Pith. sign in

REVIEW 4 major objections 5 minor 69 references

A Self-Explainable Deep Architecture for Security Applications

T0 review · 4 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read XSec makes prototype matches do double duty as classifier and explanation, keeping 97.33% accuracy across five security datasets.

desk verdict XSec is a useful prototype-based self-explainable model for security data, but the paper's central claim that explanations directly match the decision rule needs one more empirical check—measuring the off-class prototype weights. read the letter →

arxiv 2608.05552 v1 pith:F2UDI4IL submitted 2026-08-06 cs.CR

Ananth Shreekumar , Jyun-Jhu Syu , Muslum Ozgur Ozmen , Dongyan Xu , Z. Berkay Celik This is my paper · ORCID
classification cs.CR
keywords self-explainableAIprototypelearningfeatureimportancesecurityapplicationsmask-basedsub-featureextractionXAIdeterministicexplanationstabulardata
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that a security classifier can be built so that prediction and explanation are the same forward pass, without a separate post-hoc explainability step. Across five security datasets, XSec reports an average accuracy of 97.33% while producing deterministic, sparse feature-importance explanations. If this holds, security analysts get a model whose decision and its evidence arrive together, at a latency close to prediction alone. The paper argues that for tabular security data, self-explainability can be achieved by learning class-specific prototypes and masks that select informative sub-features.

What carries the argument

The load-bearing object is the prototype-similarity layer combined with prototype-specific binary masks. For each of $C \times k$ prototype-mask pairs, a mask selects a subset of input features, the encoder embeds the selected sub-feature, and a log-scaled inverse-distance similarity score compares the embedding to the prototype. The last layer receives only these similarity scores, with fixed weights that are positive for the prototype's own class and negative for others during joint training; a regularization term then shrinks off-class weights so that predictions rely on positive matches. The explanation is the similarity-weighted sum of masks for the top $n$ prototypes of the predicted class, making explanation and prediction the same computation.

What would settle it

Take a trained XSec model, set the off-class regularization in Equation (12) to zero, and run the feature-deduction test on samples where the predicted class changes only when off-class prototype similarity scores are altered; if those samples' top selected features fail to flip the prediction, the explanation is not capturing the decision process for the cases the paper's assumption rests on.

Watch

Extended reading notes

Core claim

XSec's central discovery is that prototype matching can serve as both the classifier and the explanation. The model learns binary masks that select informative sub-features, encodes those sub-features, and compares them with class-specific prototypes in a similarity layer; the final layer computes class probabilities from these similarity scores alone. Because predictions are determined entirely by prototype matches, the explanation is read directly off the same scores: the feature-importance vector is the similarity-weighted sum of the masks of the top matching prototypes of the predicted class. The paper demonstrates this on PDF malware, phishing websites, network intrusion, PE malware, and network attack classification, reporting an average accuracy of 97.33%, perfect run-to-run stability, and lower explanation latency than post-hoc baselines.

Load-bearing premise

The load-bearing premise is that the predicted class is fully explained by the top positive matches to that class's prototypes; the actual class probabilities also include negative evidence from other classes' prototypes, so the explanation is complete only if the regularization that suppresses off-class weights actually works.

Editorial extensions

If this is right

  • A single forward pass yields both the label and the importance weights, so explanation latency is roughly the prediction cost and no surrogate model or perturbation loop is needed.
  • Explanations are deterministic for a fixed trained model and input, avoiding the run-to-run instability of stochastic post-hoc methods; the paper measures 100% stability over two seeds.
  • The architecture transfers across security domains with different feature dimensionalities and class counts, using the same mask/prototype mechanism and swapping only the encoder architecture between an MLP and an LSTM.
  • Tuning the number of prototypes per class $k$ and the number of top matches $n$ controls a trade-off: too few prototypes collapse accuracy, while too many add noise to explanations; the paper recommends dimensionality reduction before training to keep explanations interpretable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The explanation only aggregates positive matches to the predicted class's prototypes; if a decision legitimately depends on the absence of matches to other classes, the importance score will not show that. A testable extension would augment the explanation with negative evidence from the lowest-scoring off-class prototypes and measure whether fidelity improves.
  • Because the masks are shared across all test samples for a given prototype, XSec's explanations are implicitly dataset-level as well as instance-level; inspecting which features each prototype's mask selects could yield class-characterizing fingerprints that analysts could audit before deployment.
  • The architecture's dependence on prototype count suggests a calibration procedure for a new security dataset: plot validation accuracy and explanation fidelity against $k$, and choose the smallest $k$ that keeps both high, avoiding the noise the paper observes at high $k$.
  • The paper's adversarial-perturbation results are preliminary; a stronger test would adapt white-box attacks aimed at changing the explanation while preserving the label, and the deterministic masks may be a promising target for such attacks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. XSec is a prototype-based self-explainable architecture for tabular security data. It learns C×k binary masks via a mask generator, uses an encoder to embed masked sub-features, computes similarity scores against class-specific prototypes, and maps these scores through a last linear layer to class probabilities. Explanations are produced by taking the top-n similarity scores of the predicted class and summing the corresponding masks weighted by their scores. The paper evaluates XSec on five security datasets (PDF malware, phishing, network intrusion, PE malware, network attack) against post-hoc (LIME, SHAP, LEMNA, IG, GGC, Saliency, Occlusion) and ante-hoc (ProtoPNet, Transformer, xNIDS) baselines, reporting accuracy, fidelity via three perturbation tests, sparsity (MAZ), stability, and latency. The central claim is that since the last layer only consumes prototype similarities, predictions are determined entirely by prototype matches, so explanations are directly linked to the decision process.

Significance. Prototype-based explainability has largely been developed for images; extending it to tabular security data with explicit masks and a deterministic, single-pass explanation procedure is a useful contribution. The paper ships code, hyperparameters, and ablations, and the architecture is sufficiently specified to be reimplemented. If the fidelity evaluation is made methodologically sound and the off-class evidence concern is addressed, the result would be a solid demonstration of self-explainable security analytics. The 100% stability and 3–10× latency improvement over post-hoc methods are concrete and falsifiable claims.

major comments (4)
  1. [§4.3 vs §4.1 and Algorithm 1] The manuscript contradicts itself on whether masks are generated per sample. Section 4.1 states that 'Given an input vector of length d, M generates a set of masks' and Algorithm 1 computes q = x ⊙ m, while Section 4.3 states 'all test samples use the same prototype-specific masks and prototypes; neither is generated per sample.' This ambiguity affects the central explanation procedure: if masks are fixed, M is not used at inference and the notation m in Algorithm 1 should be indexed as the fixed prototype masks; if masks are input-dependent, the explanation is not a simple weighted sum of fixed masks. Please clarify the intended behavior in the architecture description, figure, and pseudocode, and report which variant is used in the experiments.
  2. [Algorithm 1 vs Eq. (9) and Eq. (12)] The explanation w in Algorithm 1 (lines 5–6) sums masks only for the top-n prototypes of the predicted class, but classification uses the softmax over all C×k similarity scores, with the last-layer weight W^h initialized to −0.5 for off-class prototypes (Eq. 9). The paper states that Lreg (Eqs. 11–12) 'encourages predictions to rely on similarities to prototypes of the predicted class rather than on the absence of similarities to other-class prototypes,' but no evidence is provided that off-class weights are actually near zero at the end of Phase 2. Without this, the claim that 'predictions are determined entirely by prototype matches, directly linking classification and explanation' (Section 4.3) is not substantiated: the explanation omits negative evidence that may contribute to the decision. Please report the learned distribution of |W^h_{jl}| for off-class connections, the value of λ used in Eq. (12), and a counterfactual analysis (e.g., zeroing off-class similarity scores or off-class weights and measuring how often the predicted class changes).
  3. [§5.3, Figure 4] The fidelity comparison in Figure 4 does not specify which model is explained by each post-hoc baseline. For XSec, the explanation is generated for XSec's own prediction, but LIME, SHAP, IG, etc. could be explaining the tuned MLP/LSTM/CNN used as classification baselines or XSec itself. If the target model differs across methods, the fidelity tests measure different things and the comparison is not controlled. Please state explicitly which classifier each explanation method explains, and either use the same target model for all post-hoc baselines or justify why cross-model comparison is valid for the claimed conclusions.
  4. [§5.2 and Table 1] Accuracy results are reported from a single stratified train/test split with no variance estimate across seeds or folds. Given the paper's headline claim of 'minimal compromise in predictive performance' (average 97.33% across five datasets), single-point estimates are insufficient to establish that XSec's accuracy is not statistically worse than the baselines. Please report mean and standard deviation over multiple runs (at least 5 random seeds), and ideally perform a paired test comparing XSec with the strongest baseline per dataset.
minor comments (5)
  1. [Algorithm 1] The pseudocode uses m in line 1 without defining it as a collection of C×k masks. Please specify q_j = x ⊙ m_j and s_j = g_{P_j}(f(q_j)) for all j to make the elementwise operations unambiguous.
  2. [Figures 4–10] The fidelity and sparsity curves are shown without error bars or confidence bands. Adding multiple-seed variability would strengthen the quantitative comparisons.
  3. [Table 4] The table omits the xNIDS latency entry for Network Intrusion Detection, although Section 5.3 discusses xNIDS being the slowest method (7,200±600 seconds). Either include it in the table or restrict the discussion to the text.
  4. [Eq. (2)] The sentence 'Each element-wise product is minimized at 0 and 1' is slightly confusing; the penalty is minimized when each element of m_i is 0 or 1. Consider rephrasing for clarity.
  5. [Appendix B, Table 11] The table reports loss coefficients Λ for the joint objective but does not report the value of λ used in the fine-tuning objective (Eq. 12). This hyperparameter should be included for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: XSec's shared-mask design is an explicit architectural property, and its fidelity, sparsity, and latency results are evaluated against external measures.

full rationale

XSec's explanation and prediction share intermediate quantities (masks and similarity scores), but the paper does not derive any empirical result from that sharing: it constructs an architecture and evaluates it with external perturbation-based fidelity, sparsity, stability, and latency benchmarks. The claimed 'direct link' in Section 4.3 is a design property (logits are a function of similarity scores, and explanations are a similarity-weighted sum of masks), not a derivation in which a prediction reduces to its own input. Algorithm 1 does select only top-n predicted-class prototypes while classification uses all C x k similarities, and the paper relies on Lreg to shrink off-class weights without verifying that the off-class contributions are negligible; this is an unsubstantiated assumption about explanation completeness and a correctness risk, but it is not circularity because the fidelity tests can fail and do fail for various values of n and k. The paper contains no load-bearing self-citations: the cited Lipschitz continuity result and fidelity metrics come from external prior work, and the central architectural claim is self-contained. Therefore no specific circular step can be exhibited, and the appropriate finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method rests on standard deep learning machinery plus a set of tunable hyperparameters (loss coefficients, k, n, embedding dimension) and on two modeling assumptions: that security tabular features have no spatial structure, and that top-n same-class prototype masks provide a faithful explanation. No new physical or conceptual entities are introduced.

free parameters (5)
  • Loss coefficients lambda_0 through lambda_4 = Per dataset vectors, e.g., PDF malware: [1.0, 3.5, 0.8, 0.5, 0.5] (Appendix B)
    Tuned via K-fold cross-validation; the joint objective (Equation 10) depends on these weights and the paper gives no principled way to set them.
  • Number of prototypes per class k = 10 for all datasets
    Selected via K-fold CV; Table 5 shows k=3 gives degenerate performance, so the result depends on this choice.
  • Number of similarity scores n = 3 for all datasets
    Chosen because fidelity is best at n=3 (Section 5.4); the explanation content changes with n.
  • Embedding dimension = 128 for all datasets
    Set via cross-validation; affects the capacity of the prototype matching.
  • Per-dataset learning rate and batch size = e.g., 1e-3 and 256, with some datasets 5e-3 (Appendix B)
    Tuned hyperparameters reported in Appendix B; no theory determines them.
assumptions (4)
  • standard math Softmax, cross-entropy, L2 norms, and Lipschitz continuity of the encoder are used as standard loss and regularization machinery.
    Invoked in Equations 2, 5, 6, 7, 8 and the Lipschitz enforcement following [15].
  • domain assumption Security tabular features lack spatial locality and translational invariance, so CNN-based pattern extraction is unsuitable.
    Stated as design requirement C1 in Section 3 and used to justify the mask-based sub-feature extraction.
  • ad hoc to paper An explanation based only on the top-n same-class prototype similarities is faithful to the model's decision.
    Algorithm 1 lines 5-6 defines w from only the predicted class's top-n prototypes; the paper assumes this captures the decision.
  • ad hoc to paper Predictions should rely primarily on positive evidence, not on the absence of matches to other classes.
    Last-layer weights are initialized to +1 for same-class and -0.5 for off-class prototypes, and Lreg shrinks off-class weights (Section 4.4, Equations 9-12).

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Self-Explainable Deep Architecture for Security Applications." pith.science (2026). https://pith.science/paper/F2UDI4IL

@misc{pith2026260805552,
  author       = {Pith},
  title        = {Pith review of: A Self-Explainable Deep Architecture for Security Applications},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/F2UDI4IL}},
  note         = {Machine review of arXiv:2608.05552}
}
read the original abstract

Deep learning models have become integral to security applications due to their ability to model complex relationships in data and detect sophisticated threats. However, their complexity makes it difficult to understand how predictions are generated, posing significant challenges for interpretability, particularly in security applications where transparency is critical. Existing explanation methods, such as visual explanation techniques and post-hoc approaches, suffer from several limitations: reduced faithfulness due to local approximation errors, instability caused by reliance on randomness, and computational inefficiency that hinders real-time usage. To address these issues, we introduce XSec, a self-explainable deep architecture developed for security applications. During training, XSec uses a novel mask-based approach to extract informative sub-features from the data and learns prototypes, representative patterns that characterize each class. XSec then leverages the prototypes in a dedicated similarity layer at test time to compute similarity scores and generates interpretable explanations without the need for post-hoc analysis. We evaluate XSec across five diverse security scenarios, demonstrating its ability to achieve an average classification accuracy of 97.33% with minimal performance compromise. XSec produces deterministic explanations for a fixed trained model and input and substantially reduces explanation latency compared with approximation-based and perturbation-based post-hoc methods. Through this effort, we extend the applicability of self-explainable AI to security applications, bridging the gap between deep learning performance and the need for explainability in critical scenarios.

Figures

Figures reproduced from arXiv: 2608.05552 by the authors.

Figure 1
Figure 1. An overview of [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Illustration of XSEC classifying a five-dimensional sample using a seven-dimensional embedding and three prototypes per class (k = 3). Colors identify input features; embeddings and prototypes are uncolored because they reside in the learned embedding space. Lighter shading in the similarity scores indicates greater prototype-embedding similarity. Masks m Similarity scores s 0 1 0 1 Importance weights w A B p1 𝑔𝐏1 p… view at source ↗
Figure 3
Figure 3. The explanation process of XSEC. Here, the num￾ber of prototypes per class k = 3 and the number of highest similarity scores to consider n = 2. suppressing connections between prototypes and unrelated classes, we use Lreg = C ∑ l=1 ∑ pj∈/Pl |W jl h | (11) The fine-tuning objective is Llast = Lxe +λLreg (12) where λ controls the regularization strength. By shrinking off-class weights toward zero, Lreg encourages pred… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Comparison of XSEC with baseline explanation methods under three fidelity tests across all datasets. Higher PCR is better for the synthetic and feature augmentation tests; lower PCR is better for the feature deduction test. we compare XSEC against tuned neural baseline…
Figure 5
Figure 5. Figure 5: The Mean Around Zero (MAZ) sparsity curves. A steeper curve closer to 0 indicates a sparser explanation method. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The effect of hyper-parameter k (the number of prototypes per class) on the fidelity of explanations. at k = 20, the model is able to perform effectively on all three metrics. We also show the impact of k on explanation fidelity, given in [PITH_FULL_IMAGE:figures/full…
Figure 7
Figure 7. Figure 7: The effect of hyper-parameter n (the number of similarity scores to consider) on the fidelity of explanations. 10 30 50 70 90 110 130 0 50 100 PCR (%) Synthetic PDF Malware Identification 5 15 25 35 0 50 100 Website Phishing Detection 5 15 25 35 0 50 100 Network Intrus…
Figure 8
Figure 8. Figure 8: Effect of ablating loss terms on explanation fidelity. [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Impact of removing each loss term on explanation sparsity. [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Scalability analysis of the explanation fidelity (a, b, c) and sparsity (d) of [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 63 canonical work pages

  1. [1]

    Rishabh Agarwal, Levi Melnick, Nicholas Frosst, Xuezhou Zhang, Ben Lengerich, Rich Caruana, and Ge- offrey E. Hinton. Neural additive models: interpretable machine learning with neural nets. InNeural Informa- tion Processing Systems, 2021

    work page 2021

  2. [2]

    Jaakkola

    David Alvarez-Melis and Tommi S. Jaakkola. Towards robust interpretability with self-explaining neural net- works. InAdvances in Neural Information Processing Systems, 2018

    work page 2018

  3. [3]

    Tabnet: Attentive interpretable tabular learning

    Sercan Ö Arik and Tomas Pfister. Tabnet: Attentive interpretable tabular learning. InAAAI Conference on Artificial Intelligence, 2021

    work page 2021

  4. [4]

    Sok: Modeling explainability in security analytics for interpretability, trustworthiness, and usability

    Dipkamal Bhusal, Rosalyn Shin, Ajay Ashok Shewale, Monish Kumar Manikya Veerabhadran, Michael Clif- ford, Sara Rampazzi, and Nidhi Rastogi. Sok: Modeling explainability in security analytics for interpretability, trustworthiness, and usability. InInternational Confer- ence on Availability, Reliability and Security, 2023

    work page 2023

  5. [5]

    John S. Bridle. Probabilistic interpretation of feedfor- ward classification network outputs, with relationships to statistical pattern recognition. InNeurocomputing, 1990

    work page 1990

  6. [6]

    This looks like that: Deep learning for interpretable image recognition

    Chaofan Chen, Oscar Li, Daniel Tao, Alina Barnett, Cyn- thia Rudin, et al. This looks like that: Deep learning for interpretable image recognition. InAdvances in Neural Information Processing Systems, 2019

    work page 2019

  7. [7]

    Yong, and Wei King Tiong

    Kang Leng Chiew, Choon Lin Tan, KokSheik Wong, Kelvin S.C. Yong, and Wei King Tiong. A new hy- brid ensemble feature selection framework for machine learning-based phishing detection system.Information Sciences, 2019

    work page 2019

  8. [8]

    Explanations can be manipulated and geometry is to blame

    Ann-Kathrin Dombrowski, Maximillian Alber, Christo- pher Anders, Marcel Ackermann, Klaus-Robert Müller, and Pan Kessel. Explanations can be manipulated and geometry is to blame. InAdvances in Neural Informa- tion Processing Systems, 2019

    work page 2019

Show all 69 references
  1. [9]

    Concept embedding models: Beyond the accuracy-explainability trade-off.Advances in Neural Information Processing Systems, 2022

    Mateo Espinosa Zarlenga, Pietro Barbiero, Gabriele Ciravegna, Giuseppe Marra, Francesco Giannini, Michelangelo Diligenti, Zohreh Shams, Frederic Pre- cioso, Stefano Melacci, Adrian Weller, et al. Concept embedding models: Beyond the accuracy-explainability trade-off.Advances i...

    2022

  2. [10]

    Tabcbm: Concept-based interpretable neural networks for tabu- lar data.Transactions on Machine Learning Research, 2023

    Mateo Espinosa Zarlenga, Zohreh Shams, Michael Ed- ward Nelson, Been Kim, and Mateja Jamnik. Tabcbm: Concept-based interpretable neural networks for tabu- lar data.Transactions on Machine Learning Research, 2023

    2023

  3. [11]

    A lightweight, efficient and explainable-by-design convo- lutional neural network for internet traffic classification

    Kevin Fauvel, Fuxing Chen, and Dario Rossi. A lightweight, efficient and explainable-by-design convo- lutional neural network for internet traffic classification. InACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2023

    2023

  4. [12]

    Fong and Andrea Vedaldi

    Ruth C. Fong and Andrea Vedaldi. Interpretable ex- planations of black boxes by meaningful perturbation. InIEEE International Conference on Computer Vision, 2017

    2017

  5. [13]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. InarXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  6. [14]

    right to explanation

    Bryce Goodman and Seth Flaxman. European union regulations on algorithmic decision making and a “right to explanation”. InAI Magazine, 2017

    2017

  7. [15]

    Henry Gouk, Eibe Frank, Bernhard Pfahringer, and Michael J. Cree. Regularisation of neural networks by enforcing lipschitz continuity. InMachine Learning, 2021

    2021

  8. [16]

    Lemna: Explaining deep learn- ing based security applications

    Wenbo Guo, Dongliang Mu, Jun Xu, Purui Su, Gang Wang, and Xinyu Xing. Lemna: Explaining deep learn- ing based security applications. InACM SIGSAC Confer- ence on Computer and Communications Security, 2018

    2018

  9. [17]

    Lemna: Explaining deep learn- ing based security applications

    Wenbo Guo, Dongliang Mu, Jun Xu, Purui Su, Gang Wang, and Xinyu Xing. Lemna: Explaining deep learn- ing based security applications. https://github. com/Henrygwb/Explaining-DL, 2018. Accessed: 2025-04-08

    2018

  10. [18]

    Evaluation and improvement of interpretability for self- explainable part-prototype networks

    Qihan Huang, Mengqi Xue, Wenqi Huang, Haofei Zhang, Jie Song, Yongcheng Jing, and Mingli Song. Evaluation and improvement of interpretability for self- explainable part-prototype networks. InIEEE/CVF In- ternational Conference on Computer Vision, 2023

    2023

  11. [19]

    An interpretable prototype parts-based neural network for medical tabular data

    Jerzy Stefanowski Jacek Karolczak. An interpretable prototype parts-based neural network for medical tabular data. InSecond Workshop on Explainable Artificial Intelligence for the Medical Domain, 2025

    2025

  12. [20]

    Protogate: Prototype-based neural networks with global-to-local feature selection for tab- ular biomedical data

    Xiangjian Jiang, Andrei Margeloiu, Nikola Simidjievski, and Mateja Jamnik. Protogate: Prototype-based neural networks with global-to-local feature selection for tab- ular biomedical data. InInternational Conference on Machine Learning, 2024

    2024

  13. [21]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. InInternational Conference on Learning Representations, 2015

    2015

  14. [22]

    Pantypes: Diverse representatives for self- explainable models

    Rune Kjærsgaard, Ahcene Boubekki, and Line Clem- mensen. Pantypes: Diverse representatives for self- explainable models. InAAAI Conference on Artificial Intelligence, 2024

    2024

  15. [23]

    Concept bottleneck models

    Pang Wei Koh, Thao Nguyen, Yew Siang Tang, Stephen Mussmann, Emma Pierson, et al. Concept bottleneck models. InInternational Conference on Machine Learn- ing, 2020

    2020

  16. [24]

    Howard, Wayne Hubbard, and Lawrence Jackel

    Yann LeCun, Bernhard Boser, John Denker, Donnie Henderson, R. Howard, Wayne Hubbard, and Lawrence Jackel. Handwritten digit recognition with a back- propagation network. InNeural Information Processing Systems, 1989

    1989

  17. [25]

    Deep learning for case-based reasoning through proto- types: A neural network that explains its predictions

    Oscar Li, Hao Liu, Chaofan Chen, and Cynthia Rudin. Deep learning for case-based reasoning through proto- types: A neural network that explains its predictions. In AAAI Conference on Artificial Intelligence, 2018

    2018

  18. [26]

    Shap: Shapley addi- tive explanations

    Scott Lundberg and Su-In Lee. Shap: Shapley addi- tive explanations. https://github.com/shap/shap,

  19. [27]

    Lundberg and Su-In Lee

    Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. InInternational Confer- ence on Neural Information Processing Systems, 2017

    2017

  20. [28]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

    2018

  21. [29]

    Explainable artificial intelligence: a compre- hensive review.Artificial Intelligence Review, 2022

    Dang Minh, H Xiang Wang, Y Fen Li, and Tan N Nguyen. Explainable artificial intelligence: a compre- hensive review.Artificial Intelligence Review, 2022

    2022

  22. [30]

    Security is not my field, i’m a stats guy: A qualitative root cause analysis of barriers to adversarial machine learning defenses in industry

    Jaron Mink, Harjot Kaur, Juliane Schmüser, Sascha Fahl, and Yasemin Acar. Security is not my field, i’m a stats guy: A qualitative root cause analysis of barriers to adversarial machine learning defenses in industry. In USENIX Security Symposium, 2023

    2023

  23. [31]

    Big data analytics for intrusion detection system: Statistical decision-making using finite dirichlet mixture models

    Nour Moustafa, Gideon Creech, and Jill Slay. Big data analytics for intrusion detection system: Statistical decision-making using finite dirichlet mixture models. InData Analytics and Decision Support for Cybersecu- rity: Trends, Methodologies and Applications, 2017

    2017

  24. [32]

    Unsw-nb15: a compre- hensive dataset for network intrusion detection systems (unsw-nb15 network dataset)

    Nour Moustafa and Jill Slay. Unsw-nb15: a compre- hensive dataset for network intrusion detection systems (unsw-nb15 network dataset). InMilitary Communica- tions and Information Systems Conference, 2015

    2015

  25. [33]

    The evaluation of network anomaly detection systems: Statistical analysis of the unsw-nb15 dataset and the comparison with the kdd99 dataset

    Nour Moustafa and Jill Slay. The evaluation of network anomaly detection systems: Statistical analysis of the unsw-nb15 dataset and the comparison with the kdd99 dataset. InInformation Security Journal: A Global Perspective, 2016

    2016

  26. [34]

    Novel geometric area analysis technique for anomaly detec- tion using trapezoidal area estimation on large-scale networks

    Nour Moustafa, Jill Slay, and Gideon Creech. Novel geometric area analysis technique for anomaly detec- tion using trapezoidal area estimation on large-scale networks. InIEEE Transactions on Big Data, 2019

    2019

  27. [35]

    Neu- ral prototype trees for interpretable fine-grained image recognition

    Meike Nauta, Ron van Bree, and Christin Seifert. Neu- ral prototype trees for interpretable fine-grained image recognition. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021

    2021

  28. [36]

    Pytorch: an imperative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, et al. Pytorch: an imperative style, high-performance deep learning library. InInter- national Conference on Neural Information Processing Systems, 2019

    2019

  29. [37]

    Captum: Model in- terpretability for pytorch

    Captum Source Repository. Captum: Model in- terpretability for pytorch. https://github.com/ pytorch/captum, 2019. Accessed: 2025-04-08

    2019

  30. [38]

    Lime: Local interpretable model-agnostic explanations

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Lime: Local interpretable model-agnostic explanations. https://github.com/marcotcr/lime,

  31. [39]

    why should i trust you?

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. "why should i trust you?": Explaining the predictions of any classifier. InACM SIGKDD Interna- tional Conference on Knowledge Discovery and Data Mining, 2016

    2016

  32. [40]

    Interpretable image classification with differ- entiable prototypes assignment

    Dawid Rymarczyk, Lukasz Struski, Michal Górszczak, Koryna Lewandowska, Jacek Tabor, and Bartosz Zieli´nski. Interpretable image classification with differ- entiable prototypes assignment. InEuropean Confer- ence on Computer Vision, 2022

    2022

  33. [41]

    Protopshare: Prototypical parts shar- ing for similarity discovery in interpretable image clas- sification

    Dawid Rymarczyk, Lukasz Struski, Jacek Tabor, and Bartosz Zieli´nski. Protopshare: Prototypical parts shar- ing for similarity discovery in interpretable image clas- sification. InACM SIGKDD Conference on Knowledge Discovery & Data Mining, 2021

    2021

  34. [42]

    Evaluating the visualization of what a deep neural net- work has learned.IEEE Transactions on Neural Net- works and Learning Systems, 2017

    Wojciech Samek, Alexander Binder, Grégoire Mon- tavon, Sebastian Lapuschkin, and Klaus-Robert Müller. Evaluating the visualization of what a deep neural net- work has learned.IEEE Transactions on Neural Net- works and Learning Systems, 2017

    2017

  35. [43]

    Self-supervised interpretable concept-based models for text classification

    Francesco De Santis, Philippe Bich, Gabriele Ciravegna, Pietro Barbiero, Danilo Giordano, and Tania Cerquitelli. Self-supervised interpretable concept-based models for text classification. InarXiv preprint arXiv:2406.14335, 2024

    2024 arXiv

  36. [44]

    Netflow datasets for machine learning-based network intrusion detection systems

    Mohanad Sarhan, Siamak Layeghy, Nour Moustafa, and Marius Portmann. Netflow datasets for machine learning-based network intrusion detection systems. In Big Data Technologies and Applications, 2021

    2021

  37. [45]

    Towards a standard feature set for network intru- sion detection system datasets

    Mohanad Sarhan, Siamak Layeghy, and Marius Port- mann. Towards a standard feature set for network intru- sion detection system datasets. InMobile Networks and Applications, 2022

    2022

  38. [46]

    Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, et al

    Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, et al. Grad- cam: Visual explanations from deep networks via gradient-based localization. InInternational Confer- ence on Computer Vision, 2017

    2017

  39. [47]

    On the robustness of domain constraints

    Ryan Sheatsley, Blaine Hoak, Eric Pauley, Yohan Beu- gin, Michael Weisman, and Patrick McDaniel. On the robustness of domain constraints. InACM SIGSAC Conference on Computer and Communications Security, 2021

    2021

  40. [48]

    Krishnan

    Jacob Si, Wendy Yusi Cheng, Michael Cooper, and Rahul G. Krishnan. Interpretabnet: distilling predictive signals from tabular data by salient feature interpreta- tion. InInternational Conference on Machine Learning, 2024

    2024

  41. [49]

    Deep inside convolutional networks: Visualising image classification models and saliency maps

    Karen Simonyan, Andrea Vedaldi, and Andrew Zisser- man. Deep inside convolutional networks: Visualising image classification models and saliency maps. InIn- ternational Conference on Learning Representations, 2014

    2014

  42. [50]

    Fooling lime and shap: Ad- versarial attacks on post hoc explanation methods

    Dylan Slack, Sophie Hilgard, Emily Jia, Sameer Singh, and Himabindu Lakkaraju. Fooling lime and shap: Ad- versarial attacks on post hoc explanation methods. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, 2020

    2020

  43. [51]

    Smoothgrad: re- moving noise by adding noise

    Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenberg. Smoothgrad: re- moving noise by adding noise. InarXiv preprint arXiv:1706.03825, 2017

    2017 arXiv

  44. [52]

    Malicious pdf de- tection using metadata and structural features

    Charles Smutz and Angelos Stavrou. Malicious pdf de- tection using metadata and structural features. InAnnual Computer Security Applications Conference, 2012

    2012

  45. [53]

    Striving for simplicity: The all convolutional net

    Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin Riedmiller. Striving for simplicity: The all convolutional net. InInternational Conference on Learning Representations, 2015

    2015

  46. [54]

    Practical evasion of a learning-based classifier: A case study

    Nedim Srndic and Pavel Laskov. Practical evasion of a learning-based classifier: A case study. InIEEE Sympo- sium on Security and Privacy, 2014

    2014

  47. [55]

    Ax- iomatic attribution for deep networks

    Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Ax- iomatic attribution for deep networks. InInternational Conference on Machine Learning, 2017

    2017

  48. [56]

    Ghorbani

    Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A. Ghorbani. A detailed analysis of the kdd cup 99 data set. InIEEE Symposium on Computational Intelligence for Security and Defense Applications, 2009

    2009

  49. [57]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Ł ukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in Neural Information Processing Systems, 2017

    2017

  50. [58]

    Interpretable image recognition by constructing trans- parent embedding space

    Jiaqi Wang, Huafeng Liu, Xinyue Wang, and Liping Jing. Interpretable image recognition by constructing trans- parent embedding space. InIEEE/CVF International Conference on Computer Vision, 2021

    2021

  51. [59]

    Evaluating explanation methods for deep learning in security

    Alexander Warnecke, Daniel Arp, Christian Wressneg- ger, and Konrad Rieck. Evaluating explanation methods for deep learning in security. InIEEE European Sympo- sium on Security and Privacy (EuroS&P), 2020

    2020

  52. [60]

    xnids: Explaining deep learning-based network intrusion detection systems for active intrusion responses

    Feng Wei, Hongda Li, Ziming Zhao, and Hongxin Hu. xnids: Explaining deep learning-based network intrusion detection systems for active intrusion responses. In USENIX Security Symposium, 2023

    2023

  53. [61]

    xnids: Explaining deep learning-based network intru- sion detection systems for active intrusion responses

    Feng Wei, Hongda Li, Ziming Zhao, and Hongxin Hu. xnids: Explaining deep learning-based network intru- sion detection systems for active intrusion responses. https://github.com/CactiLab/code-xNIDS, 2023. Accessed: 2025-04-08

    2023

  54. [62]

    Bodmas: An open dataset for learning based temporal analysis of pe malware

    Limin Yang, Arridhana Ciptadi, Ihar Laziuk, Ali Ah- madzadeh, and Gang Wang. Bodmas: An open dataset for learning based temporal analysis of pe malware. In 4th Deep Learning and Security Workshop, 2021

    2021

  55. [63]

    Cade: Detecting and ex- plaining concept drift samples for security applications

    Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Cip- tadi, Ali Ahmadzadeh, et al. Cade: Detecting and ex- plaining concept drift samples for security applications. InUSENIX Security Symposium, 2021

    2021

  56. [64]

    Renos Zabounidis, Joseph Campbell, Simon Stepputtis, Dana Hughes, and Katia P. Sycara. Concept learning for interpretable multi-agent reinforcement learning. In Conference on Robot Learning, 2023

    2023

  57. [65]

    Concept embedding models: Beyond the accuracy- explainability trade-off

    Mateo Espinosa Zarlenga, Pietro Barbiero, Gabriele Ciravegna, Giuseppe Marra, Francesco Giannini, et al. Concept embedding models: Beyond the accuracy- explainability trade-off. InAdvances in Neural Informa- tion Processing Systems, 2022

    2022

  58. [66]

    Zeiler and Rob Fergus

    Matthew D. Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. InEuropean Conference on Computer Vision, 2014

    2014

  59. [67]

    Interpretable deep learning under fire

    Xinyang Zhang, Ningfei Wang, Hua Shen, Shouling Ji, Xiapu Luo, and Ting Wang. Interpretable deep learning under fire. InUSENIX Security Symposium, 2020

    2020

  60. [68]

    Zintgraf, Taco S

    Luisa M. Zintgraf, Taco S. Cohen, Tameem Adel, and Max Welling. Visualizing deep neural network deci- sions: Prediction difference analysis. InInternational Conference on Learning Representations, 2017. A Details of Datasets Here we present details of the datasets we use for e...

    2017

  61. [2016]

    Accessed: 2025-04-08

    2025

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.