Papers
Topics
Authors
Recent
Search
2000 character limit reached

Are Classification Robustness and Explanation Robustness Really Strongly Correlated? An Analysis Through Input Loss Landscape

Published 9 Mar 2024 in cs.LG and cs.CV | (2403.06013v1)

Abstract: This paper delves into the critical area of deep learning robustness, challenging the conventional belief that classification robustness and explanation robustness in image classification systems are inherently correlated. Through a novel evaluation approach leveraging clustering for efficient assessment of explanation robustness, we demonstrate that enhancing explanation robustness does not necessarily flatten the input loss landscape with respect to explanation loss - contrary to flattened loss landscapes indicating better classification robustness. To deeply investigate this contradiction, a groundbreaking training method designed to adjust the loss landscape with respect to explanation loss is proposed. Through the new training method, we uncover that although such adjustments can impact the robustness of explanations, they do not have an influence on the robustness of classification. These findings not only challenge the prevailing assumption of a strong correlation between the two forms of robustness but also pave new pathways for understanding relationship between loss landscape and explanation loss.

Definition Search Book Streamline Icon: https://streamlinehq.com
References (59)
  1. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
  2. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.
  3. Explanations can be manipulated and geometry is to blame. Advances in neural information processing systems, 32, 2019.
  4. Safari: Versatile and efficient evaluations for robustness of interpretability. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1988–1998, 2023.
  5. Proper network interpretability helps adversarial robustness in classification. In International Conference on Machine Learning, pages 1014–1023. PMLR, 2020.
  6. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
  7. How to explain individual classification decisions. The Journal of Machine Learning Research, 11:1803–1831, 2010.
  8. Interpretation of neural networks is fragile. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 3681–3688, 2019.
  9. Understanding and combating robust overfitting via input loss landscape analysis and regularization. Pattern Recognition, 136:109229, 2023.
  10. Smooth adversarial training. arXiv preprint arXiv:2006.14536, 2020.
  11. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR, 2019.
  12. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017.
  13. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pages 582–597. IEEE, 2016.
  14. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155, 2017.
  15. Defensive quantization: When efficiency meets robustness. arXiv preprint arXiv:1904.08444, 2019.
  16. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv:1710.10766, 2017.
  17. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206.10550, 2022.
  18. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274–283. PMLR, 2018.
  19. Adversarial vision challenge. In The NeurIPS’18 Competition: From Machine Learning to Intelligent Conversations, pages 129–153. Springer, 2020.
  20. Using pre-training can improve model robustness and uncertainty. In International conference on machine learning, pages 2712–2721. PMLR, 2019.
  21. Unlabeled data improves adversarial robustness. Advances in neural information processing systems, 32, 2019.
  22. Better diffusion models further improve adversarial training. arXiv preprint arXiv:2302.04638, 2023.
  23. Rethinking softmax cross-entropy loss for adversarial robustness. arXiv preprint arXiv:1905.10626, 2019.
  24. Self-supervised adversarial training. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2218–2222. IEEE, 2020.
  25. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204, 2017.
  26. Robust overfitting may be mitigated by properly learned smoothening. In International Conference on Learning Representations, 2020.
  27. Randomized adversarial training via taylor expansion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16447–16457, 2023.
  28. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33:2958–2969, 2020.
  29. Adversarial training for free! Advances in Neural Information Processing Systems, 32, 2019.
  30. Using single-step adversarial training to defend iterative adversarial examples. In Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pages 17–27, 2021.
  31. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034, 2013.
  32. Learning important features through propagating activation differences. In International conference on machine learning, pages 3145–3153. PMLR, 2017.
  33. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, 10(7):e0130140, 2015.
  34. Grad-cam: Why did you say that? arXiv preprint arXiv:1611.07450, 2016.
  35. Fooling neural network interpretations via adversarial model manipulation. Advances in neural information processing systems, 32, 2019.
  36. Fooling lime and shap: Adversarial attacks on post hoc explanation methods. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, pages 180–186, 2020.
  37. Foiling explanations in deep neural networks. arXiv preprint arXiv:2211.14860, 2022.
  38. Interpretable deep learning under fire. In 29th {normal-{\{{USENIX}normal-}\}} Security Symposium ({normal-{\{{USENIX}normal-}\}} Security 20), 2020.
  39. Robust explanation constraints for neural networks. arXiv preprint arXiv:2212.08507, 2022.
  40. On the robustness of interpretability methods. arXiv preprint arXiv:1806.08049, 2018.
  41. Robust attribution regularization. Advances in Neural Information Processing Systems, 32, 2019.
  42. Defense against explanation manipulation. Frontiers in big Data, 5:704203, 2022.
  43. Deep inside convolutional networks: Visualising image classification models and saliency maps. arxiv 2013. arXiv preprint arXiv:1312.6034, 2019.
  44. Robust models are more interpretable because attributions look normal. arXiv preprint arXiv:2103.11257, 2021.
  45. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pages 2206–2216. PMLR, 2020.
  46. Learning multiple layers of features from tiny images. 2009.
  47. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
  48. Stuart Lloyd. Least squares quantization in pcm. IEEE transactions on information theory, 28(2):129–137, 1982.
  49. Backpropagation applied to handwritten zip code recognition. Neural computation, 1(4):541–551, 1989.
  50. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017.
  51. Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
  52. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016.
  53. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861, 2017.
  54. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4510–4520, 2018.
  55. Dynamic few-shot visual learning without forgetting. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4367–4375, 2018.
  56. Improving deep neural networks using softplus units. In 2015 International joint conference on neural networks (IJCNN), pages 1–4. IEEE, 2015.
  57. Striving for simplicity: The all convolutional net. arXiv preprint arXiv:1412.6806, 2014.
  58. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
  59. Bag of tricks for adversarial training. arXiv preprint arXiv:2010.00467, 2020.

Summary

No one has generated a summary of this paper yet.

Sign Up to Summarize

Paper to Video (Beta)

No one has generated a video about this paper yet.

Sign Up to Generate All Videos Subscribe on YouTube

Whiteboard

No one has generated a whiteboard explanation for this paper yet.

Sign Up to Generate

Open Problems

We haven't generated a list of open problems mentioned in this paper yet.

Generate Now

Continue Learning

We haven't generated follow-up questions for this paper yet.

Generate Now

Collections

Sign up for free to add this paper to one or more collections.

Sign Up

Tweets

Sign up for free to view the 1 tweet with 0 likes about this paper.

Sign Up for Free