REVIEW 4 major objections 5 minor 21 references
Explainable AI for Securing Healthcare in IoT-Integrated 6G Wireless Networks
T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read Three explanation tools can jointly expose attack-signaling features in 6G medical networks, the paper argues.
desk verdict Routine XAI application to a new dataset, but the central claim that three explanation methods cross-validate each other is contradicted by the paper's own plots. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The machinery is a trio of model-agnostic explanation tools applied to a single Random Forest intrusion-detection model. SHAP (Shapley additive explanations) assigns each feature a contribution value by averaging over feature subsets; LIME (Local Interpretable Model-agnostic Explanations) fits a simple interpretable surrogate locally around the instance; DiCE (Diverse Counterfactual Explanations) generates several minimal changes to the input that flip the model's prediction. The paper's cross-validation is the qualitative comparison of which features these three methods call out for one randomly selected test sample, treating their agreement as evidence that the explanations are reliable.
What would settle it
Run the same SHAP, LIME, and DiCE pipeline on many random test samples from the same dataset and measure the overlap or rank correlation of their top features; if agreement is weak or contradictory across samples, the reliability claim fails. Alternatively, build a synthetic dataset with features that are known to generate attacks and check whether all three methods identify those features for a sample.
Extended reading notes
Core claim
The central claim is that integrating SHAP, LIME, and DiCE yields a comprehensive interpretation of model decisions in 6G healthcare networks, and that cross-validating the three methods confirms their reliability and consistency. On the paper's single test sample, SHAP associates high system, user, and idle CPU times with normal operation; LIME flags extreme idle and user times as possible attack indicators; and DiCE shows that source and destination byte counts and jitter move the prediction between attack and normal. The paper reads this convergence as confirmation that normal traffic is characterized by stable CPU usage, typical network activity, and sufficient resources, while anomalies in idle time, jitter, and unusual packet behavior indicate attacks. That interpretive convergence is the evidence offered for the conclusion that multi-method XAI can support trustworthy security decisions.
Load-bearing premise
The load-bearing premise is that qualitative agreement among SHAP, LIME, and DiCE on a single randomly chosen test instance is enough to establish that the explanations are reliable, even though no ground-truth explanation or aggregate consistency statistic is offered.
Editorial extensions
If this is right
- Security teams in 6G-enabled hospitals could watch CPU idle time, network jitter, and packet-size anomalies as early indicators of intrusion.
- A consensus approach that combines SHAP, LIME, and DiCE could be embedded in network security dashboards to deliver human-readable alerts.
- The same multi-explainer pipeline could be transferred to other critical-infrastructure intrusion-detection datasets to identify feature-level attack signatures.
- If the methods agree on normal-versus-attack behavior, the same cross-validation idea could be used to explain false negatives and help tune detection thresholds.
- Non-technical stakeholders, including clinicians and hospital administrators, could receive actionable explanations of AI security decisions.
Reading between the lines
- We would extend the paper's single-sample check by measuring pairwise feature-overlap or rank correlation of SHAP, LIME, and DiCE across hundreds of random test instances; stable consensus across a population would be far stronger evidence than one sample.
- A natural next test is to run the same three-tool pipeline on a synthetic dataset with known attack-generating features, which would show whether agreement tracks the true cause or merely shared approximation bias.
- The paper implies but does not explore that a sudden change in the three explainers' consensus could itself serve as a drift or attack alarm in real-time 6G edge monitoring.
- We infer that the authors' reliability claim should be read as consistency among explainers, not correctness against ground truth; the paper provides no external standard for what the right explanation is.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper argues that explainable AI (XAI) techniques—SHAP, LIME, and DiCE—can address security challenges in 6G-enabled healthcare by explaining the decisions of a machine-learning intrusion detector on the WUSTL-HDRL-2024 IoMT dataset. It surveys 6G usage scenarios and their security implications, trains several classifiers on a balanced subsample, selects Random Forest, and then applies the three XAI methods to a single test instance. The central claim is that cross-validating these XAI methods on that instance confirms their reliability and consistency, thereby fostering trust in AI-driven security solutions.
Significance. The topic is timely and practically important: 6G healthcare networks create new attack surfaces, and interpretable security models are needed. The paper's strengths include using a recent medical-specific intrusion dataset, applying three complementary XAI families (attribution, local surrogate, and counterfactual), and reporting standard predictive metrics such as 99.85% accuracy for Random Forest. If the cross-validation claim could be supported by multi-sample quantitative agreement analysis and external ground truth, the paper would be a useful case study in XAI-based security for IoMT. As written, however, the empirical contribution is a single-instance narrative, and the claimed consistency is not demonstrated.
major comments (4)
- [Section V, Figs. 4–6] The central claim that cross-validating SHAP, LIME, and DiCE confirms reliability and consistency rests on one randomly selected test instance. No aggregate statistics over multiple instances, no error bars or confidence intervals, and no quantitative agreement metric (e.g., sign agreement, feature-rank correlation) are provided. A single anecdote cannot establish that the explanations are reliable; the authors should report agreement statistics across a representative set of test samples, together with variability measures.
- [Section V, Figs. 4–5] The displayed evidence actually contradicts the consistency claim on a shared feature. SHAP is described as treating high 'scputimes_idle' as positively supporting the prediction ('High idle time ... typical in a Normal state'), whereas LIME assigns negative weight to excessive idle time and Section V concedes that it 'may indicate underutilization, potentially masking malicious processes.' The attempted reconciliation—'extreme deviations can imply anomalies'—is not derived from the displayed data and no threshold is given; this sign flip on the same feature for the same sample directly undermines the claimed agreement.
- [Section IV-D and Section V] The three methods appear to explain different predictions, which invalidates the intended cross-validation. Section IV-B defines the binary encoding as attack=1 and normal=0, yet the SHAP force plot is reported with a final prediction of '1.00' while the accompanying bullets interpret the features as supporting 'Normal'; LIME's plot predicts class [0] (Normal); DiCE's original sample is described as predicted 'Attack' (1). Unless the class labels are explicitly reconciled, the methods are being compared on incomparable explanations.
- [Section IV-A–C, Table I] The experimental setup lacks the detail needed to assess the reliability of the reported results. The paper does not specify the train/test split, the random seed, or whether SMOTE was applied before or after the split. Table I is ambiguous about the counts after SMOTE: the 'Total Count (After SMOTE)' and 'Class Instance (After SMOTE)' columns are not clearly separated, and the relationship between the stated 2,000-record subsample and the per-class counts shown is unclear. This matters because class-balancing and potential data leakage can inflate accuracy and change the explanations produced by XAI methods.
minor comments (5)
- [Throughout] The manuscript contains numerous typos and formatting issues, including 'Explaination' in the DiCE heading, 'Fig1' for Fig. 1, inconsistent use of 'a nd' and 'thr ough', and the caption for Fig. 2 referring to a visualization whose rendered output is not clearly included.
- [Section I and References] The paper relies heavily on the authors' own prior work [18], [19], and [20] to motivate the claim that XAI strengthens security and transparency; independent sources would strengthen the motivation and avoid the appearance of self-referential support.
- [Section IV-C] A brief description of hyperparameters for the Random Forest model (e.g., number of trees, depth) and the CNN architecture (e.g., activation functions, training epochs) would improve reproducibility; currently only the dense-layer sizes are given.
- [Section IV-D] The manuscript says 'we selected a random test sample' but does not state which sample, why it was chosen, or how the different XAI tools were configured (e.g., LIME kernel width, DiCE diversity weight). This makes the qualitative comparison impossible to reproduce.
- [Section V] The concluding sentence of Section V states that 'normal traffic is characterized by stable CPU usage, typical network activity, and sufficient resources,' but these characterizations are derived from the single sample and would need aggregate evidence to be presented as general findings.
Circularity Check
The 'cross-validation confirms reliability' claim is self-referential: consistency across methods is both the procedure and the conclusion, with no independent ground truth.
-
self definitional
[Section IV.D (Implementation of XAI) and Section VI (Conclusion)]
"By cross-validating results across these techniques, we ensure consistency in the identified features thereby reinforcing confidence in the model's predictions. ... Furthermore, our cross-validation of these XAI methods confirms their reliability and consistency, fostering trust in AI-driven security solutions."
The validation procedure is defined as comparing SHAP, LIME, and DiCE feature attributions on one chosen test sample; the conclusion asserted is that these methods are 'reliable and consistent.' Since no external ground-truth labels, quantitative agreement metric, or aggregate statistics are introduced, 'reliability' is operationalized as inter-method agreement. Therefore the statement 'cross-validation confirms reliability and consistency' reduces to 'the methods agree because we compared them and interpreted them as agreeing.' Section V then reconciles the SHAP/LIME sign disagreement on scputimes_idle with the threshold phrase 'extreme deviations can imply anomalies,' so consistency is imposed narratively rather than measured.
full rationale
The paper applies standard external XAI tools (SHAP, LIME, DiCE) to an external dataset (WUSTL-HDRL-2024) and does not fit parameters and then rename them as predictions, so most of the experimental pipeline is not circular. The only circular element is the paper's central validation claim: cross-validation is performed by checking qualitative agreement among explanation methods on one random sample, and the paper then announces that this cross-validation 'confirms their reliability and consistency.' Without an independent ground truth or a quantitative consistency measure, that conclusion is a restatement of the procedure rather than a derived result. Section III.B also cites the authors' own prior papers [18]-[20] to motivate XAI's security value, but that motivation is not the load-bearing derivation of the paper's empirical claim; it is standard background framing and does not by itself raise the score further. The SHAP/LIME sign disagreement on scputimes_idle (Section V) is a correctness risk rather than an additional circularity. Overall, the self-referential validation of reliability warrants a moderate score of 4.
Assumptions & free parameters
free parameters (2)
- Class-balanced subsample size (2,000 per class after SMOTE) =
2000 per class
- Random Forest hyperparameters =
Not reported
assumptions (4)
- domain assumption The WUSTL-HDRL-2024 dataset is representative of realistic 6G healthcare network attacks.
- ad hoc to paper Qualitative agreement among SHAP, LIME, and DiCE implies that explanations are reliable and correct.
- domain assumption A binary attack-versus-normal formulation preserves the security distinctions needed for 6G healthcare.
- domain assumption A random forest accuracy of 99.85% implies the model is trustworthy enough for interpretation.
Cite this review
Pith. "Pith review of Explainable AI for Securing Healthcare in IoT-Integrated 6G Wireless Networks." pith.science (2026). https://pith.science/paper/WR4ENPG6
@misc{pith2026250514659,
author = {Pith},
title = {Pith review of: Explainable AI for Securing Healthcare in IoT-Integrated 6G Wireless Networks},
year = {2026},
howpublished = {\url{https://pith.science/paper/WR4ENPG6}},
note = {Machine review of arXiv:2505.14659}
}
read the original abstract
As healthcare systems increasingly adopt advanced wireless networks and connected devices, securing medical applications has become critical. The integration of Internet of Medical Things devices, such as robotic surgical tools, intensive care systems, and wearable monitors has enhanced patient care but introduced serious security risks. Cyberattacks on these devices can lead to life threatening consequences, including surgical errors, equipment failure, and data breaches. While the ITU IMT 2030 vision highlights 6G's transformative role in healthcare through AI and cloud integration, it also raises new security concerns. This paper explores how explainable AI techniques like SHAP, LIME, and DiCE can uncover vulnerabilities, strengthen defenses, and improve trust and transparency in 6G enabled healthcare. We support our approach with experimental analysis and highlight promising results.
Figures
Figures from the paper (1 more)
Reference graph
Works this paper leans on
-
[1]
Digital technology -based telemedicine for the COVID-19 pandemic
Y.T. Shen, L. Chen, W.W. Yue, H.X. Xu, “Digital technology -based telemedicine for the COVID-19 pandemic.” , Frontiers in medicine, 2021, p.646506
work page 2021
-
[2]
M. Osama, “Internet of medical things and healthcare 4.0: Trends, requirements, challenges, and research directions.” Sensors, 2023, 23(17), p.7435
work page 2023
-
[3]
T. Yaqoob, H. Abbas, M. Atiquzzaman, “Security vulnerabilities, attacks, countermeasures, and regulations of networked medical devices —A review.”, IEEE COMST, 2019, 21(4), pp.3723-3768
work page 2019
-
[4]
‘Framework and overall objectives of the future development of IMT for 2030 and beyond.’ Available Online: https://www.itu.int/dms_pubrec/itu- r/rec/m/R-REC-M.2160-0-202311-I%21%21PDF-E.pdf [last accessed: 11/07/2024]
work page 2024
-
[5]
A. Ghubaish, Z. Yang, R. Jain, “HDRL -IDS: A Hybrid Deep Reinforcement Learning Intrusion Detection System for Enhancing the Security of Medical Applications in 5G Networks.” In 2024 International Conference on Smart Applications, Communications and Networking (SmartNets). 2024, (pp. 1-6)
work page 2024
-
[6]
M.S. Hossain, G. Muhammad, N. Guizani, “Explainable AI and mass surveillance system -based healthcare framework to combat COVID -I9 like pandemics.” IEEE networks, 2020, 34(4), pp.126-132
work page 2020
-
[7]
Explainable ai meets healthcare: A study on heart disease dataset
D. Dave, H. Naik, S. Singhal, P. Patel, “Explainable ai meets healthcare: A study on heart disease dataset.” arXiv preprint arXiv:2011.03195, 2020
arXiv 2011
-
[8]
Enabling federated learning of explainable AI models within beyond -5G/6G networks
J.L.C. Bárcena, P. Ducange, F. Marcelloni, G. Nardini, A. Noferi, A. Renda, F. Ruffini, A. Schiavo, G. Stea, A. Virdis, “Enabling federated learning of explainable AI models within beyond -5G/6G networks.” Computer Communications, 2023, 210, pp.356-375
work page 2023
Show all 21 references
-
[9]
Machine learning for predicting readmission risk among the frail: Explainable AI for healthcare
S.D Mohanty, D. Lekan,T.P. McCoy, M. Jenkins, P. Manda, “Machine learning for predicting readmission risk among the frail: Explainable AI for healthcare.” Patterns, 2022, 3(1)
2022
-
[10]
Augmented reality as a telemedicine platform for remote procedural training
S. Wang, M. Parsons, J. Stone-McLean, P. Rogers, S. Boyd, K. Hoover, O. Meruvia -Pastor, M. Gong, A. Smith, “Augmented reality as a telemedicine platform for remote procedural training.” Sensors, 17(10), 2017, p.2294
2017
-
[11]
A survey on security and privacy issues in modern healthcare systems: Attacks and defenses
A.I. Newaz, A.K. Sikder, M. A. Rahman, A.S. Uluagac, “ A survey on security and privacy issues in modern healthcare systems: Attacks and defenses.” ACM Transactions on Computing for Healthcare, 2021, 2(3), pp.1-44
2021
-
[12]
A unified approach to interpreting model predictions
S.M. Lundberg, S.I Lee. "A unified approach to interpreting model predictions.", Advances in neural information processing systems, 30, 2017
2017
-
[13]
Why should i trust you?
M.T. Ribeiro, S. Singh, C. Guestrin. "Why should i trust you?" Explaining the predictions of any classifier.” Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp.1135-1144
2016
-
[14]
Explaining machine learning classifiers through diverse counterfactual explanations
R.K Mothilal, A. Sharma, C. Tan, “Explaining machine learning classifiers through diverse counterfactual explanations”. In Proceedings of the 2020 conference on fairness, accountability, and transparency, 2020, (pp. 607-617)
2020
-
[15]
Designing ECG monitoring healthcare system with federated transfer learning and explainable AI
A. Raza, K.P. Tran, L. Koehl, S. Li, “Designing ECG monitoring healthcare system with federated transfer learning and explainable AI.” Knowledge-Based Systems, 2022, p.107763
2022
-
[16]
Exploring the role of 6G technology in enhancing quality of experience for m -health multimedia applications: A comprehensive survey
M.M. Nasralla, S.B.A. Khattak, I. Ur Rehman, M. Iqbal, “Exploring the role of 6G technology in enhancing quality of experience for m -health multimedia applications: A comprehensive survey.” Sensors, 2023, 23(13), p.5882
2023
-
[17]
A taxonomy for denial-of-service attacks in wireless sensor networks
A.D. Wood, J.A. Stankovic, “A taxonomy for denial-of-service attacks in wireless sensor networks.” Handbook of sensor networks: compact wireless and wired sensing systems, 2004, 4, pp.739-763
2004
-
[18]
An Approach To Enhance IoT Security In 6G Networks Through Explainable AI
N. Kaur, L. Gupta, “An Approach To Enhance IoT Security In 6G Networks Through Explainable AI.” arXiv preprint arXiv:2410.05310, 2024
2024 arXiv
-
[19]
Enhancing IoT Security in 6G Environment With Transparent AI: Leveraging XGBoost, SHAP and LIME
N. Kaur, L. Gupta, “Enhancing IoT Security in 6G Environment With Transparent AI: Leveraging XGBoost, SHAP and LIME.” In 2024 IEEE 10th NetSoft, 2024, (pp. 180-184)
2024
-
[20]
Securing the 6G–IoT Environment: A Framework for Enhancing Transparency in Artificial Intelligence Decision -Making Through Explainable Artificial Intelligence
N. Kaur, L. Gupta, “Securing the 6G–IoT Environment: A Framework for Enhancing Transparency in Artificial Intelligence Decision -Making Through Explainable Artificial Intelligence. ” Sensors, 25(3), 2025, p.854
2025
-
[21]
SMOTE: synthetic minority over -sampling technique
N.V. Chawla, K.W. Bowyer, L.O. Hall, W.P. Kegelmeyer, “SMOTE: synthetic minority over -sampling technique.” Journal of artificial intelligence research, 2002, pp.321-357
2002
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.