[论文解读] Adversarial Attacks and Defenses: An Interpretation Perspective

Ninghao Liu, Mengnan Du+3 more|arXiv (Cornell University)|Apr 23, 2020

Adversarial Robustness in Machine Learning参考文献 124被引用 7

一句话总结

本文通过可解释机器学习的视角，提出对对抗性攻击与防御的解释，将解释方法分类为特征级与模型级两类。它展示了可解释性如何揭示模型的漏洞，以实现针对性攻击或提升鲁棒性，为对抗性鲁棒性提供了统一的视角，推动了透明、可靠的模型开发。

ABSTRACT

Despite the recent advances in a wide spectrum of applications, machine learning models, especially deep neural networks, have been shown to be vulnerable to adversarial attacks. Attackers add carefully-crafted perturbations to input, where the perturbations are almost imperceptible to humans, but can cause models to make wrong predictions. Techniques to protect models against adversarial input are called adversarial defense methods. Although many approaches have been proposed to study adversarial attacks and defenses in different scenarios, an intriguing and crucial challenge remains that how to really understand model vulnerability? Inspired by the saying that "if you know yourself and your enemy, you need not fear the battles", we may tackle the aforementioned challenge after interpreting machine learning models to open the black-boxes. The goal of model interpretation, or interpretable machine learning, is to extract human-understandable terms for the working mechanism of models. Recently, some approaches start incorporating interpretation into the exploration of adversarial attacks and defenses. Meanwhile, we also observe that many existing methods of adversarial attacks and defenses, although not explicitly claimed, can be understood from the perspective of interpretation. In this paper, we review recent work on adversarial attacks and defenses, particularly from the perspective of machine learning interpretation. We categorize interpretation into two types, feature-level interpretation and model-level interpretation. For each type of interpretation, we elaborate on how it could be used for adversarial attacks and defenses. We then briefly illustrate additional correlations between interpretation and adversaries. Finally, we discuss the challenges and future directions along tackling adversary issues with interpretation.

研究动机与目标

• 为解决理解机器学习模型（尤其是深度神经网络）为何仍对对抗性攻击保持脆弱的根本性挑战。
• 探究对抗性攻击与防御是否可统一于可解释机器学习的框架之下。
• 探索模型解释如何通过揭示内部漏洞，指导开发更具鲁棒性的模型。
• 识别当前解释方法的局限性，例如其对对抗性噪声的敏感性，并提出改进方案。
• 考察对抗性样本不仅作为威胁，还可作为提升模型泛化能力与可信度的工具的潜力。

提出的方法

• 将解释划分为特征级（识别影响输入的特征）与模型级（分析内部组件与激活）解释。
• 将现有的对抗性攻击与防御技术映射到解释框架中，表明它们隐含地依赖于可解释性原则。
• 分析在对抗性扰动下解释方法的稳定性和忠实性，突出显著图在对抗性噪声下的脆弱性。
• 提出平滑激活函数及SmoothGrad的稀疏化变体，以提升解释方法的鲁棒性。
• 通过新型架构（如胶囊网络与因果模型）探索内在可解释性，从设计之初就嵌入可解释性。
• 研究对抗性训练如何提升模型可解释性与表征质量，利用批量归一化分离正常与对抗性数据分布。

实验结果

研究问题

• RQ1 如何利用特征级解释来设计更有效的对抗性攻击或防御方法？
• RQ2 模型级解释在多大程度上暴露了深度神经网络中被对抗性攻击所利用的结构性弱点？
• RQ3 现有解释技术在多大程度上自身也容易受到对抗性扰动的影响？
• RQ4 能否同时利用对抗性样本提升模型的鲁棒性与可解释性？
• RQ5 在模型设计中实现内在可解释性在多大程度上可减少对事后解释的依赖，并提升整体模型的可靠性？

主要发现

• 许多现有的对抗性攻击与防御方法可重新解释为可解释性技术的扩展，揭示了其共享的底层机制。
• 如显著图等解释方法容易受到对抗性扰动的影响，削弱了其在安全关键应用中的可靠性。
• 稳健的解释技术（如平滑激活函数及SmoothGrad的可认证鲁棒变体）可提升在对抗性噪声下的稳定性。
• 经过对抗性训练的模型表现出更高的可解释性与更优的表征质量，表明鲁棒性与可解释性之间存在关联。
• 通过批量归一化对正常与对抗性数据分布进行独立建模，可缓解对抗性训练过程中的性能下降。
• 如胶囊网络与因果模型等可解释架构为实现内在可解释且鲁棒的模型提供了有前景的路径。