An Attack Judgment Method for Fooling Interpretable Algorithms of Deep Neural Networks

Abstract

The invention discloses an attack method for fooling the interpretability of a deep neural network. Each input image generates a perturbed image after adding noise in a certain area; the perturbed image is used to construct a loss function term. On the premise of keeping the generated perturbed image classification results the same as the original image classification results, the interpretability algorithm is used to explain the classification results, and the highlighted area of ​​the interpretation is located in the perturbed area; the noise is gradually limited by using the Adam optimization algorithm Until the disturbance is not perceived visually, the disturbance is not obvious, and finally a disturbance image that makes the interpretation wrong is generated. The invention combines attack and interpretability tasks, can effectively attack five deep neural network interpretable methods, and the size and position of the attack area can be changed arbitrarily, and the robust performance of the explanation under attack can be measured.

Description

technical field [0001] The invention relates to an interpretable attack judgment method for image processing, in particular to an attack judgment method for fooling an interpretable algorithm of a deep neural network. Background technique [0002] For artificial intelligence systems, the real environment is complex and changeable, and mistakes in the system's decision-making will lead to heavy losses. Therefore, the interpretability of the artificial intelligence system model becomes very important, so that people can understand how the system works and how decisions are formed. , find the cause of the error and improve it. Therefore, it is necessary to study the interpretability of deep learning. However, as artificial intelligence interpretability algorithms continue to be proposed, attacks on interpretable algorithms have emerged. For example, adding disturbance to the input image will change the interpretation effect to a great extent while keeping the prediction resul...

AI Technical Summary

Problems solved by technology

[0004] The technical problems to be solved in the present invention include: an effective attack algorithm; the size of the disturbance added to the noise must be constrained; both single-target object and multi-target object image classification interpretation can be fooled; multi-target object image classification interpretation is fooled to be distributed Suitable

Images