wang, A. Punjabi, Y. Zhao, Y. Zhang, Z. Xu, H. Gao and G. Han, _ACS Macro Lett._ , 2017, 6, 700–704.
  * Qi _et al._ 2019 M. Qi, S. Duan, B. Yu, H. Yao, W. Tian and F. Xu, _Colloids Surf. B_ , 2019, 182, 110375.
  * Feng _et al._ 2012 G. Feng, D. Ding and B. Liu, _Nanoscale_ , 2012, 4, 6150.
  * Malekzadeh _et al._ 2017 A. M. Malekzadeh, A. Ramazani, S. T. Rezaei and H. Niknejad, _J. Colloid Interface Sci._ , 2017, 490, 64–73.
  * Pitois _et al._ 2001 C. Pitois, D. Wiesmann, M. Lindgren and A. Hult, _Adv. Mater._ , 2001, 13, 1483.
  * Shi _et al._ 2013 H. Shi, X. Chen, S. Liu, H. Xu, Z. An, L. Ouyang, Z. Tu, Q. Zhao, Q. Fan, L. Wang and W. Huang, _ACS Appl. Mater. Interfaces_ , 2013, 5, 4562\.
  * Liu _et al._ 2014 X. Liu, H.-J. Liu, F. Cheng and Y. Chen, _Nanoscale_ , 2014, 6, 7453\.
  * Zheng _et al._ 2011 Y. Zheng, H. Cao, B. Newland, Y. Dong, A. Pandit and W. Wang, _J. Am. Chem. Soc._ , 2011, 133, 13130.
  * Lyu _et al._ 2018 J. Lyu, Y. Gao, Z. Zhang, U. Greiser, H. Tai and W. Wang, _Sci. China Chem._ , 2018, 61, 319–327.
  * Biffi _et al._ 2013 S. Biffi, R. Cerbino, F. Bomboi, E. Paraboschi, R. Asselta, F. Sciortino and T. Bellini, _Proc. Natl. Acad. Sci. U. S. A._ , 2013, 110, 15633\.
  * Biffi _et al._ 2015 S. Biffi, R. Cerbino, G. Nava, F. Bomboi, F. Sciortino and T. Bellini, _Soft Matter_ , 2015, 11, 3132.
  * Rovigatti _et al._ 2014 L. Rovigatti, F. Bomboi and F. Sciortino, _J. Chem. Phys._ , 2014, 140, 154903.
  * Conrad _et al._ 2019 N. Conrad, T. Kennedy, D. Fygenson and O. Saleh, _Proc. Natl. Acad. Sci. U. S. A._ , 2019, 116, 7238.
  * Ouldridge _et al._ 2011 T. Ouldridge, A. Louis and J. Doye, _J. Chem. Phys._ , 2011, 134, 085101\.
  * Snodin _et al._ 2015 B. Snodin, F. Randisi, M. Mosayebi, P. Šulc, J. Schreck, F. Romano, T. Ouldridge, R. Tsukanov, E. Nir, A. Louis and J. Doye, _J. Chem. Phys._ , 2015, 142, 234901.
  * Seeman 2003 N. Seeman, _Nature_ , 2003, 421, 427–431.
  * Seeman 2005 N. Seeman, in _NanoBiotechnology Protocols_ , Springer, 2005, pp. 143–166.
  * Bellini _et al._ 2011 T. Bellini, R. Cerbino and G. Zanchetta, in _Liquid Crystals_ , Springer, 2011, pp. 225–279.
  * Salamonczyk _et al._ 2016 M. Salamonczyk, J. Zhang, G. Portale, C. Zhu, E. Kentzinger, J. Gleeson, A. Jakli, C. D. Michele, J. Dhont, S. Sprunt and E. Stiakakis, _Nat. Commun._ , 2016, 7, 13358.
  * Fernandez-Castanon _et al._ 2016 J. Fernandez-Castanon, F. Bomboi, L. Rovigatti, M. Zanatta, A. Paciaroni, L. Comez, L. Porcar, C. Jafta, G. Fadda, T. Bellini and F. Sciortino, _J. Chem. Phys._ , 2016, 145, 084910.
  * Nguyen and Saleh 2017 D. Nguyen and O. Saleh, _Soft Matter_ , 2017, 13, 5421.
  * Bomboi _et al._ 2015 F. Bomboi, S. Biffi, R. Cerbino, T. Bellini, F. Bordi and F. Sciortino, _Eur. Phys. J. E_ , 2015, 38, 64.
  * SantaLucia 1998 J. SantaLucia, _Proc. Natl. Acad. Sci. U.S.A._ , 1998, 95, 1460\.
  * Holbrook _et al._ 1999 J. A. Holbrook, M. W. Capp, R. M. Saecker and M. T. Record, _Biochemistry_ , 1999, 38, 8409.
  * 44 https://dna.physics.ox.ac.uk.
  * Russo _et al._ 2009 J. Russo, P. Tartaglia and F. Sciortino, _J. Chem. Phys._ , 2009, 131, 014504.
  * SantaLucia 1996 J. SantaLucia, _Nucleic Acid Res._ , 1996, 28, 1929.
  * Rubinstein and Colby 2003 M. Rubinstein and R. Colby, _Polymer Physics_ , OUP Oxford, 2003.
  * Sciortino 2019 F. Sciortino, _Riv. del Nuovo Cim._ , 2019, 42, 511–548.
  * Corezzi _et al._ 2012 S. Corezzi, D. Fioretto and F. Sciortino, _Soft Matter_ , 2012, 8, 11207\.
  * Hill 1987 T. Hill, _Statistical Mechanics: Principles and Selected Applications_ , Dover Publications, 1987.
  * Markham and Zuker 2005 N. Markham and M. Zuker, _Nucleic Acid Res._ , 2005, 33, W577.
  * Smallenburg and Sciortino 2013 F. Smallenburg and F. Sciortino, _Nat. Phys._ , 2013, 9, 554–558.
  * Rovigatti _et al._ 2019 L. Rovigatti, N. Gnan, A. Ninarello and E. Zaccarelli, _Macromolecules_ , 2019, 52, 4895.
  * Hubbard and Douglas 1993 J. Hubbard and J. Douglas, _Phys. Rev. E_ , 1993, 47, R2983.

See pages 1-5 of supplementary.pdf


# Incorporating Locality of Images to Generate Targeted Transferable
Adversarial Examples

Zhipeng Wei1,2, Jingjing Chen1,2111Correspondence to: Jingjing Chen., Zuxuan
Wu1,2, Yu-Gang Jiang1,2

###### Abstract

Despite that leveraging the transferability of adversarial examples can attain
a fairly high attack success rate for non-targeted attacks, it does not work
well in targeted attacks since the gradient directions from a source image to
a targeted class are usually different in different DNNs. To increase the
transferability of target attacks, recent studies make efforts in aligning the
feature of the generated adversarial example with the feature distributions of
the targeted class learned from an auxiliary network or a generative
adversarial network. However, these works assume that the training dataset is
available and require a lot of time to train networks, which makes it hard to
apply to real-world scenarios. In this paper, we revisit adversarial examples
with targeted transferability from the perspective of universality and find
that highly universal adversarial perturbations tend to be more transferable.
Based on this observation, we propose the Locality of Images (LI) attack to
improve targeted transferability. Specifically, instead of using the
classification loss only, LI introduces a feature similarity loss between
intermediate features from adversarial perturbed original images and randomly
cropped images, which makes the features from adversarial perturbations to be
more dominant than that of benign images, hence improving targeted
transferability. Through incorporating locality of images into optimizing
perturbations, the LI attack emphasizes that targeted perturbations should be
universal to diverse input patterns, even local image patches. Extensive
experiments demonstrate that LI can achieve high success rates for transfer-
based targeted attacks. On attacking the ImageNet-compatible dataset, LI
yields an improvement of 12% compared with existing state-of-the-art methods.

## Introduction

Deep neural networks (DNNs) have been demonstrated to be susceptible to
adversarial examples (Goodfellow, Shlens, and Szegedy 2014; Biggio et al.
2013), which are generated by adding small human-crafted perturbations that
may lead to wrong prediction of DNNs. The existence of adversarial examples
has raised serious security threats for DNNs. Even when the adversary has no
access to the architecture and parameters of the attacked model, they can
utilize adversarial examples generated from a surrogate white-box model to
attack the black-box model, which is also known as cross-model transferability
of adversarial examples. Such cross-model adversarial transferability further
makes a threat to DNN applications.

Recent studies (Dong et al. 2018; Xie et al. 2019; Wei et al. 2022a, b) have
shown that the non-targeted adversarial transferability has attained high
performance even when attacking robust trained models, as decision boundaries
around one source image align well among different models. In contrast, the
targeted adversarial transferability is more challenging due to the different
gradient directions from one source image to the targeted class among models
(Liu et al. 2017). The study of targeted adversarial transferability has
become an important aspect of understanding inner-workings of DNNs.

Figure 1: Overview of the proposed LI attack. The random cropping is applied
to the given benign image to generate the local image patch. After cropping,
the local patch is resized to the shape of the benign image. Then both benign
and local adversarial images with the shared perturbations are input to a
surrogate white-box CNN model. Finally, the gradients obtained from the
classification loss and the feature similarity loss are used to optimize
perturbations.

Previous researches in this field have been devoted to training class-specific
auxiliary networks (Inkawhich et al. 2020b, a) or generative adversarial
networks (GANs) (Naseer et al. 2021), in order to learn feature distributions
of the targeted class. Then the generated adversarial examples are optimized
to match the learned feature distributions of the targeted class. Despite
these methods have been demonstrated to be effective in improving the
adversarial transferability towards targeted attacks, they usually suffer from
poor usability in the real world, due to the data dependency and time-
consuming training. On the contrary, non-targeted transferable attack methods
that based on the Iterative Fast Gradient Sign Method (I-FGSM) (Kurakin,
Goodfellow, and Bengio 2018) are more efficient, since they only depend on a
single image and a surrogate white-box model. However, these methods do not
work well in targeted attack scenarios. The Logit attack (Zhao, Liu, and
Larson 2021) attributes this phenomenon to the attack unconvergence caused by
a small number of iterations. Moreover, it shows that the combination of
Diverse Input (DI) (Xie et al. 2019), Momentum Iterative (MI) (Dong et al.
2018) and Translation-invariant (TI) (Dong et al. 2019) with a large number of
iterations, which are originally proposed in non-targeted attacks, can yield
good results in targeted attacks. Hence, these malicious perturbations
generated by smoothed and stabilized gradients in TI and MI lead to
misclassifying diverse input patterns from DI. In other words, these
perturbations are universal to different input patterns, which motivates us to
investigate the universality of targeted perturbations.

Based on the above analysis, we conduct toy experiments to analyze the
correlations between the universality of adversarial perturbations and the
success rate of targeted attacks. Through the experiment, we discover that
highly universal adversarial perturbations tend to be more transferable for
target attacks. Moreover, we also find that the adversarial features tend to
be more dominant than benign image features, which is consistent with the
conclusion presented in (Zhang et al. 2020).

Based on these observations, we propose to create more diverse input patterns
and increase the dominance of adversarial perturbations for the purpose of
enhancing universality. More specifically, we introduce the Locality of Image
(LI) attack, which applies random cropping to the input images and maximizes
the cosine similarity of adversarial intermediate features between original
images and local patches. Compared to input patterns used in DI (random
resizing and padding), the locality of images focus on local structures of
images. Through incorporating local structures into optimizing perturbations,
LI generates adversarial perturbations that can be well generalized to both
global and local structures. Besides, aligning adversarial intermediate
features between global and local images aims to generate perturbations with
high dominant features regardless of the superimposed images, hence enhancing
targeted transferability.

Figure 1 gives an overview of the proposed LI attack. LI firstly applies the
random cropping on benign images to obtain local cropped patches. Then it
resizes local patches to the same shape with benign images. Consequently,
global and local inputs with the shared perturbations are input to the white-
box model. Finally, adversarial perturbations are updated by minimizing the
classification loss (e.g., Cross Entropy) between inputs and the targeted
class and maximizing the feature similarity loss (e.g., Cosine Similarity) of
adversarial intermediate features between local and global inputs. Benefited
from satisfying the prediction of the target class between global and local
inputs and approximating adversarial intermediate features between the two,
the proposed locality of images and the feature similarity loss yield more
universal perturbations to the diverse inputs of one specified image, thereby
improving the cross-model targeted transferability. We briefly summarize our
primary contributions as follows:

  * •

We provide new insight into targeted transferability and investigate the
universal property of targeted transferable perturbations. We observe that
targeted transferable adversarial perturbations are more universal to other
inputs and have more dominant features.

  * •

The above observations motivate us to incorporate locality of images into
optimizing perturbations for creating more diverse input patterns. Besides, we
introduce a feature similarity loss between global and local adversarial
features to generate targeted perturbations with dominant features, hence
improving targeted transferability.

  * •

We conduct comprehensive experiments to demonstrate that the proposed locality
of images and the feature similarity loss can improve the cross-model targeted
transferability of adversarial images. Besides, the proposed LI attack can be
easily combined with existing methods.

## Related Work

In this section, we review existing works on non-targeted transferable attacks
as well as targeted transferable attacks.

### Non-targeted Transferable Attacks

Non-targeted transferable attacks are based on the Iterative-Fast Gradient
Sign Method (I-FGSM) (Kurakin, Goodfellow, and Bengio 2018), which iteratively
calculates the gradient of the classification loss with respect to the input
and update perturbations along the direction of maximizing the loss. The
multiple-step update of I-FGSM leads to a high wrong prediction of white-box
models. However, the generated adversarial examples are hard to attack other
black-box models. This phenomenon is called over-fitting to the white-box
model (Kurakin, Goodfellow, and Bengio 2017). Subsequently, several works
perform data augmentation or advanced gradient calculation to overcome the
over-fitting problem. Data augmentation creates various input patterns, which
generate adversarial perturbations with a generic pattern. For the input
images, Diverse Input (DI) (Xie et al. 2019) performs random resizing and
padding, Scale-invariant method (SIM) (Lin et al. 2020) apples scale
transformation. However, these data augmentation approaches neglect to
consider more diverse input patterns (e.g., random cropping in this paper),
and focus on the loss-preserving transformation (Lin et al. 2020). This is
because the gradient direction fluctuates violently under more diverse input
patterns for non-target attacks without specified target classes. Advanced
gradient calculation pays attention to changing gradient calculation methods
or designing a new loss function. For changing gradient calculation, the
momentum term (Dong et al. 2018) and the Nesterov accelerated gradient (Lin et
al. 2020) can be incorporated with I-FGSM to stabilize gradients. Translation-
Invariant (TI) (Dong et al. 2019) smooths gradients through a predefined
convolution kernel in order to mitigate the over-fitting problem. Skip
Gradient Method (SGM) (Wu et al. 2020a) modifies the path of gradient
backpropagation by skipping residual modules. Variance Tuning (Wang and He
2021) utilizes gradients from data points around previous data to avoid over-
fitting. For designing a new loss function, Attention-guided Transfer Attack
(ATA) (Wu et al. 2020b) and Feature Importance-aware Attack (FIA) (Wang et al.
2021) disrupt important features that are likely to be utilized in other
black-box models. ATA applies Grad-CAM (Selvaraju et al. 2017) to represent
attention weights of features. Different to ATA, FIA computes averaged
gradients of features among various augmented inputs as attention weights.
However, these new loss functions are restricted to global structures. In
contrast, this paper calculates the feature similarity loss between global and
local structures of images.

### Targeted Transferable Attacks

The targeted transferable attacks are more challenging than the non-targeted
transferable attacks due to the specified target class. One way is to train
auxiliary networks for capturing feature distributions of the targeted class.
Feature Distribution Attack (FDA) (Inkawhich et al. 2020b) utilizes the
intermediate features of the training dataset from the white-box model to
train a binary classifier, which predicts the probability that the current
feature belongs to the targeted class. Then, Through learning class-wise and
layer-wise feature distributions, FDA generates targeted transferable
adversarial perturbations by maximizing the probability outputted from the
trained binary classifier. Subsequently, $FDA^{N}+xent$ (Inkawhich et al.
2020a) incorporates the CE loss and multi-layer information with FDA,
achieving better performance. Transferable targeted perturbations (TTP)
(Naseer et al. 2021) trains a generator to synthesize perturbations that seek
to have similar features with targeted samples in the latent space of a
pretrained discriminator. This series of FDA works and TTP improve the
performance of targeted transferable attacks, but require training auxiliary
networks with the training dataset. To improve the efficiency of targeted
transferable attacks, another way is based on I-FGSM. Activation Attack (AA)
(Inkawhich et al. 2019) replace the classification loss with a euclidean
distance loss between features of adversarial and targeted images. However, AA
depends on the selected examples of the targeted class and achieves low
performance on the large resolution image dataset (e.g.ImageNet (Deng et al.
2009)). Different to AA, Po+Trip (Li et al. 2020) utilizes Poincaré distance
metric to solve the noise curing. They also design a triplet loss for driving
adversarial examples away from the original class. However, Po+Trip evaluates
the attack performance only on easy transfer scenarios, and also achieves poor
performance on the targeted scenario used in the Logit attack (Zhao, Liu, and
Larson 2021). Logit (Zhao, Liu, and Larson 2021) attributes the poor
performance of I-FGSM based methods to the restricted number of iterations.
Thus, Logit enlarges the number of iterations for ensuring the convergence of
attacks. In addition, to overcome the gradient vanishment caused by the large
iterations, Logit utilizes gradients of the targeted logit output with respect
to inputs to update perturbations. Different to them, our method leverages the
global and local structures to generate adversarial examples with high
universality, hence improving targeted transferability. Note that the proposed
LI methods can be easily combined with existing methods.

(a) Comparison on universality (b) Feature similarity analysis

Figure 2: (a) For each targeted perturbation generated by I-FGSM or DTMI, we
calculate the number of successful targeted attacks caused by adding this
perturbation to benign images other than the original optimized image. (b) We
average cosine similarity of intermediate features among different benign
images or adversarial examples that are generated by adding the same
perturbation to these benign images.

## Methodology

### Preliminary

Let $f$ represent the white-box surrogate model, $v$ be the black-box victim
model, $x\in\mathcal{X}\subset\mathbf{R}^{H\times W\times C}$ be the benign
image with the ground-truth label $y\in\mathcal{Y}=\\{1,2,...,K\\}$, where $f$
and $v$ are trained with the same training dataset, $H$, $W$, $C$ denote the
number of height, width and channels respectively, K is the number of classes.
We use $f(x),v(x)$ to be the prediction over the set of classes $\mathcal{Y}$.
Given a specified targeted class $y_{t}$, the targeted transferable attacks
aim to generate adversarial examples $x_{adv}$ from the white-box model $f$
that satisfy $v(x_{adv})=y_{t}$. Following previous works, we enforce an
$L_{\infty}$-norm constraint on perturbations, which can be formulated as
$||x_{adv}-x||_{\infty}=||\delta||_{\infty}\leq\epsilon$, where $\delta$ is
the perturbation, $\epsilon$ denotes a constant of the norm constraint. Given
a classification loss $J$ (e.g.CE loss) of $f$, the targeted attack of I-FGSM
can be formulated as:

$\displaystyle\delta_{0}$ $\displaystyle=0,g_{0}=0,$ (1) $\displaystyle
g_{i+1}$ $\displaystyle=\nabla_{\delta}J(f(x+\delta_{i}),y_{t}),$ (2)
$\displaystyle\delta_{i+1}$ $\displaystyle=\delta_{i}-\alpha*sign(g_{i+1}),$
(3) $\displaystyle\delta_{i+1}$
$\displaystyle=Clip_{x,\epsilon}(\delta_{i+1}),$ (4)

where $\delta_{i},g_{i}$ denotes the adversarial perturbation and the gradient
of the $i$-th iteration, $i=[0,...,I-1]$, and $I$ is the maximum number of
iterations, $\alpha$ is the step size, the function $Clip_{x,\epsilon}(\cdot)$
projects $\delta$ to the vicinity of $x$ for satisfying the $L_{\infty}$-norm
constraint. Specifically, I-FGSM first initializes $\delta_{0}$ and and
$g_{0}$ by $0$ (Eq.1), then calculates the gradients of the loss function with
respect to the perturbation (Eq.2), and drives the prediction of $f$ on the
adversarial example towards the targeted class by minimizing
$J(f(x+\delta_{i}),y_{t})$ (Eq.3), finally restricts the adversarial
perturbation with the $L_{\infty}$-norm constraint (Eq.4). Eq.2, 3, 4 are
performed alternately until the maximum iterations is reached. Through this
greedy update, I-FGSM is easily caught in local maxima and over-fitting to
$f$, which results in performing poorly for both non-targeted and targeted
attacks. Therefore, Logit (Zhao, Liu, and Larson 2021) utilizes the
combination of DI (Xie et al. 2019), TI (Dong et al. 2019) and MI (Dong et al.
2018) as the baseline, which achieves substantial performance in targeted
transferable attacks with large numbers of iterations, rather than I-FGSM. For
convenience, we abbreviate the name of this combination as DTMI. DTMI replaces
Eq.2 with

$g_{i+1}=\mu\cdot
g_{i}+\frac{W\cdot\nabla_{\delta}J(f(T(x+\delta_{i},p)),y_{t})}{||W\cdot\nabla_{\delta}J(f(T(x+\delta_{i},p)),y_{t})||_{1}},$
(5)

where $T(x+\delta_{i},p)$ perform random resizing and padding with a
probability $p$ in DI, $W$ is the convolution kernel in TI, $\mu$ is a decay
factor in MI. Following them, we incorporate the locality of images and the
feature similarity loss with DTMI in order to boost targeted transferability.

### Universality of Targeted Perturbations

Targeted transferable attacks aim to generate cross-model perturbations that
drive the prediction of different models towards the same specified class. It
requires that perturbations generated from one white-box model are model-
agnostic or universal to different models. A simple way to meet this
requirement is to optimize perturbations on ensemble models. However, it may
be unsuitable in the real world, because the number of white-box models is
limited. Intuitively, image-agnostic perturbations, which are highly dominant
features than benign images (Zhang et al. 2020), may activate channels of
different models with a high probability, hence becoming more universal to
models. However, generating image-agnostic perturbations like (Moosavi-
Dezfooli et al. 2017) requires additional images for perturbation optimization
and hence consumes more computation. On the contrary, DTMI can generate high
targeted transferable perturbations without additional things, which motivates
us to further investigate the universality of perturbations generated by DTMI.

A toy experiment is conducted to understand the correlation between
universality and targeted transferability. We optimize perturbations on the
ImageNet-compatible dataset (dataset details are in Section “Experimental
Settings”) by I-FGSM and DTMI with the white-box model DenseNet121. For each
image, the generated adversarial perturbation is then added to other images
rather than itself to calculate the number of successful targeted attacks on
DenseNet121. The classification loss is set as the CE loss.

The results are shown in Figure 2(a). The perturbations are sorted in
descending order based on the number of successful attacks on other images for
I-FGSM. As can be seen, the targeted perturbations tend to be universal to
different images, even for the perturbations generated from I-FGSM. Besides,
the diverse input patterns and advanced gradient calculation used in DTMI
drive targeted transferable perturbations towards high generality, despite the
fact that DTMI optimizes perturbations on one image. It experimentally
demonstrates that targeted perturbations are generic to different images,
which indicates that the generated targeted perturbations represent the
feature distributions of targeted classes in the white-box model
(DenseNet121), and even more dominant than benign images’ features.

To further illustrate the dominance of targeted perturbations, we calculate
the averaged cosine similarity of intermediate features between images, which
consist of benign images and adversarial images that are generated by adding
each perturbation that can lead to the targeted prediction. The results are
summarized in Figure 2(b). It can be observed that the features of adversarial
images that are added to the same perturbation become more similar. This
suggests that, compared to benign images, targeted perturbations are the
dominant feature.

These two experiments jointly show that DTMI leverages the targeted feature
distributions of the white-box model to generate targeted perturbations with
high dominant features, and improves the generality of perturbations by
creating diverse inputs and stable gradient calculation. These factors
motivate us to generate intra-image-agnostic perturbations by creating more
diverse input patterns and improving the dominance of adversarial features for
boosting cross-model targeted transferability.

### Locality of Images (LI) Attack

Based on the analysis above, we propose to incorporate the Locality of Images
into the iterative attacks, named LI. To create more diverse input patterns,
we consider the random cropping, which crops images into a local image patch
by the scale parameter $s=\\{s_{l},s_{int}\\}$. Where $s_{l}$ denotes the
lower bound for the area of the random cropped images, and $s_{int}$ is the
interval value between the lower and upper bounds, thus $s_{l}+s_{int}$ is the
upper bound. After cropping images, we resize them to the same shape with
benign images. Let $Loc(x,s)$ be the random cropping and the resizing
operations222We perform it by RandomResizedCrop in torchvision and ignore the
parameter of the random aspect ratio.. In addition, to generate high universal
perturbations, we propose a feature similarity loss to maximize the cosine
similarity of intermediate features between the adversarial global and local
inputs. It can be formulated by
$CS(f_{l}(x+\delta_{i}),f_{l}(Loc(x,s)+\delta_{i}))$, where $f_{l}(\cdot)$
means to extract features from the $l$-th layer of the white-box model $f$,
the function $CS(\cdot,\cdot)$ calculates cosine similarity score of features
between adversarial global and local inputs. In summary, the proposed LI
replaces Eq.2 with:

$\begin{split}g_{i+1}=&\nabla_{\delta}(J(f(x+\delta_{i}),y_{t})+J(f(Loc(x,s)+\delta_{i}),y_{t})\\\
&-\lambda\cdot CS(f_{l}(x+\delta_{i}),f_{l}(Loc(x,s)+\delta))),\end{split}$
(6)

where $\lambda$ weights the contribution of the classification loss and the
proposed similarity loss.

In this way, the perturbation optimization in LI can leverage global and local
structures of the inputs to improve the generalization of perturbations, and
the maximization of the cosine similarity can align intermediate features
between adversarial global and local inputs for improving the dominance of
feature representation of perturbations. Following (Zhao, Liu, and Larson
2021), we integrate LI with DTMI, named DTMI-LI, which is illustrated in
Algorithm 1. In the end, LI can generate adversarial perturbations with
dominant features by incorporating locality of images, as shown in Figure
2(b), hence improving targeted transferability.

Algorithm 1 DTMI-LI attack

Input: the classification loss function $J$, white-box model $f$, benign image
$x$, targeted class $y_{t}$.
Parameter: The perturbation budget $\epsilon$, iteration number I, step size
$\alpha$, scale parameter $s=\\{s_{l},s_{int}\\}$, weighted parameter
$\lambda$, and DTMI parameters $T(\cdot,p)$, $W$, $\mu$.
Output: The adversarial example $x_{adv}$.

1: Initialize $\delta_{0}$ and $g_{0}$ by Eq.1

2: for $i=0$ to $I-1$ do

3:
$g_{i+1}=\nabla_{\delta}(J(f(T(x+\delta_{i},p)),y_{t})+J(f(T(Loc(x,s)+\delta_{i}),p),y_{t})-\lambda\cdot
CS(f_{l}(T(x+\delta_{i},p)),f_{l}(T(Loc(x,s)+\delta,p))))$

4: $g_{i+1}=\mu\cdot g_{i}+\frac{W\cdot g_{i+1}}{||W\cdot g_{i+1}||_{1}}$

5: Update and Clip $\delta_{i+1}$ by Eq.3, 4

6: end for

7: return $x+\delta_{I}$

## Experiment

### Experimental Settings

#### Dataset and models

Following (Zhao, Liu, and Larson 2021), we attack four diverse classifier
architectures: ResNet50 (He et al. 2016), DenseNet121 (Huang, Liu, and
Weinberger 2017), VGGNet16 (Simonyan and Zisserman 2015), and Inception-v3
(Szegedy et al. 2016) with the ImageNet-compatible
dataset333https://github.com/cleverhans-
lab/cleverhans/tree/master/cleverhans˙v3.1.0/examples/nips17˙adversarial˙competition/dataset.
The architectures of these four models are more diverse and challenging than
the ones used in (Li et al. 2020). The used dataset is firstly introduced by
the NIPS 2017 Competition on Adversarial Attacks and Defenses. It consists of
1,000 images and corresponding labels for targeted adversarial attacks.

Model | Layer 1 | Layer 2 | Layer 3 | Layer 4
---|---|---|---|---
Res50 | Block-1 | Block-2 | Block-3 | Block-4
Den121 | Block-1 | Block-2 | Block-3 | Block-4
VGG16 | ReLU-4 | ReLU-7 | ReLU-10 | ReLU-13
Inc-v3 | Conv-4a | Mix-5d | Mix-6e | Mix-7c
Table 1: Intermediate layers for feature extraction. “Block” means the basic
block in ResNet50 and DenseNet121. “ReLU-k” denotes the $k$-th ReLU layer.

#### Attack setting

We use the Targeted Attack Success Rate (TASR) to evaluate the targeted attack
on one black-box model, which is the rate of adversarial examples that are
successfully classified as the targeted class by the black-box model. Hence,
the methods with higher TASR can generate adversarial examples with high
targeted transferability. Following (Zhao, Liu, and Larson 2021), we set the
maximum perturbation as $\epsilon=16$, the step size as $\alpha=2$, the
maximum number of iterations as $I=300$, DTMI with the original parameters as
the baseline attack. For each model, we select layer 1/2/3/4 from bottom to
top layer (as shown in Table 1) to calculate the feature similarity loss.

Attack | White-box Model: Res50 | White-box Model: Dense121
---|---|---
$\rightarrow\textrm{Dense121}$ | $\rightarrow\textrm{VGG16}$ | $\rightarrow\textrm{Inc-v3}$ | $\rightarrow\textrm{Res50}$ | $\rightarrow\textrm{VGG16}$ | $\rightarrow\textrm{Inc-v3}$
DTMI-CE | 27.1/39.7/44.3 | 18.9/27.6/29.4 | 2.2/3.4/4.1 | 12.9/16.7/18.4 | 8.1/10.6/10.6 | 1.7/2.2/3.2
DTMI-CE-LI | 6.3/28.1/51.7 | 3.1/21.4/41.6 | 0.6/5.2/8.9 | 2.3/18.2/33.0 | 1.1/14.6/28.9 | 0.3/5.5/10.9
DTMI-Logit | 30.4/64.4/71.8 | 22.6/55.1/62.8 | 2.7/7.1/9.6 | 16.1/39.3/43.7 | 13.5/33.0/38.1 | 2.1/7.1/7.7
DTMI-Logit-LI | 23.7/64.8/75.1 | 16.9/56.8/67.7 | 1.8/7.7/11.2 | 12.7/42.2/50.0 | 9.5/37.3/45.1 | 1.7/7.9/10.3
Attack | White-box Model: VGG16 | White-box Model: Inc-v3
$\rightarrow\textrm{Res50}$ | $\rightarrow\textrm{Dense121}$ | $\rightarrow\textrm{Inc-v3}$ | $\rightarrow\textrm{Res50}$ | $\rightarrow\textrm{Dense121}$ | $\rightarrow\textrm{VGG16}$
DTMI-CE | 0.6/0.6/0.5 | 0.4/0.3/0.4 | 0.0/0.0/0.0 | 0.8/1.8/2.4 | 0.8/2.4/2.9 | 0.7/1.3/1.8
DTMI-CE-LI | 0.2/1.6/1.8 | 0.3/1.5/1.6 | 0.0/0.2/0.1 | 0.4/1.6/2.9 | 0.2/1.8/4.6 | 0.0/1.2/2.2
DTMI-Logit | 3.0/9.6/11.3 | 3.2/12.0/13.7 | 0.1/0.6/0.7 | 0.9/2.0/2.8 | 1.1/3.3/5.0 | 0.6/2.2/3.9
DTMI-Logit-LI | 2.7/12.3/13.2 | 3.6/13.4/15.3 | 0.1/1.1/0.8 | 0.8/2.7/4.3 | 1.1/3.9/7.2 | 0.5/2.2/3.9
Table 2: TASR of all black-box models under four attack scenarios using ResNet50, DenseNet121, VGGNet16 and Inception-v3 as white-box models, respectively. We conduct these experiments three times and report TASR with 20/100/300 iterations. The best results with 300 iterations are in bold.  Ensemble Attack | Black-box Model | Average
---|---|---
Res50 | Dense121 | VGG16 | Inc-v3
DTMI-CE | 31.1 | 55.2 | 51.6 | 16.1 | 38.5
DTMI-CE-LI | 42.8 | 55.2 | 67.9 | 24.2 | 47.5
DTMI-Logit | 70.2 | 82.3 | 82.2 | 29.1 | 65.9
DTMI-Logit-LI | 75.9 | 83.0 | 84.1 | 35.4 | 69.6
Table 3: TASR of one black-box model in ensemble transfer attacks. TASR with
300 iterations is reported. The best results are in bold.

### Performance Comparison

In this section, we integrate our method with several baselines: CE loss with
DTMI (DTMI-CE) and Logit loss (Zhao, Liu, and Larson 2021) with DTMI (DTMI-
Logit). We ignore Po+Trip (Li et al. 2020) because it has a lower performance
than Logit loss. For LI, the weighted parameter $\lambda$ is set as $0.4$, the
scale parameters $s$ is set as $(0.1,0)$, and the layer 3 is used to extract
features. These parameters will be discussed in Section “Ablation Studies”.

#### Single-model transferable attacks

We conduct single-model transferable experiments by selecting one model as the
white-box model to attack the other three black-box models. Table 2 shows the
results. We have the following observations. First, the proposed LI method
achieves higher TASR than DTMI-CE and DTMI-Logit by a large margin in almost
all cases. It suggests that the proposed LI is suitable for different
classification loss functions. Second, the attacks using ResNet50 and
DenseNet121 as white-box models outperform that using VGGNet16 and
Inception-v3, which is also observed in (Inkawhich et al. 2019, 2020b; Zhao,
Liu, and Larson 2021). It may be caused by the skip connection structure,
which mitigates the gradient vanishing/exploding problem in a large number of
iterations and emphasizes on features of lower layers by backpropagating
gradients on both residual modules and skip connections. These features tend
to transfer among different models (Wu et al. 2020a; Wei et al. 2022b). Third,
LI performs worse than other methods when using a small number of iterations
(e.g.$I=20$). This is because the local input pattern and the feature
similarity loss require a large iteration for convergence.

#### Ensemble model transferable attacks

As mentioned above, the targeted perturbations generated from a set of models
are more model-agnostic, thus can obtain high cross-model transferability.
Hence, we select one black-box model to attack, and use the other three models
as white-box models. Following (Zhao, Liu, and Larson 2021), we simply assign
equal weights to all white-box models. Results are shown in Table 3. As can be
seen, compared to single-model transferable attacks, ensemble attacks achieve
much better performance. It demonstrates that the model-agnostic perturbations
can easily transfer to attack other models. In addition, the proposed LI
further boosts the cross-model targeted transferability. However, the
improvement of TASR gained from DTMI-Logit-LI is not so significant. This can
be explained by the fact that the loss function value of Logit increases
infinitely, while the value of cosine similarity is bounded. Thus, it impedes
the maximization of feature similarity. Nevertheless, methods that are
combined with LI can promote targeted transferability in all cases.

Locality | Feature Similarity Loss | Averaged TASR
---|---|---
- | - | 9.8
✓ | - | 10.9
✓ | ✓ | 15.6
Table 4: Average TASR (%) of black-box models for our proposed method with
different component combinations. The classification loss is set as CE. ‘✓’
indicates that the component is used while ‘-’ indicates that it is not used.
TASR is averaged among four attack scenarios using ResNet50, DenseNet121,
VGGNet16 and Inceptionv3 as white-box models, respectively.

(a) The scale parameter (b) The feature extraction layer and weighted
parameter

Figure 3: Average TASR with different values of hypterparameters in the
attack.

### Ablation Studies

In this section, we investigate the effects of each component and various
hyperparameters.

#### Effect of Components

The evaluations are conducted on four attack scenarios using ResNet50,
DenseNet121, VGGNet16 and Inceptionv3 as white-box models, respectively. We
split LI into the locality of images and the feature similarity loss. Table 4
show the results of different component combinations. As can be seen, both
components improve targeted transferability. And the improvement of TASR
gained from feature similarity loss is more significant. Combining all
components increases the average TASR by 59.18%. It demonstrates the
effectiveness of each component in the proposed LI attack.

#### Effect of hyperparameters

The evaluations are conducted by using densenet121 as the white-box model and
averaging TASR among black-box models. The scale parameter $s$ determines the
area of cropped images. When the area is large, LI overlooks the local
structure of inputs. Thus, it is vital to study optimal values of $s$. We fix
the weighted parameter $\lambda=1.0$, and the feature extraction layer as
layer 3 due to the high transferability of middle layers (Wei et al. 2022b).
Figure 3(a) shows the results with $s_{l}\in[0.1,0.3,0.5,0.7]$ and
$s_{int}\in[0.0,0.1,0.2,0.3]$. We observe that the smaller the area of cropped
images, the higher the performance. It suggests that local image patches that
differ significantly from the original images provide more diverse input
patterns for perturbation optimization and contribute to targeted
transferability. Besides, when $s_{l}=0.1$ and $s_{int}=0.1$, the optimal
result is reached. However, the area relative to the original image may
fluctuate within $[0.1,0.2]$. To keep it stable, we use the parameters
$s=(0.1,0.0)$ of the sub-optimal result to conduct subsequent experiments.
Figure 3(b) shows the results of performing attacks on different layers and
$\lambda$. Extracting features from layer 3 is better than other layers. This
is consistent with the observations in (Wei et al. 2022b). For the weighted
parameter $\lambda$, we set $\lambda\in[0.4,0.6,0.8,1.0]$. When $\lambda=0.4$,
LI achieves the best result.

## Conclusion

In this paper, we provide new insight into targeted transferability, that is
targeted transferable perturbations tend to be universal to images. Based on
this observation, we propose the Locality of Images (LI) attack, which
optimizes perturbations on both global and local images, and aligns
intermediate features between them. Through incorporating local structures
with global structures, LI can tune the suitability of crafted perturbations
and boost targeted transferability. Besides, the proposed LI can easily be
combined with existing transfer-based attack methods. We conduct extensive
experiments to show that LI can improve targeted transferability regardless of
the single-model attack or ensemble-based attack. The combination of the
proposed LI and DTMI consistently outperforms the baseline attacks by 12%. Our
best targeted attack, DTMI-Logit-LI can achieve a 69.6% TASR on average in the
ensemble-based scenario. The results demonstrate that adversarial
perturbations with high universality can be more transferable even across wide
architectural gaps between models, posing threats to the real-world
applications of models. In the future, we will solve the problem that the
value of the logit loss increases infinitely by an adaptive weighted
parameter, and construct importance-aware features to further boost targeted
transferability.

## References

  * Biggio et al. (2013) Biggio, B.; Corona, I.; Maiorca, D.; Nelson, B.; Srndic, N.; Laskov, P.; Giacinto, G.; and Roli, F. 2013.  Evasion Attacks against Machine Learning at Test Time.  In _ECML/PKDD_.
  * Deng et al. (2009) Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and Fei-Fei, L. 2009.  ImageNet: A large-scale hierarchical image database.  _2009 IEEE Conference on Computer Vision and Pattern Recognition_ , 248–255.
  * Dong et al. (2018) Dong, Y.; Liao, F.; Pang, T.; Su, H.; Zhu, J.; Hu, X.; and Li, J. 2018.  Boosting adversarial attacks with momentum.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 9185–9193.
  * Dong et al. (2019) Dong, Y.; Pang, T.; Su, H.; and Zhu, J. 2019.  Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks.  _2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 4307–4316.
  * Goodfellow, Shlens, and Szegedy (2014) Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2014.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_.
  * He et al. (2016) He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016.  Deep Residual Learning for Image Recognition.  _2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , 770–778.
  * Huang, Liu, and Weinberger (2017) Huang, G.; Liu, Z.; and Weinberger, K. Q. 2017.  Densely Connected Convolutional Networks.  _2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , 2261–2269.
  * Inkawhich et al. (2020a) Inkawhich, N.; Liang, K.; Wang, B.; Inkawhich, M.; Carin, L.; and Chen, Y. 2020a.  Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferability.  _Advances in Neural Information Processing Systems_ , 33: 20791–20801.
  * Inkawhich et al. (2020b) Inkawhich, N.; Liang, K. J.; Carin, L.; and Chen, Y. 2020b.  Transferable perturbations of deep feature distributions.  _arXiv preprint arXiv:2004.12519_.
  * Inkawhich et al. (2019) Inkawhich, N.; Wen, W.; Li, H. H.; and Chen, Y. 2019.  Feature space perturbations yield more transferable adversarial examples.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 7066–7074.
  * Kurakin, Goodfellow, and Bengio (2017) Kurakin, A.; Goodfellow, I. J.; and Bengio, S. 2017.  Adversarial Machine Learning at Scale.  _ArXiv_ , abs/1611.01236.
  * Kurakin, Goodfellow, and Bengio (2018) Kurakin, A.; Goodfellow, I. J.; and Bengio, S. 2018.  Adversarial examples in the physical world.  In _Artificial intelligence safety and security_ , 99–112. Chapman and Hall/CRC.
  * Li et al. (2020) Li, M.; Deng, C.; Li, T.; Yan, J.; Gao, X.; and Huang, H. 2020.  Towards Transferable Targeted Attack.  _2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 638–646.
  * Lin et al. (2020) Lin, J.; Song, C.; He, K.; Wang, L.; and Hopcroft, J. E. 2020.  Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks.  _arXiv: Learning_.
  * Liu et al. (2017) Liu, Y.; Chen, X.; Liu, C.; and Song, D. 2017.  Delving into Transferable Adversarial Examples and Black-box Attacks.  In _International Conference on Learning Representations_.
  * Moosavi-Dezfooli et al. (2017) Moosavi-Dezfooli, S.-M.; Fawzi, A.; Fawzi, O.; and Frossard, P. 2017.  Universal Adversarial Perturbations.  _2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , 86–94.
  * Naseer et al. (2021) Naseer, M.; Khan, S.; Hayat, M.; Khan, F. S.; and Porikli, F. 2021.  On generating transferable targeted perturbations.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , 7708–7717.
  * Selvaraju et al. (2017) Selvaraju, R. R.; Das, A.; Vedantam, R.; Cogswell, M.; Parikh, D.; and Batra, D. 2017.  Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization.  _International Journal of Computer Vision_ , 128: 336–359.
  * Simonyan and Zisserman (2015) Simonyan, K.; and Zisserman, A. 2015.  Very Deep Convolutional Networks for Large-Scale Image Recognition.  _CoRR_ , abs/1409.1556.
  * Szegedy et al. (2016) Szegedy, C.; Vanhoucke, V.; Ioffe, S.; Shlens, J.; and Wojna, Z. 2016.  Rethinking the Inception Architecture for Computer Vision.  _2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , 2818–2826.
  * Wang and He (2021) Wang, X.; and He, K. 2021.  Enhancing the Transferability of Adversarial Attacks through Variance Tuning.  _2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 1924–1933.
  * Wang et al. (2021) Wang, Z.; Guo, H.; Zhang, Z.; Liu, W.; Qin, Z.; and Ren, K. 2021.  Feature Importance-aware Transferable Adversarial Attacks.  _2021 IEEE/CVF International Conference on Computer Vision (ICCV)_ , 7619–7628.
  * Wei et al. (2022a) Wei, Z.; Chen, J.; Wu, Z.; and Jiang, Y.-G. 2022a.  Boosting the Transferability of Video Adversarial Examples via Temporal Translation.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 36, 2659–2667.
  * Wei et al. (2022b) Wei, Z.; Chen, J.; Wu, Z.; and Jiang, Y.-G. 2022b.  Cross-Modal Transferable Adversarial Attacks from Images to Videos.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 15064–15073.
  * Wu et al. (2020a) Wu, D.; Wang, Y.; Xia, S.; Bailey, J.; and Ma, X. 2020a.  Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets.  _ArXiv_ , abs/2002.05990.
  * Wu et al. (2020b) Wu, W.; Su, Y.; Chen, X.; Zhao, S.; King, I.; Lyu, M. R.; and Tai, Y.-W. 2020b.  Boosting the Transferability of Adversarial Samples via Attention.  _2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 1158–1167.
  * Xie et al. (2019) Xie, C.; Zhang, Z.; Zhou, Y.; Bai, S.; Wang, J.; Ren, Z.; and Yuille, A. L. 2019\.  Improving transferability of adversarial examples with input diversity.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2730–2739.
  * Zhang et al. (2020) Zhang, C.; Benz, P.; Imtiaz, T.; and Kweon, I. S. 2020.  Understanding Adversarial Examples From the Mutual Influence of Images and Perturbations.  _2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 14509–14518.
  * Zhao, Liu, and Larson (2021) Zhao, Z.; Liu, Z.; and Larson, M. 2021.  On success and simplicity: A second look at transferable targeted attacks.  _Advances in Neural Information Processing Systems_ , 34: 6115–6128.