Interpreting Attributions and Interactions of Adversarial Attacks
arXiv:2108.06895
Abstract
This paper aims to explain adversarial attacks in terms of how adversarial perturbations contribute to the attacking task. We estimate attributions of different image regions to the decrease of the attacking cost based on the Shapley value. We define and quantify interactions among adversarial perturbation pixels, and decompose the entire perturbation map into relatively independent perturbation components. The decomposition of the perturbation map shows that adversarially-trained DNNs have more perturbation components in the foreground than normally-trained DNNs. Moreover, compared to the normally-trained DNN, the adversarially-trained DNN have more components which mainly decrease the score of the true category. Above analyses provide new insights into the understanding of adversarial attacks.
References in corpus (16)
- Distilling the Knowledge in a Neural Network
- Explaining and Harnessing Adversarial Examples
- Axiomatic Attribution for Deep Networks
- Striving for Simplicity: The All Convolutional Net
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Detecting Adversarial Samples from Artifacts
- On Detecting Adversarial Perturbations
- Consistent feature attribution for tree ensembles
- Adversarial examples from computational constraints
- Structured Adversarial Attack: Towards General Implementation and Better Interpretability
- Improving the Robustness of Deep Neural Networks via Stability Training
- Adversarial Spheres
- Explaining Explanations: Axiomatic Feature Interactions for Deep Networks
- Technical Note: Game-Theoretic Interactions of Different Orders
- Can We Faithfully Represent Masked States to Compute Shapley Values on a DNN?
- Building Interpretable Interaction Trees for Deep NLP Models