Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Towards Robust and Accurate Stability Estimation of Local Surrogate Models in Text-based Explainable AI

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LIME's apparent instability across adversarial text examples is largely a side effect of overly sensitive similarity measures, and synonymity-weighted versions of those measures give a more accurate picture of robustness.

desk verdict Useful sensitivity map for text-XAI similarity measures, but the 'more accurate' synonymity-weighting claim rests on a circular embedding choice and an unvalidated semantic assumption. read the letter →

arxiv 2501.02042 v1 pith:7FCUSD77 submitted 2025-01-03 cs.LG cs.CR

Christopher Burger , Charles Walter , Thai Le , Lingwei Chen This is my paper · ORCID
classification cs.LGcs.CR
keywords explainableAIadversarialattacksonXAILIMEstabilitysimilaritymeasuresrankedlistssynonymityweightingtextclassificationGloVeembeddings
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the similarity measure used to score adversarial text attacks on local surrogate explainers like LIME is a primary driver of reported instability, not a neutral meter. It shows that rank-sensitive measures such as Kendall's tau treat small synonym substitutions as near-total explanation failure, producing attack success rates close to 100 percent even when the original and perturbed documents remain semantically close. It then introduces synonymity weighting, in which each replaced word contributes cosine similarity to its replacement rather than strict equality, and reports that weighted versions of Jaccard and Spearman drop most attack successes to zero or near zero. The intended upshot is that prior estimates of LIME's vulnerability on text are inflated by the choice of measure, and that practitioners should calibrate sensitivity or adopt weighted measures before judging an XAI method weak.

What carries the argument

The carrying mechanism is a synonymity function $\mathrm{Syn}(a,b)$, defined as the cosine similarity between GloVe word vectors for the original feature and its replacement, constrained to $\mathrm{Syn}(x,x)=1$, embedded into rank-list measures through a mapping from each perturbed word back to its original. Applied to Jaccard, it replaces the strict intersection numerator with a sum of pairwise synonymity scores; applied to Kendall's tau it scales a dissonant pair's penalty by $1-\mathrm{Syn}(a,b)$; applied to Spearman's footrule it divides the positional distance by $\mathrm{Syn}(a,b)$ up to the maximum footrule distance; and applied to RBO it enlarges each depth-$d$ intersection by the synonymity of mapped disjoint pairs. This softens the discontinuity between a word and a near-synonym, and it is what turns many reported attack successes into failures.

What would settle it

Recompute the synonymity weighting with an independent semantic scoring source, for example a thesaurus-based synonymy relation or a contextual embedding model not used to generate the candidate replacements, on the same GB and S2D attack batches. If attack success rates under the weighted measures return to near their unweighted levels, the reported accuracy gain is an artifact of GloVe cosine similarity rather than a true reflection of semantic preservation.

Watch

Extended reading notes

Core claim

The paper's central claim is that many standard similarity measures for ranked lists are overly sensitive for text-based adversarial XAI, and this sensitivity, not the surrogate itself, accounts for most apparent instability. Experimentally, the same greedy attack against LIME explanations on two text datasets with a DistilBERT classifier is scored under nine measures: Kendall's tau reports near-certain attack success at every threshold, Jaccard and Spearman rise to near-certain success at high similarity thresholds, while RBO gives moderate rates. When the same attacks are rescored with synonymity-weighted variants, Jaccard and Spearman success collapses, leading the authors to state that conclusions about XAI instability drawn with unweighted Jaccard or Spearman should be viewed with suspicion. Kendall remains too sensitive even weighted, and RBO's own depth weighting already absorbs much of the synonymity effect.

Load-bearing premise

The load-bearing premise is that GloVe cosine similarity between a replaced word and its replacement is a valid measure of whether the explanation's meaning actually stayed the same, and that using the same embeddings to choose replacements and to score them does not systematically bias the result.

Editorial extensions

If this is right

  • Reanalyzing prior adversarial-text-XAI results with synonymity-weighted Jaccard or Spearman can convert many reported successes into failures, so published instability rates for LIME should be re-examined before being used to disqualify the method.
  • Kendall's tau, even in weighted form, remains too sensitive for text XAI stability work and should not be trusted for attack-success judgments.
  • RBO with $p = 0.7$ or $p = 0.9$ is the most defensible standard measure: it changes little under synonymity weighting, indicating its depth-based weighting already compensates for the sensitivity problem.
  • Synonymity weighting costs negligible computation because explanation generation dominates, so adopting a weighted measure does not slow the adversarial pipeline.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same measure-sensitivity problem should appear outside text: any XAI stability evaluation that scores explanations as discrete feature lists will overstate instability when deletion or replacement changes token identity but not meaning, so synonymity or perceptual-similarity weighting is a general remedy rather than a text-only one.
  • Because the attack's replacement selection and the synonymity score both use GloVe cosine similarity, a circularity check is missing: the weighted measure may simply reward the search for choosing words close in the same embedding space, and a human rating study or a thesaurus-based synonymy function would separate semantic preservation from embedding-space proximity.
  • The paper's Limitations section concedes that transferability to other XAI methods, untested measures, and better synonymity estimates are open; the accuracy result should therefore be read as conditional on GloVe-based cosine synonymity and on LIME-style ranked lists.
  • A practical testable extension is to choose the success threshold $\tau$ per measure based on the measure's own sensitivity, so that a random synonym substitution is not automatically classified as a success; calibrating thresholds this way would make cross-measure robustness comparisons meaningful.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript studies how the choice of similarity measure affects estimates of adversarial stability for LIME explanations on text. The authors run a greedy perturbation search over two text datasets under nine ranked-list similarity measures and four success thresholds, and they report attack success rates for each combination. They then propose synonymity-weighted variants of Jaccard, Kendall, Spearman, and RBO, scoring substituted words by GloVe cosine similarity, and show that weighting dramatically lowers the reported attack success rates for Jaccard and Spearman. Their descriptive claim is that standard measures disagree strongly — Kendall appears nearly always 'successful' while Jaccard and RBO0.9 are very conservative. Their prescriptive claim is that the weighted measures give 'more accurate estimates' of the true weakness of XAI methods to adversarial examples.

Significance. If the accuracy claim were supported, this would be a useful methodological contribution to adversarial text-XAI evaluation: it would show that rank-list measures can overstate instability and that synonymity-aware variants are preferable. The descriptive comparison is the paper's real strength: Tables 2 and 3 show cleanly that the choice of measure can move attack success rates from near zero to near one, and the experimental protocol is described in enough detail to be replicated. The Limitations section is candid about several threats to generality. However, the central 'more accurate' claim currently lacks an external semantic ground truth; the only evidence is the weighted measures' own reduction in success rates, and the synonymity function appears to come from the same embedding family used in perturbation search. The paper is therefore best viewed as a solid sensitivity study whose validity conclusion needs additional support or careful reframing.

major comments (3)
  1. [§3.2, Eq. (2); §3.4; §4.5, Eq. (6)] The central claim that synonymity weighting yields 'more accurate estimates' is not externally grounded. Section 4.6 defines Syn as cosine similarity on the GloVe Twitter 27B-25d embedding, while Section 3.1 says perturbations are chosen as the n nearest neighbors in 'some embedding space' without naming it. If that embedding space is GloVe, then a replacement is selected precisely because its GloVe cosine to the original word is high, and it is then scored as highly similar by the same function; the reductions in attack success in Table 3 are then partly a self-consistency artifact, not evidence of semantic accuracy. The Limitations section itself concedes that 'superior estimates of synonymity can probably be obtained with alternative methods.' To support the abstract's 'more accurate estimates,' the authors should either specify the perturbation embedding and show it is independent of the evaluation embedding, or validate the weighted measures against human judgments of meaning preservation, an independent contextual-embedding baseline such as BERTScore, or another external criterion. Without such validation, the paper can claim a measure-sensitivity effect but not accuracy.
  2. [§3.2, Eq. (2); §3.4; §4.5, Eq. (6)] Equation (2) is not Kendall's tau. The prose says the measure 'counts the number of pairwise inversions,' but the displayed formula sums position mismatches, 1[A[i] ≠ B[i]], plus a size-difference term. That is a Hamming distance over aligned positions, not the number of discordant pairs. Because the near-100% attack success rates for 'Kendall' in Table 2 and the sensitivity conclusions in Section 3.4 are based on this misdefined statistic, the authors should re-run the analysis with the true Kendall tau distance or rename the measure consistently. The weighted extension in Eq. (6) inherits the same problem, so the 'Kendall w' results in Table 2 should also be revisited.
  3. [§4.2, §4.5, Eqs. (5) and (7)] The weighted measure definitions are incomplete for two cases that occur in the reported experiments. Section 4.2 says that elements in A may be mapped to the null mapping, but Eq. (5) evaluates Syn(A[i], M(A[i])) with no branch for Syn(a, null), so the numerator is undefined for disjoint elements. In Eq. (7), the term |i−j|/Syn(a,b) divides by Syn(a,b); the paper constrains Syn to [0,1] but gives no rule for converting raw GloVe cosine values, which can be negative or zero, into this interval, and a zero synonymity score would make the quotient undefined. Because the Jaccard-w and Spearman-w results in Table 3 depend on these unspecified choices, the implementation is not fully reproducible as written. Please add explicit penalty branches for null mappings and a clamping or rescaling rule for Syn.
minor comments (5)
  1. [§3.1] The phrase 'some embedding space' is needlessly vague and is directly relevant to the circularity concern; please name the embedding used for nearest-neighbor perturbation generation.
  2. [§4.6] There are typos in this section: 'Jaccad Index' should be 'Jaccard Index,' and 'synonymity weighting„' contains a stray double comma.
  3. [§4.5, Eq. (6)] In Eq. (6), the variables a and b in the summation are not bound; they should be A[i] and B[i] to match the indicator and the penalty term.
  4. [§3.3, Tables 2–3] The attack-success rates are reported without confidence intervals or the raw counts from which they are computed; given that each batch consists of 50 examples, reporting counts or intervals would help readers judge the stability of the rates.
  5. [§4.7] The discussion of RBO says 'the lack of overall success associated with RBO0.9 makes a firm judgment on its usefulness premature'; this is appropriately cautious, but the same caution is not consistently applied to the weighted Jaccard and Spearman results, which are discussed as demonstrating inaccuracy of the base measures.

Circularity Check

1 steps flagged · score 6.0 of 10

The 'more accurate estimates' claim is self-referential: synonymity-weighted measures are constructed from the same GloVe synonymity function used as the criterion of semantic preservation, so the observed drop in attack success is partly built into the definitions.

  1. self definitional [Abstract; Section 4.5 Eq. (5); Section 4.6; Section 4.7 (Jaccard & Spearman discussion)]
    "We then propose a weighting scheme for text-based data that incorporates the synonymity between the features within an explanation, providing more accurate estimates of the actual weakness of XAI methods to adversarial examples. ... JW (A, B) = |A|X i=1 Syn(A[i], M(A[i])) / |A ∪ B| (5) ... The method used to determine feature synonymity is cosine similarity on the GloVe Twitter 27B-25d embedding. ..."

    Eq. (5) defines weighted Jaccard by summing Syn values for mapped pairs, so any replacement with Syn>0 increases similarity relative to strict equality by construction; Eq. (6) and Eq. (7) similarly damp dissonance by 1−Syn or divide distance by Syn. The reported collapse of attack success under Jaccardw/Spearmanw is thus an analytic consequence of the weighting definitions whenever the generator proposes positively similar substitutes, not an independent test of semantic accuracy. The 'more accurate' conclusion then uses GloVe cosine (Syn) as the ground truth for 'fundamental meaning,' but no human rating, independent embedding, or behavioral benchmark validates that equation.

full rationale

The descriptive part of the paper is non-circular and useful: success rates genuinely depend on the chosen similarity measure (Table 3), and the observation that Kendall- and Jaccard-style rankings are highly sensitive is an empirical fact about those rulers. The circularity enters only when the paper upgrades the weighted measures to 'more accurate estimates of actual weakness.' The weighted measures are constructed so that synonym pairs contribute higher similarity, and the attack generator already targets replacements that are close in an embedding space; re-scoring with a synonymity function from the same family therefore guarantees lower success rates without establishing that the standard measures were wrong about semantic content. The Limitations section itself concedes 'Superior estimates of synonymity can probably be obtained with alternative methods,' underscoring that the chosen Syn is not independently grounded. The self-citations to Burger et al. (2023) supply the perturbation algorithm and datasets, not the contested accuracy claim, so they are not load-bearing. Overall, a partial circularity in the central accuracy claim warrants a 6 rather than a higher score because the sensitivity comparisons retain independent empirical content.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

No fitted constants are estimated from the target data; the method's behavior is controlled by the chosen thresholds, RBO p values, penalty values, and especially the GloVe-based synonymity function. The main load-bearing choices are the ranked-list abstraction, the single-word substitution mapping, and the assumption that GloVe cosine similarity is ground-truth synonymity. No new physical or conceptual entities are introduced.

free parameters (4)
  • RBO persistence p = 0.5, 0.7, 0.9
    The rank-biased overlap measure requires choosing how quickly weights decay down the list; the paper compares three values, and RBO conclusions depend on this choice.
  • Attack success threshold tau = 0.3, 0.4, 0.5, 0.6
    A perturbation is called an attack only if the measured similarity falls below tau; the reported success rates are threshold-dependent.
  • Spearman disjoint penalty p = not specified
    Weighted Spearman's footrule needs a penalty for unpaired elements; the paper says variations changed results by at most 5 percent but never reports the value used.
  • Synonymity function Syn = GloVe Twitter 27B-25d cosine similarity
    This function defines the weighted measures; the accuracy of the stability estimate is wholly determined by this choice, with no target-domain fitting or external validation.
assumptions (3)
  • domain assumption Explanation similarity for XAI stability can be modeled as similarity of ranked lists of words
    Throughout, explanations are treated as ordered feature lists; the entire measure comparison assumes this representation.
  • domain assumption Each perturbation replaces at most one word, so every original feature maps to one perturbed feature or to null
    Section 4.2 states this restriction explicitly; multi-word substitutions are excluded from the framework.
  • ad hoc to paper GloVe cosine similarity is a sufficient proxy for synonymity between explanation features
    Section 4.6 selects GloVe Twitter 27B-25d for Syn; the paper's Limitations admit better synonymity estimates may exist, and no independent evidence is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Robust and Accurate Stability Estimation of Local Surrogate Models in Text-based Explainable AI." pith.science (2026). https://pith.science/paper/7FCUSD77

@misc{pith2026250102042,
  author       = {Pith},
  title        = {Pith review of: Towards Robust and Accurate Stability Estimation of Local Surrogate Models in Text-based Explainable AI},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7FCUSD77}},
  note         = {Machine review of arXiv:2501.02042}
}
read the original abstract

Recent work has investigated the concept of adversarial attacks on explainable AI (XAI) in the NLP domain with a focus on examining the vulnerability of local surrogate methods such as Lime to adversarial perturbations or small changes on the input of a machine learning (ML) model. In such attacks, the generated explanation is manipulated while the meaning and structure of the original input remain similar under the ML model. Such attacks are especially alarming when XAI is used as a basis for decision making (e.g., prescribing drugs based on AI medical predictors) or for legal action (e.g., legal dispute involving AI software). Although weaknesses across many XAI methods have been shown to exist, the reasons behind why remain little explored. Central to this XAI manipulation is the similarity measure used to calculate how one explanation differs from another. A poor choice of similarity measure can lead to erroneous conclusions about the stability or adversarial robustness of an XAI method. Therefore, this work investigates a variety of similarity measures designed for text-based ranked lists referenced in related work to determine their comparative suitability for use. We find that many measures are overly sensitive, resulting in erroneous estimates of stability. We then propose a weighting scheme for text-based data that incorporates the synonymity between the features within an explanation, providing more accurate estimates of the actual weakness of XAI methods to adversarial examples.

Figures

Figures reproduced from arXiv: 2501.02042 by the authors.

Figure 1
Figure 1. Successful attack rates under threshold τ for standard and synonymity weighted explanations (Base Measure (Blue) - Synonymity Weighted Measure (Orange)) τ Jaccard Kendall Spearman RBO0.5 RBO0.7 RBO0.9 Base Synw Base Synw Base Synw Base Synw Base Synw Base Synw 30% 0.02 0 0.95 0.88 0.14 0 0.12 0.10 0 0 0 0 GB 40% 0.24 0 0.98 0.90 0.38 0 0.26 0.17 0.07 0.05 0 0 50% 0.88 0 1 0.86 0.83 0.02 0.40 0.40 0.28 0.14 0.07 0 60… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Explainable Knowledge Graph Retrieval-Augmented Generation (KG-RAG) with KG-SMILE

    cs.AI 2025-09 reject novelty 4.0 of 10

    KG-SMILE applies perturbation and linear regression to a knowledge graph to attribute which entities and relations drive a GraphRAG system's answers.

Reference graph

Works this paper leans on

23 extracted references · 10 canonical work pages · cited by 1 Pith paper

  1. [1]

    David Alvarez-Melis and Tommi S Jaakkola. 2018. https://arxiv.org/abs/1806.08049 On the robustness of interpretability methods . ICML Workshop on Human Interpretability in Machine Learning (WHI 2018)

    arXiv 2018

  2. [2]

    Christopher Burger, Lingwei Chen, and Thai Le. 2023. `` A re Y our E xplanations R eliable?" I nvestigating the S tability of LIME in E xplaining T ext C lassifiers by M arrying XAI and A dversarial A ttack. In The 2023 Conference on Empirical Methods in Natural Language Processing

    work page 2023

  3. [3]

    Emily Dinan, Angela Fan, Ledell Wu, Jason Weston, Douwe Kiela, and Adina Williams. 2020. https://doi.org/10.18653/v1/2020.emnlp-main.23 Multi-dimensional gender bias classification . In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 314--331, Online. Association for Computational Linguistics

    doi:10.18653/v1/2020.emnlp-main.23 2020

  4. [4]

    Shi Dong, Ping Wang, and Khushnood Abbas. 2021. A survey on deep learning and its applications. Computer Science Review, 40:100379

    work page 2021

  5. [5]

    Rudresh Dwivedi, Devam Dave, Het Naik, Smiti Singhal, Rana Omer, Pankesh Patel, Bin Qian, Zhenyu Wen, Tejal Shah, Graham Morgan, et al. 2023. Explainable ai (xai): Core ideas, techniques, and solutions. ACM Computing Surveys, 55(9):1--33

    work page 2023

  6. [6]

    Jordan D Fuhrman, Naveena Gorre, Qiyuan Hu, Hui Li, Issam El Naqa, and Maryellen L Giger. 2022. A review of explainable and interpretable ai with applications in covid-19 imaging. Medical Physics, 49(1):1--14

    work page 2022

  7. [7]

    Damien Garreau and Ulrike Luxburg. 2020. https://proceedings.mlr.press/v108/garreau20a.html Explaining the explainer: A first theoretical analysis of LIME . In International Conference on Artificial Intelligence and Statistics, pages 1287--1296. PMLR

    work page 2020

  8. [8]

    Damien Garreau and Ulrike von Luxburg. 2020. https://arxiv.org/abs/2008.11092 Looking deeper into tabular LIME . arXiv preprint arXiv:2008.11092

    arXiv 2020

Show all 23 references
  1. [9]

    Amirata Ghorbani, Abubakar Abid, and James Zou. 2019. https://doi.org/10.1609/aaai.v33i01.33013681 Interpretation of neural networks is fragile . In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 3681--3688

    2019 doi

  2. [10]

    Alex Gramegna and Paolo Giudici. 2021. Shap and lime: an evaluation of discriminative power in credit risk. Frontiers in Artificial Intelligence, 4:752558

    2021

  3. [11]

    Riccardo Guidotti, Anna Monreale, Salvatore Ruggieri, Franco Turini, Fosca Giannotti, and Dino Pedreschi. 2018. A survey of methods for explaining black box models. ACM computing surveys (CSUR), 51(5):1--42

    2018

  4. [12]

    Adam Ivankay, Ivan Girardi, Chiara Marchiori, and Pascal Frossard. 2022. https://arxiv.org/abs/2206.03178 Fooling explanations in text classifiers . International Conference on Learning Representations (ICLR)

    2022 arXiv

  5. [13]

    Nesaretnam Barr Kumarakulasinghe, Tobias Blomberg, Jintai Liu, Alexandra Saraiva Leao, and Panagiotis Papapetrou. 2020. Evaluating local interpretable model-agnostic explanations on clinical machine learning classification models. In 2020 IEEE 33rd International Symposium on C...

    2020

  6. [14]

    Dina Mardaoui and Damien Garreau. 2021. http://proceedings.mlr.press/v130/mardaoui21a.html An analysis of LIME for text data . In International Conference on Artificial Intelligence and Statistics, pages 3493--3501. PMLR

    2021

  7. [15]

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2016. https://doi.org/10.1145/2939672.2939778 `` W hy should I trust you?'' E xplaining the predictions of any classifier . In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mi...

    2016

  8. [16]

    Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019. https://arxiv.org/abs/1910.01108 Distil BERT , a distilled version of BERT : smaller, faster, cheaper and lighter . arXiv preprint arXiv:1910.01108

    2019 arXiv

  9. [17]

    Sanchit Sinha, Hanjie Chen, Arshdeep Sekhon, Yangfeng Ji, and Yanjun Qi. 2021. Perturbing inputs for fragile interpretations in deep natural language processing. arXiv preprint arXiv:2108.04990

    2021 arXiv

  10. [18]

    Dylan Slack, Sophie Hilgard, Emily Jia, Sameer Singh, and Himabindu Lakkaraju. 2020. https://doi.org/10.1145/3375627.3375830 Fooling LIME and SHAP : Adversarial attacks on post hoc explanation methods . In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, page...

    2020

  11. [19]

    Erico Tjoa and Cuntai Guan. 2020. A survey on explainable artificial intelligence (xai): Toward medical xai. IEEE transactions on neural networks and learning systems, 32(11):4793--4813

    2020

  12. [20]

    Sahil Verma, Varich Boonsanong, Minh Hoang, Keegan E Hines, John P Dickerson, and Chirag Shah. 2020. Counterfactual explanations and algorithmic recourses for machine learning: A review. arXiv preprint arXiv:2010.10596

    2020 arXiv

  13. [21]

    William Webber, Alistair Moffat, and Justin Zobel. 2010. https://doi.org/10.1145/1852102.1852106 A similarity measure for indefinite rankings . ACM Trans. Inf. Syst., 28(4)

    2010

  14. [22]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  15. [23]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.