mlsanityData to 14 Oct 2026

XRand: Differentially Private Defense against Explanation-Guided Attacks

arXiv 2212.04454 ↗First posted 8 Dec 2022cs.LG cs.CRcited by 11

Not on the map. Why?

Abstract (arXiv)

Recent development in the field of explainable artificial intelligence (XAI) has helped improve trust in Machine-Learning-as-a-Service (MLaaS) systems, in which an explanation is provided together with the model prediction in response to each query. However, XAI also opens a door for adversaries to gain insights into the black-box models in MLaaS, thereby making the models more vulnerable to several attacks. For example, feature-based explanations (e.g., SHAP) could expose the top important features that a black-box model focuses on. Such disclosure has been exploited to craft effective backdoor triggers against malware classifiers. To address this trade-off, we introduce a new concept of achieving local differential privacy (LDP) in the explanations, and from that we establish a defense, called XRand, against such attacks. We show that our mechanism restricts the information that the adversary can learn about the top important features, while maintaining the faithfulness of the explanations.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Builds on 35 of its 59 references that are in the map. First posted on arXiv 8 Dec 2022.

Builds on

35 of 59 references.

References · 35

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  3. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  4. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,070
  5. 2017Axiomatic Attribution for Deep Networkscited by 3,384
  6. 2017Learning Important Features Through Propagating Activation Differencescited by 1,458
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  8. 2019GNNExplainer: Generating Explanations for Graph Neural Networkscited by 737
  9. 2016CVXPY: A Python-Embedded Modeling Language for Convex Optimizationcited by 641
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  11. 2018Spectral Signatures in Backdoor Attackscited by 484
  12. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
23 more
  1. 2017Interpretation of Neural Networks is Fragilecited by 444
  2. 2019Fooling LIME and SHAP: Adversarial Attacks on Post hoc Explanation Methodscited by 443
  3. 2014RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Responsecited by 272
  4. 2020PGM-Explainer: Probabilistic Graphical Model Explanations for Graph Neural Networkscited by 211
  5. 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 165
  6. 2019Fooling Neural Network Interpretations via Adversarial Model Manipulationcited by 112
  7. 2016Minimax Optimal Procedures for Locally Private Estimationcited by 107
  8. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 94
  9. 2018Model Reconstruction from Model Explanationscited by 86
  10. 2020Local Differential Privacy based Federated Learning for Internet of Thingscited by 75
  11. 2018Interpretable Deep Learning under Firecited by 74
  12. 2020LDP-FL: Practical Private Aggregation in Federated Learning with Local Differential Privacycited by 64
  13. 2016Discrete Distribution Estimation under Local Privacycited by 59
  14. 2019Collecting and Analyzing Multidimensional Data with Local Differential Privacycited by 49
  15. 2021Exploiting Explanations for Model Inversion Attackscited by 49
  16. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  17. 2019Local Differential Privacy for Deep Learningcited by 46
  18. 2015Local, Private, Efficient Protocols for Succinct Histogramscited by 36
  19. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  20. 2020Towards Differentially Private Text Representationscited by 29
  21. 2018Hadamard Response: Estimating Distributions Privately, Efficiently, and with Little Communicationcited by 26
  22. 2019Heterogeneous Gaussian Mechanism: Preserving Differential Privacy in Deep Learning with Provable Robustnesscited by 15
  23. 2019Improving Utility and Security of the Shuffler-based Differential Privacycited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 3; 2025: 3; 2026: 2.

11 papers.

  1. 2024A Survey of Privacy-Preserving Model Explanations: Privacy Risks, Attacks, and Countermeasurescited by 6
  2. 2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
  3. 2023Privacy-Preserving Algorithmic Recoursecited by 5
  4. 2023SoK: Taming the Triangle -- On the Interplays between Fairness, Interpretability and Privacy in Machine Learningcited by 4
  5. 2025Privacy Risks and Preservation Methods in Explainable Artificial Intelligence: A Scoping Reviewcited by 2
  6. 2024Contrastive Explainable Clustering with Differential Privacycited by 1
  7. 2025Models That Are Interpretable But Not Transparentcited by 1
  8. 2025Privacy-Preserving Explainable AIoT Application via SHAP Entropy Regularizationcited by 1
  9. 2026NOIR: Privacy-Preserving Generation of Code with Open-Source LLMscited by 1
  10. 2024XSub: Explanation-Driven Adversarial Attack against Blackbox Classifiers via Feature Substitutioncited by 0
  11. 2026SoK: Privacy Attacks on Machine Learning via Explainable AIcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Explainable but Vulnerable: Adversarial Attacks on XAI Explanation in Cybersecurity Applications
  2. 2024Knowledge Distillation-Based Model Extraction Attack using GAN-based Private Counterfactual Explanations
  3. 2026Explanations Leak: Membership Inference with Differential Privacy and Active Learning Defense
  4. 2025PrivateXR: Defending Privacy Attacks in Extended Reality Through Explainable AI-Guided Differential Privacy
  5. 2024Revealing Vulnerabilities of Neural Networks in Parameter Learning and Defense Against Explanation-Aware Backdoors
  6. 2024Towards a Game-theoretic Understanding of Explanation-based Membership Inference Attacks
  7. 2022Backdooring Explainable Machine Learning
  8. 2023AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Models