Visual explanations aim at providing an understanding of the inner behavior of convolutional neural networks. Naturally, it is necessary to explore whether these methods themselves are reasonable and reliable. In this paper, we focus on Class Activation Mapping (CAM), a type of attractive explanations that has been widely applied to model diagnosis and weakly supervised tasks. Our contribution is two-fold. First, we identify an important but neglected issue that affects the reliability of CAM results: there is a misalignment between the effective receptive field and the implicit receptive field, where the former is determined by the model and the input, and the latter is determined by the upsampling function in CAM. Occlusion experiments are designed to empirically testify to its existence. Second, based on this finding, an adversarial marginal attack is proposed to fool the CAM-based method and the CNN model simultaneously. Experimental results demonstrate that the provided saliency map can be completely changed to another shape by only perturbing the area with 1-pixel width. The prototype code of the method is now available at https://github.com/xpf/CAM-Adversarial-Marginal-Attack.

视觉解释旨在提供对卷积神经网络内部行为的理解。自然，有必要探讨这些方法本身是否合理可靠。在本文中，我们关注类激活映射（CAM），这是一种广泛应用于模型诊断和弱监督任务的有吸引​​力的解释。我们的贡献是双重的。首先，我们确定了一个影响 CAM 结果可靠性的重要但被忽视的问题：有效感受野和隐含感受野之间存在错位，前者由模型和输入决定，后者由CAM中的上采样功能。遮挡实验旨在凭经验证明其存在。其次，基于这一发现，提出了一种对抗性边缘攻击来同时欺骗基于 CAM 的方法和 CNN 模型。实验结果表明，提供的显着图可以通过仅扰动 1 像素宽度的区域而完全改变为另一种形状。该方法的原型代码现在可在 https://github.com/xpf/CAM-Adversarial-Marginal-Attack 获得。