Research map / Adversarial robustness and security / Certified and empirical robustness

Interpretable but Fragile? Robustness of Concept Bottlenecks under Geometric-Semantic Perturbations

NeurIPS 2026 · Adversarial robustness and security › Certified and empirical robustness · approach: Decision-boundary geometry of robustness · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a generator-based framework (CB-AE generator) that separates latent geometric perturbations from concept-space semantic flips to empirically and certifiably compare standard classifiers and concept bottleneck models on CUB and RIVAL-10, finding CBMs do not uniformly improve robustness.

Problem

Prior studies give conflicting conclusions on whether concept bottleneck models improve robustness; robustness is measured inconsistently across perturbation spaces and criteria.

Approach

A frozen concept-bottleneck generator (CB-AE on StyleGAN/BigGAN) provides a common perturbation interface: latent-space geometric noise and discrete concept flips, with empirical metrics (CFR, PFR, DFS) and randomized-smoothing certificates in latent (l2) and concept (l0) spaces, applied to matched standard and CBM classifiers sharing a backbone.

Key results

• On CUB, the standard ResNet-50 achieves higher smoothed accuracy and larger latent certified radii than PCBM (e.g., sigma=0.10: 81.7% vs 77.2% SmAcc, R 0.1034 vs 0.0918).
• On RIVAL-10 the original split is saturated (100% SmAcc under latent smoothing), so harder variants with added classes or concepts were needed.
• PCBM shows slightly higher prediction flip rate than the standard classifier on CUB across most budgets (e.g., eps=0.05: 31.4% vs 27.1%), but its concept representation is comparatively stable.

Surprising findings

• Higher concept flip rate does not always imply higher prediction instability, and DFS tracks PFR better than CFR.
• The effect of concept vocabulary size on CBM robustness is non-monotonic.

Limitations

• Analysis relies on generator-native inputs, so results may not transfer to real-world images outside the generator manifold.
• Only post-hoc CBMs with frozen backbones are studied; end-to-end CBMs are not evaluated.
• Conclusions limited to structured geometric and semantic perturbations and do not replace pixel-space adversarial evaluation.

Experimental setup

Datasets: CUB-200-2011 RIVAL-10

Benchmarks: CUB-200-2011 RIVAL-10

Metrics: prediction flip rate concept flip rate decision function sensitivity smoothed accuracy certified radius robust accuracy under APGD-CE

Baselines: ResNet-50 standard classifier PCBM

Builds on: concept bottleneck models post-hoc concept bottleneck models randomized smoothing APGD

Closest papers by meaning

• An Analysis of Concept Bottleneck Models: Measuring, Understanding, and Mitigating the Impact of Noisy Annotations (NeurIPS 2025 · similarity 0.92)
• A theoretical design of concept sets: improving the predictability of concept bottleneck models (NeurIPS 2024 · similarity 0.90)
• Hyperbolic Concept Bottleneck Models (NeurIPS 2026 · similarity 0.89)
• Sample-efficient Learning of Concepts with Theoretical Guarantees: from Data to Concepts without Interventions (NeurIPS 2025 · similarity 0.89)
• Measuring What Matters: Synthetic Benchmarks for Concept Bottleneck Models (NeurIPS 2026 · similarity 0.88)
• Energy-Based Concept Bottleneck Models: Unifying Prediction, Concept Intervention, and Probabilistic Interpretations (ICLR 2024 · similarity 0.88)