Timezone: »

Robust Feature-Level Adversaries are Interpretability Tools
Stephen Casper · Max Nadeau · Dylan Hadfield-Menell · Gabriel Kreiman

Wed Nov 30 09:00 AM -- 11:00 AM (PST) @ Hall J #716

The literature on adversarial attacks in computer vision typically focuses on pixel-level perturbations. These tend to be very difficult to interpret. Recent work that manipulates the latent representations of image generators to create "feature-level" adversarial perturbations gives us an opportunity to explore perceptible, interpretable adversarial attacks. We make three contributions. First, we observe that feature-level attacks provide useful classes of inputs for studying representations in models. Second, we show that these adversaries are versatile and highly robust. We demonstrate that they can be used to produce targeted, universal, disguised, physically-realizable, and black-box attacks at the ImageNet scale. Third, we show how these adversarial images can be used as a practical interpretability tool for identifying bugs in networks. We use these adversaries to make predictions about spurious associations between features and classes which we then test by designing "copy/paste" attacks in which one natural image is pasted into another to cause a targeted misclassification. Our results suggest that feature-level attacks are a promising approach for rigorous interpretability research. They support the design of tools to better understand what a model has learned and diagnose brittle feature associations.

Author Information

Stephen Casper (MIT)
Stephen Casper

Hi, I’m Stephen Casper, but most people call me Cas. I’m a second year Ph.D student at MIT in Computer Science (EECS) in the Algorithmic Alignment Group advised by Dylan Hadfield-Menell. I’m supported by the Vitalik Buterin Fellowship from the Future of Life Institute. Formerly, I have worked with the Harvard Kreiman Lab and the Center for Human-Compatible AI. My main focus is in developing tools for more interpretable and robust AI. Lately, I have been particularly interested in finding (mostly) automated ways of finding/fixing flaws in how deep neural networks handle human-interpretable concepts. I’m also an Effective Altruist trying to do the most good I can.

Max Nadeau (Harvard University)
Dylan Hadfield-Menell (MIT)
Gabriel Kreiman (Harvard Medical School)

Gabriel Kreiman is Associate Professor at Children's Hospital, Harvard Medical School and leads the thrust to study neural circuits in the Center for Brains, Minds and Machines (MIT/Harvard). He received the NSF Career Award, the NIH New Innovator Award and the Pisart Award for Vision Research. Research in the Kreiman laboratory combines computational, neurophysiological and behavioral tools to further our understanding of how intelligent computations are implemented by neural circuits in the brain. His work has shed light on the biological codes to represent information in cortex and the fundamental principles underlying computations involved in vision and learning. For further details about his work, please visit klab.tch.harvard.edu

More from the Same Authors