FAR: A General Framework for Attributional Robustness

TL;DR

This paper introduces FAR, a flexible framework for training neural networks with attributional robustness, improving the stability of attribution maps against adversarial perturbations in vision tasks.

Contribution

The paper proposes a novel, general framework (FAR) for enhancing attributional robustness, along with two new instantiations, AAT and AdvAAT, that improve robustness and applicability.

Findings

FAR outperforms existing methods in attributional robustness on vision datasets.

AAT and AdvAAT effectively optimize for both robust attributions and accurate predictions.

The methods reduce dependency on certain training and estimation parameters.

Abstract

Attribution maps are popular tools for explaining neural networks predictions. By assigning an importance value to each input dimension that represents its impact towards the outcome, they give an intuitive explanation of the decision process. However, recent work has discovered vulnerability of these maps to imperceptible adversarial changes, which can prove critical in safety-relevant domains such as healthcare. Therefore, we define a novel generic framework for attributional robustness (FAR) as general problem formulation for training models with robust attributions. This framework consist of a generic regularization term and training objective that minimize the maximal dissimilarity of attribution maps in a local neighbourhood of the input. We show that FAR is a generalized, less constrained formulation of currently existing training methods. We then propose two new instantiations of this framework, AAT and AdvAAT, that directly optimize for both robust attributions and predictions. Experiments performed on widely used vision datasets show that our methods perform better or comparably to current ones in terms of attributional robustness while being more generally applicable. We finally show that our methods mitigate undesired dependencies between attributional robustness and some training and estimation parameters, which seem to critically affect other competitor methods.