Smoothed Geometry for Robust Attribution

Abstract

Feature attributions are a popular tool for explaining the behavior of Deep Neural Networks (DNNs), but have recently been shown to be vulnerable to attacks that produce divergent explanations for nearby inputs. This lack of robustness is especially problematic in high-stakes applications where adversarially-manipulated explanations could impair safety and trustworthiness. Building on a geometric understanding of these attacks presented in recent work, we identify Lipschitz continuity conditions on models' gradient that lead to robust gradient-based attributions, and observe that smoothness may also be related to the ability of an attack to transfer across multiple attribution methods. To mitigate these attacks in practice, we propose an inexpensive regularization method that promotes these conditions in DNNs, as well as a stochastic smoothing technique that does not require re-training. Our experiments on a range of image models demonstrate that both of these mitigations consistently improve attribution robustness, and confirm the role that smooth geometry plays in these attacks on real, large-scale models.

References in corpus (21)

• Grad-CAM++: Improved Visual Explanations for Deep Convolutional Networks
• Axiomatic Attribution for Deep Networks
• Striving for Simplicity: The All Convolutional Net
• Learning Important Features Through Propagating Activation Differences
• SmoothGrad: removing noise by adding noise
• Sanity Checks for Saliency Maps
• Visualizing and Understanding Convolutional Networks
• Towards Robust Interpretability with Self-Explaining Neural Networks
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Spectral Norm Regularization for Improving the Generalizability of Deep Learning
• RISE: Randomized Input Sampling for Explanation of Black-box Models
• The (Un)reliability of saliency methods
• Fooling Neural Network Interpretations via Adversarial Model Manipulation
• Understanding artificial intelligence ethics and safety
• Provable Robustness of ReLU networks via Maximization of Linear Regions
• A Hitting Time Analysis of Stochastic Gradient Langevin Dynamics
• Restricting the Flow: Information Bottlenecks for Attribution
• Robust Attribution Regularization
• Provable Certificates for Adversarial Examples: Fitting a Ball in the Union of Polytopes
• How to Manipulate CNNs to Make Them Lie: the GradCAM Case
• Interpreting Interpretations: Organizing Attribution Methods by Criteria

Cited by in corpus (8)

• SS-CAM: Smoothed Score-CAM for Sharper Visual Feature Localization
• Fooling Partial Dependence via Data Poisoning
• Robust Models Are More Interpretable Because Attributions Look Normal
• Towards Robust Explanations for Deep Neural Networks
• Selective Ensembles for Consistent Predictions
• Stein Latent Optimization for Generative Adversarial Networks
• Influence Patterns for Explaining Information Flow in BERT
• Reconstructing Actions To Explain Deep Reinforcement Learning