DETERMINING A PERTURBATION MASK FOR A CLASSIFICATION MODEL

A system (100) is disclosed for determining, for an input instance to a classification model, a mask indicating perturbations that disturb a classification of the input instance by the classification model. A classification model determines classifications of input instances of a certain type. A generative model generates synthetic instances of the type from latent space representations. Given an input instance, its classification according to the classification model, and a latent space representation that lets the generative model approximate the input instance, the mask is determined. The mask indicates perturbations to the latent space representation for the input instance and is determined based on a classification score of the classification model for a perturbed input instance. The perturbed instance is determined using the mask by masking the latent space representation with the mask and generating the perturbed input instance from the masked latent space representation using the generative model.