CAM-based methods are widely-used post-hoc interpretability method that
produce a saliency map to explain the decision of an image classification
model. The saliency map highlights the important areas of the image relevant to
the prediction. In this paper, we show that most of these methods can
incorrectly attribute an important score to parts of the image that the model
cannot see. We show that this phenomenon occurs both theoretically and
experimentally. On the theory side, we analyze the behavior of GradCAM on a
simple masked CNN model at initialization. Experimentally, we train a VGG-like
model constrained to not use the lower part of the image and nevertheless
observe positive scores in the unseen part of the image. This behavior is
evaluated quantitatively on two new datasets. We believe that this is
problematic, potentially leading to mis-interpretation of the model's behavior.

CAM-based 方法是广泛使用的事后解释性方法，通过生成热点图来解释图像分类模型的决策。在本文中，我们展示了大部分这些方法可能会错误地将重要分数归因于模型无法看到的图像部分。我们从理论和实验两方面分析了该现象，并通过两个新数据集进行了定量评估。我们认为这是有问题的，可能导致对模型行为的错误解释。

基于 CAM 的方法能穿墙

CAM-Based Methods Can See through Walls

Backdoor attacks become a significant security concern for deep neural
networks in recent years. An image classification model can be compromised if
malicious backdoors are injected into it. This corruption will cause the model
to function normally on clean images but predict a specific target label when
triggers are present. Previous research can be categorized into two genres:
poisoning a portion of the dataset with triggered images for users to train the
model from scratch, or training a backdoored model alongside a triggered image
generator. Both approaches require significant amount of attackable parameters
for optimization to establish a connection between the trigger and the target
label, which may raise suspicions as more people become aware of the existence
of backdoor attacks. In this paper, we propose a backdoor attack paradigm that
only requires minimal alterations (specifically, the output layer) to a clean
model in order to inject the backdoor under the guise of fine-tuning. To
achieve this, we leverage mode mixture samples, which are located between
different modes in latent space, and introduce a novel method for conducting
backdoor attacks. We evaluate the effectiveness of our method on four popular
benchmark datasets: MNIST, CIFAR-10, GTSRB, and TinyImageNet.

提出一种只需对干净模型进行最小修改（特别是输出层）以在精调的假象下注入后门的后门攻击范例。通过利用位于潜空间中不同模态之间的模式混合样本，并引入一种新的后门攻击方法来实现。在 MNIST，CIFAR-10，GTSRB 和 TinyImageNet 数据集上评估该方法的有效性。