SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Our core technical result is in showing that  $f$  as defined in (2) is Lipschitz to the masking of features. We present MuS in terms of  $g$ , where it is parametric with respect to the distribution  $\mathcal{D}$ : so long as  $\mathcal{D}$  satisfies a coordinate-wise Bernoulli condition, then it is usable with MuS.
Theorem 3.2 (MuS). Let  $\mathcal{D}$  be any distribution on  $\{0,1\}^n$  where each coordinates of  $s\sim \mathcal{D}$  is distributed as  $s_i\sim \mathcal{B}(\lambda)$ . Consider any  $h:\mathcal{X}\to [0,1]$  and define  $g:\mathcal{X}\times \{0,1\} ^n\to [0,1]$  as
$$
g (x, \alpha) = \underset {s \sim \mathcal {D}} {\mathbb {E}} h (x \odot \tilde {\alpha}), \qquad \tilde {\alpha} = \alpha \odot s.
$$
Then the function  $g(x, \cdot): \{0, 1\}^n \to [0, 1]$  is  $\lambda$ -Lipschitz in the  $\ell^1$  norm for all  $x \in \mathcal{X}$ .
The strength of this result is in its weak assumptions. First, the theorem applies to any model  $h$  and input  $x \in \mathcal{X}$ . It further suffices that each coordinate is distributed as  $s_i \sim \mathcal{B}(\lambda)$ , and we emphasize that statistical independence between different  $s_i, s_j$  is not assumed. This allows us to construct
$\mathcal{D}$  with structured dependence in Section 3.3, such that we may exactly and efficiently evaluate  $g(x,\alpha)$  at a sample complexity of  $N \ll 2^n$ . A low sample complexity is important for making MuS practically usable, as otherwise, one must settle for the expected value subject to probabilistic guarantees. For instance, simpler distributions like  $\mathcal{B}^n(\lambda)$  do satisfy the requirements of Theorem 3.2 — but costs  $2^n$  samples because of coordinate-wise independence. Whatever choice of  $\mathcal{D}$ , one can guarantee stability so long as  $g$  is Lipschitz in its second argument.
Theorem 3.3 (Stability). Consider any  $h: \mathcal{X} \to [0,1]^m$  with coordinates  $h_1, \ldots, h_m$ . Fix  $\lambda \in [0,1]$  and let  $g_1, \ldots, g_m$  be the respectively smoothed coordinates as in Theorem 3.2, using which we analogously define  $g: \mathcal{X} \times \{0,1\}^n \to [0,1]^m$ . Also define  $f(x) = g(x,1)$ . Then for any explanation method  $\varphi$  and input  $x \in \mathcal{X}$ , the explainable model  $\langle f, \varphi \rangle$  is incrementally stable with radius  $r_{\mathrm{inc}}$  and decrementally stable with radius  $r_{\mathrm{dec}}$ :
where  $g_{A} - g_{B}$  is the confidence gap as in (1).
Note that it is only in the case where the radius  $\geq 1$  that non-trivial stability guarantees exist. Because each  $g_{k}$  has range in [0, 1], this means that a Lipschitz constant of  $\lambda \leq 1/2$  is necessary to attain at least one radius of stability. We present in Appendix A.2 some extensions to MuS that allow one to achieve higher coverage of features.
3.3 Exploiting Structured Dependency
We now present  $\mathcal{L}_{qv}(\lambda)$ , a distribution on  $\{0,1\}^n$  that allows for efficient and exact evaluation of a MuS-smoothed classifier. Our construction is an adaption of [28] from uniform to Bernoulli noise, where the primary insight is that one can parametrize  $n$ -dimensional noise using a single dimension via structured coordinate-wise dependence. In particular, we use a seed vector  $v$ , where with an integer quantization parameter  $q > 1$  there will only exist  $q$  distinct choices of  $s \sim \mathcal{L}_{qv}(\lambda)$ . All the while, we still enforce that any such  $s$  is coordinate-wise Bernoulli with  $s_i \sim \mathcal{B}(\lambda)$ . Thus, for a sufficiently small quantization parameter (i.e.,  $q \ll 2^n$ ), we may tractably enumerate through all  $q$  possible choices of  $s$  and thereby evaluate a MuS-smoothed model with only  $q$  samples.
Proposition 3.4. Fix integer  $q > 1$  and consider any vector  $v \in \{0, 1/q, \dots, (q-1)/q\}^n$  and scalar  $\lambda \in \{1/q, \dots, q/q\}$ . Define  $s \sim \mathcal{L}_{qv}(\lambda)$  to be a random vector in  $\{0, 1\}^n$  with coordinates given by
$$
s _ {i} = \mathbb {I} [ t _ {i} \leq \lambda ], \qquad t _ {i} = v _ {i} + s _ {\mathrm {b a s e}} \mod 1, \qquad s _ {\mathrm {b a s e}} \sim \mathcal {U} (\{1 / q, \dots , q / q \}) - 1 / (2 q).
$$
Then there are  $q$  distinct values of  $s$  and each coordinate is distributed as  $s_i \sim \mathcal{B}(\lambda)$ .
Proof. First, observe that each of the  $q$  distinct values of  $s_{\mathrm{base}}$  defines a unique value of  $s$  since we have assumed  $v$  and  $\lambda$  to be fixed. Next, observe that each  $t_i$  has  $q$  unique values uniformly distributed as  $t_i \sim \mathcal{U}(1/q, \ldots, q/q)} - 1/(2q)$ . Because  $\lambda \in \{1/q, \ldots, q/q\}$  we therefore have  $\operatorname*{Pr}[t_i \leq \lambda] = \lambda$ , which implies that  $s_i \sim \mathcal{B}(\lambda)$ .
The seed vector  $v$  is the source of our structured coordinate-wise dependence, and the one-dimensional source of randomness  $s_{\mathrm{base}}$  is used to generate the  $n$ -dimensional  $s$ . Such  $s \sim \mathcal{L}_{qv}(\lambda)$  then satisfies the conditions for use in MuS (Theorem 3.2), and this noise allows for an exact evaluation of the smoothed classifier in  $q$  samples. We have found  $q = 64$  to be sufficient in practice and that values as low as  $q = 16$  also yield good performance. We remark that one drawback is that one may get an unlucky seed  $v$ , but we have not yet observed this in our experiments.
4 Empirical Evaluations
We evaluate the quality of MuS on different classification models and explanation methods as they relate to stability guarantees. To that end, we perform the following experiments.
(E1) How good are the stability guarantees? A natural measure of quality for stability guarantees over a dataset exists: what radii are achieved, and at what frequency. We investigate how different combinations of models, explanation methods, and  $\lambda$  affect this measure.
(E2) What is the cost of smoothing? To increase the radius of a provable stability guarantee, we must decrease the Lipschitz constant  $\lambda$ . However, as  $\lambda$  decreases, more features are dropped during the smoothing process. This experiment investigates this stability-accuracy trade-off.
(E3) Which explanation method is best? We evaluate which existing feature attribution methods are amenable to strong stability guarantees. We examine LIME [6], SHAP [7], Vanilla Gradient Saliency (VGrad) [5], and Integrated Gradients (IGrad) [8], with focus on the size of the explanation.
(Experimental Setup) We use on two vision models (Vision Transformer [9] and ResNet50 [29]) and one language model (RoBERTa [30]). We use ImageNet1K [31] as our vision dataset and TweetEval [32] sentiment analysis as our language dataset. We use feature grouping from Appendix A.2.1 on ImageNet1K to reduce the  $3 \times 224 \times 224$  dimensional input into  $n = 64$  superpixel patches. We report stability radii  $r$  in terms of the fraction of features, i.e.,  $r/n$ . In all our experiments, we use the quantized noise as in Section 3.3 with  $q = 64$  unless specified otherwise. We refer to Appendix B for training details and the comprehensive experiments.
Figure 4: Rate of consistency and incremental (decremental) stability up to radius  $r$  vs. fraction of feature coverage  $r/n$ . Left: certified  $N_{\mathrm{cert}} = 2000$ ; Right: empirical  $N_{\mathrm{emp}} = 250$  with  $q = 16$ .
4.1 (E1) Quality of Stability Guarantees
We study how much radius of consistent and incremental (resp. decremental) stability is achieved, and how often. We take an explainable model  $\langle f,\varphi \rangle$  where  $f$  is Vision Transformer and  $\varphi$  is SHAP with top-25% feature selection. We plot the rate at which a property holds (e.g., consistent and incrementally stable with radius  $r$ ) as a function of radius (expressed as a fraction of features  $r / n$ ).
We show our results in Figure 4, where on the left we have the certified guarantees for  $N_{\mathrm{cert}} = 2000$  samples from ImageNet1K; on the right we have the empirical radii for  $N_{\mathrm{emp}} = 250$  samples obtained by applying a standard box attack [33] strategy with  $q = 16$ . We observe from the certified results that the decremental stability radii are larger than those of incremental stability. This is reasonable since the base classifier sees much more of the input when analyzing decremental stability and is thus more confident on average, i.e., achieves a larger confidence gap. Moreover, our empirical radii often cover up to half of the input, which suggests that our certified analysis is quite conservative.
4.2 (E2) Stability-Accuracy Trade-Offs
We next investigate how smoothing impacts the classifier accuracy. As  $\lambda$  decreases due to more smoothing, the base classifier sees increasingly zeroed-out features — which should hurt accuracy. We took  $N = 2000$  samples for each classifier on their respective datasets and plotted the certified accuracy vs. radius of decremental stability.
Figure 5: Certified accuracy vs. decremental stability radius.  $N = 2000$ .
We show the results in Figure 5, where the clean accuracy (in parentheses) decreases with  $\lambda$  as expected. This accuracy drop is especially pronounced for ResNet50, and we suspect that the transformer architecture of Vision Transformer and RoBERTa makes them more resilient to the randomized masking of features. Nevertheless, this experiment demonstrates that large models, especially transformers, can tolerate non-trivial noise from MuS while maintaining high accuracy.
Figure 6: Average  $k / n$  vs.  $\lambda$ , where  $k = \| \varphi(x) \|_1$  is the number of features for  $\langle f, \varphi \rangle$  to be consistent, incrementally stable with radius 1, and decrementally stable with radius 1.  $N = 250$ .
4.3 (E3) Which Explanation Method to Pick?
Finally, we explore which feature attribution method is best suited to stability guarantees of explainable model  $\langle f,\varphi \rangle$ . All four methods  $\psi \in \{\mathrm{LIME},\mathrm{SHAP},\mathrm{VGrad},\mathrm{IGrad}\}$  are continuous-valued, for which we samples  $N = 250$  inputs from each model's respective dataset. For each input  $x$ , we use the feature importance ranking generated by  $\psi (x)$  to iteratively build  $\varphi (x)$  in a greedy manner like in Section 2.4. For some  $x$ , let  $k_{x} = \varphi (x) / n$  be the number fraction of features needed for  $\langle f,\varphi \rangle$  to be consistent, incrementally stable with radius 1, and decrementally stable with radius 1. We then plot the average  $k_{x}$  for different methods at  $\lambda \in \{1 / 8,\dots ,4 / 8\}$  in Figure 6, where note that SHAP tends to require fewer features to achieve the desired properties, while VGrad tends to require more. However, we do not believe these to be decisive results, as many curves are relatively close, especially for Vision Transformer and ResNet50.
For extensive surveys on explainability methods see [16, 20, 34, 35, 36, 37, 38]. Notable feature attribution methods include Vanilla Gradient Saliency [5], SmoothGrad [23], Integrated Gradients [8], Grad-CAM [39], Occlusion [40], LIME [6], SHAP [7], and their variants. Of these, Shapley value-based [17] methods [7, 24, 25] are rooted in axiomatic principles, as are Integrated Gradients [8, 41]. The work of [42] finds confidence intervals over attribution scores. A study of common feature attribution methods is done in [43]. Similar to our approach is [44], which studies binary-valued classifiers and presents an algorithm with succinctness and probabilistic precision guarantees. Different metrics for evaluating feature attributions are studied in [16, 18, 45, 46, 47, 48, 49, 50, 51]. Whether an attribution correctly identifies relevant features is a well-known issue [52, 53]. Many methods are also susceptible to adversarial attacks [54, 55]. As a negative result, [56] shows that
feature attributions have provably poor performance on sufficiently rich model classes. Related to feature attributions are data attributions [57, 58, 59], which assigns values to training data points. Also related to formal guarantees are formal methods-based approaches towards explainability [60].
We study provable stability guarantees for binary feature attribution methods through the framework of explainable models. A selection of features is stable if the additional inclusion of other features does not alter its explanatory power. We show that if the classifier is Lipschitz with respect to the masking of features, then one can guarantee relaxed variants of stability. To achieve this Lipschitz condition, we develop a smoothing method called Multiplicative Smoothing (MuS). This method is parametric to the choice of noise distribution, allowing us to construct and exploit distributions with structured dependence for exact and efficient evaluation. We evaluate MuS on vision and language models and demonstrate that MuS yields strong stability guarantees at only a small cost to accuracy.
This research was partially supported by NSF award SLES 2331783 and a gift from AWS AI.
[1] Maurizio Reyes, Raphael Meier, Sérgio Pereira, Carlos A Silva, Fried-Michael Dahlweid, Hendrik von Tengg-Kobligk, Ronald M Summers, and Roland Wiest. On the interpretability of artificial intelligence in radiology: challenges and opportunities. *Radiology: artificial intelligence*, 2(3):e190043, 2020.
[2] Erico Tjoa and Cuntai Guan. A survey on explainable artificial intelligence (xai): Toward medical xai. IEEE transactions on neural networks and learning systems, 32(11):4793-4813, 2020.
[3] Sandra Wachter, Brent Mittelstadt, and Chris Russell. Counterfactual explanations without opening the black box: Automated decisions and the gdpr. Harv. JL & Tech., 31:841, 2017.
[4] Adrien Bibal, Michael Lognoul, Alexandre De Strel, and Benoit Frénay. Legal requirements on explainability in machine learning. Artificial Intelligence and Law, 29:149-169, 2021.
[5] Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034, 2013.
[6] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. "why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135-1144, 2016.
[7] Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions. Advances in neural information processing systems, 30, 2017.
[8] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In International conference on machine learning, pages 3319-3328. PMLR, 2017.
[9] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020.
[10] Amirata Ghorbani, Abubakar Abid, and James Zou. Interpretation of neural networks is fragile. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 3681-3688, 2019.
A Proofs and Theoretical Discussions
In this Section, we present the proofs of our main results and some extensions to MuS.
A.1 Proofs of Main Results
A.1.1 Proof of Theorem 3.2
Proof. By linearity, we have:
$$
g (x, \alpha) - g (x, \alpha^ {\prime}) = \underset {s \sim \mathcal {D}} {\mathbb {E}} h (x \odot \tilde {\alpha}) - h (x \odot \tilde {\alpha} ^ {\prime}), \qquad \tilde {\alpha} = \alpha \odot s, \qquad \tilde {\alpha} ^ {\prime} = \alpha^ {\prime} \odot s,
$$
so it suffices to analyze an arbitrary term by fixing some  $s \sim \mathcal{D}$ . Consider any  $x \in \mathcal{X}$ , let  $\alpha, \alpha' \in \{0,1\}^n$ , and define  $\delta = \alpha - \alpha'$ . Observe that  $\tilde{\alpha}_i \neq \tilde{\alpha}_i'$  exactly when  $|\delta_i| = 1$  and  $s_i = 1$ . Since  $s_i \sim \mathcal{B}(\lambda)$ , we thus have  $\operatorname*{Pr}[\tilde{\alpha}_i \neq \tilde{\alpha}_i'] = \lambda |\delta_i|$ , and applying the union bound:
$$
\operatorname * {P r} _ {s \sim \mathcal {D}} \left[ \tilde {\alpha} \neq \tilde {\alpha} ^ {\prime} \right] = \operatorname * {P r} _ {s \sim \mathcal {D}} \left[ \bigcup_ {i = 1} ^ {n} \tilde {\alpha} _ {i} \neq \tilde {\alpha} _ {i} ^ {\prime} \right] \leq \sum_ {i = 1} ^ {n} \lambda | \delta_ {i} | = \lambda \| \delta \| _ {1},
$$
and so:
$$
\begin{array}{l} | g (x, \alpha) - g (x, \alpha^ {\prime}) | = \left| \underset {s \sim \mathcal {D}} {\mathbb {E}} [ h (x \odot \tilde {\alpha}) - h (x \odot \tilde {\alpha} ^ {\prime}) ] \right| \\ = \left| \Pr_ {s \sim \mathcal {D}} \left[ \tilde {\alpha} \neq \tilde {\alpha} ^ {\prime} \right] \cdot \mathbb {E} _ {s \sim \mathcal {D}} \left[ h (x \odot \tilde {\alpha}) - h (x \odot \tilde {\alpha} ^ {\prime}) \mid \tilde {\alpha} \neq \tilde {\alpha} ^ {\prime} \right] \right. \\ \left. - \Pr_ {s \sim \mathcal {D}} \left[ \tilde {\alpha} = \tilde {\alpha} ^ {\prime} \right] \cdot \mathbb {E} _ {s \sim \mathcal {D}} \left[ h (x \odot \tilde {\alpha}) - h (x \odot \tilde {\alpha} ^ {\prime}) \mid \tilde {\alpha} = \tilde {\alpha} ^ {\prime} \right] \right|. \\ \end{array}
$$
Note that  $\mathbb{E}\left[h(x\odot \tilde{\alpha}) - h(x\odot \tilde{\alpha}^{\prime})\mid \tilde{\alpha} = \tilde{\alpha}^{\prime}\right] = 0$  , and so
$$
\begin{array}{l} | g (x, \alpha) - g (x, \alpha^ {\prime}) | = \operatorname * {P r} _ {s \sim \mathcal {D}} [ \tilde {\alpha} \neq \tilde {\alpha} ^ {\prime} ] \cdot \underbrace {\left| \underset {s \sim \mathcal {D}} {\mathbb {E}} [ h (x \odot \tilde {\alpha}) - h (x \odot \tilde {\alpha} ^ {\prime}) | \tilde {\alpha} \neq \tilde {\alpha} ^ {\prime} ] \right|} _ {\leq 1 \text {b e c a u s e} h (\cdot) \in [ 0, 1 ]} \\ \leq \operatorname * {P r} _ {s \sim \mathcal {D}} \left[ \tilde {\alpha} \neq \tilde {\alpha} ^ {\prime} \right] \\ \leq \lambda \| \delta \| _ {1}. \\ \end{array}
$$
Thus,  $g(x,\cdot)$  is  $\lambda$ -Lipschitz in the  $\ell^1$  norm.
A.1.2 Proof of Theorem 3.3
Proof. We first show incremental stability. Consider any  $x \in \mathcal{X}$ , then by masking equivalence:
$$
f (x \odot \varphi (x)) = g (x \odot \varphi (x), \mathbf {1}) = g (x, \varphi (x)),
$$
and let  $g_{A}, g_{B}$  be the top-two class probabilities of  $g$  as defined in (1). By Theorem 3.2, both  $g_{A}, g_{B}$  are Lipschitz in their second parameter, and so for all  $\alpha \in \{0,1\}^{n}$ :
$$
\left\| g _ {A} (x, \varphi (x)) - g _ {A} (x, \alpha) \right\| _ {1} \leq \lambda \left\| \varphi (x) - \alpha \right\| _ {1}
$$
$$
\left\| g _ {B} (x, \varphi (x)) - g _ {B} (x, \alpha) \right\| _ {1} \leq \lambda \left\| \varphi (x) - \alpha \right\| _ {1}
$$
Observe that if  $\alpha$  is sufficiently close to  $\varphi (x)$  ,i.e.:
$$
2 \lambda \| \varphi (x) - \alpha \| _ {1} \leq g _ {A} (x, \varphi (x)) - g _ {B} (x, \varphi (x)),
$$
then the top-class index of  $g(x, \varphi(x))$  and  $g(x, \alpha)$  are the same. This means that  $g(x, \varphi(x)) \cong g(x, \alpha)$  and thus  $f(x \odot \varphi(x)) \cong f(x \odot \alpha)$ , thus proving incremental stability with radius  $d(x, \varphi(x)) / (2\lambda)$ .
The decremental stability case is similar, except we replace  $\varphi (x)$  with 1.
A.2 Some Basic Extensions
Below, we present some extensions to MuS that help increase the fraction of the input to which we can guarantee stability.
A.2.1 Feature Grouping
We have so far assumed that  $\mathcal{X} = \mathbb{R}^n$ , but sometimes it may be desirable to group features together, e.g., color channels of the same pixel. Our results also hold for more general  $\mathcal{X} = \mathbb{R}^{d_1}\times \dots \times \mathbb{R}^{d_n}$  where for such  $x\in \mathcal{X}$  and  $\alpha \in \mathbb{R}^n$  we lift  $\odot$  as
$$
\odot : \mathcal {X} \times \mathbb {R} ^ {n} \rightarrow \mathcal {X}, \quad (x \odot \alpha) _ {i} = x _ {i} \cdot \mathbb {I} [ \alpha_ {i} = 1 ] \in \mathbb {R} ^ {d _ {i}}.
$$
All of our proofs are identical under this construction, with the exception of the dimensionalities of terms like  $(x\odot \alpha)$ . Figure 1 gives an example of feature grouping.
B All Experiments
Models, Datasets, and Explanation Methods We evaluate on two vision models (Vision Transformer [9] and ResNet50 [29]) and one language model (RoBERTa [30]). For the vision dataset, we use ImageNet1K [31]; for the language dataset, we use TweetEval [32] sentiment analysis. We use four explanation methods in SHAP [7], LIME [6], Integrated Gradients (IGrad) [8], and Vanilla Gradient Saliency (VGrad) [5]; where we take  $\varphi(x)$  as the top- $k$  weighted features.
Training Details We used Adam [61] as our optimizer with default parameters and a learning rate of  $10^{-6}$  for 5 epochs. Because we consider  $\lambda \in \{1/8, 2/8, 3/8, 4/8, 8/8\}$  and  $h \in \{\text{Vision Transformer}, \text{ResNet50}, \text{RoBERTa}\}$ , there are a total of 15 different models for most experiments. To train with a particular  $\lambda$ : for each training input  $x$ , we generate two random maskings — one where  $\lambda$  of the features are zeroed and one where  $\lambda/2$  of the features are zeroed. This additional  $\lambda/2$  zeroing is to account for the fact that inputs to a smoothed model will be subject to masking by  $\lambda$  as well as  $\varphi(x)$ , where the scaling factor of  $1/2$  is informed by our prior experience about the size of a stable explanation.
Miscellaneous Preprocessing For images in ImageNet1K we use feature grouping (Section A.2.1) to group the  $3 \times 224 \times 224$  dimensional image into patches of size  $3 \times 28 \times 28$ , such that there remains  $n = 64$  feature groups. Each feature of a feature group then receives the same value of noise during smoothing. We report radii of stability as a fraction of the feature groups covered. For example, if at some input from ImageNet1K, we get an incremental stability radius of  $r$ , then we report  $r / 64$  as the fraction of features up to which we are guaranteed to be stable. This is especially amenable to evaluating RoBERTa on TweetEval where inputs do not have uniform token lengths, i.e., do not have uniform feature dimensions. In all of our experiments, we use the quantized noise as in Section 3.3 with a quantization parameter of  $q = 64$ , with the exception of Appendix B.2 and Appendix B.3. Our experiments are organized as follows:
- (Section B.1) What is the quality of stability guarantees?
- (Section B.2) What is the theoretical vs empirical stability that can be guaranteed?
- We  $q = 64$  for theoretical guarantees,  $q = 16$  for empirical guarantees.
- (Section B.3) What are the stability-accuracy trade-offs?
- We use  $q \in \{16, 32, 64, 128\}$  to study the effect of  $q$  on MuS-smoothed performance.
- (Section B.4) Which explanation method is best?
- (Section B.5) Does additive smoothing improve empirical stability?
- (Section B.6) Does adversarial training improve empirical stability?
B.1 Quality of Stability Guarantees
Here we study what radii of stability are certifiable, and how often these can be achieved with different models and explanation methods. We therefore consider explainable models  $\langle f,\varphi \rangle$  constructed from base models  $h\in \{\mathrm{Vision~Transformer},\mathrm{ResNet50},\mathrm{RoBERTa}\}$  and explanation methods  $\varphi \in \{\mathrm{SHAP},\mathrm{LIME},\mathrm{IGrad},\mathrm{VGrad}\}$  with top-  $k\in \{1 / 8,2 / 8,3 / 8\}$  feature selection. We take  $N = 2000$  samples from each model's respective datasets and compute the following value for each radius:
$$
\operatorname {v a l u e} (r) = \frac {\# \{x : \langle f , \varphi \rangle \text {c o n s i s t e n t a n d i n c (d e c) s t a b l e w i t h r a d i u s} \leq r \}}{N}.
$$
Plots of incremental stability are on the left; plots of decremental stability are on the right.
Vision Transformer, SHAP
Vision Transformer, LIME
Figure 7: (Top) Vision Transformer with SHAP. (Bottom) Vision Transformer with LIME. (Left) consistent and incrementally stable. (Right) consistent and decrementally stable.
Vision Transformer, IGrad
Vision Transformer, VGrad