Research map / Adversarial robustness and security / Certified and empirical robustness
Robust Feature-Level Adversaries are Interpretability Tools
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with feature-level adversaries | ResNet50 · Five class pairs | binary classification accuracy: 0.42 | Helped |
| Use patch adversaries rather than channel or region adversaries for adversarial training | ResNet50 · Five class pairs | binary classification accuracy improvement: Channel 0.33; Region 0.32; Patch 0.60 | Helped |
| Use the full generator-based method with all disguise regularizers | ResNet50 feature-level patch attacks · ImageNet-scale targeted universal attacks | attack effectiveness and disguise | Mixed |
| Remove the generator (ablation) | Full feature-level patch method · ImageNet-scale targeted universal attacks | attack effectiveness and feature-level interpretability | Mixed |
| Remove discriminator regularization (ablation) | Full feature-level patch method · ImageNet-scale targeted universal attacks | realistic-looking patch quality | No clear effect |
| Remove entropy regularization (ablation) | Full feature-level patch method · ImageNet-scale targeted universal attacks | attack effectiveness and disguise | Mixed |
| Remove patch cross-entropy disguise regularization (ablation) | Full feature-level patch method · ImageNet-scale targeted universal attacks | attack effectiveness and disguise | Mixed |
| Remove all disguise regularization terms while retaining the generator (ablation) | Full feature-level patch method · ImageNet-scale targeted universal attacks | disguise | Hurt |
| Remove the generator and all disguise regularizers, using a pixel-space patch instead (ablation) | Full feature-level patch method · ImageNet-scale targeted universal attacks | attack effectiveness and disguise | Hurt |
| Optimize patch adversaries under transformations | Feature-level patch attacks · Physical-world transfer | target class confidence: 0.312 | Helped |
| Use class-universal channel attacks instead of the other attack forms | Feature-level attacks · Generated source-class examples | universal attack success | Hurt |
| Train transfer attacks against an ensemble and apply them to a held-out ResNet50 | Feature-level patch and generalized patch attacks · Black-box transfer | mean target class confidence: over 0.1 | Helped |
Closest papers by meaning
- With Friends Like These, Who Needs Adversaries? (NeurIPS 2018 · similarity 0.90)
- Proper Network Interpretability Helps Adversarial Robustness in Classification (ICML 2020 · similarity 0.89)
- OTI: A Model-free and Visually Interpretable Measure of Image Attackability (AAAI 2026 · similarity 0.89)
- Attacks Meet Interpretability: Attribute-steered Detection of Adversarial Samples (NeurIPS 2018 · similarity 0.89)
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability (ICML 2025 · similarity 0.88)
- Doppelgangers and Adversarial Vulnerability (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.