adversarial攻击让模型变瞎，但解释方法却看不出异常。
Impact of Adversarial Attacks on Deep Learning Model Explainability
- 用FGSM和BIM攻击模型，加微小扰动骗过深度学习
- 模型准确率从89.94%暴跌至45.50%，解释结果却几乎不变
- 现有解释评估指标对攻击不敏感，可能误导可信度判断
本文研究对抗攻击对深度学习模型可解释性的影响。尽管深度学习具备自主特征提取能力，但其黑箱特性常引发信任危机。为此，研究者提出了GradCAM、SmoothGrad和LIME等解释方法。本研究聚焦于模型在受到对抗攻击时解释的鲁棒性，采用快梯度符号法（FGSM）和基本迭代法（BIM）引入人眼难以察觉的图像扰动。实验显示，模型准确率从89.94%分别降至58.73%（FGSM）和45.50%（BIM）。然而，基于交并比（IoU）和均方根误差（RMSE）的解释评估结果变化极小，表明当前解释评价指标对对抗扰动不敏感，可能无法有效揭示模型被欺骗的情况。
原文摘要 · Abstract (English)
In this paper, we investigate the impact of adversarial attacks on the explainability of deep learning models, which are commonly criticized for their black-box nature despite their capacity for autonomous feature extraction. This black-box nature can affect the perceived trustworthiness of these models. To address this, explainability techniques such as GradCAM, SmoothGrad, and LIME have been developed to clarify model decision-making processes. Our research focuses on the robustness of these explanations when models are subjected to adversarial attacks, specifically those involving subtle image perturbations that are imperceptible to humans but can significantly mislead models. For this, we utilize attack methods like the Fast Gradient Sign Method (FGSM) and the Basic Iterative Method (BIM) and observe their effects on model accuracy and explanations. The results reveal a substantial decline in model accuracy, with accuracies dropping from 89.94% to 58.73% and 45.50% under FGSM and BIM attacks, respectively. Despite these declines in accuracy, the explanation of the models measured by metrics such as Intersection over Union (IoU) and Root Mean Square Error (RMSE) shows negligible changes, suggesting that these metrics may not be sensitive enough to detect the presence of adversarial perturbations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。