Fooling Neural Network Interpretations via Adversarial Model Manipulation

By Juyeon Heo, Sunghwan Joo, Taesup Moon. 2019

241 citations recorded by the source corpus.

We ask whether the neural network interpretation methods can be fooled via adversarial model manipulation, which is defined as a model fine-tuning step that aims to radically alter the explanations without hurting the accuracy of the original models, e.g., VGG19, ResNet50, and DenseNet121. By incorporating the interpretation results directly in the penalty term of the objective function for fine-tuning, we show that the state-of-the-art saliency map based interpreters, e.g., LRP, Grad-CAM, and SimpleGrad, can be easily fooled with our model manipulation. We propose two types of fooling, Passive and Active, and demonstrate such foolings generalize well to the entire validation set as well as transfer to other interpretation methods. Our results are validated by both visually showing the fooled explanations and reporting quantitative metrics that measure the deviations from the original explanations. We claim that the stability of neural network interpretation method with respect to our adversarial model manipulation is an important criterion to check for developing robust and reliable neural network interpretation method.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Association Between Labels and Free-Text Rationales (2020, methodology): “Robustness Analysis Robustness of post-hoc ex-tractive interpretability methods has been studied (Kindermans et al., 2019; Ghorbani et al., 2019; Heo et al., 2019; Zheng et al., 2019; Slack et al., 2020).”
Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims (2020, background): “, the reliability of existing methods is an active area of research [85] [86] [87] [88] [89] [90] [91] [92].”
Explanations can be manipulated and geometry is to blame (2019, background): “In [23], explanation maps are changed by randomization of (some of) the network weights and in [24] the complete network is fine-tuned to produce manipulated explanations while the accuracy remains high.”
Fooling LIME and SHAP: Adversarial Attacks on Post hoc Explanation Methods (2019, background): “[9] also propose similar attacks on saliency maps.”
Interpretable deep learning: interpretation, interpretability, trustworthiness, and beyond (2021, background): “Moreover, we should note that the adversarial attacks do not only aim at trained models [30], but the interpretations [8, 56, 71].”
You Shouldn't Trust Me: Learning Models Which Conceal Unfairness From Multiple Explanation Methods (2020, methodology): “Heo, Joo, and Moon (2019) We believe we are the ﬁrst to focus on fairness of a model in relation to popular explanation methods.”
Toward Interpretable Machine Learning: Transparent Deep Neural Networks and Beyond (2020, background): “Recent work has shown that an ‘adversary’ can modify the ML model in an imperceptible fashion so that the prediction behavior remains intact but the explanation of those predictions changes drastically [53].”
How can we fool LIME and SHAP? Adversarial Attacks on Post hoc Explanation Methods (2019, background): “Heo, Joo, and Moon (2019) also propose similar attacks on saliency maps.”
Aggregating explanation methods for stable and robust explainability. (2019, background): “, 2019)) or the network weights (Heo et al., 2019) can be changed by the attacker.”
Debugging Tests for Model Explanations (2020, background): “Feature attributions can be easily manipulated, providing evidence for a collective ‘weakness’ of current approaches [23, 24, 35, 61].”
Fairwashing Explanations with Off-Manifold Detergent (2020, unknown): “This work was crucially inspired by (Heo et al., 2019).”