Research map / Adversarial robustness and security / Certified and empirical robustness
Fooling Neural Network Interpretations via Adversarial Model Manipulation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add interpretation-based Location, Top-k, or Center-mass penalties during fine-tuning | VGG19, ResNet50, and DenseNet121 · ImageNet validation | Top-1 accuracy: 72.4 -> 70.4; 76.1 -> 73.0; 74.4 -> 72.3 | Hurt |
| Add a Location fooling penalty to emphasize a fixed image region | VGG19 with LRP_T · ImageNet validation images | FSR (%): 87.5 | Helped |
| Add a Top-k fooling penalty to suppress originally salient pixels | VGG19 with LRP_T · ImageNet validation images | FSR (%): 96.3 | Helped |
| Add a Center-mass fooling penalty to displace explanation centers | VGG19 with LRP_T · ImageNet validation images | FSR (%): 99.9 | Helped |
| Add Active fooling to swap African Elephant and Firetruck explanations | VGG19 with LRP_T · Synthetic images with both classes | FSR (%): 94.5 | Helped |
| Add Active fooling to swap African Elephant and Firetruck explanations | ResNet50 with LRP_T · Synthetic images with both classes | FSR (%): 34.0 | Mixed |
| Add Active fooling to swap African Elephant and Firetruck explanations | DenseNet121 with LRP_T · Synthetic images with both classes | FSR (%): 0.0 | Hurt |
| Use Grad-CAM to guide Location fooling | VGG19, ResNet50, and DenseNet121 · ImageNet validation images | FSR (%): 89.2; 97.3; 81.8 | Mixed |
| Transfer fooling from one interpreter to other saliency methods | Manipulated models · ImageNet validation images | FSR (%): 66.8; 81.1; 88.2 | Mixed |
| Manipulate a model using SmoothGrad-based explanations rather than pointwise gradients | VGG19 · ImageNet validation | Top-5 accuracy: around 10% | Hurt |
| Maintain adversarial training while applying Location fooling | Adversarially trained ResNet50 · ImageNet validation and PGD-attacked validation | Top-1 accuracy | No clear effect |
Closest papers by meaning
- Building Reliable Explanations of Unreliable Neural Networks: Locally Smoothing Perspective of Model Interpretation (CVPR 2021 · similarity 0.90)
- Proper Network Interpretability Helps Adversarial Robustness in Classification (ICML 2020 · similarity 0.87)
- Explaining, Fast and Slow: Abstraction and Refinement of Provable Explanations (ICML 2025 · similarity 0.86)
- Unlearning-based Neural Interpretations (ICLR 2025 · similarity 0.85)
- How to Probe: Simple Yet Effective Techniques for Improving Post-hoc Explanations (ICLR 2025 · similarity 0.84)
- Towards Modeling Uncertainties of Self-Explaining Neural Networks via Conformal Prediction (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.