Explainable Adversarial Attacks on Coarse-to-Fine Classifiers
^††thanks: This work was supported by NSF under Awards CCF-2106339 and DMS-2304489, and DARPA under Agreement No. HR0011-24-9-0427.

Consider a pre-trained hierarchical classifier structured in a C2F hierarchy, where an initial coarse-level classifier provides a broad classification, which is then further refined by subsequent finer classifiers.

Each data point $x\in X\subseteq\mathbb{R}^{N}$ is assigned a coarse label $i\in[M]$, where $M$ denotes the total number of coarse labels and $[M]:=\{1,2,\dots,M\}$. Additionally, there is a fine label $l\in[M_{i}]$, where $M_{i}$ represents the number of fine classes associated with the $i$-th coarse label. Let $C:\mathbb{R}^{N}\rightarrow[M]$ be the coarse classifier function that assigns $x$ to a coarse class. For classifier $C$, we assume the existence of $M$ discriminant functionals, $C_{i}(x):\mathbb{R}^{N}\rightarrow\mathbb{R}$ for $i\in[M]$, which are used for coarse classification such that

For each coarse label $i\in[M]$, let $F^{i}$ represent the $i$-th fine classifier function. Similar to the formulation in (1), we define $F^{i}_{j}(x):\mathbb{R}^{N}\rightarrow\mathbb{R}$ for $j\in[M_{i}]$ as the discriminant functions used to determine the finer class of coarse label $i$, such that

Layer-wise Relevance Propagation (LRP) is a technique to explain the decisions made by neural networks, determining the contribution of each parts of the input data to the final decision [14]. To interpret the network’s prediction for a specific class $c$, we propagate relevance scores $R$ from the output layer $L$ back to the input layer, using the activations and network weights. For the output layer, relevance is defined by:

where $\delta_{i,c}$ is the Kronecker delta, which selects the relevance for class $c$ by setting $R^{L}_{i}=1$ when $i=c$ and $R^{L}_{i}=0$ otherwise. The relevance scores are then propagated back through all layers except the first using the z+ rule [15]:

where $(W^{l})^{+}$ denotes the positive weights of the $l$-th layer and $a^{l}$ is the activation vector of the $l$-th layer. Finally, the relevance scores at the input layer are calculated using the $z\beta$ rule [15]:

where $l_{i}$ and $h_{i}$ are the lower and upper bounds of the input domain, respectively. For simplicity, we henceforth use the notation $LRP_{G}(x;c)$ to indicate the relevance scores at the input layer of a classifier $G$, for an input image $x$ and label $c$.

In this attack, the goal is to generate imperceptible additive perturbations to fool the coarse-level classification, satisfying the requirement $C(x+\eta)\neq C(x)$. To formalize this, let $r_{\text{org}}=C(x)$ and $r_{\text{adv}}=C(x+\eta)$ represent the original and adversarial coarse labels, respectively, where these labels correspond to the coarse categories with the highest prediction probability for the input image $x$ and the perturbed image $x+\eta$. The attacker selects $r_{\text{adv}}$ as

the coarse label with the second-highest probability after $r_{\text{org}}$.

To achieve the objective of redirecting the coarse classifier’s attention from $r_{\text{org}}$ to $r_{\text{adv}}$, we define a loss function based on the $\ell_{p}$-norm of the positive and negative relevance scores produced by LRP with respect to these labels. The loss function is designed to decrease all positive relevance scores and increase all negative relevance scores of the heatmap $LRP_{C}(x+\eta;r_{\text{org}})$, while simultaneously increasing all positive relevance scores and decreasing all negative relevance scores of $LRP_{C}(x+\eta;r_{\text{adv}})$. Thus, we define the loss function for the LRP Coarse-Level Attack (LRPC):

Here, we set $p=1$, calculating the $\ell_{1}$-norm of the heatmaps.

In this scenario, the goal is to create perturbations that alter the finer classification while keeping the coarse prediction unchanged. Specifically, we aim to ensure that $C(x+\eta)=C(x)=r_{\text{org}}$, while $F^{r_{\text{org}}}(x)\neq F^{r_{\text{org}}}(x+\eta)$. The coarse label is first determined and used as a prerequisite to identify the corresponding fine label. Similar to the coarse level attack, the attacker selects $f_{\text{adv}}$ as:

where $f_{\text{org}}:=F^{r_{\text{org}}}(x)$ and $f_{\text{adv}}$ is the fine label with the second-highest probability.

We apply the same approach at the fine level by defining the loss function similarly, based on the $\ell_{1}$-norm of the positive relevances produced by LRP for the $r_{\text{org}}$-th fine classifier, $F^{\text{org}}$, with respect to the fine-level labels. Thus, the loss function for the LRP Fine-Level Attack (LRPF) is defined as:

Algorithm 1 describes our approach. The perturbation is initialized to zero at the beginning of the attack. At each iteration, the perturbation $\eta$ is clipped by $\min(\epsilon,\eta)$, where $\epsilon$ is the maximum permissible $l_{\infty}$-norm. $\eta$ is then added to the benign images to create perturbed images, which are clipped again to maintain pixel values within the range $[0,255]$. Both benign and perturbed images are fed into the pre-trained model to obtain the original and adversarial labels. The adversarial labels could change with each iteration, as the goal is to generate small perturbations that progressively move the perturbed image toward the nearest labels at each step. The gradient-descent algorithm is used to minimize the loss function as defined in (8) and (11) and optimize the perturbation $\eta$ via the loss gradients $\frac{\partial\mathcal{L}_{C}}{\partial\eta}$ and $\frac{\partial\mathcal{L}_{F}}{\partial\eta}$ for LRPC and LRPF, respectively. Depending on the attack type, the optimization process terminates either when the coarse label changes (LRPC) or when the fine label changes while maintaining coarse label consistency (LRPF), ensuring effective perturbation generation.