Model attribution is a popular tool to explain the rationales behind model
predictions. However, recent work suggests that the attributions are vulnerable
to minute perturbations, which can be added to input samples to fool the
attributions while maintaining the prediction outputs. Although empirical
studies have shown positive performance via adversarial training, an effective
certified defense method is eminently needed to understand the robustness of
attributions. In this work, we propose to use uniform smoothing technique that
augments the vanilla attributions by noises uniformly sampled from a certain
space. It is proved that, for all perturbations within the attack region, the
cosine similarity between uniformly smoothed attribution of perturbed sample
and the unperturbed sample is guaranteed to be lower bounded. We also derive
alternative formulations of the certification that is equivalent to the
original one and provides the maximum size of perturbation or the minimum
smoothing radius such that the attribution can not be perturbed. We evaluate
the proposed method on three datasets and show that the proposed method can
effectively protect the attributions from attacks, regardless of the
architecture of networks, training schemes and the size of the datasets.

提出了一种使用均匀平滑技术的认证方法，通过在一定空间内均匀采样的噪音增加基础归因结果，确保在攻击区域内所有扰动的样本均匀平滑归因与未扰动样本之间的余弦相似度被保证为下界，从而防止归因受到攻击。