Pith. sign in

REVIEW 3 major objections 4 minor 61 references

Pixel-level Certified Explanations via Randomized Smoothing

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that any black-box attribution method can be smoothed and binarized so that every pixel receives a provably stable important/unimportant label inside an ℓ2 ball around the input, making explanation robustness a per-pixel…

desk verdict The central certified radius is invalid for the abstaining smoothed function, so the paper's main guarantee does not hold as stated. read the letter →

arxiv 2506.15499 v1 pith:EJD225KQ submitted 2025-06-18 cs.LG cs.AIcs.CV

Alaa Anani , Tobias Lorenz , Mario Fritz , Bernt Schiele This is my paper · ORCID
classification cs.LGcs.AIcs.CV
keywords certifiedrobustnessrandomizedsmoothingpixel-levelattributionexplainableAIsaliencymapssegmentationcertificationImageNetlayer-wiserelevancepropagation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper takes on a known failure mode of neural-network explanations: tiny, imperceptible input perturbations can completely reshuffle an attribution map while the prediction is unchanged. It claims that pixel-level robustness can be guaranteed for any black-box attribution method by sparsifying the map into the top-K% important pixels and smoothing it with Gaussian noise, which turns explanation into segmentation and lets an existing certified-segmentation theorem issue per-pixel guarantees. Within the certified ℓ2 ball, each pixel is labeled important, unimportant, or abstain, and the label is provably stable. Across 12 attribution methods and 5 ImageNet classifiers, the certificates are far from vacuous: most methods certify a useful fraction of pixels, and LRP and RISE achieve the best balance on the paper's three metrics of robustness, localization, and faithfulness. If the claims are right, any explanation pipeline can be upgraded to output maps that carry per-pixel stability guarantees usable in downstream tasks.

What carries the argument

The load-bearing construction is the composition of two maps. Sparsification h_K thresholds an attribution map by relative rank — pixels in the top K% become 1, the rest 0 — which is what makes the output a two-class segmentation map rather than a vector of real values. The smoothed sparsified attribution h̄_{τ,K} then applies the randomized-smoothing-for-segmentation recipe: for each pixel, Monte Carlo sampling estimates the probability that it is 1 under Gaussian input noise, and the pixel is certified when that probability beats threshold τ, with radius R = σΦ⁻¹(τ) coming from the standard Gaussian CDF. This identity — smoothed sparsified attribution equals smoothed segmentation — is what lets a theorem proven for segmentation models carry over to explanations unchanged. The empirical evaluation is carried by three metrics the paper defines: %certified (coverage), Certified GridPG (localization within 2×2 image grids), and deletion-based faithfulness (class-confidence drop when certified pixels are removed).

What would settle it

Sample many perturbations δ with ‖δ‖₂ ≤ R around certified images and record how often a certified pixel changes label or the model's predicted class changes: a flip rate above the advertised α=0.001 would break the statistical guarantee, and any prediction flip inside the ball while the certified map stays identical would expose that the certificate attests to the explanation but not to the decision it explains. At the assumption level, take a pair of images whose top-K% binary maps coincide but whose attribution magnitudes or sign patterns point to different evidence, and check whether the certified maps are treated as equally faithful by a deletion test.

Watch

Extended reading notes

Core claim

The central claim is that pixel-level attribution robustness reduces to a segmentation-certification problem. Given any attribution map h(x), the paper binarizes it by rank: the top K% of values become 1, the rest 0, producing a sparsified map h_K. Its Gaussian-smoothed version h̄_{τ,K} estimates, per pixel, the probability that the pixel keeps its class under input noise, and certifies the pixel as '1' or '0' when that probability exceeds τ, otherwise abstaining. Because h̄_{τ,K} is exactly a smoothed segmentation model, the randomized-smoothing theorem applies verbatim: every non-abstaining pixel keeps its certified label for all perturbations within radius R = σΦ⁻¹(τ), with confidence 1−α from Monte Carlo estimation. The paper then compares 12 attribution methods on 5 ImageNet models with three new metrics — %certified, Certified GridPG, and deletion faithfulness — and reports that LRP and RISE dominate the robustness-localization-faithfulness trade-off, with final-layer attributions generally certifying better than input-layer ones.

Load-bearing premise

The load-bearing premise is that the relative rank of attribution values — which pixels land in the top K% — is what an explanation means, so that certifying a binarized, noise-smoothed version of a map certifies the explanation itself: if the absolute values or the positive/negative evidence structure carry the information, the certificate protects a thresholded proxy, and it also says nothing about whether the model's prediction itself stays fixed inside the certified ball.

Editorial extensions

If this is right

  • Any black-box attribution method can be wrapped to emit per-pixel certificates — important, unimportant, or abstain — with the label provably fixed for every ℓ2 perturbation inside radius R = σΦ⁻¹(τ).
  • Certified maps are immediately usable in downstream tasks: the paper produces the first such maps and shows that deleting LRP/RISE certified pixels collapses class confidence, so the certified pixels are the ones the model truly leans on.
  • Attribution families differ sharply in certifiability: IxG and IntGrad certify almost no input-layer pixels, while LRP and RISE certify across radii, models, and layers, giving practitioners a principled way to pick an explainer.
  • The certification is tunable: raising the threshold τ or lowering K trades coverage for precision, so users can dial in how conservative their stability guarantee is.
  • Final-layer explanations certify better than input-layer ones across nearly all methods, pointing to coarse, high-level attribution maps as the more certifiable target.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The certificate can outlive the decision: nothing in the framework prevents the model's predicted class from changing inside the certified ball, so a certified map may stay intact for a prediction the model no longer makes. A natural extension is to certify the joint object (prediction, explanation), or to condition the certificate on the predicted class.
  • The construction only needs black-box access plus a smoothing distribution, so the same scheme should transfer to ℓ1 or ℓ∞ balls by swapping Gaussian noise for Laplacian or uniform noise — the segmentation theorem carries over with the corresponding level-set radius and inverse CDF.
  • Binarizing by rank discards the sign and magnitude structure of attributions, which matters for methods like LRP where positive and negative relevance carry distinct semantics; a testable extension is to certify the signed evidence structure, separating certified positive from certified negative pixels.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a certification method for pixel-level robustness of post-hoc attribution maps. The authors binarize attribution maps by labeling the top K% of pixels as 'important' and the rest as 'not important', smooth the resulting binary map with Gaussian noise, and then apply randomized smoothing for segmentation to label each pixel as certified '1', certified '0', or abstaining. They introduce three evaluation metrics—%certified, Certified GridPG, and a deletion-based faithfulness score—and report an extensive comparison of 12 attribution methods on 5 ImageNet classifiers. The central claim is that any black-box attribution method can be wrapped so that the binarized importance label of every certified pixel is provably invariant under l2-bounded input perturbations.

Significance. The conceptual reduction of attribution certification to binary segmentation certification is elegant, and the experimental breadth (12 methods, 5 models, multiple layers and sparsification levels) is commendable. The proposed metrics are natural and would be useful if the underlying certificates were valid. The paper is clearly written and provides a code link, and the reformulation of sparsified attributions as a segmentation problem is a simple but productive idea. However, the central theoretical guarantee, Theorem 3.1, is incorrect as stated, and this undermines the quantitative evaluation built on it. If the radius issue is corrected and the experiments are recomputed, the framework could be a valuable contribution to certified explainability.

major comments (3)
  1. [3.2, Theorem 3.1, Eq. (3)] Theorem 3.1 is false as stated for the abstaining smoothed function g_tau defined in Eq. (3). The radius R = sigma * Phi^{-1}(tau) does not guarantee that the top-class probability remains above tau; it only bounds the classification margin under the assumption p_A > tau. For a binary pixel with p_1(x) = 0.76, tau = 0.75, and sigma = 0.15, the paper's radius is R = 0.101, but at ||delta||_2 = 0.09 the Neyman-Pearson lower bound is p_1(x+delta) >= Phi(Phi^{-1}(0.76) - 0.09/0.15) = Phi(0.706 - 0.600) = Phi(0.106) = 0.542, which is below tau. Hence Eq. (3) returns the abstain symbol at x+delta even though the pixel was certified as '1' at x, so the asserted equality g_tau_i(x+delta) = g_tau_i(x) fails. The correct radius preserving non-abstention is per-pixel and equals sigma * (Phi^{-1}(p_A(x)) - Phi^{-1}(tau)) in the binary case, which tends to zero as p_A approaches tau. The fixed radius R = sigma * Phi^{-1}(tau) used throughout the paper is therefore not a valid certificate for the declared guarantee.
  2. [5, 6, 7] Because Theorem 3.1 is invalid, the quantitative evaluation built on it does not certify the claimed property. Section 6 states that 'all certified results are robust with confidence 1-alpha w.r.t the radius R=0.10', but with a correct per-pixel radius each pixel is certified only up to its own radius, and pixels with p_A just above tau have certified radius near zero. Consequently, the %certified and Certified GridPG scores in Figures 5-7 and the appendix do not report certified robustness at the stated radii, and the comparative conclusions (e.g., that LRP and RISE strike the best balance) may change when valid per-pixel certificates are used. The experiments need to be recomputed with the corrected radius definition.
  3. [6] The Monte Carlo confidence statement is incomplete. The paper sets n=100 and alpha=0.001 but does not describe how a lower confidence bound on the top-class probability is obtained before applying the radius formula. With n=100, a nominal confidence level of 0.999 requires a substantial margin between the observed frequency and the threshold tau; using point estimates or an unspecified estimator would void the 'with confidence 1-alpha' claim. The certification procedure must specify the confidence-bound computation, especially because the corrected per-pixel radius depends directly on the estimated p_A.
minor comments (4)
  1. [4.1] The sparsification parameter K is defined for K in [50,100], but the experiments use K=30, 10, and 5; the admissible range should be clarified or extended to (0,100].
  2. [Appendix E] Several appendix figure captions (e.g., Figures 15-18) refer to 'certified radiusK' where the correct term is 'certified radius R'.
  3. [1] The contributions list contains a typo: 'trustworhty' should be 'trustworthy'.
  4. [7.1] The abbreviation 'SS' is used without a formal definition in the main text; it should be defined when first introduced.

Circularity Check

0 steps flagged · score 2.0 of 10

No material circularity: the certificate is imported from Fischer et al. (2021), and the only self-citation is contextual.

full rationale

The central guarantee is not derived from the paper's own outputs. Section 4.1 defines the sparsified attribution h_K (Eq. 4), Section 4.2 constructs the smoothed sparsified attribution hbar (Eq. 5), and Section 4.3 identifies hbar with the smoothed segmentation model g_tau of Eq. 3, whose robustness certificate is stated as Theorem 3.1 and attributed to Fischer et al. (2021), an external source. No parameter is fitted to a subset of data and then reported as a prediction: the certified radius R = sigma*Phi^{-1}(tau) is a function of the pre-chosen noise level and threshold, not of the attribution maps. The three evaluation metrics (%certified, Certified GridPG, faithfulness) are measurements on certified outputs and do not feed back into the certificate. The only self-citation, Anani et al. (2024), appears in Section 1 as part of the phrase "Randomized Smoothing (Fischer et al., 2021; Anani et al., 2024)" and in Related Work; the operationally load-bearing theorem is expressly from Fischer et al. (2021), so the self-citation is not load-bearing. The skeptic's objection that Theorem 3.1's radius may not be valid for the abstaining smoothed function is a correctness/mathematical-validity concern about a quoted external result, not a demonstration that the paper's conclusion is equivalent to its inputs by construction; under the circularity rubric it does not raise the score. Score 2 reflects only the presence of a minor, non-load-bearing self-citation.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The method itself adds no fitted constants: the certificate follows from an external theorem. The hand-chosen hyperparameters (sigma, tau, K, n, alpha) control the concrete behavior of the method and the reported evaluations, and tau is tuned on one of the paper's own metrics. The semantic premise that top-K rank equals importance is an assumption, not a theorem.

free parameters (5)
  • sigma (Gaussian noise level) = 0.15 (swept to 0.25, 0.33 for radii 0.17, 0.22)
    Chosen by hand as the noise scale of randomized smoothing; it directly sets the certified radius R = sigma * Phi^{-1}(tau). The paper sweeps it to report results at different radii.
  • tau (abstention threshold) = 0.75
    Chosen in App. C after observing that tau=0.75 improves Certified GridPG over tau=0.60; this tunes a hyperparameter on one of the paper's own evaluation metrics before fixing the default.
  • K (sparsification percentage) = 50, 30, 10, 5 (swept)
    The top-K threshold that converts continuous attributions into binary labels; the paper sweeps it to balance fine versus coarse maps. Section 4.1 states K in [50,100] but experiments use K=5, an inconsistency.
  • n (Monte Carlo samples) = 100
    Number of noisy input samples per image used to estimate class probabilities; affects confidence intervals and computational cost.
  • alpha (type I error) = 0.001
    Preset confidence parameter for the Monte Carlo bounds.
assumptions (5)
  • standard math Randomized smoothing certification theorem (Fischer et al. 2021): if the top-class probability exceeds tau, the predicted label is constant within l2 radius sigma * Phi^{-1}(tau).
    The paper's core guarantee, quoted as Theorem 3.1, is imported from prior work rather than derived.
  • domain assumption Attribution methods can be treated as black-box functions of the input, mapping an image to N real-valued scores.
    The whole framing requires h(x) to be a well-defined function; internal randomness, for example RISE masks, is averaged over.
  • domain assumption The top-K percent rank threshold preserves the semantically meaningful content of an attribution map.
    Section 4.1 states relative ranks are important for interpretation; this is the premise that turns robustness of binary labels into trustworthy explanations.
  • domain assumption The target class for which attributions are computed is fixed across all noisy inputs.
    Eq. 5 certifies h^K(x+epsilon) but does not specify which class the attribution is for; if noise flips the model's prediction, the certified map may no longer explain the actual decision.
  • domain assumption The 100 high-confidence ImageNet images and 100 grids are representative for comparing attribution methods.
    Section 6 selects images classified with high confidence; this may inflate robustness and localization relative to a random ImageNet sample.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Pixel-level Certified Explanations via Randomized Smoothing." pith.science (2026). https://pith.science/paper/EJD225KQ

@misc{pith2026250615499,
  author       = {Pith},
  title        = {Pith review of: Pixel-level Certified Explanations via Randomized Smoothing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EJD225KQ}},
  note         = {Machine review of arXiv:2506.15499}
}
abstract

Post-hoc attribution methods aim to explain deep learning predictions by highlighting influential input pixels. However, these explanations are highly non-robust: small, imperceptible input perturbations can drastically alter the attribution map while maintaining the same prediction. This vulnerability undermines their trustworthiness and calls for rigorous robustness guarantees of pixel-level attribution scores. We introduce the first certification framework that guarantees pixel-level robustness for any black-box attribution method using randomized smoothing. By sparsifying and smoothing attribution maps, we reformulate the task as a segmentation problem and certify each pixel's importance against $\ell_2$-bounded perturbations. We further propose three evaluation metrics to assess certified robustness, localization, and faithfulness. An extensive evaluation of 12 attribution methods across 5 ImageNet models shows that our certified attributions are robust, interpretable, and faithful, enabling reliable use in downstream tasks. Our code is at https://github.com/AlaaAnani/certified-attributions.

Figures

Figures reproduced from arXiv: 2506.15499 by the authors.

Figure 1
Figure 1. Pixel-level certified explanations via random￾ized smoothing. (a) The original attribution h(x) lacks robustness guarantees and changes under small input per￾turbations. (b) We sample noisy attributions h(x + ϵ), and (c) certify which pixels robustly remain in the top-K%. Colored pixels show certifiably robust top K pixels across different attribution methods (LRP, RISE, Grad-CAM). tible input perturbations can sign… view at source ↗
Figure 2
Figure 2. shows certified attribution maps at different sparsi￾fication values K. As K decreases, fewer pixels are certi￾fied as top K% (“1”), highlighting finer details (e.g., LRP marks the fish’s eye at K = 5%), while larger K values capture coarser features (e.g., LRP highlights the full fish Input Grad SS K=50% Certified K=25% K=5% Overlayed LRP RISE GradCam GradCam++ 0 Top 50% Top 25% Top 5% [PITH_FULL_IMAGE:figures/ful… view at source ↗
Figure 3
Figure 3. Examples from overlayed certified GridPG at￾tributions at different sparsification K values on ResNet￾18. The blue square denotes the ground truth subimage. at K = 50%). Overlaying maps across K (see “Overlayed” column) reveals a pixel importance hierarchy, with darker pixels denoting higher importance [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (20 more)
Figure 4
Figure 4. Figure 4: Overlayed certified attributions at different K values across methods on ResNet-18. SS (Smoothed Sparsified), which refers to the average of the sparsified attributions, is evaluated on n = 100 noisy input samples per image and at K = 50%. This figure is extended to Vi…
Figure 5
Figure 5. Figure 5: Comparison of the per-pixel certification rate (%certified) on ResNet-18 across backpropagation, perturba￾tion and activation methods. (Left) shows evaluation at the input and (Right) at the final layer using different certified radii R (Top) and sparsification paramet…
Figure 6
Figure 6. Figure 6: Comparison of the certified localization (Certified GridPG) on ResNet-18 across backpropagation, pertur￾bation and activation methods. (Left) shows evaluation at the input and (Right) at the final layer using different certified radii (Top) and sparsification parameter…
Figure 7
Figure 7. Figure 7: Robustness-localization tradeoff of attribution methods using the %certified and Certified GridPG metrics on all 5 models at K = 30%. (Top) evaluation is on input and (Bottom) final layers. 7.5. Faithfulness Analysis of Certified Attributions Orig. K=10 K=30 K=50 0 0.2…
Figure 8
Figure 8. Figure 8: Faithfulness comparison of certified attribution methods on ResNet-18 using the ground truth (GT) class confidence against the deletion steps in which top K certi￾fied pixels are removed in descending order of importance. (Left) evaluation is at the input and (Right) a…
Figure 9
Figure 9. Figure 9: Comparison of the per-pixel certification rate (%certified) against the certified radius R on all 5 models across backpropagation, activation and perturbation methods. (Left) shows evaluation at the input and (Right) at the final layer. The darkest shades denote %certi…
Figure 10
Figure 10. Figure 10: Comparison of the per-pixel certification rate (%certified) against sparsification values K on all 5 models across backpropagation, activation and perturbation methods. (Left) shows evaluation at the input and (Right) at the final layer. 15 [PITH_FULL_IMAGE:figures/f…
Figure 11
Figure 11. Figure 11: Comparison of the certified localization (Certified GridPG) against the certified radius R on all 5 models across backpropagation, activation and perturbation methods. (Left) shows evaluation at the input and (Right) at the final layer. 50 30 10 Sparsification paramet…
Figure 12
Figure 12. Figure 12: Comparison of the certified localization (Certified GridPG) against the sparsification values K on all 5 models across methods. (Left) shows evaluation at the input and (Right) at the final layer. Input layer In Figures 11 and 12, backpropagation and perturbation meth…
Figure 13
Figure 13. Figure 13: The performance of attribution methods in terms of %certified (a) and Certified GridPG (b) by increasing the top [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: The performance of attribution methods on ResNet18 in terms of original GridPG score against Certified GridPG. [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]
Figure 15
Figure 15. Figure 15: Example image and its certified attribution maps on ResNet-18 of all methods at different sparsification (K) and certified radius K values. SS (Smoothed Sparsified) is evaluated at K = 50%. The ”Overlayed” last column shows the certified top K% pixels from row-wise ce…
Figure 16
Figure 16. Figure 16: Example image and its certified attribution maps on ResNet-18 of all methods at different sparsification (K) and certified radius K values. SS (Smoothed Sparsified) is evaluated at K = 50%. The ”Overlayed” last column shows the certified top K% pixels from row-wise ce…
Figure 17
Figure 17. Figure 17: Certified attribution maps on ResNet-18 (a) and ResNet-152 (b) of all methods at different sparsification (K) and certified radius K values. SS (Smoothed Sparsified) is evaluated at K = 50%. The ”Overlayed” last column shows the certified top K% pixels from row-wise c…
Figure 18
Figure 18. Figure 18: Example image and its certified attribution maps on ResNet-18 (a) and ResNet-152 (b) of all methods at different sparsification (K) and certified radius K values. SS (Smoothed Sparsified) is evaluated at K = 50%. The ”Overlayed” last column shows the certified top K% …
Figure 19
Figure 19. Figure 19: Certified attribution maps of ViT-B/16 of all methods at different sparsification parameter (K) values. SS (Smoothed Sparsified) is evaluated on n = 100 noisy input samples per image and at K = 50%. The “Overlayed” column shows certified top K% pixels per row, with lo…
Figure 20
Figure 20. Figure 20: Overlayed certified attributions on ViT-B/16 at different K values across methods . SS (Smoothed Sparsified), which refers to the average of the sparsified attributions, is evaluated on n = 100 noisy input samples per image and at K = 50%. 25 [PITH_FULL_IMAGE:figures…
Figure 21
Figure 21. Figure 21: Examples from each AggAtt for all methods at the input layer using Certified GridPG. White denotes certified “0”, black is certified “1” and gray is abstain ⊘. The percentile bin values are displayed at the top of every column. Default values: K = 50%, R = 0.10, τ = 0…
Figure 22
Figure 22. Figure 22: Examples from each AggAtt for all methods at the final layer using Certified GridPG. White denotes certified “0”, black is certified “1” and gray is abstain ⊘. The percentile bin values are displayed at the top of every column. Default values: K = 50%, R = 0.10, τ = 0…
Figure 23
Figure 23. Figure 23: AggAtt Evaluation on Certified GridPG for all attribution methods at the input and final layers across sparsification parameters K and certified radii R values. 29 [PITH_FULL_IMAGE:figures/full_fig_p029_23.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 54 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Adaptive hierarchical certification for segmentation using randomized smoothing

    Anani, A., Lorenz, T., Schiele, B., and Fritz, M. Adaptive hierarchical certification for segmentation using randomized smoothing. In International Conference on Machine Learning (ICML), 2024

    work page 2024

  3. [3]

    Who explains the explanation? quantitatively assessing feature attribution methods

    Arias-Duart, A., Par \'e s, F., and Garcia-Gasulla, D. Who explains the explanation? quantitatively assessing feature attribution methods. arXiv preprint arXiv:2109.15035, 2021

    arXiv 2021

  4. [4]

    On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation

    Bach, S., Binder, A., Montavon, G., Klauschen, F., M \"u ller, K.-R., and Samek, W. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, 2015

    work page 2015

  5. [5]

    and Biecek, P

    Baniecki, H. and Biecek, P. Adversarial attacks and defenses in explainable artificial intelligence: A survey. Information Fusion, 2024

    work page 2024

  6. [6]

    Convolutional dynamic alignment networks for interpretable classifications

    Bohle, M., Fritz, M., and Schiele, B. Convolutional dynamic alignment networks for interpretable classifications. In Computer Vision and Pattern Recognition (CVPR), 2021

    work page 2021

  7. [7]

    and Scheirer, W

    Carmichael, Z. and Scheirer, W. J. Unfooling perturbation-based post hoc explainers. In AAAI Conference on Artificial Intelligence (AAAI), 2023

    work page 2023

  8. [8]

    Chattopadhay, A., Sarkar, A., Howlader, P., and Balasubramanian, V. N. Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks. In Winter Conference on Applications of Computer Vision (WACV), 2018

    work page 2018

Show all 61 references
  1. [9]

    Provable robust saliency-based explanations

    Chen, C., Guo, C., Ma, G., Zeng, M., Zhang, X., and Xie, S. Provable robust saliency-based explanations. arXiv preprint arXiv:2212.14106, 2022

    2022 arXiv

  2. [10]

    Robust attribution regularization

    Chen, J., Wu, X., Rastogi, V., Liang, Y., and Jha, S. Robust attribution regularization. In Advances in Neural Information Processing Systems (NeurIPS), 2019

    2019

  3. [11]

    Certified adversarial robustness via randomized smoothing

    Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning (ICML), 2019

    2019

  4. [12]

    and Gal, Y

    Dabkowski, P. and Gal, Y. Real time image saliency for black box classifiers. In Advances in Neural Information Processing Systems (NeurIPS), 2017

    2017

  5. [13]

    Dhurandhar, A., Haldar, S., Wei, D., and Ramamurthy, K. N. Trust regions for explanations via black-box probabilistic certification. In International Conference on Machine Learning (ICML), 2024

    2024

  6. [14]

    Explanations can be manipulated and geometry is to blame

    Dombrowski, A.-K., Alber, M., Anders, C., Ackermann, M., M \"u ller, K.-R., and Kessel, P. Explanations can be manipulated and geometry is to blame. In Advances in Neural Information Processing Systems (NeurIPS), 2019

    2019

  7. [15]

    J., M \"u ller, K.-R., and Kessel, P

    Dombrowski, A.-K., Anders, C. J., M \"u ller, K.-R., and Kessel, P. Towards robust explanations for deep neural networks. Pattern Recognition, 2022

    2022

  8. [16]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. An image is worth 16x16 words: Transformers for image recognition at scale. International Conference for Learning Representations ...

    2020

  9. [17]

    Scalable certified segmentation via randomized smoothing

    Fischer, M., Baader, M., and Vechev, M. Scalable certified segmentation via randomized smoothing. In International Conference on Machine Learning (ICML), 2021

    2021

  10. [18]

    Fong, R. C. and Vedaldi, A. Interpretable explanations of black boxes by meaningful perturbation. In International Conference on Computer Vision (ICCV), 2017

    2017

  11. [19]

    Ghalebikesabi, S., Ter-Minassian, L., DiazOrdaz, K., and Holmes, C. C. On locality of local explanation models. In Advances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  12. [20]

    Interpretation of neural networks is fragile

    Ghorbani, A., Abid, A., and Zou, J. Interpretation of neural networks is fragile. In AAAI conference on artificial intelligence (AAAI), 2019

    2019

  13. [21]

    Deep learning-based image segmentation on multimodal medical imaging

    Guo, Z., Li, X., Huang, H., Guo, N., and Li, Q. Deep learning-based image segmentation on multimodal medical imaging. IEEE Transactions on Radiation and Plasma Medical Sciences, 2019

    2019

  14. [22]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Computer Vision and Pattern Recognition (CVPR), 2016

    2016

  15. [23]

    Layercam: Exploring hierarchical class activation maps for localization

    Jiang, P.-T., Zhang, C.-B., Hou, Q., Cheng, M.-M., and Wei, Y. Layercam: Exploring hierarchical class activation maps for localization. IEEE Transactions on Image Processing (TIP), 2021

    2021

  16. [24]

    Very deep convolutional networks for large-scale image recognition

    Karen, S. Very deep convolutional networks for large-scale image recognition. In International Conference for Learning Representations (ICLR), 2015

    2015

  17. [25]

    Cnn-based segmentation of medical imaging data

    Kayalibay, B., Jensen, G., and van der Smagt, P. Cnn-based segmentation of medical imaging data. arXiv preprint arXiv:1701.03056, 2017

    2017 arXiv

  18. [26]

    and U c ar, A

    Kaymak, C . and U c ar, A. A brief survey and an application of semantic image segmentation for autonomous driving. Handbook of Deep Learning Applications, 2019

    2019

  19. [27]

    u tt, K. T., D \

    Kindermans, P.-J., Hooker, S., Adebayo, J., Alber, M., Sch \"u tt, K. T., D \"a hne, S., Erhan, D., and Kim, B. The (un) reliability of saliency methods. Explainable AI: Interpreting, explaining and visualizing deep learning, 2019

    2019

  20. [28]

    and Le-Khac, N.-A

    Kuppa, A. and Le-Khac, N.-A. Black box attacks on explainable artificial intelligence (xai) methods in cyber security. In International Joint Conference on Neural Networks (IJCNN), 2020

    2020

  21. [29]

    Certified robustness to adversarial examples with differential privacy

    Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S. Certified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and Privacy (SP), 2019

    2019

  22. [30]

    Certifiably robust interpretation in deep learning

    Levine, A., Singla, S., and Feizi, S. Certifiably robust interpretation in deep learning. arXiv preprint arXiv:1905.12105, 2019

    1905 arXiv

  23. [31]

    On the robustness of removal-based feature attributions

    Lin, C., Covert, I., and Lee, S.-I. On the robustness of removal-based feature attributions. In Advances in Neural Information Processing Systems (NeurIPS), 2024

    2024

  24. [32]

    Certifiably robust interpretation via r \'e nyi differential privacy

    Liu, A., Chen, X., Liu, S., Xia, L., and Gan, C. Certifiably robust interpretation via r \'e nyi differential privacy. Artificial Intelligence, 2022

    2022

  25. [33]

    Explaining nonlinear classification decisions with deep taylor decomposition

    Montavon, G., Lapuschkin, S., Binder, A., Samek, W., and Müller, K.-R. Explaining nonlinear classification decisions with deep taylor decomposition. Pattern Recognition, 2017

    2017

  26. [34]

    Digital technologies and artificial intelligence’s present and foreseeable impact on lawyering, judging, policing and law enforcement

    Nissan, E. Digital technologies and artificial intelligence’s present and foreseeable impact on lawyering, judging, policing and law enforcement. Ai & Society, 2017

    2017

  27. [35]

    Rise: Randomized input sampling for explanation of black-box models

    Petsiuk, V., Das, A., and Saenko, K. Rise: Randomized input sampling for explanation of black-box models. In British Machine Vision Conference (BMVC), 2018 a

    2018

  28. [36]

    Rise: Randomized input sampling for explanation of black-box models

    Petsiuk, V., Das, A., and Saenko, K. Rise: Randomized input sampling for explanation of black-box models. In British Machine Vision Conference (BMVC), 2018 b

    2018

  29. [37]

    Ramaswamy, H. G. et al. Ablation-cam: Visual explanations for deep convolutional network via gradient-free localization. In Winter Conference on Applications of Computer Vision (WACV), 2020

    2020

  30. [38]

    Better understanding differences in attribution methods via systematic evaluations

    Rao, S., B \"o hle, M., and Schiele, B. Better understanding differences in attribution methods via systematic evaluations. Computer Vision and Pattern Recognition (CVPR), 2022

    2022

  31. [39]

    why should i trust you?

    Ribeiro, M. T., Singh, S., and Guestrin, C. " why should i trust you?" explaining the predictions of any classifier. In International Conference on Knowledge Discovery and Data Mining (ICKDD), 2016

    2016

  32. [40]

    Imagenet large scale visual recognition challenge

    Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. Imagenet large scale visual recognition challenge. International Journal of Computer Vision (IJCV), 2015

    2015

  33. [41]

    R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D

    Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. Grad-cam: Visual explanations from deep networks via gradient-based localization. In International Conference on Computer Vision (ICCV), 2017

    2017

  34. [42]

    and Pardeshi, M

    Sheu, R.-K. and Pardeshi, M. S. A survey on medical explainable ai (xai): recent progress, explainability approach, human interaction and scoring system. Sensors, 2022

    2022

  35. [43]

    Learning important features through propagating activation differences

    Shrikumar, A., Greenside, P., and Kundaje, A. Learning important features through propagating activation differences. In International Conference on Machine Learning (ICML), 2017

    2017

  36. [44]

    A., Narodytska, N., Ignatiev, A., Meel, K

    Shrotri, A. A., Narodytska, N., Ignatiev, A., Meel, K. S., Marques-Silva, J., and Vardi, M. Y. Constraint-driven explanations for black-box ml models. In AAAI Conference on Artificial Intelligence (AAAI), 2022

    2022

  37. [45]

    Deep inside convolutional networks: Visualising image classification models and saliency maps

    Simonyan, K. Deep inside convolutional networks: Visualising image classification models and saliency maps. In International Conference for Learning Representations Worshop (ICLR-W), 2014

    2014

  38. [46]

    T., Dosovitskiy, A., Brox, T., and Riedmiller, M

    Springenberg, J. T., Dosovitskiy, A., Brox, T., and Riedmiller, M. Striving for simplicity: The all convolutional net. In International Conference for Learning Representations Worshop (ICLR-W), 2014

    2014

  39. [47]

    Fooling network interpretation in image classification

    Subramanya, A., Pillai, V., and Pirsiavash, H. Fooling network interpretation in image classification. In International Conference on Computer Vision (ICCV), 2019

    2019

  40. [48]

    Axiomatic attribution for deep networks

    Sundararajan, M., Taly, A., and Yan, Q. Axiomatic attribution for deep networks. In International Conference on Machine Learning (ICML), 2017

    2017

  41. [49]

    and Tian, Y

    Tan, Z. and Tian, Y. Robust explanation for free or at the cost of faithfulness. In International Conference on Machine Learning (ICML), 2023

    2023

  42. [50]

    Defense against explanation manipulation

    Tang, R., Liu, N., Yang, F., Zou, N., and Hu, X. Defense against explanation manipulation. Frontiers in Big Data, 2022

    2022

  43. [51]

    and Robnik- S ikonja, M

    Vre s , D. and Robnik- S ikonja, M. Preventing deception with explanation methods using focused sampling. Data Mining and Knowledge Discovery (DMKD), 2024

    2024

  44. [52]

    and Kong, A

    Wang, F. and Kong, A. W.-K. A practical upper bound for the worst-case attribution deviations. In Computer Vision and Pattern Recognition (CVPR), 2023

    2023

  45. [53]

    and Kong, A

    Wang, F. and Kong, A. W.-K. Certified _2 attribution robustness via uniformly smoothed attributions. arXiv preprint arXiv:2405.06361, 2024

    2024 arXiv

  46. [54]

    Smoothed geometry for robust attribution

    Wang, Z., Wang, H., Ramkumar, S., Mardziel, P., Fredrikson, M., and Datta, A. Smoothed geometry for robust attribution. In Advances in Neural Information Processing systems (NeurIPS), 2020

    2020

  47. [55]

    Cancer omic data based explainable ai drug recommendation inference: A traceability perspective for explainability

    Xi, J., Wang, D., Yang, X., Zhang, W., and Huang, Q. Cancer omic data based explainable ai drug recommendation inference: A traceability perspective for explainability. Biomedical Signal Processing and Control, 2023

    2023

  48. [56]

    and Komodakis, N

    Zagoruyko, S. and Komodakis, N. Wide residual networks. arXiv preprint, 2016

    2016

  49. [57]

    Visualizing and understanding convolutional networks

    Zeiler, M. Visualizing and understanding convolutional networks. In European Conference on Computer Vision (ECCV), 2014

    2014

  50. [58]

    Zeiler, M. D. and Fergus, R. Visualizing and understanding convolutional networks. In European Conference on Computer Vision (ECCV), 2014

    2014

  51. [59]

    Interpretable deep learning under fire

    Zhang, X., Wang, N., Shen, H., Ji, S., Luo, X., and Wang, T. Interpretable deep learning under fire. In USENIX security symposium ( USENIX ) , 2020

    2020

  52. [60]

    Instance-level segmentation for autonomous driving with deep densely connected mrfs

    Zhang, Z., Fidler, S., and Urtasun, R. Instance-level segmentation for autonomous driving with deep densely connected mrfs. In Computer Vision and Pattern Recognition (CVPR), 2016

    2016

  53. [61]

    Learning deep features for discriminative localization

    Zhou, B., Khosla, A., Lapedriza, A., Oliva, A., and Torralba, A. Learning deep features for discriminative localization. In Conference on Computer Vision and Pattern Recognition (CVPR), 2016

    2016

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.