Pith. sign in

REVIEW 3 major objections 7 minor 61 references

Reliable Evaluation of Attribution Maps in CNNs: A Perturbation-Based Approach

T0 review · 3 major / 7 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Attribution maps are best evaluated by undoing an adversarial perturbation, not by masking pixels.

desk verdict The Perturb metric measures gradient alignment, so the headline claims about SmoothGrad and 'only metric passing all checks' are partly built into the construction; the benchmark is valuable but the interpretation is overreaching. read the letter →

arxiv 2411.14946 v1 pith:RONP62W2 submitted 2024-11-22 cs.CV cs.AIcs.LG

Lars Nieradzik , Henrike Stephani , Janis Keuper This is my paper · ORCID
classification cs.CVcs.AIcs.LG
keywords attributionmapssaliencyevaluationmetricsFGSMadversarialperturbationSmoothGraddeletionandinsertionmodelinterpretabilitysanitychecks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the standard metrics for rating attribution maps in CNNs — deletion and insertion — are unreliable because they zero out or blur pixels, pushing images outside the distribution the model was trained on. It proposes a new score, Perturb, that instead adds a minimal adversarial perturbation ($\pm 1$ per pixel via FGSM) to the whole image and then restores pixels in the order the attribution map says is important, measuring how quickly the model's confidence returns. The paper reports that this metric is smoother and more monotonic than deletion/insertion, always ranks trivial baselines (uniform noise and Canny edges) last, and is more consistent across 15 dataset-architecture combinations. Under this metric, SmoothGrad is the best of 16 attribution methods tested.

What carries the argument

The load-bearing object is a score function built from the Fast Gradient Sign Method (FGSM): start from $X + \epsilon \cdot \mathrm{sign}(\partial L/\partial X)$ with $\epsilon = 1/255$, then restore pixels one by one in descending order of the attribution map and integrate the model's confidence over the restoration curve (AUC). The FGSM perturbation is what keeps every intermediate image on the data manifold, because each pixel moves by only one greyscale level, making the confidence curve smooth and monotonic. Supporting machinery includes two baseline maps (uniform noise and Canny edges) used as sanity checks, and the monotonicity, smoothness, and Kendall's $\tau$ measures used to compare metrics.

What would settle it

Feed the Perturb metric a map whose pixel values are the FGSM perturbation signs themselves (or those signs randomly shuffled); if either scores near the top, the metric is mostly detecting gradient alignment rather than genuine explanatory value. A second check: find a dataset-architecture pair where FGSM attack success is low and show that the ranking changes when failed-attack images are handled differently than the paper's skip rule.

Watch

Extended reading notes

Core claim

The central discovery is that switching from pixel masking to a minimal adversarial perturbation removes a distribution-shift artifact that corrupts attribution-map evaluation. The Perturb score fixes $\epsilon = 1/255$, so the FGSM attack changes every pixel by exactly $\pm 1$, then progressively reverses the perturbation in the order prescribed by the attribution map; the area under the confidence-recovery curve is the map's score. The authors show that deletion, insertion, and insertion-with-blur rank uniform-noise or Canny-edge baselines above real maps in multiple settings, while Perturb ranks them last in all 15 settings. They further report higher monotonicity (0.967 versus at most 0.671 for the other metrics), lower fluctuation (0.891 versus at least 1.238), and the highest average Kendall rank correlation (0.466). The paper concludes that SmoothGrad is the best attribution map currently available and suggests ReciproCAM or GradCAM++ as noise-free alternatives.

Load-bearing premise

The metric assumes that the pixels the FGSM attack changes — the sign of the model's loss gradient — are exactly the pixels the model relies on, so that restoring those pixels fastest is the right measure of an attribution map's quality.

Editorial extensions

If this is right

  • Rankings of attribution methods produced by deletion or insertion should be re-examined, since those metrics can place meaningless baselines above real maps.
  • Practitioners comparing explanation methods can use the Perturb AUC as a more consistent ordering, with SmoothGrad emerging as the top map in the authors' experiments.
  • The metric can tune continuous parameters of attribution methods: the authors use it to select SmoothGrad's noise level $\sigma$, and visual inspection agrees.
  • Because Perturb is robust to switching FGSM to PGD, the ranking does not depend on the precise attack strength within this perturbation class.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The Perturb score implicitly rewards maps aligned with the raw model gradient, so it may rank causal or counterfactual explanations lower even when they are faithful; testing this would require an independent ground truth.
  • The same restore-from-perturbation design could be ported to non-CNN architectures or black-box settings by substituting any small uniform perturbation for FGSM.
  • The paper asserts, without analysis, that skipping images where the attack failed does not bias the AUC; an explicit study of that selection effect would strengthen the method.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes a new quantitative evaluation metric for attribution maps (AMs) in CNNs, called Perturb, which replaces the pixel-masking operations of deletion/insertion metrics with FGSM adversarial perturbations. Starting from a fully perturbed image, pixels are restored in the order determined by the attribution map, and the area under the target-class probability curve (AUC) is used as the score. The authors evaluate 16 attribution methods across 15 dataset-architecture combinations (three datasets, five CNN architectures) and report that their metric uniquely passes baseline sanity checks (uniform and Canny maps rank last), exhibits higher monotonicity and smoothness, and achieves higher average Kendall's tau consistency than deletion, insertion, and blurred-insertion metrics. They conclude that SmoothGrad is the best attribution map currently available. The paper argues that masking induces distribution shifts that render existing metrics unreliable, while their ±1 adversarial perturbations stay closer to the original image distribution.

Significance. The paper addresses a practically important problem: the lack of a reliable quantitative benchmark for comparing attribution maps. If the proposed metric is valid, it would offer a standardized way to rank explanation methods and to sanity-check newly proposed AMs. The empirical scope is a strength: 16 methods, 15 model-dataset pairs, multiple architectures, and the inclusion of baseline maps as sanity checks. The monotonicity and smoothness analyses are also useful and well-motivated. However, the central validity of the metric is questionable because the perturbation direction is defined by the sign of the model's loss gradient, which makes the metric essentially measure how well an attribution map reproduces the gradient-magnitude ranking. This circularity threatens the headline claim that SmoothGrad is the best map and that the metric is a more robust evaluation framework. The paper's contribution may be more defensible if reframed as a consistency and smoothness diagnostic for gradient-aligned maps rather than as a faithfulness test.

major comments (3)
  1. [§3 'Defining the score function'] The construction of the metric makes the evaluation circular relative to the hypothesis being tested. The perturbation is defined as δ = ε·sign(∂L/∂X), and under a first-order Taylor expansion, restoring pixel i from the perturbed image changes the loss by approximately −ε·|∂L/∂X_i|. Therefore the maximum-AUC restoration order for any image is exactly the descending order of gradient magnitudes, and the Perturb score measures how closely a candidate attribution map agrees with the raw gradient ranking. This explains why gradient-based methods (Gradients, SmoothGrad, Integrated Gradients) dominate Table 4 and why uniform/Canny baselines score lowest in Table 2: the metric is not an independent test of faithfulness but rather a test of alignment with the model's local gradient. The paper does not justify gradient magnitude as the correct notion of 'pixels the CNN relies on,' and alternative importance notions (causal, counterfactual, occlusion-based) can diverge from it. I request (i) a first-order analysis of the score function explicitly derived in the text, and (ii) an experiment that replaces the FGSM direction with a perturbation direction independent of the gradient (e.g., random directions or a black-box estimated gradient) to show that the ranking of attribution methods changes accordingly. Without such evidence, the claim 'SmoothGrad to be the best map currently available' is not supported by an independent criterion.
  2. [§3 'Other attacks' and §4.1 quantitative evaluation] The practice of skipping images for which the attack is unsuccessful can bias the evaluation, but the paper neither reports per-dataset skip rates nor analyzes selection effects. The text states 'we can skip images that were not successfully attacked' and later notes that PGD raises success from 95.80% to 100% on ChestX-ray8, yet no table or figure gives the fraction of skipped images for each dataset-architecture pair. If attack success correlates with image difficulty, class, or model confidence, the AUC is computed on a non-representative subset, which can change the relative ranking of attribution methods. Please provide per-dataset attack success rates for FGSM and PGD, and a sensitivity analysis comparing rankings computed on the subset where FGSM succeeds versus the larger subset where PGD succeeds. The statement that 'we did not observe any change in the ranking' with PGD should also be substantiated with a direct comparison table or figure.
  3. [§4.1, Table 3 and Appendix A] The claim that Perturb is 'the most consistent' metric rests on a difference in average Kendall's tau (0.466 vs. 0.432 for InsBlur) for which no statistical significance is reported, and the standard deviations overlap (0.252 vs. 0.314). The 15×15 matrices in Appendix A show substantial variability, including negative correlations for some pairs under Del, so the average alone is insufficient to establish superiority. I request a paired bootstrap or permutation test over the 15 rankings to provide confidence intervals or p-values for the pairwise differences (Perturb vs. InsBlur, Perturb vs. Ins, Perturb vs. Del). This is directly load-bearing for the paper's central claim of increased consistency across dataset-architecture combinations.
minor comments (7)
  1. [Title page] The title on page 1 reads 'Reliable Evaluation of Attribution Maps in CNN S'; it should be 'CNNs'.
  2. [§2.1] The naming of GradCAM is inconsistent: the text uses both 'GradCam' and 'GradCAM' in the same paragraph. Please unify the notation.
  3. [§3 'Deletion/Insertion as ℓ∞ adversarial attack'] The paragraph states that the equivalence holds when ∂L/∂X < 0 for all pixels, which is not a general property. Please clarify that this is a special-case illustration rather than a general equivalence, or provide the precise conditions under which deletion and insertion can be viewed as FGSM with ϵ=255/255.
  4. [Abstract and §1] The abstract and Section 1 state that 'we will provide the code along with our results' and that the evaluation is reproducible, but no code repository or data availability statement appears in the manuscript. Please add a reproducibility section with a URL or state that code will be released upon publication.
  5. [§4.2 and Figure 7] The SmoothGrad σ-tuning experiment uses a single image. If this is intended as quantitative evidence, please report the number of images and provide the numerical scores for both metrics across the four σ values; otherwise, describe it explicitly as an illustrative case study.
  6. [Table 1 caption] The caption says 'The first five AM methods require upsampling, while the next five methods output an AM in input resolution,' but the table contains more than ten entries and the grouping is unclear. Please mark the upsampling-required methods explicitly and list all methods in the same order as the caption.
  7. [§4.1 smoothness definition] In the equation for Smoothness, the sample mean is written as 'x' instead of the usual notation (e.g., \bar{x}), and the equation is otherwise hard to parse. Please correct the notation and define all symbols.

Circularity Check

1 steps flagged · score 6.0 of 10

The Perturb metric's FGSM perturbation encodes gradient magnitude as the definition of importance, so the headline result 'SmoothGrad is best' is substantially predetermined by construction.

  1. self definitional [Section 3, 'Adversarial perturbation' and 'Defining the score function'; Fig. 4 caption]
    "A solution to this gradient-based optimization problem using the ℓ∞-norm for S is the fast gradient sign attack (FGSM) Goodfellow et al. [2014], where δ = ϵ · sgn(∂L/∂X) and sgn(·) is the sign function. ... We start with a fully perturbed image where to every pixel either 1 or −1 was added with the FGSM attack. Gradually, this perturbation is systematically undone using the AM ... when the network converges more rapidly to the initial probability, it signifies that the saliency map accurately pinpointed the pertinent regions."

    Under the first-order approximation that motivates FGSM, f(X+δ) ≈ f(X) + Σ_i (∂f/∂X_i) δ_i with δ_i = ε·sign(∂L/∂X_i). Reverting the perturbation at pixel i then changes the target probability by an amount proportional to |∂L/∂X_i|. Hence the AUC-maximizing restoration order for any image is descending |∂L/∂X_i|, and the Perturb score measures, to first order, how well an attribution map reproduces the loss-gradient magnitude ranking. SmoothGrad and Gradients are precisely smoothed and unsmoothed gradient estimates, so their consistently top ranking is a consequence of the metric's construction rather than an independent test of faithfulness. The baseline 'sanity checks' (Uniform, Canny) are also forced to fail for the same reason.

full rationale

The central circularity is in the score definition: the FGSM perturbation is built from sign(∂L/∂X), and reversing that perturbation in attribution-map order makes the score approximate a rank correlation with |∂L/∂X|. This is not merely a loose analogy; it is the first-order content of the paper's own FGSM formulation. As a result, the abstract's claims that SmoothGrad is 'the best map currently available' and that the metric is 'the only contender to pass all checks' are substantially predetermined: gradient-based maps are expected to score highest by construction, and non-gradient baselines are expected to score lowest. This warrants a partial-circularity finding rather than a dismissal of the whole paper, because the method still provides a reproducible, consistent ranking procedure and the empirical comparisons across 15 dataset-architecture combinations contain independent experimental content. The paper's self-citations (e.g., Nieradzik et al. 2024) are not load-bearing for this issue. The separate decision to skip images where the attack failed ('we can skip images that were not successfully attacked') is a potential selection-bias risk but is not itself a circularity; it is noted here only as an unanalyzed assumption. Overall, the headline ranking claim reduces in large part to gradient alignment, giving a circularity score of 6.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The proposed metric rests on several domain assumptions about what constitutes a valid explanation (smooth recovery, baseline maps being worst, on-manifold perturbations) and on a data-selection choice (skipping failed attacks) that is not fully characterized. The FGSM perturbation introduces a gradient-alignment bias that is not acknowledged as such.

free parameters (2)
  • epsilon (FGSM perturbation strength) = 1/255 (recommended; ablation tested 1/255 to 32/255)
    The metric's smoothness and monotonicity depend on epsilon; the authors select 1/255 after an ablation showing higher values degrade these properties. This is a hand-chosen parameter, not derived from first principles.
  • Skipped-image threshold (attack success criterion) = not specified
    Images where FGSM does not reduce the target-class probability are excluded from AUC computation. The criterion for a successful attack is not defined quantitatively, and the fraction skipped per dataset is not reported.
assumptions (5)
  • domain assumption Small uniform ±1 pixel perturbations keep images on the data manifold, unlike zero-masking.
    Stated in Section 3 ('these types of images might not have been encountered during training' for zero-masking; 'the attacks produce images that are likely to have qualitatively occurred as training samples'). The metric's validity depends on this premise.
  • domain assumption A reliable attribution-map evaluation should produce smooth and monotonic probability-recovery curves.
    Introduced in Section 4.1 as motivation for the monotonicity and smoothness analyses; the paper treats monotonicity as evidence of no distribution shift, but this is a normative assumption about how a correct map should behave.
  • ad hoc to paper Uniform random maps and Canny-edge maps should be ranked worst by any valid evaluation metric.
    Introduced as sanity baselines in Section 3. The paper uses these baselines to argue their metric is more reliable than deletion/insertion, but the expectation that these maps must be worst is an assumption about what makes an explanation good, not a ground truth.
  • domain assumption Images with unsuccessful FGSM attacks can be skipped without biasing the evaluation.
    Stated in Section 3 ('we can skip images that were not successfully attacked'). The paper does not analyze whether attack failure correlates with attribution-map quality or dataset, so the resulting AUC may be biased.
  • domain assumption FGSM success rates are high enough that skipping is rare; PGD produces the same ranking.
    Reported only for ChestX-ray8 (95.8% for FGSM, 100% for PGD); the authors claim rankings are unchanged under PGD but do not show per-dataset success rates or the comparison.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reliable Evaluation of Attribution Maps in CNNs: A Perturbation-Based Approach." pith.science (2026). https://pith.science/paper/RONP62W2

@misc{pith2026241114946,
  author       = {Pith},
  title        = {Pith review of: Reliable Evaluation of Attribution Maps in CNNs: A Perturbation-Based Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RONP62W2}},
  note         = {Machine review of arXiv:2411.14946}
}
abstract

In this paper, we present an approach for evaluating attribution maps, which play a central role in interpreting the predictions of convolutional neural networks (CNNs). We show that the widely used insertion/deletion metrics are susceptible to distribution shifts that affect the reliability of the ranking. Our method proposes to replace pixel modifications with adversarial perturbations, which provides a more robust evaluation framework. By using smoothness and monotonicity measures, we illustrate the effectiveness of our approach in correcting distribution shifts. In addition, we conduct the most comprehensive quantitative and qualitative assessment of attribution maps to date. Introducing baseline attribution maps as sanity checks, we find that our metric is the only contender to pass all checks. Using Kendall's $\tau$ rank correlation coefficient, we show the increased consistency of our metric across 15 dataset-architecture combinations. Of the 16 attribution maps tested, our results clearly show SmoothGrad to be the best map currently available. This research makes an important contribution to the development of attribution maps by providing a reliable and consistent evaluation framework. To ensure reproducibility, we will provide the code along with our results.

Figures

Figures reproduced from arXiv: 2411.14946 by the authors.

Figure 1
Figure 1. Visualization of four different attribution maps (AM) and two evaluation methods on the same input image [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. This plot illustrates the degree of similarity among all attribution maps. The matrix was computed by [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The series of images showcases the process of the Deletion methods, applied to the original image. The first [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Insertion, Insertion Blur, and our Perturbation method applied to one image. (a) Shows the Insertion and [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Blue is the original image, orange is the perturbed image. There is only a small effect on the image distribution. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: This plot shows that our score function is almost always increasing at [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: The optimal σ values for SmoothGrad are determined by two evaluation methods: Deletion (↓) and our metric (↑). While visual analysis clearly suggests the first image as the most appropriate choice, the Deletion metric unexpectedly favors the last image as the preferred…
Figure 8
Figure 8. Figure 8: Correlation matrix for InsBlur. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Correlation matrix for Ins. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: Correlation matrix for Del. 19 [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: Correlation matrix for Perturb (ours). 20 [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]
Figure 12
Figure 12. Figure 12: This plot shows the effect of ϵ on smoothness. Lower is better. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 23 canonical work pages

  1. [1]

    Explaining explanations: An overview of interpretability of machine learning

    Leilani H Gilpin, David Bau, Ben Z Yuan, Ayesha Bajwa, Michael Specter, and Lalana Kagal. Explaining explanations: An overview of interpretability of machine learning. In 2018 IEEE 5th International Conference on data science and advanced analytics (DSAA), pages 80--89. IEEE, 2018

    work page 2018

  2. [2]

    Overview of cnn research: 25 years history and the current trends

    \'A kos Zar \'a ndy, Csaba Rekeczky, P \'e ter Szolgay, and Leon O Chua. Overview of cnn research: 25 years history and the current trends. In 2015 IEEE International Symposium on Circuits and Systems (ISCAS), pages 401--404. IEEE, 2015

    work page 2015

  3. [3]

    Mingxing Tan and Quoc V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks. CoRR, abs/1905.11946, 2019. URL http://arxiv.org/abs/1905.11946

    arXiv 1905

  4. [4]

    Interpretable explanations of black boxes by meaningful perturbation

    Ruth Fong and Andrea Vedaldi. Interpretable explanations of black boxes by meaningful perturbation. CoRR, abs/1704.03296, 2017. URL http://arxiv.org/abs/1704.03296

    arXiv 2017

  5. [6]

    Guided integrated gradients: An adaptive path method for removing noise

    Andrei Kapishnikov, Subhashini Venugopalan, Besim Avci, Ben Wedin, Michael Terry, and Tolga Bolukbasi. Guided integrated gradients: An adaptive path method for removing noise. CoRR, abs/2106.09788, 2021. URL https://arxiv.org/abs/2106.09788

    arXiv 2021

  6. [7]

    Attribution in scale and space

    Shawn Xu, Subhashini Venugopalan, and Mukund Sundararajan. Attribution in scale and space. CoRR, abs/2004.03383, 2020. URL https://arxiv.org/abs/2004.03383

    arXiv 2004

  7. [8]

    A survey on neural network interpretability

    Yu Zhang, Peter Ti n o, Ale s Leonardis, and Ke Tang. A survey on neural network interpretability. IEEE Transactions on Emerging Topics in Computational Intelligence, 5 0 (5): 0 726--742, 2021 a

    work page 2021

  8. [9]

    Challenging the black box: A comprehensive evaluation of attribution maps of cnn applications in agriculture and forestry, 2024

    Lars Nieradzik, Henrike Stephani, Jördis Sieburg-Rockel, Stephanie Helmling, Andrea Olbrich, and Janis Keuper. Challenging the black box: A comprehensive evaluation of attribution maps of cnn applications in agriculture and forestry, 2024

    work page 2024

Show all 61 references
  1. [10]

    Convolutional networks for images, speech, and time series

    Yann LeCun, Yoshua Bengio, et al. Convolutional networks for images, speech, and time series

  2. [11]

    Deep inside convolutional networks: Visualising image classification models and saliency maps

    Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. In Yoshua Bengio and Yann LeCun, editors, 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada...

    2014 arXiv

  3. [12]

    Zeiler and Rob Fergus

    Matthew D. Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. CoRR, abs/1311.2901, 2013. URL http://arxiv.org/abs/1311.2901

    2013 arXiv

  4. [13]

    Riedmiller

    Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin A. Riedmiller. Striving for simplicity: The all convolutional net. In Yoshua Bengio and Yann LeCun, editors, 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, ...

    2015 arXiv

  5. [14]

    Vi \' e gas, and Martin Wattenberg

    Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda B. Vi \' e gas, and Martin Wattenberg. Smoothgrad: removing noise by adding noise. CoRR, abs/1706.03825, 2017. URL http://arxiv.org/abs/1706.03825

    2017 arXiv

  6. [15]

    Axiomatic attribution for deep networks

    Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. CoRR, abs/1703.01365, 2017. URL http://arxiv.org/abs/1703.01365

    2017 arXiv

  7. [16]

    Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra

    Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad- CAM : Visual explanations from deep networks via gradient-based localization. International Journal of Computer Vision, 128 0 (2): 0 336--359, oct 2019. doi:10.1...

    2019 doi

  8. [17]

    Grad- CAM ++: Generalized gradient-based visual explanations for deep convolutional networks

    Aditya Chattopadhay, Anirban Sarkar, Prantik Howlader, and Vineeth N Balasubramanian. Grad- CAM ++: Generalized gradient-based visual explanations for deep convolutional networks. In 2018 IEEE Winter Conference on Applications of Computer Vision ( WACV ) . IEEE , mar 2018. doi...

    2018

  9. [18]

    Smooth grad-cam++: An enhanced inference level visualization technique for deep convolutional neural network models

    Daniel Omeiza, Skyler Speakman, Celia Cintas, and Komminist Weldemariam. Smooth grad-cam++: An enhanced inference level visualization technique for deep convolutional neural network models. CoRR, abs/1908.01224, 2019. URL http://arxiv.org/abs/1908.01224

    1908 arXiv

  10. [19]

    Layercam: Exploring hierarchical class activation maps for localization

    Peng-Tao Jiang, Chang-Bin Zhang, Qibin Hou, Ming-Ming Cheng, and Yunchao Wei. Layercam: Exploring hierarchical class activation maps for localization. IEEE Transactions on Image Processing, 30: 0 5875--5888, 2021. doi:10.1109/TIP.2021.3089943

    2021

  11. [20]

    Axiom-based grad-cam: Towards accurate visualization and explanation of cnns

    Ruigang Fu, Qingyong Hu, Xiaohu Dong, Yulan Guo, Yinghui Gao, and Biao Li. Axiom-based grad-cam: Towards accurate visualization and explanation of cnns. CoRR, abs/2008.02312, 2020. URL https://arxiv.org/abs/2008.02312

    2008 arXiv

  12. [21]

    Score-cam: Score-weighted visual explanations for convolutional neural networks, 2020 a

    Haofan Wang, Zifan Wang, Mengnan Du, Fan Yang, Zijian Zhang, Sirui Ding, Piotr Mardziel, and Xia Hu. Score-cam: Score-weighted visual explanations for convolutional neural networks, 2020 a

    2020

  13. [22]

    Cengiz \" O ztireli, and Markus H

    Marco Ancona, Enea Ceolini, A. Cengiz \" O ztireli, and Markus H. Gross. A unified view of gradient-based attribution methods for deep neural networks. CoRR, abs/1711.06104, 2017. URL http://arxiv.org/abs/1711.06104

    2017 arXiv

  14. [23]

    Ss-cam: Smoothed score-cam for sharper visual feature localization, 2020 b

    Haofan Wang, Rakshit Naidu, Joy Michael, and Soumya Snigdha Kundu. Ss-cam: Smoothed score-cam for sharper visual feature localization, 2020 b . URL https://arxiv.org/abs/2006.14255

    2020 arXiv

  15. [24]

    Nayak K, and Soumya Snigdha Kundu

    Rakshit Naidu, Ankita Ghosh, Yash Maurya, Shamanth R. Nayak K, and Soumya Snigdha Kundu. IS-CAM: integrated score-cam for axiomatic-based explanations. CoRR, abs/2010.03023, 2020. URL https://arxiv.org/abs/2010.03023

    2010 arXiv

  16. [25]

    Ramaswamy

    Saurabh Desai and Harish G. Ramaswamy. Ablation-cam: Visual explanations for deep convolutional network via gradient-free localization. In 2020 IEEE Winter Conference on Applications of Computer Vision (WACV), pages 972--980, 2020. doi:10.1109/WACV45572.2020.9093360

    2020

  17. [26]

    Fd-cam: Improving faithfulness and discriminability of visual explanation for cnns, 2022

    Hui Li, Zihao Li, Rui Ma, and Tieru Wu. Fd-cam: Improving faithfulness and discriminability of visual explanation for cnns, 2022. URL https://arxiv.org/abs/2206.08792

    2022 arXiv

  18. [27]

    Group-cam: Group score-weighted visual explanations for deep convolutional networks

    Qing - Long Zhang, Lu Rao, and Yubin Yang. Group-cam: Group score-weighted visual explanations for deep convolutional networks. CoRR, abs/2103.13859, 2021 b . URL https://arxiv.org/abs/2103.13859

    2021 arXiv

  19. [28]

    Poly-cam: High resolution class activation map for convolutional neural networks, 2022

    Alexandre Englebert, Olivier Cornu, and Christophe De Vleeschouwer. Poly-cam: High resolution class activation map for convolutional neural networks, 2022. URL https://arxiv.org/abs/2204.13359

    2022 arXiv

  20. [29]

    Zoom-cam: Generating fine-grained pixel annotations from image labels

    Xiangwei Shi, Seyran Khademi, Yunqiang Li, and Jan van Gemert. Zoom-cam: Generating fine-grained pixel annotations from image labels. CoRR, abs/2010.08644, 2020. URL https://arxiv.org/abs/2010.08644

    2010 arXiv

  21. [30]

    Recipro-cam: Fast gradient-free visual explanations for convolutional neural networks, 2023

    Seok-Yong Byun and Wonju Lee. Recipro-cam: Fast gradient-free visual explanations for convolutional neural networks, 2023

    2023

  22. [31]

    Eigen-cam: Class activation map using principal components

    Mohammed Bany Muhammad and Mohammed Yeasin. Eigen-cam: Class activation map using principal components. CoRR, abs/2008.00299, 2020. URL https://arxiv.org/abs/2008.00299

    2008 arXiv

  23. [32]

    Rise: Randomized input sampling for explanation of black-box models, 2018 b

    Vitali Petsiuk, Abir Das, and Kate Saenko. Rise: Randomized input sampling for explanation of black-box models, 2018 b . URL https://arxiv.org/abs/1806.07421

    2018 arXiv

  24. [33]

    Understanding deep networks via extremal perturbations and smooth masks

    Ruth Fong, Mandela Patrick, and Andrea Vedaldi. Understanding deep networks via extremal perturbations and smooth masks. CoRR, abs/1910.08485, 2019. URL http://arxiv.org/abs/1910.08485

    1910 arXiv

  25. [34]

    why should I trust you?

    Marco T \' u lio Ribeiro, Sameer Singh, and Carlos Guestrin. "why should I trust you?": Explaining the predictions of any classifier. CoRR, abs/1602.04938, 2016. URL http://arxiv.org/abs/1602.04938

    2016 arXiv

  26. [35]

    Revisiting the evaluation of class activation mapping for explainability: A novel metric and experimental analysis

    Samuele Poppi, Marcella Cornia, Lorenzo Baraldi, and Rita Cucchiara. Revisiting the evaluation of class activation mapping for explainability: A novel metric and experimental analysis. CoRR, abs/2104.10252, 2021. URL https://arxiv.org/abs/2104.10252

    2021 arXiv

  27. [36]

    Metrics for saliency map evaluation of deep learning explanation methods

    Tristan Gomez, Thomas Fr \' e our, and Harold Mouch \` e re. Metrics for saliency map evaluation of deep learning explanation methods. CoRR, abs/2201.13291, 2022. URL https://arxiv.org/abs/2201.13291

    2022 arXiv

  28. [37]

    Top-down neural attention by excitation backprop

    Jianming Zhang, Zhe Lin, Jonathan Brandt, Xiaohui Shen, and Stan Sclaroff. Top-down neural attention by excitation backprop. CoRR, abs/1608.00507, 2016. URL http://arxiv.org/abs/1608.00507

    2016 arXiv

  29. [38]

    The weighting game: Evaluating quality of explainability methods, 2022

    Lassi Raatikainen and Esa Rahtu. The weighting game: Evaluating quality of explainability methods, 2022. URL https://arxiv.org/abs/2208.06175

    2022 arXiv

  30. [39]

    Mark Everingham, Luc Van Gool, Christopher K. I. Williams, John Winn, and Andrew Zisserman. The pascal visual object classes ( VOC ) challenge. International Journal of Computer Vision, 88 0 (2): 0 303--338, September 2009. doi:10.1007/s11263-009-0275-4. URL https://doi.org/10...

    2009 doi

  31. [40]

    Belongie, Lubomir D

    Tsung - Yi Lin, Michael Maire, Serge J. Belongie, Lubomir D. Bourdev, Ross B. Girshick, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll \' a r, and C. Lawrence Zitnick. Microsoft COCO: common objects in context. CoRR, abs/1405.0312, 2014. URL http://arxiv.org/abs/1405.0312

    2014 arXiv

  32. [41]

    Threat of adversarial attacks on deep learning in computer vision: A survey

    Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access, 6: 0 14410--14430, 2018

    2018

  33. [42]

    Foolbox v0.8.0: A python toolbox to benchmark the robustness of machine learning models

    Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox v0.8.0: A python toolbox to benchmark the robustness of machine learning models. CoRR, abs/1707.04131, 2017. URL http://arxiv.org/abs/1707.04131

    2017 arXiv

  34. [43]

    One pixel attack for fooling deep neural networks

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. CoRR, abs/1710.08864, 2017. URL http://arxiv.org/abs/1710.08864

    2017 arXiv

  35. [44]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. CoRR, abs/1608.04644, 2016. URL http://arxiv.org/abs/1608.04644

    2016 arXiv

  36. [45]

    Detecting adversarial image examples in deep neural networks with adaptive noise reduction

    Bin Liang, Hongcheng Li, Miaoqiang Su, Xirong Li, Wenchang Shi, and Xiaofeng Wang. Detecting adversarial image examples in deep neural networks with adaptive noise reduction. IEEE Transactions on Dependable and Secure Computing, 18 0 (1): 0 72--85, 2021. doi:10.1109/TDSC.2018.2874243

    2021

  37. [46]

    Feature squeezing: Detecting adversarial examples in deep neural networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. CoRR, abs/1704.01155, 2017. URL http://arxiv.org/abs/1704.01155

    2017 arXiv

  38. [47]

    Yao Li, Minhao Cheng, Cho - Jui Hsieh, and Thomas C. M. Lee. A review of adversarial attack and defense for classification methods. CoRR, abs/2111.09961, 2021. URL https://arxiv.org/abs/2111.09961

    2021 arXiv

  39. [48]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2014. URL https://arxiv.org/abs/1412.6572

    2014 arXiv

  40. [49]

    Towards deep learning models resistant to adversarial attacks, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2017. URL https://arxiv.org/abs/1706.06083

    2017 arXiv

  41. [50]

    A computational approach to edge detection

    John Canny. A computational approach to edge detection. IEEE Transactions on pattern analysis and machine intelligence, 0 (6): 0 679--698, 1986

    1986

  42. [51]

    Sanity checks for saliency maps

    Julius Adebayo, Justin Gilmer, Michael Muelly, Ian Goodfellow, Moritz Hardt, and Been Kim. Sanity checks for saliency maps. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume ...

    2018

  43. [52]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248--255, 2009. doi:10.1109/CVPR.2009.5206848

    2009

  44. [53]

    O. M. Parkhi, A. Vedaldi, A. Zisserman, and C. V. Jawahar. Cats and dogs. In IEEE Conference on Computer Vision and Pattern Recognition, 2012

    2012

  45. [54]

    Xiaosong Wang, Yifan Peng, Le Lu, Zhiyong Lu, Mohammadhadi Bagheri, and Ronald M. Summers. Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases. In CVPR, pages 3462--3471. IEEE Computer S...

    2017

  46. [55]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CoRR, abs/1512.03385, 2015. URL http://arxiv.org/abs/1512.03385

    2015 arXiv

  47. [56]

    Weinberger

    Gao Huang, Zhuang Liu, and Kilian Q. Weinberger. Densely connected convolutional networks. CoRR, abs/1608.06993, 2016. URL http://arxiv.org/abs/1608.06993

    2016 arXiv

  48. [57]

    A convnet for the 2020s

    Zhuang Liu, Hanzi Mao, Chao - Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. CoRR, abs/2201.03545, 2022. URL https://arxiv.org/abs/2201.03545

    2022 arXiv

  49. [58]

    Repvgg: Making vgg-style convnets great again

    Xiaohan Ding, Xiangyu Zhang, Ningning Ma, Jungong Han, Guiguang Ding, and Jian Sun. Repvgg: Making vgg-style convnets great again. CoRR, abs/2101.03697, 2021. URL https://arxiv.org/abs/2101.03697

    2021 arXiv

  50. [59]

    Torchcam: class activation explorer

    François-Guillaume Fernandez. Torchcam: class activation explorer. https://github.com/frgfm/torch-cam, March 2020

    2020

  51. [60]

    Saliency library

    Google PAIR. Saliency library. https://github.com/PAIR-code/saliency, 2022

    2022

  52. [61]

    nonparametric

    Roger Newson. Parameters behind “nonparametric” statistics: Kendall’s tau, somers’ d and median differences. The Stata Journal: Promoting communications on statistics and Stata, 2 0 (1): 0 45–64, March 2002. ISSN 1536-8734. doi:10.1177/1536867x0200200103. URL http://dx.doi.org...

    2002 doi

  53. [62]

    Towards deep learning models resistant to adversarial attacks, 2019

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019

    2019

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.