On the human-recognizability phenomenon of adversarially trained deep image classifiers

Abstract

In this work, we investigate the phenomenon that robust image classifiers have human-recognizable features -- often referred to as interpretability -- as revealed through the input gradients of their score functions and their subsequent adversarial perturbations. In particular, we demonstrate that state-of-the-art methods for adversarial training incorporate two terms -- one that orients the decision boundary via minimizing the expected loss, and another that induces smoothness of the classifier's decision surface by penalizing the local Lipschitz constant. Through this demonstration, we provide a unified discussion of gradient and Jacobian-based regularizers that have been used to encourage adversarial robustness in prior works. Following this discussion, we give qualitative evidence that the coupling of smoothness and orientation of the decision boundary is sufficient to induce the aforementioned human-recognizability phenomenon.

References in corpus (8)

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Distilling the Knowledge in a Neural Network
• Theoretically Principled Trade-off between Robustness and Accuracy
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Defensive Distillation is Not Robust to Adversarial Examples
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?
• Robust or Private? Adversarial Training Makes Models More Vulnerable to Privacy Attacks