Composite Explanation-Aware Attacks

While modern deep learning models have long been considered black boxes, recent advances in explainable machine learning now shed light on their internals. However, explanation methods can be deceived just as the machine learning model itself using adversarial examples and neural backdoors, giving rise to explanation-aware attacks. Such attacks can simultaneously manipulate a classifier's prediction and its explanations. We argue that separating these two objectives into different attack vectors can be beneficial and present so-called composite explanation-aware attacks. We manipulate the classifier's prediction via a neural backdoor and its explanation using an adversarial example, allowing us to disguise the back-door individually per sample. This dichotomy allows composite explanation-aware attacks to (a) regard attack concealment as optional if input manipulations are difficult due to input filters, constraint feature sets, or low complexity of the targeted model and (b) establish the backdoor via mere data poisoning only, without assuming control over the entire learning process. Composite explanation-aware attacks represent a new attack with a threat model neglected by existing works so far. In our evaluation, we demonstrate their effectiveness against popular explanation methods, Gradients and GradCAM, and extensively investigate the relation of both components of our attack.