Recent works have empirically shown that there exist adversarial examples
that can be hidden from neural network interpretability (namely, making network
interpretation maps visually similar), or interpretability is itself
susceptible to adversarial attacks. In this paper, we theoretically show that
with a proper measurement of interpretation, it is actually difficult to
prevent prediction-evasion adversarial attacks from causing interpretation
discrepancy, as confirmed by experiments on MNIST, CIFAR-10 and Restricted
ImageNet. Spurred by that, we develop an interpretability-aware defensive
scheme built only on promoting robust interpretation (without the need for
resorting to adversarial loss minimization). We show that our defense achieves
both robust classification and robust interpretation, outperforming
state-of-the-art adversarial training methods against attacks of large
perturbation in particular.

通过在 MNIST、CIFAR-10 和 Restricted ImageNet 上进行实验，本文在理论上证明了防止预测侵蚀性对抗攻击导致解释差异的正确解释度量是很困难的，并开发了一种仅基于促进稳健解释的解释敏感的防御方案。与对抗训练方法相比，在对大扰动攻击的抵抗中，本文的防御方法实现了稳健分类和稳健解释，表现优于最先进的对抗训练方法。