{"id":"7232bd3f-4bc3-491b-bb97-17f0361c982f","arxiv_id":"2411.14946","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A perturbation-based metric using FGSM flips of ±1/255 instead of zero-masking gives more consistent and monotonic evaluation of attribution maps across 15 CNN-dataset pairs, with SmoothGrad ranked first.","lead":"Attribution maps tell which pixels a CNN uses, but current tests for them (deletion and insertion) corrupt the image so much that the rankings become unreliable. This paper replaces the corruption with tiny adversarial pixel flips, arguing the new test is smoother, more consistent across models and datasets, and ranks SmoothGrad as the best map.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Perturb metric may be circular: its FGSM perturbation defines importance as gradient magnitude, so SmoothGrad's top ranking could be an artifact of gradient alignment rather than evidence of faithful attribution.","rationale":"The reader's conditional verdict is well founded, and the gradient-alignment premise is the most load-bearing issue. The metric's innovation is replacing zero-masking with FGSM perturbations, which genuinely reduces distribution shift and improves smoothness/monotonicity—those are real strengths. However, the perturbation is generated from the model gradient, so the optimal map under the metric is the gradient magnitude itself. Because SmoothGrad is a smoothed version of the gradient, its top ranking is unsurprising and partly tautological. This does not make the metric useless: local gradient sensitivity is a legitimate notion of importance, and the consistency and baseline checks are informative. But the paper's stronger claims—that the metric is the only contender to pass all sanity checks and that SmoothGrad is the best map currently available—require an independent justification that gradient magnitude is the correct ground truth, which is not provided. The proposed synthetic-map experiment would settle whether the metric merely measures gradient alignment. I therefore keep the reader's CONDITIONAL verdict rather than moving to accept or reject.","tokens_in":21435,"tokens_out":4746,"duration_ms":50472,"concrete_test":"Add two synthetic attribution maps to the benchmark: (1) M_grad = |∂L/∂X|, the raw gradient magnitude used implicitly by the FGSM perturbation, and (2) M_anti = -M_grad, plus a causal reference map such as a high-quality occlusion/RISE map or an oracle foreground mask on a dataset where object masks are decision-relevant. If Perturb AUC for M_grad is near the maximum and substantially exceeds the causal reference map, the metric is primarily rewarding gradient alignment. Also compute the rank correlation between each attribution map and |∂L/∂X|; if that correlation predicts Perturb AUC, the confound is confirmed. If instead the causal reference map outperforms M_grad, the concern is refuted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The metric constructs the perturbation as δ = ε·sign(∂L/∂X) (Section 3, FGSM). Starting from X+δ, restoring pixel i changes the target probability, to first order, by a term proportional to -ε·|∂L/∂X_i|. Hence the maximum-AUC restoration order for any image is descending |∂L/∂X_i|, and the score largely measures how well an attribution map reproduces the gradient-magnitude ranking. This is not an independent test of faithfulness: it defines the ground truth as the model's local gradient, which is exactly the quantity estimated by the gradient-based methods that top the ranking (Gradients, SmoothGrad, Integrated Gradients). The paper does not justify gradient magnitude as the correct notion of 'pixels the CNN relies on'; causal, counterfactual, or occlusion-based importance can diverge from it. A map that simply outputs |∂L/∂X|—or SmoothGrad's smoothed version—will score near-optimal by construction, making the headline 'SmoothGrad is best' and 'only contender passes all checks' largely a consequence of the metric's construction. The secondary issue of skipping unsuccessful attacks (Section 3, 'Other attacks') can bias the AUC if failure correlates with image difficulty, but the gradient-alignment issue alone is sufficient to weaken the central claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a new quantitative evaluation metric for attribution maps (AMs) in CNNs, called Perturb, which replaces the pixel-masking operations of deletion/insertion metrics with FGSM adversarial perturbations. Starting from a fully perturbed image, pixels are restored in the order determined by the attribution map, and the area under the target-class probability curve (AUC) is used as the score. The authors evaluate 16 attribution methods across 15 dataset-architecture combinations (three datasets, five CNN architectures) and report that their metric uniquely passes baseline sanity checks (uniform and Canny maps rank last), exhibits higher monotonicity and smoothness, and achieves higher average Kendall's tau consistency than deletion, insertion, and blurred-insertion metrics. They conclude that SmoothGrad is the best attribution map currently available. The paper argues that masking induces distribution shifts that render existing metrics unreliable, while their ±1 adversarial perturbations stay closer to the original image distribution.","tokens_in":21678,"tokens_out":6895,"duration_ms":67438,"significance":"The paper addresses a practically important problem: the lack of a reliable quantitative benchmark for comparing attribution maps. If the proposed metric is valid, it would offer a standardized way to rank explanation methods and to sanity-check newly proposed AMs. The empirical scope is a strength: 16 methods, 15 model-dataset pairs, multiple architectures, and the inclusion of baseline maps as sanity checks. The monotonicity and smoothness analyses are also useful and well-motivated. However, the central validity of the metric is questionable because the perturbation direction is defined by the sign of the model's loss gradient, which makes the metric essentially measure how well an attribution map reproduces the gradient-magnitude ranking. This circularity threatens the headline claim that SmoothGrad is the best map and that the metric is a more robust evaluation framework. The paper's contribution may be more defensible if reframed as a consistency and smoothness diagnostic for gradient-aligned maps rather than as a faithfulness test.","major_comments":[{"comment":"The construction of the metric makes the evaluation circular relative to the hypothesis being tested. The perturbation is defined as δ = ε·sign(∂L/∂X), and under a first-order Taylor expansion, restoring pixel i from the perturbed image changes the loss by approximately −ε·|∂L/∂X_i|. Therefore the maximum-AUC restoration order for any image is exactly the descending order of gradient magnitudes, and the Perturb score measures how closely a candidate attribution map agrees with the raw gradient ranking. This explains why gradient-based methods (Gradients, SmoothGrad, Integrated Gradients) dominate Table 4 and why uniform/Canny baselines score lowest in Table 2: the metric is not an independent test of faithfulness but rather a test of alignment with the model's local gradient. The paper does not justify gradient magnitude as the correct notion of 'pixels the CNN relies on,' and alternative importance notions (causal, counterfactual, occlusion-based) can diverge from it. I request (i) a first-order analysis of the score function explicitly derived in the text, and (ii) an experiment that replaces the FGSM direction with a perturbation direction independent of the gradient (e.g., random directions or a black-box estimated gradient) to show that the ranking of attribution methods changes accordingly. Without such evidence, the claim 'SmoothGrad to be the best map currently available' is not supported by an independent criterion.","section":"§3 'Defining the score function'"},{"comment":"The practice of skipping images for which the attack is unsuccessful can bias the evaluation, but the paper neither reports per-dataset skip rates nor analyzes selection effects. The text states 'we can skip images that were not successfully attacked' and later notes that PGD raises success from 95.80% to 100% on ChestX-ray8, yet no table or figure gives the fraction of skipped images for each dataset-architecture pair. If attack success correlates with image difficulty, class, or model confidence, the AUC is computed on a non-representative subset, which can change the relative ranking of attribution methods. Please provide per-dataset attack success rates for FGSM and PGD, and a sensitivity analysis comparing rankings computed on the subset where FGSM succeeds versus the larger subset where PGD succeeds. The statement that 'we did not observe any change in the ranking' with PGD should also be substantiated with a direct comparison table or figure.","section":"§3 'Other attacks' and §4.1 quantitative evaluation"},{"comment":"The claim that Perturb is 'the most consistent' metric rests on a difference in average Kendall's tau (0.466 vs. 0.432 for InsBlur) for which no statistical significance is reported, and the standard deviations overlap (0.252 vs. 0.314). The 15×15 matrices in Appendix A show substantial variability, including negative correlations for some pairs under Del, so the average alone is insufficient to establish superiority. I request a paired bootstrap or permutation test over the 15 rankings to provide confidence intervals or p-values for the pairwise differences (Perturb vs. InsBlur, Perturb vs. Ins, Perturb vs. Del). This is directly load-bearing for the paper's central claim of increased consistency across dataset-architecture combinations.","section":"§4.1, Table 3 and Appendix A"}],"minor_comments":[{"comment":"The title on page 1 reads 'Reliable Evaluation of Attribution Maps in CNN S'; it should be 'CNNs'.","section":"Title page"},{"comment":"The naming of GradCAM is inconsistent: the text uses both 'GradCam' and 'GradCAM' in the same paragraph. Please unify the notation.","section":"§2.1"},{"comment":"The paragraph states that the equivalence holds when ∂L/∂X < 0 for all pixels, which is not a general property. Please clarify that this is a special-case illustration rather than a general equivalence, or provide the precise conditions under which deletion and insertion can be viewed as FGSM with ϵ=255/255.","section":"§3 'Deletion/Insertion as ℓ∞ adversarial attack'"},{"comment":"The abstract and Section 1 state that 'we will provide the code along with our results' and that the evaluation is reproducible, but no code repository or data availability statement appears in the manuscript. Please add a reproducibility section with a URL or state that code will be released upon publication.","section":"Abstract and §1"},{"comment":"The SmoothGrad σ-tuning experiment uses a single image. If this is intended as quantitative evidence, please report the number of images and provide the numerical scores for both metrics across the four σ values; otherwise, describe it explicitly as an illustrative case study.","section":"§4.2 and Figure 7"},{"comment":"The caption says 'The first five AM methods require upsampling, while the next five methods output an AM in input resolution,' but the table contains more than ten entries and the grouping is unclear. Please mark the upsampling-required methods explicitly and list all methods in the same order as the caption.","section":"Table 1 caption"},{"comment":"In the equation for Smoothness, the sample mean is written as 'x' instead of the usual notation (e.g., \\bar{x}), and the equation is otherwise hard to parse. Please correct the notation and define all symbols.","section":"§4.1 smoothness definition"}],"recommendation":"major_revision","confidential_remarks":"The paper is clearly written and the experimental breadth is commendable, but the central metric is essentially a gradient-alignment measure, which makes the headline result that SmoothGrad is the best attribution map largely a consequence of the construction. This is a load-bearing concern that needs to be addressed before publication. I would encourage the editor to seek a revision in which the authors either (a) justify gradient-magnitude importance as the intended notion of faithfulness,, or (b) reframe the contribution as a consistency and smoothness diagnostic and temper the claims accordingly. The absence of per-dataset attack success rates and of statistically tested consistency differences also needs attention. The paper has merit and is potentially salvageable, but the current version overstates its conclusions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe one thing to know: the central claim in this paper is undermined by construction. The Perturb metric starts from X + ε·sign(∂L/∂X), so under a first-order approximation the AUC is maximized by restoring pixels in descending |∂L/∂X|. That means the metric is essentially measuring how well an attribution map reproduces the gradient-magnitude ranking. SmoothGrad and Gradients top the ranking because they are gradient-based, not because they are independently shown to be more faithful. The stress-test note is right: this is circular, and the paper doesn't justify gradient magnitude as the correct ground truth for \"what the CNN relies on.\"\n\nThat said, the paper does useful work. The 16-method / 15-dataset-architecture comparison is the broadest I've seen in this area. The use of Uniform and Canny as sanity-check baselines is a good protocol, and the demonstration that deletion/insertion fail those checks is a real finding. The monotonicity/smoothness improvements over masking are real, though they are a property of starting close to the original distribution rather than evidence of faithfulness. The SmoothGrad σ-tuning example is a nice qualitative validation that the metric can pick the visually sensible parameter.\n\nThe soft spots beyond circularity: the authors skip images where FGSM fails to lower the probability, and they don't report per-dataset skip rates or analyze whether skipping biases the AUC. The Kendall's τ advantage over InsBlur (0.466 ± 0.252 vs 0.432 ± 0.314) is within one standard deviation; no significance test is given. Code is promised but not provided. The Limitations section doesn't mention the gradient-alignment issue, which is the one that matters most.\n\nWho is this for? Practitioners who want a quick way to rank attribution methods and are willing to accept \"alignment with local gradient\" as their definition of importance. It is not a neutral test of faithfulness. The paper deserves a serious referee because the benchmark is valuable and the perturbation idea is worth developing, but a referee should ask for an upper-bound comparison (e.g., score of a pure |gradient| map), per-dataset attack success rates, and a discussion of alternative importance notions.\n\nRecommendation: send to peer review with major revision. The empirical work is substantial; the interpretation needs to be reframed.","headline":"The Perturb metric measures gradient alignment, so the headline claims about SmoothGrad and 'only metric passing all checks' are partly built into the construction; the benchmark is valuable but the interpretation is overreaching.","tokens_in":22224,"tokens_out":3156,"would_cite":false,"duration_ms":30438,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Attribution maps are best evaluated by undoing an adversarial perturbation, not by masking pixels.","keywords":["attribution maps","saliency maps","evaluation metrics","FGSM adversarial perturbation","SmoothGrad","deletion and insertion metrics","model interpretability","sanity checks"],"falsifier":"Feed the Perturb metric a map whose pixel values are the FGSM perturbation signs themselves (or those signs randomly shuffled); if either scores near the top, the metric is mostly detecting gradient alignment rather than genuine explanatory value. A second check: find a dataset-architecture pair where FGSM attack success is low and show that the ranking changes when failed-attack images are handled differently than the paper's skip rule.","tokens_in":21199,"feed_emoji":"🎯","tokens_out":7776,"duration_ms":64242,"temperature":0.7,"pith_summary":"The paper argues that the standard metrics for rating attribution maps in CNNs — deletion and insertion — are unreliable because they zero out or blur pixels, pushing images outside the distribution the model was trained on. It proposes a new score, Perturb, that instead adds a minimal adversarial perturbation ($\\pm 1$ per pixel via FGSM) to the whole image and then restores pixels in the order the attribution map says is important, measuring how quickly the model's confidence returns. The paper reports that this metric is smoother and more monotonic than deletion/insertion, always ranks trivial baselines (uniform noise and Canny edges) last, and is more consistent across 15 dataset-architecture combinations. Under this metric, SmoothGrad is the best of 16 attribution methods tested.","feed_headline":"Adversarial noise gives a fairer test of saliency maps","feed_subtitle":"New Perturb metric beats deletion/insertion on sanity checks and consistency; SmoothGrad ranks first.","key_machinery":"The load-bearing object is a score function built from the Fast Gradient Sign Method (FGSM): start from $X + \\epsilon \\cdot \\mathrm{sign}(\\partial L/\\partial X)$ with $\\epsilon = 1/255$, then restore pixels one by one in descending order of the attribution map and integrate the model's confidence over the restoration curve (AUC). The FGSM perturbation is what keeps every intermediate image on the data manifold, because each pixel moves by only one greyscale level, making the confidence curve smooth and monotonic. Supporting machinery includes two baseline maps (uniform noise and Canny edges) used as sanity checks, and the monotonicity, smoothness, and Kendall's $\\tau$ measures used to compare metrics.","core_discovery":"The central discovery is that switching from pixel masking to a minimal adversarial perturbation removes a distribution-shift artifact that corrupts attribution-map evaluation. The Perturb score fixes $\\epsilon = 1/255$, so the FGSM attack changes every pixel by exactly $\\pm 1$, then progressively reverses the perturbation in the order prescribed by the attribution map; the area under the confidence-recovery curve is the map's score. The authors show that deletion, insertion, and insertion-with-blur rank uniform-noise or Canny-edge baselines above real maps in multiple settings, while Perturb ranks them last in all 15 settings. They further report higher monotonicity (0.967 versus at most 0.671 for the other metrics), lower fluctuation (0.891 versus at least 1.238), and the highest average Kendall rank correlation (0.466). The paper concludes that SmoothGrad is the best attribution map currently available and suggests ReciproCAM or GradCAM++ as noise-free alternatives.","pith_inferences":["The Perturb score implicitly rewards maps aligned with the raw model gradient, so it may rank causal or counterfactual explanations lower even when they are faithful; testing this would require an independent ground truth.","The same restore-from-perturbation design could be ported to non-CNN architectures or black-box settings by substituting any small uniform perturbation for FGSM.","The paper asserts, without analysis, that skipping images where the attack failed does not bias the AUC; an explicit study of that selection effect would strengthen the method."],"forward_implications":["Rankings of attribution methods produced by deletion or insertion should be re-examined, since those metrics can place meaningless baselines above real maps.","Practitioners comparing explanation methods can use the Perturb AUC as a more consistent ordering, with SmoothGrad emerging as the top map in the authors' experiments.","The metric can tune continuous parameters of attribution methods: the authors use it to select SmoothGrad's noise level $\\sigma$, and visual inspection agrees.","Because Perturb is robust to switching FGSM to PGD, the ranking does not depend on the precise attack strength within this perturbation class."],"supporting_citations":[{"why":"Introduces deletion-by-masking, the evaluation protocol the paper argues is distribution-shifted.","marker":"Fong and Vedaldi [2017]"},{"why":"Introduces insertion and RISE-style randomized sampling, the other baseline the new metric replaces.","marker":"Petsiuk et al. [2018a]"},{"why":"Defines the FGSM attack that generates the paper's perturbation direction.","marker":"Goodfellow et al. [2014]"},{"why":"Proposes SmoothGrad, the attribution map that ranks best under the new metric.","marker":"Smilkov et al. [2017]"},{"why":"Supplies the edge-detector baseline that Perturb correctly ranks last.","marker":"Canny [1986]"},{"why":"Motivates sanity checks for attribution maps, on which the baseline tests are built.","marker":"Adebayo et al. [2018]"},{"why":"Provides PGD, used to show the ranking is unchanged by a stronger gradient-based attack.","marker":"Madry et al. [2017]"},{"why":"GradCAM is among the evaluated maps and the canonical CAM reference for comparison.","marker":"Selvaraju et al. [2019]"}],"fun_headline_variants":["Perturb metric beats deletion and insertion using adversarial noise","Adversarial perturbations fix attribution map evaluation","New test ranks SmoothGrad best: perturbation beats masking","Attribution maps: replace masking with minimal adversarial changes","Perturb passes all sanity checks; SmoothGrad takes the crown"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The metric assumes that the pixels the FGSM attack changes — the sign of the model's loss gradient — are exactly the pixels the model relies on, so that restoring those pixels fastest is the right measure of an attribution map's quality.","fun_headline_variants_meta":{"raw":{"variants":["Perturb metric beats deletion and insertion using adversarial noise","Adversarial perturbations fix attribution map evaluation","New test ranks SmoothGrad best: perturbation beats masking","Attribution maps: replace masking with minimal adversarial changes","Perturb passes all sanity checks; SmoothGrad takes the crown"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000482,"raw_usage":{"total_tokens":2377,"prompt_tokens":934,"completion_tokens":1443,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":550,"completion_tokens_details":{"reasoning_tokens":1363}},"tokens_in":550,"tokens_out":1443,"duration_ms":13118,"temperature":1.0,"reasoning_tokens":1363,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:41:35.708665+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Feed the Perturb metric a map whose pixel values are the FGSM perturbation signs themselves (or those signs randomly shuffled); if either scores near the top, the metric is mostly detecting gradient alignment rather than genuine explanatory value. A second check: find a dataset-architecture pair where FGSM attack success is low and show that the ranking changes when failed-attack images are handled differently than the paper's skip rule.","supporting_citations":[{"cited_title":"A computational approach to edge detection","cited_arxiv_id":null,"evidence_quote":"Supplies the edge-detector baseline that Perturb correctly ranks last."},{"cited_title":"Sanity checks for saliency maps","cited_arxiv_id":null,"evidence_quote":"Motivates sanity checks for attribution maps, on which the baseline tests are built."}],"review_version":1}