Interpreting neural network classifiers using gradient-based saliency maps has been extensively studied in the deep learning literature. While the existing algorithms manage to achieve satisfactory performance in application to standard image recognition datasets, recent works demonstrate the vulnerability of widely-used gradient-based interpretation schemes to norm-bounded perturbations adversarially designed for every individual input sample. However, such adversarial perturbations are commonly designed using the knowledge of an input sample, and hence perform sub-optimally in application to an unknown or constantly changing data point. In this paper, we show the existence of a Universal Perturbation for Interpretation (UPI) for standard image datasets, which can alter a gradient-based feature map of neural networks over a significant fraction of test samples. To design such a UPI, we propose a gradient-based optimization method as well as a principal component analysis (PCA)-based approach to compute a UPI which can effectively alter a neural network's gradient-based interpretation on different samples. We support the proposed UPI approaches by presenting several numerical results of their successful applications to standard image datasets.

翻译：利用基于梯度的显著性图解释神经网络分类器在深度学习文献中已得到广泛研究。尽管现有算法在标准图像识别数据集上取得了令人满意的性能，但近期研究表明，广泛使用的基于梯度的解释方案易受针对每个独立输入样本对抗性设计的范数有界扰动影响。然而，此类对抗性扰动通常利用输入样本的先验知识设计，因此在面对未知或动态变化的数据点时表现欠佳。本文证明了标准图像数据集上存在通用解释扰动（UPI），可显著改变神经网络在大量测试样本上的梯度特征图。为设计此类UPI，我们提出了基于梯度的优化方法及主成分分析（PCA）方法，通过计算UPI有效改变神经网络对不同样本的梯度解释。我们通过展示其成功应用于标准图像数据集的数值结果，验证了所提U PI方法的有效性。