Neural network interpretation methods, particularly feature attribution methods, are known to be fragile with respect to adversarial input perturbations. To address this, several methods for enhancing the local smoothness of the gradient while training have been proposed for attaining \textit{robust} feature attributions. However, the lack of considering the normalization of the attributions, which is essential in their visualizations, has been an obstacle to understanding and improving the robustness of feature attribution methods. In this paper, we provide new insights by taking such normalization into account. First, we show that for every non-negative homogeneous neural network, a naive $\ell_2$-robust criterion for gradients is \textit{not} normalization invariant, which means that two functions with the same normalized gradient can have different values. Second, we formulate a normalization invariant cosine distance-based criterion and derive its upper bound, which gives insight for why simply minimizing the Hessian norm at the input, as has been done in previous work, is not sufficient for attaining robust feature attribution. Finally, we propose to combine both $\ell_2$ and cosine distance-based criteria as regularization terms to leverage the advantages of both in aligning the local gradient. As a result, we experimentally show that models trained with our method produce much more robust interpretations on CIFAR-10 and ImageNet-100 without significantly hurting the accuracy, compared to the recent baselines. To the best of our knowledge, this is the first work to verify the robustness of interpretation on a larger-scale dataset beyond CIFAR-10, thanks to the computational efficiency of our method.

Explainability has been widely stated as a cornerstone of the responsible and trustworthy use of machine learning models. With the ubiquitous use of Deep Neural Network (DNN) models expanding to risk-sensitive and safety-critical domains, many methods have been proposed to explain the decisions of these models. Recent years have also seen concerted efforts that have shown how such explanations can be distorted (attacked) by minor input perturbations. While there have been many surveys that review explainability methods themselves, there has been no effort hitherto to assimilate the different methods and metrics proposed to study the robustness of explanations of DNN models. In this work, we present a comprehensive survey of methods that study, understand, attack, and defend explanations of DNN models. We also present a detailed review of different metrics used to evaluate explanation methods, as well as describe attributional attack and defense methods. We conclude with lessons and take-aways for the community towards ensuring robust explanations of DNN model predictions.

模型归因在深度神经网络中很重要，因为它们可以帮助实践者理解模型，但是最近的研究表明，通过向输入中添加不可察觉的噪声可以轻松扰动归因。非差异性肯德尔的等级相关性是归因保护的关键绩效指数。在本文中，我们首先证明了预期的肯德尔的等级相关性与余弦相似性呈正相关，然后表明归因方向是归因鲁棒性的关键。基于这些发现，我们探索了归因的矢量空间，以使用$ \ ell_p $ norm来解释归因防御方法的缺点，并提出了集成的梯度正常化程序（IGR），从而最大程度地提高了自然和扰动属性之间的余弦相似性。我们的分析进一步公开了IGR鼓励具有相同激活状态的天然样品和相应扰动样品的神经元，这证明可以诱导基于梯度的归因方法的鲁棒性。我们在不同模型和数据集上的实验证实了我们对归因保护的分析，并证明了对抗性鲁棒性的不当改善。

Post-hoc explanation methods are used with the intent of providing insights about neural networks and are sometimes said to help engender trust in their outputs. However, popular explanations methods have been found to be fragile to minor perturbations of input features or model parameters. Relying on constraint relaxation techniques from non-convex optimization, we develop a method that upper-bounds the largest change an adversary can make to a gradient-based explanation via bounded manipulation of either the input features or model parameters. By propagating a compact input or parameter set as symbolic intervals through the forwards and backwards computations of the neural network we can formally certify the robustness of gradient-based explanations. Our bounds are differentiable, hence we can incorporate provable explanation robustness into neural network training. Empirically, our method surpasses the robustness provided by previous heuristic approaches. We find that our training method is the only method able to learn neural networks with certificates of explanation robustness across all six datasets tested.

深度神经网络的高度非线性性质使它们容易受到对抗例子的影响，并且具有不稳定的梯度，从而阻碍了可解释性。但是，解决这些问题的现有方法，例如对抗性训练，是昂贵的，并且通常会牺牲预测的准确性。在这项工作中，我们考虑曲率，这是编码非线性程度的数学数量。使用此功能，我们展示了低曲率的神经网络（LCNN），这些神经网络（LCNN）的曲率比标准模型大大低，同时表现出相似的预测性能，从而导致稳健性和稳定梯度，并且只有略有增加的训练时间。为了实现这一目标，我们最大程度地减少了与数据依赖性的上限在神经网络的曲率上，该曲率分解了其组成层的曲率和斜率方面的总体曲率。为了有效地最大程度地减少这种结合，我们介绍了两个新型的建筑组件：首先，一种称为中心软pplus的非线性性，是SoftPlus非线性的稳定变体，其次是Lipschitz构成的批处理标准化层。我们的实验表明，与标准的高曲率对应物相比，LCNN具有较低的曲率，更稳定的梯度和增加现成的对抗性鲁棒性，而不会影响预测性能。我们的方法易于使用，可以很容易地将其纳入现有的神经网络模型中。

最近的研究表明，深度神经网络（DNNS）极易受到精心设计的对抗例子的影响。对那些对抗性例子的对抗性学习已被证明是防御这种攻击的最有效方法之一。目前，大多数现有的对抗示例生成方法基于一阶梯度，这几乎无法进一步改善模型的鲁棒性，尤其是在面对二阶对抗攻击时。与一阶梯度相比，二阶梯度提供了相对于自然示例的损失格局的更准确近似。受此启发的启发，我们的工作制作了二阶的对抗示例，并使用它们来训练DNNS。然而，二阶优化涉及Hessian Inverse的耗时计算。我们通过将问题转换为Krylov子空间中的优化，提出了一种近似方法，该方法显着降低了计算复杂性以加快训练过程。在矿工和CIFAR-10数据集上进行的广泛实验表明，我们使用二阶对抗示例的对抗性学习优于其他FISRT-阶方法，这可以改善针对广泛攻击的模型稳健性。

Adversarial training is widely used to improve the robustness of deep neural networks to adversarial attack. However, adversarial training is prone to overfitting, and the cause is far from clear. This work sheds light on the mechanisms underlying overfitting through analyzing the loss landscape w.r.t. the input. We find that robust overfitting results from standard training, specifically the minimization of the clean loss, and can be mitigated by regularization of the loss gradients. Moreover, we find that robust overfitting turns severer during adversarial training partially because the gradient regularization effect of adversarial training becomes weaker due to the increase in the loss landscapes curvature. To improve robust generalization, we propose a new regularizer to smooth the loss landscape by penalizing the weighted logits variation along the adversarial direction. Our method significantly mitigates robust overfitting and achieves the highest robustness and efficiency compared to similar previous methods. Code is available at https://github.com/TreeLLi/Combating-RO-AdvLC.

Gradient-based explanation is the cornerstone of explainable deep networks, but it has been shown to be vulnerable to adversarial attacks. However, existing works measure the explanation robustness based on $\ell_p$-norm, which can be counter-intuitive to humans, who only pay attention to the top few salient features. We propose explanation ranking thickness as a more suitable explanation robustness metric. We then present a new practical adversarial attacking goal for manipulating explanation rankings. To mitigate the ranking-based attacks while maintaining computational feasibility, we derive surrogate bounds of the thickness that involve expensive sampling and integration. We use a multi-objective approach to analyze the convergence of a gradient-based attack to confirm that the explanation robustness can be measured by the thickness metric. We conduct experiments on various network architectures and diverse datasets to prove the superiority of the proposed methods, while the widely accepted Hessian-based curvature smoothing approaches are not as robust as our method.

Deep learning methods have gained increased attention in various applications due to their outstanding performance. For exploring how this high performance relates to the proper use of data artifacts and the accurate problem formulation of a given task, interpretation models have become a crucial component in developing deep learning-based systems. Interpretation models enable the understanding of the inner workings of deep learning models and offer a sense of security in detecting the misuse of artifacts in the input data. Similar to prediction models, interpretation models are also susceptible to adversarial inputs. This work introduces two attacks, AdvEdge and AdvEdge$^{+}$, that deceive both the target deep learning model and the coupled interpretation model. We assess the effectiveness of proposed attacks against two deep learning model architectures coupled with four interpretation models that represent different categories of interpretation models. Our experiments include the attack implementation using various attack frameworks. We also explore the potential countermeasures against such attacks. Our analysis shows the effectiveness of our attacks in terms of deceiving the deep learning models and their interpreters, and highlights insights to improve and circumvent the attacks.

经认证的稳健性是安全关键应用中的深度神经网络的理想性质，流行的训练算法可以通过计算其Lipschitz常数的全球界限来认证神经网络的鲁棒性。然而，这种界限往往松动：它倾向于过度规范神经网络并降低其自然精度。绑定的Lipschitz绑定可以在自然和认证的准确性之间提供更好的权衡，但通常很难根据网络的非凸起计算。在这项工作中，我们通过考虑激活函数（例如Relu）和权重矩阵之间的相互作用，提出了一种有效和培训的\ emph {本地} Lipschitz上限。具体地，当计算权重矩阵的诱发标准时，我们消除了相应的行和列，其中保证激活函数在每个给定数据点的邻域中是常数，它提供比全局Lipschitz常数的可怕更严格的绑定神经网络。我们的方法可用作插入式模块，以拧紧在许多可认证的训练算法中绑定的Lipschitz。此外，我们建议夹住激活功能（例如，Relu和Maxmin），具有可读的上限阈值和稀疏性损失，以帮助网络实现甚至更严格的本地嘴唇尖端。在实验上，我们表明我们的方法始终如一地优于Mnist，CiFar-10和Tinyimagenet数据集的清洁和认证准确性，具有各种网络架构的清洁和认证的准确性。

对抗性可转移性是一种有趣的性质 - 针对一个模型制作的对抗性扰动也是对另一个模型有效的，而这些模型来自不同的模型家庭或培训过程。为了更好地保护ML系统免受对抗性攻击，提出了几个问题：对抗性转移性的充分条件是什么，以及如何绑定它？有没有办法降低对抗的转移性，以改善合奏ML模型的鲁棒性？为了回答这些问题，在这项工作中，我们首先在理论上分析和概述了模型之间的对抗性可转移的充分条件;然后提出一种实用的算法，以减少集合内基础模型之间的可转换，以提高其鲁棒性。我们的理论分析表明，只有促进基础模型梯度之间的正交性不足以确保低可转移性;与此同时，模型平滑度是控制可转移性的重要因素。我们还在某些条件下提供了对抗性可转移性的下界和上限。灵感来自我们的理论分析，我们提出了一种有效的可转让性，减少了平滑（TRS）集合培训策略，以通过实施基础模型之间的梯度正交性和模型平滑度来培训具有低可转换性的强大集成。我们对TRS进行了广泛的实验，并与6个最先进的集合基线进行比较，防止不同数据集的8个白箱攻击，表明所提出的TRS显着优于所有基线。

研究神经网络中重量扰动的敏感性及其对模型性能的影响，包括泛化和鲁棒性，是一种积极的研究主题，因为它对模型压缩，泛化差距评估和对抗攻击等诸如模型压缩，泛化差距评估和对抗性攻击的广泛机器学习任务。在本文中，我们在重量扰动下的鲁棒性方面提供了前馈神经网络的第一积分研究和分析及其在体重扰动下的泛化行为。我们进一步设计了一种新的理论驱动损失功能，用于培训互动和强大的神经网络免受重量扰动。进行实证实验以验证我们的理论分析。我们的结果提供了基本洞察，以表征神经网络免受重量扰动的泛化和鲁棒性。

使用重量衰减来惩罚神经网络中的重量规范，这是一种标准的培训实践，可以使网络的复杂性正常。在本文中，我们表明，包括重量衰减在内的一个正规化家族无效地惩罚具有正均匀激活功能的网络的固有权重规范，例如线性，relu和max-pool-pool函数。由于同质性，网络指定的功能是在层之间的重量尺度转移的不变性。无效的正规化器对这种转移敏感，因此使模型容量不正常，导致过度拟合。为了解决这一缺点，我们提出了一个改进的正规器，该正常化程序是体重尺度转移不变的，因此有效地约束了神经网络的内在规范。派生的正常化程序是网络输入梯度的上限，因此最大程度地降低了改进的正规器也使对抗性鲁棒性受益。还考虑了剩余连接，我们表明我们的正规器还形成了这种残留网络的输入梯度的上限。我们证明了我们提出的正常化程序在各种数据集和神经网络体系结构上的功效，以改善概括和对抗性鲁棒性。

State-of-the-art classifiers have been shown to be largely vulnerable to adversarial perturbations. One of the most effective strategies to improve robustness is adversarial training. In this paper, we investigate the effect of adversarial training on the geometry of the classification landscape and decision boundaries. We show in particular that adversarial training leads to a significant decrease in the curvature of the loss surface with respect to inputs, leading to a drastically more "linear" behaviour of the network. Using a locally quadratic approximation, we provide theoretical evidence on the existence of a strong relation between large robustness and small curvature. To further show the importance of reduced curvature for improving the robustness, we propose a new regularizer that directly minimizes curvature of the loss surface, and leads to adversarial robustness that is on par with adversarial training. Besides being a more efficient and principled alternative to adversarial training, the proposed regularizer confirms our claims on the importance of exhibiting quasi-linear behavior in the vicinity of data points in order to achieve robustness.

对抗性培训（AT）已成为培训强大网络的热门选择。然而，它倾向于牺牲清洁精度，以令人满意的鲁棒性，并且遭受大的概括误差。为了解决这些问题，我们提出了平稳的对抗培训（SAT），以我们对损失令人歉端的损失的终人谱指导。 We find that curriculum learning, a scheme that emphasizes on starting "easy" and gradually ramping up on the "difficulty" of training, smooths the adversarial loss landscape for a suitably chosen difficulty metric.我们展示了对普通环境中的课程学习的一般制定，并提出了一种基于最大Hessian特征值（H-SAT）和软MAX概率（P-SA）的两个难度指标。我们展示SAT稳定网络培训即使是大型扰动规范，并且允许网络以更好的清洁精度运行而与鲁棒性权衡曲线相比。与AT，交易和其他基线相比，这导致清洁精度和鲁棒性的显着改善。为了突出一些结果，我们的最佳模型将分别在CIFAR-100上提高6％和1％的稳健准确性。在Imagenette上，一个十一级想象成的子集，我们的模型分别以正常和强大的准确性达到23％和3％。

已知深度神经网络（DNN）容易受到用不可察觉的扰动制作的对抗性示例的影响，即，输入图像的微小变化会引起错误的分类，从而威胁着基于深度学习的部署系统的可靠性。经常采用对抗训练（AT）来通过训练损坏和干净的数据的混合物来提高DNN的鲁棒性。但是，大多数基于AT的方法在处理\ textit {转移的对抗示例}方面是无效的，这些方法是生成以欺骗各种防御模型的生成的，因此无法满足现实情况下提出的概括要求。此外，对抗性训练一般的国防模型不能对具有扰动的输入产生可解释的预测，而不同的领域专家则需要一个高度可解释的强大模型才能了解DNN的行为。在这项工作中，我们提出了一种基于Jacobian规范和选择性输入梯度正则化（J-SIGR）的方法，该方法通过Jacobian归一化提出了线性化的鲁棒性，还将基于扰动的显着性图正规化，以模仿模型的可解释预测。因此，我们既可以提高DNN的防御能力和高解释性。最后，我们评估了跨不同体系结构的方法，以针对强大的对抗性攻击。实验表明，提出的J-Sigr赋予了针对转移的对抗攻击的鲁棒性，我们还表明，来自神经网络的预测易于解释。

Although deep learning has made remarkable progress in processing various types of data such as images, text and speech, they are known to be susceptible to adversarial perturbations: perturbations specifically designed and added to the input to make the target model produce erroneous output. Most of the existing studies on generating adversarial perturbations attempt to perturb the entire input indiscriminately. In this paper, we propose ExploreADV, a general and flexible adversarial attack system that is capable of modeling regional and imperceptible attacks, allowing users to explore various kinds of adversarial examples as needed. We adapt and combine two existing boundary attack methods, DeepFool and Brendel\&Bethge Attack, and propose a mask-constrained adversarial attack system, which generates minimal adversarial perturbations under the pixel-level constraints, namely ``mask-constraints''. We study different ways of generating such mask-constraints considering the variance and importance of the input features, and show that our adversarial attack system offers users good flexibility to focus on sub-regions of inputs, explore imperceptible perturbations and understand the vulnerability of pixels/regions to adversarial attacks. We demonstrate our system to be effective based on extensive experiments and user study.

基于梯度的解释算法何时提供有意义的解释？我们提出了一个必要的标准：它们的特征归因需要与数据歧管的切线空间保持一致。为了提供这一假设的证据，我们介绍了一个基于变异自动编码器的框架，该框架允许估计和生成图像歧管。通过跨各种不同数据集的实验 - MNIST，EMNIST，CIFAR10，X射线肺炎和糖尿病性视网膜病变检测 - 我们证明，功能归因与数据的切线相符，结构化和解释性越多倾向于。特别是，由流行的事后方法（例如集成梯度，SmoothGrad和Input $ \ times $梯度）提供的归因往往比原始梯度更与数据歧管更强烈。结果，我们建议解释算法应积极努力将其解释与数据歧管保持一致。在某种程度上，这可以通过对抗训练来实现，从而可以使所有数据集更好地对齐。必须对模型架构或训练算法进行某种形式的调整，因为我们表明单独的神经网络的概括并不意味着模型梯度与数据歧管的一致性。

随着深度神经网络的兴起，解释这些网络预测的挑战已经越来越识别。虽然存在许多用于解释深度神经网络的决策的方法，但目前没有关于如何评估它们的共识。另一方面，鲁棒性是深度学习研究的热门话题;但是，在最近，几乎没有谈论解释性。在本教程中，我们首先呈现基于梯度的可解释性方法。这些技术使用梯度信号来分配对输入特征的决定的负担。后来，我们讨论如何为其鲁棒性和对抗性的鲁棒性在具有有意义的解释中扮演的作用来评估基于梯度的方法。我们还讨论了基于梯度的方法的局限性。最后，我们提出了在选择解释性方法之前应检查的最佳实践和属性。我们结束了未来在稳健性和解释性融合的地区研究的研究。

深度神经网络易于对自然投入的离前事实制作，小而难以察觉的变化影响。对这些实例的最有效的防御机制是对逆脉训练在训练期间通过迭代最大化的损失来构建对抗性实例。然后训练该模型以最小化这些构建的实施例的损失。此最小最大优化需要更多数据，更大的容量模型和额外的计算资源。它还降低了模型的标准泛化性能。我们可以更有效地实现鲁棒性吗？在这项工作中，我们从知识转移的角度探讨了这个问题。首先，我们理论上展示了在混合增强的帮助下将鲁棒性从对接地训练的教师模型到学生模型的可转换性。其次，我们提出了一种新颖的鲁棒性转移方法，称为基于混合的激活信道图（MixacM）转移。 MixacM通过匹配未在没有昂贵的对抗扰动的匹配生成的激活频道地图将强大的教师转移到学生的鲁棒性。最后，对多个数据集的广泛实验和不同的学习情景显示我们的方法可以转移鲁棒性，同时还改善自然图像的概括。