Pith. sign in

REVIEW 5 major objections 5 minor 54 references

Attribution for Enhanced Explanation with Transferable Adversarial eXploration

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Transferable adversarial attacks, by defining the integration path, improve image attribution scores by 32.62% over prior interpretability methods.

desk verdict Table III is the useful empirical core; the headline gains are a test-set oracle and the numbers don't reproduce from the tables. read the letter →

arxiv 2412.19523 v1 pith:YYATADTZ submitted 2024-12-27 cs.AI cs.CV

Zhiyu Zhu , Jiayu Zhang , Zhibo Jin , Huaming Chen , Jianlong Zhou , Fang Chen This is my paper · ORCID
classification cs.AIcs.CV
keywords interpretabilityattributionmethodstransferableadversarialattacksintegratedgradientsvisiontransformersImageNetinsertionanddeletionscoresexplainableAI
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that the quality of AI image explanations can be improved by choosing better adversarial attacks to define the path along which attributions are computed. It extends the AttEXplore framework, whose attribution integral runs along a non-linear adversarial attack path, by swapping in highly transferable attack methods—MIG for Inception-v3 and ViT-B/16, GRA for ResNet-50, VGG16 and MaxViT-T. On 1000 ImageNet samples, the resulting AttEXplore++ outperforms AttEXplore by 7.57% and other interpretability baselines by 32.62% in insertion and deletion scores. The paper also reports that randomness has little effect on the scores and that larger perturbation rates and noise amplitudes generally help. If correct, this shows that adversarial transferability, not just local gradient information, is a key ingredient in producing useful explanations.

What carries the argument

The load-bearing object is the adversarial path attribution integral, $A_i = \int \Delta x_t \cdot g(x_t)\,dt$, which attributes importance by accumulating the inner product of the input step $\Delta x_t$ with the attack gradient $g(x_t)$ along the non-linear trajectory from the original image to an adversarial image. The paper's innovation is to choose which attack defines this path: MIG, which combines momentum with integrated gradients, and GRA, which samples gradient-relevant neighborhoods, both producing highly transferable adversarial examples. That transferability, rather than the path geometry alone, is what the paper identifies as the driver of better attribution scores.

What would settle it

Train a small classifier on synthetic images where the only decision-relevant feature is a known patch, run AttEXplore++ on them, and check whether the highest-attributed pixels coincide with that patch. If the path integral points elsewhere while insertion and deletion scores remain high, the reported improvements would reflect artifacts of the score, not better explanations.

Watch

Extended reading notes

Core claim

The central claim is that substituting transferable adversarial attacks into the path-integral attribution formula yields more accurate and robust explanations. Specifically, the attribution $A_i = \int \Delta x_t \cdot g(x_t)\,dt$ is computed along the non-linear path traced by an iterative attack, and the gradient $g$ is supplied by the attack method. When $g$ comes from MIG (momentum integrated gradients) or GRA (gradient relevance attack) rather than from plain BIM or PGD, insertion and deletion scores improve on every model tested. The paper reports an average gain of 7.57% over AttEXplore and 32.62% over eleven competing interpretability algorithms, establishing that the transferability of the attack is strongly correlated with attribution performance.

Load-bearing premise

The whole comparison assumes that the adversarial path integral in Eq. (5) is a faithful measure of which features truly drive the model's decision, an assumption inherited from AttEXplore and never validated against ground-truth importance in this paper.

Editorial extensions

If this is right

  • On all five tested models, replacing the attack in the attribution path with MIG or GRA raises insertion scores above every baseline, so attack selection is now a first-class design choice for attribution methods.
  • The reported 7.57% gain over AttEXplore and 32.62% gain over other interpretability algorithms imply that transferability is at least as important as the path-integral geometry itself.
  • Attribution performance is stable across random seeds, so results from the framework are reproducible despite the stochastic components in DIM, TIM, and GRA.
  • The parameter study indicates that users should tune perturbation rate $\epsilon$ and noise amplitude $\beta$ per model, since CNN and transformer responses differ.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the paper never checks attributions against ground-truth features, the 32.62% headline is a gain on insertion and deletion scores, not necessarily on explanation correctness; a human-subject or ground-truth benchmark would be needed to confirm the practical value.
  • If transferability is the active ingredient, then future transfer attacks with even higher cross-model success should keep pushing these scores—an easily testable prediction the paper does not make.
  • The per-model choice of attack (MIG for some architectures, GRA for others) suggests a selection heuristic: match the attack's inductive bias to the model family; this could be formalized as an automated per-model attack selector.
  • The robustness to randomness is measured only across three seeds on 1000 samples; a tighter variance analysis over more seeds and more images would be the natural next check.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper extends the authors' previous AttEXplore method by integrating transferable adversarial attack methods (MIG, GRA, and others) into a path-integral attribution formula, Eq. (5). The proposed AttEXplore+ framework is evaluated on five ImageNet classifiers (Inception-v3, ResNet-50, VGG16, MaxViT-T, ViT-B/16) using insertion and deletion scores. The paper further claims that an optimized variant, AttEXplore++, improves over AttEXplore by 7.57% on average and over other state-of-the-art interpretability methods by 32.62%, and it presents ablation studies of diversity probability, perturbation rate, and noise amplitude.

Significance. If the empirical claims were valid, the paper would make a useful empirical contribution by showing that transferable adversarial attacks can improve attribution maps, and the ablation studies on randomness and hyperparameters would be of practical interest. The manuscript is also accompanied by an anonymous code release, which is a positive practice. However, the central evaluation protocol is flawed: AttEXplore++ is defined as a per-model oracle chosen from the test results in Table III, and the reported headline numbers are not reproducible from the tables. The path-integral attribution definition in Eq. (5) is taken from prior work without validation, and the claimed dominance over baselines is contradicted by the paper's own Table II on some models. These issues undermine the main contribution as stated.

major comments (5)
  1. [Section V-D, Table III] AttEXplore++ is not a single method but a post hoc oracle. The text states that the authors "chose the most optimal strategy" and selects MIG for Inception-v3 and ViT-B/16 and GRA for ResNet-50, VGG16, and MaxViT-T. These choices coincide exactly with the best insertion scores in Table III for each model. Because the selection is made on the same 1000-image test set that is then used for the final comparison in Table II, the reported average improvement is the result of maximizing over nine attack variants, not an evaluation of a single proposed algorithm. No validation split, nested model-selection procedure, or significance test is described. Recomputing from Table III, a fixed MIG strategy gives an average insertion gain of about 6.2% over AttEXplore, and a fixed GRA strategy gives about 3.3%; both are below the claimed 7.57%, and fixed MIG on MaxViT-T or fixed GRA on ViT-B/16 is worse than AttEXplore. The central empirical claim must be re-evaluated with a method selected on a validation set or reported separately for each attack variant.
  2. [Section V-E, Table II] The reported improvement numbers are not reproducible from the data in Table II. For insertion scores, the per-model relative gains of AttEXplore++ over AttEXplore are approximately 15.6% (Inception-v3), 6.3% (ResNet-50), 15.2% (VGG16), 8.3% (MaxViT-T), and 5.4% (ViT-B/16), which average to about 10.2%, not 7.57%. Moreover, on MaxViT-T the SmoothGrad baseline has an insertion score of 0.6432, which is higher than AttEXplore++'s 0.6368, contradicting the claim that AttEXplore++ is best across all models. The deletion scores of AttEXplore++ are worse than those of AttEXplore on all five models (e.g., 0.0496 vs. 0.0288 on Inception-v3), contradicting the conclusion that both metrics improve. The 32.62% gain over state-of-the-art methods also needs an explicit aggregation formula; using the best non-AttEXplore baseline in each column of Table II gives an average relative gain of roughly 25.6%, and on MaxViT-T the gain is negative.
  3. [Section V-D, Table III] The specification of AttEXplore++ is internally inconsistent. The text says 'For ResNet-50, VGG16, and MaxViT-T models, we applied the GRA method', but Table III shows that the best insertion score for VGG16 is achieved by MIG (0.3494), not GRA (0.3257), and the AttEXplore++ entry in Table II for VGG16 is 0.3494, matching MIG. The method description and the reported configuration must be reconciled so that the evaluated model is precisely defined.
  4. [Section IV-A, Eq. (5)] The attribution definition A_i = ∫ Δx_t · g(x_t) dt is stated without derivation, axiomatic justification, or empirical validation, and it is inherited from AttEXplore [20]. Since all reported improvements are measured on attribution maps produced by this formula, a failure of Eq. (5) to capture true feature importance would invalidate the comparison. The authors should include sanity checks, such as synthetic data with known ground-truth features or model-randomization tests, and relate Eq. (5) to standard attribution axioms. This is a correctness-risk concern, not a claim that the definition is necessarily wrong.
  5. [Section IV-B, Tables I and III] The paper claims that AttEXplore+ integrates 10 transferable attack methods, but Table III reports experimental results for only nine variants, and two methods listed in Table I (NAA and FSPS) are absent from the reported experiments. The claim of comprehensive coverage of transferable attack types is therefore not supported by the presented evidence.
minor comments (5)
  1. [Section IV-C] There is a typo in 'diversity probabilit' and the noise formula g'(x) = g(x) + η is not connected to the experiments; the authors should specify how differential-privacy noise is implemented in each attack method and what values of σ are used.
  2. [Section V-D] The setting 'perturbation rate ϵ to 16' conflicts with the definition of ϵ as an Lp perturbation bound in Eq. (3); the authors should clarify whether ϵ denotes the total perturbation budget or a per-step bound.
  3. [Figures 3-6] The embedded figures are rendered as sequences of raw glyph codes and are unreadable; the captions and plots need to be regenerated so that the results of the seed, DP, ϵ, and β experiments can be inspected.
  4. [Section V-H, Figure 4] The claim that higher DP values are recommended on ResNet-50, VGG16, and ViT-B/16 is based on a figure that is currently unreadable; provide numerical tables or a readable figure to support the recommendation.
  5. [Section V-E, Table II] The bold/underline formatting does not follow the stated protocol: for MaxViT-T, the highest insertion score is SmoothGrad's 0.6432, which should be bold, not AttEXplore++'s 0.6368.

Circularity Check

1 steps flagged · score 6.0 of 10

AttEXplore++'s headline 7.57% gain is a post-hoc oracle: the per-model attack choice in Sec. V-D is selected from the same Table III it is then used to beat, making the improvement an artifact of test-set selection rather than a prediction.

  1. fitted input called prediction [Section V-D (Experimental Settings), Tables II and III, Abstract]
    "In the AttEXplore+ framework, we chose the most optimal strategy to build our AttEXplore++ method. Specifically, in the Inception-v3 and ViT-B/16 models, we utilized MIG to optimize the transferability of adversarial attacks to improve the attribution process. For ResNet-50, VGG16, and MaxViT-T models, we applied the GRA method to enhance the attribution process. ... AttEXplore++ demonstrates superior performance across all models ... improves overall performance by an average of 7.57%."

    The 'most optimal strategy' is chosen after inspecting the same test-bed results reported in Table III: for each model, the selected attack is the best (or near-best) insertion-score row on the same 1000 ImageNet samples later used in Table II to claim superiority. AttEXplore++ is therefore not a single fixed algorithm but the argmax over nine AttEXplore+ attack variants on the evaluation set. Averaging these per-model maxima yields the headline 7.57% over AttEXplore and 32.62% over baselines, so those numbers are forced by the selection rule rather than predicted by an independently specified method; even under pure noise, the maximum of nine rows will beat a fixed row on average.

full rationale

The central empirical claim of the paper—that AttEXplore++ improves attribution by 7.57% over AttEXplore and 32.62% over other methods—reduces by construction to a post-hoc test-set selection. Section V-D states that the authors 'chose the most optimal strategy' for each model, and the resulting Table II numbers are exactly the best Table III insertion scores per model (modulo a textual inconsistency for VGG16). This is the fitted-input-called-prediction pattern: the method's per-model configuration is fit to the same data on which its performance is then reported as a prediction. The attribution integral in Eq. (5) is inherited from the authors' AttEXplore prior work, but that inheritance is not itself circular: the paper evaluates against external baselines with standard insertion/deletion metrics, and the path-integral definition is an assumption rather than a conclusion derived from the target claim. The deletion scores in Table II are actually worse for AttEXplore++ than AttEXplore on all five models, and the paper downgrades deletion to an auxiliary metric; this does not create circularity but reinforces that the headline improvement rests on a single, post-hoc selected insertion-score comparison. Because the selection is not validated on held-out data, the reported gains are statistically forced and the central claim is partially circular.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a path-integral attribution definition inherited from AttEXplore, on an evaluation protocol with unspecified details, on a 1,000-image sample, and on the existence of a transferability effect that is never directly tested. The only fitted component is the per-model selection of MIG vs GRA, which is chosen by inspecting test-set scores.

free parameters (4)
  • Per-model attack choice (MIG vs GRA) = MIG for Inception-v3 and ViT-B/16; GRA for ResNet-50, VGG16, MaxViT-T
    The choice of which adversarial attack to use in AttEXplore++ is made by inspecting the insertion/deletion scores on the test set (Table III), so the reported AttEXplore++ performance is an oracle selection rather than a single fixed algorithm.
  • Noise amplitude beta = 4.0
    Selected to maximize insertion scores in Figure 6; the paper tests 3.0, 3.5, 4.0 and reports that larger beta improves attribution performance.
  • Perturbation rate epsilon = 16
    Chosen from values 8, 16, 24 in Figure 5; the paper reports that higher epsilon generally improves insertion scores.
  • Diversity probability DP = 0.5
    Chosen from 0.2, 0.5, 0.8 in Figure 4; the paper recommends different values per model but sets 0.5 for the main results.
assumptions (4)
  • domain assumption The path-integral attribution A_i = ∫ Δx_t · g(x_t) dt along an adversarial attack trajectory is a valid measure of feature importance.
    Stated as a definition in Eq. (5) with no derivation or validation; the entire paper measures how this quantity changes across attack methods, but never validates it against ground-truth feature importance.
  • domain assumption Insertion and deletion scores computed on a 1,000-image subset of ImageNet are reliable proxies for attribution quality.
    The evaluation protocol details (number of steps, masking, blur) are not specified, and no error bars or significance tests are reported; the headline improvements in the abstract cannot be reproduced from Table II.
  • domain assumption The 1,000 sampled ImageNet images are representative of the full dataset.
    The paper does not describe how the 1,000 samples were selected, and the small sample size amplifies variance in insertion/deletion scores.
  • domain assumption Adversarial attack methods designed for transferability retain their distinguishing properties when applied directly to the explained model.
    The paper never performs cross-model transfer experiments; the claimed link between transferability and attribution quality is asserted but not isolated from other algorithmic differences.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attribution for Enhanced Explanation with Transferable Adversarial eXploration." pith.science (2026). https://pith.science/paper/YYATADTZ

@misc{pith2026241219523,
  author       = {Pith},
  title        = {Pith review of: Attribution for Enhanced Explanation with Transferable Adversarial eXploration},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YYATADTZ}},
  note         = {Machine review of arXiv:2412.19523}
}
read the original abstract

The interpretability of deep neural networks is crucial for understanding model decisions in various applications, including computer vision. AttEXplore++, an advanced framework built upon AttEXplore, enhances attribution by incorporating transferable adversarial attack methods such as MIG and GRA, significantly improving the accuracy and robustness of model explanations. We conduct extensive experiments on five models, including CNNs (Inception-v3, ResNet-50, VGG16) and vision transformers (MaxViT-T, ViT-B/16), using the ImageNet dataset. Our method achieves an average performance improvement of 7.57\% over AttEXplore and 32.62\% compared to other state-of-the-art interpretability algorithms. Using insertion and deletion scores as evaluation metrics, we show that adversarial transferability plays a vital role in enhancing attribution results. Furthermore, we explore the impact of randomness, perturbation rate, noise amplitude, and diversity probability on attribution performance, demonstrating that AttEXplore++ provides more stable and reliable explanations across various models. We release our code at: https://anonymous.4open.science/r/ATTEXPLOREP-8435/

Figures

Figures reproduced from arXiv: 2412.19523 by the authors.

Figure 1
Figure 1. Flowchart of AttEXplore+ Framework feature importance in models, thus demonstrating the value of diverse attacks in improving interpretability. Moreover, AttEXplore+ expands not only the types of at￾tacks but also specifically addresses the impact of randomness on attribution results. Through more in-depth ablation studies, we investigate the role of different levels of randomness in generating adversarial examples … view at source ↗
Figure 2
Figure 2. Non-linear Attribution Path B. Different Ways to Obtain Gradient Information Transfer-based attacks do not directly train adversarial ex￾amples on the target deep neural network model but rather on a substitute model. This requires the adversarial examples trained on the substitute model to reliably cross the decision boundary of the target model and mislead its decision. Fur￾thermore, in training adversarial exampl… view at source ↗
Figure 3
Figure 3. Evaluation of the impact of different random seeds on the insertion and deletion scores of different adversarial attack [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (1 more)
Figure 6
Figure 6. Figure 6: The impact of noise amplitude β on the insertion and deletion scores of the AttEXplore+GRA method across different models. Insertion and deletion scores are represented by blue and orange, respectively. 3.0 3.5 4.0 0.486 0.488 0.490 0.492 0.494 Insertion AttEXplore+GRA…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 31 canonical work pages

  1. [20]

    Attexplore: Attribution for explanation with model parameters exploration,

    Z. Zhu, H. Chen, J. Zhang, X. Wang, Z. Jin, J. Xue, and F. D. Salim, “Attexplore: Attribution for explanation with model parameters exploration,” in The Twelfth International Conference on Learning Representations, 2024

    work page 2024

  2. [1]

    Deep learning,

    Y . LeCun, Y . Bengio, and G. Hinton, “Deep learning,” nature, vol. 521, no. 7553, pp. 436–444, 2015

    2015

  3. [2]

    Dermatologist-level classification of skin cancer with deep neural networks,

    A. Esteva, B. Kuprel, R. A. Novoa, J. Ko, S. M. Swetter, H. M. Blau, and S. Thrun, “Dermatologist-level classification of skin cancer with deep neural networks,” nature, vol. 542, no. 7639, pp. 115–118, 2017

    2017

  4. [3]

    Xgboost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining , pp. 785–794, 2016

    2016

  5. [4]

    Towards a rigorous science of interpretable machine learning,

    F. Doshi-Velez and B. Kim, “Towards a rigorous science of interpretable machine learning,” arXiv preprint arXiv:1702.08608 , 2017

    arXiv 2017

  6. [5]

    The mythos of model interpretability: In machine learning, the concept of interpretability is both important and slippery.,

    Z. C. Lipton, “The mythos of model interpretability: In machine learning, the concept of interpretability is both important and slippery.,” Queue, vol. 16, no. 3, pp. 31–57, 2018

    work page 2018

  7. [6]

    Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead,

    C. Rudin, “Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead,” Nature machine intelligence, vol. 1, no. 5, pp. 206–215, 2019

    2019

  8. [7]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    arXiv 2014

Show all 54 references
  1. [8]

    A survey on bias and fairness in machine learning,

    N. Mehrabi, F. Morstatter, N. Saxena, K. Lerman, and A. Galstyan, “A survey on bias and fairness in machine learning,” ACM computing surveys (CSUR), vol. 54, no. 6, pp. 1–35, 2021

    2021

  2. [9]

    Propagating transparency: A deep dive into the interpretability of neural networks,

    A. Somani, L. A. Horsch, A. Bopardikar, and D. K. Prasad, “Propagating transparency: A deep dive into the interpretability of neural networks,” 2024

    2024

  3. [10]

    A benchmark for interpretability methods in deep neural networks,

    S. Hooker, D. Erhan, P.-J. Kindermans, and B. Kim, “A benchmark for interpretability methods in deep neural networks,” Advances in neural information processing systems , vol. 32, 2019

    2019

  4. [11]

    Methods for interpreting and understanding deep neural networks,

    G. Montavon, W. Samek, and K.-R. M ¨uller, “Methods for interpreting and understanding deep neural networks,” Digital signal processing , vol. 73, pp. 1–15, 2018

    2018

  5. [12]

    A survey on explainable artificial intelligence (xai): Toward medical xai,

    E. Tjoa and C. Guan, “A survey on explainable artificial intelligence (xai): Toward medical xai,” IEEE transactions on neural networks and learning systems, vol. 32, no. 11, pp. 4793–4813, 2020

    2020

  6. [13]

    Interpretability of machine learning methods applied to neuroimaging,

    E. Thibeau-Sutre, S. Collin, N. Burgos, and O. Colliot, “Interpretability of machine learning methods applied to neuroimaging,” Machine Learn- ing for Brain Disorders , pp. 655–704, 2023

    2023

  7. [14]

    Simple black-box adversarial attacks on deep neural networks.,

    N. Narodytska and S. P. Kasiviswanathan, “Simple black-box adversarial attacks on deep neural networks.,” in CVPR Workshops, vol. 2, 2017

    2017

  8. [15]

    Di-aa: An interpretable white-box attack for fooling deep neural networks,

    Y . Wang, J. Liu, X. Chang, R. J. Rodr ´ıguez, and J. Wang, “Di-aa: An interpretable white-box attack for fooling deep neural networks,” Information Sciences, vol. 610, pp. 14–32, 2022

    2022

  9. [16]

    Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gra- dients,

    A. Ross and F. Doshi-Velez, “Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gra- dients,” in Proceedings of the AAAI conference on artificial intelligence , vol. 32, 2018

    2018

  10. [17]

    Fooling network inter- pretation in image classification,

    A. Subramanya, V . Pillai, and H. Pirsiavash, “Fooling network inter- pretation in image classification,” in Proceedings of the IEEE/CVF international conference on computer vision , pp. 2020–2029, 2019

    2020

  11. [18]

    Adversarial perturbation defense on deep neural networks,

    X. Zhang, X. Zheng, and W. Mao, “Adversarial perturbation defense on deep neural networks,” ACM Computing Surveys (CSUR), vol. 54, no. 8, pp. 1–36, 2021

    2021

  12. [19]

    Interpreting adversarial examples in deep learning: A review,

    S. Han, C. Lin, C. Shen, Q. Wang, and X. Guan, “Interpreting adversarial examples in deep learning: A review,” ACM Computing Surveys, vol. 55, no. 14s, pp. 1–38, 2023

    2023

  13. [21]

    ” why should i trust you?

    M. T. Ribeiro, S. Singh, and C. Guestrin, “” why should i trust you?” explaining the predictions of any classifier,” in Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pp. 1135–1144, 2016

    2016

  14. [22]

    A unified approach to interpreting model predictions,

    S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” Advances in neural information processing systems, vol. 30, 2017

    2017

  15. [23]

    Learning important features through propagating activation differences,

    A. Shrikumar, P. Greenside, and A. Kundaje, “Learning important features through propagating activation differences,” in International conference on machine learning , pp. 3145–3153, PMLR, 2017

    2017

  16. [24]

    Axiomatic attribution for deep networks,

    M. Sundararajan, A. Taly, and Q. Yan, “Axiomatic attribution for deep networks,” in International conference on machine learning , pp. 3319– 3328, PMLR, 2017

    2017

  17. [25]

    Deep inside convolutional networks: Visualising image classification models and saliency maps,

    K. Simonyan, A. Vedaldi, and A. Zisserman, “Deep inside convolutional networks: Visualising image classification models and saliency maps,” arXiv preprint arXiv:1312.6034 , 2013

    2013 arXiv

  18. [26]

    Smoothgrad: removing noise by adding noise,

    D. Smilkov, N. Thorat, B. Kim, F. Vi ´egas, and M. Wattenberg, “Smoothgrad: removing noise by adding noise,” arXiv preprint arXiv:1706.03825, 2017

    2017 arXiv

  19. [27]

    Guided integrated gradients: An adaptive path method for removing noise,

    A. Kapishnikov, S. Venugopalan, B. Avci, B. Wedin, M. Terry, and T. Bolukbasi, “Guided integrated gradients: An adaptive path method for removing noise,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pp. 5050–5058, 2021

    2021

  20. [28]

    Improving performance of deep learning models with axiomatic attribution priors and expected gradients,

    G. Erion, J. D. Janizek, P. Sturmfels, S. M. Lundberg, and S.-I. Lee, “Improving performance of deep learning models with axiomatic attribution priors and expected gradients,” Nature machine intelligence , vol. 3, no. 7, pp. 620–631, 2021

    2021

  21. [29]

    Robust models are more interpretable because attributions look normal,

    Z. Wang, M. Fredrikson, and A. Datta, “Robust models are more interpretable because attributions look normal,” arXiv preprint arXiv:2103.11257, 2021

    2021 arXiv

  22. [30]

    Fast axiomatic attribution for neural networks,

    R. Hesse, S. Schaub-Meyer, and S. Roth, “Fast axiomatic attribution for neural networks,” Advances in Neural Information Processing Systems , vol. 34, pp. 19513–19524, 2021

    2021

  23. [31]

    Explaining deep neural network models with adversarial gradient integration,

    D. Pan, X. Li, and D. Zhu, “Explaining deep neural network models with adversarial gradient integration,” in Thirtieth International Joint Conference on Artificial Intelligence (IJCAI) , 2021

    2021

  24. [32]

    Mfaba: A more faithful and accelerated boundary- based attribution method for deep neural networks,

    Z. Zhu, H. Chen, J. Zhang, X. Wang, Z. Jin, M. Xue, D. Zhu, and K.-K. R. Choo, “Mfaba: A more faithful and accelerated boundary- based attribution method for deep neural networks,” arXiv preprint arXiv:2312.13630, 2023

    2023 arXiv

  25. [33]

    Iterative search attribution for deep neural networks,

    Z. Zhu, H. Chen, X. Wang, J. Zhang, Z. Jin, J. Xue, and J. Shen, “Iterative search attribution for deep neural networks,” in Forty-first International Conference on Machine Learning , 2024

    2024

  26. [34]

    Enhancing model inter- pretability with local attribution over global exploration,

    Z. Zhu, Z. Jin, J. Zhang, and H. Chen, “Enhancing model inter- pretability with local attribution over global exploration,” arXiv preprint arXiv:2408.07736, 2024

    2024 arXiv

  27. [35]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  28. [36]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp), pp. 39– 57, Ieee, 2017

    2017

  29. [37]

    Benchmarking transferable adversarial attacks.,

    Z. Jin, J. Zhang, Z. Zhu, and H. Chen, “Benchmarking transferable adversarial attacks.,” CoRR, 2024

    2024

  30. [38]

    Boost- ing adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boost- ing adversarial attacks with momentum,” in Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 9185–9193, 2018

    2018

  31. [39]

    Transferable adversarial attack for both vision transformers and convolutional networks via momentum integrated gradients,

    W. Ma, Y . Li, X. Jia, and W. Xu, “Transferable adversarial attack for both vision transformers and convolutional networks via momentum integrated gradients,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 4630–4639, 2023. 12

    2023

  32. [40]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2730–2739, 2019

    2019

  33. [41]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” arXiv preprint arXiv:1908.06281, 2019

    1908 arXiv

  34. [42]

    Evading defenses to transferable adversarial examples by translation-invariant attacks,

    Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to transferable adversarial examples by translation-invariant attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312–4321, 2019

    2019

  35. [43]

    Improving adversarial transferability via neuron attribution-based attacks,

    J. Zhang, W. Wu, J.-t. Huang, Y . Huang, W. Wang, Y . Su, and M. R. Lyu, “Improving adversarial transferability via neuron attribution-based attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 14993–15002, 2022

    2022

  36. [44]

    Structure invariant transformation for better adversarial transferability,

    X. Wang, Z. Zhang, and J. Zhang, “Structure invariant transformation for better adversarial transferability,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 4607–4619, 2023

    2023

  37. [45]

    Boosting adversarial transferability via gradient relevance attack,

    H. Zhu, Y . Ren, X. Sui, L. Yang, and W. Jiang, “Boosting adversarial transferability via gradient relevance attack,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 4741– 4750, 2023

    2023

  38. [46]

    Improving adversarial transferability via frequency-based stationary point search,

    Z. Zhu, H. Chen, J. Zhang, X. Wang, Z. Jin, Q. Lu, J. Shen, and K.- K. R. Choo, “Improving adversarial transferability via frequency-based stationary point search,” in Proceedings of the 32nd ACM International Conference on Information and Knowledge Management , pp. 3626– 3635, 2023

    2023

  39. [47]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security, pp. 99– 112, Chapman and Hall/CRC, 2018

    2018

  40. [48]

    Frequency domain model augmentation for adversarial attack,

    Y . Long, Q. Zhang, B. Zeng, L. Gao, X. Liu, J. Zhang, and J. Song, “Frequency domain model augmentation for adversarial attack,” in European Conference on Computer Vision, pp. 549–566, Springer, 2022

    2022

  41. [49]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition , pp. 248–255, Ieee, 2009

    2009

  42. [50]

    Rethinking the inception architecture for computer vision,

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” in Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 2818– 2826, 2016

    2016

  43. [51]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 770–778, 2016

    2016

  44. [52]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  45. [53]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020

    2010 arXiv

  46. [54]

    Rise: Randomized input sampling for explanation of black- box models,

    V . Petsiuk, “Rise: Randomized input sampling for explanation of black- box models,” arXiv preprint arXiv:1806.07421 , 2018

    2018 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.