{"id":"5d7f8c3a-ec99-4283-90f6-c6f033213969","arxiv_id":"1908.08413","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Guided Backpropagation maps contain class-relevant value differences, and subtracting channel-wise normalized maps makes adversarial misclassifications explainable.","lead":"This paper proposes a small modification to the Guided Backpropagation explanation method so that the heatmap changes when an adversarial attack fools a neural network. The authors claim the modified maps show which pixels actually support the wrong decision.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Enhanced GuidedBP's class-discriminative claim is untested: Figure 4 lacks a null baseline and the channel-wise difference may be normalization artifacts.","rationale":"The reader's weakest assumption is exactly the load-bearing step of the paper: that after channel-wise energy normalization, the difference between two GuidedBP saliency maps isolates input evidence for the change in logit ranking, rather than normalization artifacts or noise. I agree and make the concern concrete by pointing to the only quantitative experiment (Figure 4), which lacks any null control. The accuracy-recovery metric can be satisfied by any perturbation that disrupts the adversarial pattern, so without a random-pixel or random-class baseline the observed recovery does not demonstrate class-discriminative content. Section 2.1 establishes only that average saliency values differ between classes, which is a necessary but not sufficient condition for the central claim. The method is simple, parameter-free, and reproducible in principle, which counts in its favor, but the state-of-the-art assertion is further weakened by the absence of a comparison to the authors' own contrastive backpropagation [14] and by the lack of statistical reporting. Since the concern is substantive but testable, the reader's conditional verdict remains appropriate.","tokens_in":5765,"tokens_out":5405,"duration_ms":53059,"concrete_test":"Run the Figure 4 recovery experiment with two control saliency maps: (a) a per-image random permutation of the proposed enhanced GuidedBP map, and (b) the same channel-wise energy-normalized difference but with the second map computed for a randomly chosen class that is neither the true nor the adversarial target class. Perturb the same percentages of top pixels for each control on the same C&W adversary images, average over at least 1000 images, and report the mean and standard deviation of recovery accuracy. If either control achieves comparable recovery to the proposed method, the conclusion that the difference map isolates logit-ranking evidence is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 2.2 asserts that \"relatively larger saliency values in SMs correspond to the input features that support a specific class\" and that subtracting channel-wise L1-normalized GuidedBP maps isolates the evidence responsible for the change in logit ranking. This is not validated. Section 2.1 only shows that average saliency values of two class maps differ; it does not show that the difference is class-relevant rather than a scale or normalization artifact. The quantitative evaluation (Section 3, Figure 4) perturbs the highest-saliency pixels of adversary images and reports accuracy recovery; this metric is confounded, because many arbitrary perturbations can destroy adversarial noise and partially restore accuracy. No null control (e.g., random pixels, or a difference with a third class) is run, and no comparison to contrastive backpropagation [14] is made. Thus the paper's claim that the enhanced map explains the misclassification by finding decision-relevant evidence is not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that, contrary to prior claims that Guided Backpropagation (GuidedBP) merely performs partial image recovery, GuidedBP saliency maps do contain class-discriminative information. The authors support this with an analysis of pairs of GuidedBP maps for different classes, showing that the maps differ in saliency values even when their filtering effects are similar. They then propose an 'enhanced GuidedBP' that normalizes the maps channel-wise by energy and subtracts the maps of two classes, keeping only positive differences, in order to highlight features that support one class over another. The method is applied to explaining adversarial misclassifications on ImageNet with VGG16, and the paper reports qualitative examples and a quantitative accuracy-recovery experiment in which pixels ranked highly by the enhanced map are perturbed to partially restore classification accuracy. The central claims are that GuidedBP saliency maps contain class-discriminative information and that enhanced GuidedBP achieves state-of-the-art performance in explaining adversarial classifications.","tokens_in":5928,"tokens_out":2293,"duration_ms":24607,"significance":"If the central claims are established, the paper would make a useful contribution to the interpretability literature: it would soften the strong negative result that GuidedBP is purely image recovery, and it would offer a simple, parameter-free contrastive extension that responds to adversarial misclassifications. The proposed energy-normalized difference of GuidedBP maps is elegant and computationally cheap, and the paper identifies a concrete limitation of standard saliency methods for adversarial inputs. The analysis is falsifiable and does not rely on fitted parameters, which is a strength. However, the significance is currently limited by the evaluation: the quantitative evidence is thin, lacks a null control, and does not include comparisons with the most relevant prior contrastive method, reference [14], despite the 'state-of-the-art' claim. The paper's core idea is plausible, but its empirical support is not yet commensurate with the strength of the claims.","major_comments":[{"comment":"The central assumption that 'relatively larger saliency values in SMs correspond to the input features that support a specific class' is asserted but not validated. The channel-wise energy-normalized difference is then taken to isolate the evidence responsible for the change in logit ranking. This needs a direct test: for example, compare the discriminative pixels obtained by subtracting the k-th and m-th class maps against a random-pixel baseline, or against the difference of a map of a third unrelated class, to show that the resulting localization is class-specific rather than a normalization artifact. Without such a control, the enhanced map could be dominated by scale differences or noise.","section":"Section 2.2"},{"comment":"The quantitative evaluation of the enhanced GuidedBP is insufficient to support the central claim. Figure 4 reports accuracy recovery after perturbing the highest-saliency pixels, but this metric is confounded: many arbitrary perturbations can destroy the adversarial perturbation and partially restore accuracy. There is no random-pixel baseline, no perturbation of a fixed arbitrary region, no error bars, and no statement of the number of images or attack success rate. The reader cannot tell whether the recovery is due to the saliency map identifying decision-relevant pixels or simply to the destruction of the attack. These controls are necessary before the accuracy-recovery experiment can be read as evidence for explanation quality.","section":"Section 3, Figure 4"},{"comment":"The paper claims 'state-of-the-art performance to explain adversary classifications,' but no comparison to existing explanation methods is provided in the quantitative experiment. In particular, the method is closely related to contrastive backpropagation [14], yet Figure 4 contains no comparison to [14] or to any other attribution method (e.g., Grad-CAM, DeepLIFT, or Integrated Gradients). Without such a comparison, the state-of-the-art claim is unsupported. The qualitative figures (Figures 3 and 5) show only a few examples and do not establish systematic superiority.","section":"Section 3 and Abstract"},{"comment":"The stated limitation that 'the attack methods are not aware of our method' is important and should be discussed in the evaluation itself, not only at the end. In particular, the accuracy-recovery experiment in Section 3 uses attacks (FGSM, BIM, C&W) that are agnostic to the explanation method, but the paper does not examine whether the proposed saliency map would remain meaningful under an adaptive adversary that optimizes the perturbation with knowledge of the explanation method. This is a scope restriction that should be made explicit when interpreting the results.","section":"Section 4"}],"minor_comments":[{"comment":"There is a typo: 'GuiedBP' should be 'GuidedBP'.","section":"Section 2.1"},{"comment":"The text contains 'RuLU' in the description of GuidedBP; this should be 'ReLU'.","section":"Section 2"},{"comment":"The phrase 'the perturbation with SMs of our enhanced GuidedBP can recovery the score better' uses 'recovery' as a verb; it should be 'recover'.","section":"Section 3"},{"comment":"The qualitative description mentions 'e.g., sheepland dog', which appears to be a typo for 'sheep and dog'.","section":"Section 3, Figure 3"},{"comment":"The analysis of Avg-Diff in Figure 1b would be easier to interpret if the number of image pairs and the distribution of scores were described; currently only a statement that scores vary from 0 to 0.8 is given.","section":"Section 2.1"},{"comment":"Reference [14] is the authors' own prior work on contrastive backpropagation; given the close relationship to the proposed method, a substantive discussion of differences and an empirical comparison would be appropriate.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"This is a workshop-style paper with an interesting and simple idea. The main barrier to acceptance is that the empirical evaluation is not yet rigorous enough for the strength of the claims. The absence of a null baseline, of error bars, and of a comparison to the most relevant prior work ([14]) are the key issues. The authors should be encouraged to add those experiments, but the central idea is worth pursuing."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know two things about this paper. First, it contains a real empirical observation: GuidedBP saliency maps for different classes have almost identical filtering effects but measurably different average saliency values. That directly challenges the earlier claim that GuidedBP is just partial image recovery, and it is worth taking seriously. Second, the enhancement built on that observation—channel-wise energy-normalized subtraction of two class maps—is simple and parameter-free, but the paper does not actually show that the subtraction isolates decision-relevant evidence.\n\nThe best part is Section 2.1. The Sim-Ratio and Avg-Diff analysis cleanly separates shape (filtering effect) from magnitude, and the finding contradicts [15-17] in a testable way. The proposed method has no learned parameters, and the idea of explaining the difference between logits rather than the logits themselves is conceptually reasonable. The authors also state their main limitation plainly in Section 4: the method assumes the attack is not aware of the explanation procedure, and generalization depends on similar filtering effects in the baseline method. That honesty counts.\n\nThe soft spots are concentrated in the evaluation. Figure 4 reports accuracy recovery after perturbing the top-saliency pixels, but there is no random-pixel baseline, no error bars, and no sample size. Without a null control, the metric is confounded—many arbitrary perturbations can destroy adversarial noise and partially restore accuracy. The paper also never compares to the authors' own contrastive backpropagation [14], which is the most closely related method; the channel-wise subtraction is conceptually close to it. The qualitative examples are suggestive but not systematic. So the central claim—that enhanced GuidedBP explains the misclassification by finding the pixels that support the wrong class—is not yet established.\n\nThe paper is honest, clearly written, and the core observation is worth a careful look. But as a full contribution it is an incremental idea with a thin evaluation. I would send it to peer review for a workshop-length venue, mainly because the Section 2.1 finding deserves scrutiny and could be developed. I would not cite it as a demonstrated method yet.","headline":"A genuinely interesting observation about GuidedBP saliency values, but the paper's own evaluation is too thin to support the state-of-the-art claim it makes.","tokens_in":6404,"tokens_out":1771,"would_cite":false,"duration_ms":17754,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Guided Backpropagation saliency maps retain class-discriminative information, and subtracting channel-normalized maps of two classes turns that signal into explanations of adversarial misclassifications.","keywords":["Saliency maps","Explainable AI","Adversarial attacks","Guided backpropagation","Contrastive explanation","Class-discriminative saliency","Neural network interpretability","Logit ranking"],"falsifier":"Compute enhanced GuidedBP maps on attacked images, then repeat the same procedure with randomly paired classes or with the two class labels swapped, and compare the resulting maps' ability to recover classification accuracy under pixel perturbation (the Figure 4 test). If the random-pair maps are statistically as effective as the proposed class-pair maps, the explanatory content would be shown to be an artifact of the normalization-subtraction operation rather than class-specific evidence.","tokens_in":5574,"feed_emoji":"🎯","tokens_out":7994,"duration_ms":75408,"temperature":0.7,"pith_summary":"This paper tries to establish that Guided Backpropagation saliency maps contain information specific to the class being explained, despite published claims that the method merely recovers parts of the input image. The authors show that maps for two different classes share almost the same binary pattern, the filtering effect, but differ in their actual saliency values, and that value difference is what earlier critiques missed because normalizing maps before visualization hides it. They then propose an enhanced GuidedBP: normalize each color channel of two class maps by its total saliency energy, subtract one map from the other, and keep the positive residue. On adversarial images, the enhanced maps react to the misclassification, highlighting features that support the wrongly predicted class rather than the ground-truth object, while standard saliency maps look nearly identical for clean and attacked inputs. If the claim holds, a simple contrastive subtraction turns a criticized saliency method into a usable tool for explaining adversarial decisions.","feed_headline":"A simple map subtraction exposes the evidence behind adversarial attacks","feed_subtitle":"GuidedBP maps hide class-specific signal; channel-wise subtraction of two classes pulls it out.","key_machinery":"The load-bearing object is the channel-wise energy-normalized contrast between two GuidedBP saliency maps. A GuidedBP map is obtained by propagating the gradient of a class score back to the input while masking out negative gradients at ReLU units; the paper defines the filtering effect as the binary pattern of positive entries of a map. The enhancement step takes, for each color channel, the positive part of $\\frac{s_k^{(r)}}{|s_k^{(r)}|_1} - \\frac{s_m^{(r)}}{|s_m^{(r)}|_1}$, where $s_k$ and $s_m$ are the maps for two classes and the denominator is the channel's total absolute saliency. This subtraction isolates input features whose saliency is relatively larger for one class, on the premise that relatively large saliency values mark features supporting that class. All claims about explaining adversarial classifications rest on this contrast operation.","core_discovery":"GuidedBP maps for different classes are not redundant. For a pair of classes, the binarized support sets of the maps are almost identical, but the unnormalized saliency values differ noticeably; the paper's numerical analysis measures this with a similarity ratio near 1 for filtering effects and an average-difference score that varies up to 0.8. The class-discriminative signal therefore lives in the magnitudes, not the pattern. To pull it out, the paper normalizes each RGB channel of a map by the channel's sum of absolute values and subtracts the two class maps channel-wise, taking the positive part, so the result marks input features that support one class relative to the other. Because adversarial attacks change the ranking of pre-softmax logits, the enhanced map explains the misclassification by showing where the evidence for the new class comes from, and it visibly changes between clean and attacked images, whereas other tested saliency methods produce nearly the same maps.","pith_inferences":["The contrastive map is effectively attributing the difference between two logits rather than a single logit; in principle the same operation could explain any pairwise decision boundary, including non-adversarial confusions between similar classes, not just attacked inputs.","A natural stress test the paper does not run is a randomization control: subtracting the maps of two randomly paired classes, or subtracting the map of a class from itself under independent noise, should produce no explanatory signal; if such control maps recover accuracy as well as the proposed ones, the claimed class evidence would be called into question.","Since the authors note the method assumes attacks are not aware of it, an adversary who knows the explanation procedure could in principle craft perturbations that change the logit ranking while leaving the contrastive map pointing at innocuous regions, so explanation robustness under adaptive attacks is a direct open extension.","The recovered-accuracy result suggests a practical use beyond explanation: the discriminative pixels could seed a training regularizer that stabilizes logit rankings, which the authors mention as future work but do not test."],"forward_implications":["GuidedBP cannot be reduced to partial image recovery: its class-discriminative information, although hidden by visualization normalization, is present in the saliency values.","A saliency method that explains adversarial classifications should change when the network's decision changes; enhanced GuidedBP meets that criterion while standard GuidedBP and other methods do not.","Perturbing the pixels identified by enhanced GuidedBP on attacked images recovers classification accuracy better than perturbing pixels from other saliency methods, indicating the identified pixels carry decision-relevant evidence.","The same channel-wise energy-normalized subtraction can be applied to any saliency method whose maps for different classes share similar filtering effects, and its usefulness is governed by how well that similarity holds.","If the explanation of an adversarial misclassification points to class-irrelevant image regions, that provides evidence the network focused on wrong features rather than on the object's discriminative parts."],"supporting_citations":[{"why":"Introduces Guided Backpropagation, the saliency method the paper enhances.","marker":"[3]"},{"why":"Faults GuidedBP maps for not being class-discriminative, the position the paper tests and rejects.","marker":"[15]"},{"why":"Sanity-check result that GuidedBP maps are insensitive to model or class; the paper's value-difference analysis responds to it.","marker":"[16]"},{"why":"Proves GuidedBP is partial image recovery, the claim contradicted by class-discriminative value differences.","marker":"[17]"},{"why":"Supplies the theoretical result that different-class maps share filtering effects, the pivot for locating discriminative information in values.","marker":"[18]"},{"why":"Provides the FGSM attack used to generate adversary images in the experiments.","marker":"[19]"},{"why":"Supplies the VGG16 architecture used in all experiments.","marker":"[21]"},{"why":"Supplies the PASCAL VOC dataset and multi-label setup for quantifying filtering-effect similarity and value differences.","marker":"[22]"},{"why":"Provides the BIM attack used for adversary-image experiments.","marker":"[23]"},{"why":"Supplies the C&W attack used for the quantitative recovery evaluation via pixel perturbation.","marker":"[24]"}],"fun_headline_variants":["Subtract class maps to expose adversarial evidence","Channel subtraction reveals class-specific attack signal","Enhanced GuidedBP maps clarify adversarial misclassifications","Simple subtraction boosts saliency for attack explanations"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method rests on the premise that after channel-wise energy normalization, the positive difference between two class maps marks exactly the input features that support one class over the other, rather than normalization artifacts or noise; the paper asserts this premise rather than validating it against a random baseline.","fun_headline_variants_meta":{"raw":{"variants":["Subtract class maps to expose adversarial evidence","Channel subtraction reveals class-specific attack signal","Enhanced GuidedBP maps clarify adversarial misclassifications","Simple subtraction boosts saliency for attack explanations"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000167,"raw_usage":{"total_tokens":1211,"prompt_tokens":853,"completion_tokens":358,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":469,"completion_tokens_details":{"reasoning_tokens":303}},"tokens_in":469,"tokens_out":358,"duration_ms":3700,"temperature":1.0,"reasoning_tokens":303,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T11:39:26.814217+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute enhanced GuidedBP maps on attacked images, then repeat the same procedure with randomly paired classes or with the two class labels swapped, and compare the resulting maps' ability to recover classification accuracy under pixel perturbation (the Figure 4 test). If the random-pair maps are statistically as effective as the proposed class-pair maps, the explanatory content would be shown to be an artifact of the normalization-subtraction operation rather than class-specific evidence.","supporting_citations":[{"cited_title":"Riedmiller","cited_arxiv_id":null,"evidence_quote":"Introduces Guided Backpropagation, the saliency method the paper enhances."},{"cited_title":"Salient deconvolutional networks","cited_arxiv_id":null,"evidence_quote":"Faults GuidedBP maps for not being class-discriminative, the position the paper tests and rejects."},{"cited_title":"Sanity checks for saliency maps","cited_arxiv_id":null,"evidence_quote":"Sanity-check result that GuidedBP maps are insensitive to model or class; the paper's value-difference analysis responds to it."},{"cited_title":"A theoretical explanation for perplexing behaviors of backpropagation-based visualizations","cited_arxiv_id":null,"evidence_quote":"Proves GuidedBP is partial image recovery, the claim contradicted by class-discriminative value differences."},{"cited_title":"On the robustness of interpretability methods","cited_arxiv_id":null,"evidence_quote":"Supplies the theoretical result that different-class maps share filtering effects, the pivot for locating discriminative information in values."}],"review_version":1}