Understanding Audio Deep Learning Classifiers Through Adversarial Attacks and Interpretability
Year: 2023
Type: dissertation
Abstract: The rise of deep learning as an effective tool for classification tasks in the audio domain came at the cost of transparency in the model prediction process. Deep learning models have a lot of parameters and non-linearities which makes them much more difficult to interpret than classical machine learning algorithms such as Decision Trees and Logistic Regression. The benefit of having an interpretable model is that it is easier to understand the strengths and weaknesses of the model and it is easier to fix biases in the systems. This is especially important for machine learning models that are public facing and are used by a lot of people. Given that there a lot of audio classification models that are deployed in public settings such as music tagging and sound event classification, the aim of this thesis is to understand the decision making process of machine learning models for these tasks. While the field of interpretable machine learning (IML) or explainable AI (XAI) has been around for a few years, most of the focus is on domains such as computer vision, natural language processing and tabular data. The domain of the data changes how the model is interpreted so while the core algorithms can be transferred from other domains to the audio domain, the method of analysis needs to be developed specifically for audio classification models. There is some work in the audio domain with interpretability methods such as LIME and feature inversion, however there is so much left to be explored. In this thesis, the analysis of deep learning models is split into two methods, adversarial attacks and gradient-based interpretability. Adversarial attacks are algorithms that perturb the input to a model in order to fool it, it is typically used to analyse security concerns of deep learning models. Gradient-based interpretability methods are computed using the gradient of the output of the model with respect to the input to identify regions of the input that were important for the model prediction, it is typically used as a visualisation tool. The common thread between adversarial attacks and gradient-based interpretability is that they both rely on the backpropagation algorithm. In this thesis the adversarial attacks research was done for the task of sound event classification. Sound event classification aims to predict a single target, given an audio file from categories such as Bus, coughing, violin etc. Adversarial attacks were used for two purposes, the first was to understand the threat that adversarial attacks pose to existing sound event classification systems and the second part is to discover interesting behaviour of deep learning models in response to adversarial attacks. For the first part, the research showed that it is possible to generate powerful adversarial attacks for a model in ideal conditions but, with simulations of the real world the adversarial attacks fail to be a threat. In the process a lot of interesting behaviours from the models were unconvered mostly around unique label behaviour. The gradient-based interpretability methods were evaluated on singing voice detection and music tagging. Loss gradients and saliency maps are the methods investigated. Loss gradients are generated by computing the gradient of the output of the loss function with respect to the input and saliency maps are calculated by computing the gradient of the output layer with respect to the input. The aim was to perform a thorough quantitative evaluation of Saliency maps and Loss gradients to verify if they were actually highlighting features that were important for the model to make a prediction. The core of the evaluation revolved around generating masks from the interpretability method and masking out a percentage of the input. Then, by observing changes in the performance of the input, the effectiveness of the interpretability method is analysed. The results showed how setting different variables in the interpretability method affects the masks generated and that by using the ground truth and keeping the signs of the gradients creates the most effective masks. This thesis continues progress into understanding deep learning models for audio classification models. By laying the foundations for adversarial attacks and gradient-based interpretability in the audio domain, future work can build off of this foundation and establish standards for interpretability in audio classification tasks.
Author: SUBRAMANIAN, V
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7006584081