Faithfulness Under the Distribution: A New Look at Attribution Evaluation
Authors: Zhiyu Zhu
Zhibo Jin
Jiayu Zhang
Bartlomiej Sobieski
Przemyslaw Biecek
Fang Chen
Jianlong Zhou
Venue: ICLR 2026 Poster (2026)
Keywords: Attribution Evaluation
Model Faithfulness
In-Distribution Perturbation
Out-of-Distribution Bias
Primary area: interpretability and explainable AI

Abstract: Evaluating the faithfulness of attribution methods remains an open challenge. Standard metrics such as Insertion and Deletion Scores rely on heuristic input perturbations (e.g., zeroing pixels), which often push samples out of the data distribution (OOD). This can distort model behavior and lead to unreliable evaluations. We propose FUD, a novel evaluation framework that reconstructs masked regions using score-based diffusion models to produce in-distribution, semantically coherent inputs. This distribution-aware approach avoids the common pitfalls of existing Attribution Evaluation Methods (AEMs) and yields assessments that more accurately reflect attribution faithfulness. Experiments across models show that FUD produces significantly different—and more reliable—judgments than prior approaches. Our implementation is available at: https://github.com/LMBTough/FUD.

Published as a conference paper at ICLR 2026
FAITHFULNESS UNDER THE DISTRIBUTION: A NEW LOOK AT ATTRIBUTION EVALUATION
Zhiyu Zhu', Zhibo Jin', Jiayu Zhang", Bartlomiej Sobieski", Przemyslaw Biecek
Fang Chen', Jianlong Zhou
ABSTRACT
Evaluating the faithfulness of attribution methods remains an open challenge. Standard metrics such as Insertion and Deletion Scores rely on heuristic input perturbations (e.g., zeroing pixels), which often push samples out of the data distri- bution (OOD). This can distort model behavior and lead unreliable evaluations. We propose FUD, novel evaluation framework that reconstructs masked regions using score-based diffusion models to produce in-distribution, semantically co- herent inputs. This Distribution-wwar approach avoids the common pitfalls of existing Attribution Evaluation Methods (AEMs) and yields assessments that more accurately reflect attribution faithfulness. Experiments across models show that FUD produces significantly different- and more reliable-judgments than prior ap- proaches. Our implementation is available at: https://gitubb.cm/LMMM. MoBTogh//FUU
INTRODUCTION
With the widespread adoption of deep learning techniques in critical domains such as medical diagnosis (Bakator & Radosav 2018), financial risk control (Mashrur al. 2020), autonomous driving (Grigorescu et al. 2020). and security surveillance (Yu et al.] (021). J. the issue of model interpretability has attracted increasing attention. Although deep neural networks have achieved breakthrough performance across a range of tasks, their complex internal mechanisms are often regarded "black box," making it difficult to understand the rationale behind specific predictions. In safety-critical or high-risk applications. a lack of reasonable explanation for model decisions may lead severe consequences (Van der Velden et 2022). Therefore, enhancing model interpretability not only helps to foster user trust, but also facil facilitates error analysis, model debugging, and even improves robustness and generalization performance.
Among the various explainability techniques, attribution methods have emerged as a crucial approach for interpreting complex models by mapping prediction outcomes back to the input space (such as image pixels or feature dimensions) to identify key regions or factors that the model focuses on.
These methods are widely employed in tasks like image classification (Rao et al.) 2022) and sentiment analysis (ann et al. 2024), and have demonstrated significant value, particularly in scenarios that demand high levels security in model decision -aaiin...
However, attribution methods themselves are not always reliable or consistent, different techniques may produce significantly divergent explanations for the same model prediction. Therefore, how to objectively assess the quality of attribution results has emerged research. Faithfulness (Petsiuk et al.) 2018 Yeh et al. 2011)) is widely regarded as a key criterion for evaluating the effectiveness of attribution methods. Such criterion reflects the consistency between the attribution results and the actual dicision-makinn basis of the model: highly faithful attribution method indicates that the highlighted high-contribution regions genuinely play a critical role in the model's prediction. In other words, when these regions are removed or perturbed, the model's output changes significantly.
core challenge in current
Building on this insight, the research community has proposed various quantitative metrics to assess faithfulness. Among them, the most representative and widely adopted are the Insertion & Deletion
*Corresponding author: an l zhou @uts edu. au; University of Technology Sydney; SSuzhou University of Technology; *Warsaw University of Technology.

---

Published as a conference paper at ICLR 2026
DOD Space
(1) 3-D Contour with Langovin Trijecueses
[II] Soom Faid with Langeiin Trapcttriiss
IB Space
FLO (OCRS) Kesk
INFID
Otter Methads
Nettdd Sample
Stcaple
(a) OOD-00-TTll ID via Diffusion
(b) Langevin Trajectories
Figure 1: Overview of the FUD framework. (a) The left panel illustrates the core motivation of FUD: compared to conventional attribution evaluation metrics such as INS/DEL and INFID, which generate perturbed inputs drifting into the OOD space (puplle area), FUD ensures that evaluation samples remain within the ID manifold (green area) by reconstructing masked regions via a score-based diffusion model. (b) The right panel shows how FUD) leverages Langevin dynamics guide inputs back toward the data manifold. Subfigure (i) visualizes Langevin trajectories in a toy 3D density; subfigure (ii) shows how the learned score field V. log (z steers samples from OOD to ID regions. The derivation of this score function is discussed in Section 3.3
Scores (Petsiuk et al. 2018) and Infidelity (Yeh et al. 2019). The Insertion & Deletion Score is a pair of complementary evaluation metrics, which start from the "substitutability of contribution areas" and simulate the way humans understand the model's dependent areas. Specifically, the Deletion Score progressively removes the highest-scoring regions from the original input-ic., the pixels or features with the largest attribution values- and records the corresponding changes in the model's output at each step. In contrast, the Insertion Score starts from a blank image (such as an all-zero input or a blurred background) and gradually inserts the highest-scoring regions from the attribution map in order of decreasing attribution value.
Infidelity is another faithfulness metric based expected values, focusing on the explanatory power of attribution scores with respect to prediction changes. It is defined as the mean squared error between the attribution values and the actual changes in the model's 's predictions under a set of input perturbations, such as additive noise. Although existing Attribution Evaluation Methods (AEMs) provide powerful tools for quantitatively analyzing attribution methods, they also suffer from notable limitations. These methods fundamentally rely on the core operation of feature removal or modification, a process that inherently introduces two key heuristic mistakes, introducing additional information and being affected by the instability of the out-of-distribution space of models. We will discuss the details later. As a result, mainstream attribution methods often fail to faithfully reflect the true decision-making making basis of the model. leading explanations that lack faithfulness. To address the shortcomings of current AEMS in accurately capturing the faithfulness of attribution algorithms, inspired by Score-based Generative Modeling (SGM), we propose FUD. FUD capable of constructing attribution evaluation samples that remain within the data distribution while preserving the essential information required for faithful evaluation. The core idea of FUD lies in its ability to leverage the score function learned from the true data distribution to pull out-of-distribution samples back into the data manifold, while simultaneously preserving the critical information needed for faithful attribution evaluation. Building on this idea, we present detailed derivation of the distributional formulation underlying FUD. It worth emphasizing that FUD can be readily applied by incorporating the target model into existing score function, without the need for any additional training. An overview of the proposed pipeline shown Fig.
evaluation method called
Contributions. (1) we first identify that widely used Attribution Evaluation Methods (AEMs) systematically exhibit significant heuristic issues, posing substantial risks to explainable AI, and we analyse these issues from distributional perspective using explicit OOD detection and image-quality metrics; (2) we propose and formally derive the FUD evaluation method, explicitly designed to avoid these heuristic pitfalls, and validate its effectiveness through extensive experiments across diverse cases; and (3) we release FUD as an open- toolkit to promote transparency, reproducibility, and community engagement.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
Attribution methods aim to explain model predictions by identifying input regions most responsible for the output, with approaches such as Integrated Gradients (IG) (Sundararajan et al. 2017). Guided IG (Kapishnikov et al. (02T), Boundary-based IG (Wang et al.
2021), and adversarial-pan methods including AGI (Pan et al. (022) and subsequent adversarial attribution variants (Zhu et al. 2024b a ch. Evaluating attribution faithfulness typically relies perturbation-
metrics such as Insertion & 2019), Sensitivity-n v (Ancona et al., 2
Deletion Scores (Petsiuk et al. 2018). Infidelity (Yeh et al.
and aptimized-mask approaches (Fong & Vedaldi 2017 Fong et al., 2019), all of which introduce distribution shifts to varying degrees. In addition, generative in-filling approaches (Chang et al. 2019)]
Agarwal & Nguyen 2020) use learned generative models to replace removed pixels with realistic content; however, they do not incorporate classifier-input gradients and may inadvertently introduce plas-suppooting evidence instead of faithfully removing it. These methods collectively highlight the trade-off between interpretability and distributional consistency, motivating more robust evaluation frameworks. A detailed and extended discussion of attribution methods and evaluation metrics provided in Appendix A
METHOD
3.1 PROBLEM DEFINITION
In the Research of interpretability for deep learning models, attribution methods aim to measure the contribution of input features to the model's ' decision. Given a trained predictive model fz)) where x E R" represents an n-dimensional input sample, the model's output is a c-dimensional vector f(x) E IRC corresponding to the probability distribution or prediction scores over classes. Attribution methods attempt to generate an interpretable representation A (xx) E IR"" for the input sample x, indicating the importance of each input feature or feature region for the model output (usually for a specific class). For the i-th feature in the image, a larger value of A (z), represents a greater contribution of that feature to the model's decision. In the Appendix A we also provide detailed related work of the current state-of-ther the-trt attribution methods and commonly used AEMs.
Model-centric out-of-distributio (OOD) definition. Throughout this paper, OOD is defined with respect to the original model under evaluation. That is, perturbed sample is considered in-distribution if it lies on (or near) the model's learned data manifold, regardless of whether it appears visually "natural" to humans. This model-centric view consistent with our goal-assessing attribution faithfulness for the original rather than for re- re-trained or adaptively fine-tuned model. See Appx. objective OOD-detection evidence supporting this distinction.
3.2 THE HEURISTIC MISTAKES OF CURRENT AEMS
Most of the currently designed AEMs Petsiukk et al. 2018 Ych et al. 2019 Ancona et al. 2017) heuristic in nature. Although they are often supported by some mathematical interpretations and theoretical foundations (Yeh et al. 2019), they are essentially based on intuition-driven designs. Of course, we do not consider heuristic or intuition-driven evaluation method design to be wrong choice. Just as using the probability output of a classification model as measure of confidence is widely accepted-it effectively reflects the relative likelihoods of different class decisions made by the model. Since AEMs require an understanding of the model's 's internal mechanisms, and such understanding still largely relies on heuristic reasoning and empirical analysis, we inevitably make reasonable assumptions about these internal processes during interpretation. However, because these assumptions are themselves heuristic, it is difficult to design AEMs based on first principles. But precisely because of this, need to approach the potential heuristic mistakes with greater rigor.
We find that mainstream AEMs commonly involve feature insertion and deletion during their design. For example, the insertion score is calculated by progressively inserting features based on their contribution values in descending order, and observing the increase in the confidence score of the target class. A higher insertion score indicates that the attribution method has successfully identified important, high-contribution features. Similarly, the deletion score involves removing features in descending order of their estimated contribution values, where lower score
3

---

Published as a conference paper at ICLR 2026
indicates a better attribution method. During this process, corresponding mask M E 0, 1 is generated, where the ratio of O and I depends on the number of features we want to retain. The dimensions with a value of I indicate the features that are intended to be kept. Furthermore, directly construct an evaluation sample ã = M @ x + (1 - M) @ 0, which lies outside the distribution that the model is responsible for. Intuitively, this is appropriate evaluation method that can directly reflect the impact of feature importance.
However, in reality, this process is based on fundamentally flawed assumption-thal removing a feature means setting it to zero (the insertion score can be seen as the dual counterpart of the deletion score, which removes unimportant features). In images, zero often represents specific color information, such as black, so setting values to zero does not equate to removing features; instead, may introduce new, semantically meaningful information into the image. For a straightforward example: in a classification task distinguishing black cats from white cats, the black regions are important features for recognizing the "black cat" class. If we set parts of the image to zero (i.e., turn them black), this does not actually remove the black information-in in fact, it may even strengthen the representation of the "black cat." " As a result, the model's confidence output might not decrease and could even increase, which directly contradicts our expectation that the model should fail when important features are removed.
Aside from the issue of introducing additional information, current AEMs also suffer from another obvious heuristic mistake: it is difficult to ensure that samples with removed features remain valid and realistic samples. We assume that we have removed 50% of the important features, resulting in images containing half blacked-out regions. However, such samples would never appear in reality. When training the model, we expect it learn the distribution P=~P(z) (z)((())](]] where P(x) represents the true data distribution, and y denotes the class label information. In other words, since the true data distribution occupies only a very small portion of the high-dimensional space, the model only needs to to-and can only-be responsible for the distribution of the training data, while large amount of uncertainty exists outside this distribution. Using model behavior outside the data distribution to evaluate model behavior within the distribution is a highly counterintuitive approach.
In Section 4.3.1 and Section 4.3.7 we analyzed the intermediate images generated by current attribution evaluation methods using OOD detection techniques and image quality evaluation metrics, and found that these samples not only lie outside the true data distribution but also appear highly unrealistic. Since the samples with removed information often lie far from the true distribution P(x). the shift in the model's 's output probability distribution during this process may stem not only from biases in the class decision itself but also from discrepancies between the sample and the true distribution P(x). This issue cannot be distinguished during the attribution evaluation process, which undermines the credibility of AEMs. Morcover, because these evaluation results lie in an unstable OOD space, manifesting as very unsmooth insertion and deletion curves, including abnormal phenomena such as confidence increasing when important features are deleted.
Besides Insertion& Deletion Scores, evaluation methods such as Infidelity and Sensitivity-n, although attempting to circumvent the explicit insertion/delltton issues by focusing on consistency or sensitivity, still rely intervening in the input features during their operations. Consequently, they inevitably introduce intermediate images that deviate from the original distribution, resulting in similar heuristic mistakes in the evaluation outcomes. The issues with the Sensitivity-n metric are similar. Although this metric observes changes in model predictions by randomly occluding a subset of important features selected based on attribution rankings. it fundamentally relies on the assumption that "occlusion is equivalent to feature deletion." Meanwhile, these occlusion operations may still introduce unnatural semantic cues or create abnormal structures within the images, thereby affecting the stability of the model's output. In summary, when designing AEMs, we must rigorously avoid these hcuristic mistakes.
3.3 FAITHFULNESS UNDER THE DISTRIBUTION (FUD)
3.3.1 INTUITION
The core idea of FUD is simple: given attribution map, construct perturbed samples that (i) remain on the data manifold and (ii) preserve all visible features that the attribution method identifies as important, without introducing new evidence that supports the predicted class y. Conceptually. this
4

---

Published as a conference paper at ICLR 2026
corresponds to diffusion-style inpainting process guided by a hard mask and by "no new evidence for class y" bias, so that the evaluation reflects only the contribution of the preserved features.
For completeness, note that such perturbations expected satisfy several desirable properties, including ri-distribution realism, exact preservation of the retained features, absence of hallucinated class evidence, and perceptual coherence. These desiderata motivate the FUD update rule, and are discussed in more detail Appendix B
3.3.2 DERIVATION
We now summarise the FUD evaluation algorithm and formalise the above intuition. The derivation addresses two questions: how to keep the perturbed samples within the data distribution, and how to preserve the information we want to evaluate.
Within the distribution Inspired by the SGM algorithm (Song al. 2020). assume that the true data distribution P(x). We denote by x' an intermediate sample at iteration t (1.2..... T), where counts the remaining update steps and each update transforms xf into x'-1, We initialise
x² = @ + (1 - M) Oe.
<~ c0,10,,1,
(I)
so that the unmasked pixels follow the original image æ, while the masked pixels are replaced by noise; in general, such xf lies off the data manifold.
we could obtain the gradient Zz P(x") of the true distribution at the current position, we could gradient ascent to update xt and guide it towards regions of higher density. In practice, gradients in the input space are very sparse and the optimisation must satisfy normalisation constraints, so we
instead work with the score function and update according to
x¹ + Var log P(x') V2ce,
(O,
where denotes the Langevin step size and the noise term follows Song et al. (020). We approximate the true score Va log P(x²) using learned score funetion so so(x'), trained with the standard SGM objective
8r arg min
X(t) Ep (at) [|s0(00) Vai log Po (x')
where X(t) and o² are pre-defined hyperparameters. The score 89 can also be learned via diffusion models such DDPM (Ho al., (020). Since this paper does not focus the training details, we refer the reader to SGM (Song et al. 2020); here it is sufficient to note that, once we obtain the gradient information of the distribution, we can update samples using gradient steps to bring them back within the distribution.
Preservation of the evaluation information During the evaluation of attribution methods, we progressively remove or modify features that the attribution method deems unimportant, thereby preserving the features that are crucial to the model's decision-making. FUD aims to generate evaluation samples that both stay within the data distribution and preserve precisely these features. To achieve this, we require that the features to evaluated are kept intact, and that no newly generated features bring the sample closer to different class distribution. Otherwise. it becomes impossible to disentangle the effect of the original preserved features from that of newly created, class-supporting evidence.
To enforce this constraint, we introduce a hypothetical distribution P(y | x²) whose gradient is opposite that of Ply x²),
2t P(y x²) = V P(y l=))
and we denote this "no new class evidence" bias as an event The target distribution that FUD aims to sample from is then
P(a, xt, P(a" M)
P(x 2, M)
P(z, M)
(5)
P(= x²) P( M) P(x))
P(.) x') 1 H.M),
P(a M)
5

---

Published as a conference paper at ICLR 2026
where P(z,ã ă MM is normalising constant and P(x* M) = P(x') if the prior is independent of M. Taking gradients yields
V log P(x 2, M) v. log P(x') V. log P(y x²) V log P(# M),
(6)
with all gradients taken with respect to x'.
In this expression, the first term V. log P(x") ((aa)=a is the image prior P(æ) (not label vector) and is provided by the learned score network 69(x²). The second term v log P(y x²) is the classifier's input gradient with respect to z², supplied by the model whose behaviour we evaluate; in later steps, we only activate this term after x' has moved sufficiently close to the data manifold. The third term uu log P(x x², M) enforces consistency the unmasked pixels. Choosing
P( x M)
II M,=1
5(x) - 3:))
ensures that these coordinates remain fixed, effectively combining the score-model prior, the classifier- gradient correction, and the hard masking constraint into single update rule in Eq. (2). In implemen- tation, we directly replace the entries of x² with i whenever M; = 1; further properties are provided in Cppendix[[]
The construction of , log P(y x²) can be seen as taking the gradient of the input with respect to the negative cross-entropy loss. However, the model behaviour reliable only for samples that lie within the data distribution. The initial sample x! is far from the manifold, and the corresponding a log Pvy | x²) is therefore not meaningful. In SGM-like approaches, similar gradients require additional training that sacrifices classification performance in order to obtain useful gradients on noisy samples, which is incompatible with evaluating arbitrary pretrained models. To avoid this, we initially ignore the 2-term and use
P(o x M) P(x*) P(# M)
P(x 2. M)
& P(x') M)
(8)
instead of P(x* | 2, ã, M), using only the score prior and mask constraint to move samples closer to the manifold. In Appendix [ we show empirically, using the score function to generate evaluation samples, that after updating P(z i. M) for about 5% of the remaining sampling steps, the samples begin to enter the in-distribution region. At that point, features close to the original class distribution have not yet been newly generated, so we switch to the original target distribution P(x* |2, M) and continue sampling to obtain high-quality evaluation samples.
Finally, we summarise how FUD is used an evaluation metric. FUD generates attribu- tion-evaluation samples that stay within the distribution while preserving the features that need to be evaluated. We follow deletion-style protocol: unimportant by the attribution method, use FUD (with fixed hyperparameters) to generate the cor- responding evaluation samples each removal level, and track the model's confidence on these samples. If an attribution algorithm can accurately identify important features, then evaluation samples retaining the same proportion of features will exhibit higher confidence. We only consider this "retain important-fcaturres direction, rather than defining separate insertion and deletion scores, because evaluating samples where only unimportant features are kept is often not informative (for example, keeping few background patches of grass in a black-cat vs. white-cat task). From an optimisation perspective, the presence of the v, log P(y I x²)) term also means that explicitly evaluating "unimportant" features would tend to amplify adversarial effects and destabilise the metric, making it difficult to distinguish truly unimportant features from artefacts introduced by this term. The pseudocode of our FUD algorithm is provided in Appendix
progressively remove features deemed
4 EXPERIMENT
4.1
EXPERIMENTAL SETUP
Models & Data. To demonstrate that the proposed evaluation scheme generalises across network families, we test one convolutional and one transformer backbone: RESNET-50 (He et al.) 2016) the canonical ImageNet convolutional network- and VIT-B/I B/16 (Dosovitskiy 2020). , a vision transformer of comparable capacity. Both checkpoints are the publicly released ImageNet- 1 weights and are

---

Published as a conference paper at ICLR 2026
Table 1: Mainstream attribution evaluation metrics compared with FUD.
Metric
Description
Insertion & Deletion (INS/DEL)
Measures change in model output after iteratively inserting / delcting high-score regions.
Infidelity (INFID)
Expected squared error between attribution-weighee weighted perturbations and output change. Correlation hetween outpur change and random masking of the top-N salient features.
Sensitivity-N (Sen-N)
kept frozen during every attribution run, thereby eliminating confounding factors that fine-tuning could introduce. Following Pan et al. (202T) and Long et al. (2022), we draw 1,000 validation images uniformly random from ImageNet (Deng et al. 2009). No further curation performed, so the subset retains the long-tailed distribution of object categories and recording conditions; each attribution method is therefore evaluated on exactly the same, unbiased sample.
Attribution Baselines. We benchmark eleven representative explainability techniques that col- lectively cover gradient-, perturbation- and attack-based families: FIG (Hesse et al., [202I)
GIG (Kapishnikov et al.) (222T) IG (Sundararajan et al. (017). BIG (Wang et al. [021 SM (Si- monyan al. 20 MFABA (Zuu et 2004e), ATTEXPL.RR (Zhu et al. al.[[0025] ) ISA (Zhu et al.
2024a), EG (Erion al. 2021). AGI (Pan et al. 202I), and LA (Zhu et al. 2024d). All algorithms are executed with the syper-parameters recommended by their authors.
Competing Evaluation Criteria. To test whether the proposed metric (FUD) in Section 3 yields a more faithful signal of explanation quality, we compare it against three widely used quantitative criteria, summarised in Table [
Implementation Details. All experiments run on two NVIDIA L40S GPUs (48 GB) with Py- Torch 2.4.1. Mixed-preet precision inference (FP16) is enabled wherever supported. yielding ~1.7x speed-up without compromising numerical stability. Following standard practice in generative-model evaluation, adopt deterministic image-quality metrics (PSNR, SSIM, MS-SSIM, FSIM, GMSD, HaarPSI, VSI) that return fixed scores for each image pair, computed via the PyTorch Image Quality library with default configurations. We set the random seed 3407 for reproducibility. following Picard (202T). Results are reported as averages over all test samples, consistent with diffusion-model evaluation protocols (Ho et al. (020).
FUD employs an unconditional diffusion generator 256x256 wwwffssicnuuucoooo pt. The underlying U-Net has 256 base channels, two residual blocks per resolution, and multi-head self- at 32, 16, and 8 pixels (head dim. 64). All residual blocks include up/down sampling with scale-shift normalisation. We adopt FP16 arithmetic and 1 0000-step linear noise schedule while learning both mean and variance (learn_ gma=True), Although the generator is class-agnostic, we steer the reverse process with a pretrained classifier (256x256 class sifier. pt); guidance scale of 4.0 plus classifier-free guidance weight 2.0 balances diversity and fidelity. Each the 000 ImageNet images is explained at 256 x 256 resolution with batch size 2.
FUD Diffusion Configuration.
4.2 COMPUTATIONAL CONSIDERATIONS
While FUD provides more reliable attribution evaluations by ensuring in-distribution samples, it introduces additional computational overhead compared to standard deletion/insertion methods. Generating baffe samples for each masking step requires approximately few seconds per image on modern GPUs, whereas traditional zero-masking is virtually instantancous. This trade-off between evaluation fidelity and computational efficiency is inherent to our approach. In practice, the generative model needs to be trained only once per dataset and can be reused across all evaluations, amortizing the initial cost. We view this overhead as worthwhile investment for obtaining more faithful attribution assessments. Appendix [.3 (TTble 10 reports wall-clock times on ViT-B/16 for different numbers of diffusion steps.
4.3 EXPERIMENTAL RESULTS
We conduct extensive experiments to validate the proposed FUD evaluation scheme against existing attribution evaluation metrics. Unless otherwise specified, all reported results are averaged over 198 runs for fairness (complete results are available in the supplementary repository). We compare
7

---

Published as a conference paper at ICLR 2026
FUD with three widely-used evaluation methods Insertion/Deletion (INS/DEL), Sensitivity-N (Sen-N), and Infidelity (INFID) using two representative models (RESNET-50 and VIT-B/16) and eleven attribution methods spanning gradient- and perturbation basodd explainer families. In the following, we analyze the authenticity of intermediate samples and the stability of the evaluation process, and we examine an ablation on hard vs. soft mask constraints.
4.3.1 COMPARISON WITH EXISTING EVALUATION METRICS
Our first experiment demonstrates that conventional evaluation metrics produce intermediate samples that significantly deviate from the training distribution, whereas FUD generates intermediate samples that remain largely in-distribution. We verify this claim by employing Energy (L.iu et al. 2020) as our out-of-distribttion (OOD) detector to distinguish intermediate samples from genuine in-distribution (ID) data. The results in Table show that intermediate inputs produced by INS/DEL, Sen-N, and INFID are easily recognized as OOD, while those produced by FUD much harder to distinguish from normal inputs. For instance, under RESNET-50, the OOD detector achieves a high AUROC of 0.8974 on INS/DEL samples, but only 0.6863 on FUD's samples (closer to 0.5, which indicates random guessing). For completeness, additional perceptual and structural fidelity comparisons are provided in Table 9 (Appendix [.T). showing that FUD yields substantially higher PSNR/SSIM/FSIM scores than existing metrics.
Similarly, the detector's false positive rate 95% TPR (F jumps from 0.36 (INS/DEL) to 0.83 for FUD, and FUD yields markedly lower AUPR-In/ In/Out values than others. In other words, FUD's 's transitional examples are so realistic that the detector struggles to tell them apart from ID data, whereas other methods produce "artificial" inputs with obvious OOD char- acteristics that are readily identified. The reason is that traditional metrics rely on naive feature removal or perturbation (e.g. replacing content with zeros blurred backgrounds), which introduces semantic bi- ases (such as large black or noisy regions) not seen in the training distribution. This distribution shift can spuriously alter the model's behavior, undermining the fidelity evaluation. By contrast, FUD leverages a learned score function to gradually nudge perturbed inputs back towards the data manifold while preserv- ing the important features, thereby yielding much more authentic intermediate samples. As qualita- tive illustration, we provide examples of the progres- sive masking process under INS/DEL versus FUD in the Appendix F) as noted prior work (Jacovi & Goldberg, 2020), faithful explanations should be grounded in the model's representation space rather than human visual preferences, so even when extreme deletion ratios make some FUD samples appear less visually intuitive, they nevertheless remain on the model's in-distribution manifold. Under FUD, the model's confidence decays much more smoothly without abrupt jumps. Additional comparisons with recent OOD-aware attribution evaluation protocols are reported in Appendix[] further confirming FUD's advantage in maintaining in-distribution intermediate samples. detailed analysis of the L distance between the perturbed images and the original inputs is provided in Appendix
Buslution
INS.DEL
Semrintty
SSIM
INFID
FLD (Ouz)
PSI
SNK
GMSR
VSL
HaurPi
Figure 2: Radar plot of normalised image- quality metrics (GMSD inverted). FUD en- closes the largest area, indicating the highest overall fidelity.
4.3.2 AUTHENTICITY OF TRANSITIONAL SAMPLES
While the OOD detector in Section 4.3.1 confirms distributional realism, we further quantify the perceptual and structural fidelity of transitional images with seven standard quality metrics; a concise summary is given in Table 6. and detailed definitions be found in Appendix [F]
Protocol. Eleven attribution methods are evaluated on RESNET-50 and 1/16./16. Following standard practice, we progressively mask the top-ranked pixels from 10% 90% (step 10%), yielding
8

---

Published as a conference paper at ICLR 2026
Table 2: OOD detection performance for intermediate evaluation samples (higher values indicate casier detection as OOD). We report AUROC (higher means better OOD discrimination), FPRss (false positive rate 95% true positive rate), AUPR-In, and AUPR-Out for standard OOD detector distinguishing intermediate samples (OOD) from normal validation images (ID). Bold highlights the values indicating the most ID-like (hardest to detect) samples in each case. Note: In this context, AUROC, AUPR-In, and AUPR-Out values approaching 0.5 indicate maximal uncertainty in distinguishing between and OOD samples, thus reflecting increased in-distribution similarity and greater detection difficulty.
RESNET-50
VIT-B/16
Evaluation AUROC
FPR t AUPR-In | AUPR-Out AUROC FPR
AUPR-In AUPR-Out
INS/DEL
0,8974
0.3603
0.8948
0.8893
0.8784
0,4761
0,8529
0.8894
Sen-N
0.8773
0.5450
0.8579
0.8864
0,8781
0.5660
0.8568
0.8734
INFID
0.7801
0.7720
0.7526
0,7876
0,8181
0.7390
0.7904
0.8119
FUD (Ours)
0.6863
0.8317
0.6660
0.6922
0.6450
0.9404
0,5827
0.6812
Table 3: Average image-quality scores of transitional samples produced by four evaluation metrics.
Best values are bold.
Evaluation
PSNR
SSIM
MS-SSIM
FSIM t
GMSD
HaarPSI
VSI
INS/DEL
10.49
0.27
0.48
0.58
0.271
0.292
0,780
Sensitivity-N
13.63
0.13
0.62
0.53
0.214
0.444
0.732
INFID
16.64
0.22
0.72
0.63
0.169
0,550
0.810
FUD (Ours)
25.20
0.75
0.78
0,86
0.124
0.663
0.946
11 2 x 9 198 runs per metric. We average each metric across all runs, obtaining Table and visualise the normalised values in Figure
Discussion. Across all seven metries FUD outperforms prior evaluations by substantial margin. Its PSNR is +8.6 dB higher than the next best (INFID), SSIM improves by ~0.53, and the distortion- oriented GMSD drops by > 25%. Qualitatively, FUD's intermediate images preserve fine texture and colour consistency, whereas INS/DEL and Sensitivity-N introduce large black or noisy regions, and INFID yields blur artefacts. Combined with the OOD analysis, these results show that FUD produces transitional samples that are not only statistically in-distribution but also perceptually faithful, providing solid foundation for reliable attribution evaluation.
4.3.3 SMOOTHNESS OF THE EVALUATION PROCESS
We quantitatively assess the stability and monotonicity of attribution evaluation under different metrics. Ideally, as more important features are removed, the model's confidence should decrease smoothly and monotonically; irregular rises or plateaus indicate unreliability. We measure smoothness with Kendall's т, which captures a sequence's monotonic trend via pairwise-order concordance. value of r denotes perfectly monotonic decreasing confidence (cach removal step strictly reduces the score), whereas values near 0) indicate no clear trend (many out-of-order fluctuations). Table 4 reports for deletion sequences from eleven attribution methods evaluated with INS/DEL versus with FUD. FUD makes the process substantially more orderly and smooth: on RESNET-50, FUD gives 7 0.8 for most explainers, while INS/DEL often yields gradient-based methods). Notably, IG and GIG, which score very low under INS/DEL (T RV 0.22), reach much higher monotonicity with FUD (T 0.69). A similar trend appears on VIT-B/16; e.g.. IG improves from 0.46 to 0.78 under FUD. The higher values indicate that confidence decreases more consistently as important features are removed, without the erratic jumps or counter-intuitive increases seen with traditional masking. This monotonic behavior suggests that FUD's in-distribution samples provide more stable, interpretable signals for attribution evaluation and produce a smoother confidence decay. We also report additional OOD-detectin results for intermediate samples in Table II AAppnndx [.2) which further confirm that FUD produces ID-like transitions that support smoother and more stable confidence decay. By keeping intermediate samples realistic, FUD ensures that each incremental removal yields a proportional, stable change in output, aligning with the ideal of faithful attribution metrie. A more detailed discussion of what FUD measures, together with
0.6 (and as low 0.21 for

---

Published as a conference paper at ICLR 2026
Table 4: Smoothness of the evaluation process, measured by Kendall's (higher values indicate a more monotonic, smoother confidence decrease during feature removal). We compare eleven attribution methods evaluated under INS/DEL vs, under FUD. Bold numbers indicate the higher (smoother) value for each attribution method.
Model
Eval.
AGI
LAA
Attlisp
BIG
EG
FIG
GIG
1G
ISA
MFABA
SM
INS/DEL
0.6496
0,5771
0,7944
0.6379
0.5730
0.2006
0.2128
0.2176
0.6983
0.6774
0.2833
REsNET-50
FUD (Ours)
0.8443
0.8315
0.8771
0.9129
0.8292
0.8329
0.6845
0.0908
0.8312
0.9289
0.6728
INS/DEL
0.7344
0.3767
0.4523
0.4615
0.6629
VIT-B/16
FUD (Ours)
0.9174
0.9060
0.9241
0.9046
0.8203
0.8654
0.7741
0.7803
0.8763
0.9206
0.7472
Table 5: Comparison of generated image fidelity under hard vs. soft mask constraints FUD
(using IG at 50% masking). Higher values indicate better quality for PSNR, SSIM, MS-SSIM, FSIM, HaarPSI, VSI, while lower is better for the distortion metric GMSD. Bold denotes the better result for each metric.
Constraint
PSNR1
SSIM
MS-SSIM f
FSIM
GMSD +
HaarPSI f
VSI 1
Hard (Ours) Soft
34.0335 27.6317
0,947984 0.830200
0.985258
0.970190
0.035163
0.921655
0.9913477
0.951012
0.916191
0.081117
0.794670
0.971782
quantitative comparison of FUD scores across 11 representative attribution methods, is provided in Appendix G (Table
4.3.4 EFFECT OF SOFT vs. HARD CONSTRAINTS ON IMAGE QUALITY
We ablate soft versus hard mask constraints in FUD. By default (hard), masked features are fixed to baseline, i.e., a binary gate that fully removes selected features. As a soft alternative, inspired by Song et al.] (2020) and related work, we fill masked regions with Gaussian noise centered the original values. Formally, instead of I 5(x5 - %,) to enforce ã; = xf for unmasked features, we sample ī ~ NMM @ x, o²21) where M is a binary mask (I=preserve, O=remove), yielding the score o²
Vaa log P x²,, M) MO(ā-x)) This soft constraint adds noise in preserved regions, potentially
smoothing transitions. However, it significantly degrades image fidelity. Pixel-level masks often induce incoherent noise, lowering quality. We evaluate fidelity under both settings by applying Integrated Gradients (IG) on 50% masked inputs and computing standard image-quality metrics. Table 5] shows that hard masking yields higher DONR/SSIM/SS-SSIIIIII specifically, PSNR/SSIM of 34.03/0.948 vs. 27.63/0.833 for soft. These results confirm that the hard constraint produces more realistic, coherent transitional images, which is critical for reliable evaluation. Therefore, we adopt the hard constraint in FUD by default to maintain high image fidelity and stable performance.
and lower GMSD;
CONCLUSION AND FUTURE WORK
FUD evaluates attribution maps in a distribution-awan way by reconstructing masked regions via a score-based diffusion process, keeping transitional samples on the data manifold. This yields more realistic, perceptually faithful, and smoother evaluation dynamics than heuristic baselines. Given compute limits (and to avoid perfectionism). we leave several optimizations for future work: (i) task-specific score functions (x(") tailored to attribution evaluation the current sx(x²) is an unconditional -diffuddif model trained on ImageNet and requires resolution alignmen and (ii) more efficient samplers (e.g., DPM-Solver, DDIM) mitigate the sample-gent sample-generation bottleneck. At extreme deletion ratios, fills may look unnatural to humans due to limited context yet remain model-in in- in-distribution under objective detectors; our evaluation adheres to this model-centric criterion. Future improvements in estimating the data dist-iiitt score V, log P(z) may further reduce these limitations, as our framework can seamlessly incorporate stronger generative priors.
10

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
We have read and will adhere to the ICLR Code of Ethics. This work uses only public data, involves human subjects personally identifiable information, and therefore does not require IRB review. Results are reported for research purposes only; we release anonymized code/configurations to support verification, and will disclose any funding sources and potential conflicts of interest upon acceptance.
REPRODUCIBILITY STATEMENT
To support reproducibility, we release an anonymized repository with all experiment details including training/evaluation scripts, default hyperparameters, configuration files, and software/hardwarc environment.
REFERENCES
Chirag Agarwal and Anh Nguyen. Explaining image classifiers by removing input features using generative models. In Proceedings of the Asian Conference Computer Vision, 2020.
Marco Ancona, Enea Ceolini, Cengiz Öztireli, and Markus Gross. Towards better understanding of gradient- gradient-based attribution methods for deep neural networks. arXiv preprint arXiv:1711.06100 2017.
Mihalj Bakator and Dragica Radosav. Deep learning and medical diagnosis: A review of literature. Multimodal Technologies and Interaction, 23)):47,0018
Chun-Hao Chang, Elliot Creager, Anna Goldenberg, and David Duvenaud. Explaining image classifiers by counterfactual generation. In International Conference on Learning Representations, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-255. leee, 2009.
Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 2020.
Gabriel Erion, Joseph D Janizek, Pascal Sturmfels, Scott M Lundberg, and Su-In Lee. Improving performance deep learning models with axiomatic attribution priors and expected gradients. Nature machine intelligence, 3(7):620-6)) 631, 2021.
Ruth Fong, Mandela Patrick, and Andrea Vedaldi. Understanding deep networks via extremal perturbations and smooth masks. Proceedings of the IEEE/CV international conference on computer vision, pp. 2950-290000 290022998.11 2019.
Ruth C Fong and Andrea Vedaldi. Interpretable explanations of black boxes meaningful perturba- tion. In Proceedings of the IEEE international conference on computer vision, pp. 3429-3437, 2017.
Arne Gevaert, Axel-Jan Rousseau, Thijs Becker, Dirk Valkenborg, Tijl De Bie, and Yvan Saeys. Evaluating feature attribution methods in the image domain. Machine Learning, 113()):6019-6044, 2024.
Sorin Grigorescu, Bogdan Trasnea, Tiberiu Cocias, and Gigel Macesanu. A survey of deep learning techniques for autonomous driving. Journal of field robotics, 37(3):32--386, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 770-778, 2016.
Robin Hesse, Simone Schaub- Meyerr, and Stefan Roth. Fast axiomatic attribution for neural networks. Advances in Neural Information Processing Systems, 34:19513-19524 2021.
11

---

Published as a conference paper at ICLR 2026
Robin Hesse, Simone Schaub-Meyer and Stefan Roth. Benchmarking the attribution quality of vision
models. Advances in Neural Information Processing Systems, 37:97928 999477, 2024.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6883 2020.
Alon Jacovi and Yoav Goldberg. Towards faithfully interpretable nlp systems: How should we define and evaluate faithfulness? In Proceedings of the 58th Annual Meeting of the Association for Computationna Linguistics, pp- 4198-4205, 2020.
Andrei Kapishnikov, Subhashini Venugopalan, Besim Avci, Ben Wedin, Michael Terry, and Tolga Bolukbasi. Guided integrated gradients: An adaptive path method for removing noise. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 5050- 5058, 2021.
Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy- based out-of cuutoof-dsttriee of-distribution detection. Advances in neural information processing systems, 33:21 13:21464-2 21475, 2020.
Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song. Frequency domain model augmentation for adversarial attack. In European conference on computer vision, pp. 549-566. Springer, 2022.
Akib Mashrur, Wei Luo, Nayyar A Zaidi, and Antonio Relles-Kelly. Machine learning for financial risk management: survey. Ieee Access, 8:203203-203222, 2020.
Lars Nieradzik, Henrike Stephani, and Janis Keuper. Reliable evaluation of attribution maps in cnns: A perturbation-based approach. International Journal of Computer Vision, pp. 1-18, 2024.
Deng Pan, Xin Li, and Dongxiao Zhu. Explaining deep neural network models with adversarial gradient integration. In Thirtieth International Joint Conference Artificial Intelligence (IJCAI), 2021.
Jeng-Shyang Pan, Gui-Ling Wang, Shu-Chuan Chu, Dongqiang Yang, and Václav Snásel. New feature attribution method for explainable aspect-based sentiment classification. Knowledge-Bil Systems, 304: 12550, 2024.
Vitali Petsiuk, Abir Das, and Kate Saenko. Rise: Randomized input sampling for explanation of black-box models. arXiv preprint arXiv:1806.07423 2018.
David Picard. Torch. manual_seed (3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision. CoRR, 2021.
Sukrut Rao, Moritz Böhle, and Bernt Schiele. Towards better understanding attribution methods. In Proceedings of the ieee/cvf conference on computer vision and pattern recognition, pp. 10223- 10232, 2022.
Yao Rong, Tobias Leemann, Vadim Borisov, Gjergji Kasneci, and Enkelejda Kasneci. consistent and efficient evaluation strategy for attribution methods. In International Conference Machine Learning, pp. 18770-18795. PMLR, 2022.
Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv: 1312.6034 2013.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456, 2020.
Pascal Sturmfels, Scott Lundberg, and Su-In Lee. Visualizing the impact of feature attribution baselines. Distill, 5(1)=e2, 2020.
Mukund Sundararajan, Ankur Taly, and Qigi Yan. Axiomatic attribution for deep networks. In International conference machine learning, pp. 3319-3328, PMLR, 2017.
12

---

Published as a conference paper at ICLR 2026
Bas HM Van der Velden, Hugo J Kuijf, Kenneth GA Gilhuijs, and Max A Viergever. Explainable artificial intelligence (xai) in deep learning- cranningbbseed medical image analysis. Medical Image Analysis, 79:102470, 2022.
Zifan Wang, Matt Fredrikson, and Anupam Datta. Robust models are more interpretable because attributions look normal. arXiv preprini arXiv:2103. 2021.
Chih-Kuan Yeh, Cheng- Yu Hsieh, Arun Suggala, David Inouye, and Pradeep K Ravikumar. On the (in) fidelity and sensitivity of explanations. Advances neural information processing systems, 32, 2019.
Tianxi Yu, Xiaoyao Yin, Menglin Yao, and Tong Liu. Network security monitoring method based on deep learning. In Journal of Physics: Conference Series, volume 1955, pp. 012040. IOP Publishing, 2021.
Zhiyu Zhu, Huaming Chen, Xinyi Wang, Jiayu Zhang, Zhibo Jin, Jason Xue, and Jun Shen. Iterative search attribution for deep neural networks. In Forty-first International Conference on Machine Learning, 2024a.
Zhiyu Zhu, Huaming Chen, Jiayu Zhang, Xinyi Wang. Zhibo Jin, Jason Xue, and Flora Salim. Attexplore: Attribution for explanation with model parameters exploration. In The Twelfth International Conference on Learning Representations, 2024b.
Zhiyu Zhu, Huaming Chen, Jiayu Zhang, Xinyi Wang. Zhibo Jin, Minhui Xue, Dongxiao Zhu, and
Kim-K Kim-Kwang Raymond Choo. Mfaba: more faithful and accelerated boundary- -hared attribution method for deep neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38. pp. 17228-172366 2024c.
Zhiyu Zhu, Zhibo Jin, Jiayu Zhang, and Huaming Chen. Enhancing model interpretability with local attribution over global exploration. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 5347-5355, 2024d.
13

---

Published as a conference paper at ICLR 2026
LLM USAGE DISCLOSURE
We used large language models (OpenAI GPT-4o and GTP-5) as auxiliary tools for grammar checking and language polishing of the manuscript. These models were not involved in research ideation, experimental design, implementation, analysis. The authors take full responsibility for all content.
A RELATED WORK
A.1 STATE-OF-THE-ARE ATTRIBUTION METHODS
Attribution methods have emerged as one of the mainstream approaches for interpreting Deep Neural Networks (DNNs), owing to their ability to provide fine-grained, pixel-level explanations. We begin by introducing several commonly used attribution methods developed in recent years. The Integrated Gradients (IG) method (Sundararajan an et al. 2017) addresses the issue of vanishing gradients in Saliency Map (SM) (Simonyan al. 2013) algorithm by proposing two axioms that attribution should satisfy. IG computes attribution scores for each input feature by integrating the gradients along straight-line path from a chosen baseline to the input. To mitigate the noise interference along the integration path, the Guided Integrated Gradients (GIG) method (Kapishnikov et al., (021) introduces constraints on the network input and backpropagates neuron gradients suppress irrelevant pixel attributions, retaining only those features pertinent to the predicted class. While GIG effectively reduces noise, is primarily tailored image- based tasks, is highly sensitive to the quality of input features, and suffers from significant computational complexity. To further improve the rationality of anchor point selection, the foundary-based Integrated Gradients (BIG) method (Wang et al. (02T) introduces boundary mechanism to achieve more accurate attribution results. BIG attempts to use adversarial examples as anchors but still relies on linear integration paths. Additionally, BIG requires gradient computations for each feature point individually, which substantially increases computational costs. In contrast, the Adversarial Gradient Integration (AGI) method (Pan et al. 2021) seeks the steepest non-linear ascent path starting from adversarial examples, thus avoiding the need for a predefined baseline as required in IG. However, AGI's effectiveness heavily depends on the quality of adversarial sample generation, and its robustness remains under debate. In addition, other adversarial attribution methods (Zhu et al. [2024b a c) that employ adversarial examples as attribution baselines have also been widely adopted.
A.2 COMMONLY USED ATTRIBUTION EVALUATION METRICS
Current attribution evaluation metrics, such as the Insertion & Deletion Scores (Petsiuk et al. 2018
offer an intuitive curve- based evaluation approach. By progressively adding or removing regions with high attribution scores and observing the corresponding changes in prediction probability, these metrics aim to reflect the faithfulness of the attribution. The Deletion Score progressively occludes the pixels with the highest attribution scores (e.g., by setting them to zero or to the mean value), and plots a curve showing how the model's 'ss prediction probability decreases as the proportion of occluded pixels increases. A smaller Area under the Curve (AUC) indicates more faithful attribution. In contrast, the Insertion Score begins with a blank or blurred baseline and progressively inserts the most important pixels based on attribution scores, observing the rate which the model's prediction probability increases. As the Insertion and Deletion Scores often rely on filling removed regions with constant values (e.g., black mean pixels), they are highly sensitive distributional shifts. The resulting perturbed inputs charrateriree by large artificial occlusions can diverge substantially from the original data distribution, potentially introducing instability or bias into the evaluation outcomes. Recent research (Nieradzik et al.) 2024) have sought to improve the smoothness of attribution maps by introducing adversarial perturbations or enforcing smoothness regularization during the evaluation phase. Nonetheless, such methods fall short in mitigating the distributional shift induced by masking operations, as the modified inputs often remain at the periphery of the training data distribution.
The Infidelity metric (Yeh et al., 2019) attempts to quantify attribution consistency by computing the expected mean squared error between attribution scores and the corresponding changes in model predictions under input perturbations, theoretically providing more robust estimate. The metric selects a meaningful perturbation distribution (e.g., adding random noise to pixels or occluding a patch), and computes the expected mean squared error between the change in the model's output
14

---

Published as a conference paper at ICLR 2026
and the inner product of the perturbation with the attribution. A lower Infidelity score indicates higher attribution faithfulness. It is worth noting that the experiments compute the Infidelity metric using perturbations such as 'noise basclines' and 'patch removal'. However, commonly used global patch occlusion methods often result in unrealistic images, which may compromise the reliability of the metric. Although local random noise perturbations tend to cause smaller deviations from the original data distribution, this assumption still does not fully guarantee alignment with the training distribution.
Another metric for evaluating attribution faithfulness is Sensitivity-n (Ancona et al. 2017). which emphasizes the consistency between attribution scores and the model's output response. The core idea is that if certain pixels (or features) are identified as important in the attribution map, then randomly occluding these regions should lead to significant changes in the model's prediction. Specifically, Sensitivity-n evaluates whether the change in the model's output is consistent with the attribution importance by randomly selecting and occluding the top-n features with the highest attribution scores and measuring the resulting output variation. Unlike the Insertion & Deletion Scores, Sensitivity-n does not rely on explicitly constructing a perturbation sequence or response curve, making it more computationally efficient. Moreover, it mitigates the distributional shift issue caused by unnatural occluded images. However, this metric remains sensitive to the choice of occlusion strategy- for significantly influence
instance, the selection of occlusion values (e.g., zero mean replacement) the results. Moreover, Sensitivity-n does not directly assess the causal explanatory relationship between the attribution and the model's prediction, but rather reflects local perturbation consistency. As result, it is limited in its ability to serve as comprehensive evaluation metric.
To mitigate the aforementioned issues, some studies have introduced blurring operations as alternatives to direct occlusion. For instance, the Meaningful Perturbation (Fong & Vedaldi (017) and Extremal Perturbation (Fong et al. 2019) methods optimize masks to maximize the model's output within the preserved regions. These methods produce visually more natural perturbations and reduce abrupt distributional shifts; however, the inherent blurring still preserves low-frequency features of the original image, which may lead to semantic distortions in the attribution maps. Moreover, the generated inputs are rarely encountered in the training set, thus still posing a certain risk of out-of-distribution (OOD) inputs.
Beyond blurring-basee perturbations, several works have explored the use of generative models to reconstruct in mn-paint the regions removed during attribution. Chang et al. (2019) generate counterfactual images by replacing selected features with samples from a conditional generative model, thereby exposing how classifiers depend specific structures. Similarly, Similarly.AAgarwal Agarwal & Nguyen
(2020) propose filling removed pixels using a generative model to maintain perceptual realism while probing feature importance. While these approaches significantly reduce the visual artifacts of masking, the generative prior may inadvertently introduce class-supporting evidence rather than faithfully removing it, complicating deletion-based evaluation. Our FUD framework inherits the insight that perturbations should remain on the data manifold, but applies it at the level of the evaluation metric: any attribution method can be assessed under a unified score-based generative prior without modifying the explainer itself. Therefore, the design of attribution metrics must balance 'distributional consistency' and 'interpretability"" avoiding conclusions about attribution quality based solely on any single metric.
B DESIRABLE PROPERTIES OF EVALUATION PERTURBATIONS
To clarify what constitutes reasonable modified image for attribution evaluation, we list the ideal properties that any perturbation x' should satisfy:
1. In-distribution realism. Perturbed samples should remain on (or close to) the data manifold rather than becoming OOD artifacts. FUD enforces this via the prior term V, log P(z) and validates through OOD-detection metrics.
2. Preservation of retained features. Pixels marked as "kept" must match the original input exactly. This is implemented through the hard constraint P( | x. M) and stepwise overwriting.
3. No hallucinated class evidence. Perturbations should not introduce features that artificially increase confidence in class y. FUD controls this via the corrective term Vv. log P(y x))
15

---

Published as a conference paper at ICLR 2026
4. Perceptual coherence. Intermediate samples should remain structurally consistent (edges, colors, textures). This is quantified using standard perceptual metrics such as PSNR, SSIM, FSIM, and GMSD.
These desiderata generalize the assumptions underlying baseline-replacement methods. FUD opera- tionalizes them explicitly through the posterior
P(x, 2, M) x P(x.) P(z x2) P(ø 2z,, M).
(9)
whose gradient decomposition in Eq. 6 directly corresponds properties (1)-3), while (4) is validated empirically.
C PROOF OF THE &-LIKELIHOOD FOR OBSERVED PIXELS
For each pixel index i we denote by =, that the pixel is observed (i.e. must be preserved exactly in every evaluation sample) and by M, that the pixel is free (no constraint). Hence the conditional likelihood factorises
P( M) = II 5(x) 5(x 2:). M,=1
(10)
where the Dirac distribution 8(.) assigns non-zero density only when z = ã, while the factor 1 leaves unobserved pixels unconstrained. The support of x' is therefore restricted to the linear sub-manifold {x² E Rd at ã for all M, = =
Dirac the zero-variance limit of Gaussian Gaussian proxy
To justify the 8-likelihood formally, consider the
(atiū, 0²)
exp
(x] (x-=
(11)
V2TO
Taking the limit o² - 0 yields N 02) over all with M, and letting 0² - produces precisely the product of Dirac distributions used above.
8(x) 2,). Multiplying the Gaussian factors
This formulation be understood as extreme case of "zero- variance Gaussian," where non-zero probability mass exists only when z|x; = i( for observed pixels. That is, the distri- bution has support strictly limited to the set of values that exactly match the ground truth on known entries. For unobserved pixels where M, O, the likelihood imposes no acting as multiplicative factor of one. As result, the support of x' becomes lincar sub-manifold which all observed pixels must precisely align with their true values. This induces a hard constraint in the generative process: any valid sample must match the observed data exactly.
Intuition
Log-likelihood and gradient Because 6(-) is not a conventional density, its logarithm undefined; nevertheless the gradient of the log-liielihood can be obtained safely via the Gaussian limit. For the vector z E RRd we have
log P(i x. M) =
Σ
log 8(2) -x,),
(12)
M.
A log P MO
vector pointing towards infinity
(13)
a
where @ denotes the element-wise product and M E 10 is the mask vector. As a - 0, the magnitude of the gradient diverges while its direction always points from xf back to the pixel values Z: the optimisation is therefore forced instantaneously onto the constraint manifold.
Practical implementation In practice we do not apply the infinite gradient. Instead, after each diffusion update we simply overwrite the observed pixels:
x² M
M) xf,
(14)
which is exactly equivalent to following the 6-likelihood's 's gradient in the o² + limit but avoids numerical instabilities.
16

---

Published as a conference paper at ICLR 2026
D ADDITIONAL ANALYSIS OF THE SCORE FUNCTION
Why delay the classifier gradient? As argued in Section 3.3.2] adding the classifier term vt log Ply x²) too early can push off- off-manifold samples further away; guidance benefi- cial only after the diffusion trajectory has moved close to the data manifold under the prior score sg (2()).
This is because at early steps, the sample x' is still far from the classifier's data distribution, making the gradient signal from the classifier unreliable or even misleading. Delaying the classifier guidance ensures that meaningful and stable gradients are provided only when the sample is sufficiently close to the data manifold.
Experimental protocol We fix the total diffusion steps at 1000 and always turn on classifier guidance for the last 5% of those steps (1 < 50). To study the effect across different deletion levels, we vary the mask ratio E { (10%, 20%, 90%), J. where p denotes the percentage of unimportant features removed by the attribution method before FUD starts sampling. For each p generate 500 evaluation samples and measure the AUROC between the retained-featie featuree ratio and the classifier confidence.
AUROC vs. Stop
0.95
0.90
AUROC
10%
0.80
30%
40%6
0.75
70%
Stop
Figure 3: AUROC versus diffusion step for different mask ratios p (10%-90%). Classifier guidance is enabled for the last 5% of steps (grey vertical line). All curves stabilise quickly after guidance kicks in, and the final AUROC highest under this 5% schedule.
Figure plots plots AUROC versus diffusion step for six representative mask ratios. A consistent pattern emerges: AUROC remains flat while only the prior so (xx)) is applied, then climbs sharply once classifier guidance begins the i/T 0.05 mark, finally saturating within 30-40 steps. Although higher mask ratios (e.g. 70-90 converge to stable curves once guidance is applied, confirming that the "5% switch" robust across deletion levels.
Results
E PSEUDOCODE FOR FUD EVALUATION
Note: In practice we use DDIM to accelerate the sampling process. This procedure in Algorithm be viewed as discretized version of DDPM sampling.
17

---

Published as a conference paper at ICLR 2026
Algorithm 1: FUD Evaluation
Input: original image 2;
mask M,;
out-of-distribution threshold O;
Score Function co,
classifier P(y z):
total steps T' DDIM noise schedule { Yi=0,
Output: in-distribution evaluation sample x
((0 [) x² F@M + &
for 1 = T T..... do
ift 0 then
é t So(a*,t) t)
else
L e So ,1) + vI 0z xe log P(y |x0)
xx¹ vI -1- āi
x-11 t vā,-1
+ v1 ā,-
α
x² + To M x² 2 (1 M)
return σ
F METRIC DEFINITIONS
Each metric in Table 6 is briefly defined below:
PSNR Peak Signal-to-Noise Ratio; measures average pixel fidelity.
SSIM Structural Similarity Index; compares luminance, contrast, and structure.
MS-SSIM Multi-Scale SSIM; aggregates SSIM over multiple resolutions.
FSIM Feature Similarity; integrates phase congruency and gradient magnitude.
GMSD Gradient Magnitude Similarity Deviation; lower values indicate fewer edge distortions.
HaarPSI Haar Wavelet-based Perceptual Similarity; focuses on multiscale edge recall.
VSI Visual Saliency-based Index; emphasises fidelity in salient regions.
Table 6: Image-quality metries used to assess transitional samples. For GMSD we invert the score (1 (L-MMDD) when plotting the radar chart to align ischerr-i--btteer semantics.
Metric
High Value Means
Low Value Means
Trend
PSNR
Low pixel distortion
Large pixel error
SSIM
High structural similarity
Blurring structure loss Local distortion Edge and detail loss Edge blur, contour loss Global blur Salient region blur / loss
MS-SSIM
Multi-scale consistency
FSIM
Sharp edges / textures
GMSD
Small gradient deviation
HaarPSI
Good multi-scall detail
VSI
Clear salient regions
Comparing FUD existing deletion baselines. The upper sub-row of each example Fig. (Original Heat-map - INFD - INS/DEL- + Sen-N) visualises three widely-used deletion metrics. Despite their popularity, all three baselines exhibit conspicuous off-manifold artefacts even before half of the pixels are masked:
INFD (third column) applies saliency-guit guided Gaussian blur. At moderate deletion ratios the foreground object dissolves into cow-frequency smear, but background textures remain the intended foeus "unimportant" regions.
18

---

Published as a conference paper at ICLR 2026
Original Inage
Hestmap
INFID
INSIDEL
Sc3.N
Ociginal Image
Hestmap
INFID
INSIDEL
Sen
10%
30%
50%
FUD
FUD
FUD
PUD
Oraginal Image
Ulestnap
INFID
IXS-DEL
Sem-N
Ocagieal Image
Elestnap
INFID
INSIDLL
Sen
30% 90%
FUD
FUD
FLD
Figure 4: Qualitative evolution of FUD. From left to right: original image, LA Zhu et al. 2024d) map, and FUD samples after deleting (100 p)% unimportant pixels and reconstructing the removed regions via score-based diffusion under the learned data distribution, rather than using any constant black/white filling. The apparent contrast changes therefore come from generative in- painting on the image manifold, not from hard occlusions as in INS/DEL or Sen-N. Rows correspond four rahoom validation images.
INS/DEL (fourth column) literally zeros the unimportant features, producing unnatural black cavities that trigger premature confidence drops and confound any perceptual judgement.
Sen-N (fifth columm) injects pixel-wise Gaussian noise; as deletion grows the image devolves into high-frequency snow, masking true object boundaries and violating the data-manifold assumption behind the classifier.
FUD yields natural transitional samples. The lower sub-row shows FUD results for five retained- feature ratios p 10%, 30%, 50%, 70%, 90%. Three qualitative patterns stand out:
1. Perceptual realism up to 50 %. When p 2 50% the generated evaluation images almost indistinguishable from the originals in both structure and colour palette. Crucially, no "floating" fragments or unnatural voids appear, confirming that FUD keeps the trajectory on the image manifold.
2. Smooth degradation beyond 50 %. As the mask ratio increases to 70 90 %, FUD removes the object a coarse-to-fimg fashion: salient boundaries blur first, then disappear into context-aware textures. The resulting images are still globally coherent-e.g, the beetle body in Example melts into surrounding earth tones, and the red deck-chair pattern in Example D fades without breaking symmetry.
3. No class-switch artefacts. Even in the extreme 90 % deletion case, FUD never hallucinates features suggestive of different ImageNet class. This visually supports the theoretical constraint in Eq. (7) that prevents samples from crossing class manifolds.
Implications for metric fidelity. Because FUD maintains high perceptual quality until more than half of the high-attribution pixels are removed, the resulting deletion curve (cf. Fig. 6, main paper) reflects true model reliance on the preserved features rather than spurious artefacts. Conversely, the rapid confidence collapse observed with INS/DEL or Sen-N be attributed to their off-manifold distortions rather than to the attribution map itself. Hence FUD provides a more faithful and interpretable evaluation of saliency methods.
19

---

Published as a conference paper at ICLR 2026
Table 7: FUD, Insertion, Deletion, Sensitivity-n, and INFID scores for 11 representative attribution methods. Higher is better for FUD, Insertion, and Sensitivity-n; lower is better for Deletion and
INFID.
Method
FUD
Insertion
Deletion
Sensitivity-n
INFID
SM
0.282534
0.314616
0.068716
0.141470
0.287042
IG
0.313328
0.344998
0.052537
0.126894
0.129003
FIG
0.208447
0.245956
0.069740
-0.130477
0.277800
BIG
0.354196
0,435646
0.084743
0.027358
0,019717
MFABA
0.276959
0.374439
0.118989
0.034741
0.019622
AuEXPlore
0,276253
0.468133
0.056584
0.010449
0.019581
GIG
0.309788
0.332303
0.047974
0.123184
0.113368
AGI
0.318770
0.443992
0.057337
0.013355
0.020138
ISA
0,232271
0.567845
0,101100
0.023021
0.019569
EG
0.274612
0.319021
0.076970
-0.007913
0.219567
LA
0,268251
0.520222
0.054138
0.019070
0.019574
G ADDITIONAL ANALYSIS OF WHAT FUD MEASURES
In this section we provide a more detailed discussion of what FUD actually measures and how affects the ranking of attribution methods.
By design, a higher FUD score indicates that, when we progressively remove the features ranked as "low importance" by attribution method, the model confidence decreases more slowly and more smoothly along the deletion path. Intuitively: (i) if an attribution method can accurately identify the truly important regions, then removing the features it considers unimportant should keep the model performance relatively high for longer portion of the deletion trajectory, and the corresponding FUD curve should exhibit a smoother and slower decay; (ii) therefore, a higher FUD score can be interpreted, under the constraint of staying in-distribution, as evidence that the method is more accurate at identifying genuinely important regions.
To make the effect of FUD on the ranking more transparent, we report in Table 7 the scores of 11 representative attribution methods under five evaluation metries: FUD, Insertion, Deletion, Sensitivity- and INFID. Here, higher values are better for FUD, Insertion, and Sensitivity-n, whereas lower values are better for Deletion and INFID. Gradient-path based methods such as BIG, AGI, IG and GIG achieve relatively higher FUD scores, whereas some methods that perform well under conventional Insertion/Deletee
metrics (for example, variants that rely on aggressive masking or boundary attacks) move down in the ranking under FUD. Combined with the Kendall's 7 analysis in Sec. 4.3.3 we observe that, under traditional INS/DEL evaluation, methods like IG and GIG can exhibit non-monotonic behaviour and even abnormal confidence increases, while under FUD their deletion curves become much smoother and closer to monotonic decay. This is consistent with the overall pattern in Table 7 FUD not only reorders existing attribution methods, but also clarifies which methods are more trustworthy when evaluated in-distribution and without relying on spurious evidence, thereby changing our empirical judgement about which family of attribution methods is more faithful.
H EXTENDED TABLE FOR TABLE 2
Compared to the Table 2 in the main text, we have added the results of AUPR-In here.
I ADDITIONAL EXPERIMENTS COMPARISON WITH PRIOR OOD-AWARE METHODS
In addition the experiments reported in the main paper, conducted supplementary evaluations to further validate the effectiveness of FUD against recent attribution evaluation protocols such as IDSDS (Hesse et al. 2024), ROAD (Rong al. 2022) Distill baselines (Sturmfels al. (020).
20

---

Published as a conference paper at ICLR 2026
Table 8: OOD detection performance for intermediate evaluation samples (higher values indicate casier detection as OOD). We report AUROC (higher means better OOD discrimination), FPRss (false positive rate 95% true positive rate), AUPR-In, and AUPR-Out for standard OOD detector distinguishing intermediate samples (OOD) from normal validation images (ID). Bold highlights the values indicating the most ID-like (hardest to detect) samples in each case. Note: In this context, AUROC, AUPR-In, and AUPR-Out values approaching 0.5 indicate maximal uncertainty in distinguishing between and OOD samples, thus reflecting increased in-distribution similarity and greater detection difficulty.
Model
Evaluation
AUROC
FP
AUPR-In 4
AUPR-Out +
INS/DEL
0.8974
0.3603
0.8948
0.8893
Sen-N
0.8773
0,5450
0.8579
0.8864
RESNET-50
INFID
0.7801
0.7720
0.7526
0.7876
FUD (Ours)
0.6863
0,8317
0.6660
0.6922
INS/DEL 0.8784
0.4761
0.8529
0.8894
Sen-N
0.8781
0.5660
0.8568
0.8734
VIT-B/16
INFID
0,8181
0.7390
0.7904
0.8119
FUD (Ours)
0.6450
0,9404
0,5827
0.6812
and Gevaert et al. (2024). The results reinforce that FUD consistently produces in-distribution, high- high-fidelity transitional samples and more faithful attribution evaluations.
I.1 PERCEPTUAL AND STRUCTURAL FIDELITY
Table 9 compares image quality metrics of transitional samples generated by different evaluation schemes. FUD achieves the best performance across nearly all metrics, indicating that its generated samples remain both perceptually and structurally closer to the natural data distribution.
Table 9: Additional perceptuull/strucuuaal fidelity results. Higher values are better for PSNR/SSIM/MS SSIM/FSIM/HaarPSI/NS lower is better for GMSD.
Evaluation
PSNR 1
SSIM f
MS-SSIM f
FSIM t
GMSD 4
HaarPSI 1
1
IDSDS Hesse et al. 2024
10.592
0.487
0.459
0.699
()322
0.263
0.866
ROAD Rong et al. 2022
18.169
0.385
0.783
0.728
0.159
0.594
0.868
Distill Sturmfels et al.
2020
16.273
0.385
0.631
0.683
0.227
0.465
0.853
Gevaer Gevaerl
2024
23.829
0.722
0.859
0.805
0.161
0.620
0.936
FUD (Ours)
25.200
0.750
0.780
0.860
0.124
0.663
0.946
1.2 OOD DETECTION ROBUSTNESS
Table I1 reports the ability of a standard OOD detector to distinguish transitional samples from true in- distribiitt (ID) data, Lower AUROC, AUPR-In, and AUPR- -ut, and higher FPR @95TPR indicate samples are harder to detect as OOD (i.e., closer to ID). FUD consistently yields the most ID-like samples across both ResNet-50 and ViT-B/16.
1.3 ADDITIONAL RUNTIME ANALYSIS OF DDIM SAMPLING
To complement the perturbation analysis in this appendix, we also report the wall-clock runtime of the DDIM sampler on ViT-B/16 for different numbers of diffusion steps. shown in Table TO the cost grows approximately linearly with the number of steps: increasing from 10 to 100 steps raises the per-image runtime from about 0.40 s to 4.04 s. Importantly, these timings correspond to the end-to-end evaluation of single image-attributin pair at the given step count, i.e., they already include the full FOIM-based perturbation process along the deletion trajectory. In our experiments use 100 steps obtain stable in- distribution samples, but smaller step counts (e.g., 40-60) already keep the overhead within a few seconds per image, indicating that FUD remains computationally manageable for attribution evaluation.
21

---

Published as a conference paper at ICLR 2026
Table 10: Runtime of the DDIM sampler with different numbers of diffusion steps ViT-B/16. The numbers report average wall-clock time per image (batch size 1), including the time to apply all corresponding perturbation steps.
DDIM steps
10
20
30
40
50
60
70
80
90
100
Time (s)
0.395
0.804
1.210
1.620
2.010
2,430
2.820
3.225
3.615
4.041
Table 11: Additional OOD detection results of intermediate samples.
Model
Evaluation
AUROC FPR@95TPR
AUPR-In + AUPR-Out 1
IDSDS Hesse et al.
(2024
0,8016
0,5653
0.7907
0.7965
ROAD
Kong et al 2022
0.7123
0,8226
0,6838
0.7210
ResNet-50
Distill Strmfels cl Bl. 2020
0.8226
0.5837
0.8107
0.8178
Gevaert Gevaert
2024
0.7690
0.6552
0.7585
0.7603
FUD (Ours)
0.6863
0.8317
0.6660
0.6922
IDSDS Hesse et al. (2024
0.8329
0,5803
0.8059
0.8358
ROAD Rong el al. 2022
0,7584
0,8000
0.7209
0,7505
VIT-B/16
Distill Sturneels el al. 2020
0,8174
0.6795
0.7828
0.8255
Gevaerl Gevaert el al. 2024
0,6675
0,9024
0.6201
0.7013
FUD (Ours)
0.6450
0.9404
0.5827
0.6812
J L2 DISTANCE BETWEEN PERTURBED AND ORIGINAL IMAGES
To quantify how strongly diffusion belfusiio--baeed perturbation modifies the input, measure the pixel-wise 1 distance between the perturbed images and the original image x.
First, for fixed mask ratio of 10%, track the distance between the intermediate denoised samples It and the original image & over the diffusion steps. As shown in Fig. 5 the mean [2 x) starts around 80 the initial noisy state and decreases smoothly and monotonically the diffusion proceeds, reaching values below 5 after 100 denoising steps. The shaded band indicates one standard deviation across the evaluation driving the samples back toward the data manifold, instead of introducing additional distortion.
This confirms that the optimisation gradually reduces the perturbation while
Second, measure the final distance between the reconstructed image zo and the original image for different mask ratios. Figure reports the mean (2 x) as a function of the mask ratio. The distance grows approximately monotonically with the amount of masked area: it remains small for mask ratios around 10- 10-30%, becomes moderate for 40 40-60%, and only becomes large when 70-90% of the image is removed. This shows that in the mask regimes typically used for attribution evaluation, our method perturbs the image relatively mildly, and stronger deviations occur only when substantial portion of the content is intentionally removed.
K ADDITIONAL ANALYSIS OF PERTURBATION MAGNITUDE
NOTATION SUMMARY FOR FUD
For clarity, summarise the main symbols used in Section 3.3 (Faithfulness Under the Distribution) Table [2 All symbols follow the notation used in the main text.
22

---

Published as a conference paper at ICLR 2026
Timestep 10%)
Rean 12 cistance
L2 Distance to Ohiginal
60
Denoising
Figure 5: (1 ..) function of the denoising step for a fixed mask ratio of 10%. The solid curve shows the mean distance across images; the shaded region indicates +1 standard deviation.
L2(x final, x) vs Mask Ratio mtabaa smooth vit b 16 quidance=2.0
Mean L2(x_ finel, xi
L.2 Distance
000
Mask Ratio (%)
Figure 6: Final (x x) after diffussoo as function of the mask ratio. We report the mean distance across images, with shaded band for +1 standard deviation.
Original
Mart (hoise)
Middle
Rrol
Figure 7: Qualitative "Original-Start -iidle)-Mid visualisation of the FUD denoising trajectory. From left to right: the original image æ, the noisy masked starting point 2r, an intermediate denoising state I₁, and the final in-distribution sample 2g- The final image remains visually close to the original while the masked region is restored using the diffusion prior.
23

---

Published as a conference paper at ICLR 2026
Table 12: Summary of notation used in the definition and derivation FUD.
Symbol
Description
Original input image.
5
Masked image constructed from xr using the deletion mask M (e.g., 5 = M @ 2 ()] o.)). Intermediate sample at diffusion step / in the DDIM sampling process.
24
Final in in-distribution evaluation sample used for the deletion trajectory (Algorithm I oulput).
Class lahel predicted by the classifier.
f
Classifier under evaluation (e.g.. ViT-B/16).
Binary deletion mask (1 preserve pixel, 0 = mask pixel).
A(x)
Attribution (saliency) map for input x used to construct the deletion masks. Predictive distribution the classifier state xf.
P(y x9)
P(y 2x)
Auxiliary distribution with gradient F Pyy =V a²).
Event encoding "no additional class-y evidence" (used in Eq. (1)). Target conditional distribution that FUD aims upproximate.
P(al a, M)
P(aa)
Unconditional image prior at step approximated by the score network sa(z)).
P(G M)
Likelihood term enforcing consistency with the observed (unmasked) pixels.
P(= ((=
Term encoding the "no new evidence for class y" constraint.
sa(x")
Learned score network upproximating V. log P(x") (used in Eq. 6
8o(a,e,
Score function of the DDIM sampler used in Algorithm Total number of DDIM sampling steps.
T
O
Out-of- oitto--distribution threshold on the diffussin time axis. Cumulative noise-schie scheuucc coefficient at diffusion step f.
&
AUD(S.A)
FUD score classifier under attribution map A.
24


Reviews:
[{"review_id": "XmZZxFiZP5", "reviewer": "Reviewer_DTUU", "summary": "The paper introduces FUD, a new evaluation framework for attribution methods (xAI)  that uses score-based diffusion to generate in-distribution masked samples.", "questions": "- Please refer to the weaknesses section. \n\n- Additionally, it would be helpful to provide an experiment on non-visual data, for example, on tabular data.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- Strong results on multiple benchmarks\n- Thorough method explanation and justification\n- Good reproducibility, clear pseudocode + released configs/code", "weaknesses": "- Hard to follow. Related Work and key visual examples are in the appendix; in my opinion, they should be in the main paper. Also, I believe Tables 8 and 9 are very valuable for readers.\n\n- Wording like “universally” is too strong (`Line 097`). The heuristic issues are already known and not universal across all AEMs. \n\n- Figure 4: At a glance, FUD’s results look similar to simple black/white occlusions -> the very issue the paper critiques (main motivation e.g. OOD samples)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "In8xhkuifV", "reviewer": "Reviewer_PgAe", "summary": "Current methods for removing input feature contribution for measuring attribution method faithfulness do not truly remove input feature contributions. The authors introduce a new attribution measuring metric: Faithfulness Under the Distribution (FUD). FUD follows other metrics by inserting/deleting some number of pixels. However, instead of just blacking out the removed pixels, FUD uses a diffusion model to generate the image gradients, which are then used to determine the pixel values for the masked region. The FUD process also ensures that the generated pixels stay within the original data distribution of the non-perturbed image, keeping the image functionally the same for the next metric step. The authors provide comparisons against other metrics in terms of the intermediate images generated and some qualitative results.", "questions": "- Can the authors provide any instances in which the metric performs worse than other metrics, or any kind of failure case analysis? Relying on a diffusion models seems like it should cause problems somewhere, even if it is in some small corner cases.\n- How are pixels chosen for their inclusion in the image mask? Is it the same way as insertion/deletion?\n- Could the authors re-explain the necessity of the inclusion of z? Is it to ensure that when gradient steps are taken, the steps are updating the masked region in such a way that the new pixels are aligned with the unmasked pixel class while not adding new features? But how does this ensure that new features are not added? \n- What is the relation of equation 2 to s_{theta}(x^t)? Is there any relation? Or is it used during the z \"event\"?\n- In plain terms, can the authors explain the transition between x^t --> x^{t+1}? I am able to follow the the very high level idea of what is trying to be accomplished but some of the specifics of equations 1 and 2 are lost on me. \n- Is P(x) the one-hot encoded ground truth label for some image? Is \\theta^* the parameters for the diffusion model in use? Are the gradients being referred to the image gradients or model gradients? How is equation 2 being used?\n\nFinal Review:\nThe paper proposes a very interesting solution to the issue of assessing attribution performance. I am able to follow at a high level what is trying to be accomplished, but the exact math is lost on me, hence the (2/5) confidence rating. Given this state, I rate the paper a (6/10). Based on my understanding of the high-level idea, I think it should be accepted, but I am not confident enough in my understanding of the math to rate it higher.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "- Originality: The authors use part of a previous approach for the metric, but significantly build off of it. (3/4)\n- Quality / Clarity: Paper presentation is high quality. The motivation and experiments are easy to follow, but the methodology is not. (3/4)\n- Significance: The authors have come up with a method for measuring attribution methods without introducing a significant amount of noise. (4/4)\n\nOther Notes:\n- Very strong introduction and motivation. Easy to follow and understand why/where the problems exist. \n- Framing the issue as an in-/out-of-distribution problem is particularly clever\n- The approach tries to steer the masked regions towards an alignment with the unmasked regions, thereby mitigating negative effects of masking, which is a novel issue that has not been explored\n- The experimental evaluation suite is wide", "weaknesses": "- There must be a significant runtime for these evaluations because diffusion models are computationally expensive. However, attributions are scored offline, so it is not a significant issue.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uFjCsZqikS", "reviewer": "Reviewer_hCbT", "summary": "This paper proposes a solution to the longstanding baseline selection problem which exists with input perturbation-based attribution evaluation metrics. They propose to fix the two side effects of: OOD inputs and failed feature removal by performing a deletion metric that employs a score-based diffusion model to produce ID inputs that ensure feature removal. The result is an improved quantitative evaluation of attributions.", "questions": "Why was previous work which employed infilling or diffusion for attribution methods ignored? \n\nOtherwise, please see the weaknesses.  \n\nMy rating could be improved to an 8 if this question and the weaknesses are properly addressed. I have major concerns about the lack of references to relevant work, but I think the authors could clear this up with a proper reply and reasoning for the omission.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "They highlight a clear and pervasive issue that has yet to be solved in the attribution field. This is not the first method to attempt to solve this problem with generative model infilling [1, 2], but it is the first metric to employ this operation, and it adds new layers of theory, which appears to improve its solution. \n\nThe two tasks of the diffusion process: staying in distribution and not producing class-relevant features is a strong formulation. I have not seen the former issue addressed before.  \n\nThis is a strong alternative to approaches that aim to solve OOD by training the model on ablated inputs.  \n\n[1] Explaining Image Classifiers by Counterfactual Generation \n\n[2] Explaining image classifiers by removing input features using generative models", "weaknesses": "Crucial references missing [1, 2]. They do not acknowledge that this is a process that has been used heavily in perturbation methods. Metrics are different, and their use is better motivated and better backed, but these papers must be mentioned and addressed.  \n\nThe computational overhead of FUD is surely significant. Not just the original training of the diffusion model on the dataset, but the employment of diffusion model inference at 11 perturbation steps for any evaluated attribution/image pair. Evaluation is not a run-time activity, so this is okay, but I would’ve liked to see an evaluation to understand the significance of the runtime penalty. \n\nIt is hard to tell the impact of this metric past the theoretical improvements that it shows. It does surely improve the baseline selection problem, but how does doing so actually change what we know about the best attribution methods? It would have been nice to see if there are improvements in metric IRR or ICR [3] or in the rankings of current SOTA attributions.  \n\nSection 2.3 is challenging to read to the extent that it takes away from the paper. While the notation appears correct, the formatting of the section leads to many things blending together and it becomes overly complicated to interpret. It would be good to separate intuition from derivation in this section to improve readability, accessibility, and reproducibility.  \n\n[3] Sanity checks for saliency metrics", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DxkNjd2wa3", "reviewer": "Reviewer_1BFX", "summary": "This paper identifies a key limitation in evaluating attribution quality, which is the reliance on a baseline image in perturbation-based tests. Such tests modify the input image and measure the model’s response to infer the importance of different features. However, the choice of baseline image critically affects the results. Prior studies have shown that commonly used baselines, such as white, random, or black images, are often out-of-distribution (OOD) with respect to the evaluated model. As a result, the attribution quality becomes dependent on the model’s behavior under OOD conditions, which is not a meaningful measure. To address this issue, the paper introduces an optimization framework that formulates OOD deviation as a loss and adjusts the baseline to be in-distribution while ensuring that the inserted pixels do not encode features from other classes.", "questions": "1) How should we formally measure the quality of a perturbed image? What is the justification for this metric.\n2) It's not clear how much the perturbation method modifies the image to make it in distribution. Can we measure the L2 norm or other relevant metric? What is the starting point for the optimization process?\n3) IG defines conditions that a baseline image should satisfy. This method breaks there conditions. Does that make the axioms of IG invalid?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1) The paper describes and addresses important problems for the evaluation of attribution methods. \n2)  The algorithm and evaluation shows that the perturbed images are in-distribution.", "weaknesses": "1) The 2.3 Section is not well structured. It’s several paragraphs of text and heavy math with no clear organization describing the overall approach. \n    2) Previous work select a baseline image I and replace perturbed pixels from the baseline image. This work introduces an algorithm A that generates the perturbed pixels. Both methods introduce a dependence on the “score” on I or A. The paper should formally define what properties of a modified image are desirable upfront. In-distribution seems to be one such property. However, the visual similarity that is used in the evaluation seems to be presented rather ad-hoc. Are there other properties? \n   3) Overall, it would be good to state upfront what is the metric that is being optimized and why. This could help provide some structure to the FUD methodology section. \n  4) How does the proposed methods impact the very popular insertion/deletion scores? No such results are reported. \n\nMinor:\n   1) Why 198 runs? Typically, we select even numbers like 100,200, or 500.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)