REVIEW 4 major objections 6 minor 1 cited by
Saliency Methods for Explaining Adversarial Attacks
T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read Guided Backpropagation saliency maps retain class-discriminative information, and subtracting channel-normalized maps of two classes turns that signal into explanations of adversarial misclassifications.
desk verdict A genuinely interesting observation about GuidedBP saliency values, but the paper's own evaluation is too thin to support the state-of-the-art claim it makes. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the channel-wise energy-normalized contrast between two GuidedBP saliency maps. A GuidedBP map is obtained by propagating the gradient of a class score back to the input while masking out negative gradients at ReLU units; the paper defines the filtering effect as the binary pattern of positive entries of a map. The enhancement step takes, for each color channel, the positive part of $\frac{s_k^{(r)}}{|s_k^{(r)}|_1} - \frac{s_m^{(r)}}{|s_m^{(r)}|_1}$, where $s_k$ and $s_m$ are the maps for two classes and the denominator is the channel's total absolute saliency. This subtraction isolates input features whose saliency is relatively larger for one class, on the premise that relatively large saliency values mark features supporting that class. All claims about explaining adversarial classifications rest on this contrast operation.
What would settle it
Compute enhanced GuidedBP maps on attacked images, then repeat the same procedure with randomly paired classes or with the two class labels swapped, and compare the resulting maps' ability to recover classification accuracy under pixel perturbation (the Figure 4 test). If the random-pair maps are statistically as effective as the proposed class-pair maps, the explanatory content would be shown to be an artifact of the normalization-subtraction operation rather than class-specific evidence.
Extended reading notes
Core claim
GuidedBP maps for different classes are not redundant. For a pair of classes, the binarized support sets of the maps are almost identical, but the unnormalized saliency values differ noticeably; the paper's numerical analysis measures this with a similarity ratio near 1 for filtering effects and an average-difference score that varies up to 0.8. The class-discriminative signal therefore lives in the magnitudes, not the pattern. To pull it out, the paper normalizes each RGB channel of a map by the channel's sum of absolute values and subtracts the two class maps channel-wise, taking the positive part, so the result marks input features that support one class relative to the other. Because adversarial attacks change the ranking of pre-softmax logits, the enhanced map explains the misclassification by showing where the evidence for the new class comes from, and it visibly changes between clean and attacked images, whereas other tested saliency methods produce nearly the same maps.
Load-bearing premise
The method rests on the premise that after channel-wise energy normalization, the positive difference between two class maps marks exactly the input features that support one class over the other, rather than normalization artifacts or noise; the paper asserts this premise rather than validating it against a random baseline.
Editorial extensions
If this is right
- GuidedBP cannot be reduced to partial image recovery: its class-discriminative information, although hidden by visualization normalization, is present in the saliency values.
- A saliency method that explains adversarial classifications should change when the network's decision changes; enhanced GuidedBP meets that criterion while standard GuidedBP and other methods do not.
- Perturbing the pixels identified by enhanced GuidedBP on attacked images recovers classification accuracy better than perturbing pixels from other saliency methods, indicating the identified pixels carry decision-relevant evidence.
- The same channel-wise energy-normalized subtraction can be applied to any saliency method whose maps for different classes share similar filtering effects, and its usefulness is governed by how well that similarity holds.
- If the explanation of an adversarial misclassification points to class-irrelevant image regions, that provides evidence the network focused on wrong features rather than on the object's discriminative parts.
Reading between the lines
- The contrastive map is effectively attributing the difference between two logits rather than a single logit; in principle the same operation could explain any pairwise decision boundary, including non-adversarial confusions between similar classes, not just attacked inputs.
- A natural stress test the paper does not run is a randomization control: subtracting the maps of two randomly paired classes, or subtracting the map of a class from itself under independent noise, should produce no explanatory signal; if such control maps recover accuracy as well as the proposed ones, the claimed class evidence would be called into question.
- Since the authors note the method assumes attacks are not aware of it, an adversary who knows the explanation procedure could in principle craft perturbations that change the logit ranking while leaving the contrastive map pointing at innocuous regions, so explanation robustness under adaptive attacks is a direct open extension.
- The recovered-accuracy result suggests a practical use beyond explanation: the discriminative pixels could seed a training regularizer that stabilizes logit rankings, which the authors mention as future work but do not test.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper argues that, contrary to prior claims that Guided Backpropagation (GuidedBP) merely performs partial image recovery, GuidedBP saliency maps do contain class-discriminative information. The authors support this with an analysis of pairs of GuidedBP maps for different classes, showing that the maps differ in saliency values even when their filtering effects are similar. They then propose an 'enhanced GuidedBP' that normalizes the maps channel-wise by energy and subtracts the maps of two classes, keeping only positive differences, in order to highlight features that support one class over another. The method is applied to explaining adversarial misclassifications on ImageNet with VGG16, and the paper reports qualitative examples and a quantitative accuracy-recovery experiment in which pixels ranked highly by the enhanced map are perturbed to partially restore classification accuracy. The central claims are that GuidedBP saliency maps contain class-discriminative information and that enhanced GuidedBP achieves state-of-the-art performance in explaining adversarial classifications.
Significance. If the central claims are established, the paper would make a useful contribution to the interpretability literature: it would soften the strong negative result that GuidedBP is purely image recovery, and it would offer a simple, parameter-free contrastive extension that responds to adversarial misclassifications. The proposed energy-normalized difference of GuidedBP maps is elegant and computationally cheap, and the paper identifies a concrete limitation of standard saliency methods for adversarial inputs. The analysis is falsifiable and does not rely on fitted parameters, which is a strength. However, the significance is currently limited by the evaluation: the quantitative evidence is thin, lacks a null control, and does not include comparisons with the most relevant prior contrastive method, reference [14], despite the 'state-of-the-art' claim. The paper's core idea is plausible, but its empirical support is not yet commensurate with the strength of the claims.
major comments (4)
- [Section 2.2] The central assumption that 'relatively larger saliency values in SMs correspond to the input features that support a specific class' is asserted but not validated. The channel-wise energy-normalized difference is then taken to isolate the evidence responsible for the change in logit ranking. This needs a direct test: for example, compare the discriminative pixels obtained by subtracting the k-th and m-th class maps against a random-pixel baseline, or against the difference of a map of a third unrelated class, to show that the resulting localization is class-specific rather than a normalization artifact. Without such a control, the enhanced map could be dominated by scale differences or noise.
- [Section 3, Figure 4] The quantitative evaluation of the enhanced GuidedBP is insufficient to support the central claim. Figure 4 reports accuracy recovery after perturbing the highest-saliency pixels, but this metric is confounded: many arbitrary perturbations can destroy the adversarial perturbation and partially restore accuracy. There is no random-pixel baseline, no perturbation of a fixed arbitrary region, no error bars, and no statement of the number of images or attack success rate. The reader cannot tell whether the recovery is due to the saliency map identifying decision-relevant pixels or simply to the destruction of the attack. These controls are necessary before the accuracy-recovery experiment can be read as evidence for explanation quality.
- [Section 3 and Abstract] The paper claims 'state-of-the-art performance to explain adversary classifications,' but no comparison to existing explanation methods is provided in the quantitative experiment. In particular, the method is closely related to contrastive backpropagation [14], yet Figure 4 contains no comparison to [14] or to any other attribution method (e.g., Grad-CAM, DeepLIFT, or Integrated Gradients). Without such a comparison, the state-of-the-art claim is unsupported. The qualitative figures (Figures 3 and 5) show only a few examples and do not establish systematic superiority.
- [Section 4] The stated limitation that 'the attack methods are not aware of our method' is important and should be discussed in the evaluation itself, not only at the end. In particular, the accuracy-recovery experiment in Section 3 uses attacks (FGSM, BIM, C&W) that are agnostic to the explanation method, but the paper does not examine whether the proposed saliency map would remain meaningful under an adaptive adversary that optimizes the perturbation with knowledge of the explanation method. This is a scope restriction that should be made explicit when interpreting the results.
minor comments (6)
- [Section 2.1] There is a typo: 'GuiedBP' should be 'GuidedBP'.
- [Section 2] The text contains 'RuLU' in the description of GuidedBP; this should be 'ReLU'.
- [Section 3] The phrase 'the perturbation with SMs of our enhanced GuidedBP can recovery the score better' uses 'recovery' as a verb; it should be 'recover'.
- [Section 3, Figure 3] The qualitative description mentions 'e.g., sheepland dog', which appears to be a typo for 'sheep and dog'.
- [Section 2.1] The analysis of Avg-Diff in Figure 1b would be easier to interpret if the number of image pairs and the distribution of scores were described; currently only a statement that scores vary from 0 to 0.8 is given.
- [References] Reference [14] is the authors' own prior work on contrastive backpropagation; given the close relationship to the proposed method, a substantive discussion of differences and an empirical comparison would be appropriate.
Circularity Check
No significant circularity: the enhanced method is a deterministic contrastive construction and is evaluated on an external accuracy-recovery benchmark; the only self-citation is a non-load-bearing survey reference.
full rationale
The paper proposes enhanced GuidedBP as a channel-wise, energy-normalized subtraction of two class-level GuidedBP saliency maps, Dis_k_r = max(0, s^k_r/|s^k_r| - s^m_r/|s^m_r|). This construction is not fitted to the data used in the evaluation, and there are no trainable parameters whose values could make the later claim true by construction. The key claim that GuidedBP maps contain class-discriminative information is supported by a numerical observation (Avg-Diff between unnormalized maps), while the main performance claim is tested by perturbing top-saliency pixels of C&W adversary images and measuring accuracy recovery. That metric is external to the construction, although it would be stronger with a random-pixel baseline; absence of a baseline is an evidence-quality concern, not circularity. The only self-citation, reference [14] by the same authors on contrastive backpropagation, appears in a general survey list and is not used as the justification for the proposed method, so it is not load-bearing. No equation in the paper reduces a predicted quantity to an input by construction, and no fitted parameter is renamed as a prediction. Score 2 reflects the minor self-citation and the weak but not circular operationalization of 'class-discriminative information.'
Assumptions & free parameters
assumptions (5)
- domain assumption Saliency values of GuidedBP are meaningful attributions of input features to the output class (larger values support the class).
- domain assumption The filtering effects (zero patterns) of GuidedBP saliency maps for two classes are nearly identical, so value differences after normalization isolate class-relevant evidence.
- domain assumption Perturbing pixels according to a saliency map and measuring accuracy recovery is a valid proxy for explanation quality.
- ad hoc to paper The attack methods are not aware of the explanation method.
- standard math Standard backpropagation and the math of logit differences.
Cite this review
Pith. "Pith review of Saliency Methods for Explaining Adversarial Attacks." pith.science (2026). https://pith.science/paper/XCWBYSE7
@misc{pith2026190808413,
author = {Pith},
title = {Pith review of: Saliency Methods for Explaining Adversarial Attacks},
year = {2026},
howpublished = {\url{https://pith.science/paper/XCWBYSE7}},
note = {Machine review of arXiv:1908.08413}
}
read the original abstract
The classification decisions of neural networks can be misled by small imperceptible perturbations. This work aims to explain the misled classifications using saliency methods. The idea behind saliency methods is to explain the classification decisions of neural networks by creating so-called saliency maps. Unfortunately, a number of recent publications have shown that many of the proposed saliency methods do not provide insightful explanations. A prominent example is Guided Backpropagation (GuidedBP), which simply performs (partial) image recovery. However, our numerical analysis shows the saliency maps created by GuidedBP do indeed contain class-discriminative information. We propose a simple and efficient way to enhance the saliency maps. The proposed enhanced GuidedBP shows the state-of-the-art performance to explain adversary classifications.
Figures
Forward citations
Cited by 1 Pith paper
-
Beyond Explainable AI (XAI): An Overdue Paradigm Shift and Post-XAI Research Directions
Current XAI methods for DNNs and LLMs rest on paradoxes and false assumptions that demand a paradigm shift to verification protocols, scientific foundations, context-aware design, and faithful model analysis rather th...
Reference graph
Works this paper leans on
-
[14]
Understanding individual decisions of cnns via contrastive backpropagation
Jindong Gu, Yinchong Yang, and V olker Tresp. Understanding individual decisions of cnns via contrastive backpropagation. In ACCV, 2018
work page 2018
-
[1]
Deep inside convolutional networks: Visualising image classification models and saliency maps
Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. In ICLR, 2013
work page 2013
-
[2]
Visualizing and understanding convolutional networks
Matthew D Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In ECCV, pages 818–833. Springer, 2014
2014
-
[3]
Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin A. Riedmiller. Striving for simplicity: The all convolutional net. In ICLR, 2014
work page 2014
-
[4]
On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation
Sebastian Bach, Alexander Binder, Grégoire Montavon, Frederick Klauschen, Klaus-Robert Müller, and Wojciech Samek. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, 10(7):e0130140, 2015
2015
-
[5]
Why should i trust you?: Explaining the predictions of any classifier
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Why should i trust you?: Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD , pages 1135–1144. ACM, 2016
work page 2016
-
[6]
Axiomatic attribution for deep networks
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In ICML, 2017
2017
-
[7]
Smooth- grad: removing noise by adding noise
Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenberg. Smooth- grad: removing noise by adding noise. arXiv preprint arXiv:1706.03825, 2017
arXiv 2017
Show all 26 references
-
[8]
Learning important features through propagating activation differences
Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Learning important features through propagating activation differences. In ICML, 2017
2017
-
[9]
Grad-cam: Visual explanations from deep networks via gradient- based localization
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, Dhruv Batra, et al. Grad-cam: Visual explanations from deep networks via gradient- based localization. In ICCV, pages 618–626, 2017
2017
-
[10]
A unified view of gradient- based attribution methods for deep neural networks
Marco Ancona, Enea Ceolini, Cengiz Öztireli, and Markus Gross. A unified view of gradient- based attribution methods for deep neural networks. In NIPS 2017-Workshop on Interpreting, Explaining and Visualizing Deep Learning . ETH Zurich, 2017
2017
-
[11]
Zintgraf, Taco Cohen, Tameem Adel, and Max Welling
Luisa M. Zintgraf, Taco Cohen, Tameem Adel, and Max Welling. Visualizing deep neural network decisions: Prediction difference analysis. In ICLR, 2017
2017
-
[12]
Real time image saliency for black box classifiers
Piotr Dabkowski and Yarin Gal. Real time image saliency for black box classifiers. In NeuIPS, pages 6967–6976, 2017
2017
-
[13]
Fong and Andrea Vedaldi
Ruth C. Fong and Andrea Vedaldi. Interpretable explanations of black boxes by meaningful perturbation. ICCV, pages 3449–3457, 2017
2017
-
[15]
Salient deconvolutional networks
Aravindh Mahendran and Andrea Vedaldi. Salient deconvolutional networks. In ECCV, 2016
2016
-
[16]
Sanity checks for saliency maps
Julius Adebayo, Justin Gilmer, Michael Muelly, Ian Goodfellow, Moritz Hardt, and Been Kim. Sanity checks for saliency maps. In NeurIPS, pages 9525–9536, 2018
2018
-
[17]
A theoretical explanation for perplexing behaviors of backpropagation-based visualizations
Weili Nie, Yang Zhang, and Ankit Patel. A theoretical explanation for perplexing behaviors of backpropagation-based visualizations. In 2018 Workshop on Human Interpretability in Machine Learning (WHI), 2018
2018
-
[18]
On the robustness of interpretability methods
David Alvarez-Melis and Tommi S Jaakkola. On the robustness of interpretability methods. In Workshop on Human Interpretability in Machine Learning (WHI) , 2018
2018
-
[19]
Goodfellow, and Rob Fergus
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014
2014
-
[20]
Goodfellow, Jonathon Shlens, and Christian Szegedy
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In ICLR, 2015. 5
2015
-
[21]
Very deep convolutional networks for large-scale image recognition
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014
2014 arXiv
-
[22]
The pascal visual object classes (voc) challenge
Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes (voc) challenge. IJCV, 88(2):303–338, 2010
2010
-
[23]
Adversarial examples in the physical world
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016
2016 arXiv
-
[24]
Towards evaluating the robustness of neural networks
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 39–57. IEEE, 2017
2017
-
[25]
Amirata Ghorbani, Abubakar Abid, and James Y . Zou. Interpretation of neural networks is fragile. In AAAI, 2017
2017
-
[26]
Anders, Marcel Ackermann, K
Ann-Kathrin Dombrowski, Maximilian Alber, Christopher J. Anders, Marcel Ackermann, K. Mueller, and Pan Kessel. Explanations can be manipulated and geometry is to blame. ArXiv, abs/1906.07983, 2019. 6
1906 arXiv
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.