Research map / Adversarial robustness and security / Black-box and transfer attacks
Manifold Integrated Gradients: Riemannian Geometry for Feature Attribution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Manifold Integrated Gradients (MIG), which integrates classifier gradients along geodesics of a VAE-induced Riemannian latent manifold instead of the linear image-space path, yielding less noisy and more attack-robust attributions.
Problem
Integrated Gradients produces noisy saliency maps for vision models and is vulnerable to targeted attributional attacks, largely because its linear path crosses off-manifold, saturated regions.
Approach
Replace the linear attribution path with a geodesic computed under the Riemannian metric induced by a VAE decoder's Jacobian, so the path follows the data manifold; classifiers are trained on VAE reconstructions and attributions are integrated along the mapped geodesic.
Key results
- On Oxford-IIIT Pets, MIG reaches SENS_max 0.17 and INFD 1.86 versus 0.87 and 7.65 for IG (lower is better).
- Under IG-targeted attributional attacks, MIG attains SSI of 0.87, 0.91 and 0.86 on Pets for VGG-16, ResNet18 and InceptionV1, versus 0.43, 0.48 and 0.36 for IG.
- On 102 Flowers, MIG achieves INFD 3.46 versus 15.26 for IG and SSI up to 0.86 versus 0.41 for IG.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace IG's linear path with a geodesic path on the learned data manifold | MIG · Oxford IIT Pets and 102 Flowers | SENSmax: 0.87 -> 0.17; 0.74 -> 0.21 | Helped |
| Replace IG's linear path with a geodesic path on the learned data manifold | MIG · Oxford IIT Pets and 102 Flowers | INFD: 7.65 -> 1.86; 15.26 -> 3.46 | Helped |
| Replace IG's linear path with a geodesic path on the learned data manifold | MIG · Oxford IIT Pets and 102 Flowers, VGG-16 | SSI: 0.43 -> 0.87; 0.35 -> 0.74 | Helped |
| Replace IG's linear path with a geodesic path on the learned data manifold | MIG · Oxford IIT Pets and 102 Flowers, ResNet18 | SSI: 0.48 -> 0.91; 0.41 -> 0.86 | Helped |
| Replace IG's linear path with a geodesic path on the learned data manifold | MIG · Oxford IIT Pets and 102 Flowers, InceptionV1 | SSI: 0.36 -> 0.86; 0.36 -> 0.71 | Helped |
| Replace SmoothIG with a geodesic path on the learned data manifold | MIG · Oxford IIT Pets and 102 Flowers | SENSmax: 0.42 -> 0.17; 0.38 -> 0.21 | Helped |
| Replace SmoothIG with a geodesic path on the learned data manifold | MIG · Oxford IIT Pets and 102 Flowers | INFD: 4.30 -> 1.86; 9.81 -> 3.46 | Helped |
Surprising findings
- In one example, EIG (linear path in latent space) produces nearly the same maps as MIG because the geodesic lies in a nearly flat region of the latent manifold.
Limitations
- Requires training a VAE to model the data manifold and computing geodesics, adding complexity and cost.
- Results are reported only on two image datasets with VGG-16, ResNet18 and InceptionV1 backbones.
- Robustness is evaluated against IG-targeted attacks only, and new adversarial attacks targeting MIG may exist.
Experimental setup
Datasets: Oxford-IIIT Pet Dataset Oxford 102 Flower Dataset
Benchmarks: Oxford-IIIT Pet Dataset Oxford 102 Flower Dataset
Metrics: maximum sensitivity explanation infidelity structural similarity index
Baselines: Saliency Input x Gradients Guided Backpropagation IG SmoothIG EIG BlurIG
Builds on: Integrated Gradients Guided Integrated Gradients Blur IG Expected Integrated Gradients SmoothGrad
Closest papers by meaning
- Integrated Decision Gradients: Compute Your Attributions Where the Model Makes Its Decision (AAAI 2024 · similarity 0.86)
- Derivative-Free Diffusion Manifold-Constrained Gradient for Unified XAI (CVPR 2025 · similarity 0.84)
- LibraGrad: Balancing Gradient Flow for Universally Better Vision Transformer Attributions (CVPR 2025 · similarity 0.84)
- Task-Induced Riemannian Metrics for Vision Transformer Feature Spaces (NeurIPS 2026 · similarity 0.84)
- The Geometric Wall: Manifold Structure Predicts Layerwise Sparse Autoencoder Scaling Laws (NeurIPS 2026 · similarity 0.84)
- Manifold Induced Biases for Zero-shot and Few-shot Detection of Generated Images (ICLR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.