提出可解释的多阶段分类器攻击方法，让对抗扰动既骗过模型又说明原因。
Explainable Adversarial Attacks on Coarse-to-Fine Classifiers
- 用LRP识别影响分类的关键像素，针对性生成扰动。
- 在多阶段分类器上实现误分类，同时保留模型决策过程的可解释性。
- 适合研究模型安全与可解释性的研究人员使用。
传统对抗攻击旨在通过人眼难以察觉的扰动改变输入图像的预测标签，但通常缺乏可解释性。此外，大多数现有工作聚焦于单阶段分类器，而多阶段分类器尚未被充分探索。本文针对多阶段分类器提出基于实例的对抗攻击方法，利用层间相关性传播（LRP）为像素分配相关性得分，反映其对分类结果的影响。该方法通过LRP识别并攻击粗粒度和细粒度分类中关键特征，生成兼具可解释性的对抗扰动。与传统攻击不同，本方法不仅诱导分类错误，还增强了模型在各分类阶段行为的可解释性，实验结果验证了其有效性。
原文摘要 · Abstract (English)
Traditional adversarial attacks typically aim to alter the predicted labels of input images by generating perturbations that are imperceptible to the human eye. However, these approaches often lack explainability. Moreover, most existing work on adversarial attacks focuses on single-stage classifiers, but multi-stage classifiers are largely unexplored. In this paper, we introduce instance-based adversarial attacks for multi-stage classifiers, leveraging Layer-wise Relevance Propagation (LRP), which assigns relevance scores to pixels based on their influence on classification outcomes. Our approach generates explainable adversarial perturbations by utilizing LRP to identify and target key features critical for both coarse and fine-grained classifications. Unlike conventional attacks, our method not only induces misclassification but also enhances the interpretability of the model's behavior across classification stages, as demonstrated by experimental results.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。