Research map / Adversarial robustness and security / Black-box and transfer attacks
Derivative-Free Diffusion Manifold-Constrained Gradient for Unified XAI
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FreeMCG, a derivative-free, black-box gradient approximation that uses diffusion-model Tweedie particles and ensemble Kalman filter covariance to give on-manifold gradients for both feature attribution and counterfactual explanation.
Problem
Gradient-based XAI needs white-box model access, is vulnerable to adversarial-like off-manifold attributions, and feature attribution and counterfactual explanation are treated as separate tasks.
Approach
Approximate the classifier's gradient projected onto the data manifold without derivatives: sample particles via diffusion Tweedie denoising, and estimate the covariance-preconditioned gradient as the cross-covariance between particles and classifier logits (EnKF-style), then use it for both attribution and reverse-diffusion counterfactual generation.
Key results
- Counterfactuals: FreeMCG achieves perceived change 1.65 versus 2.35 for DVCE* and 2.00 for LDCE on the human study, with lower flip rate (51.5%) than DVCE* (85.8%) and LDCE (61.7%).
- FreeMCG has the steepest prediction decline among gradient-based attribution methods on ROAD, approaching the SHAP lower bound.
- FreeMCG achieves L2 1001.02 and FID 1001.02-scale values comparable to DVCE* (995.92), while LDCE has FID 1351.39.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FreeMCG instead of gradient-based counterfactual methods | Counterfactual generation with ResNet-50 · ImageNet validation | flip rate: 85.8 vs 51.5 | Hurt |
| Use FreeMCG instead of gradient-based counterfactual methods | Counterfactual generation with ResNet-50 · perceived change | perceived change: 2.35 vs 1.65; 2.00 vs 1.65 | Helped |
| Use FreeMCG instead of gradient-based counterfactual methods | Counterfactual generation with ResNet-50 · ImageNet validation | FID: 71.38 vs 66.89; 63.04 vs 66.89 | Mixed |
| Use FreeMCG for feature attribution rather than gradient-based attribution methods | Feature attribution · ImageNet and MIMIC-CXR | ROAD prediction decline | Helped |
Surprising findings
- Gradient-based counterfactual baselines often fool the classifier without semantically meaningful change, behaving like adversarial attacks.
- FreeMCG has a lower flip rate than gradient-based baselines, since it lacks model gradients, yet is judged to produce more perceived change.
Limitations
- Requires black-box access to logits; not applicable when only class predictions are available.
- Reverse-diffusion counterfactual variant is slower and the simple gradient ascent variant is hyperparameter-sensitive.
- Flip rate is lower than gradient-based baselines, since the method does not use model gradients.
Experimental setup
Datasets: ImageNet MIMIC-CXR
Benchmarks: ImageNet validation set (counterfactuals, 1K) MIMIC-CXR (ROAD feature attribution) ImageNet (ROAD feature attribution)
Metrics: flip rate L2 distance FID perceived change perceived similarity perceived realism ROAD prediction drop
Baselines: DVCE LDCE Vanilla gradient Integrated Gradients InputXGradient SHAP
Builds on: Tweedie's formula ensemble Kalman filter DVCE LDCE SDEdit
Closest papers by meaning
- Understanding and Improving Training-free Loss-based Diffusion Guidance (NeurIPS 2024 · similarity 0.87)
- CFG++: Manifold-constrained Classifier Free Guidance for Diffusion Models (ICLR 2025 · similarity 0.86)
- Manifold Preserving Guided Diffusion (ICLR 2024 · similarity 0.85)
- LGDM: Latent Guidance in Diffusion Models for Perceptual Evaluations (ICML 2025 · similarity 0.85)
- Diffusion Model's Generalization Can Be Characterized by Inductive Biases toward a Data-Dependent Ridge Manifold (NeurIPS 2026 · similarity 0.85)
- Structure-Guided Adversarial Training of Diffusion Models (CVPR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.