Although deep Reinforcement Learning (RL) has proven successful in a wide
range of tasks, one challenge it faces is interpretability when applied to
real-world problems. Saliency maps are frequently used to provide
interpretability for deep neural networks. However, in the RL domain, existing
saliency map approaches are either computationally expensive and thus cannot
satisfy the real-time requirement of real-world scenarios or cannot produce
interpretable saliency maps for RL policies. In this work, we propose an
approach of Distillation with selective Input Gradient Regularization (DIGR)
which uses policy distillation and input gradient regularization to produce new
policies that achieve both high interpretability and computation efficiency in
generating saliency maps. Our approach is also found to improve the robustness
of RL policies to multiple adversarial attacks. We conduct experiments on three
tasks, MiniGrid (Fetch Object), Atari (Breakout) and CARLA Autonomous Driving,
to demonstrate the importance and effectiveness of our approach.

本研究提出了一种称作 Distillation with selective Input Gradient Regularization (DIGR) 的方法，利用政策精炼和输入梯度正则化生成新政策，从而实现生成适用于实景且高效的可解释性 saliency 激活图。实验证明，该方法能够提高 RL 政策在多个对抗攻击下的鲁棒性，并且在 MiniGrid（Fetch Object）、Atari（Breakout）和 CARLA 自动驾驶任务上表现出良好的效果。

选择性输入梯度正则化的政策蒸馏以实现高效可解释性

Policy Distillation with Selective Input Gradient Regularization for Efficient Interpretability

In this work we study input gradient regularization of deep neural networks,
and demonstrate that such regularization leads to generalization proofs and
improved adversarial robustness. The proof of generalization does not overcome
the curse of dimensionality, but it is independent of the number of layers in
the networks. The adversarial robustness regularization combines adversarial
training, which we show to be equivalent to Total Variation regularization,
with Lipschitz regularization. We demonstrate empirically that the regularized
models are more robust, and that gradient norms of images can be used for
attack detection.

本文研究了深度神经网络的输入梯度正则化，并证明了这种正则化可以导致泛化证明和改进的对抗性稳健性。通过将对抗训练与 Lipschitz 正则化相结合，可以使模型更加稳健，并且可以使用图像的梯度范数进行攻击检测。

利普希茨正则化深度神经网络的泛化性能和防御对抗攻击能力

Lipschitz regularized Deep Neural Networks generalize and are  adversarially robust

Deep neural networks have proven remarkably effective at solving many
classification problems, but have been criticized recently for two major
weaknesses: the reasons behind their predictions are uninterpretable, and the
predictions themselves can often be fooled by small adversarial perturbations.
These problems pose major obstacles for the adoption of neural networks in
domains that require security or transparency. In this work, we evaluate the
effectiveness of defenses that differentiably penalize the degree to which
small changes in inputs can alter model predictions. Across multiple attacks,
architectures, defenses, and datasets, we find that neural networks trained
with this input gradient regularization exhibit robustness to transferred
adversarial examples generated to fool all of the other models. We also find
that adversarial examples generated to fool gradient-regularized models fool
all other models equally well, and actually lead to more "legitimate,"
interpretable misclassifications as rated by people (which we confirm in a
human subject experiment). Finally, we demonstrate that regularizing input
gradients makes them more naturally interpretable as rationales for model
predictions. We conclude by discussing this relationship between
interpretability and robustness in deep neural networks.

本研究评估了不同防御机制对神经网络的有效性，发现使用输入梯度规则化训练的神经网络具有抵御小幅度扰动的鲁棒性，并且可以提高预测的可解释性。同时，对这种神经网络产生的误分类可以解释，并进一步讨论了深度神经网络中解释性和鲁棒性之间的关系。