arXiv:2506.08514cs.LG2025-06

提出DiffGradCAM解决CNN解释中的对抗漏洞,提升可视化可靠性。

DiffGradCAM: A Class Activation Map Using the Full Model Decision to Solve Unaddressed Adversarial Attacks

  • 基于输出差异而非单个得分计算激活图,增强鲁棒性
  • 在非对抗场景下与传统方法效果相当,对抗下显著更稳定
  • 适合需要可信解释的高风险应用如医疗、自动驾驶

类激活映射(CAM)及其基于梯度的变体(如GradCAM)已成为解释卷积神经网络(CNN)预测的标准工具。然而,这些方法通常关注单个logits,而使用softmax的神经网络中,类别归属概率仅依赖于logits之间的差异,而非其绝对值。这一脱节使标准CAM易受对抗操纵,例如被动欺骗攻击——模型被训练为生成误导性CAM,而不影响决策性能。为此,我们提出DiffGradCAM及其高阶导数版本DiffGradCAM++,作为新型轻量级对比型类激活映射方法,对被动欺骗攻击不敏感,且在非对抗情况下与GradCAM、GradCAM++输出一致。为验证主张,我们引入了信息熵感知的被动欺骗基准——显著性伪装激活图(SHAM),用于评估对抗条件下CAM的鲁棒性。SHAM与DiffGradCAM共同构建了探测和提升基于显著性的解释鲁棒性的新框架。我们在多分类任务(含少类与多类)中验证了两项贡献的有效性。

原文摘要 · Abstract (English)

Class Activation Mapping (CAM) and its gradient-based variants (e.g., GradCAM) have become standard tools for explaining Convolutional Neural Network (CNN) predictions. However, these approaches typically focus on individual logits, while for neural networks using softmax, the class membership probability estimates depend only on the differences between logits, not on their absolute values. This disconnect leaves standard CAMs vulnerable to adversarial manipulation, such as passive fooling, where a model is trained to produce misleading CAMs without affecting decision performance. To address this vulnerability, we propose DiffGradCAM and its higher-order derivative version DiffGradCAM++, as novel, lightweight, contrastive approaches to class activation mapping that are not susceptible to passive fooling and match the output of standard methods such as GradCAM and GradCAM++ in the non-adversarial case. To test our claims, we introduce Salience-Hoax Activation Maps (SHAMs), a more advanced, entropy-aware form of passive fooling that serves as a benchmark for CAM robustness under adversarial conditions. Together, SHAM and DiffGradCAM establish a new framework for probing and improving the robustness of saliency-based explanations. We validate both contributions across multi-class tasks with few and many classes.

解释性AI对抗攻击激活图CNN

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。