CM-PGD: Adversarial Attacks by Concept-Based Explainable AI

In recent years, Explainable AI (XAI) has become increasingly critical, and research on XAI has progressed in various aspects, such as Learned Feature, Pixel Attribution, and Concept Detection in image classification. Among them, concept-based explanation is one of the major methods to understand the predictions by a neural network. In this paper, we combine concept-based explanation and adversarial attack together in order to optimize the process of direct adversarial attack. We first propose Concept Mask, which offers a way to explain the decisions of a model. Then, we propose a Concept Masked Projected Gradient Descent (CM-PGD) based attack, which can generate adversarial examples with fewer total pixel change size and fewer changed pixel count. Compared with Projected Gradient Descent (PGD) attack, CM-PGD can reduce 20%–50% total pixel change size and 20%–40% changed pixel count on average.