Joint Universal Adversarial Perturbations with Interpretations

TL;DR

This paper introduces a novel framework for generating universal adversarial perturbations that simultaneously deceive deep neural networks and mislead their interpretability methods, highlighting a new security concern.

Contribution

It is the first to propose and empirically validate joint universal adversarial perturbations targeting both DNN predictions and their interpretation maps.

Findings

JUAP effectively fools DNN classifiers across datasets.

JUAP successfully misleads attribution maps, reducing interpretability.

First demonstration of joint attack on models and their explanations.

Abstract

Deep neural networks (DNNs) have significantly boosted the performance of many challenging tasks. Despite the great development, DNNs have also exposed their vulnerability. Recent studies have shown that adversaries can manipulate the predictions of DNNs by adding a universal adversarial perturbation (UAP) to benign samples. On the other hand, increasing efforts have been made to help users understand and explain the inner working of DNNs by highlighting the most informative parts (i.e., attribution maps) of samples with respect to their predictions. Moreover, we first empirically find that such attribution maps between benign and adversarial examples have a significant discrepancy, which has the potential to detect universal adversarial perturbations for defending against adversarial attacks. This finding motivates us to further investigate a new research problem: whether there exist universal adversarial perturbations that are able to jointly attack DNNs classifier and its interpretation with malicious desires. It is challenging to give an explicit answer since these two objectives are seemingly conflicting. In this paper, we propose a novel attacking framework to generate joint universal adversarial perturbations (JUAP), which can fool the DNNs model and misguide the inspection from interpreters simultaneously. Comprehensive experiments on various datasets demonstrate the effectiveness of the proposed method JUAP for joint attacks. To the best of our knowledge, this is the first effort to study UAP for jointly attacking both DNNs and interpretations.