arXiv:2608.00566cs.LGcs.AI2026-08

让模型在不触发异常警报的情况下,骗过解释器对关键特征的检测。

Crushing the Evidence: A Dual-Penalty Evasion Framework for Fooling White-Box Explainable AI Auditors

  • 训练时用双惩罚机制直接抑制目标特征梯度,让模型自然隐藏敏感信息。
  • 在4个数据集上将特征重要性压至0.02以下,攻击成功率超90%。
  • 无需外部伪装,生成的预测平滑自然,可绕过所有现有检测手段。

后处理模型解释器(如LIME、SHAP、Integrated Gradients)被广泛用于金融、医疗等高风险领域,以确保模型透明可接受。然而,已有研究揭示解释管道可能被攻击:攻击者可通过对抗性解释攻击掩盖算法偏见或后门。现有攻击依赖分布外(OOD)检测器作为外挂,在被解释器查询时切换预测,导致防御可识别其异常扰动痕迹。本文提出一种更强的白盒梯度正则化逃避框架,通过连续嵌入的双惩罚机制,在分布内数据训练中直接惩罚触发特征梯度。由于规避逻辑原生嵌入模型参数,无需依赖OOD外挂,生成的预测平滑且分布内,无异常痕迹。在四个基准表格数据集(COMPAS、German Credit、IEEE-CIS、Communities & Crime)上的实验证明,该方法系统性地将目标特征归因降至近零(<0.02),保持>90%攻击成功率,并彻底绕过条件异常检测。

原文摘要 · Abstract (English)

Post-hoc model explainers such as LIME, SHAP, and Integrated Gradients are widely deployed to audit models in high-stakes sensitive domains, including finance, healthcare, and social welfare. This ensures the model's transparency and acceptability. However, a few studies have examined potential attacks in the explainability pipeline. Adversaries can attempt to conceal algorithmic biases or backdoors using adversarial explanation attacks. These attacks have relied on scaffolding out-of-distribution (OOD) detectors that toggle predictions when queried by an explainer. Consequently, defenses have been developed to successfully neutralize these black-box attacks by identifying their anomalous perturbation footprints. In this paper, we demonstrate a critical vulnerability by introducing a more potent white-box, gradient-regularized evasion attack framework. By employing a continuous-embedding dual-penalty framework, we directly penalize trigger feature gradients during training on in-distribution data. Since our approach embeds the evasion logic natively into the model parameters, without relying on OOD scaffolding wrappers, it generates smooth, in-distribution predictions that leave no anomaly footprint. Empirical evaluations across four benchmark tabular datasets (COMPAS, German Credit, IEEE-CIS, and Communities & Crime) confirm that our method systematically crushes target feature attribution to near-zero (<0.02), maintains >90% Attack Success Rates, and fundamentally bypasses Conditional Anomaly Detection.

模型解释对抗攻击白盒防御特征归因

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。