Pith. sign in

REVIEW 4 major objections 5 minor 21 references

Explainable AI for Securing Healthcare in IoT-Integrated 6G Wireless Networks

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Pith's one-line read Three explanation tools can jointly expose attack-signaling features in 6G medical networks, the paper argues.

desk verdict Routine XAI application to a new dataset, but the central claim that three explanation methods cross-validate each other is contradicted by the paper's own plots. read the letter →

arxiv 2505.14659 v1 pith:WR4ENPG6 submitted 2025-05-20 cs.LG cs.AI

classification cs.LGcs.AI
keywords explainableAISHAPLIMEDiCE6GnetworkshealthcaresecurityIoMTcounterfactualexplanations
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Explainable AI is often a single tool applied to a single model. This paper tries to establish that using three explanations for the same prediction—SHAP, LIME, and DiCE—produces a more complete and trustworthy account of why a 6G-era medical network classifier flags a sample as normal or attacking. The authors build a Random Forest intrusion detector on a medical network dataset, balance it with SMOTE, and explain one random test instance with all three methods. Because the methods converge on overlapping CPU, memory, and packet-activity features, the paper claims their agreement cross-validates the explanations and fosters trust in AI-driven security. The value, if right, is that security teams could rely on qualitative consensus among explainers to guide defenses in life-critical healthcare infrastructure.

What carries the argument

The machinery is a trio of model-agnostic explanation tools applied to a single Random Forest intrusion-detection model. SHAP (Shapley additive explanations) assigns each feature a contribution value by averaging over feature subsets; LIME (Local Interpretable Model-agnostic Explanations) fits a simple interpretable surrogate locally around the instance; DiCE (Diverse Counterfactual Explanations) generates several minimal changes to the input that flip the model's prediction. The paper's cross-validation is the qualitative comparison of which features these three methods call out for one randomly selected test sample, treating their agreement as evidence that the explanations are reliable.

What would settle it

Run the same SHAP, LIME, and DiCE pipeline on many random test samples from the same dataset and measure the overlap or rank correlation of their top features; if agreement is weak or contradictory across samples, the reliability claim fails. Alternatively, build a synthetic dataset with features that are known to generate attacks and check whether all three methods identify those features for a sample.

Watch

Extended reading notes

Core claim

The central claim is that integrating SHAP, LIME, and DiCE yields a comprehensive interpretation of model decisions in 6G healthcare networks, and that cross-validating the three methods confirms their reliability and consistency. On the paper's single test sample, SHAP associates high system, user, and idle CPU times with normal operation; LIME flags extreme idle and user times as possible attack indicators; and DiCE shows that source and destination byte counts and jitter move the prediction between attack and normal. The paper reads this convergence as confirmation that normal traffic is characterized by stable CPU usage, typical network activity, and sufficient resources, while anomalies in idle time, jitter, and unusual packet behavior indicate attacks. That interpretive convergence is the evidence offered for the conclusion that multi-method XAI can support trustworthy security decisions.

Load-bearing premise

The load-bearing premise is that qualitative agreement among SHAP, LIME, and DiCE on a single randomly chosen test instance is enough to establish that the explanations are reliable, even though no ground-truth explanation or aggregate consistency statistic is offered.

Editorial extensions

If this is right

  • Security teams in 6G-enabled hospitals could watch CPU idle time, network jitter, and packet-size anomalies as early indicators of intrusion.
  • A consensus approach that combines SHAP, LIME, and DiCE could be embedded in network security dashboards to deliver human-readable alerts.
  • The same multi-explainer pipeline could be transferred to other critical-infrastructure intrusion-detection datasets to identify feature-level attack signatures.
  • If the methods agree on normal-versus-attack behavior, the same cross-validation idea could be used to explain false negatives and help tune detection thresholds.
  • Non-technical stakeholders, including clinicians and hospital administrators, could receive actionable explanations of AI security decisions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We would extend the paper's single-sample check by measuring pairwise feature-overlap or rank correlation of SHAP, LIME, and DiCE across hundreds of random test instances; stable consensus across a population would be far stronger evidence than one sample.
  • A natural next test is to run the same three-tool pipeline on a synthetic dataset with known attack-generating features, which would show whether agreement tracks the true cause or merely shared approximation bias.
  • The paper implies but does not explore that a sudden change in the three explainers' consensus could itself serve as a drift or attack alarm in real-time 6G edge monitoring.
  • We infer that the authors' reliability claim should be read as consistency among explainers, not correctness against ground truth; the paper provides no external standard for what the right explanation is.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper argues that explainable AI (XAI) techniques—SHAP, LIME, and DiCE—can address security challenges in 6G-enabled healthcare by explaining the decisions of a machine-learning intrusion detector on the WUSTL-HDRL-2024 IoMT dataset. It surveys 6G usage scenarios and their security implications, trains several classifiers on a balanced subsample, selects Random Forest, and then applies the three XAI methods to a single test instance. The central claim is that cross-validating these XAI methods on that instance confirms their reliability and consistency, thereby fostering trust in AI-driven security solutions.

Significance. The topic is timely and practically important: 6G healthcare networks create new attack surfaces, and interpretable security models are needed. The paper's strengths include using a recent medical-specific intrusion dataset, applying three complementary XAI families (attribution, local surrogate, and counterfactual), and reporting standard predictive metrics such as 99.85% accuracy for Random Forest. If the cross-validation claim could be supported by multi-sample quantitative agreement analysis and external ground truth, the paper would be a useful case study in XAI-based security for IoMT. As written, however, the empirical contribution is a single-instance narrative, and the claimed consistency is not demonstrated.

major comments (4)
  1. [Section V, Figs. 4–6] The central claim that cross-validating SHAP, LIME, and DiCE confirms reliability and consistency rests on one randomly selected test instance. No aggregate statistics over multiple instances, no error bars or confidence intervals, and no quantitative agreement metric (e.g., sign agreement, feature-rank correlation) are provided. A single anecdote cannot establish that the explanations are reliable; the authors should report agreement statistics across a representative set of test samples, together with variability measures.
  2. [Section V, Figs. 4–5] The displayed evidence actually contradicts the consistency claim on a shared feature. SHAP is described as treating high 'scputimes_idle' as positively supporting the prediction ('High idle time ... typical in a Normal state'), whereas LIME assigns negative weight to excessive idle time and Section V concedes that it 'may indicate underutilization, potentially masking malicious processes.' The attempted reconciliation—'extreme deviations can imply anomalies'—is not derived from the displayed data and no threshold is given; this sign flip on the same feature for the same sample directly undermines the claimed agreement.
  3. [Section IV-D and Section V] The three methods appear to explain different predictions, which invalidates the intended cross-validation. Section IV-B defines the binary encoding as attack=1 and normal=0, yet the SHAP force plot is reported with a final prediction of '1.00' while the accompanying bullets interpret the features as supporting 'Normal'; LIME's plot predicts class [0] (Normal); DiCE's original sample is described as predicted 'Attack' (1). Unless the class labels are explicitly reconciled, the methods are being compared on incomparable explanations.
  4. [Section IV-A–C, Table I] The experimental setup lacks the detail needed to assess the reliability of the reported results. The paper does not specify the train/test split, the random seed, or whether SMOTE was applied before or after the split. Table I is ambiguous about the counts after SMOTE: the 'Total Count (After SMOTE)' and 'Class Instance (After SMOTE)' columns are not clearly separated, and the relationship between the stated 2,000-record subsample and the per-class counts shown is unclear. This matters because class-balancing and potential data leakage can inflate accuracy and change the explanations produced by XAI methods.
minor comments (5)
  1. [Throughout] The manuscript contains numerous typos and formatting issues, including 'Explaination' in the DiCE heading, 'Fig1' for Fig. 1, inconsistent use of 'a nd' and 'thr ough', and the caption for Fig. 2 referring to a visualization whose rendered output is not clearly included.
  2. [Section I and References] The paper relies heavily on the authors' own prior work [18], [19], and [20] to motivate the claim that XAI strengthens security and transparency; independent sources would strengthen the motivation and avoid the appearance of self-referential support.
  3. [Section IV-C] A brief description of hyperparameters for the Random Forest model (e.g., number of trees, depth) and the CNN architecture (e.g., activation functions, training epochs) would improve reproducibility; currently only the dense-layer sizes are given.
  4. [Section IV-D] The manuscript says 'we selected a random test sample' but does not state which sample, why it was chosen, or how the different XAI tools were configured (e.g., LIME kernel width, DiCE diversity weight). This makes the qualitative comparison impossible to reproduce.
  5. [Section V] The concluding sentence of Section V states that 'normal traffic is characterized by stable CPU usage, typical network activity, and sufficient resources,' but these characterizations are derived from the single sample and would need aggregate evidence to be presented as general findings.

Circularity Check

1 steps flagged · score 4.0 of 10

The 'cross-validation confirms reliability' claim is self-referential: consistency across methods is both the procedure and the conclusion, with no independent ground truth.

  1. self definitional [Section IV.D (Implementation of XAI) and Section VI (Conclusion)]
    "By cross-validating results across these techniques, we ensure consistency in the identified features thereby reinforcing confidence in the model's predictions. ... Furthermore, our cross-validation of these XAI methods confirms their reliability and consistency, fostering trust in AI-driven security solutions."

    The validation procedure is defined as comparing SHAP, LIME, and DiCE feature attributions on one chosen test sample; the conclusion asserted is that these methods are 'reliable and consistent.' Since no external ground-truth labels, quantitative agreement metric, or aggregate statistics are introduced, 'reliability' is operationalized as inter-method agreement. Therefore the statement 'cross-validation confirms reliability and consistency' reduces to 'the methods agree because we compared them and interpreted them as agreeing.' Section V then reconciles the SHAP/LIME sign disagreement on scputimes_idle with the threshold phrase 'extreme deviations can imply anomalies,' so consistency is imposed narratively rather than measured.

full rationale

The paper applies standard external XAI tools (SHAP, LIME, DiCE) to an external dataset (WUSTL-HDRL-2024) and does not fit parameters and then rename them as predictions, so most of the experimental pipeline is not circular. The only circular element is the paper's central validation claim: cross-validation is performed by checking qualitative agreement among explanation methods on one random sample, and the paper then announces that this cross-validation 'confirms their reliability and consistency.' Without an independent ground truth or a quantitative consistency measure, that conclusion is a restatement of the procedure rather than a derived result. Section III.B also cites the authors' own prior papers [18]-[20] to motivate XAI's security value, but that motivation is not the load-bearing derivation of the paper's empirical claim; it is standard background framing and does not by itself raise the score further. The SHAP/LIME sign disagreement on scputimes_idle (Section V) is a correctness risk rather than an additional circularity. Overall, the self-referential validation of reliability warrants a moderate score of 4.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The analysis depends on several assumptions: the dataset represents realistic 6G IoMT traffic; agreement among SHAP, LIME, and DiCE is a valid proxy for explanation correctness; binary classification preserves security-relevant distinctions; and high model accuracy implies the model is suitable for interpretation. None of these is independently verified in the paper.

free parameters (2)
  • Class-balanced subsample size (2,000 per class after SMOTE) = 2000 per class
    The paper hand-selects 2,000 records per class for evaluation, and all results depend on this choice; no sensitivity analysis is provided.
  • Random Forest hyperparameters = Not reported
    Model performance and the resulting XAI explanations depend on hyperparameters, which are not specified. The paper likely relies on library defaults without stating them.
assumptions (4)
  • domain assumption The WUSTL-HDRL-2024 dataset is representative of realistic 6G healthcare network attacks.
    Section IV.A states the dataset is an ideal resource for 6G medical security, but no independent evidence links this dataset to actual 6G deployments.
  • ad hoc to paper Qualitative agreement among SHAP, LIME, and DiCE implies that explanations are reliable and correct.
    Section V treats cross-method agreement as validation, but no external ground truth or quantitative consistency metric is provided.
  • domain assumption A binary attack-versus-normal formulation preserves the security distinctions needed for 6G healthcare.
    Section IV.B collapses four attack types into one class, losing the ability to distinguish DDoS, MiTM, ransomware, and buffer overflow in the explanation analysis.
  • domain assumption A random forest accuracy of 99.85% implies the model is trustworthy enough for interpretation.
    Section IV.C selects Random Forest for XAI based on accuracy, without checking calibrated confidence, adversarial robustness, or class-wise performance after subsampling.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Explainable AI for Securing Healthcare in IoT-Integrated 6G Wireless Networks." pith.science (2026). https://pith.science/paper/WR4ENPG6

@misc{pith2026250514659,
  author       = {Pith},
  title        = {Pith review of: Explainable AI for Securing Healthcare in IoT-Integrated 6G Wireless Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WR4ENPG6}},
  note         = {Machine review of arXiv:2505.14659}
}
read the original abstract

As healthcare systems increasingly adopt advanced wireless networks and connected devices, securing medical applications has become critical. The integration of Internet of Medical Things devices, such as robotic surgical tools, intensive care systems, and wearable monitors has enhanced patient care but introduced serious security risks. Cyberattacks on these devices can lead to life threatening consequences, including surgical errors, equipment failure, and data breaches. While the ITU IMT 2030 vision highlights 6G's transformative role in healthcare through AI and cloud integration, it also raises new security concerns. This paper explores how explainable AI techniques like SHAP, LIME, and DiCE can uncover vulnerabilities, strengthen defenses, and improve trust and transparency in 6G enabled healthcare. We support our approach with experimental analysis and highlight promising results.

Figures

Figures reproduced from arXiv: 2505.14659 by the authors.

Figure 1
Figure 1. Fig1. Usage Scenarios Wheel Diagram (Source ITU) [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Visualization Plot of different class types and their counts. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Distribution of Class Labels – After SMOTE Given the dataset's size, we randomly selected 2,000 records for each class (normal and attack traffic) to evaluate our machine learning models, as outlined in Table I. Since our primary objective is to develop a model that emphasizes interpretability and prediction clarity while enhancing security in network environments, this dataset size is sufficient to demonstrate the … view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: illustrates a LIME explanation. In the left panel, the model predicts class [0], indicating a "Normal" status. The middle panel shows each feature's contribution to the prediction. The length of each bar indicates the feature's impact, with longer bars signifying great…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

21 extracted references · 20 canonical work pages

  1. [1]

    Digital technology -based telemedicine for the COVID-19 pandemic

    Y.T. Shen, L. Chen, W.W. Yue, H.X. Xu, “Digital technology -based telemedicine for the COVID-19 pandemic.” , Frontiers in medicine, 2021, p.646506

  2. [2]

    Internet of medical things and healthcare 4.0: Trends, requirements, challenges, and research directions

    M. Osama, “Internet of medical things and healthcare 4.0: Trends, requirements, challenges, and research directions.” Sensors, 2023, 23(17), p.7435

  3. [3]

    Security vulnerabilities, attacks, countermeasures, and regulations of networked medical devices —A review

    T. Yaqoob, H. Abbas, M. Atiquzzaman, “Security vulnerabilities, attacks, countermeasures, and regulations of networked medical devices —A review.”, IEEE COMST, 2019, 21(4), pp.3723-3768

  4. [4]

    ‘Framework and overall objectives of the future development of IMT for 2030 and beyond.’ Available Online: https://www.itu.int/dms_pubrec/itu- r/rec/m/R-REC-M.2160-0-202311-I%21%21PDF-E.pdf [last accessed: 11/07/2024]

  5. [5]

    HDRL -IDS: A Hybrid Deep Reinforcement Learning Intrusion Detection System for Enhancing the Security of Medical Applications in 5G Networks

    A. Ghubaish, Z. Yang, R. Jain, “HDRL -IDS: A Hybrid Deep Reinforcement Learning Intrusion Detection System for Enhancing the Security of Medical Applications in 5G Networks.” In 2024 International Conference on Smart Applications, Communications and Networking (SmartNets). 2024, (pp. 1-6)

  6. [6]

    Explainable AI and mass surveillance system -based healthcare framework to combat COVID -I9 like pandemics

    M.S. Hossain, G. Muhammad, N. Guizani, “Explainable AI and mass surveillance system -based healthcare framework to combat COVID -I9 like pandemics.” IEEE networks, 2020, 34(4), pp.126-132

  7. [7]

    Explainable ai meets healthcare: A study on heart disease dataset

    D. Dave, H. Naik, S. Singhal, P. Patel, “Explainable ai meets healthcare: A study on heart disease dataset.” arXiv preprint arXiv:2011.03195, 2020

  8. [8]

    Enabling federated learning of explainable AI models within beyond -5G/6G networks

    J.L.C. Bárcena, P. Ducange, F. Marcelloni, G. Nardini, A. Noferi, A. Renda, F. Ruffini, A. Schiavo, G. Stea, A. Virdis, “Enabling federated learning of explainable AI models within beyond -5G/6G networks.” Computer Communications, 2023, 210, pp.356-375

Show all 21 references
  1. [9]

    Machine learning for predicting readmission risk among the frail: Explainable AI for healthcare

    S.D Mohanty, D. Lekan,T.P. McCoy, M. Jenkins, P. Manda, “Machine learning for predicting readmission risk among the frail: Explainable AI for healthcare.” Patterns, 2022, 3(1)

  2. [10]

    Augmented reality as a telemedicine platform for remote procedural training

    S. Wang, M. Parsons, J. Stone-McLean, P. Rogers, S. Boyd, K. Hoover, O. Meruvia -Pastor, M. Gong, A. Smith, “Augmented reality as a telemedicine platform for remote procedural training.” Sensors, 17(10), 2017, p.2294

  3. [11]

    A survey on security and privacy issues in modern healthcare systems: Attacks and defenses

    A.I. Newaz, A.K. Sikder, M. A. Rahman, A.S. Uluagac, “ A survey on security and privacy issues in modern healthcare systems: Attacks and defenses.” ACM Transactions on Computing for Healthcare, 2021, 2(3), pp.1-44

  4. [12]

    A unified approach to interpreting model predictions

    S.M. Lundberg, S.I Lee. "A unified approach to interpreting model predictions.", Advances in neural information processing systems, 30, 2017

  5. [13]

    Why should i trust you?

    M.T. Ribeiro, S. Singh, C. Guestrin. "Why should i trust you?" Explaining the predictions of any classifier.” Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp.1135-1144

  6. [14]

    Explaining machine learning classifiers through diverse counterfactual explanations

    R.K Mothilal, A. Sharma, C. Tan, “Explaining machine learning classifiers through diverse counterfactual explanations”. In Proceedings of the 2020 conference on fairness, accountability, and transparency, 2020, (pp. 607-617)

  7. [15]

    Designing ECG monitoring healthcare system with federated transfer learning and explainable AI

    A. Raza, K.P. Tran, L. Koehl, S. Li, “Designing ECG monitoring healthcare system with federated transfer learning and explainable AI.” Knowledge-Based Systems, 2022, p.107763

  8. [16]

    Exploring the role of 6G technology in enhancing quality of experience for m -health multimedia applications: A comprehensive survey

    M.M. Nasralla, S.B.A. Khattak, I. Ur Rehman, M. Iqbal, “Exploring the role of 6G technology in enhancing quality of experience for m -health multimedia applications: A comprehensive survey.” Sensors, 2023, 23(13), p.5882

  9. [17]

    A taxonomy for denial-of-service attacks in wireless sensor networks

    A.D. Wood, J.A. Stankovic, “A taxonomy for denial-of-service attacks in wireless sensor networks.” Handbook of sensor networks: compact wireless and wired sensing systems, 2004, 4, pp.739-763

  10. [18]

    An Approach To Enhance IoT Security In 6G Networks Through Explainable AI

    N. Kaur, L. Gupta, “An Approach To Enhance IoT Security In 6G Networks Through Explainable AI.” arXiv preprint arXiv:2410.05310, 2024

  11. [19]

    Enhancing IoT Security in 6G Environment With Transparent AI: Leveraging XGBoost, SHAP and LIME

    N. Kaur, L. Gupta, “Enhancing IoT Security in 6G Environment With Transparent AI: Leveraging XGBoost, SHAP and LIME.” In 2024 IEEE 10th NetSoft, 2024, (pp. 180-184)

  12. [20]

    Securing the 6G–IoT Environment: A Framework for Enhancing Transparency in Artificial Intelligence Decision -Making Through Explainable Artificial Intelligence

    N. Kaur, L. Gupta, “Securing the 6G–IoT Environment: A Framework for Enhancing Transparency in Artificial Intelligence Decision -Making Through Explainable Artificial Intelligence. ” Sensors, 25(3), 2025, p.854

  13. [21]

    SMOTE: synthetic minority over -sampling technique

    N.V. Chawla, K.W. Bowyer, L.O. Hall, W.P. Kegelmeyer, “SMOTE: synthetic minority over -sampling technique.” Journal of artificial intelligence research, 2002, pp.321-357

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.