攻击逻辑而非输出：通过证伪基于概念的属性实现深度神经网络的高效鲁棒性增强
Attack logics, not outputs: Towards efficient robustification of deep neural networks by falsifying concept-based properties
AI总结：
针对深度神经网络易受对抗攻击的问题，提出通过证伪涉及可解释概念的基于概念的属性来攻击逻辑而非输出的方法，理论上其搜索空间更小、更贴合鲁棒性目标，有望同时提升逻辑合规性与鲁棒性。
摘要：
计算机视觉领域的深度神经网络（NNs）易受对抗攻击影响，即对输入施加极微小的恶意改动就可能导致违反直觉的输出。验证并缓解此类鲁棒性问题的一种关键方法是证伪预期的输出行为，这可用于例如局部安全性证明，或利用得到的对抗输入样本对神经网络进行（重新）训练。由于神经网络的黑盒特性，当前的攻击仅能证伪最终输出的类别，例如将$\texttt{stop_sign}$（停止标志）翻转为$\neg\texttt{stop_sign}$（非停止标志）。在这篇短篇观点论文中，我们将这一思路推广到搜索神经网络验证中所考虑的普遍不合逻辑行为：证伪涉及更多人类可解释概念的约束（基于概念的属性），例如$\texttt{red}\text{（红色）}\texttt{octogonal}\text{（八边形）}\rightarrow\texttt{stop_sign}\text{（停止标志）}$。为此，我们利用可解释人工智能领域的技术，提出了一种在已训练神经网络上实现基于概念的属性的简便方法。此外，我们概述了理论证明：与简单的类别证伪相比，针对基于概念的属性的攻击预计具有更小的搜索空间，同时可以说更符合直观的鲁棒性目标。作为对这项正在进行中工作的展望，我们假设该方法有潜力高效且同时提升逻辑合规性与鲁棒性。
英文摘要：
Deep neural networks (NNs) for computer vision are vulnerable to adversarial attacks, i.e., miniscule malicious changes to inputs may induce unintuitive outputs. One key approach to verify and mitigate such robustness issues is to falsify expected output behavior. This allows, e.g., to locally proof security, or to (re)train NNs on obtained adversarial input examples. Due to the black-box nature of NNs, current attacks only falsify a class of the final output, such as flipping from $\texttt{stop_sign}$ to $\neg\texttt{stop_sign}$. In this short position paper we generalize this to search for generally illogical behavior, as considered in NN verification: falsify constraints (concept-based properties) involving further human-interpretable concepts, like $\texttt{red}\wedge\texttt{octogonal}\rightarrow\texttt{stop_sign}$. For this, an easy implementation of concept-based properties on already trained NNs is proposed using techniques from explainable artificial intelligence. Further, we sketch the theoretical proof that attacks on concept-based properties are expected to have a reduced search space compared to simple class falsification, whilst arguably be more aligned with intuitive robustness targets. As an outlook to this work in progress we hypothesize that this approach has potential to efficiently and simultaneously improve logical compliance and robustness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
