RoCourseNet: Distributionally Robust Training of a Prediction Aware Recourse Model
Authors: Hangzhi Guo
Feiran Jia
Jinghui Chen
Anna Squicciarini
Amulya Yadav
Venue: Submitted to ICLR 2023 (2023)
Keywords: Counterfactual Explanation
Algorithmic Recourse
Adversarial ML
Robustness

Abstract: Counterfactual (CF) explanations for machine learning (ML) models are preferred by end-users, as they explain the predictions of ML models by providing a recourse (or contrastive) case to individuals who are adversely impacted by predicted outcomes. Existing CF explanation methods generate recourses under the assumption that the underlying target ML model remains stationary over time. However, due to commonly occurring distributional shifts in training data, ML models constantly get updated in practice, which might render previously generated recourses invalid and diminish end-users trust in our algorithmic framework. To address this problem, we propose RoCourseNet, a training framework that jointly optimizes for predictions and recourses that are robust to future data shifts. We have three main contributions: (i) We propose a novel \emph{virtual data shift (VDS)} algorithm to find worst-case shifted ML models by explicitly considering the worst-case data shift in the training dataset. (ii) We leverage adversarial training to solve a novel tri-level optimization problem inside RoCourseNet, which simultaneously generates predictions and corresponding robust recourses. (iii) Finally, we evaluate RoCourseNet's performance on three real-world datasets and show that RoCourseNet outperforms state-of-the-art baselines by $\sim$10\% in generating robust CF explanations.










Under review as a conference paper at ICLR 2023
ROCOURSENET: ROBUST TRAINING OF A PREDICTION AWARE RECOURSE MODEL
Anonymous authors Paper under double-blind review
ABSTRACT
Counterfactual (CF) explanations for machine learning (ML) models are preferred by end-users, as they explain the predictions of ML models by providing a recourse (or contrastive) case to individuals who are adversely impacted by predicted out- comes. Existing CF explanation methods generate recourses under the assumption that the underlying target ML. model remains stationary over time. However, due to commonly occurring distributional shifts in training data, ML models constantly get updated in practice, which might render previously generated recourses invalid and diminish end-users trust in our algorithmic framework. To address this prob- lem, we propose RoCourseNet, training framework that jointly optimizes for predictions and recourses that are robust to future data shifts. We have three main contributions: (i) We propose a novel virtual data shift (VDS) algorithm find worst-case shifted MI models by explicitly considering the worst-case data shift in the training dataset. (ii) We leverage adversarial training to solve novel tri-level optimization problem inside RoCourseNet, which simultaneously generates predic- tions and corresponding robust recourses. (iii) Finally, we evaluate RoCourseNet's performance three real-worid datasets and show that RoCourseNet outperforms state-offie siiee-of-thearte
ttehhhertt art baselines by 100% in generating robust CF explanations.
INTRODUCTION
To explain the prediction made by a Machine Learning (ML) model data point x, counterfactual (CF) explanation methods find a new counterfactual example x= which similar to x but gets a different/opposite prediction from the ML model. CF explanations (Wachter et al., 2017; Karimi et al., 2020; Verma et al., 2020) are often preferred by end-users as they provide actionable recourse' to individuals who negatively impacted by algorithm-median decisions. For example. CF explanation techniques can provide recourse for impoverished loan applicants whose loans have been denied by bank's MI. algorithm.
Most CF explanation techniques assume that the underlying ML model is stationary and does not change over time (Barocas et al., 2020). However, practice, ML models are often updated regularly when new data is available to improve predictive accuracy on the new shifted data distribution. This shifted ML model might render previously recommended recourses ineffective (Rawal et al., 2020), and in turn, diminish end users' trust towards our system. For example, when providing a recourse to a loan applicant who was denied a loan by the bank's ML algorithm, it is critical approve re-applications that fully follow recourse recommendations, even if the bank updates their MIL model in the meantime. This necessitates the development robust algorithms that can generate recourses which remain effective (or valid) for an end-user in the face of ML models being frequently updated. Figure illustrates this challenge of generating robust recourses.
Limitations of Prior Work. To our knowledge, only two studies (Upadhyay et al., 2021; Nguyen et al., 2022) propose algorithmic methods to generate robust recourses. Unfortunately, both these studies suffer from two major limitations. First. both methods are based on strong modeling as- sumptions which degrades their effectiveness at finding robust recourses (as we show in Section 4). For example, Upadhyay al. (2021) assume that the MI. model's decision boundary can be
Note that counterfactual explanation (Wachter et al., 2017) and algorithmic recourse (Ustun al., 2019) closely related (Verma al., 2020; Stepin al., 2021). Hence, we use these terms interchangeably.

---

Under review as a conference paper at ICLR 2023
Original
Original Data:
Original Data: +
New Dela:
x 0)
Oxe
f(:0)
f(:0)
f(:0)*
f(:00)
(a) The decision boundary of model f(- 0) trained on the original data,
(b) Updated decision boundary of
(c) Under the shifts in data distri- bution and model, the recourse s. becomes invalid, but 2 is valid. We call ged a robust recourse.
retrained new model f-:00)) 0') with
and a recourse z" of the example generated CF explanation methods.
newly available data (or shifted
data distribution).
Figure 1: Illustration of the robust recourse generation. (a) Given an input data point x. CF explanation methods generate new recourse od which lies on the opposite side of decision boundary f(;;0. (b) As new data is made available, the ML model's decision boundary is updated as f(: 0*). This shifted decision boundary f(;; 0*) invalidates the chosen recourse zf (as æ and xd lie on the same side of the shifted model f():))). (c) However, robust CF explanation methods generate a robust recourse ze for input by anticipating the future shifted model f(:;
locally approximated via a linear function, and adopt LIME (Ribeiro et al., 2016) find this linear approximation. However, recent works show that the local approximation generated from LIME unfaithful (Laugel et al., 2018; Rudin, 2019) and inconsistent (Slack et al., 2020; Alvarez-Melis & Jaakkola, 2018). Similarly, Nguyen et al. (2022) assumes that the underlying data distribution can be approximated using kernel density estimators (Bickel et al., 2009). However, kernel density estimators suffers from the curse of dimensionality (Bellman, 1961), i.e., they perform exponentially worse with increasing dimensionality of data (Crabbe, 2013; Nagler & Czado, 2016), which limits its usability in estimating the data distributions of real-world, digensiinns data.
Second, these two techniques are post-hoc methods designed for use with proprictary black-box ML models whose training data and model weights not available. However, with the advent of data regulations that enshrine the "Right to Explanation" (e.g.. EU-GDPR (Wachter et al., 2017)), service providers are required by law communicate both the decision outcome (i.c., the ML model's prediction) and its actionable implications (i.e., recourse for this prediction) to an end-user. In these scenarios, the post-hoc assumption overly limiting, as service providers can build recourse models that leverage the knowledge of their ML model to generate higher-qualin recourses. In fact, prior work (Guo al., 2021) has shown that post-hoc CF explanation approaches are unable balance the cost-invalidity trade-off (Rawal et al., 2020), which is an important consideration in generating recourses. To date, very little prior work departs from the post-hoe paradigm; Guo et al. (2021) propose such approach, unfortunately. it does not consider the robustness of generated recourses.
Contributions. We propose Robust ReCourse Neural Network (or RoCourseNet), a novel algorithmic framework for generating recourses which: (i) departs from the prevalent post-hoc paradigm of generating recourses; while (ii) explicitly optimizing the robustness of the generated recourses. RoCourseNet makes the following three novel contributions:
(Formulation-wise) We formulate the robust recourse generation problem as tri-level (min-max- min) optimization problem, which consists of two sub-problems: (i) bi-level (max-min) problem which simulates a worst-case attacker to find adversarially shifted model by explicitly simulating the worst-case data shift in the training dataset; and (ii) an outer minimization problem which simulates an ML model designer who wants to generate robust recourses against this worst-case bi-level attacker. Unlike prior approaches, our bi-level attacker formulation explicitly connects shifts in the underlying data distribution corresponding shifts in the MI. model parameters.
(Methodology-wise) We propose RoCourseNel for solving our tri-level optimization problem for generating robust recourses. RoCourseNet relies on two key ideas: (i) we propose a novel Virtual Data Shift (VDS) algorithm to optimize for the inner bi-level (max-min) attacker problem, which results in an adversarially shifted model; and (ii) inspired by Guo et al. (2021), RoCourseNet leverages block-wise coordinate descent training procedure to optimize the robustness of generated
2

---

Under review as a conference paper at ICLR 2023
recourses against these adversarially shifted models. Unlike prior methods (Upadhyay et al., 2021), we require no intermediate steps in approximating the underlying model or data distribution.
(Experiment-wisse We conduct rigorous experiments three real-world datasets to evaluate the robustness of several popular recourse generation methods under data shifts, Our results show that RoCourseNet generates highly robust CF explanations against data shifts, as it consistently achieves >96% robust validity, outperforming state-of-the-art baselines by ~ ~00%
RELATED WORK
Counterfactual Explanation Techniques. We categorize prior work on CF explanation techniques into non-muramelric methods (Wachter et al., 2017; Ustun et al., 2019; Mothilal et al., 2020; Van Loov- eren & Klaise, 2019: Karimi et al., 2021; Upadhyay al., 2021; Verma al., 2020; Karimi et al.. 2020), which aim to find recourses without involving parameterized models, and parametric methods (Pawelezyk et al., 2020b; Yang et al., 2021; Mahajan al., 2019; Guo et al., 2021), which adopt parametric models (e.g.. a neural network model) to generate recourses. In particular, our work is most closely related to CounterNet (Guo et al., 2021), which unlike post-hoc methods, jointly trains the predictive model and a CF explanation generator. However, all aforementioned CF explanation techniques (including CounterNet) do not optimize for robustness against adversarial model shifts; instead, we devise novel adversarial training approach generate robust recourses.
Robustness in Counterfactual Explanations. Our method is closely related to the model shift problem in algorithmic recourse (Rawal et al., 2020), i.c.. how to ensure that the generated recourse robust to shifts in the underlying predictive model. However, existing approaches (Upadhyay et al., 2021; Nguyen et al., 2022) rely simplifying assumptions: (i) Upadhyay al. (2021) propose ROAR which relies on a locally linear approximation (via LIME (Ribeiro et al., 2016)) to construct a shifted model, which is known suffer from inconsistency (Slack et al., 2020; Alvarez-Melis & Jaakkola, 2018) and unfaithfulness issues (Laugel et al., 2018; Rudin, 2019). (ii) Similarly, Nguyen et al. (2022) propose RBR which assumes that kernel density estimators can approximate the underlying data distribution. In particular, RBR relies on Gaussian kernels for multivariate kernel density estimation, which suffers from the curse of dimensionality (Bellman, 1961; Crabbe, 2013; Nagler Czado, 2016). In contrast, our work relaxes these assumptions by constructing adversarial shifted models via simulating the worst-case data shift, and conducting adversarial training for robust CF generation.
Orthogonal to our work, Pawelczyk et al. (2020a) analyze the model multiplicity problem, which studies the validity recourses under different ML models trained on the same data, and Black et al. (2022) propose methods to ensure consistency under the model multiplicity setting. In addition, some prior work focuses on ensuring robustness to small perturbations in the feature space generated recourses (Mishra al., 2021; Fokkema al., 2022; Haminnuez--lmede
al., 2022).
Adversarial training. We also leverage adversarial robustness techniques, which are effective in defending ML models against adversarial examples (Goodfellow et al., 2014; Madry et al., 2017; Shafahi et al., 2019; Wong et al., 2019; Chen et al., 2022). In addition, recent works (Geiping et al., 2021: Gao et al., 2022) also leverage adversarial training defend against data poisoning (Huang et al., 2020) and backdoor attacks (Saha et al., 2020). In general, adversarial training solves a bi-level main-max) optimization problem. In our work, formulate RoCourseNet's objective as a tri-level (min-mu max--max-aaa -inn) optimization problem, which we can decompose into a game played between a model designer and worst-case (hypothetical) adversary. The inner worst-case data and model shifts are assumed to be generated by bi-level worst-case attacker. The defender trains robust CF generator against this bi-level attacker by following an adversarial training procedure.
ROCOURSENET: END-TO-END ROBUST RECOURSE GENERATION
RoCourseNet is an end-to-end training framework for simultaneously generating accurate predictions and corresponding recourses (or CF explanations) that are robust to model shifts induced by shifts in the training dataset. At high level, RoCourseNet jointly generates predictions and robust recourses by solving tri-level optimization problem, which consists of two sub-problems: (i) a bi-level (max-min) problem which simulates worst-case attacker by finding adversarially shifted model; and (ii) an outer minimization problem that simulates a defender who wants to generate accurate predictions and robust recourses against this worst-case bi-level attacker.
3

---

Under review as a conference paper at ICLR 2023
We describe the RoCourseNet framework in two stages. First, discuss the attacker's problem: (i) we propose a novel bi-level attacker problem to find the worst-case data shift that leads to an adversarially shifted ML model; and (ii) we propose a novel Virtual Data Shift (VDS) algorithm for solving this bi-level attacker problem. Second, we discuss the defender's 's problem: (i) we derive a novel tri-level learning problem based on the attacker's bi-level problem; and (ii) propose the RoCourseNet training framework for optimizing this tri-level optimization problem, which leads to the simultaneous generation of accurate predictions and robust recourses.
3.1 VIRTUAL DATA SHIFT: CONSTRUCTING WORST-CASE DATA SHIFTS
We define predictive model f X + Let ((xs yi) l fl...., N}} represent our training dataset containing points. We denote f(x, 0) as the prediction generated by predictive model f on point x, parameterized by 0. Next, we denote 0 and O' as parameters of an (original) ML model (=;0) and its shifted counterpart O-;;0',, respectively. Also, let xt denote a CF explanation (or recourse) for input point æc Finally, recourse za is valid iff it gets opposite prediction from the original data point x, i.c., f(x";;)) w.r.t a shifted model f(::0') iff zd gets an opposite prediction from the shifted model (as compared to the prediction received by x on the original model), i.e., f(xx; (*) aligns with the notion of robustness to model shifts in the literature (Upadhyay et al., 2021). Finally, (),.) represents a loss function formulation, e.g., binary cross-entropy, mean squared error, etc.
1 f(z 0). On the other hand, recourse zf is robustly valid
fx; 0). This definition
Model Shift as an optimization problem. To motivate the need of introducing our bi-level attacker problem, we first discuss an optimization problem for worst-case attacker which directly perturbs model parameters to find an adversarially shifted model (denoted by f(;; ()..)). The goal of the attacker is to find ad adversarially shifted model which minimizes the robustness of the generated recourses. More formally, given our training dataset D and CF explanation method (that can generate recourses of for each (2r, y) D), the attacker's problem aims to find the worst-case shifted model f.: Bude) which minimizes the robust validity of the generated recourses, i.e., f (x**; Bldv) o 1 [x;;0) We can find adversarial shifted model by solving Equation 1.
Cad = argmaxgrer
1 N
Σ
(z --)
(1)
(DDD
where of correspond to CF explanations of input æ produced by a CF generator, and F (0' 0++5} denotes a plausible set of the parameters of all possible shifted models.
Unfortunately, it is non-trivial to construct a plausible model set F by directly perturbing the ML model's parameters 0, especially when f(::0) () is represented using a neural network. Unlike a linear model, quantifying the importance of neurons (to get neuron-speciff, weights) is challenging (Leino et al., 2018; Dhamdhere et al., 2018), which leads to difficulty in applying weight perturbations. To overcome these challenges, prior work (Upadhyay et al., 2021) adopts a simplified linear model to approximate the target model, and perturbs this linear model accordingly. Unfortunately, this simplified local linear model introduces approximation errors into the system, which leads to poor performance (as shown in Section 4). Instead of directly perturbing the model's weights, we explicitly consider a worst-case data shift, which then leads to an adversarial model shift.
Data Shift as a bilevel optimization problem. We identify distributional data shifts the funda- mental cause of non-robust recourses. Unlike prior work, we propose a bi-level optimization problem for the attacker which explicitly connects shifts in the underlying training data to corresponding shifts in the MI. model parameters. Specifically, in response to a shift in the training data (from D to Dahined,, defenders update (or shift) their predictive model by optimizing the prediction loss:
Cppt = argming
1 N.
E EnnnggeeDaa Deutodl
Crucially, this updated ML model f(, ((pe (caused by the shifted data Dasinee) is the key reason which leads to the non-robustness of recourses (i.e,, f(z*t; (%pe)) # 1 f(x; 8)). Therefore, to generate robust recourses, we optimize against an adversary who creates a worst-case shifted dataset Dr Shitted such that the correspondingly updated model (found by solving Eq. 2) minimizes the robust
4

---

Under review as a conference paper at ICLR 2023
validity of CF examples zfd Then, this data shift problem can be formulated as bi-level problem:
8" argmax 6,V6,EA
Σ
(DL.EED ( opec()))
-(ar;())
N
(3)
s.t., 8 opop(() = argming 1
-o; );;;0))) +1:: (.)
N
where d; E A denotes the data shift for a single data point 3; D. and {ō; V(= vs) E } denotes the data shift across all data points in the entire dataset. We define A as the -nom ball A
{ō E R || I c) (see 1o-morm based definitions in Appendix). Intuitively, the outer problem minimizes the robust validity to construct the worst-case data shift 8*, and the inner problem learns shifted model [(: ope) on the shifted dataset D Shineed Once we get the optimal 8 {oi, 82. ........... 8% by solving Equation 3, the worst-case shifted dataset Phineed = ((x; + 5% y:) V( Us) E D).
Virtual Data Shift (VDS). Unfortunately, solving Eq. is computationally intractable due to its nested structure. To approximate this bi-level problem, we devise Virtual Data Shift (VDS) (Algorithm 1), a gradient-based algorithm with an unrolling optimization pipeline. At a high level, VDS iteratively approximates the inner problem by unrolling -tstpss of gradient descent for each outer optimization step. Similar unrolling optimization pipelines a bi-level formulation (Shaban et al., 2019; Gu et al., 2022), e.g., meta-learning (Finn et al., 2017), hyperparameter search (Maclaurin et al., 2015), and poisoning attacks (Huang et al., 2020).
commonly adopted in many ML problems with
Algorithm 1 layouts the VDS algorithm which outputs the worst-case data shift 8", and the correspond- ing shifted model {.; ). VDS makes two design choices. First, it uniformly randomizes the data shift 8 ~ (-(,,, + where d {ō1, ( 5v) } (Line 3), following practices of Wong al. (2019). Uniform randomization is critical to adversarial model performance as increases the smoothness of the objective function, leading to improved convergence of gradient-based algorithms (Chen et al., 2022). Then, we iteratively solve this bi-level optimization problem via I' outer attack steps. At each step, we first update the predictor (.; 0') using the shifted data x + 5 via K unrolling steps of gradient descent, where x = {II,.... NN (Line 6). Next, similar to the fast sign gradient method (FSGM) (Goodfellow al., 2014), we maximize the adversarial loss and project ō into the feasible region& A (i.e., lox norm ball; Line 8-9). Crucially, when calculating the gradient of adversarial loss (outer problem) with respect to data shift (Line 8), we look ahead the inner problem for a few forward steps and then back-propager
the initial unrolling step. We do this because use K unrolling steps of gradient descent, as opposed to full-blown gradient descent till convergence. Note that the gradient w.r.t. ó depends on 0(6), where (()) is function resulting from LINE 5-7.
Algorithm Virtual Data Shift (VDS)
1: Hyperparameters: learning rates 7, step size a, # of attacker steps T, # of unrolling steps K
2: Input: model weights 6, perturbation constraints c, batch B (x, v). CF examples x
3: Initialize: virtual shifted model weights 0' 0, ~ U(-e, +e)
4: for i = 1 T steps do
5: for k = 1 - K unroll steps do
6:
8); 8' 0' 77 V C (f(x+
7: end for
8:
8 5e + a sign (V&L (f 8'), ((x;
9:
Project 8 onto the -orm ball.
10:
end for
11:
return 0',8
3.2
BLOCK-WISS COORDINATE DESCENT WITH ADVERSARIAL TRAINING
Choice of CF Explanation Technique. Note that our bi-level attacker formulation assumes that CF explanations x; for all data points z; are provided input the VDS algorithm. Thus, key design choice inside the RoCourseNet framework is the selection of an appropriate CF explanation technique, which can be used to generate recourses for input data points in Algorithm 1.
As mentioned in Section 2, most existing CF explanation techniques belong to the post-hoe expla- nation paradigm, which makes them unsuitable for use inside the RoCourseNet framework for two
5

---

Under review as a conference paper at ICLR 2023
reasons: (ii) misaligned motivations: post-hoc CF explanation methods mainly designed for use with proprietary black-box ML models whose training data and model weights are not available; instead, the VDS algorithm relies having access to the training data. Thus, the motivations and use-cases of VDS and post-hoe methods are misaligned. (ii) the post-hoe paradigm is overly limiting in many real-world scenarios. With the advent of data regulations that enshrine the "Right Explana- tion" (e.g.. EU-GDPR (Wachter et al., 2017)), service providers are required by law to communicate both the decision outcome (i.e., the ML model's prediction) and its actionable implications (i.e., recourse for this prediction) to an end-user. In these scenarios, the post-hoc assumption is overly limiting, as service providers can build specialized CF explanation techniques that can leverage the knowledge of their particular ML model to generate higher-quality recourses.
Motivated by these reasons, we choose CounterNet (Guo et al., 2021) as our CF explanation model of choice inside the RoCourseNet framework, as that is an end-to-end approach that departs from the post-hoe explanation paradigm by jointly training accurate predictions and recourses. In fact, Guo et al. (2021) show that CounterNet is able to better balance the cost-invalidity trade-off (Rawal et al., 2020) as compared to state-of-the-arr post-hoc approaches.
RoCourseNet Objective Function. We now describe how our bi-level attacker problem is plugged into an outer minimization problem to formulate a tri-level problem. which represents RoCourseNet's objective function. Inspired by Guo et al. (2021), RoCourseNet has three objectives: (i) high predictive accuracy- we expect RoCourseNet to output accurate predictions; (ii) high robust validity expect that generated recourses in RoCourseNet are robustly valid on shifted models?; (iii) low proximity we desire minimal changes required to modify input instance I to corresponding recourse xs! Based on these objectives, RoCourseNet solves the following min-max-min optimization problem to find parameters for its predictive model (.; and recourse generator g(5 0g). Note that similar to Guo et al. (2021). both f(; 0) and g(:; 0g) are represented using neural networks.
Σ E [ ((((;)))) 0) +N3 N
1
C C( 2t
argmin 9.,0g
Prediction Loss (L1)
Proximity Loss (L.s)
+ max
Σ (EDDEED
p ((s (2st )o
(Ix;; 0)
(4)
8, &.
N
Robust Validity Loss (I-z)
s.t 8 (6) argming
Σ (BLN)ED N
1
8,; 6. (
c (
x.. -0( 0,))
RoCourseNet Training. A common prac- tice in solving a min-max formulation is to first solve the inner maximization problem, and then solve the outer minimization prob- lem (Madry et al., 2017). Thus, we solve Eq. 4 as follows (see Algorithm 2): (i) To solve the inner bi-le problem, we find the worst-case model shift by solving Eq. 3 using VDS (Algorithm 1). (ii) To solve the outer minimization problem, we adopt dise coordinate descent optimization by distribut- 8:
Algorithm 2 Tri-level Robust CF Training
I: Hyperparameters: learning rates 1), # of epochs
N. maximum perturbation E
2: Input: dataset (x, v) E DD
3: Initialize: 0.
4: for epoch
N do
5:
<= E epoch/N
>> Linearly schedule e.
6:
for each minibach in D do
7:
0 + 0 -1 V V
8 VDS( zf (...) 8, g 0g - Vo, (12 L2 + As Ls)
ing gradient descent backpropagation on the objective function into two stages (as sug- gested in (Guo et al., 2021)) at stage one, optimize for predictive accuracy, i.e., L1 in Eq. 4 (Line 7). and at stage two, optimize the quality of CF explanations, i.c., X2 L2 + As La in Eq. (Line 9). Note that in Line 9, the gradient of X2 L2 + Xs La is calculated using the adversarially shifted model parameters 0' found by VDS in Line 8. Guo et al. (2021) show that this block-wis wise coordinate descent algorithm efficiently optimizes the outer minimization problem by alleviating the problem of divergent gradients.
9:
10: end for
11: end for
Note that robust validity also ensures validity the original predictive model (i.c., (z 1 f((=1;0)) the worst-case model shift case encompasses the unshifted model case.

---

Under review as a conference paper at ICLR 2023
In addition, we linearly increase the perturbation constraints for improved convergence of the training of our robust CF generator. Intuitively, linearly increasing e values corresponds to increasingly strong (hypothetical) adversaries. Prior work in curriculum adversarial training (Cai et al., 2018; Wang et al., 2019) suggests that adaptively adjusting the strength of the adversary improves the convergence of adversarial training (we verify this in Section 4).
4 EXPERIMENTAL EVALUATION
Baselines. Since, to our knowledge, RoCourseNet is the first method which optimizes for an end-to- end model for generating predictions and robust recourses, there exist previous approaches which we can directly compare against. Nevertheless, we compare RoCourseNet with two post-hoc robust recourse generation methods: (i) ROAR-LIME (Upadhyay et al., 2021); and (ii) RBR (Nguyen et al., 2022). In addition, to remain consistent with baselines established in prior work (U (Upadhyay et al., 2021: Nguyen et al., 2022), we also compare against VANILLACE (Wachter et al., 2017). a popular post-hoc method. Finally, we also compare against COUNTER (Guo et al., 2021) since our approach is inspired by their end-to-end paradigm of generating recourses.
Other than CounterNet, all remaining baselines require trained ML. model as an input. Similar to (Guo et al., 2021), we train a neural network model and use it as the base ML model for all baselines. For each dataset, we separately tune hyperparameters using grid search (see Appendix for details),
Datasets. To remain consistent with prior work on robust recourses (Upadhyay et al., 2021; Nguyen et al., 2022), we evaluate RoCourseNet on three benchmarked real-world datasets. (i) Loun (Li et al., 2018), which captures temporal shifts in loan application records. predicts whether a business defaulted on a loan (Y-1) or not (Y-0). This large-sized dataset consists of 449,152 loan approval records across U.S. during the years 1994 to 2009 (i.e., Dan = (Di, D2..., Di., where each subset D; corresponds to a particular year, and ie 16 is the total number of years). (ii) German Credit (Asuncion & Newman, 2007), which captures data correction shifts. It predicts whether the credit score of customer is good (Y=1) or bad (Y=0). This dataset has 2,000 data points with two versions; each version contains 1,000 data points (i.e.. Dan [D1, D2). where D1, D2 corresponds to the original and corrected datasets, respectively). (iii) Finally, we use the Student dataset (Cortez& Silva, 2008), which captures geospatial shifts. It predicts whether student will pass (Y (Y-1) 1) or fail (Y=0) the final exam. It contains 649 student records two locations (i.e., Dan = (D1, D2}, where each subset D; corresponds to a particular location).
Evaluation Procedure & Metrics. Each dataset is partitioned into subsets Dan = {D1, D2. .... DR)- This partitioning enables us to create & original datasets D, E Dan, and h: corresponding shifted datasets, Dahined = Dan D., where each shifted dataset Dshiied, contains all subsets of the dataset Dall except for the original dataset D:. Next, we do train/test split each D; Dan (i.e., D: (eiam We train a separate model (i.e., the entire models for RoCourseNet and CounterNer, and predictive models for other baselines) on each train set Dirain Vi E {1...., .....k). Then, we use the model trained on Diman to generate recourses on the hold-out sets Dieue Vi E {1,..., k). Finally, we evaluate the robustness (against the model shift) of recourses generated on Diest, Vi E (1...., k} as follows: for each recourse of (corresponding to an input instance x in Diest), we evaluate its robust validity by measuring the fraction of shifted models (i.c., 1 models trained on all shifted training sets) on which zd remains robustly valid (see definitions in Section 3.1).
Finally, we use three metrics to evaluate CF explanation: (i) Validity is defined the fraction of valid CF examples on the original model fl: (ii) Robust validity is defined as the fraction of robustly valid CF examples on a shifted predictive model f.: We calculate the robust validity on all possible shifted models (as described above). (iii) Preximity is defined as the I distance between the input and the CF example. We report the averaged results across all subsets Daul (see Table 1).
Validity & Robust Validity. Table 1 compares the validity and robust validity achieved by Ro- CourseNet and other baselines. RoCourseNet achieves the highest robust validity on each dataset outperforms ROAR-LIME by 10% (the next best performing baseline), and consistently achieves at least 96.5% robust validity. This illustrates RoCourseNet's effectiveness at generating highly robust recourses. Also, RoCourseNet achieves the highest validity each dataset. This result shows that optimizing the worst-case shifted model (i.e., L2 in Eq. 4) is sufficient to achieve high validity, without the need to explicitly optimize for an additional validity loss on the original model.
7

---

Under review as a conference paper at ICLR 2023
Table Evaluation of recourse robustness under model shift. It desirable for recourse methods to have low proximity (prox.) with high validity (Val.) and high robust validity (Rob-Val,, Val.).
Methods
Loan Val.
German Credit
Student Val.
Prox.
Rob-Vat
Prox.
Val.
Rob-Vat Val.
Prox.
Rob- Val.
VANILLACF
7,390
0.942
0.885
4.65
0.900
0.772
152236
0.915
0.673
1.860
0.026
0.121
0.197
20011
2.0088
0,383
0.056
0.006
COUNTERNET
6.746
0.964
0.639
5.719
0.60
0.706
18,619
0.907
0,859
0.725
0.085
0.222
0.130
+ 0.02
0.044
0.131
0,053
0,071
ROAR-LIME
7.648
0.934
0
4.862
0,100
0,792
11.931
0.967
0,820
1.951
0.117
0.052
0.026
0,075
RBR
11:71
6.005
26.255
0.660
0.611
1:1.33
0.130
0.132
2,099
1: 0.148
0.046
3,089
0.014
0.073
ROCOURSENET
6.611
0.99
0.969
6,908
1.000
1,000
0.418
0.002
0.106
+ 0.250
+ 0.002
+ 0.008
0,281
0.000
0.000
Proximity. Table I compares the proximity achieved by RoCourseNet and baselines. In particular, RoCourseNet performs exceedingly well on the Loan application dataset (our largest dataset with ~450k data points), it is the second-best method in terms of proximity (just behind CounterNet), and outperforms all our post-hoc baseline methods (RBR, ROAR-LIME, and VanillaCF). Perhaps understandably, RoCourseNet achieves poorer proximity on the German Credit and Student dataset, given that the limited size of these datasets (less than 1000 data points) precludes efficient training.
German Credit
Student
1.0
1.0
ROAR-Lie RBR
Valziry
ooCoourneee
ROAB-Line
RoCoemseNes
0.6
ROAR-Line
10
5
10
15
20
25
Robatt Validity
0.95
ROAT-LLme
0.8
0.90
RBR
RoCounseie
ROAR-Line
0.8
0.85
0.7
RoCoomseNes
0.50
ROAR Lime
0.6
0.75
8
10
12
14
5
10
15
20
25
Proximity
Pruximity
Prosimity
Figure 2: Pareto frontiers of the cost-invalidity trade-off.
Cost- Validity Trade-Off. We compare RoCourseNet, ROAR-LIME, and RBR (three recourse methods explicitly optimizing for distribu- tional shift) in their trade-off between the cost (measured by proximity) and their original and robust validity (Rawal et al., 2020). For each method, we plot the Pareto frontier of the cost-validity trade-off as follows: (i) For RBR, we obtain the Pareto frontier by varying the ambi- guity sizes 1 Eg (i.e.. hyperparameters of RBR Nguyen al. (2022)); (ii) For ROAR -IME and CounterNet, we obtain the Pareto frontier by varying the trade-off hyperparameter that controls the proximity loss term in their respective loss functions (e.g., As in Equation 4). Figure 2 shows that on the large-sized Loan dataset, RoCourseNet's Pareto frontiers either dominate or are comparable to frontiers achieved by ROAR-LIME and RBR. On the other hand, we observe a clear trade-off on the German Credit and Student datasets, where RoCourseNet (and other methods) can increase their normal and robust validity, but only at the cost of a poorer proximity score. This is consistent with prior literature, which shows that proximity needs to be sacrificed to achieve higher validity (Nguyen al., 2022).
1.00
Bolaue Valaatt
0.95
sRacic
0.00
11.55
0.80
2
30
15
16
Attocker Stepe
Figure 4: Impact of epsilon scheduler on the robustness.
8

---

Under review as a conference paper at ICLR 2023
1.0
tobict valdhy
Robest valdity
Prodimtt
7.0
0.5
700
BoConnelien
123
18
123
7
10
16
20
2.3
5
10
13
15
20
Mioocr Stepa
Attockee Steps
Attackos Staps
(a) The number of attacker steps T vs attacker effectiveness (1)
(b) The number of attacker steps
(c) The number of attacker steps
T vs robust validity (1).
T vs proximity (1).
7.4
Nobrus Valdie
Nobust Valnity
Produdre
0.9
0.3
7.0
BuCosmeNe
0.7 0000000000
DMD
"100010000 D0S
0,00033001
U.S.
Perturbation
Perturbction
(d) Maximum perturbation attacker effectiveness (L).
(e) Maximum perturbation E. robust validity (t).
(f) Maximum perturbation E vs. proximity (L).
Figure 3: The impact of the number of attacker steps T (3a-3c) and max- perturbatttoon E (3d-3f) to robustness on the Loan dataset (1 or I means that higher or lower value is preferable, respectively).
Evaluating VDS Attacker. We first demonstrate the effectiveness of VDS on solving the inner maximization problem in Eq. 4, i.e., how often VDS succeeds in finding an adversarial shifted model f(:;0"), such that the generated recourses at are not robustly valid. To evaluate the performance of VDS, we apply Algorithm 1 to find shifted model parameters 0', and compute the robust validity of all hold-out test-sets with respect to this shifted model.
Figure 3a and 3d compares the effectiveness of attacking RoCourseNet and CounterNet via the VDS algorithm, which highlights three important findings: (i) First, the VDS algorithm effective in finding shifted model which invalidates given recourse the average robust validity drops 74.8% when the attacker steps T 20, as compared to 99.8% validity on the original model. (ii) Figure 3a shows that when T is increased, the robust validity of both CounterNet and RoCourseNet is degraded, which indicates that increasing attack steps improves the effectiveness of solving the bi-level problem in Eq. 3. Similarly, Figure 3d shows that increasing F. also improves effectiveness of solving Eq.3. (iii) Finally, RoCourseNet is more robust than CounterNet when attacked by the VDS algorithm, as RoCourseNet vastly outperforms CounterNet in robust validity (e.g., 28%, 10% improved robust validity when T = 20, E = 0.5 in Figure 3a and 3d, respectively).
Understanding the Tri-level Robust CF Training, We further analyze our tri-level robust training procedure. First, we observe that stronger attacker (i.c., more effective in solving Eq. 3) contributes the training of more robust CF generator. In Figure 3b, we observe that increasing T (which results in stronger attacker as shown in Figure 3a) leads to improved robust validity, which indicates a more robust CF generator. Similarly, Figure 3e illustrates that increasing values leads improved robustness of counterfactual validity. These results show that having appropriately strong attacker (i.e., effectively optimizing Eq. 3) is crucial to train for robust CF generator.
Epsilon Scheduler. Figure 4 illustrates the importance of linearly scheduling values inside VDS (see Appendix for experiments with non-linear schedulings). By linearly increasing e, we observe ~0.88% improved robust validity (on average) compared to using static during the entire adversarial training. This shows that this curriculum training strategy can boost the robustness of recourses.
5 CONCLUSION
We present RoCourseNet, end-to-end training framework to generate predictions and robust CF explanations. We formulate this robust end-to-end training as min-max min-max-minn optimization problem, and leverage novel adversarial training techniques to effectively solve this complicated tri-level problem. Empirical results show that RoCourseNet outperforms state-of-the-an baselines in terms of robust validity, and balances the cost-validity trade-off significantly better than baselines.

---

Under review as a conference paper at ICLR 2023
ETHICS & REPRODUCIBLILITY STATEMENT
Ethics Statement. RoCoursenet takes into account of potential model shift in the real-world deployment. However, before deploying RoCourseNet real-world system, must be aware of the possibility for RoCourseNet to reinforce pre-existing societal prejudices among end users. A temporary workaround is to have trained human operators to communicate the CF explanations in respectful manner. In the long term, more quantitative and qualitative research will be required to fully understand RoCourseNet's societal impact.
Reproducibility Statement. We release the code through an anonymous repository in supporting the reproduction of this work (Chttps: //gg//g// //ggtttuuuuu github.... com/ hom/bkghz orange- baaggge-buee/ee /coutt ernet adv). In this anonymous repository, we also offer the dataset that was utilized for this paper's evaluation. We also include the options for hyperparameters the appendix A. Appendix A contains thorough description of our experimental implementation.
REFERENCES
David Alvarez-Melis and Tommi S Jaakkola. On the robustness of interpretability methods. arXiv preprint arXiv:1806. 08049, 2018.
Arthur Asuncion and David Newman. Uci machine learning repository, 2007.
Solon Barocas, Andrew D Selbst, and Manish Raghavan. The hidden assumptions behind counter- factual explanations and principal reasons. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, pp. 80-89, 2020.
Richard Bellman. Adaptive Control Processes. Princeton University Press, 1961.
P Bickel, P Diggle, S Fienberg, U Gather, I Olkin, and Zeger. Springer series in statistics. Springer, 2009.
Emily Black, Zifan Wang, and Matt Fredrikson. Consistent counterfactuals for deep models. In International Conference on Learning Representations, 2022. URL https::/openrevve//
net/ pee//for coooummid=Steee Sey
Qi-Zhi Cai, Chang Liu, and Dawn Song. Curriculum adversarial training. In Proceedings of the 27th International Joint Conference Artificial Intelligence, pp. 3740-3747, 2018.
Jinghui Chen, Yu Cheng, The Gan, Quanquan Gu, and Jingjing Liu. Efficient robust training via backward smoothing. Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 2022.
Paulo Cortez and Alice Maria Gonçalves Silva. Using data mining to predict secondary school student performance. 2008.
Jordan Jimmy Crabbe. Handling the curse of dimensionality multivariate kernel density estimation. Oklahoma State University, 2013.
Kedar Dhamdhere, Mukund Sundararajan, and Qigi Yan. How important is neuron? arXiv preprint arXiv:1805.1 12233, 2018.
Ricardo Dominguez-Olmedo. Amir H Karimi, and Bernhard Schölkopf. On the adversarial robustness of causal algorithmic recourse. In International Conference on Machine Learning, pp. 5324-5342. PMLR. 2022.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. In International conference on machine learning, pp. 1126-1135. PMLR, 2017.
Hidde Fokkema, Rianne de Heide, and Tim van Erven. Attribution- -based explanations that provide recourse cannot be robust. arXiv preprint arXiv:2205. /5834, 2022.
Yinghua Gao, Dongxian Wu, Jingfeng Zhang, Guanhao Gan, Shu-Tao Xia, Gang Niu, and Masashi Sugiyama. On the effectiveness adversarial training against backdoor attacks. arXiv preprint arXiv:2202. 10627, 2022.
10

---

Under review as a conference paper at ICLR 2023
Jonas Geiping, Liam Fowl, Gowthami Somepalli, Micah Goldblum, Michael Moeller, and Tom Goldstein. What doesn't 't kill you makes you robust (er): Adversarial training against poisons and 2021.
backdoors. arXiv preprint arX
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: 1412.65712166 2014.
Edward Grefenstette, Brandon Amos, Denis Yarats, Phu Mon Htut, Artem Molchanov, Franziska Meier, Douwe Kiela, Kyunghyun Cho, and Soumith Chintala. Generalized inner loop meta-learning. arXiv preprint arXiv:1910.01727, 2019.
Alex Gu, Songtao Lu, Parikshit Ram, and Lily Weng. Min-max bilevel multi-objective optimization with applications in machine learning. arXiv preprint arXiv:2203.0192. 2022.
Hangzhi Guo, Thanh Nguyen, and Amulya Yadav. Counternet: End-to-end training of counterfactual aware predictions. In ICML 2021 Workshop on Algorithmic Recourse, 2021.
W Ronny Huang. Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Practical general-purpose clean-label data poisoning. Advances in Neural Information Processing Systems, 33:12080-12091, 2020.
Amir-Hossein Karimi, Gilles Barthe, Bernhard Schölkopf, and Isabel Valera. A survey of algorithmic recourse: definitions, formulations, solutions, and prospects. arXiv preprint 2020.
Smir-Hossein Karimi, Bernhard Schölkopf, and Isabel Valera. Algorithmic recourse: from counter- factual explanations to interventions. In Proceedings of the 2021 ACM Conference Fairness, Accountability, and Transparency, pp. 353-362, 2021.
Thibault Laugel, Xavier Renard, Marie-Jeanne Lesot, Christophe Marsala, and Marcin Detyniecki. Defining locality for surrogates in post-hoe interpretablity. arXiv preprint 1806.0/800607499 2018.
Klas Leino, Shayak Sen, Anupam Datta, Matt Fredrikson, and Linyi Li. Influence-directed explana- tions for deep convolutional networks. In 2018 IEEE International Test Conference (ITC), pp. 1-8. IEEE, 2018.
Min Li, Amy Mickel, and Stanley Taylor. "should this loan be approved or denied?": A large dataset with class assignment guidelines. Journal of Statistics Education, 26(1):55-66 2018.
Dougal Maclaurin, David Duvenaud, and Ryan Adams. Gradient- brasee hyperparameter optimization through reversible learning. In International conference on machine learning, pp. 2113-2122. PMLR, 2015.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint (0Xxv:/706.0688. 2017.
Divyat Mahajan, Chenhao Tan, and Amit Sharma. Preserving causal constraints in counterfactual explanations for machine learning classifiers. arXiv preprint arXiv: 1912.03277, 2019.
Saumitra Mishra, Sanghamitra Dutta, Jason Long, and Daniele Magazzeni. A survey the robustness of feature importance and counterfactual explanations. arXiv preprint arXiv:2111.0033 2021.
Ramaravind K Mothilal, Amit Sharma, and Chenhao Tan. Explaining machine learning classifiers through diverse counterfactual explanations. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, pp. 607-617, 2020.
Thomas Nagler and Claudia Czado. Evading the curse of dimensionality in nonparametric density estimation with simplified vine copulas. Journal of Multivariate Analysis, 151:69-89, 2016.
Tuan-Duy Hien Nguyen, Ngoc Bui, Duy Nguyen, Man- Man-Chhng Yue, and Viet Anh Nguyen. Robust bayesian recourse. In The 38th Conference Uncertainty in Artificial Intelligncce, 2022.
11

---

Under review as a conference paper at ICLR 2023
Martin Pawelczyk, Klaus Broelemann, and Gjergji Kasneci. On counterfactual explanations under predictive multiplicity. In Conference on Uncertainty in Artificial Intelligence, pp. 809-818. PMLR, 2020a.
Martin Pawelczyk, Klaus Broelemann, and Gjergji Kasneci. Learning model-agnostic counterfactual explanations for tabular data. In Proceedings of The Web Conference 2020, pp. 3126-3132, 2020b.
Kaivalya Rawal, Ece Kamar, and Himabindu Lakkaraju. Algorithmic recourse in the wild: Under- standing the impact of data and model shifts. arXiv preprint arXiv:20/2.11788 2020.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. why should trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pp. 1135-1144, 2016.
Cynthia Rudin. Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead. Nature Machine Intelligence, 1(5):206-215, 2019.
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 1 11957-11960 2020.
Amirreza Shaban, Ching-An Cheng, Nathan Hatch, and Byron Boots. Truncated back back-propagation for bilevel optimization. In The 22nd International Conference Artificial Intelligence and Statistics, pp. 1723-1732. PMLR, 2019.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems, 32, 2019.
Dylan Slack, Sophie Hilgard, Emily Jia, Sameer Singh, and Himabindu Lakkaraju. Fooling lime and shap: Adversarial attacks on post hoc explanation methods. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, pp. 180-186, 2020.
Ilia Stepin, Jose M Alonso, Alejandro Catala, and Martín Fereira-Fariña. A survey of contrastive and counterfactual explanation generation methods for explainable artificial intelligence. IEEE Access, 9:11974-1200, 2021.
Sohini Upadhyay, Shalmali Joshi, and Himabindu Lakkaraju. Towards robust and reliable algorithmic recourse. Advances in Neural Information Processing Systems, 34:1 19966-6666677, 2021.
Berk Ustun, Alexander Spangher, and Yang Liu. Actionable recourse in linear classification. In Proceedings of the Conference on Fairness, Accountability, and Transparency, pp. 10-19, 2019.
Arnaud Van Looveren and Janis Klaise Interpretable counterfactual explanations guided by proto- types. arXiv preprint arXiv: 1907.02544 2019.
Sahil Verma, John Dickerson, and Keegan Hines, Counterfactual explanations for machine learning: A review. arXiv preprint arXiv:2010. 10596, 2020.
Sandra Wachter, Brent Mittelstadt, and Chris Russell. Counterfactual explanations without opening the black box: Automated decisions and the gdpr. Harv. JL & Tech., 31:841, 2017.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In International Conference on Machine Learning, pp. 6586-6595. PMLR, 2019.
Eric Wong, Leslie Rice, and Zico Kolter. Fast better than free: Revisiting adversarial training. In International Conference Learning Representations, 2019,
Fan Yang. Sahan Suresh Alva, Jiahao Chen, and Xia Hu. Model-based counterfactual synthesizer for interpretation. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and
Data Mining, KDD '21, pp. 1964-1974, New York, NY. USA, 2021. Association for Computing Machinery. ISBN 978 4503333333
doi: 10.1145/3447548.34666
URL https: /dooi. .org/
10. 11 411111334444 4754444444444 84..47548..44444 3467333
12

---

Under review as a conference paper at ICLR 2023
A IMPLEMENTATION DETAILS
Here we provide implementation details of RoCourseNet and three baseline methods on three datasets listed in Section The code can be found through this anonymous repository (https: / //github. http////gooooooaoeeabaaaaa
Feature Engineering. We follow the feature engineering procedure of CounterNet (Guo al., 2021). Specifically, for continuous features, we scale all feature values into the [0, 1] range. To handle the categorical features, we customize model architecture for each dataset. First, we transform the categorical features into numerical representations via one-hot encoding. In addition, for each categorical feature, we add softmax layer after the final output layer the CF generator, which ensures that the generated CF examples respect the one-hot encoding format.
Hyperparameters. For all three datasets, we train the model for up to 50 epochs with Adam. We set dropout rate to 0.3 to prevent overfitting. We use T and E 0.1 to report results in Table 1, and report the impact of attacker steps and maximum perturbation E' to robustness in Figure 3. We use 2.5 x 8/T (based Madry et al. (2017)) for solving the bi-level problem in Equation 3 (via VDS). In addition, Table reports the hyperparameters chosen for each dataset, and Table speficies the architecture used for each dataset.
K 2 unrolling steps (same Huang et al. (2020)) with the step size
Table 2: Hyperparameters setting for each dataset.
Dataset
Learning Rate
7
Batch Size
X1
X2
X
Loan German Credit
0.003
0.03
128
1.0
0.2
0.1
0.003
0.03
256
1.0
1.0
0.1
Student
0.01
0.01
128
1.0
0.2
0.1
Table 3: Architecture specification of RoCourseNet for each dataset.
Dataset
Encoder Dims
Predictor Dims
CF Generator Dims
Loan
[110,200,10]
[10, 10]
[10, 10]
German Credit
[19, 100,10]
[10, 20]
[10, 20]
Student
[83,50,10]
[10, 10]
[10, 50]
Software and Hardware Specifications. We use Python (v3.7) with Pytorch (v1.82), Pytorch Lightning (vI,10), numpy (v1.19.3), pandas (v1.1.1), scikit-learn (v0.23.2) and higher (v0.2.1) Grefenstette et al. (2019) for the implementations. All our experiments were run a Debian-10 10 Lisux-based Deep Learning Image on the Google Cloud Platform. The RoCourseNet and baseline methods are trained (or optimized)
16-core Intel machine with 64 GB of RAM.
B ADDITIONAL EXPERIMENTAL ANALYSIS
B. PREDICTIVE PERFORMANCE
We first show that, similar to CounterNet, the training of RoCourseNet does not come at the cost of degraded predictive accuracy. Table 4 & 5 compare RoCourseNet's predictive accuracy and AUC score against the base prediction model used by baselines. This table shows that RoCourseNet achieves competitive predictive performance - achieves marginally better accuracy than the base model (~ 2%). Thus, conclude that the joint training of RoCourseNet does not come cost of reduced predictive performance.
B.2 HEURISTIC BASELINES
We provide two heuristic baseline methods to further illustrate the challenge of generating robust recourses under the distribution shift scenarios. MhaillaCF-Randon aims to generate robust recourse
13

---

Under review as a conference paper at ICLR 2023
Table 4: Predictive accuracy for each dataset.
Dataset
Base Model
RoCourseNet
Loan
0.886 + 0.036
0.885 + 0.035
German Credit
0.714 + 0.003
0.742 + 0.014
Student
0.914 + 0.028
0.906 + 0.066
Table 5: AUC score for each dataset.
Dataset
Base Model
RoCourseNet
Loan
0.897 + 0.026
0.900 + 0.027
German Credit
0.662 + 0.018
0.729 0.010
Student
0.913 0.012
0.947 = 0.018
by adding small perturbation to input. In addition, RoCourseNer-Randon optimizes for robust CF generator against a random perturbation attacker.
Table 6 compares heuristic baselines with RoCourseNet. Both baseline methods peroform significantly worse than RoCourseNet in validity, robust validity and proximity. This experiment further highlights the hardness of generating robust recourses simple heuristics drastically underperform compared to RoCourseNet.
Table 6: Heuristic baselines compared RoCourseNet on Loan dataset. Simple heuristic does defend against distribution shift.
Method
Validity
Robust Validity
Proximity
VANILLACF-RANDON
0.270
0.510=+0.21 0.856 10.127
9.446+1.042 10.405 + 1.857 6.611 = 0.418
0.856 10.127 0.996 + 0.002
ROCOURSENET
0.969 + 0.106
B.3
SIMULATED DATA SHIFT
We conduct simulated experiments with covariant and label shift.
Covariant Shift
We simulate the covariant shift via this Bayesian network:
T1 (1)1, I2 ~ NN2,, 02)
y - x + ~~ N(-00.10.11
where we set = 0.5, = 0.5, 0,00 = 0.3 for D,, and μn = 0, 01
= 0.3, p2
= 0.5, 02
0.5 for D2. Figure 5 illustrates this simulation dataset.
Label Shift Similarly, we simulate the label shift via this Bayesian network:
binomial(p)
= 2y - & (00110))) x1 N(-2+22,00
22 ~ N(= 33, 0.3)
where set p 0.6 for Di, and p 0.3 for D2. Figure 6 illustrates this simulation dataset.
14

---

Under review as a conference paper at ICLR 2023
Covariant Shift
D1
D2
2.0
1.5
0.50
0.25
0.00
-0.25
-0.50
-0.5
-0.75
1.0
1.5
2.0
-1.0
-0.5
0.0
0.5
Figure 5: Illustration of covariant shift.
Label Shift
(p 0.6)
(p
0.5
0.0
-0.5
-2.0
225
-3.0
1.0
1.0
x1
x1
Figure Illustration of label shift.
15

---

Under review as a conference paper at ICLR 2023
Prociction
Roinet Validity Lose Co
Proximity Less
0.010
0.35
3.02
0.30
0.05
0.20
0.06
0.16
0013
0.01
0.00
(a) Ci training curve.
(h) L2 training
(c) La training curve.
Figure 7: Training loss curves of RoCourseNet on the Loan dataset.
84
600
87
08
RoGazaNe:
03 Connadee
1070
3.2.5
Artucke Stige
(a) The number of attacker steps attacker effectiveness (L)
(b) The number of attacker steps
The number of attacker steps T vs proximity (L).
T robust validity (t).
Figure 8: The impact of the number of attacker steps T under the 12-norm constrains.
Experimental Results Table 7 shows that RoCourseNet achieves 100% validity and robust validity under both covariate and label shifts.
Table 7: RoCourseNet simulated data shifts.
Data Shift
Validity
Robust Validity
Proximity
Covariant
1.00
1.00
0.389 1 0.051
Label 1.00
1.00
0.425 + 0.012
C ABLATIONS OF ROCOURSENET
C.I TRAINING LOSs CURVE OF ROCOURSENET
Figure shows RoCourseNet's training curve. Importantly, the prediction loss L1 and the proximity loss L3 are smoothly optimized during the training. The robust validity loss C2 encounters fluctuations the early stage of training, but starts to converge after 10 epochs.
C.2 4 NORM PROJECTION IN ALGORITHM
We provide supplementary results on adopting as the /2-norm ball (i.e., A = {5 E R" || < ) for the maximum perturbation constrains. Figure highlights the results of using the 12-norm ball in attacking and adversarial training. We observe similar patterns in Figure 3. Thus, this result shows that 4o- -orm constrain can be substitute other feasible region.
D TIME-COMPLEXITY ANALYSIS
D.1 TRAINING TIME
RoCourseNet takes only 10 more minutes of training (as compared to CounterNet) on the Loan dataset (our largest-sized dataset). This is quite reasonable since training time is one-time up-front
16

---

Under review as a conference paper at ICLR 2023
Table 8: Training time of CounterNet and RoCourseNet on the Loan dataset (the largest dataset).
Dataset
CounterNet
RoCourseNet
Loan
22m 6s
32m 16s
German Credit
46s
1m 37s
Student
55s
2m 19s
Table 9: Inference time for generating single CF example on the Loan dataset (in milliseconds).
Dataset
ROAR
RBR
CounterNee
RoCourseNet
Loan
131.38
345.91
0.67
0.67
German Credit
104.87
271.34
0.51
0.51
Student
213.58
555.91
1.00
1.01
cost; after RoCourseNet is trained, test-time inference happens in milliseconds. Table 8 shows the training time of these two models.
D.2 INFERENCE TIME
Inference runtime is an important metric recourses are user-facing, Table 9 shows the inference runtime of RoCourseNet and baseline methods. Importantly, CounterNet and RoCourseNet achieve the same amount of inference time (as they share the same network structure). On the other hand, ROAR and RBR (two con-aaametric methods) take significantly more time (i.c., ~200X and 500X runtime as compared RoCourseNet, respectively).
E DISCUSSION ABOUT GENERALIZED FRAMEWORKS TO ROCOURSENET
This section discusses extending the training of RoCourseNet (see Algorithm 1 & 2) into a broader framework. The training framework of RoCourseNet are not tied to the CounterNet architecture, and we can substitute predictor and CF generator components to other parametric models. Crucially, we can extend the RoCourseNet training into a general framework, which contains two components: (i) a predictor f(: 8), which makes an accurate prediction for given input instance x, (ii) and CF generator g(::0)) which generates its corresponding CF explanations. This general framework does not require shared structure similar to the RoCourseNet architecture. We can choose separate models for the predictor f:: and CF generator g(: 0g). In addition, we can train this framework exactly train RoCourseNet via Algorithm 2, which optimizes for predictor (::6) and robust CF generator g(: 0g).
Experimental Settings. We demonstrate the feasibility of training this general framework (denoted as Robust CF Framework in Table 10). For fair comparison, we use the same hyperparameters in training RoCourseNet (See Appendix A) optimize this general framework. In addition, we use the same architecture specifications of RoCourseNet, as the predictor of this framework combines the encoder network and predictor network in RoCourseNet, and the CF generator network combines the encoder network and CF generator in RoCourseNet.
Empirical Results. Table compares this general robust CF framework with RoCourseNet and Roar-LIME. This table highlights two important findings: (i) First, our proposed tri-level robust training (in Algorithm 2) can be extended to general framework optimize a robust CF generator. In particular, this robust CF framework outperforms Roar-LIME in terms of proximity and validity, and achieves the same level of robust validity as Roar-LIME, (ii) Additionally, we highlight the importance of RoCourseNet design (by leveraging the design of CounterNet (Guo et al., 2021)). This architecture design enables to generate well-aligned CF explanations by passing the predictor model's decision boundary (i.e., pz) the CF generator. From Table 10, observe that RoCourseNet outperforms this Robust CF Framework in terms of the validity and robust validity, which underscores the importance of NoCourseNtt's architecture designs.
17

---

Under review as a conference paper at ICLR 2023
Table 10: Evaluating robustness under model shift using a general framework.
Methods
Metries
Proximity
Validity
Rob- Validity
Robust CF Framework
7.150 + 1.078
0.949 0.022
0.906 + 0.119
Roar-LIME
7.648 = 2.248
0.937 + 0.046
0.908 + 0.107
RoCourseNet
7.183 = 0.406
0.994 + 0.002
0.930 + 0.152
F DISCUSSION ABOUT MULTI-CLASS CLASSIFICATION
Existing CF explanation literature focuses on evaluating methods under the binary classification
settings (Mothilal al., 2020; Mahajan al., 2019; Upadhyay al., 2021; Guo et al., 2021). However, these CF explanation methods be adapted to the multi-class classification settings. Given an input instance x R the RoCourseNet generates (i) a prediction De H for input instance æ, and (ii) CF example xz encoded as one-hot format as ý. {0, 1},, where Σ; Me 1, h denotes the number of classes. In addition, assume a desired outcome y for every imput instances As such, can adapt Eq. for binary settings to the multi-class settings as follows:
explanation for input instance The prediction f.r R
argmin 0,0,
Σ
WDD A ((((s)))) D. +hs
L (1r veef
N
Prediction Loss (Ir)
Proximity Loss (Iaz)
Σ
Ao L {ss (2ft: O (0))
+ max
(5)
8, 6.
N
Robust Validity Loss (Lz)
s.l. O op (6) argming
1 E (E) N
+ ((( +,:00)
x. =g(0;;;;00 0g)-
To optimize for Eq. 5, we can follow the same procedure outlined in Algorithm 2. For each sampled batch, we first optimize for the predictive accuracy = 0 Ve(A1 L1). Next, we use the VDS algorithm to optimize for the inner max-min bi-level problem (in Algorithm 1). Finally, optimize for the CF explanations by updating the model's weight as 8" = 0% - Veg (A2 L2 + d L3).
18


Reviews:
[{"review_id": "zoGhFXCYWM", "reviewer": "Reviewer_KsVC", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This submission proposed an approach to solving the data distributional shift problem in recourse models. A min-max-min learning objective is proposed to learn the predictions and enhance the robustness of future data shifts. Then an optimization framework, RoCourseNet, is designed to optimize the learning objective. Experiments on three datasets and comparisons with several existing baselines demonstrate the effectiveness of the proposed method. ", "summary_of_the_review": "I suggest rejecting this paper. For details, please see my weakness. ", "strength_and_weaknesses": "Strength:\n\n1. The paper is easy to follow.\n\nWeakness:\n\n1. The motivation is not clear. When I look at the title of this submission, I feel this paper is related to the distributionally robust optimization (DRO) topic. However, I find the main part of this paper is related to adversarial perturbations. Therefore, the title is easy to mislead the understanding of this paper. I do not mean this title is a mismatch with this paper. But 'DISTRIBUTIONALLY ROBUST' is not fit well in this paper. Most importantly, it seems like the robust recourse is dynamically generated during training. According to (4), $x^{cf}$ is generated by another model (i.e., neural network) $g$. The final model should be $f$. I guess the distribution shift only works on $x$ instead of $x^{cf}$. However, in Figure 1, it is not clear what the data shift is. One observation is the model shifted but the data is not shifted. Moreover, the experiments are based on three datasets. However, distributional shifts in the training data (as mentioned in the Abstract) are not demonstrated on these datasets.\n\n2. Notations are not clear. For example, in Section 3.1, what is the domain of $f$? Is it a real number or belongs to {0,1}? In addition, below (1), $\\mathcal{F}={\\theta'|\\theta+\\delta}$. This $\\delta$ works on the model parameters. However, according to (3), $\\delta$ seems working on features. I am very confused with this parameter. \n\n3. In experiments, Table 1 is hard to read. For the three metrics, it is not clear whether the values large better or small are better. Most importantly, what is the meaning of bold values? If the bold value means the best result, why 6.746 $\\pm$ 0.723(from Loan, Proximity) is the best? It seems like this value is not the best.\n\n4. In Section 4 (Cost-Validity Trade-Off), I am very confused with the discussion from the **Cost-Validity Trade-Off** paragraph. First, I am not sure how to define 'the three best performing models from Table 1'. Section, What is the meaning of ambiguity sizes $\\epsilon_1$ $\\epsilon_2$? Third, the authors mentioned 'These figures show that ...'. I do not know which figure is for this discussion.\n\n5. Since the proposed optimization framework has no convergency guarantee, the authors should show the tendency curve of training loss. Moreover, since this task is a classification task, the authors should show the accuracy performance besides the metrics only for CF. Even Upadhyay et al., 2021 show accuracy and AUC (See Table 2 in [Upadhyay et al., 2021] for evaluating the performance of generating robust recourse). Without accuracy, it is hard to say the applicability of the proposed model. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "m-GXnLW_A_", "reviewer": "Reviewer_GDb3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper tackles the problem of generating counterfactual examples that are robust to distribution shifts.\nTo this regard, the authors first formulate a framework for this problem that considers a tri-level optimization problem.\nSecond, they propose a methodology, RoCourseNet, that solves a tri-level optimization problem.\nThey perform experiments on three standard benchmarks and find their results to be highly robust counterfactual explanations against data shifts that consistently outperform previous state of the art.\n", "summary_of_the_review": "While the paper has some strengths, as highlighted in the relevant strength section, the lack of a clear and formal definition of the problem they are facing severely limits their chance of acceptance for this paper as it is. \nAddressing the points listed in the weaknesses section could improve the rating of this paper according to this reviewer.\n", "strength_and_weaknesses": "## Strenghts:\n\nThe authors are effective in inserting their work in the current state of the art, with a satisfactory related work and introduction section.\nThe methodology introduced is clear with helpful pseudo algorithms as accompaniment.\nThe authors include anonymized code with their submission, which helps in the reproducibility compartment.\n\n\n## Weaknesses:\n\nMy main concern with this paper is the intuitive explanation of the underlying problem and, as a result, its lack of a formal definition.\n\nThe authors provide the classic example of an applicant to a loan bank.\nTheir goal is to provide a counterfactual explanation to a rejected applicant that is “robust” in the sense that the following time, if the conditions are met, the applicant will see its loan accepted.\nWhat is then the definition of “robust” in this case? What if interest rates drastically change in the meanwhile? Should the application still be accepted? Or is it more a sort of “ceteris paribus” change considered here? \n\nThis leads to the next point. The authors consider a worst case scenario, and use an adversarial technique to represent this.\nIt is the opinion of this reviewer that the authors did not really justify this choice.\nAs seen in the literature (Goodfellow 2014 and many others), adversarial attacks are often random to the human eye. Why then assume a worst case scenario, maybe even an unfeasible one? What is the probability of observing such a change?\n\nFinally, it could be argued that this method  ends up just trading off validity and robust validity with an increased proximity, as it seems to be the case in at least two of the three datasets considered in figure 2.\n\nThe fact that all comparisons are performed against methods that make stronger assumptions does not help in evaluating the method, the addition of a heuristic based similar technique would have helped in this regard (even a simple random baseline).\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "C6xz9G0pRf", "reviewer": "Reviewer_hKo5", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes an architecture and a training methodology (termed RoCourseNet) to generate a robust counterfactual (cf) along with the prediction for a given factual point. RoCourseNet builds on earlier work CounterNet [1] by modifying its objective to generate robust cfs i.e cfs which stay valid even when the underlying model shifts. As part of the RoCourseNet objective, the inner ‘adversary’ itself is proposed as a bilevel problem (called VDS in the paper). The paper proposes to learn a ‘worst-case’ classifier by looking at how the training dataset can change such that a classifier learnt on this new dataset maximally invalidates the old cfs.  Experiments are performed on 3 real-world datasets and they compare against 4 baselines.\n", "summary_of_the_review": "The paper solves an important problem. The experimental protocol and results are convincing. The main issue I have is I feel the method is computationally expensive, and it lacks some flexibility that post-hoc cf-generation methods have. I propose acceptance, conditional on some time-complexity analysis.", "strength_and_weaknesses": "+ The paper deals with a practical problem; generating robust recourses is necessary for models which are to be deployed in the real world\n+ RoCourseNet outperforms the baselines convincingly in generating robust recourses for the 3 datasets considered\n+ RoCourseNet works with the full model and not its locally linear approximation (via LIME etc.) which allows it to model larger number of model shifts via the VDS algorithm\n\n- RoCourseNet involves a tri-level optimization problem. How much additional computational effort does ReCourseNet require? A comparison of the training time taken vs CounterNet seems necessary. \n- The method lacks some flexibility of post-hoc counterfactual generation methods. Ex, different people have different notions of cost (proximity) or actionability. Can RoCourseNet solve this without retraining?\n\nOther points:\n* In Algorithm1 VDS line (8) how is this gradient w.r.t \\delta computed? Is the only dependence of \\delta through \\theta(\\delta)? \n* Although not completely fair, a comparison of the training time w.r.t ROAR [2] may also be instructive.\n* Cite the published version of ROAR\n\n[1] Hangzhi Guo, Thanh Nguyen, and Amulya Yadav. Counternet: End-to-end training of counterfactual aware predictions. In ICML 2021 Workshop on Algorithmic Recourse, 2021.\n[2] Upadhyay, Sohini, Shalmali Joshi and Himabindu Lakkaraju. “Towards Robust and Reliable Algorithmic Recourse.” NeurIPS (2021).", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "2LsyxIaEBNi", "reviewer": "Reviewer_N727", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose combining adversarial training with recourse generation methods to produce a robust recourse generation method, by solving a min-max-min tri-level optimization problem. They show that their method works better than competing state-of-art methods on several real world data shift datasets. \n", "summary_of_the_review": "This work is of high technical quality and the method produced by the authors can beat other state-of-art methods in generating robust recourse. The main limitation is the relative lack of novelty of the method or any new understanding or insights. \n", "strength_and_weaknesses": "Strengths: \n- The method is fairly straightforward and easy to understand, combining adversarial training with recourse generation. \n\n- The method works better than other state-of-art method in robust recourse generation, and the experimental evaluation is quite thorough. \n\nWeaknesses: \n- The method is a fairly direct combination of robustness through adversarial training and existing recourse generation methods. The novelty is not very high, although the authors did solve the technical difficulty of solving the tri-level optimization problem. \n\n- The current work considers robustness to adversarial perturbations to inputs in generating counterfactual explanations. But adversarial perturbations is a fairly specific and strong type of data shift, which does not cover all the cases suggested in the introduction. Have the authors considered robustness to other types of common data shifts such as covariate shifts or label shifts?  \n\n- It is odd that while the algorithm is trained on adversarial perturbations, the evaluation is focused on temporal data shifts, which is a mismatch. Are there any explanations on why models trained on adversarial data shifts work well on temporal data shifts? \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject