Root cause analysis of vulnerability of neural networks to adversarial examples

An apparatus for protecting a machine learning model, comprising:

• a memory;
• and
• at least one processor coupled to the memory, the processor being operative:
• to determine concept-level interpretability of respective units within the model;
• to determine sensitivity of the respective units within the model to an adversarial attack;
• to identify units within the model which are both interpretable and sensitive to the adversarial attack;
• and
• to enhance defense against the adversarial attack by masking at least a portion of the units identified as both interpretable and sensitive to the adversarial attack.

A computer program product comprising a non-transitory machine-readable storage medium having machine-readable program code embodied therewith, said machine-readable program code comprising machine-readable program code configured:

• to determine concept-level interpretability of respective units within the model;
• to determine sensitivity of the respective units within the model to an adversarial attack;
• to identify units within the model which are both interpretable and sensitive to the adversarial attack;
• and
• to enhance defense against the adversarial attack by masking at least a portion of the units identified as both interpretable and sensitive to the adversarial attack.