Visual Interpretability Alone Helps Adversarial Robustness
Recent works have empirically shown that there exist adversarial examples that can be hidden from neural network interpretability, and interpretability is itself susceptible to adversarial attacks. In this paper, we theoretically show that with the correct measurement of interpretation, it is actually difficult to hide adversarial examples, as confirmed by experiments on MNIST, CIFAR-10 and Restricted ImageNet. Spurred by that, we develop a novel defensive scheme built only on robust interpretation (without resorting to adversarial loss minimization). We show that our defense achieves similar classification robustness to state-of-the-art robust training methods while attaining higher interpretation robustness under various settings of adversarial attacks.
Interesting work and good contribution #Summary: The paper demonstrated that by having an l1-norm based 2-class interpretability discrepancy measure, it can be shown both empirically and theoretically that it is actually difficult to hide adversarial examples. Furthermore, the authors propose an interpretability-aware robust training method and show it can be used to successfully defend adversarially attacks and can result in comparable performance compared to adversarial training. #Strength The paper is well written and structured, with a clear demonstration of technical details. Compared with other works that tried to use model interpretation to help improve the model’s robustness, the authors not only consider the saliency map computed for the actual target label but also the label that corresponds to the adversarial example. The proposed interpretability discrepancy measure is novel and has been proven effective to defend interpretability sneaking attacks that aiming to fool both classifiers and detectors and against interpretability-only attacks. Furthermore, extensive experiments have been done to prove the effectiveness of interpretability-aware training, which strengthens the claims of the entire paper. #Presentation Good coverage of the literature in both adversarial robustness and model interpretation. Some minor typos need to be fixed. For example, in the second last line of the caption of Figure. 2, one L(x’,i) should be L(x,i) if I understand correctly.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Visual Interpretability Alone Helps Adversarial Robustness
Recent works have empirically shown that there exist adversarial examples that can be hidden from neural network interpretability, and interpretability is itself susceptible to adversarial attacks. In this paper, we theoretically show that with the correct measurement of interpretation, it is actually difficult to hide adversarial examples, as confirmed by experiments on MNIST, CIFAR-10 and Restricted ImageNet. Spurred by that, we develop a novel defensive scheme built only on robust interpretation (without resorting to adversarial loss minimization). We show that our defense achieves similar classification robustness to state-of-the-art robust training methods while attaining higher interpretation robustness under various settings of adversarial attacks.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



Interesting work and good contribution #Summary: The paper demonstrated that by having an l1-norm based 2-class interpretability discrepancy measure, it can be shown both empirically and theoretically that it is actually difficult to hide adversarial examples. Furthermore, the authors propose an interpretability-aware robust training method and show it can be used to successfully defend adversarially attacks and can result in comparable performance compared to adversarial training. #Strength The paper is well written and structured, with a clear demonstration of technical details. Compared with other works that tried to use model interpretation to help improve the model’s robustness, the authors not only consider the saliency map computed for the actual target label but also the label that corresponds to the adversarial example. The proposed interpretability discrepancy measure is novel and has been proven effective to defend interpretability sneaking attacks that aiming to fool both classifiers and detectors and against interpretability-only attacks. Furthermore, extensive experiments have been done to prove the effectiveness of interpretability-aware training, which strengthens the claims of the entire paper. #Presentation Good coverage of the literature in both adversarial robustness and model interpretation. Some minor typos need to be fixed. For example, in the second last line of the caption of Figure. 2, one L(x’,i) should be L(x,i) if I understand correctly.
assistant
Interesting work and good contribution #Summary: The paper demonstrated that by having an l1-norm based 2-class interpretability discrepancy measure, it can be shown both empirically and theoretically that it is actually difficult to hide adversarial examples. Furthermore, the authors propose an interpretability-aware robust training method and show it can be used to successfully defend adversarially attacks and can result in comparable performance compared to adversarial training. #Strength The paper is well written and structured, with a clear demonstration of technical details. Compared with other works that tried to use model interpretation to help improve the model’s robustness, the authors not only consider the saliency map computed for the actual target label but also the label that corresponds to the adversarial example. The proposed interpretability discrepancy measure is novel and has been proven effective to defend interpretability sneaking attacks that aiming to fool both classifiers and detectors and against interpretability-only attacks. Furthermore, extensive experiments have been done to prove the effectiveness of interpretability-aware training, which strengthens the claims of the entire paper. #Presentation Good coverage of the literature in both adversarial robustness and model interpretation. Some minor typos need to be fixed. For example, in the second last line of the caption of Figure. 2, one L(x’,i) should be L(x,i) if I understand correctly.