SlowGuess/NeurIPS_2023_OCR huggingface dataset:
1-Lipschitz networks parametrization. Several soltutions have been proposed to set the Lipschitz constant of affine layers: Weight clipping [7] (WGAN), Frobenius normalization [54] and spectral normalization [46]. In order to avoid vanishing gradients, orthogonalization can be done using Björck algorithm [10]. DEEL.LIP implements most of these solutions, but we focus on layers called SpectralDense and SpectralConv2D, with spectral normalization [46] and Björck algorithm [10]. Most activation functions are Lipschitz, including ReLU, sigmoid, but we use GroupSort2 proposed by [5], and defined by the following equation:
$$
\operatorname {G r o u p S o r t} 2 (x) _ {2 i, 2 i + 1} = \left[ \min  \left(x _ {2 i}, x _ {2 i + 1}\right), \max  \left(x _ {2 i}, x _ {2 i + 1}\right) \right]
$$
Network architectures used for CelebA dataset are described in Table 3.
Network architectures used for FashionMNIST dataset are described in Table 4. The same OTNN architecture is used for MNIST experimentation presented in Fig. 1.
<sup>4</sup>https://github.com/deel-ai/deel-lip distributed under MIT License (MIT)
Table 3: CelebA Neural network architectures: Sconv2D is SpectralConv2D, GS2 is GroupSort2, L2Pool is L2NormPooling, SDense is SpectralDense, BN is BatchNorm, AvgPool is AveragePooling
Dataset	OTNN	Unconstrained NN
Layer	Layer	Output size
CelebA	Input	Input	218 × 178 × 3
SConv2D, GS2	Conv2D, BN, ReLU	218 × 178 × 16
SConv2D, GS2	Conv2D, BN, ReLU	218 × 178 × 16
L2Pool	AvgPool	109 × 89 × 16
SConv2D, GS2	Conv2D, BN, ReLU	109 × 89 × 32
SConv2D, GS2	Conv2D, BN, ReLU	109 × 89 × 32
L2Pool	AvgPool	54 × 44 × 32
SConv2D, GS2	Conv2D, BN, ReLU	54 × 44 × 64
SConv2D, GS2	Conv2D, BN, ReLU	54 × 44 × 64
SConv2D, GS2	Conv2D, BN, ReLU	54 × 44 × 64
L2Pool	AvgPool	27 × 22 × 64
SConv2D, GS2	Conv2D, BN, ReLU	27 × 22 × 128
SConv2D, GS2	Conv2D, BN, ReLU	27 × 22 × 128
SConv2D, GS2	Conv2D, BN, ReLU	27 × 22 × 128
L2Pool	AvgPool	13 × 11 × 128
SConv2D, GS2	Conv2D, BN, ReLU	13 × 11 × 128
SConv2D, GS2	Conv2D, BN, ReLU	13 × 11 × 128
SConv2D, GS2	Conv2D, BN, ReLU	13 × 11 × 128
L2Pool	AvgPool	6 × 5 × 128
Flatten, SDense, GS2	Flatten, Dense, BN, ReLU	256
SDense, GS2	Dense,BN, ReLU	256
SDense	Dense	22
The 1-Lipschitz version of resnet50 is described in Table 5. As the unconstrained version, It has around 25M parameters. For the large version, we simply multiply the number channels in hidden layers by 1.5. The unconstrained version is the standart resnet50 architecture. In the case ofImagenet we use the pretrained version provided by tensorflow.
Table 4: FashionMNIST Neural network architectures: Sconv2D is SpectralConv2D, GS2 is GroupSort2, SDense is SpectralDense, BN is BatchNorm, AvgPool is AveragePooling, SGAvgPool is ScaledGlobalAveragePooling (DEEL.LIP), GAvgPool is GlobalAveragePooling
Dataset	OTNN	Unconstrained NN
Layer	Layer	Output size
FashionMNIST	Input	Input	28 × 28 × 1
SConv2D, GS2	Conv2D, BN,ReLU	28 × 28 × 96
SConv2D, GS2	Conv2D, BN,ReLU	28 × 28 × 96
SConv2D, GS2	Conv2D, BN,ReLU	28 × 28 × 96
SConv2D (stride=2), GS2	Conv2D (stride=2), BN,ReLU	14 × 14 × 96
SConv2D, GS2	Conv2D, BN,ReLU	14 × 14 × 192
SConv2D, GS2	Conv2D, BN,ReLU	14 × 14 × 192
SConv2D, GS2	Conv2D, BN,ReLU	14 × 14 × 192
SConv2D (stride=2), GS2	Conv2D (stride=2), BN,ReLU	7 × 7 × 192
SConv2D, GS2	Conv2D, BN,ReLU	7 × 7 × 384
SConv2D, GS2	Conv2D, BN,ReLU	7 × 7 × 384
SConv2D, GS2	Conv2D, BN,ReLU	7 × 7 × 384
SGAvgPool	GAvgPool	384
SDense	Dense	10
Table 5: 1-lip resnet architecture for Imagenet and cat vs dog: Sconv2D is SpectralConv2D, GS2 is GroupSort2, SDense is SpectralDense, BC is Batchcentering (centeing without normalization), SL2npool is ScaledL2NormPooling2D, SGAvgl2Pool is ScaledGlobalL2NormPooling2D, GAvgPool is GlobalAveragePooling
Layer	output
Input	224 × 224 × 3
SConv2D 7-64 (stride=2), BC, GS2	112 × 112 × 64
InvertibleDownSampling	56 × 56 × 256
[ SConv2D 1 × 1 SConv2D 3 × 3 SConv2D 1 × 1 add-lip	64 64 256	BC, GS2 BC, GS2 BC, GS2	×3	56 × 56 × 256
SL2npool	28 × 28 × 256
[ SConv2D 1 × 1 SConv2D 3 × 3 SConv2D 1 × 1 add-lip	128 128 512	BC, GS2 BC, GS2 BC, GS2	×4	28 × 28 × 512
SL2npool	14 × 14 × 512
[ SConv2D 1 × 1 SConv2D 3 × 3 SConv2D 1 × 1 add-lip	256 256 1024	BC, GS2 BC, GS2 BC, GS2	×6	14 × 14 × 1024
SL2npool	7 × 7 × 1024
[ SConv2D 1 × 1 SConv2D 3 × 3 SConv2D 1 × 1 add-lip	256 256 1024	BC, GS2 BC, GS2 BC, GS2	×3	7 × 7 × 2048
SGAvgl2Pool	2048
SDense	1 cat vs dog imagenet
A.2.3 Losses and optimizer
An extension of  $\mathcal{L}^{hKR}$  to the multiclass case with  $q$  classes. has also been proposed in [56] The idea is to learn  $q$  1-Lipschitz functions  $f_{1},\ldots ,f_{q}$ , each component  $f_{i}$  being a one-versus-all binary classifier. The loss proposed was the following
$$
\mathcal {L} _ {\lambda , m} ^ {h K R} \left(f _ {1, \dots , q}\right) = \sum_ {k = 1} ^ {q} \left[ \underset {\mathbf {x} \sim \neg P _ {k}} {\mathbb {E}} \left[ f _ {k} (\mathbf {x}) \right] - \underset {\mathbf {x} \sim P _ {k}} {\mathbb {E}} \left[ f _ {k} (\mathbf {x}) \right] \right] + \lambda_ {\mathbf {x}, y \sim \bigcup_ {k = 1} ^ {q} P _ {k}} \left(H \left(f _ {1} (\boldsymbol {x}), \dots , f _ {q} (\boldsymbol {x}), y, m\right) \right. \tag {4}
$$
with :
$$
H \left(f _ {1} (\boldsymbol {x}), \dots , f _ {q} (\boldsymbol {x}), y, m\right) = (m - f _ {y} (\boldsymbol {x})) _ {+} + \sum_ {k \neq y} (m + f _ {k} (\boldsymbol {x})) _ {+}
$$
This formulation has three main drawbacks: (i) for large number of classes several outputs may have few or no positive sample within a batch leading to slow convergence, (ii) weight of  $f_{y}(\boldsymbol{x})$  (the function of the true class) with respect to the other decreases when the number of classes increases, (iii) the expectancy has to be evaluated through the batch, making the loss dependant of the size of the batch.
To overcome these drawbacks, we propose first to replace the Hinge term  $H$  with a softmax weighted version. The softmax on all but true class is defined by:
$$
\sigma \left(f _ {k} (\boldsymbol {x}), y, \alpha\right) = \frac {e ^ {\alpha * f _ {k} (\boldsymbol {x})}}{\sum_ {j \neq y} e ^ {\alpha * f _ {j} (\boldsymbol {x})}}
$$
We can define a weighted version of  $H$  function:
$$
H _ {\sigma} \left(f _ {1} (\boldsymbol {x}), \dots , f _ {q} (\boldsymbol {x}), y, m, \alpha\right) = (m - f _ {y} (\boldsymbol {x})) _ {+} + \sum_ {k \neq y} \sigma \left(f _ {k} (\boldsymbol {x}), y, \alpha\right) * \left(m + f _ {k} (\boldsymbol {x})\right) _ {+}
$$
In this function, the value of  $f_{y}(\pmb{x})$  for the true class maintains consistent weight relative to the values of other functions, regardless of the number of classes.  $\alpha$  is a temperature parameter. Initially, the softmax behaves like an average as all the values of  $f_{k}$  are close. However, during the learning process, as the values of  $|f_{k}|$  increase, the softmax transitions to function like a maximum. Similarly, if a low value is chosen for  $\alpha$ , the softmax behaves as an average, resulting in a one vs all hKR loss. By choosing a higher value for  $\alpha$ , the softmax unbalances the weights. Thus the loss persists as a one vs all hKR but incorporates a re-weighting of the opposing classes for each targeted class.
We also propose a sample-wise and weighted version of the KR part (left term in Eq 4). to get the proposed loss:
$$
\begin{array}{l} \mathcal {L} _ {\lambda , m, \alpha} ^ {h K R} \left(f _ {1, \dots , q}, x, y\right) = \left[ \sum_ {k \neq y} \left[ f _ {k} (\boldsymbol {x}) * \sigma \left(f _ {k} (\boldsymbol {x}), y, \alpha\right) \right] - f _ {y} (\mathbf {x}) \right] \tag {5} \\ + \lambda * H _ {\sigma} (f _ {1} (\boldsymbol {x}), \dots , f _ {q} (\boldsymbol {x}), y, m, \alpha) \\ \end{array}
$$
It's important to note that this definition only applies to the balanced multiclass case (as in FashionMnist and ImageNet). In the unbalanced scenario, the weight must be rescaled according to the a priori distribution of the classes.
For CelebA, with hyperparameters  $\lambda$  is set to 20, and  $m = 1$ . For FashionMNIST, we use Eq. 5,  $\lambda$  is set to 5,  $\alpha = 10$  and  $m = 0.5$ . For cat vs dog  $\lambda$  is set to 10 and  $m = 18$ . ForImagenet  $\lambda$  is set to 500,  $\alpha = 200$  and  $m = 0.05$ .
We train all networks with ADAM optimizer [39]. We use a batch size of 128, 200 epochs, and a fixed learning rate  $1\mathrm{e} - 2$  for CelebA. For FashionMNIST we perform 200 epochs with a batch size of 128. We fix the learing rate to  $5\mathrm{e} - 4$  for the 50 first epochs,  $5\mathrm{e} - 5$  for the epochs 50-75,  $1\mathrm{e} - 6$  for the last epochs. For cat vs dog we perform 200 epochs with a batch size of 256. We fix the learing rate to  $1\mathrm{e} - 2$  for the 100 first epochs,  $1\mathrm{e} - 3$  for the epochs 100-150,  $1\mathrm{e} - 4$  for the epochs 150-180 and  $1\mathrm{e} - 9$  for the last epochs. ForImagenet we perform 40 epochs with a batch size of 512. We fix the learing rate to  $5\mathrm{e} - 4$  for the 30 first epochs,  $5\mathrm{e} - 5$  for the epochs 30-35,  $1\mathrm{e} - 5$  for the epochs 35-38 and  $1\mathrm{e} - 9$  for the last epochs.
A.3 Complementary results
A.3.1 FashionMNIST performances and ablation study
Table 6 presents different performance results on FashionMNIST. First line is the reference unconstrained network. Second line shows the performances of the new version of  $\mathcal{L}_{\lambda,\alpha}^{hKR}$ . Table 6 also shows that the new version of the  $\mathcal{L}_{\lambda,m,\alpha}^{hKR}$  in the multiclass case (Eq. 5) outperforms the  $\mathcal{L}_{\lambda,m}^{hKR}$  defined in [56] (Eq. 4). Obviously, the accuracy enhancement is obtained at the expense of the robustness. The main interest of this new loss is to provide a wider range in the accuracy/robustness trade-off.
Table 6: FashionMNIST accuracy comparison with the different version of multiclass  ${\mathcal{L}}_{\lambda ,m}^{hK R}$  . For the fixed margin,we use the one that performs best by parameter tuning (i.e.  $m = {0.5}$  )
Model	Accuracy
Unconstrained	88.5
OTNN λ,mhKRTmulticlass version [56] (λ = 10, m = 0.5)	72.2
(Ours) OTNN λ,m,αhKRT(λ = 10, m = 0.5, α = 10) (Eq. 5)	88.6
A.3.2 CelebA performances
Table 7 presents the Sensibility and Specificity for each label reached by Unconstrained network and OTNN.
As a reminder, given True Positive (TP), True Negative (TN), False Positive (FP), False Negative (FN) samples, Sensitivity (true positive rate or Recall) is defined by:
$$
S e n s = \frac {T P}{T P + F N}
$$
Specificity (true negative rate) is defined by:
$$
S p e c = \frac {T N}{T N + F P}
$$
Table 7: CelebA performance results for unconstrained and OTNN networks
Model	Metrics: Sensibility/Specificity
Attractive	Bald	Big_Nose	Black_Hair
Unconstrained	0.83 / 0.81	0.64 / 1.00	0.65 / 0.87	0.74 / 0.95
OTNN	0.80 / 0.75	0.87 / 0.83	0.73 / 0.70	0.78 / 0.84
Blond_Hair	Blurry	Brown_Hair	Eyeglasses
Unconstrained	0.86 / 0.97	0.49 / 0.99	0.80 / 0.88	0.96 / 1.00
OTNN	0.86 / 0.89	0.66 / 0.72	0.81 / 0.73	0.80 / 0.89
Gray_Hair	Heavy_Makeup	Male	Mouth_Slightly_Open
Unconstrained	0.62 / 0.99	0.84 / 0.95	0.98 / 0.98	0.93 / 0.94
OTNN	0.84 / 0.83	0.89 / 0.83	0.92 / 0.89	0.80 / 0.89
Mustache	Receding_Hairline	Rosy_Cheeks	Sideburns
Unconstrained	0.47 / 0.99	0.47 / 0.98	0.46 / 0.99	0.79 / 0.98
OTNN	0.86 / 0.76	0.81 / 0.79	0.82 / 0.80	0.79 / 0.82
Smiling	Wearing_Earrings	Wearing_Hat	Wearing_Lipstick
Unconstrained	0.90 / 0.95	0.84 / 0.90	0.89 / 0.99	0.90 / 0.96
OTNN	0.84 / 0.88	0.78 / 0.72	0.86 / 0.90	0.90 / 0.89
Wearing_Necktie	Young
Unconstrained	0.75 / 0.98	0.95 / 0.65
OTNN	0.87 / 0.86	0.79 / 0.69
A.4 Complementary explanations metrics
A.4.1 Explanation attribution methods
An attribution method provides an importance score for each input variables  $x_{i}$  in the output  $f(x)$ . The library used to generate the attribution maps is Xplique [24].
For a full description of attribution methods, we advise to read [21], Appendix B. We will only remind here the equations of
- Saliency:  $g(\pmb{x}) = |\nabla_{\pmb{x}}f(\pmb{x})|$
- SmoothGrad:  $g(\pmb{x}) = \underset{\delta \sim \mathcal{N}(0, \mathbf{I}\sigma)}{\mathbb{E}} (\nabla f(\pmb{x} + \delta))$
SmoothGrad is evaluated on  $N = 50$  samples on a normal distribution of standard deviation  $\sigma = 0.2$  around  $x$ . Integrated Gradient [64], noted IG, is also evaluated on  $N = 50$  samples at regular intervals. Grad-CAM [55], noted GC, is classically applied on the last convolutional layer.
A.4.2 XAI metrics
For the experiments we use four fidelity metrics, evaluated on 1000 samples of test datasets:
- Deletion [50]: it consists in measuring the drop of the score when the important variables are set to a baseline state. Formally, at step  $k$ , with  $u$  the  $k$  most important variables according to an attribution method, the Deletion $^{(k)}$  score is given by:
$$
\operatorname {D e l t i o n} ^ {(k)} = f \left(\boldsymbol {x} _ {\left[ \boldsymbol {x} _ {u} = \boldsymbol {x} _ {0} \right]}\right)
$$
The AUC of the Deletion scores is then measured to compare the attribution methods (↓ is better). The baseline  $x_0$  can either be a zero value (Deletion-zero), or a uniform random value (Deletion-uniform).
- Insertion [50]: this metric is the inverse of Deletion, starting with an image in a baseline state and then progressively adding the most important variables. Formally, at step  $k$ , with  $u$  the most important variables according to an attribution method, the Insertion $^{(k)}$  score is given by:
$$
\operatorname {I s t e n t i o n} ^ {(k)} = f \left(\boldsymbol {x} _ {\left[ \boldsymbol {x} _ {\overline {{u}}} = \boldsymbol {x} _ {0} \right]}\right)
$$
The AUC is also measured to compare attribution methods (↑ is better). The baseline is the same as for Deletion.
-  $\mu$  Fidelity [9]: this metric measures the correlation between the fall of the score when variables are put at a baseline state and the importance of these variables. Formally:
$$
\mu \text{Fidelity} = \operatorname* {C o r r}_{\substack{u\subseteq \{1,\ldots ,d\} \\ |u| = k}}\left(\sum_{i\in u}g(\boldsymbol {x})_{i},f(\boldsymbol {x}) - f(\boldsymbol{x}_{[\boldsymbol{x}_{u} = \boldsymbol{x}_{0}]})\right)
$$
For all experiments,  $k$  is equal to  $20\%$  of the total number of variables, and cutting the image in a grid of  $20 \times 20$  ( $9 \times 9$  for cat vs dog and imagenet). The baseline is the same as the one used by Deletion. Being a correlation score, we can either compare attribution methods, or different neural networks on the same attribution method ( $\uparrow$  is better).
- Robustness-Sr [34]: this metric evaluate the average adversarial distance when the attack is done only on the most relevant features. Formally, given the  $u$  most important variables:
$$
\text {R o b u s t n e s s - S r} = \left\{m i n _ {\delta} | | \delta | | s. t. a r g m a x (f (\boldsymbol {x} + \delta)) \neq a r g m a x (f (\boldsymbol {x})), \delta_ {\bar {u}} = 0 \right\}
$$
where  $\delta_{\overline{u}} = 0$  indicates that adversarial attack is authorized only on the set  $u$ . The AUC is measured to compare attribution methods ( $\downarrow$  is better). Note this metric cannot be used to compare different networks, since it depends on the robustness of the network.
We use also several other metrics:
- Distances between explanations: to compare two explanation  $f(x)$ , we use either  $L_{2}$  distance, or  $1 - \rho$  where  $\rho$  is the Spearman rank correlation [2, 23, 65] ( $\downarrow$  is better).
- Explanation complexity: we use the JPEG compression size as a proxy of the Kolmogorov complexity ( $\downarrow$  is better).
- Stability: As proposed in [74], the Stability is evaluated by the average distance of explanations provided for random samples drawn in a ball of radius 0.3 (0.15 for cat vs dog and imagenet) around  $x$ . As before, the distance can be either  $L_{2}$  or  $1 - \rho$  ( $\downarrow$  is better).
- Accuracy: To assess the relevance of explanation [57] use a semi-real dataset, called BlockMNIST, having a random null block and evaluate the proportion of top-k feature attribution values within the null block.
A.4.3 Supplementary metric results
In this section we present several experiments and metrics that we were not able to insert in the core of the paper.
Deletion-zero and Insertion-zero are evaluated on CelebA and FashionMNIST dataset. It is known that the baseline value can be a bias for these metrics, and we are convinced that it has a higher influence with 1-Lipschitz networks. Even if results for Deletion-zero and Insertion-zero are less obvious than for Deletion and Insertion Uniform, we can see in Table 8, that for these metrics, the rank of Saliency is most of the time higher for OTNN.
Table 8: Insertion and Deletion metrics evaluation; GC: GradCam, GI: Gradient.Input, IG: Integrated Gradient, Saliency Rk : Rank (comparison by line only : in bold best score)
Dataset	Network	GC	GI	Deletion-Zero (↓ is better)
IG	Rise	Saliency	SmoothGrad
Deletion-Zero
CelebA	OTNN	8.01	7.04	7.05	7.09	6.98 (Rk2)	6.96
Unconstrained	5.77	4.56	4.38	5.07	4.13 (Rk1)	4.51
Fashion-MNIST	OTNN	0.24	0.16	0.15	0.26	0.20 (Rk4)	0.19
Unconstrained	0.33	0.28	0.23	0.16	0.38 (Rk5)	0.39
Insertion-zero (↑ is better)
CelebA	OTNN	10.26	11.63	11.58	15.50	10.06 (Rk6)	10.10
Unconstrained	14.24	11.71	12.37	15.70	6.67 (Rk6)	7.65
Fashion-MNIST	OTNN	0.31	0.46	0.47	0.36	0.36 (Rk4)	0.39
Unconstrained	0.53	0.59	0.68	0.73	0.45 (Rk6)	0.46
To leverage the bias of the baseline value, as proposed in [34] we evaluated the Robustness-SR metric, Saliency map on OTNN achieves top-ranking scores. One might argue that scores for unconstrained networks are lower, but this is directly linked to the higher intrinsic robustness of OTNN and thus cannot be compared.
Table 9: Robustness-SR metrics evaluation; GC: GradCam, GI: Gradient.Input, IG: Integrated Gradient, Saliency Rk : Rank (comparison by line only : in bold best score)
Dataset	Network	Robustness-SR (↓ is better)
GC	GI	IG	Rise	Saliency	SmoothGrad
CelebA	OTNN	28.54	14.01	13.28	30.54	11.64 (Rk1)	12.65
Unconstrained	11.11	9.19	10.00	15.15	7.38 (Rk2)	7.20
Fashion-MNIST	OTNN	1.69	3.31	3.36	3.27	2.29 (Rk3)	2.01
Unconstrained	1.17	1.36	1.17	1.15	1.21 (Rk4)	1.25
The full results for the explanation complexity is given on Table 10. The complexity is still lower for OTNN on FashionMNIST, even if the gap with Unconstrained networks is narrower than for CelebA.
Accuracy was also assessed by learning an OTNN (MLP architecture) on BlockMNIST dataset [57], and evaluating the proportion of top-k saliency map values that fall in the null block. Fig 7 presents
Table 10: Complexity of Saliency map by JPEG compression (kB): lower is better
CelebA	FashionMNIST
OTNN	9.48	0.92
Unconstrained	16.84	0.94
several samples of input images and saliency maps of BlockMNIST dataset, to be compared to Fig.1 in [57]. It shows that OTNN gradients are almost only on the signal block (digit). And Table 11 evaluates the proxy metric proposed in [57], and confirms that OTNNs saliency maps top-k values point even more on discriminative features than those of adversarial trained networks.
Figure 7: blockMNIST experiments using the proposed OTNN framework (10 blockMNIST images and their respective OTNN gradients). null marks are almost invisible in the gradients
Table 11: Comparison of Proxy metric on BlockMNIST (0 vs. 1) data for OTNNs, standard and robust models (values for the two last are directly extracted from [57])
Unmasking fraction k	2.5	5	10	15	20	25	30
Type of NN	Fraction of top-k pixels in null block
Unconstrained [57]	43.8	42.5	44.8	46.5	47.5	48.1	48.4
Adversarial [57]	< 1	< 1	2.3	7.9	16.7	24.2	29.9
OTNN	< 1	< 1	1.8	6.6	16.8	26.0	32.9
A.5 Complementary qualitative results
In this section, we provide more samples of qualitative results and counterfactual explanations for OTNN, based on the gradient, i.e.  $\pmb{x} - t*\hat{f} (\pmb {x})\nabla_{x}\hat{f} (\pmb {x})$  for  $t > 1$
A.5.1 FashionMNIST
Fig. 8 gives more results on FashionMNIST.
Ankle boot
Shirt
Figure 8: FashionMNIST samples
Trouser
A.5.2 CelebA
We present results for other labels of CelebA. For ethnic concerns we have hidden labels that can be subject to misinterpretation, such as Attractive, Male, Big_Nose. Fig. 9 to 27 present more results on the labels presented in the core of the paper, Mouth_Slightly_Open, Mustache,Wearing_Hat.
A.5.3 Cat vs Dog
We present some supplementary comparison of Saliency Maps and counterfactual examples for cat vs dog(Fig. 28 and 29).
A.5.4 Imagenet
Values of accuracy and human feature alignment used for the Fig.4 are described in Tab.12. We present some supplementary comparison of Saliency Maps Imagenet (Fig. 30). As pointed out previously, our model doesn't produce significant counterfacutal explanations on Imagenet.
Table 12: Comparison accuracy on human feature alignment of Saliency Maps different models on imagenet [22].
Model	Accuracy	Human Alignment
clip	56.0	0.03
swin	85.2	0.03
vit_convnext	85.8	0.15
inception	81.1	0.25
resnet50_adv	74.8	0.33
resnet50	76.0	0.33
VGG16	71.3	0.35
resnet50_harmonized	77.0	0.44
OTNN	67.0	0.54
OTNN_large	70.0	0.57
Figure 9: Samples from label Mouth_slightly_open: left source image (closed), center difference image, right counterfactual (open) of form  $\pmb{x} - 10 * \hat{f}(\pmb{x}) \nabla_x \hat{f}(\pmb{x})$
Figure 10: Samples from label Mouth_slightly_open: left source image (open), center difference image, right counterfactual (close) of form  $\pmb{x} - 10 * \hat{f}(\pmb{x}) \nabla_{\pmb{x}} \hat{f}(\pmb{x})$
Figure 11: Samples from label Mustache: left source image (no mustache), center difference image, right counterfactual (mustache) of form  $\pmb{x} - t*\hat{f} (\pmb {x})\nabla_{x}\hat{f} (\pmb {x})$  with  $t\in \{5,10,20\}$
Figure 12: Samples from label Mustache: left source image (Mustache), center difference image, right counterfactual (Non Mustache) of form  $\pmb{x} - t*\hat{f} (\pmb {x})\nabla_{x}\hat{f} (\pmb {x}),t\in 5,10$
Figure 13: Samples from label Wearing Hat: left source image (No Hat), center difference image, right counterfactual (Hat) of form  $\pmb{x} - t*\hat{f} (\pmb {x})\nabla_{x}\hat{f} (\pmb {x}),t\in 5,10$
Figure 14: Samples from label Wearing Hat: left source image (Hat), center difference image, right counterfactual (No Hat) of form  $\pmb{x} - t*\hat{f} (\pmb {x})\nabla_{x}\hat{f} (\pmb {x}),t\in 5,10$
Bald  $\rightarrow$  "not" Bald
not"Bald  $\rightarrow$  Bald
Figure 15: Samples from label Bald
Black_Hair  $\rightarrow$  "not" Black_Hair
"not" Black_Hair  $\rightarrow$  Black_Hair
Figure 16: Samples from label Black_Hair
Blond_Hair  $\rightarrow$  "not" Blond_Hair
"not" Blond_Hair  $\rightarrow$  Blond_Hair
Figure 17: Samples from label Blond_Hair
Blurry  $\rightarrow$  "not" Blurry
not"Blurry  $\rightarrow$  Blurry
Figure 18: Samples from label Blurry
Brown_Hair  $\rightarrow$  "not" Brown_Hair
"not" Brown_Hair  $\rightarrow$  Brown_Hair
Figure 19: Samples from label Brown_Hair
Eyeglasses  $\rightarrow$  "not" Eyeglasses
"not" Eyeglasses  $\rightarrow$  Eyeglasses
Figure 20: Samples from label Eyeglasses
Gray_Hair  $\rightarrow$  "not" Gray_Hair
Figure 21: Samples from label Gray_Hair
"not" Gray_Hair  $\rightarrow$  Gray_Hair
Hairline  $\rightarrow$  "not" Hairline
Figure 22: Samples from label Hairline
"not" Hairline  $\rightarrow$  Hairline
Heavy_Makeup  $\rightarrow$  "not" Heavy_Makeup
not"Heavy_Makeup  $\rightarrow$  Heavy_Makeup
Figure 23: Samples from label Heavy_Makeup
Rosy_Cheeks  $\rightarrow$  "not" Rosy_Cheeks
not" Rosy_Cheeks  $\rightarrow$  Rosy_Cheeks
Figure 24: Samples from label Rosy_Cheeks
Smiling  $\rightarrow$  "not" Smiling
"not"Smiling  $\rightarrow$  Smiling
Figure 25: Samples from label Smiling
Figure 26: Samples from label Wearing_Lipstick
Young  $\rightarrow$  "not" Young
"not" Young  $\rightarrow$  Young
Figure 27: Samples from label Young
Wearing_Lipstick  $\rightarrow$  "not" Wearing_Lipstick
"not" Wearing_Lipstick  $\rightarrow$  Wearing_Lipstick
Figure 28: Cat vs Dog Saliency Map samples
Figure 29: Cat vs Dog Saliency counterfactual samples. Left dog to cat, right cat to dog
Figure 30: Imagenet Saliency Map samples