Research map / Adversarial robustness and security / Certified and empirical robustness
Pixel-level Certified Explanations via Randomized Smoothing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Certifies pixel-level robustness of any black-box attribution method by sparsifying attribution maps into top-K% binary masks and applying randomized smoothing for segmentation, with three certified metrics across 12 attribution methods and 5 ImageNet models.
Problem
Post-hoc pixel attribution maps are non-robust to small l2-bounded input perturbations, and prior certified attribution work only bounds image-level similarity scores rather than individual pixels.
Approach
Reframe attribution as a segmentation task by binarizing attribution maps into top-K% vs. rest, then apply randomized smoothing for segmentation to certify each pixel's importance class under l2 perturbations, abstaining on unstable pixels.
Key results
- LRP and RISE achieve the best trade-off between certified robustness (%certified), certified localization and faithfulness across settings.
- Input-layer backpropagation methods such as IxG and IntGrad show roughly 0% certified pixels at input layer, while RISE has the highest certification rates across all radii at the input layer.
- Activation-based methods perform worse than random on Certified GridPG at the input layer, while Grad and GB achieve near-random localization at the final layer despite high certification rates.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RISE instead of other attribution methods | ImageNet classifiers · ImageNet validation images, input layer | %certified | Helped |
| Use LRP or RISE instead of other attribution methods | ImageNet classifiers · ImageNet validation images | robustness-localization-faithfulness tradeoff | Helped |
| Use RISE instead of other attribution methods | ImageNet classifiers · Certified GridPG, input and final layers | Certified GridPG | Helped |
| Increase the certified radius (ablation) | Pixel-certified attributions · ImageNet classifiers | %certified | Hurt |
| Decrease the sparsification parameter K (ablation) | Pixel-certified attributions · ImageNet classifiers | certified top-K pixels | Hurt |
| Decrease the sparsification parameter K (ablation) | Pixel-certified attributions · Certified GridPG, robust methods | Certified GridPG | Helped |
| Increase the certification threshold τ from 0.60 to 0.75 (ablation) | Pixel-certified attributions · ResNet-18 | Certified GridPG | Helped |
| Increase the certification threshold τ (ablation) | Pixel-certified attributions · ResNet-18 | %certified | Hurt |
| Increase the certification threshold τ to 0.95 (ablation) | Pixel-certified attributions · ResNet-18 | %certified | Hurt |
| Evaluate at the final layer instead of the input layer (ablation) | Attribution methods · ImageNet classifiers | %certified | Helped |
| Evaluate at the final layer instead of the input layer (ablation) | Attribution methods · ImageNet classifiers | Certified GridPG | Helped |
| Use activation-based methods at the input layer | Activation-based attribution methods · Certified GridPG, ImageNet classifiers | Certified GridPG | Hurt |
Surprising findings
- Grad and Guided Backpropagation are the most robust at the final layer on CNNs but produce grid-like, uninformative constant attributions with random-like localization.
- Certified GridPG for backpropagation and activation methods can exceed their raw GridPG, attributed to certification rejecting positive evidence outside the correct subimage.
Limitations
- Certification requires many Monte-Carlo samples per image, making it computationally costly, so only 100 images were evaluated.
- Certified radius trades off against base model accuracy via noise level sigma; higher radius reduces certification rates.
- LRP and CAM were not evaluated on ViT-B/16 due to lack of transformer extensions.
Experimental setup
Datasets: ImageNet
Benchmarks: ImageNet
Metrics: %certified Certified GridPG deletion-based faithfulness (confidence drop)
Baselines: Grad Guided Backpropagation Integrated Gradients Input x Gradient LRP CAM Grad-CAM Grad-CAM++ Ablation-CAM Layer-CAM RISE Occlusion
Builds on: randomized smoothing randomized smoothing for segmentation Sparsified SmoothGrad certification GridPG
Closest papers by meaning
- Smoothed Geometry for Robust Attribution (NeurIPS 2020 · similarity 0.89)
- Benchmarking the Attribution Quality of Vision Models (NeurIPS 2024 · similarity 0.88)
- Rethinking Robustness of Model Attributions (AAAI 2024 · similarity 0.88)
- Probabilistic Stability Guarantees for Feature Attributions (NeurIPS 2025 · similarity 0.87)
- Adaptive Hierarchical Certification for Segmentation using Randomized Smoothing (ICML 2024 · similarity 0.86)
- LibraGrad: Balancing Gradient Flow for Universally Better Vision Transformer Attributions (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.