・本資料は下記イベントにおける第三者（竹中）による論文紹介用資料です。 ・間違い等のご指摘は竹中までご連絡お願いいたします。 ・【画像処理 & 機械学習】論文LT会 #5 @ エルピクセル株式会社, 2019/07/22 https://lpixel.connpass.com/event/138687/ ・紹介論文 Amirata Ghorbani et al. "Interpretation of Neural Networks is Fragile", AAAI2019

1. Interpretation of
Neural Networks is
Fragile
1

2. • Interpretation of Neural Networks is Fragile
• Amirata Ghorbani, Abubakar Abid, James Zou
• Stanford University
• AAAI 2019
• arXiv:1710.10547
•
• DNN Adversarial Attack
•
•
• Adversarial Attack
• Attack Attack
2

3. •
•
•
•
•
3

4. Adversarial Attacks
•
• panda → gibbon ( )
x
4

5. Adversarial Attacks for Against Feature Importance
• Attack
Attack
•
5

6. • DNN
δ
•
L ∇x
xt
6

7. • Feature importance
•
• 3
• Simple gradient method
• Integrated gradient DeepLIFT …
•
• Sample Importance
•
• [Koh&Liang2017]
I S ∇x
7
Sl(xt) xt ∈ ℝd
l
zi zt

8. •
•
•
• clip
•
xt I(xt; 𝒩) xt + δ
I(xt + δ; 𝒩) D( ⋅ ) δ
8

9. • Feature Importance
• Top-k
•
• Targeted
•
• Mass-center
•
• Sample Importance
• N
9
xt D
xp
(p ∈ [1,N]) D(xt, xp
)

10. •
• Feature Importance Attack
• Attack
• Sample Importance Attack
• Attack
•
• Feature Importance
• ImageNet SqueezeNet
• CIFAR-10 (cf. Appendix A.)
•
•
• Sample Importance
• InceptionNet v3 ImageNet
• rose or sunflower
• 1000
• Validation acc. 97.5 %
•
•
•
•
• FI
• SI
• TopK
• FI 1000
• SI Top
• ※ Appendix E F Center Attack CenterShift
P = 100, α = 0.5
±ϵ
10

11. Feature Importance Targeted Attack
• 3 Targeted Attack
•
•
11

12. Feature importance Attack
• ImageNet 512
• Top 1000
•
• l∞
12

13. Sample importance Attack
• (a)
• (b) clip size
• (c) 2
ϵ l∞
ϵ
13

14. • 1
•
•
•
•
• g
• i feature
•
• feature
S(x; w)
∇xS(x + δ) − ∇xS(x) ≃ Hδ, x ∈ ℝd
, Hi,j =
∂S
∂xi∂xj
S(w ⋅ x)
∇xS = w x
S = g(w ⋅ x)
x → x + δ
δ w l1
14

15. • Attack
•
• Fig6 2 NN
•
•
15

16. •
•
•
•
•
16