让模型既抗攻击又可解释,通过动态生成对抗样本并约束解释一致性。
Explanation-Guided Adversarial Training for Robust and Interpretable Models
- 在训练中动态生成对抗样本,并强制模型输出有意义的解释。
- 在未知数据上准确率提升37%,训练时间仅增加16%。
- 适合需要高鲁棒性和可解释性的实际应用,如医疗、金融决策。
深度神经网络在诸多任务中表现卓越,但常被视为黑箱。解释引导学习(EGL)方法利用人工提供的解释或对模型归因的监督来引导网络,虽提升可解释性,但通常假设输入为良性且标注成本高。相比之下,深度模型在面对微小扰动或未见模式时,预测与显著图可能剧烈变化。对抗训练(AT)可显著提升鲁棒性,但无法保证模型依赖语义上有意义的特征。为此,我们提出解释引导的对抗训练(EGAT),一个融合AT与EGL优势的统一框架,同时提升预测性能、鲁棒性与解释质量。EGAT在线生成对抗样本,并对模型施加解释约束。通过联合优化分类性能、对抗鲁棒性与归因稳定性,EGAT不仅更抵抗意外情况(包括对抗攻击和分布外OOD场景),还能提供人类可理解的决策依据。我们进一步在可能近似正确学习框架下形式化EGAT,理论上证明其在异常情境下预测更稳定。在分布外基准数据集上的实证评估显示,EGAT在干净准确率与对抗准确率上均优于基线,提升达+37%,且解释更具语义合理性,训练时间仅增加+16%。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) have achieved remarkable performance in many tasks, yet they often behave as opaque black boxes. Explanation-guided learning (EGL) methods steer DNNs using human-provided explanations or supervision on model attributions. These approaches improve interpretability but typically assume benign inputs and incur heavy annotation costs. In contrast, both predictions and saliency maps of DNNs could dramatically alter facing imperceptible perturbations or unseen patterns. Adversarial training (AT) can substantially improve robustness, but it does not guarantee that model decisions rely on semantically meaningful features. In response, we propose Explanation-Guided Adversarial Training (EGAT), a unified framework that integrates the strength of AT and EGL to simultaneously improve prediction performance, robustness, and explanation quality. EGAT generates adversarial examples on the fly while imposing explanation-based constraints on the model. By jointly optimizing classification performance, adversarial robustness, and attributional stability, EGAT is not only more resistant to unexpected cases, including adversarial attacks and out-of-distribution (OOD) scenarios, but also offer human-interpretable justifications for the decisions. We further formalize EGAT within the Probably Approximately Correct learning framework, demonstrating theoretically that it yields more stable predictions under unexpected situations compared to standard AT. Empirical evaluations on OOD benchmark datasets show that EGAT consistently outperforms competitive baselines in both clean accuracy and adversarial accuracy +37% while producing more semantically meaningful explanations, and requiring only a limited increase +16% in training time.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。