Certifiably robust interpretation
Interpretation maps of convolutional neural networks having certifiable robustness using Rényi differential privacy are provided. In one aspect, a method for generating an interpretation map includes: adding generalized Gaussian noise to an image x to obtain T noisy images, wherein the generalized Gaussian noise constitutes perturbations to the image x; providing the T noisy images as input to a convolutional neural network; calculating T noisy interpretations of output from the convolutional neural network corresponding to the T noisy images; re-scaling the T noisy interpretations using a scoring vector υ to obtain T re-scaled noisy interpretations; and generating the interpretation map using the T re-scaled noisy interpretations, wherein the interpretation map is robust against the perturbations.
1. A method for generating an interpretation map, the method comprising:
adding generalized Gaussian noise to an image x to obtain T noisy images, wherein the generalized Gaussian noise constitutes perturbations to the image x;
providing the T noisy images as input to a convolutional neural network;
calculating T noisy interpretations of output from the convolutional neural network corresponding to the T noisy images, wherein the T noisy interpretations comprise images that illustrate how important each pixel in the image x is for classification by the convolutional neural network;
re-scaling the T noisy interpretations using a scoring vector υ to obtain T re-scaled noisy interpretations; and
generating the interpretation map using the T re-scaled noisy interpretations, wherein the interpretation map is robust against the perturbations, and wherein the perturbations are constrained by an d -norm for any d≥1, including d=∞.
2. The method of claim 1 , further comprising:
independently repeating the adding T times on the input image x to obtain the T noisy images.
3. The method of claim 2 , wherein T is from about 20 to about 200 and ranges therebetween.
4. The method of claim 1 , further comprising:
adding the generalized Gaussian noise to each pixel of the input image x.
5. The method of claim 1 , further comprising:
drawing the generalized Gaussian noise from a generalized normal distribution (μ,σ,b).
6. The method of claim 3 , wherein a random variable X follows the generalized normal distribution (μ,σ,b) if its probability density function is:
b
·
Γ
(
3
/
b
)
Γ
(
1
/
b
)
2
σΓ
(
1
/
b
)
·
exp
[
-
(
Γ
(
3
/
b
)
Γ
(
1
/
b
)
·
❘
"\[LeftBracketingBar]"
x
-
μ
❘
"\[RightBracketingBar]"
σ
)
b
]
,
wherein μ correspond to an expectation of X, σ correspond to a standard deviation of X and b correspond to a shape factor of X.
7. The method of claim 1 , wherein the scoring vector υ=(υ 1 , . . . , υ n ), and wherein the method further comprises:
setting υ 1 ≥ . . . ≥υ n for the scoring vector υ.
8. The method of claim 1 , wherein the T noisy interpretations are calculated using an interpreter g.
9. The method of claim 8 , wherein the T noisy interpretations comprise saliency maps.
10. A system for generating an interpretation map, the system comprising:
a convolutional neural network; and
an apparatus comprising a processor, connected to a memory, operable to:
add generalized Gaussian noise to an image x to obtain T noisy images, wherein the generalized Gaussian noise constitutes perturbations to the image x;
provide the T noisy images as input to the convolutional neural network;
calculate T noisy interpretations of output from the convolutional neural network corresponding to the T noisy images, wherein the T noisy interpretations comprise images that illustrate how important each pixel in the image x is for classification by the convolutional neural network;
re-scale the T noisy interpretations using a scoring vector u to obtain T re-scaled noisy interpretations; and
generate the interpretation map using the T re-scaled noisy interpretations, wherein the interpretation map is robust against the perturbations, and wherein the perturbations are constrained by an d -norm for any d≥1, including d=∞.
11. The system of claim 10 , wherein the processor is further operable to:
independently repeat adding the generalized Gaussian noise T times to the input image x to obtain the T noisy images.
12. The system of claim 10 , wherein the processor is further operable to:
add the generalized Gaussian noise to each pixel of the input image x.
13. The system of claim 10 , wherein the processor is further operable to:
draw the generalized Gaussian noise from a generalized normal distribution (μ,σ,b).
14. The system of claim 13 , wherein a random variable X follows the generalized normal distribution (μ,σ,b) if its probability density function is:
b
·
Γ
(
3
/
b
)
Γ
(
1
/
b
)
2
σΓ
(
1
/
b
)
·
exp
[
-
(
Γ
(
3
/
b
)
Γ
(
1
/
b
)
·
❘
"\[LeftBracketingBar]"
x
-
μ
❘
"\[RightBracketingBar]"
σ
)
b
]
,
wherein μ correspond to an expectation of X, σ correspond to a standard deviation of X and b correspond to a shape factor of X.
15. The system of claim 10 , wherein the scoring vector υ=(υ 1 , . . . , υ n ), and wherein the processor is further operable to:
set υ 1 ≥ . . . ≥υ n for the scoring vector υ.
16. The system of claim 10 , wherein the T noisy interpretations are calculated using an interpreter g.
17. A non-transitory computer program product for generating an interpretation map, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:
add generalized Gaussian noise to an image x to obtain T noisy images, wherein the generalized Gaussian noise constitutes perturbations to the image x;
provide the T noisy images as input to a convolutional neural network;
calculate T noisy interpretations of output from the convolutional neural network corresponding to the T noisy images, wherein the T noisy interpretations comprise images that illustrate how important each pixel in the image x is for classification by the convolutional neural network;
re-scale the T noisy interpretations using a scoring vector υ to obtain T re-scaled noisy interpretations; and
generate the interpretation map using the T re-scaled noisy interpretations, wherein the interpretation map is robust against the perturbations, and wherein the perturbations are constrained by an d -norm for any d≥1, including d=∞.
18. The non-transitory computer program product of claim 17 , wherein the program instructions further cause the computer to:
draw the generalized Gaussian noise from a generalized normal distribution (μ,σ,b).
19. The non-transitory computer program product of claim 18 , wherein a random variable X follows the generalized normal distribution (μ,σ,b) if its probability density function is:
b
·
Γ
(
3
/
b
)
Γ
(
1
/
b
)
2
σΓ
(
1
/
b
)
·
exp
[
-
(
Γ
(
3
/
b
)
Γ
(
1
/
b
)
·
❘
"\[LeftBracketingBar]"
x
-
μ
❘
"\[RightBracketingBar]"
σ
)
b
]
,
wherein μ correspond to an expectation of X, σ correspond to a standard deviation of X and b correspond to a shape factor of X.
20. The non-transitory computer program product of claim 19 , wherein the scoring vector υ=(υ 1 , . . . , υ n ), and wherein the program instructions further cause the computer to:
set υ 1 ≥ . . . ≥υ n for the scoring vector υ.