Along with the successful deployment of deep neural networks in several
application domains, the need to unravel the black-box nature of these networks
has seen a significant increase recently. Several methods have been introduced
to provide insight into the inference process of deep neural networks. However,
most of these explainability methods have been shown to be brittle in the face
of adversarial perturbations of their inputs in the image and generic textual
domain. In this work we show that this phenomenon extends to specific and
important high stakes domains like biomedical datasets. In particular, we
observe that the robustness of explanations should be characterized in terms of
the accuracy of the explanation in linking a model's inputs and its decisions -
faithfulness - and its relevance from the perspective of domain experts -
plausibility. This is crucial to prevent explanations that are inaccurate but
still look convincing in the context of the domain at hand. To this end, we
show how to adapt current attribution robustness estimation methods to a given
domain, so as to take into account domain-specific plausibility. This results
in our DomainAdaptiveAREstimator (DARE) attribution robustness estimator,
allowing us to properly characterize the domain-specific robustness of faithful
explanations. Next, we provide two methods, adversarial training and FAR
training, to mitigate the brittleness characterized by DARE, allowing us to
train networks that display robust attributions. Finally, we empirically
validate our methods with extensive experiments on three established biomedical
benchmarks.

本文旨在解决当前越来越普遍的深度神经网络 “黑匣子” 问题，介绍了如何适应不同领域的需求来提高解释方法的鲁棒性，并提供两种训练方法来缓解其脆弱性，最终通过实验证明了方法的有效性。

DARE：针对生物医学和医疗保健应用的强韧文本解释

DARE: Towards Robust Text Explanations in Biomedical and Healthcare  Applications

Explanations are crucial parts of deep neural network (DNN) classifiers. In
high stakes applications, faithful and robust explanations are important to
understand and gain trust in DNN classifiers. However, recent work has shown
that state-of-the-art attribution methods in text classifiers are susceptible
to imperceptible adversarial perturbations that alter explanations
significantly while maintaining the correct prediction outcome. If undetected,
this can critically mislead the users of DNNs. Thus, it is crucial to
understand the influence of such adversarial perturbations on the networks'
explanations and their perceptibility. In this work, we establish a novel
definition of attribution robustness (AR) in text classification, based on
Lipschitz continuity. Crucially, it reflects both attribution change induced by
adversarial input alterations and perceptibility of such alterations. Moreover,
we introduce a wide set of text similarity measures to effectively capture
locality between two text samples and imperceptibility of adversarial
perturbations in text. We then propose our novel TransformerExplanationAttack
(TEA), a strong adversary that provides a tight estimation for attribution
robustness in text classification. TEA uses state-of-the-art language models to
extract word substitutions that result in fluent, contextual adversarial
samples. Finally, with experiments on several text classification
architectures, we show that TEA consistently outperforms current
state-of-the-art AR estimators, yielding perturbations that alter explanations
to a greater extent while being more fluent and less perceptible.

通过提出 attribution robustness（AR）的概念，使用一系列文本相似性度量来捕捉两个文本的局部性和不可感知性，并提出了 TransformerExplanationAttack（TEA）的概念，利用最先进的语言模型，提取单词替换，从而展示了对于几种文本分类架构的实验，证明了 TEA 在提高对上下文敏感性的同时，更加流畅，更不易被察觉。