Robust Feature-Level Adversaries are Interpretability Tools

By Stephen Casper, Max Nadeau, Dylan Hadfield-Menell, Gabriel Kreiman. 2021

34 citations recorded by the source corpus.

The literature on adversarial attacks in computer vision typically focuses on pixel-level perturbations. These tend to be very difficult to interpret. Recent work that manipulates the latent representations of image generators to create"feature-level"adversarial perturbations gives us an opportunity to explore perceptible, interpretable adversarial attacks. We make three contributions. First, we observe that feature-level attacks provide useful classes of inputs for studying representations in models. Second, we show that these adversaries are uniquely versatile and highly robust. We demonstrate that they can be used to produce targeted, universal, disguised, physically-realizable, and black-box attacks at the ImageNet scale. Third, we show how these adversarial images can be used as a practical interpretability tool for identifying bugs in networks. We use these adversaries to make predictions about spurious associations between features and classes which we then test by designing"copy/paste"attacks in which one natural image is pasted into another to cause a targeted misclassification. Our results suggest that feature-level attacks are a promising approach for rigorous interpretability research. They support the design of tools to better understand what a model has learned and diagnose brittle feature associations. Code is available at https://github.com/thestephencasper/feature_level_adv

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Training for High-Stakes Reliability (2022, background): “…could add more tools (such as better suggestions for our human adversaries [50]) and study the relative effectiveness of the different tools, develop better training methods for human attackers, or more fully characterize properties of adversarial inputs to better understand our models [51, 52].”
Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedback (2023, methodology): “To mitigate this problem, developers should use tools to generate inputs which result in undesired behavior and train against these adversarial examples [Zhang and Li, 2019, Ziegler et al., 2022, Perez et al., 2022a, Casper et al., 2023b].”