  Attribution maps are popular tools for explaining neural networks
predictions. By assigning an importance value to each input dimension that
represents its impact towards the outcome, they give an intuitive explanation
of the decision process. However, recent work has discovered vulnerability of
these maps to imperceptible adversarial changes, which can prove critical in
safety-relevant domains such as healthcare. Therefore, we define a novel
generic framework for attributional robustness (FAR) as general problem
formulation for training models with robust attributions. This framework
consist of a generic regularization term and training objective that minimize
the maximal dissimilarity of attribution maps in a local neighbourhood of the
input. We show that FAR is a generalized, less constrained formulation of
currently existing training methods. We then propose two new instantiations of
this framework, AAT and AdvAAT, that directly optimize for both robust
attributions and predictions. Experiments performed on widely used vision
datasets show that our methods perform better or comparably to current ones in
terms of attributional robustness while being more generally applicable. We
finally show that our methods mitigate undesired dependencies between
attributional robustness and some training and estimation parameters, which
seem to critically affect other competitor methods.
