Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper provides certification guarantees on robustness of gradient based explainers by providing upper bounds on the largest adversarial change that can be made to the explanation from these explainers given bounded manipulation of either the input features or model parameters. Additionally, these bounds are differentiable, which means they can be used during training of neural networks that the explainers intend to explain and the resulting explanations will be provably robust. 
strength_and_weaknesses: Strengths:
- Important and significant research problem. Robustness of of explanation is an important problem from interpretability as well as fairness point of views. As authors point out, most current explainers are not very robust.
- Theoretically grounded with provable certifications.
- Actionable result as the results can directly be used to improve NN training from robust explanations point of view.
- Thorough experiments on a variety of different datasets. 

Weaknesses:
These are minor points but can help
- the $\tau$ notation is overloaded between being a similarity threshold and a dissimilarity threshold. I don't think that confusion is needed either. Authors can stick with $\tau$ as similarity threshold and simply flip the inequalities where it's currently being used as a dissimilarity threshold, this will also improve readability.

- A few citations can enhance the intro further in the discussion of explainer robustness e.g. Alvarez-Melis & Jaakkola (2018) "On the robustness of interpretability methods" is a good reference discussing why robustness is important in explainers and how to quantify it. Khan et al. (2022) "Analyzing the effects of classifier Lipschitzness on explainers" and Wang et al. (2022) " "Robust Models Are More Interpretable Because Attributions Look Normal" " discusses the connection between smoothness of classifiers and robustness of explanation. Zhou et al (2022) "From local explanations to model understanding" and Ju et al (2022) "Logic traps in evaluating attribution scores" provide some useful counterpoints in the discussion about the importance of robustness for explainers.
clarity,_quality,_novelty_and_reproducibility: - The paper is well written, clear and of good quality.
- Reproducibility is somewhat harder to ascertain, although the experiments are described in details, the code link is not available.
summary_of_the_review: I believe this paper is worth appearing in ICLR as it enhances our understanding of explainer robustness, and provides actionable tools for certifiably achieving it at training time.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The authors propose a bound on how much a gradient based explanation can be manipulated (by input OR model parameter manipulation). They then include the bounds into the training regime to create certifiably robust networks. They compare their approach to previous attempts to make neural network explanations more robust on several data sets. The thorough quantitative and qualitative evaluation shows the advantages of the authors' proposed methods.
strength_and_weaknesses: ### Strengths

- important topic
- theoretical justification/motivation
- comparison to previous works
- quantitative and qualitative evaluation looks very promising
- the authors address robustness to input AND model parameter manipulation


### Weaknesses

- a more thorough theoretical analysis of differences to previous work would have been interesting
- no evaluation on high dimensional image data (ImageNet)
- the authors claim a bit too much for very little theoretical justification. After all they are still just solving an optimization problem, so there are not really guarantees.

### Question and Remarks
- I don't quite understand why in section 3 you define the gradient explanation as the gradient of the LOSS of the neural network output. It is usually just defined as the gradient wrt the winning class neuron of the network... The loss $\mathcal{L}$ is also not defined anywhere. Is that the training loss? Why?
- What is $J$ in the Backward Pass w.r.t. Bounds equations on page 6?
- Where is the proof sketch and where is Appendix X?
- Why can your certification procedure from section 4.1 not also be applied to standard, L2 Regr and Hessian Regr approaches?
- You talk a lot about guarantees and provable robustness. But the theory does not provide these guarantees and empirically you would have to test all possible perturbation configurations in your defined ranges which you probably didn't do. 

### Typos/ minor remarks
- in 4: Now, we proceed define what it $\rightarrow$ Now, we proceed to define what it
- in 5: As desired, Lemma 1 allows us to jointy propagate $\rightarrow$ As desired, Lemma 1 allows us to jointly propagate
- choosing $\mathcal{L}$ for loss and loser bound seems a bit unfortunate.
- in 5.1: For input robustness, implies that for all points in $\rightarrow$ For input robustness, this implies that for all points in
clarity,_quality,_novelty_and_reproducibility: ### Clarity
The motivation and procedure are clearly explained and the paper is well-written. I just find the loss thing confusing (see questions).
The text in Figure 2 is too small.

### Quality
The discussion of previous work is very thorough. The experiments are of high quality. The theoretical justification is not very thorough though. Proof and theoretical guarantees are missing.

### Novelty
The topic of explanation robustness is not new. The author's approach is very related to previous work. The empirical results show superior performance very clearly.

### Reproducability
The authors say that they will provide code, but it is not provided for the reviewers so I cannot assess the reproducibility at this point. Please provide an anonymous GitHub repository or send the code with the supplementary material next time to make assessment possible,
summary_of_the_review: Overall I think this is a decent contribution. The authors could improve their work by providing a more thorough theoretical analysis. They might also consider lowering their claims and discussing the limitations of their approach critically. I'm happy to change my recommendation when my questions are answered to a satisfactory degree.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper proposes a framework for assessing the explanation robustness of neural network (NN) models in the context of both classification and regression tasks. This proposed framework is claimed to solve a number of issues pertaining to the recent heuristic explanation approaches that suffer from a wide range of relevant adversarial attacks, i.e. "out-of-distribution" attacks, among many others. In particular, the paper develops a method to upper-bound the largest change an adversary can make in order to fool the corresponding explainer. The framework also allows one to train an NN model that is guaranteed to be certified explanation robust subject to a given parameter delta. Experimental results obtained for a few datasets demonstrate the efficiency of the proposed framework.
strength_and_weaknesses: First of all, I should admit that I am no expert on heuristic explanation methods in machine learning so I might have overlooked some of the technicalities of the paper. However, I did my best to assess its general idea and its merits.

I will start by listing the pros of the paper. I believe the paper is nicely written. The discussion is concise but informative enough for an average reader (like me) to follow. It clearly poses the problem with the existing explanation approaches and proposes a solution to the problem. Although I have not checked the proofs of the theoretical results, they make perfect sense to me. I should also say that experimental results look convincing to me.

On the negative side and despite my previous comments on the clarity, the paper mixes up the concept of explanations with the properties of the models themselves, which I find somewhat confusing. This can be observed in Definitions 1 and 2, which seemingly discuss the properties of an explanation while, in fact, they describe the properties of a model.

Here I should also say that despite the claims made on explanation robustness, the authors fail to define what kind of explanations their methodology actually supports. Indeed, there are numerous post-hoc explanation approaches and the explanations they produce may vary a lot in terms of both syntax and semantics. It would be great if the authors could elaborate on this in their rebuttal.

Finally, the authors overlook a large body of work on formal explainable AI, where abductive and contrastive explanations computed by means of formally reasoning about the target model are guaranteed to be sound (correct), i.e. no robustness issues apply to them. Furthermore, there are probabilistic extensions of the above, which are not discussed in the paper either. I believe these lines of work should have been discussed in the related work. I would also appreciate it if the authors could comment on this in the rebuttal.
clarity,_quality,_novelty_and_reproducibility: Clarity- and quality-wise, I believe the paper is well-written. Also, to the best of my knowledge, the proposed idea is novel. The paper is augmented with a few appendices although I am not sure if the source code is provided (could not find a link in the paper) to reproduce the results described.

summary_of_the_review: Although the paper has a few issues outlined above, I am inclined to believe it makes an interesting contribution, which can be deemed sufficient for publication at ICLR.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes certification methods for assessing input-gradient robustness to both perturbations in inputs and weights, and this is achieved using interval bound propagation (IBP) methods. To this end, the paper proposes to use box-type constraints to measure input-gradient robustness (definitions 1 and 2). The main methodological contributions are the usage of Lemma 1 on neural network, which presents a way to compute bounds of products of matrices; and section 5.1, which presents a regularized loss function based on the certified loss. 

Experiments show that the proposed certified loss function results in models that have improved gradient attack robustness across datasets, and sparser gradients with minimal degredation of test performance.

strength_and_weaknesses: **Strengths**:
+ The problem considered is an important one, and the proposed direction of having certifiable bounds on gradients robustness has not been explored much in literature, and thus is novel and 
interesting from that perspective. 

+ The proposed solution of presenting a common method that provides robustness both to input and weights perturbation via box constraints is novel as far as I am aware.

**Weaknesses**:

**Lemma 1: unclear novelty, missing proof, unclear notations, unclear slackness**

- The central result for this paper (Lemma 1) seems to be a previously known result, and the contribution of this paper is its usage for forward and backward propogating interval bounds in NNs. However, this point is not stated clearly in the paper, as the introduction claims that "We derive explicit bounds relying on interval bound propagation" suggesting that they indeed derive Lemma 1. Perhaps they mean that they present a computational framework to **compute** bounds rather than derive them? It would be helpful to more clearly state the contributions of this paper in this case.

- The paper states that "We provide more detailed exposition and proof-sketch in Appendix X", which I could not find in the supplementary material. Presumably these are proofs for Lemma 1 and their usage for deriving NN forward and backward propagation?

- (Minor) The statement of Lemma 1 includes the notation M^B = A | B^r |. Just to clarify, is this a matrix multiplication of A with element-wise absolute value of B^r? It would be helpful to clarify this notation.

- (Minor) The paper mentions that this Lemma may not provides the tightest bounds. It would be helpful to provide some discussion or intuition about how loose these bounds are, and under what conditions are they tight.

- (Minor) I could not find Lemma 1 in the PhD thesis linked, so it would help to provide more detailed pointers regarding chapter number, etc.

**(Minor) Robustness definition may not be practically relevant** 

- Definitions 1 and 2 present defns for explanation robustness in terms of box constraints. However, the **direction** of an explanation vector is more important than its magnitude which reveals the relative importance of various input features. Thus according to the current definition, assume there exists explanation vectors whose directions remains constant within inputs set "T" or parameter set "M", but only their magnitude changes. Then such models have non-robust gradients according to the present definition, but that may not be of practical significance as far as explanations are concerned.

**Missing baselines: gradient regularization, local linearization and curvature regularization** 

- A missing baseline is gradient norm regularization, which penalizes the magnitude of the gradient explanation. The proposed regularizer penalizes both gradient magnitude and directions (see previous point), so it is important to disentangle the effects of magnitude vs direction regularization. 

- Another set of missing baselines are a local linearity regularizer (https://arxiv.org/abs/1907.02610), and curvature regularization (https://arxiv.org/abs/1811.09716) which explicitly penalizes model curvature, which in the limit forces models to be linear similar to the proposed method.

- An alternative to these approaches is to compare against an adversarial training baseline, as all these methods are intended to be proxies for the same.

**Missing evaluations on larger datasets and models**

- Evaluations presently seem to be conducted on relatively smaller datasets (those that are MNIST-scale and below) and small models (two hidden layer neural networks). Some evaluations on larger datasets such as CIFAR / SVHN and larger models like deep resnets would help assess the scalability of the approach. 
clarity,_quality,_novelty_and_reproducibility: Clarity: The paper is easy to read, however as mentioned in the weaknesses section, the state of some contributions are unclear and some mathematical notations are undefined.

Quality: The proofs are currently missing, which makes it impossible to assess the correctness and applicability of Lemma 1. Experiments miss crucial baselines, thus the paper scores low on quality.

Novelty: The problem proposed in the paper, that of simultaneous gradient robustness wrt inputs and weights, is novel as far as I am aware. IBP bounds are known, so the method scores low on novelty of methods.

Reproducibility: The calculations presented in the paper seem simple enough to be reproduced independently, so this does not appear to be an issue.

summary_of_the_review: Overall, this paper misses some crucial details about its central result that impact its novelty, misses relevant baselines, and conducts only small scale experiments. As a result, I am currently leaning towards a reject.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper provides a novel method to bound adversarial changes to gradient based explanations and train neural with certified robustness guarantees. The method and paper are well executed. The primary drawback is that the method has only been tested on MNIST scale experiments and likely does not scale to large models. Despite this the paper presents a novel and interesting contribution and should be published.
justification_for_why_not_higher_score: The method should have experimental evaluation on larger datasets/networks.
justification_for_why_not_lower_score: The paper is interesting and novel and correct.
Decision: Accept: poster