# A simple defense against adversarial attacks on heatmap explanations

arXiv: https://arxiv.org/abs/2007.06381 · HTML: https://mlsanity.com/paper/2007.06381/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Jul 2020.

## Built on by (most cited first, 23 of 23)

- [Adversarial attacks and defenses in explainable artificial intelligence: A survey](https://mlsanity.com/paper/2306.06123/) (2023)
- [Perturbing Inputs for Fragile Interpretations in Deep Natural Language Processing](https://mlsanity.com/paper/2108.04990/) (2021)
- [NoiseGrad: Enhancing Explanations by Introducing Stochasticity to Model Weights](https://mlsanity.com/paper/2106.10185/) (2021)
- [Robust Explanation Constraints for Neural Networks](https://mlsanity.com/paper/2212.08507/) (2022)
- [What Makes a Good Explanation?: A Harmonized View of Properties of Explanations](https://mlsanity.com/paper/2211.05667/) (2022)
- [Fooling Partial Dependence via Data Poisoning](https://mlsanity.com/paper/2105.12837/) (2021)
- [When and How to Fool Explainable Models (and Humans) with Adversarial Examples](https://mlsanity.com/paper/2107.01943/) (2021)
- [Analyzing Explainer Robustness via Probabilistic Lipschitzness of Prediction Functions](https://mlsanity.com/paper/2206.12481/) (2022)
- [Improving Attribution Methods by Learning Submodular Functions](https://mlsanity.com/paper/2104.09073/) (2021)
- [On the Robustness of Explanations of Deep Neural Network Models: A Survey](https://mlsanity.com/paper/2211.04780/) (2022)
- [When Can You Trust Your Explanations? A Robustness Analysis on Feature Importances](https://mlsanity.com/paper/2406.14349/) (2024)
- [Towards More Robust Interpretation via Local Gradient Alignment](https://mlsanity.com/paper/2211.15900/) (2022)
- [Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectors](https://mlsanity.com/paper/2406.15104/) (2024)
- [Axiomatic Explainer Globalness via Optimal Transport](https://mlsanity.com/paper/2411.01126/) (2024)
- [Resilience of Bayesian Layer-Wise Explanations under Adversarial Attacks](https://mlsanity.com/paper/2102.11010/) (2021)
- [Fidelity of Ensemble Aggregation for Saliency Map Explanations using Bayesian Optimization Techniques](https://mlsanity.com/paper/2207.01565/) (2022)
- [Provable Robust Saliency-based Explanations](https://mlsanity.com/paper/2212.14106/) (2022)
- [CNN-based explanation ensembling for dataset, representation and explanations evaluation](https://mlsanity.com/paper/2404.10387/) (2024)
- [Robust Ranking Explanations](https://mlsanity.com/paper/2307.04024/) (2023)
- [NormEnsembleXAI: Unveiling the Strengths and Weaknesses of XAI Ensemble Techniques](https://mlsanity.com/paper/2401.17200/) (2024)
- [Revealing Vulnerabilities of Neural Networks in Parameter Learning and Defense Against Explanation-Aware Backdoors](https://mlsanity.com/paper/2403.16569/) (2024)
- [The Anatomy of Adversarial Attacks: Concept-based XAI Dissection](https://mlsanity.com/paper/2403.16782/) (2024)
- [Impact of Adversarial Attacks on Deep Learning Model Explainability](https://mlsanity.com/paper/2412.11119/) (2024)

## Abstract (arXiv)

With machine learning models being used for more sensitive applications, we rely on interpretability methods to prove that no discriminating attributes were used for classification. A potential concern is the so-called "fair-washing" - manipulating a model such that the features used in reality are hidden and more innocuous features are shown to be important instead. In our work we present an effective defence against such adversarial attacks on neural networks. By a simple aggregation of multiple explanation methods, the network becomes robust against manipulation. This holds even when the attacker has exact knowledge of the model weights and the explanation methods used.