Crushing the Evidence: A Dual-Penalty Evasion Framework for Fooling White-Box Explainable AI Auditors

2026-08-01

AI Summary

This work addresses the vulnerability of existing explainable AI methods—such as LIME and SHAP—to adversarial attacks, which adversaries can exploit to conceal model biases or backdoors. The paper proposes a white-box gradient regularization evasion framework that, for the first time, embeds evasion logic directly into model parameters. By integrating a dual-penalty mechanism during training, the approach continuously suppresses gradients associated with trigger features, enabling the model to maintain accurate predictions while deceiving explanation systems. Notably, this method generates smooth, anomaly-free predictions without relying on out-of-distribution detection bypasses, thereby effectively evading conditional anomaly detection defenses. Evaluated on four benchmark tabular datasets, the technique reduces target feature attributions to below 0.02 and achieves attack success rates exceeding 90%, substantially outperforming current state-of-the-art approaches.

Abstract

Post-hoc model explainers such as LIME, SHAP, and Integrated Gradients are widely deployed to audit models in high-stakes sensitive domains, including finance, healthcare, and social welfare. This ensures the model's transparency and acceptability. However, a few studies have examined potential attacks in the explainability pipeline. Adversaries can attempt to conceal algorithmic biases or backdoors using adversarial explanation attacks. These attacks have relied on scaffolding out-of-distribution (OOD) detectors that toggle predictions when queried by an explainer. Consequently, defenses have been developed to successfully neutralize these black-box attacks by identifying their anomalous perturbation footprints. In this paper, we demonstrate a critical vulnerability by introducing a more potent white-box, gradient-regularized evasion attack framework. By employing a continuous-embedding dual-penalty framework, we directly penalize trigger feature gradients during training on in-distribution data. Since our approach embeds the evasion logic natively into the model parameters, without relying on OOD scaffolding wrappers, it generates smooth, in-distribution predictions that leave no anomaly footprint. Empirical evaluations across four benchmark tabular datasets (COMPAS, German Credit, IEEE-CIS, and Communities & Crime) confirm that our method systematically crushes target feature attribution to near-zero (<0.02), maintains >90% Attack Success Rates, and fundamentally bypasses Conditional Anomaly Detection.

Problem

• Explainable AI
• Adversarial Attacks
• White-Box Evasion
• Model Auditing
• Feature Attribution

Innovation

• white-box evasion
• gradient regularization
• dual-penalty framework
• explainable AI attack
• in-distribution stealth