Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Explainability-Guided Defense: Attribution-Aware Model Refinement Against Adversarial Data Attacks

Longwei Wang, Mohammad Navid Nayyem, Abdullah Al Rakin, KC Santosh, Chaowei Zhang, Yang Zhou

TL;DR

This paper tackles the vulnerability of deep neural networks to adversarial perturbations and distribution shifts by proposing an attribution-guided defense that integrates explainability into training. By using LIME to identify semantically irrelevant or unstable features, the framework suppresses these cues through masking, gradient regularization, and adversarial augmentation in a closed-loop pipeline. A theoretical attribution-aware bound on adversarial distortion is derived, and empirical results on CIFAR-10, CIFAR-100, and CIFAR-10-C show improved robustness and out-of-distribution generalization with minimal clean accuracy loss. The approach provides a practical path to transparent, robust models by leveraging explanation feedback as an active training signal.

Abstract

The growing reliance on deep learning models in safety-critical domains such as healthcare and autonomous navigation underscores the need for defenses that are both robust to adversarial perturbations and transparent in their decision-making. In this paper, we identify a connection between interpretability and robustness that can be directly leveraged during training. Specifically, we observe that spurious, unstable, or semantically irrelevant features identified through Local Interpretable Model-Agnostic Explanations (LIME) contribute disproportionately to adversarial vulnerability. Building on this insight, we introduce an attribution-guided refinement framework that transforms LIME from a passive diagnostic into an active training signal. Our method systematically suppresses spurious features using feature masking, sensitivity-aware regularization, and adversarial augmentation in a closed-loop refinement pipeline. This approach does not require additional datasets or model architectures and integrates seamlessly into standard adversarial training. Theoretically, we derive an attribution-aware lower bound on adversarial distortion that formalizes the link between explanation alignment and robustness. Empirical evaluations on CIFAR-10, CIFAR-10-C, and CIFAR-100 demonstrate substantial improvements in adversarial robustness and out-of-distribution generalization.

Explainability-Guided Defense: Attribution-Aware Model Refinement Against Adversarial Data Attacks

TL;DR

This paper tackles the vulnerability of deep neural networks to adversarial perturbations and distribution shifts by proposing an attribution-guided defense that integrates explainability into training. By using LIME to identify semantically irrelevant or unstable features, the framework suppresses these cues through masking, gradient regularization, and adversarial augmentation in a closed-loop pipeline. A theoretical attribution-aware bound on adversarial distortion is derived, and empirical results on CIFAR-10, CIFAR-100, and CIFAR-10-C show improved robustness and out-of-distribution generalization with minimal clean accuracy loss. The approach provides a practical path to transparent, robust models by leveraging explanation feedback as an active training signal.

Abstract

The growing reliance on deep learning models in safety-critical domains such as healthcare and autonomous navigation underscores the need for defenses that are both robust to adversarial perturbations and transparent in their decision-making. In this paper, we identify a connection between interpretability and robustness that can be directly leveraged during training. Specifically, we observe that spurious, unstable, or semantically irrelevant features identified through Local Interpretable Model-Agnostic Explanations (LIME) contribute disproportionately to adversarial vulnerability. Building on this insight, we introduce an attribution-guided refinement framework that transforms LIME from a passive diagnostic into an active training signal. Our method systematically suppresses spurious features using feature masking, sensitivity-aware regularization, and adversarial augmentation in a closed-loop refinement pipeline. This approach does not require additional datasets or model architectures and integrates seamlessly into standard adversarial training. Theoretically, we derive an attribution-aware lower bound on adversarial distortion that formalizes the link between explanation alignment and robustness. Empirical evaluations on CIFAR-10, CIFAR-10-C, and CIFAR-100 demonstrate substantial improvements in adversarial robustness and out-of-distribution generalization.
Paper Structure (27 sections, 30 equations, 4 figures, 1 table, 1 algorithm)

This paper contains 27 sections, 30 equations, 4 figures, 1 table, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Works
  3. Adversarial Robustness in Deep Models
  4. Model Interpretability
  5. Integrating Interpretability and Robustness
  6. Methodology
  7. Attribution-Guided Analysis
  8. Spurious Feature Identification
  9. XAI-Guided Model Refinement
  10. Feature Masking
  11. Sensitivity Regularization
  12. Adversarial Training
  13. Iterative Refinement Procedure
  14. Theoretical Analysis: Bridging Interpretability and Robustness
  15. Attribution-Constrained Model Behavior
  16. ...and 12 more sections

Figures (4)

  • Figure 1: LIME-based feature attribution maps illustrating the difference in learned representations between robust and non-robust models. The robust model (InceptionV3) consistently attends to semantically meaningful regions, while the non-robust baseline focuses on irrelevant or noise-sensitive areas.
  • Figure 2: Overview of the iterative XAI-guided refinement framework. LIME highlights spurious features post initial training. These are mitigated through feature masking, sensitivity regularization, and adversarial training. The process iterates until robustness and interpretability metrics converge.
  • Figure 3: Robustness Analysis under FGSM and PGD Attacks on CIFAR-10. The refined model consistently demonstrates improved performance across different perturbation strengths.
  • Figure 4: Robustness Analysis under FGSM and PGD Attacks on CIFAR-100. The refined model consistently achieves improved performance across varying perturbation strengths.