Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness

Abstract

For sensitive problems, such as medical imaging or fraud detection, Neural Network (NN) adoption has been slow due to concerns about their reliability, leading to a number of algorithms for explaining their decisions. NNs have also been found vulnerable to a class of imperceptible attacks, called adversarial examples, which arbitrarily alter the output of the network. Here we demonstrate both that these attacks can invalidate prior attempts to explain the decisions of NNs, and that with very robust networks, the attacks themselves may be leveraged as explanations with greater fidelity to the model. We show that the introduction of a novel regularization technique inspired by the Lipschitz constraint, alongside other proposed improvements, greatly improves an NN's resistance to adversarial examples. On the ImageNet classification task, we demonstrate a network with an Accuracy-Robustness Area (ARA) of 0.0053, an ARA 2.4x greater than the previous state of the art. Improving the mechanisms by which NN decisions are understood is an important direction for both establishing trust in sensitive domains and learning more about the stimuli to which NNs respond.

arXiv comment23 pages with a 14 page appendix. Submitted to Nature ML for peer review

References in corpus (17)

• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• Interpretable machine learning: definitions, methods, and applications
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Understanding the Effective Receptive Field in Deep Convolutional Neural Networks
• Certified Adversarial Robustness via Randomized Smoothing
• On Evaluating Adversarial Robustness
• Online Tracking by Learning Discriminative Saliency Map with Convolutional Neural Network
• Adversarial Attacks and Defences: A Survey
• Robustness May Be at Odds with Accuracy
• Attention-over-Attention Neural Networks for Reading Comprehension
• Parseval Networks: Improving Robustness to Adversarial Examples
• Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
• Learn To Pay Attention
• On the Geometry of Adversarial Examples

Cited by in corpus (9)

• Adversarial attacks and defenses in explainable artificial intelligence: A survey
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks
• Deepfake Detection: A Comprehensive Survey from the Reliability Perspective
• Quantifying the Preferential Direction of the Model Gradient in Adversarial Training With Projected Gradient Descent
• White Paper Machine Learning in Certified Systems
• Feature Guided Training and Rotational Standardisation for the Morphological Classification of Radio Galaxies
• The Inherent Adversarial Robustness of Analog In-Memory Computing
• Combining AI Control Systems and Human Decision Support via Robustness and Criticality
• AN-GCN: An Anonymous Graph Convolutional Network Defense Against Edge-Perturbing Attack