Research map / Adversarial robustness and security / Certified and empirical robustness

Training for Stable Explanation for Free

NeurIPS 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Decision-boundary geometry of robustness · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ranking explanation thickness, a top-k ranking-based stability metric, and R2ET, a cheap regularizer (two extra backward passes) that trains classifiers for stable saliency explanations and avoids adversarial training's cost and arms race.

Problem

Explanations from gradient-based methods are easily manipulated by small input perturbations; existing stability work uses ℓp distances that do not match human perception of the top-k salient features, and adversarial training for explanation robustness is computationally intensive and prone to an a

Approach

Defines a ranking-based "explanation thickness" measuring the expected gap between top-k salient and non-salient feature importances over a neighborhood, bounds it with Hessian terms, and uses this as a regularizer (R2ET) that needs only two backward passes per sample, with theoretical links to certified robustness, adversarial training, and constrained optimization.

Key results

• R2ET achieves the highest P@k in many settings, e.g., on ADHD under ERAttack R2ET reaches 71.6% P@k versus 45.5% for Vanilla and 59.4% for AT (pairwise t-test significant).
• On COMPAS, R2ET raises P@k to 92.0% under ERAttack versus 84.2% for Vanilla, and SP reaches 99.5%, showing mixed winners across datasets.
• Sample-level thickness correlates strongly with attack iterations to first flip on COMPAS (correlation 0.89), while Hessian norm alone does not (0.06).

Measured effects reported in the paper

Surprising findings

• MSE (l2) attacks barely change rankings and give over-optimistic robustness impressions compared with ranking-based ERAttack.
• The ablation R2ET\H (without the Hessian term) outperforms full R2ET on Adult and Bank, which the authors attribute to higher thickness on those datasets.

Limitations

• R2ET optimizes a surrogate of thickness rather than exact thickness, so it does not uniformly beat baselines (e.g., SP or R2ET\H on some datasets).
• Theoretical analysis and bounds are restricted to gradient-based explanation methods.
• Some bounds rely on local Lipschitz and smoothness assumptions and approximations (Taylor expansions).

Experimental setup

Datasets: Adult Bank COMPAS MNIST CIFAR-10 ROCT BP ADHD

Benchmarks: Adult Bank COMPAS MNIST CIFAR-10 ROCT BP ADHD

Metrics: Precision@k (P@k) model-level thickness AUC (clean prediction)

Baselines: Vanilla WD SP Est-H Exact-H SSR AT (Fast-AT)

Builds on: Fast adversarial training Hessian norm regularization (Est-H) weight decay curvature smoothing softplus activation for explanation robustness SmoothGrad Integrated Gradients

Closest papers by meaning

• Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation (NeurIPS 2024 · similarity 0.86)
• Promoting Counterfactual Robustness through Diversity (AAAI 2024 · similarity 0.84)
• TAET: Two-Stage Adversarial Equalization Training on Long-Tailed Distributions (CVPR 2025 · similarity 0.84)
• Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.84)
• Probing RLVR Training Instability through the Lens of Objective-Level Hacking (ICML 2026 · similarity 0.84)
• Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.83)