When Interpretability Becomes a Liability: Adversarial Attacks on CBM Concept Layers
2026-05-25 • Machine Learning
Machine LearningCryptography and SecurityComputer Vision and Pattern Recognition
AI summaryⓘ
The authors study Concept Bottleneck Models (CBMs), which are designed to be easy to understand by using human-friendly concepts inside the model. They discovered that these concept layers create a new weak point where small changes to the input can trick the model into wrong decisions. To measure and fix this problem, they created a method called SPECTRA that makes the concept layer much harder to fool without losing accuracy. Their work highlights a new type of attack specific to models that explain themselves using concepts.
Concept Bottleneck Modelsinterpretable machine learningadversarial attackssemantic representationrobustnessconcept activationsperturbationCUB-200-2011 datasetregularizationSPECTRA
Authors
Aditya Sridhar
Abstract
Concept Bottleneck Models (CBMs) have emerged as a cornerstone approach for interpretable machine learning, providing human-understandable intermediate representations through explicit concept activations. However, this interpretability fundamentally introduces a critical, previously unexplored attack surface: the concept bottleneck layer itself. We present a comprehensive, systematic study of concept-level adversarial vulnerabilities in CBMs, revealing that targeted, minimal perturbations operating on input pixels can induce catastrophic misclassification by manipulating semantic representations. We develop a rigorous theoretical framework to quantify concept-space robustness, establishing novel metrics that expose the vulnerability landscape of these architectures. Our extensive analysis on the CUB-200-2011 dataset demonstrates that standard CBMs exhibit severe susceptibility to concept-level manipulation. To address this critical weakness, we introduce SPECTRA (Semantic Perturbation-based Concept Training for Robustness against Attacks), a principled stability regularization defense. SPECTRA effectively hardens the semantic representation space, increasing the minimal perturbation norm required for a successful attack from 0.46 to over 4,200, rendering targeted concept manipulation computationally prohibitive. Furthermore, SPECTRA preserves baseline classification accuracy to within 2.2%. By establishing concept-level attacks as a fundamentally distinct threat model, this work opens a new research frontier at the intersection of interpretable machine learning and adversarial robustness.