Research On The Visual Interpretability Technology Of Deep Learning For Image Recognition

Interpretability is one of the outstanding problems facing the current deep learning field.Compared with traditional machine learning methods,the "end-to-end" characteristics and distributed feature representation of the deep neural network make it difficult for people to understand its working mechanism and decision basis,hindering its performance improvement and applications in risk-sensitive areas.Among them,the convolutional neural network(CNN)is the most commonly used network structure in image recognition.Improving the interpretability of the CNN model is of great significance for its further research and application.To this end,for the CNN model in the image recognition field,this dissertation studies the interpretability method and its attack and defense methods based on saliency map visualization,focusing on how to improve the interpretation effect of the CNN model decision-making and the reliability of the interpretation from two aspects of normal scenario and adversarial scenario.The purpose is to intuitively explain the internal representation and decision-making of the CNN model through visualization,and ensure the effectiveness of the interpretation results in the adversarial scenario.The main work of this dissertation is as follows:First,aiming at the problem of the lack of unified and intuitive comparison of existing CNN interpretability methods based on saliency map visualization,this dissertation analyzes the algorithm principle of mainstream visualization methods,classifies them,summarizes their characteristics and compares their effects,which realizes the evaluation and comparison under the unified standard.First,the mainstream visualization methods are summarized into five categories: perturbation-based method,backpropagation-based method,class activation mapping,activation maximization,and other methods.The typical methods in each category are introduced in detail.Then,six characteristics of the existing methods are summarized,and each characteristic is deeply analyzed.Finally,more than ten typical methods are selected to compare their visualization effects under the same input and post-processing method.This part of work provides guidance for users to choose the appropriate method in applications and also lays the foundation for the follow-up study of this dissertation.Second,aiming at the problem that existing class activation mapping methods only focus on the channel features of feature map and fail to make full use of the spatial distribution features,a spatial-channel attention-based class activation mapping method is proposed,which uses the attention mechanism to adjust the focus on the feature distribution,so as to generate a better class activation map to explain the correlation between CNN prediction and input features.Specifically,a CNN visualization framework based on class activation mapping is designed.Then,based on the framework,the concept of class activation weight is proposed for the first time,and the relationship between two kinds of class activation weight is derived.Finally,using the idea of attention mechanism,the two kinds of class activation weights are regarded as attention weights.Combined with the derived linear correspondence,a class activation mapping based on attention is proposed.In the experiment,the class activation weight and class activation map are visualized and analyzed on four typical CNN structures.The results show that there is a linear relationship between the two class activation weights,which is consistent with the theoretical derivation.Compared with GAP-CAM(global average pooling based class activation mapping)and Grad-CAM(gradient-weighted CAM),the class activation map visualization map of the proposed method has certain advantages.Third,aiming at the problems of coarseness,noise and not fine-grained of the saliency map generated by existing methods,a fine-grained saliency map visualization method based on discriminative deconvolution is proposed.By fusing feature map information layer by layer in the process of discriminative deconvolution,the clarity of the saliency map is improved while upsampling to achieve fine-grained saliency map visualization effect.Specifically,the method first uses the improved Grad-CAM to generate the initial class activation map,which is used as the starting point of the deconvolution process.Then,two deconvolution branches are used to transfer them to the input space layer by layer to obtain the fine-grained saliency map and class region mask.Among them,the fine-grained deconvolution branch fuses useful features from the feature map of each layer to improve the clarity of the saliency map layer by layer.Finally,the fine-grained saliency map and class region mask are fused to obtain the final saliency map.The experimental results show that the proposed method outperforms the existing seven typical visualization methods in qualitative and quantitative evaluation.Especially for small object images that are not well visualized by traditional methods,the fine-grained effect of the proposed method is more obvious than that of the traditional methods.In addition,the results of the weak-supervised instance segmentation experiment on simple background images show that the proposed method achieves a moderately effective segmentation effect and has a certain prospect in this field.Fourth,in the adversarial scenario,aiming at the problems of high attack cost and a single attack mode in existing saliency map attack methods,a saliency map attack method based on adversarial patch is proposed.By adding a specially designed adversarial patch on the input image to construct the adversarial image,the saliency map of the Grad-CAM can be changed without modifying the target model,which is easier to achieve the attack.Specifically,this method adds a constraint on the saliency map after the model's classification loss,which can optimize an adversarial patch to induce the saliency region of the saliency map to deviate to the patch region,so as to achieve the saliency map attack.At the same time,through the batch training and adding norm constraint on the perturbation,the generalization of the adversarial patch is improved,and the adversarial example can be generated.The experimental results show that the proposed method can effectively attack the saliency maps under different CNN structures and induce them to deviate to the specified region.It can also be used to attack the saliency maps of new images that have not been seen before and is suitable for different attack scenarios.Compared with the existing Grad-CAM saliency map attack methods based on model fine-tuning,this method does not need to modify the model weight.It can achieve the attack purpose more simply and effectively while maintaining the accuracy of the model classification.Fifth,in the adversarial scenario,aiming at the problems of saliency map abnormality and interpretation process failure caused by the attack of adversarial example on the visualization method,a defense method for saliency map adversarial example based on random perturbation is proposed.Through a simple input preprocessing strategy,the saliency map of the adversarial example can be restored to ensure the effectiveness of interpretation in the adversarial scenario.Specifically,before the adversarial example is input into the model and visualization method,the random noise that obeys the Gaussian distribution is added to it to offset the adversarial features through the noise perturbation,so as to realize the restoration of the saliency map of the adversarial example.In order to verify the effectiveness and versatility of the proposed method,extensive experiments are carried out on the ILSVRC 2012 dataset.The defense effect on the corresponding adversarial examples of the three class activation mapping methods and six backpropagation visualization methods are tested and compared.The results show that the proposed method can effectively restore the saliency map of adversarial example,and is suitable for those adversarial examples generated by various adversarial attack methods.Compared with the existing defense methods based on adversarial training,this method does not need to retrain the model,only needs to preprocess the input simply,and then follows the standard process to obtain an effective saliency map,which is more simple and easy to use in the real scene.