Interpretable but Fragile? Robustness of Concept Bottlenecks under Geometric-Semantic Perturbations
Published in NeurIPS 2026, 2026
This paper provides a framework to analyze the robustness of concept-based models. Read more
Publications
SL-CBM: Enhancing Concept Bottleneck Models with Semantic Locality for Better Interpretability
Published in AAAI 2026, 2026
This paper is about how to make concept bottleneck models have better semantic localization of the concepts. Read more
Recommended citation: Zhang, H., Cheng, L., Wen, R., Zhang, Y., Zhang, L., & Hermanns, H. (2026, March). Sl-cbm: Enhancing concept bottleneck models with semantic locality for better interpretability. In Proceedings of the AAAI Conference on Artificial Intelligence (Vol. 40, No. 44, pp. 38093-38101). https://ojs.aaai.org/index.php/AAAI/article/download/41147/45108
Revisiting Transferable Adversarial Images: Systemization, Evaluation, and New Insights
Published in IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025
This paper is about systematized evaluation of transferable adversarial robustness on image classification. Read more
Recommended citation: Zhao, Z., Zhang, H., Li, R., Sicre, R., Amsaleg, L., Backes, M., ... & Shen, C. (2025). Revisiting Transferable Adversarial Images: Systemization, Evaluation, and New Insights. IEEE Transactions on Pattern Analysis and Machine Intelligence. https://ieeexplore.ieee.org/abstract/document/11164808/
Saliency Maps Give a False Sense of Explanability to Image Classifiers: An Empirical Evaluation across Methods and Metrics
Published in The 16th Asian Conference on Machine Learning (Conference Track), 2024
This paper is about an empirical evaluation across saliency methods and corresponding explainable metrics. Read more
Recommended citation: Zhang, H., Figueroa, F. T., & Hermanns, H. (2024). Saliency Maps Give a False Sense of Explanability to Image Classifiers: An Empirical Evaluation across Methods and Metrics. In The 16th Asian Conference on Machine Learning (Conference Track). https://raw.githubusercontent.com/mlresearch/v260/main/assets/zhang25a/zhang25a.pdf
Eidos: Efficient, Imperceptible Adversarial 3D Point Clouds
Published in International Symposium on Dependable Software Engineering: Theories, Tools, and Applications (SETTA 2024), 2024
This paper is about adversarial robustness on 3D point clouds. Read more
Recommended citation: Zhang, H., Cheng, L., He, Q., Huang, W., Li, R., Sicre, R., ... & Zhang, L. (2024, November). Eidos: Efficient, imperceptible adversarial 3d point clouds. In International Symposium on Dependable Software Engineering: Theories, Tools, and Applications (pp. 310-326). Singapore: Springer Nature Singapore. https://link.springer.com/chapter/10.1007/978-981-96-0602-3_17
Opti-CAM: Optimizing saliency maps for interpretability
Published in Computer Vision and Image Understanding, 2024
This paper is about how to optimize saliency maps for interpretability. Read more
Recommended citation: Zhang, H., Torres, F., Sicre, R., Avrithis, Y., & Ayache, S. (2024). Opti-CAM: Optimizing saliency maps for interpretability. Computer Vision and Image Understanding, 248, 104101. https://www.sciencedirect.com/science/article/pii/S1077314224001826
Traceability and accountability by construction
Published in International Symposium on Leveraging Applications of Formal Methods, 2024
This paper is about how to build an accountable and traceable AI system through cryptographic signatures. Read more
Recommended citation: Wenzel, J., Köhl, M. A., Sterz, S., Zhang, H., Schmidt, A., Fetzer, C., & Hermanns, H. (2024, October). Traceability and accountability by construction. In International Symposium on Leveraging Applications of Formal Methods (pp. 258-280). Cham: Springer Nature Switzerland. https://link.springer.com/chapter/10.1007/978-3-031-75387-9_16
IPA-NeRF: Illusory Poisoning Attack Against Neural Radiance Fields
Published in Proceedings of ECAI 2024, 2024
This paper is about adversarial poisoning attack on NeRF. Read more
Recommended citation: Jiang, W., Zhang, H., Zhao, S., Guo, Z., & Wang, H. (2024). Ipa-nerf: Illusory poisoning attack against neural radiance fields. arXiv preprint arXiv:2407.11921. https://arxiv.org/pdf/2407.11921
NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack
Published in Proceeding of the 38th AAAI Conference on Artificial Intelligence, 2024
This paper is about adversarial robustness on NeRF. Read more
Recommended citation: Jiang, W., Zhang, H., Wang, X., Guo, Z., & Wang, H. (2024, March). Nerfail: Neural radiance fields-based multiview adversarial attack. In Proceedings of the AAAI Conference on Artificial Intelligence (Vol. 38, No. 19, pp. 21197-21205). https://ojs.aaai.org/index.php/AAAI/article/view/30113
Smooth adversarial examples
Published in EURASIP Journal on Information Security, 2020
This paper is about how to generate smooth adversarial perturbations. Read more
Recommended citation: Zhang, H., Avrithis, Y., Furon, T., & Amsaleg, L. (2020). Smooth adversarial examples. EURASIP Journal on Information Security, 2020, 1-12. https://link.springer.com/article/10.1186/s13635-020-00112-z
Walking on the edge: Fast, low-distortion adversarial examples
Published in IEEE Transactions on Information Forensics and Security, 2020
This paper is about how to generate adversarial perturbation efficiently. Read more
Recommended citation: Zhang, H., Avrithis, Y., Furon, T., & Amsaleg, L. (2020). Walking on the edge: Fast, low-distortion adversarial examples. IEEE Transactions on Information Forensics and Security, 16, 701-713. https://ieeexplore.ieee.org/abstract/document/9186644