On the Effectiveness of Explanation-Aware Adversarial Training

With explanation-aware attacks the community has recently demonstrated the inherent lack of robustness of post-hoc XAI techniques, questioning the reliability of GradCAM and methods the like in practice.In this paper, we investigate if adversarial training, as the go-to defense against classical adversarial examples, is also able to defend against explanation-aware adversarial examples.To this end, we investigate the effectiveness of three adversarial-training techniques, dedicated explanation-aware extensions for each of them, and two existing defenses that share similarities with adversarial training under the hood.Surprisingly, we find that vanilla adversarial training is already very effective against explanation-aware adversarial examples, even outperforming dedicated defenses.However, all existing techniques also lower the clean accuracy by 5-22 percentage points.In addition, we provide an extensive transferability study of AT-based defenses across five different types of explanation-aware attacks and across different target explanations.Our findings suggest that AT-defenses transfer, meaning that defenders do not need to anticipate the exact attack scenario to apply adversarial training effectively, leveling the playing field in this regard. Index Terms-Explanation-Aware Attacks, XAI1.The selection of ATEX is motivated by its high variance in explanation forgeability, which ensures a representative distribution of samples across the robustness spectrum.