💻 computer science

Adversarial Evasion Attacks on Computer Vision using SHAP Values

This paper proposes a white-box adversarial evasion attack on computer vision models that leverages SHAP values to quantify input significance, demonstrating its superior robustness over the Fast Gradient Sign Method in generating imperceptible misclassifications, particularly in gradient-hiding scenarios.

Original authors: Frank Mollard, Marcus Becker, Florian Roehrbein

Published 2026-04-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Frank Mollard, Marcus Becker, Florian Roehrbein

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Hacking the "Eye" of AI

Imagine you have built a super-smart robot that can look at a picture and tell you if it's a cat or a dog. You think it's perfect. But this paper reveals a scary secret: you can trick this robot into seeing a cat as a dog (or vice versa) by changing the picture just a tiny bit—so tiny that humans can't even see the difference.

This is called an Adversarial Evasion Attack. It's like a magician's sleight of hand for computers. The paper introduces a new, more powerful way to do this trick using something called SHAP values.

The Old Way: The "Blind" Hammer (FGSM)

Before this paper, the most famous way to trick these robots was a method called FGSM (Fast Gradient Sign Method).

The Analogy:
Imagine the robot is a student taking a test. The teacher (the algorithm) grades the test based on how far off the answer is.

FGSM is like a student who doesn't understand why they got a question wrong. They just look at the grade, see it's wrong, and blindly push the answer in the opposite direction.
They use a "hammer" approach: they hit every single pixel in the image with the same amount of force, regardless of whether that pixel actually matters.
The Problem: Sometimes the robot gets confused and starts thinking more confidently about the wrong answer. It's like hitting a wall with a hammer; sometimes the wall just gets stronger. This is called "gradient masking."

The New Way: The "Surgeon's Scalpel" (SHAP Attack)

The authors of this paper propose a smarter way using SHAP values.

What is SHAP?
Think of SHAP as a magnifying glass that explains exactly which parts of the picture convinced the robot to make its decision.

If the robot sees a picture of a cat, SHAP highlights the whiskers and the ears in Red (saying, "These parts made us think 'Cat'!").
It highlights the background in Blue (saying, "This part actually argues against it being a cat").
It ignores the parts that don't matter.

The Analogy:
Instead of hitting the whole image with a hammer, the SHAP Attack is like a surgeon.

The surgeon looks at the "Red" areas (the parts the robot loves) and the "Blue" areas (the parts the robot hates).
They gently tweak only those specific pixels to make them "neutral."
They turn the "Cat" evidence into "I don't know" evidence.

Why is this better?

Precision: It doesn't waste energy on pixels that don't matter.
Stealth: Because it only changes the important parts slightly, the image still looks exactly the same to a human eye.
Effectiveness: The paper found that this method tricks the robot much more often than the "blind hammer" method. In tests with human faces, the old method failed 31% of the time, while the new SHAP method succeeded 98% of the time.

The "Butterfly" Secret

The researchers noticed something fascinating when they looked at thousands of images.

Pixels with very bright or very dark values usually have a strong influence on the robot's decision.
Pixels with "middle-of-the-road" values (like a medium grey) have almost zero influence.

The Strategy:
The SHAP attack tries to push the "important" pixels into that "middle-of-the-road" zone.

Imagine the robot is a judge. The SHAP attack takes the evidence the judge relies on and turns it into "meh" evidence.
When all the strong evidence is neutralized, the robot gets confused. It stops being sure it's a cat, and suddenly, it might decide it's a dog.

Why Should We Care?

The authors aren't trying to break the internet; they are trying to fix it.

The Danger: If hackers can trick self-driving cars (making them think a stop sign is a speed limit sign) or medical scanners (missing a tumor), that's dangerous.
The Solution: By showing exactly how these attacks work, security experts can build "immune systems" for AI. They can train robots to look at the whole picture, not just a few specific pixels, making them harder to trick.

The Catch (The "Fine Print")

There is one downside to this new method.

It's expensive. Calculating SHAP values is like doing a massive math puzzle for every single pixel. It requires a lot of computing power (supercomputers).
It needs access. To do this, the attacker needs to know exactly how the robot's brain is built (a "white-box" attack). If the robot is a secret black box, this is harder to do.

Summary

This paper shows that while we have been using a "sledgehammer" to trick AI, we can now use a "scalpel" (SHAP values) to do it much more effectively. This is a wake-up call: our AI models are currently too focused on specific details, and we need to make them smarter and more robust before they are used in critical real-world situations.

1. Problem Statement

The paper addresses the vulnerability of deep learning computer vision models to adversarial evasion attacks. These attacks involve introducing imperceptible perturbations to input data during the inference phase to deceive the model into misclassification or reducing its output confidence.

The Threat: While these perturbations are invisible to the human eye, they can completely undermine the reliability of AI systems used in critical applications.
Limitations of Existing Methods: The authors highlight that the most common white-box attack, the Fast Gradient Sign Method (FGSM) (and its iterative variants), relies on the gradient of the loss function. This approach has two main weaknesses:
1. It assumes a uniform magnitude ( $\epsilon$ ) for all weights, ignoring the varying significance of individual pixels.
2. It is susceptible to gradient masking (where gradients become uninformative, vanishing, or scattered), leading to inconsistent attack success rates and sometimes even increasing model confidence instead of decreasing it.

2. Methodology

The authors propose a novel white-box attack strategy that replaces gradient-based optimization with SHAP (SHapley Additive exPlanations) values.

Core Concept

Instead of using the gradient of the loss function, the attack leverages SHAP values to quantify the marginal contribution of each input pixel to the model's final prediction.

SHAP Logic: SHAP values are derived from cooperative game theory (Shapley values). They calculate the average marginal contribution of a feature (pixel) across all possible subsets of features.
The "Butterfly" Pattern: Through analysis of four different datasets (Animal Faces, Cats/Dogs, MNIST, Human Faces), the authors observed a consistent pattern: SHAP values tend to be near zero for pixel intensities in a "neutral" range (e.g., around 0.3–0.4 on a 0–1 scale). Pixels with values far from this neutral zone (very dark or very bright) exert the strongest positive or negative influence on the classification.

The Attack Algorithm

The proposed attack aims to neutralize the influence of significant pixels by shifting them toward the "neutral" SHAP region.

Identify Influential Pixels: Calculate SHAP values ( $\phi$ ) for the input image.
Thresholding: Select pixels where the absolute SHAP value exceeds a threshold ( $v$ ), typically set to $2\sigma_\phi$ (two standard deviations of SHAP values).
Perturbation: Modify the pixel value ( $x$ $x$ ) to move it toward the neutral zone (where $\phi \approx 0$ $ϕ \approx 0$ ).
- If the pixel value is high ( $x \geq 1-h$ ) and has a strong positive influence, decrease it.
- If the pixel value is low ( $x \leq h$ ) and has a strong negative influence, increase it.
- The magnitude of the shift is determined by the SHAP value itself ( $\epsilon \cdot |\phi|$ ), rather than a fixed scalar.

Formula:
$x' = x + \epsilon \cdot \begin{cases} -|\phi| & \text{if } x \geq 1-h \land V \\ |\phi| & \text{if } x \leq h \land V \end{cases}$
Where $V$ is the condition that the pixel has a significant influence ( $|\phi| \geq v$ ).

3. Key Contributions

Novel Attack Vector: Introduction of a white-box adversarial attack that utilizes SHAP values instead of gradients, offering a fundamentally different approach to manipulating model inputs.
Robustness against Gradient Masking: The method demonstrates superior performance in scenarios where gradient-based attacks fail due to "gradient masking" or non-smooth loss functions.
Dual Nature of Explainability: The paper highlights the dual-use nature of Explainable AI (XAI) tools. While SHAP is designed to make models transparent, the authors prove it can be weaponized to identify and exploit the specific features a model relies on most heavily.
Empirical Validation: The method was tested across diverse architectures (CNNs, EfficientNetB7) and datasets (MNIST, Animal Faces, Human Faces), showing consistent results regardless of model depth or data complexity.

4. Results

The authors compared their SHAP attack against the iterative FGSM (Kurakin et al., 2017) across four datasets.

Dataset	Model Accuracy	FGSM Misclassification Rate	SHAP Attack Misclassification Rate
Animal Faces	99.5%	52%	73%
Cats & Dogs (Filtered)	98%	98%	89%
MNIST	99%	34%	60%
Woman & Man Faces	97%	69%	98%

Visual Imperceptibility: Both attacks remained visually imperceptible to humans at their respective optimal $\epsilon$ values.
Consistency: FGSM showed high variability; in some cases (e.g., MNIST), it failed to reduce confidence effectively. SHAP attacks provided stable and high misclassification rates across all datasets.
Mechanism of Success: SHAP attacks succeeded by targeting the most influential pixels and neutralizing them, whereas FGSM applied uniform noise based on gradient signs, which often failed to disrupt the model's decision boundary effectively when gradients were misleading.

5. Significance and Conclusion

Vulnerability Confirmation: The study proves that deep learning models are highly susceptible to attacks that specifically target the "decision-making" features identified by explainability tools.
Defense Implications: The findings suggest that current defenses based on gradient masking or smoothing may be insufficient. Future defenses must ensure that model decisions are not overly reliant on a small subset of specific pixels (over-reliance on local features) and that models generalize better across the entire image.
Computational Trade-off: The authors acknowledge a limitation: SHAP attacks are computationally expensive compared to FGSM. Calculating SHAP values requires significant resources, especially for high-resolution images and complex models, which may limit the practicality of this attack in real-time, large-scale scenarios without high-performance computing.

Final Takeaway: The paper establishes SHAP values not just as a tool for understanding AI, but as a potent weapon for adversarial attacks, revealing that models can be more effectively deceived by neutralizing their most "confident" features than by simply following the gradient of the loss function.