SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Figure 8: (Top) Vision Transformer with IGrad. (Bottom) Vision Transformer with VGrad. (Left) consistent and incrementally stable. (Right) consistent and decrementally stable.
ResNet50, SHAP
ResNet50, LIME
Figure 9: (Top) ResNet50 with SHAP. (Bottom) ResNet50 with LIME. (Left) consistent and incrementally stable. (Right) consistent and decrementally stable.
ResNet50, IGrad
ResNet50, VGrad
Figure 10: (Top) ResNet50 with IGrad. (Bottom) ResNet50 with VGrad. (Left) consistent and incrementally stable. (Right) consistent and decrementally stable.
RoBERTA, SHAP
RoBERTA, LIME
Figure 11: (Top) RoBERTa with SHAP. (Bottom) RoBERTa with LIME. (Left) consistent and incrementally stable. (Right) consistent and decrementally stable.
RoBERTA, IGrad
RoBERTA, VGrad
Figure 12: (Top) RoBERTa with IGrad. (Bottom) RoBERTa with VGrad. (Left) consistent and incrementally stable. (Right) consistent and decrementally stable.
B.2 Theoretical vs Empirical
We compare the certifiable theoretical stability guarantees with what is empirically attained via a standard box attack search [33]. This is an extension of Section 4.2, where we now show all models as evaluated with SHAP-top  $25\%$ . We take  $q = 64$  with  $N_{\mathrm{cert}} = 2000$  for the certified plots, and  $q = 64$  with  $N_{\mathrm{emp}} = 250$  for the empirical plots. This is because box attack is time-intensive.
Vision Transformer, SHAP top-25%
ResNet50, SHAP top-25%
RoBERTa, SHAP top-25%
Figure 13: With SHAP top-25%. (Top) Vision Transformer. (Middle) ResNet50. (Bottom) RoBERTa.
B.3 Stability-Accuracy Trade-Offs
We study how the accuracy degrades with  $\lambda$ . We consider a smoothed model  $f$  constructed from a base classifier  $h \in \{\text{Vision Transformer}, \text{ResNet50}, \text{RoBERTa}\}$  and vary  $\lambda \in \{1/16, 1/8, 2/8, 4/8, 8/8\}$ . We then take  $N = 2000$  samples from each respective dataset and measure the accuracy of  $f$  at different radii. We use  $f(x) \cong \text{true_label}$  to mean that  $f$  attained the correct prediction at  $x \in \mathcal{X}$ , and we plot the following value at each radius  $r$ :
$$
\operatorname {v a l u e} (r) = \frac {\# \{x : f (x) \cong \text {t r u e} _ {-} \text {l a b e l a n d d e c s t a b l e w i t h r a d i u s} \leq r \}}{N}
$$
Below, we show the plots for different quantization parameters of  $q \in \{16, 32, 64, 128\}$ . The  $q = 64$  plots are identical to that of Figure 5. We see that increasing  $q$  generally improves the performance of MuS, but at a computational cost since this requires  $q$  evaluations of  $h$ .
Figure 14: Certified accuracy plots for different quantization parameters of  $q \in \{16,32,64,128\}$ .
B.4 Which Explanation Method is the Best?
We first investigate how many features are needed to yield consistent and non-trivially stable explanations, as done by the greedy selection algorithm in Section 2.4. For some  $x \in \mathcal{X}$ , let  $k_{x}$  denote the fraction of features that  $\langle f, \varphi \rangle$  needs to be consistent, incrementally stable, and decrementally stable with radius 1. We vary  $\lambda \in \{1/8, \dots, 4/8\}$ , where recall  $\lambda \leq 4/8$  is needed for non-trivial stability, and use  $N = 250$  samples to plot the average  $k_{x}$ . This part is identical to Section 4.3.
Figure 15: (Left) Vision Transformer. (Middle) ResNet50. (Right) RoBERTa.
We next investigate the ability of each method to predict features that lead to high accuracy. Let  $f(x \odot \varphi(x)) \cong \text{true_label}$ , mean that the masked input  $x \odot \varphi(x)$  yields the correct prediction. We then plot this accuracy as we vary the top- $k \in \{1/8, 2/8, 3/8\}$  for different methods  $\varphi$ , and  $\lambda \in \{1/8, \dots, 8/8\}$ , using  $N = 2000$  samples.
Figure 16: (Top) Vision Transformer. (Middle) ResNet50. (Bottom) RoBERTa.
B.5 Empirical Stability of Additive Smoothing
We now study how well additive smoothing impacts empirical robustness compared to multiplicative smoothing. Although additive smoothing cannot yield theoretical stability guarantees (c.f. Proposition 3.1), we nevertheless investigate its empirical performance. We use explanations generated by SHAP top-25% and use Vision Transformer as our base model  $h$ . We fine-tuned different variants of Vision Transformer at  $\lambda \in \{8/8, 4/8, 2/8, 1/8\}$  and used these in two general classes of models: Vision Transformer with multiplicative smoothing, and Vision Transformer with additive smoothing. We call these two  $f_{\mathrm{mus}}$  and  $f_{\mathrm{add}}$  respectively, and define them as follows:
$$
f _ {\mathrm {m u s}} (x) = \underset {s \sim \mathcal {D}} {\mathbb {E}} h (x \odot s), \qquad f _ {\mathrm {a d d}} (x) = \underset {s \sim \mathcal {U} (- 1 / 2 \lambda , 1 / 2 \lambda)} {\mathbb {E}} h (x + s)
$$
where for multiplicative smoothing,  $\mathcal{D}$  is as in Theorem 3.2. Over  $N = 250$  samples from ImageNet1K, we check how often incremental stability of radius  $\geq 1$  is obtained, and plot our results in Figure 17 (left). We see that multiplicative smoothing yields better empirical performance than additive smoothing.
B.6 Empirical Stability of Adversarial Training
Similar to Section B.5, we also check how adversarial training [62] affects empirical stability. We consider ResNet50 with different adversarial training setups from the Robustness Python library [63] and compare them to their respective MuS-wrapped variants. As with Section B.5 we take  $N = 250$  samples from ImageNet1K, and plot our results in Figure 17 (right).
Figure 17: How often does each model empirically attain incremental stability of radius  $\geq 1$ ? We check every  $\alpha' \succeq \alpha$  where  $\| \alpha' - \alpha \|_1 = 1$ . (Left) Additive smoothing vs. multiplicative smoothing. (Right) ResNet50 with different adversarial training setups vs. their respective MuS-wrapped variants.
B.7 Discussion
Effect of Smoothing We observe that smoothing can yield non-trivial stability guarantees, especially for Vision Transformer and RoBERTa, as evidenced in Appendix B.1. We see that smoothing is least detrimental on these two transformer-based architectures, and most negatively impacts the performance of ResNet50. We conjecture that although different training set-ups may improve performance across every category, this still serves to illustrate the general trend.
Theoretical vs Empirical It is expected that the certifiable radii of stability is more conservative than what is empirically observed. As mentioned in Section 3.2, for each  $\lambda$ , there is a maximum radius to which stability can be guaranteed, which is an inherent limitation of using confidence gaps and Lipschitz constants as the main theoretical technique. We emphasize that the notion of stability need not be tied to smoothing, though we are currently not aware of other viable approaches.
Why these Explanation Methods? We chose SHAP, LIME, IGrad, and VGrad from among the large variety of methods available primarily due to their popularity, and because we believe that they are collectively representative of many techniques. In particular, we believe that LIME remains a representative baseline for surrogate model-based explanation methods. SHAP and IGrad are, to our knowledge, the two most well-known families of axiomatic feature attribution methods. Finally, we believe that VGrad is representative of a traditional gradient saliency-based approach.
Which Explanation Method is the Best? Based on our experiments in Appendix B.4 we see that SHAP generally achieves higher accuracy using the same amount of top- $k$  features as other methods. On the other hand, VGrad tends to perform poorly. We remark that there are well-known critiques against the usefulness of saliency-based explanation methods [53].
C Miscellaneous
Relevance to Other Explanation Methods Our key theoretical contribution of MuS in Theorem 3.2 is a general-purpose smoothing method that is distinct from standard smoothing techniques, namely additive smoothing. Therefore, MuS is applicable to other problem domains beyond what is studied in this paper and would be useful where small Lipschitz constants with respect to maskings are desirable.
Broader Impacts Reliable explanations are necessary for making well-informed decisions and are increasingly important as machine learning models are integrated with fields like medicine, law, and business — where the primary users may not be well-versed in the technical limitations of different methods. Formal guarantees are thus important for ensuring the predictability and reliability of complex systems, which then allows users to construct accurate mental models of interaction and behavior. In this work, we study a particular kind of guarantee known as stability, which is key to feature attribution-based explanation methods.