Counterfactual Explanations (CEs) have emerged as a major paradigm in
explainable AI research, providing recourse recommendations for users affected
by the decisions of machine learning models. However, when slight changes occur
in the parameters of the underlying model, CEs found by existing methods often
become invalid for the updated models. The literature lacks a way to certify
deterministic robustness guarantees for CEs under model changes, in that
existing methods to improve CEs' robustness are heuristic, and the robustness
performances are evaluated empirically using only a limited number of retrained
models. To bridge this gap, we propose a novel interval abstraction technique
for parametric machine learning models, which allows us to obtain provable
robustness guarantees of CEs under the possibly infinite set of plausible model
changes $\Delta$. We formalise our robustness notion as the $\Delta$-robustness
for CEs, in both binary and multi-class classification settings. We formulate
procedures to verify $\Delta$-robustness based on Mixed Integer Linear
Programming, using which we further propose two algorithms to generate CEs that
are $\Delta$-robust. In an extensive empirical study, we demonstrate how our
approach can be used in practice by discussing two strategies for determining
the appropriate hyperparameter in our method, and we quantitatively benchmark
the CEs generated by eleven methods, highlighting the effectiveness of our
algorithms in finding robust CEs.

为了解决因模型变动导致已有方法无效的问题，我们提出了一种用于参数化机器学习模型的新颖区间抽象技术，能够获得可靠的对抗模型变动的证明，进而提供具备可证明健壮性的反事实解释。通过基于混合整数线性规划的验证程序，我们进一步提出了两种算法，生成具备对抗模型变动健壮性的反事实解释，并通过对比实证研究表明，我们的算法在寻找具备健壮性的反事实解释方面具有很好的效果。

鲁棒的反事实解释的间隔抽象

Interval Abstractions for Robust Counterfactual Explanations

An adversarial patch can arbitrarily manipulate image pixels within a
restricted region to induce model misclassification. The threat of this
localized attack has gained significant attention because the adversary can
mount a physically-realizable attack by attaching patches to the victim object.
Recent provably robust defenses generally follow the PatchGuard framework by
using CNNs with small receptive fields and secure feature aggregation for
robust model predictions. In this paper, we extend PatchGuard to PatchGuard++
for provably detecting the adversarial patch attack to boost both provable
robust accuracy and clean accuracy. In PatchGuard++, we first use a CNN with
small receptive fields for feature extraction so that the number of features
corrupted by the adversarial patch is bounded. Next, we apply masks in the
feature space and evaluate predictions on all possible masked feature maps.
Finally, we extract a pattern from all masked predictions to catch the
adversarial patch attack. We evaluate PatchGuard++ on ImageNette (a 10-class
subset of ImageNet), ImageNet, and CIFAR-10 and demonstrate that PatchGuard++
significantly improves the provable robustness and clean performance.

本文介绍了将 PatchGuard 扩展到 PatchGuard++ 的方法以提高模型的可证明的鲁棒性和准确性，在局部受到对手物理攻击时也可以保证模型的安全。