@article {5039, title = {One thing to fool them all: generating interpretable, universal, and physically-realizable adversarial features}, journal = {arXiv}, year = {2022}, month = {01/2022}, abstract = {

It is well understood that modern deep networks are vulnerable to adversarial attacks. However, conventional attack methods fail to produce adversarial perturbations that are intelligible to humans, and they pose limited threats in the physical world. To study feature-class associations in networks and better understand their vulnerability to attacks in the real world, we develop feature-level adversarial perturbations using deep image generators and a novel optimization objective. We term these feature-fool attacks. We show that they are versatile and use them to generate targeted feature-level attacks at the ImageNet scale that are simultaneously interpretable, universal to any source image, and physically-realizable. These attacks reveal spurious, semantically-describable feature/class associations that can be exploited by novel combinations of objects. We use them to guide the design of {\textquotedblleft}copy/paste{\textquotedblright} adversaries in which one natural image is pasted into another to cause a targeted misclassification.

}, doi = {10.48550/arXiv.2110.03605}, url = {https://arxiv.org/abs/2110.03605}, author = {Stephen Casper and Max Nadeau and Gabriel Kreiman} } @article {5256, title = {Robust Feature-Level Adversaries are Interpretability Tools}, year = {2022}, month = {10/2022}, address = {New Orleans, Louisiana}, abstract = {

The literature on adversarial attacks in computer vision typically focuses on pixel-level perturbations. These tend to be very difficult to interpret. Recent work that manipulates the latent representations of image generators to create "feature-level" adversarial perturbations gives us an opportunity to explore perceptible, interpretable adversarial attacks. We make three contributions. First, we observe that feature-level attacks provide useful classes of inputs for studying representations in models. Second, we show that these adversaries are uniquely versatile and highly robust. We demonstrate that they can be used to produce targeted, universal, disguised, physically-realizable, and black-box attacks at the ImageNet scale. Third, we show how these adversarial images can be used as a practical interpretability tool for identifying bugs in networks. We use these adversaries to make predictions about spurious associations between features and classes which we then test by designing "copy/paste" attacks in which one natural image is pasted into another to cause a targeted misclassification. Our results suggest that feature-level attacks are a promising approach for rigorous interpretability research. They support the design of tools to better understand what a model has learned and diagnose brittle feature associations. Code is available at https://github.com/thestephencasper/feature_level_adv.

}, keywords = {Adversarial Attacks, Explainability, Interpretability}, url = {https://openreview.net/forum?id=lQ--doSB2o}, author = {Stephen Casper and Max Nadeau and Dylan Hadfield-Menell and Gabriel Kreiman} }