Research map / Adversarial robustness and security / Certified and empirical robustness

Structured Gradient-based Interpretations via Norm-Regularized Adversarial Training

CVPR 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Decision-boundary geometry of robustness · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes norm-regularized adversarial training, derived via a Fenchel-conjugate duality, to train networks whose simple-gradient saliency maps are sparse, group-sparse, or aligned with human gaze, without post-hoc fidelity loss.

Problem

Gradient-based saliency maps (simple gradient, integrated gradients) are often noisy, dense, and lack sparsity or connectedness; existing post-processing sparsification methods reduce fidelity to the original gradient map.

Approach

Shows a duality between norms of adversarial perturbations and norms of input gradients (via first-order Taylor expansion and Fenchel conjugates), and uses this to design adversarial training losses (L1, L2,1 group norm, elastic net, weighted L2 for gaze harmonization) that induce structured simple-gradient maps in-processing.

Key results

• On ImageNette, L1-norm adversarial training (eps=0.10) raised Gini sparsity from 46.53% (standard) to 65.53%, at a cost of accuracy dropping to 78.85%.
• Elastic net adversarial training (eps1=0.01, eps2=0.05) achieved the highest DiffROAR score of 3.24% versus 1.81% for standard training, with Gini 57.35% and accuracy 87.67%.
• On CUB-GHA, increasing harmonization coefficient eps raised top-5% gaze overlap from 33.42% to 50.62% with accuracy falling from 67.58% to 64.99%.

Measured effects reported in the paper

Surprising findings

• Standard training with norm regularization added directly to the objective failed to produce structured saliency maps, whereas the adversarial formulation succeeded.
• Sparsified-SmoothGrad showed high SSIM stability only because of its sparsity; top-k overlap revealed the activated regions actually differed.

Limitations

• Derivation relies on a first-order Taylor approximation valid only for small perturbations, with O(eps^2) approximation error.
• Sparsity gains come with clean accuracy drops for larger regularization coefficients (e.g., L1 eps=0.10 drops accuracy to 78.85%).
• Analysis is limited to the simple gradient; integrated gradients, DeepLIFT, and GradCAM are not covered.

Experimental setup

Datasets: synthesized dataset with ground-truth saliency (Simonyan-style, from [35]) ImageNette CUB-GHA

Benchmarks: ImageNette CUB-GHA synthesized dataset

Metrics: Gini index DiffROAR accuracy top-k overlap SSIM top-k intersection ratio five-band score binary score FPR

Baselines: standard training SmoothGrad Sparsified-SmoothGrad MoreauGrad penalty regularization

Builds on: PGD adversarial training FGSM SmoothGrad Sparsified-SmoothGrad MoreauGrad

Closest papers by meaning

• Towards More Robust Interpretation via Local Gradient Alignment (AAAI 2023 · similarity 0.87)
• On the Connection Between Adversarial Robustness and Saliency Map Interpretability (ICML 2019 · similarity 0.87)
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing Their Input Gradients (AAAI 2018 · similarity 0.87)
• Interpreting Adversarially Trained Convolutional Neural Networks (ICML 2019 · similarity 0.86)
• Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · similarity 0.85)
• Transferable Structural Sparse Adversarial Attack Via Exact Group Sparsity Training (CVPR 2024 · similarity 0.85)