用可解释定位+无梯度优化修复模型缺陷,效果优于传统方法。
Shapley-Guided Neural Repair Approach via Derivative-Free Optimization
- 基于Deep SHAP的分层定位,精准识别故障层与神经元。
- 采用CMA-ES无梯度优化,修复后在三类缺陷上提升超10%。
- 无需梯度、适配多种架构,适合需高可靠性的场景。
深度神经网络易受后门、对抗攻击和不公平性等问题影响,降低其可靠性。现有方法多依赖梯度计算,仅适用于特定激活函数(如ReLU),或使用不可解释的搜索算法,且难以跨多种缺陷泛化。本文提出SHARPEN,结合可解释的故障定位与无梯度优化策略。首先,采用基于Deep SHAP的层次化粗到精定位方法,量化各层及神经元对错误输出的边际贡献;通过分析异常状态与正常状态间的激活差异,定位故障神经元/滤波器。随后,引入CMA-ES优化器进行修复,其利用协方差矩阵捕捉变量依赖关系,实现无梯度协同调整。该方法不依赖梯度,对异常敏感度低,且可适配不同架构。实验表明,在后门移除、对抗防御和公平性修复任务中,准确率保持前提下,性能分别提升10.56%、5.78%和11.82%。其模块化设计支持替换不同无梯度优化器,具备高度灵活性。
原文摘要 · Abstract (English)
DNNs are susceptible to defects like backdoors, adversarial attacks, and unfairness, undermining their reliability. Existing approaches mainly involve retraining, optimization, constraint-solving, or search algorithms. However, most methods rely on gradient calculations, restricting applicability to specific activation functions (e.g., ReLU), or use search algorithms with uninterpretable localization and repair. Furthermore, they often lack generalizability across multiple properties. We propose SHARPEN, integrating interpretable fault localization with a derivative-free optimization strategy. First, SHARPEN introduces a Deep SHAP-based localization strategy quantifying each layer's and neuron's marginal contribution to erroneous outputs. Specifically, a hierarchical coarse-to-fine approach reranks layers by aggregated impact, then locates faulty neurons/filters by analyzing activation divergences between property-violating and benign states. Subsequently, SHARPEN incorporates CMA-ES to repair identified neurons. CMA-ES leverages a covariance matrix to capture variable dependencies, enabling gradient-free search and coordinated adjustments across coupled neurons. By combining interpretable localization with evolutionary optimization, SHARPEN enables derivative-free repair across architectures, being less sensitive to gradient anomalies and hyperparameters. We demonstrate SHARPEN's effectiveness on three repair tasks. Balancing property repair and accuracy preservation, it outperforms baselines in backdoor removal (+10.56%), adversarial mitigation (+5.78%), and unfairness repair (+11.82%). Notably, SHARPEN handles diverse tasks, and its modular design is plug-and-play with different derivative-free optimizers, highlighting its flexibility.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。