Interpreting Adversarial Examples by Activation Promotion and Suppression

Understand

It is widely known that convolutional neural networks (CNNs) are vulnerable to adversarial examples: images with imperceptible perturbations crafted to fool classifiers.

• However, interpretability of these perturbations is less explored in the literature.
• This work aims to better understand the roles of adversarial perturbations and provide visual explanations from pixel, image and network perspectives.
• We show that adversaries have a promotion-suppression effect (PSE) on neurons' activations and can be primarily categorized into three types: i) suppression-dominated perturbations that mainly reduce the classification score of the true label, ii) promotion-dominated perturbations that focus on boosting the confidence of the target label, and iii) balanced perturbations that play a dual role in suppression and promotion.