Accuracy is Not Enough: Poisoning Interpretability in Federated Learning via Color Skew
Not on the map. Why?
Abstract (arXiv)
As machine learning models are increasingly deployed in safety-critical domains, visual explanation techniques have become essential tools for supporting transparency. In this work, we reveal a new class of attacks that compromise model interpretability without affecting accuracy. Specifically, we show that small color perturbations applied by adversarial clients in a federated learning setting can shift a model's saliency maps away from semantically meaningful regions while keeping the prediction unchanged. The proposed saliency-aware attack framework, called Chromatic Perturbation Module, systematically crafts adversarial examples by altering the color contrast between foreground and background in a way that disrupts explanation fidelity. These perturbations accumulate across training rounds, poisoning the global model's internal feature attributions in a stealthy and persistent manner. Our findings challenge a common assumption in model auditing that correct predictions imply faithful explanations and demonstrate that interpretability itself can be an attack surface. We evaluate this vulnerability across multiple datasets and show that standard training pipelines are insufficient to detect or mitigate explanation degradation, especially in the federated learning setting, where subtle color perturbations are harder to discern. Our attack reduces peak activation overlap in Grad-CAM explanations by up to 35% while preserving classification accuracy above 96% on all evaluated datasets.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 32 of its 45 references that are in the map. First posted on arXiv 17 Nov 2025.
Builds on
32 of 45 references.
References · 32
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
- 2016Densely Connected Convolutional Networkscited by 6,720
- 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,845
- 2017Axiomatic Attribution for Deep Networkscited by 3,384
- 2019Advances and Open Problems in Federated Learningcited by 3,046
- 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,371
- 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,538
- 2017Learning Important Features Through Propagating Activation Differencescited by 1,458
- 2017Towards A Rigorous Science of Interpretable Machine Learningcited by 1,416
- 2018Sanity Checks for Saliency Mapscited by 1,156
20 more
- 2017Grad-CAM++: Improved Visual Explanations for Deep Convolutional Networkscited by 939
- 2018How To Backdoor Federated Learningcited by 765
- 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
- 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
- 2017Interpretation of Neural Networks is Fragilecited by 444
- 2020iDLG: Improved Deep Leakage from Gradientscited by 382
- 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
- 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
- 2017The (Un)reliability of saliency methodscited by 333
- 2019Robust Aggregation for Federated Learningcited by 317
- 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
- 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 288
- 2017Explainable Artificial Intelligence: Understanding, Visualizing and Interpreting Deep Learning Modelscited by 206
- 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
- 2019Fooling Neural Network Interpretations via Adversarial Model Manipulationcited by 112
- 2018Semantic Adversarial Examplescited by 86
- 2019Robust Attribution Regularizationcited by 47
- 2019How to Manipulate CNNs to Make Them Lie: the GradCAM Casecited by 12
- 2022Generalizing Adversarial Explanations with Grad-CAMcited by 9
- 2022On the Robustness of Explanations of Deep Neural Network Models: A Surveycited by 5
Built on by
Not cited yet.