Pixel-level Certified Explanations via Randomized Smoothing
Authors: Alaa Anani
Tobias Lorenz
Mario Fritz
Bernt Schiele
Venue: ICML 2025 poster (2025)
Keywords: explainability robustness
robustness certification
explainability
certification
robustness
certified attributions
Primary area: deep_learning->robustness
TL;DR: We propose a pixel-level certification framework for any black-box attribution method using Randomized Smoothing, ensuring robustness against  $\ell_2$-bounded noise with new robustness and localization metrics

Abstract: Post-hoc attribution methods aim to explain deep learning predictions by highlighting influential input pixels. However, these explanations are highly non-robust: small, imperceptible input perturbations can drastically alter the attribution map while maintaining the same prediction. This vulnerability undermines their trustworthiness and calls for rigorous robustness guarantees of pixel-level attribution scores. We introduce the first certification framework that guarantees pixel-level robustness for any black-box attribution method using randomized smoothing. By sparsifying and smoothing attribution maps, we reformulate the task as a segmentation problem and certify each pixel's importance against $\ell_2$-bounded perturbations. We further propose three evaluation metrics to assess certified robustness, localization, and faithfulness. An extensive evaluation of 12 attribution methods across 5 ImageNet models shows that our certified attributions are robust, interpretable, and faithful, enabling reliable use in downstream tasks. Our code is at [https://github.com/AlaaAnani/certified-attributions](https://github.com/AlaaAnani/certified-attributions).

Pixel-level Certified Explanations via Randomized Smoothing
Alaa Anani Tobias Lorenz? 2 Mario Fritz
Bernt Schiele
Abstract
Certifiably robust top K% pixels under input perturbations (c)
Post-hoc attribution methods aim explain deep learning predictions by highlighting influential input pixels. However, these explanations are highly non-robust: small, imperceptible input per- turbations can drastically alter the attribution map while maintaining the same prediction. This vul- nerability undermines their trustworthiness and calls for rigorous robustness guarantees of pixel- level attribution scores. We introduce the first cer- tification framework that guarantees pixel-level robustness for any black-box attribution method using randomized smoothing. By sparsifying and smoothing attribution maps, we reformu- late the task segmentation problem and tify each pixel's importance against fz-bounded perturbations. We further propose three evalu- ation metries to assess certified robustness, lo- calization, and faithfulness. An extensive eval- uation of 12 attribution methods across 5 Ima- geNet models shows that our certified attribu- tions are robust, interpretable, and faithful, en- abling reliable use in downstream tasks. Our code is at https: //gthub. com/ Al AlaaAnani/ certifled-attributiii
Input
Noisy samples h(x + E), E E~ o²1)
Original Attribution h(x) (a)
(b)
LRP
GradCam RISE
Top
30%
20%
10%
5%
Figure 1: Pixel-level certified explanations via random- ized smoothing. (a) The original attribution hxx) lacks robustness guarantees and changes under small input per- turbations. (b) We sample noisy attributions h(x + <). and (c) certify which pixels robustly remain in the top-K%. Colored pixels show certifiably robust top K pixels across different attribution methods (LRP, RISE, Grad-CAM).
1. Introduction
Computer vision models are highly successful in high-stakes applications, such as autonomous driving (Kaymak Uçar, 2019; Zhang et al., 2016), medical imaging (Kayalibay et al., 2017; Guo et al., 2019), and the judicial system (Nissan, 2017). In such domains, understanding the reasoning be- hind model predictions through explainability methods is paramount. Post-hoc attribution methods identify image pixels most influential for a model's 's prediction. However, attribution methods are highly non-robust: even impercep-
tible input perturbations can significantly alter attribution maps while leaving predictions unchanged (Ghorbani et al., 2019; Kindermans al., 2019; Dombrowski et al., 2019; Subramanya et al., 2019; Kuppa & Le-Khac, 2020: Zhang et al., 2020). This vulnerability undermines trust in attri- bution methods, especially when explanations directly in- fluence critical decisions (Sheu & Pardeshi, 2022; et al., 2023). Consequently, pixel-level certification methods that rigorously guarantee the robustness of each pixel's impor- tance value under input perturbations become crucial for trustworthy model explanations.
'Max Planck Institute for Informatics. Saarland Informatics Campus, Saarbrücken, Germany *CISPA Helmhotz Center for Information Security, Saarbrücken, Germany, Correspondence to: Alaa Anani <aanani mpi-inf. de?.
Previous work addresses attribution robustness through cer- tifying bounds for image-level metrics with respect to input perturbations - typically measuring the similarity of attri-
Proceedings of the nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Pixel-level Certified Explanations via Randomized Smoothing
butions between perturbed and clean inputs (Wang & Kong, 2023; 2024; Dhurandhar et al., 2024; Levine et al., 2019; Liu et al., 2022; Chen et al., 2022). However, image-level bounds are too coarse, as they (i) fail to capture pixel-level robustness, (ii) lack visual interpretability as they only pro- duce a single number, and (iii) can be disproportionately affected by a small non-robust subset of pixels.
faithfulness (Section 5), (iii) We create the first certified attribution maps that can be used in downstream tasks (Sec- tions 7.1), (iv) We analyze trade-offs across robustness, localization, and faithfulness of 12 attribution methods on 5 ImageNet models, including CNNs and transformers, show- ing that LRP and RISE strike the best balance, offering actionable insights into trustworhty and reliable attribution (Sections 7.2, 7.3, 7.4, 7.5).
We address this challenge and introduce the first certifica- tion method that guarantees pixel-level robustness for any black-box attribution method, producing fine-grained, inter- pretable certified attributions. Our key insight is to reframe attribution as a segmentation task by sparsifying the contin- uous attribution maps into binary pixel-importance classes: "1" for the top K% most important pixels and "0" for the rest, This defines a sparsified attribution function, whose output we certify using Randomized Smoothing (Fischer et al., 2021; Anani et al., 2024), framework that certifies high-dimensional outputs of segmentation models against 22-nrrm input perturbations. Each pixel is certified as ei- ther robustly important ("11", robustly unimportant ("O"), or abstaining (" ("2²") if no guarantee can be given. Figure shows an example of certified attributions for three attribu- tion methods at different sparsification levels K.
2. Related Work
Machine learning explainability Post-hoc attribution meth- ods produce maps that show which pixels in an input image are important to a classifier's output. Attribution meth- ods fall into three categories: (i) backpropagation-basst which typically use gradients with respect to the input (Si- monyan, 2014; Springenberg et al., 2014; Sundararajan et al., 2017; Shrikumar et al., 2017), (ii) activation-based which weigh activation maps to determine the importance of pixels in relation to the network's 's final layer (Selvaraju et al., 2017: Chattopadhay et al., 2018; Ramaswamy et al., 2020; Jiang al., 2021), and (iii) perturbation- turb the input differently (e.g. via occlusions or masking) to observe changes in the network output (Dabkowski & Gal, 2017; Fong & Vedaldi, 2017; Petsiuk et al., 2018h Ribeiro et al., 2016; Zeiler, 2014).
which per-
Leveraging our certification framework, we comprehen- sively compare 12 different attribution methods spanning setivation-based and perturbation- based methods on 5 different ImageNet classifiers, including CNNs (e.g.. ResNet-152) and transformer (ViT-B/16) archi- tectures. Leveraging our pixel-wise certificates, we create the first certified attribution maps, highlighting image pix- els that are robustly influential for predictions (Figures to 4). For quantitative evaluations, we propose three metrics that measure desirable properties of certified attributions: (i) the percentage of certified pixels ( (%ocerifieed), measur- ing the attribution method's robustness, (ii) Certified Grid Pointing Game (Certified GridPG), an extension of GridPG (Bohle et al., 2021) that measures robust localization by computing the percentage of correctly localized and certi- fied attributions, and (iii) -based faithfulness score that measures the confidence drop when progressively re- moving the pixels with top K% certified attributions. Our experiments show significant differences between methods in all four dimensions. with LRP and RISE demonstrating the best trade-off's between certified robustness, localization, faithfulness, and meaningful visual attributions.
backpropagation-basee
Gradient (Grad) (Simonyan, 2014), one of the earliest backpropagation- methods, generates saliency maps by computing input gradients. Guided Backpropagation (GB) (Springenberg et al., 2014) refines this by retaining only positive gradients, while Integrated Gradients (IntGrad) (Sundararajan et al., 2017) accumulates gradients along a path from a reference baseline to reduce gradient noise. In- put x Gradient (IxG) (Shrikumar et al., 2017) multiplies the input with its gradient to highlight pixel importance. Layer- wise Relevance Propagation (LRP) (Bach et al., 2015), in contrast, redistributes the network's ' output relevance back- ward through the layers using set of propagation rules, ensuring conservation of relevance while highlighting fea- tures that contribute most to the model's 's decision.
Among activation-basee methods, Class Activation Map- ping (CAM) (Zhou et al., 2016) projects class-specific weights onto the final convolutional feature maps to pro- duce coarse localization. Grad-CAM (Selvaraju et al., 2017) uses gradients and feature maps for coarse class- discriminative localization, while Grad-CAM++ (Chattopad- hay et al., 2018) extends it for finer details. Ablation-CAM, (Ramaswamy et al., 2020) removes neurons to assess their impact on the input, and Layer-CAM (Jiang et al., 2021) uses intermediate layers for multi-depth localization.
Contributions To summarize, our contributions are: (i) We introduce the first pixel-level certification framework for any black-box attribution method, providing rigorous robustness guarantees under bo-nodde perturbations (Sec- tion 4), (ii) We present three certified evaluation metries: %certified to assess robustness, Certified GridPG for ro- bust localization, and deletion-based score for evaluating
Occlusion (Zeiler & Fergus, 2014) slides a mask over the in- put, measuring output changes to identify important regions.
2

---

Pixel-level Certified Explanations via Randomized Smoothing
RISE (Petsiuk et al., 201 8b) applies random masks, evalu- ates output changes, and aggregates them into weighted saliency map.
vacy. They also generalize the concept from &y norm per- turbation models to general fy-norm radii using generalized normal distributions, Expanding on top-k score, Chen et al. (2022) prove bounds on the ranking stability (thickness) of the top-k predictions.
In our experiments, we certify all 12 previously discussed attribution methods which span all three categories.
Other methods consider bounds to the local Lipschitz con- stant (Tan & Tian, 2023) or ep-norms (Wang & Kong, 2023; 2024) as robustness metrics. Lin al. (2024) show an upper bound the distance between perturbed and unperturbed removal-based attribution methods, and Dhurandhar et al. (2024) invert the typical certification process and grow ro- bust attribution regions in the input space that maintain a certain level of fidelity.
Robustness issues common problem of attribution meth- ods is that they are not robust small changes in the in- put. Many attack vectors exist, including adversarial inputs, model manipulations, backdoor attacks, and data poison- ing (Baniecki & Biecek, 2024). In this work, we focus on small, imperceptible changes to the input that change the explanation while the model prediction remains unaffected. That is, for model f. attribution method hy, and input J, fxx = f(x') but (x))) * hx()'). It has long line of work (Ghorbani et al., 2019; Kindermans et al., 2019; Dombrowski et al., 2019; Subramanya al., 2019; Kuppa & Le-Khac, 2020; Zhang et al., 2020) and is the element that is most likely influenced by perturbations.
We propose a novel approach to certify attribution robust- ness at the pixel level, producing high-quality visual cer- tificates. Unlike prior work focused on non-interpretable image-level bounds, this is, to our knowledge, the first to offer pixel-level certification.
Several empirical defenses exist to make models and expla- nations more robust against input perturbations. A promi- nent line of work (Chen et al., 2019; Wang et al., 2020; Dom- browski et al., 2022; Tang al., 2022) uses regularization techniques to improve attribution robustness of gradient- based attribution methods. For model agnostic approaches such as SHAP and LIME, there is work on making the sampling more robust (Ghalebikesabi et al., 2021; Shrotri et al., 2022; Vreš
3. Preliminaries: Randomized Smoothing
This section introduces Randomized Smoothing for classifi- cation and segmentation, which is an essential background for our work. One key insight into our method is that we view attribution methods for classifiers as segmentation task, which allows us to certify their pixel-wise robustness.
-Snnik-S 2024). A different ap- proach is to detect perturbed inputs using anomaly detection (Carmichael & Scheirer, 2023).
3.1. Classification
The core idea of Randomized Smoothing (Lecuyer et al., 2019; Cohen et al., 2019) is to transform any black-box classifier f into a smoothed version g by adding isotropic Gaussian noise to the input x::
In our work, we address the vulnerability of attribution out- puts to small, imperceptible noise by providing guarantees that bo-boudde perturbations within a certified radius will not alter the certified attribution map.
g(x) == arg max dEY
(I)
Certified explanations While these defenses can empiri- cally improve the robustness of certain explanations, they lack theoretical guarantees. Recognizing the importance of such guarantees, recent work has started to explore certi- fiably robust attributions. They typically use randomized smoothing to derive bounds on a per-image similarity score between perturbed and non- non-perturbed attributions.
where / : RR + Y.g- g R" - y, and e ~ N'0, I²1). The smoothed model g therefore returns the class that f predicts with the highest probability. Cohen et al. (2019) show that this prediction is robust (i.e., predicts the same class) for all inputs within an fa-radius around the input x:
g(x) = g( + 5), vo Tm 160 12 S R.
(2)
The first work to consider such guarantees by Levine al. (2019) defines a top-k score that measures the percentage of intersection between the k largest Sparsified SmoothGrad attributions of the base and the perturbed image. Sparsified SmoothGrad is defined as the expected value of sparsified Grad with added noise to the input. The authors compute a certified lower bound this top-k similarity under bounded perturbations using Randomized Smoothing (Cohen al., 2019; Lecuyer et al., 2019; Anani al., 2024). Liu al. (2022) propose a tighter bound using Rèni differential pri-
where the radius R = (Φ (pA) - + -- (pE)). T --1 de- notes the inverse cumulative distribution function (CDF) of the standard Gaussian. R depends on the noise level a and the difference between the lower bound of the top class PA and upper bound of the runner-up class pr probabilities.
Since g(x) cannot be computed directly for general black- box functions f. Cohen et al. (2019) approximate it through Monte-Cane sampling. Drawing n i.id samples from N(0 d2T), g(ar) is approximated with confidence - a,
3

---

Pixel-level Certified Explanations via Randomized Smoothing
where a E [0, 1) is preset hyper-parameter that bounds the type I error probability.
sion of the sparsified attribution function (Section 4.2). This transformation allows to view the smoothed sparsified at- tribution as smoothed segmentation function (Section 4.3), enabling direct application of Theorem 3.1 for pixel-wise certification of the attribution output.
3.2. Segmentation
Fischer et al. (2021) extend Randomized Smoothing to seg- mentation models f R=*N + y'V with N output com- ponents (one prediction per pixel). The method strictly cer- tifies stable components while abstaining from non-robust ones. To this end, the authors define a threshold for the top class probability T E [0.5, 1) and abstain for all components whose top class probability is below т. The smooth model g" : N VNN is defined as:
4.1. Sparsification
Sparsifying attribution outputs has been shown to improve their certifiable robustness (Liu et al., 2022). While sparsifi- cation does not reflect the absolute values of attributions, it suggests that relative ranks of attribution values are impor- tant for interpretation. We therefore operate on sparsified attribution functions, which (i) allows to get theoretical guarantees on its outputs through Randomized Smoothing for segmentation, while (ii) producing high-quality certified attribution maps (Section 7.1).
CA. if if
>T,
g (x)
Ø
otherwise,
(3)
where CA. = arg max P. (e-.(1..2))((((( c) and " = yu {2) is the set of class labels combined with the abstain label. For all 97 (x) # Ø i.e., all pixels for which the method does not abstain, we get a guarantee that they are robust in an Eg ball around the input x:
Given an attribution function h : Rxx + RN which maps an image æ E RexN with N pixels (c = 3 for RGB) to N attribution real values, we define the sparsified version of this function h,K R + {1, 0} It is parameterized by K E [50, 100), indicating that the top K% of values are mapped to 1 and the rest to 0:
Theorem 3.1 (from (Fischer et al., 2021)). LeI = {il of (c) A 0 E E, I,..., N be the set of certified component indices in x. Then, for a perturbation 8 RmxN with ||01| < R === =0 (T) all E Izi gi (8) = (x)).
{
1 if (m)) N
S
K
h (z)
100
(4)
otherwise
where rank(h, (x)) returns the descending order of the i-th pixel (e.g., 0 for largest, N - for smallest).
4. Pixel-Certified Attributions
Motivation Attribution methods assign a real-valued score to each pixel, indicating its relevance to the classi- fier's prediction. Our goal is to certify the robustness of these pixel-level attributions - showing that for any attri- bution method, given an input image, pixels classified as "important" or "not important" robustly remain the same for an & ball around the input. While prior work provides image-level bounds on similarity between perturbed and unperturbed attributions (Wang& & Kong, 2023; 2024; Dhu- randhar et al., 2024; Levine al., 2019; Liu et al., 2022; Chen et al., 2022), no method certifies individual pixels in attribution maps. This gap likely stems from the challenge of certifying high-dimensional outputs. However, certifying a nigh-dimenssione output was addressed by Fischer et al. (2021) via Randomized Smoothing for segmentation func- tions (Section 3.2). We thus aim adapt attribution methods to such framework to certify their outputs pixel-wise.
4.2. Smoothed Sparsified Attributions
To certify the output of the sparsified attribution function 1.K in Eq. 4, we view it as a segmentation function that generates a segmentation map, assigning a class to each pixel. Specifically, h classifies every pixel into two classes: "important" or "not important". We use Randomized Smoothing for segmentation as outlined in Section 3.2 to construct a smoothed version of base sparsified attribution (segmentation) function. This function then provides per- pixel certified classes with robustness guarantees.
Specifically, given a sparsified attribution function K and Gaussian noise e ~ _N(0, o²T), the smoothed sparsified at- tribution function hT.k _ + {1, 0, @ parametrized by and the sparsification parameter K, is defined as:
!
(4 (a + +c)= > if PTP-
1,.h((0 (x)
if P (h (I = =0) >
Our approach To achieve pixel-level certification of at- tribution methods, we reformulate the base attribution task as segmentation problem, where each pixel is classified as either "important" or "not important". We achieve this by (i) sparsifying (i.c., binarizing) the output of the attribution function (Section 4. and (ii) constructing a smoothed ver-
otherwise.
(5)
which returns the certified class 1 or 0 for the i-th pixel if the class probability is higher than the threshold 5 E [0.5. 1), otherwise, abstains. A pixel certified as "1" means that
4

---

Pixel-level Certified Explanations via Randomized Smoothing
it remains in the top K% of values across all perturbed attributions with a high probability, while "0" means that it remains in the bottom (100-K)% For all non-abstain indices in the smoothed sparsified attribution function h output, h5 (x) A Ø the certified class remains the same within an &g ball around the input x, as stated in Theorem 3.1.
grid of images in which every class occurs most once. GridPG then measures the ratio of the positive attributions assigned to subimage within the grid to the rest of the grid. refer to the positive attribution for the p-th pixel in the grid. Then, the localization score for a subimage T;;
Let A+(p) (p)
Σ DEER. At()) Σド E At)))
The certified radius R. := σ (T) from Theorem 3.1 of the smoothed sparsified attribution function is high when (i) the noise level is high, but it comes at the cost of degraded performance in the base model, and (ii) the top class probability т is high, as it is a more strict condition to certify the top class. We analyze the impact of varying the certified radius in Sections 7.2, 7.3 and App. B, qualitatively in App. E. and G, and the effect of r in App. C.
L
This score is maximized when all positive attributions are fully localized within a subimage, yielding a score of L; = 1, and minimized when no positive attributions are located within the subimage I,, =
Instead of using positive attributions, we reformulate this metrie to find the ratio of pixels certified as "1" (i.e., to be in the top K% of the grid) within the subimage to the whole grid. Let (p) be a binary function that only returns I for pixels certified as top K%. Then, the certified localization score for a subimage Ty is:
4.3. Estimating the smoothed sparsified attribution
Evaluating the output of the sparsified smoothed attribu- tion h in Eq. requires sampling from the sparsified attribution h Eq. 4 as it is evaluated on data distribu- tion X = \xx,, 0²T) around instead of single point r. By design, the smoothed sparsified attribution h is mathematically equivalent to the smoothed segmentation model g" in Eq. 3. We thus employ the same Monte-Carlo sampling used for smoothed segmentation to compute the certified attribution output (Fischer et al., 2021).
cli EpEn, A((p)
(8)
Σ3 m2 EpEz, Ap)p)
Both metrics are certified, which means their values remain the same within an &g ball around the input bounded by the certified radius.
5. Robustness Evaluation Metrics
Faithfulness Beyond robustness and localization, we also assess whether certified attributions truly highlight class- relevant evidence. Inspired by deletion metries used in prior work on explanation evaluation (Fong & Vedaldi, 2017: Per- siuk et al., 2018a), we define a deletion- faithfulness score for certified attributions. For given image and its certified attribution maps at sparsification levels K, we iter- atively remove (e.g., set to zero) the pixels that are certified as "1" - starting with the most important (lowest K) - and record the model's confidence in the original class after each removal step. A steep confidence drop after deleting a small fraction of certified pixels indicates that those pixels were indeed crucial to the prediction, signaling high faithfulness.
To evaluate the certified robustness, localization, and faith- fulness of attribution methods, we introduce three quantita- tive metrics.
Certified In our pixel-level certification setup, a pixel in the output is either certified or abstained from. Abstentions occur when the assigned class for the pixel fluctuates in noise during sampling, indicating that the pixel does not consistently belong to the top K% or bottom (100-K)% of perturbed attributions. Therefore, we use &certified as a robustness metric, which is the ratio of certified pixels to all pixels. Given an image x E RexN, &certified is defined as:
(certified(()) [ii| 17.KK N
(x) + H
(6)
6. Experimental Setup
This score is maximized when all pixels are certified (#hcertified())) = 1) and minimized when all pixels are abstained from (fécertifie(z)) 0).
Dataset and Architecture We use the ImageNet (Rus- sakovsky et al., 2015) dataset and 5 classification models: ResNet-18 (He et al., 2016), Wide ResNet-50-2 (Zagoruyko & Komodakis, 2016), ResNet-152 (He et al., 2016), VGG-11 (Karen, 2015), and ViT-B/16 (Dosovitskiy al., 2020). Im- plementation details for extending attributions from CNNs to transformers (c.g., ViT-B/16) are in App. A.2. We se- lect images that were classified with a high confidence by ResNet- 18 and VGG-11, ensuring the top K pixels con- stitute positive evidence for the correct class. Due to the
Since there is no ground truth to the attribution methods, several metrics have been proposed to evaluate them. Localization metrics measure how well the attribution method localizes class minss-iicrrimnative features. For the Grid Pointing Game (GridPG) (Bohle et al., 2021), the attribution methods are evaluated on a synthetic m x m
Certified GridPG
5

---

Pixel-level Certified Explanations via Randomized Smoothing
computational cost of sampling during certification, ran- domly select 100 images from the validation set, which we compute all results. The image dimension is 224 x 224.
Input
Certified
SS
K=50%
K=25%
K=5%
Overlayed
Evaluation on Certified GridPG We create 2 x 2 grids of images from distinct classes, sampled from the confidence- filtered validation set. For each attribution method, we generate 100 such grids compute GridPG and Certified GridPG scores. Each grid has resolution of 448 448.
Grad
LRP
Evaluation at layers We evaluate all attribution methods at the input and final spatial layer for a fair comparison (Rao et al., 2022). Attributions from deeper layers are bilinearly upsampled to input resolution (Selvaraju et al., 2017).
RISE
Attribution methods We certify 12 attribution methods from 3 families: (i) backpropagation-baset: Grad (Si-
GradCam GradCam
monyan, 2014), GB (Springenberg et al., 2014), IntGrad (Sundararajan et al., 2017). IxG (Shrikumar et al., 2017)
and LRP (Bach et al., 2015) (ii) indivatiio-basede CAM (Zhou et al., 2016), -rad (Selvaraju et al., 2017), Grad-CAM++ (Chattopadhay al., 2018), Ablation-CAM (Ramaswamy al., 2020) and Layer-CAM (Jiang et al., 2021), and (iii) perturbation-based: RISE (Petsiuk al., 2018b) and Occlusion (Zeiler & Fergus, 2014). The imple- mentation details are in App. A.I. We display SS (Smoothed Sparsified), which is the average of the sparsified attribu- tions evaluated on n = 100 noisy input samples per image. Note that LRP and Cam are not evaluated on ViT-B/16 due to the extension complexity to the transformer architecture.
Top 50%
Top 25%
Top 5%
Figure 2: Certified attributions of selected methods dif- ferent sparsification parameter (K) values on ResNet-18. SS (Smoothed Sparsified) is evaluated on input samples per image and at K = 50%. The "Over- layed" column shows overlayed certified top K % pixels per method, with lower K taking precedence. Extended figures for ResNet- 18 and ResNet- 152 on all attribution methods at various certified radii for more examples are in App.
100 noisy
0.15, number of samples 100 per image, top class probability 0.75 and a = 0.001, unless stated otherwise. All certified results are robust with confidence 1 - a w.r.t the radius = 0. unless stated otherwise. Abstain pixels are marked gray (labelled 2), and certified bottom (100 K)% ("O") pixels are marked white, and top K% ("1") are colored otherwise.
Certification We use noise level
LRP
RISE
GradCam
7. Results and Discussion
We evaluate our certification approach across three attri- bution families, presenting qualitative certified attribution visuals (7.1) and quantitative robustness comparisons using %certified (7.2) and Certified GridPG (7.3). We also ana- lyze the robustness-lccalizttio tradeoff (7.4), highlighting methods that have most balance, and their faithfulness (7.5).
Top Top 20%
Top
Figure 3: Examples from overlayed certified GridPG at-
tributions at different sparsification K values on ResNet- 18. The blue square denotes the ground truth subimage.
at = 50%). Overlaying maps across K (see "Overlayed" column) reveals pixel importance hierarchy, with darker pixels denoting higher importance. Figure 4 extends this to more examples and all 12 methods. Certified attribu- tions highlight semantic features well, with LRP offering the most detail. Input-layer methods (backpropagation and perturbation) benefit from higher K due to noise-induced ranking instability, while activation methods benefit from a lower for finer isolation of their coarse outputs.
7.1. Certified Attributions Visuals
Figure shows certified attribution maps different sparsi- fication values K. As K decreases, fewer pixels are certi- fied as top K% % ("1"", highlighting finer details (e.g., LRP marks the fish's eye at K = 5%), while larger К values capture coarser features (e.g.. LRP highlights the full fish
6

---

Pixel-level Certified Explanations via Randomized Smoothing
Grad
IntGrdd
LRP
Declusion
GradCam
GradCam
AblationCam
LayeCCam
Certited
Contifeed
88
Certifeed
Contifed
Centified
Cectided
6S
Centified
Cectified
58
Centifed
Certifed
56 Certified
Ceniied
Top
Top 25%
Top
Figure Overlayed certified attributions at different K values across methods on ResNet-18. (Smoothed Sparsified), which refers to the average the sparsified attributions, evaluated on n 100 noisy input samples per image and K 50%. This figure is extended to ViT-B/16 in App. Figure 20.
To visualize the localization of certified attributions, Fig- ure displays certified attribution grid examples. In each grid, the top-left subimage contains the certified top K% pixels, which are correctly localized to the target class. A rigorous qualitative analysis of certified grids in App.
to lower (100 K pixels (medium shade). At the final layer, methods certify more 1op pixels, reflecting the robustness of high-level features to noise. We next discuss results by method family.
Backpropagation methods At the input layer (Figure 5, top). LRP is the most robust among backpropagation meth- ods (second overall after RISE), while other methods show %certified z O, due to their reliance on input magnitude (e.g., [xG and IntGrad), hence increasing sensitivity to per- turbations.
7.2. Robustness Evaluation of Attributions
We assess attribution robustness using &certified metric in Figure 5 at the input and final layers across certified radius R and sparsification K values. Increasing R (Figure 5, top) reduces certification rates for most methods, as it increases the noise making attributions less stable. Grad and GB at the final layer are exceptions, as they produce almost constant grid-like patterns in ResNet-18, though uninformative (Section 7.3). Lowering K (Figure 5, bottom) shifts certification rates from top K pixels (darkest shade)
Activation-based methods In Figure 5 (top), activation methods outperform backpropagation methods in %certi- fied at the final layer R increases, with the exception of Grad and GB. Grad-CAM++ and Layer-CAM score higher ecertified than other activation methods.
Input layer Perturbation
Final layer
Crad
Backpropagation
Activation
Backpropagation
Perturbation
Activation
CB
1xG
% pixels
75
IntGrad
50
LRP
25
RISE
Occlusion
0
0.10
0.17
0.22
0.10
0:17
0.22
0.10
0.17
0.22
0.30
0.17
0.22
0.10
0.17
0.22
0.10
0.17
0.22
Cam
Certified radius
50%
GradCam
100
GradCam
pixels
AblationCam
75
LayerCam
50
Shading Logic (LRP)
25
Certifee "1" (Darkest)
Certified (Meduus)
Sparsification parameter
50
30
0.10
50
10
10
Abstain "e" (Lightost)
Figure 5: Comparison of the per-pixel certification rate (%certified) on ResNet-18 across backpropagation, perturba- tion and activation methods. (Left) shows evaluation at the input and (Right) the final layer using different certified radii (Top) and sparsification parameter values (Bottom). The darkest shades denote %certified pixels, while brightest denotes abstain This figure is extended to models App. Figures 9 and 10.

---

Pixel-level Certified Explanations via Randomized Smoothing
Input layer
Final layer Perturbation
Backpropagation
Perturbation
Activation
Backpropagation
Activation
Cortified GridPG
random baseline
1.00
Grad
GB
0.50
0.25
IxG
IntGrad
0.00
0.10
0.17
0.22
0.10
0.17
0.22
0.10
0.17
0.10
0.17
0.22
0.10
0.22
0.10
0.17
0.22
LRP
Certified radius (R) at K 50%
RISE
Cortified GridPG
Occlusion
1.00
Cam
0.75
CradCam
0.50
GradCam++
0.25
AblationCam
0.00
LayerCam
10 50
30
50
Sparsification parameter (K) at 0.10
Figure 6: Comparison of the certified localization (Certified GridPG) ResNet-18 across backpropagation, pertur- bation and activation methods. (Left) shows evaluation at the input and (Right) at the final layer using different certified radii (Top) and sparsification parameter K values (Bottom). This figure is extended to 5 models in App. Figures 11 and 12
Perturbation-basse methods RISE outperforms all other methods at the input layer, with the highest certification rates across all radii. It has high %certified score at both layers, unlike Occlusion, which improves only at the final layer. This highlights the robustness advantage of randomized over deterministic masking.
Certified GridPG below the random baseline for all but CAM and Grad-CAM, scoring the highest. Reducing K improves localization across methods, with CAM and Grad- CAM achieving near-perfect performance at K 10%.
Perturbation methods RISE and Occlusion have compa- rable Certified GridPG scores at both the input and final layer. As K decreases at the input layer, RISE and Occlu- sion improve, with RISE achieving near-perfect score at K 10%.
Certified Robustness: RISE and LRP are the most robust across settings. All methods are more robust on the final layer.
Certified Localization: LRP, RISE, and Occlusion localize best across settings. Except for Grad and GB, all methods localize well at the final layer.
7.3. Certified Localization Evaluation of Attributions
We evaluate the localization performance of attribution methods using the Certified GridPG metric (Eq. 8) at the input and final layers in Figure 6 by varying the certified ra- dius R and sparsification parameter K. Increasing R raises the variance in Certified GridPG scores, with RISE show- ing the least variance. Activation methods perform worse than random on the input layer. LRP, RISE and Occlusion acheive near perfect localization at K 10% (Figure 6, bottom), suggesting that certifying fewer top K% pixels en- hances focus on the correct subimage in the grid in methods that are already robust (see Figure 5). Overall, perturbation methods (c.g.. RISE) demonstrate superior localization as R increases or K decreases at both layers, making them more reliable. We next discuss results by method family.
7.4. Robustness vs. Localization Tradeoff
We previously analyzed certified robustness (Section 7.2) and localization (Section 7.3), noting that higher robustness does not necessarily imply better localization and vice versa. To put both together, Figure 7 examines the tradeoff between certified robustness (%certified) and localization (Certified GridPG) across models including CNNs and VIT.
Input layer RISE and LRP offer the best tradeoff across models, with high localization and robustness. Grad, GB, and IntGrad score highest on Certified GridPG (e.g.. W- ResNet-50-2. ResNet-152) but show near- zero robustness. Activation methods perform poorly on both metrics.
Backpropagation methods At R=0.10 (Figure 6, left), Grad achieves the highest Certified GridPG at the input layer, followed by IxG, IntGrad and LRP; GB performs worst. At the final layer, Grad and GB drop to random local- ization despite high certification rates (Figure 5), showing that robustness does not guarantee localization (Section 7.4).
Final layer RISE again strikes the best balance alongside Occlusion and activation methods, while Grad and GB most robust but show random-like localization. RISE main- tains the best balance especially on ViT-B/16 where others fail. Overall, the tradeoff improves at the final layer, sug- gesting coarser attributions better enhance localization and robustness, aligning with results in 7.2 and 7.3.
Activation methods At the final layer, increasing R lowers
8

---

Pixel-level Certified Explanations via Randomized Smoothing
ResNet-18 W-ReeNet-50-22 ResNet-152
VGG-11
ViT-B/IK
Cert. Localization Cert. Localization Cert. Localization Cert. Localization Cert. Localization
Cert, Robustness Cert, Robustaess
0.75
Input
0.50
0.25
0.75
Final
0.50
0.25
0.25
0.50
0.75
0
0.25 0.75
0 0.25 0.50 0.75
0.25 0.50 0.75
0.25 0.50 0.75
Best
3
GB
IntGrad
RISE
Cam
GradCam++
LayerCam
Grad
IxG
LRP
Occlusion
GradCam
AblationCam
Figure 7: Robustnesx-localizatin tradeoff of attribution methods using the certified and Certified GridPG metries on all 5 models at K- = 30%. (Top) evaluation is input and (Bottom) final layers.
7.5. Faithfulness Analysis of Certified Attributions
Final layer In Figure 8 (right), most methods induce a pre- diction flip after the first step, indicating higher faithfulness than the input layer. However, some show high faithful- ness despite poor localization. For example, GB and Grad yield near-random Certified GridPG scores (Figure 6) but cause steep confidence drops (Figure 8). This suggests their grid-like final-layer patterns introduce deletion artifacts that disrupt predictions without identifying relevant regions.
Input Deletion steps
Final Deletion steps
ResNett 18 GTT Class probalality
0.80
0.40
0.20
All three metrics, Scertified, Certified GridPG and faithful- ness, complement each other to understand different aspects of certified attributions, which is essential for producing trustworthy attributions in safety-critical domains.
Orig.
K-110
K=300
50
Ong
Grad
RISE
GraCaan+
GB
Occlusion
AblationCam
LRP and RISE strike the best balance among robust- ness, localization and faithfulness, across settings.
GradCam
LayerCam
Figure Faithfulness comparison of certified attribution methods on ResNet-18 using the ground truth (GT) class confidence against the deletion steps in which top K certi- fied pixels removed in descending order of importance. (Left) evaluation is at the input and (Right) at the final layer.
8. Conclusion
We propose pixel-wise certification of attribution methods and framework to evaluate their certified robustness and localization. First, we introduce per-pixel certification for smoothed sparsified attributions by reformulating attribu- tion as a segmentation task, enabling direct application of Randomized Smoothing to produce certified, high-quality attribution maps. Second, we present an evaluation scheme using three metries, percentage of certified pixels, Certi- fied GridPG, and deletion-base faithfulness, to evaluate twelve attribution methods across backpropagation, activa- tion, and perturbation families. Our quantitative analysis shows that RISE and LRP achieve the best tradeoff across the three metrics across settings, while other methods vary in performance.
We assess the faithfulness of certified attributions using deletion-based (Petsiuk et al., 2018b) analysis (described in Section 5) in Figure 8.
Input layer In Figure 8 (left), LRP and RISE cause the steepest drop in class confidence after the first deletion step, indicating high faithfulness. Grad-CAM yields the smallest decrease, reflecting weak alignment with class-relevant fea- tures, consistent with its near-random certified localization in Figure LRP and RISE also achieve the highest Certified GridPG scores across models (Figures 6, 7), showing strong alignment between certified localization and faithfulness.

---

Pixel-level Certified Explanations via Randomized Smoothing
Impact Statement
much appreciate the diligent and constructive reviews by all reviewers, and believe the additional insights gained in preparing the rebuttal, and expanding the analysis in our work, significantly strengthen our paper.
We introduce novel framework for certifying attribution methods at the pixel level, reframing attribution as seg- mentation task and applying Randomized Smoothing for segmentation to certify each pixel as "important" or "not im- portant" under fz-bounded input perturbations. This yields the first certifiably robust attribution maps applicable to any black-box method, offering both fine-grained visual explanations and per-pixel robustness guarantees.
This work was partially funded by ELSA - European Light- house on Secure and Safe funded by the European Union under grant agreement No. 101070617. Views and opinions expressed are however those the authors only and do not necessarily reflect those of the European Union European Commission. Neither the European Union nor the European Commission can be held responsible for them.
Our approach enables two key contributions: (i) robust, in- terpretable certified attributions that can inform downstream tasks, and (ii) new evaluation paradigm for attribution robustness, including visual and quantitative comparisons across methods. To this end, we propose certified, which measures robustness, and Certified GridPG, which captures robust localization.
This work addresses the critical lack of robustness in at- tribution methods and underscores the ethical and societal importance of trustworthy AI explanations in high-stakes settings such as healthcare, justice, and autonomous sys- tems.
Societal Impact Our framework advances trustworthy and explainable AI by providing certified attributions that are reliable under input perturbations. In domains like health- care, law, and autonomous driving, where understanding model reasoning is vital, our method enhances decision transparency and reliability. It also introduces principled way to compare attribution methods, fostering more robust and interpretable deep learning models. Collaborations with practitioners can support integration into real-world systems, increasing accountability and trust.
Ethical Considerations In safety-critical domains, espe- cially medical decision-making certifiably robust attribu- tions offer ethical advantages by reducing the risk of mis- leading explanations. When paired with expert oversight, our method supports more informed and reliable decision- making.
Conclusion We present the first general-purpose framework for certifying and evaluating attribution methods at the pixel level, addressing Long-standing robustness challenges. Our method enables practical, reliable, and trustworthy model explanations, and lays the foundation for future work in certifiably robust AI. Ultimately, we anticipate a positive societal impact by improving explainability, robustness, and safety in AI systems.
Acknowledgements
We greatly thank Dr. Jonas Fischer for the valuable feedback and technical discussions during the rebuttal phase. We very
10

---

Pixel-level Certified Explanations via Randomized Smoothing
References
Dombrowski, A.-K., Anders, C. J., Müller, K.-R., and
Kessel, P. Towards robust explanations for deep neural networks. Puttern Recognition, 2022.
Anani, A., Lorenz, T., Schiele, B., and Fritz, M. Adaptive hierarchical certification for segmentation using random- ized smoothing. In International Conference on Machine Learning (ICML), 2024.
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. An image worth 16x16 words: Transformers for image recognition at scale. International Conference for Learning Representations (ICLR). 2020.
Arias-Duart, A., Parés, F,, and Gareia-Gasulla, D. Who explains the explanation? quantitatively assessing feature attribution methods. arXiv preprint arXiv:2109. 1503,, 2021.
Bach, S., Binder, A., Montavon, G., Klauschen, F., Müller,
Fischer, M., Baader, M., and Vechev, M. Scalable certified segmentation via randomized smoothing. In International Conference on Machine Learning (ICML), 2021.
K.-R., and Samek, W. On pixel-wise explanations for non-lincar classifier decisions by layer-wiss relevance propagation. PloS one, 2015.
Fong, R. C. and Vedaldi, A. Interpretable explanations of black boxes by meaningful perturbation. In International Conference on Computer Vision (ICCV), 2017.
Baniecki, H. and Biecek, P. Adversarial attacks and defenses in explainable artificial intelligence: A survey. Informa- tion Fusion, 2024.
Ghalebikesabi, S., Ter-Minassian, L.., DiazOrdaz, K., and
Bohle, M., Fritz, M., and Schicle, B. Convolutional dynamic alignment networks for interpretable classifications. In Computer Vision and Pattern Recognition (CVPR), 2021.
Holmes, C. C. On locality of local explanation models. In Advances in Neural Information Processing Systems (NeurIPS), 2021.
Carmichael, Z. and Scheirer, W. J. Unfooling perturbation- based post hoc explainers. AAAI Conference on Artifi- cial Intelligence (AAAI), 2023.
Ghorbani, A., Abid, A., and Zou, J. Interpretation of neural networks is fragile. In AAAI conference on artificial intelligence (AAAI), 2019.
Chattopadhay, A., Sarkar, A., Howlader, P., and Balasubra- manian, N. Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks. In Winter Conference Applications of Computer Vision (WACV), 2018.
Guo, Z., Li, X., Huang, H., Guo, N., and Li, Q. Deep learning- basen image segmentation multimodal medi- cal imaging. IEEE Transactions Radiation and Plasma Medical Sciences, 2019.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Computer Vision and Pattern Recognition (CVPR), 2016.
Chen, C., Guo, C., Ma, G., Zeng, M., Zhang, X., and Xie, S. Provable robust saliency-based explanations. arXiv preprint arXiv:22/2, /4106, 2022.
Jiang, P.-T., Zhang, C.-B., Hou, Q., Cheng, M.-M., and
Chen, J., Wu, X., Rastogi, V., Liang, Y., and Jha, S. Ro- bust attribution regularization. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
Wei, Y. Layercam: Exploring hierarchical class activa- tion maps for localization. IEEE Transactions on Image Processing (TIP), 2021.
Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial robustness via randomized smoothing. International Conference on Machine Learning (ICML), 2019.
Karen, S. Very deep convolutional networks for large-scale image recognition. In International Conference for Learn- ing Representations (ICLR), 2015.
Dabkowski, P. and Gal, Y. Real time image saliency for black box classifiers. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
Kayalibay, B., Jensen, G., and van der Smagt. Can-based segmentation of medical imaging data. arXiv preprint 1701::/701.03056 2017.
Dhurandhar, A., Haldar, S., Wei, D.,, and Ramamurthy, K. N. Trust regions for explanations via black-box probabilistic certification. In International Conference on Machine Learning (ICML), 2024.
Kaymak, Ç. and Uçar, A. brief survey and an application of semantic image segmentation for autonomous driving. Handbook of Deep Learning Applications, 2019.
Dombrowski, A.-.., Alber, M., Anders, C., Ackermann, M., Müller, K.-R., and Kessel, P. Explanations can be manipulated and geometry is to blame. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
Kindermans, P.J., Hooker, S., Adebayo, J., Alber, M.. Schütt, K. T., Dähne, S., Erhan, D., and Kim, B. The (un) reliability of saliency methods. Explainable Al: Interpret- ing, explaining and visualizing deep learning, 2019.

---

Pixel-level Certified Explanations via Randomized Smoothing
Kuppa, A. and Le-Khac, N.-A. Black box attacks on plainable artificial intelligence (xai) methods in cyber security. In International Joint Conference on Neural Networks (LJCNN), 2020.
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. Grad-cam: Visual explanations from deep networks via gradient-based localization. In International Conference on Computer Vision (ICCV), 2017.
Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S. Certified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and 2019. 2019.
Sheu, R.-K. and Pardeshi, M. S. A survey on medical explainable ai (xai): recent progress, explainability ap- proach, human interaction and scoring system. Sensors, 2022.
Privacy
Levine, A., Singla, S., and Feizi, S. Certifiably ro- bust interpretation in deep learning, arXiv preprint arXiv:I905.1 12105, 2019.
Shrikumar, A., Greenside, P., and Kundaje, A. Learning important features through propagating activation differ- ences. In International Conference on Machine Learning (ICML), 2017.
Lin, C., Covert, I., and Lee, S.-I. On the robustness of removal-based feature attributions. In Advances in Neural Information Processing Systems (NeurIPS), 2024.
Shrotri, A. A., Narodytska, N., Ignatiev, A., Meel, K. S., Marques-Silvaa J., and Vardi, M. Constraint-driveen ex- planations for black-box ml models. In AAAI Conference Artificial Intelligence (AAAI), 2022.
Liu, A., Chen, X., Liu, S., Xia, L., and Gan, C. Certifi- ably robust interpretation via rényi differential privacy. Artificial Intelligence, 2022.
Montavon, G., Lapuschkin, S., Binder, A., Samek, W., and Müller, K.-R. Explaining nonlinear classification deci- sions with deep taylor decomposition. Pattern Recogni- tion, 2017.
Simonyan, K. Deep inside convolutional networks: Visual- ising image classification models and saliency maps. In International Conference for Learning Representations Worshop (ICLR-W), 2014.
Nissan, E. Digital technologies and artificial intelligence's s present and foreseeable impact on lawyering, judging, policing and law enforcement. Ai & Society, 2017.
Springenberg, J. T., Dosovitskiy, A., Brox, T., and Ried- miller, M. Striving for simplicity: The all convolutional net. In International Conference for Learning Represen- tations Worshop (ICLR-W) 2014.
Petsiuk, V., Das, A., and Saenko, K. Rise: Randomized input sampling for explanation of black-box models. In British Machine Vision Conference (BMVC), 2018a.
Subramanya, A., Pillai, V., and Pirsiavash, H. Fooling network interpretation in image classification. In Interna- tional Conference on Computer Vision (ICCV), 2019.
Petsiuk, V., Das, A., and Saenko, K. Rise: Randomized input sampling for explanation of black-box models. In British Machine Vision Conference (BMVC), 2018b.
Sundararajan, M., Taly, A., and Yan, Q. Axiomatic attribu- tion for deep networks. In International Conference on Machine Learning (ICML), 2017.
Ramaswamy, H. G. et al. Ablation-cam: Visual explana- tions for deep convolutional network via gradient-free localization. In Winter Conference on Applications of Computer Vision (WACV), 2020.
Tan, Z. and Tian, Y. Robust explanation for free or at the cost of faithfulness. In International Conference on Machine Learning (ICML), 2023.
Rao, S., Böhle, M., and Schiele, B. Better understanding differences in attribution methods via systematic evalua- tions. Computer Vision and Pattern Recognition (CVPR), 2022.
Tang, R., Liu. N., Yang, F., Zou, N., and Hu, X. Defense against explanation manipulation. Frontiers in Big Data 2022.
Vreš, D. and Robnik Cobnik-šikonja, M. Preventing deception with explanation methods using focused sampling. Data Mining and Knowledge Discovery (DMKD), 2024.
Ribeiro, M. T,, Singh, S., and Guestrin, C.
why should trust you?" explaining the predictions of any classifier. In International Conference on Knowledge Discovery and Data Mining (ICKDD), 2016.
Wang, F. and Kong, A. W.-K. practical upper bound for the worst-case attribution deviations. In Computer Vision and Pattern Recognition (CVPR), 2023.
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. Imagenet large scale visual recognition chal- lenge. International Journal of Computer Vision (IJCV), 2015.
Wang, F. and Kong, A. W.-K. Certified & attribution robust- ness via uniformly smoothed attributions. arXiv preprint arXiv:2405.0633 2024.
12

---

Pixel-level Certified Explanations via Randomized Smoothing
Wang, Z., Wang, H., Ramkumar, S., Mardziel, P., Fredrik- son, M., and Datta, A. Smoothed geometry for robust attribution. In Advances in Neural Information Process- ing systems (NeurIPS), 2020.
Xi, J., Wang, D., Yang, X., Zhang, W., and Huang, Q. Can- omic data based explainable ai drug recommendation inference: A traceability perspective for explainability. Biomedical Signal Processing and Control, 2023.
Zagoruyko, S. and Komodakis, N. Wide residual networks. arXiv preprini. 2016.
Zeiler, M. Visualizing and understanding convolutional networks. In European Conference on Computer Vision (ECCV), 2014.
Zeiler, M. D. and Fergus, R. Visualizing and understand- ing convolutional networks. In European Conference on Computer Vision (ECCV), 2014.
Zhang, X., Wang, N., Shen, H., Ji, S., Luo, X., and Wang, T. Interpretable deep learning under fire. In USENIX security symposium (USENIX), 2020.
Zhang, Z., Fidler, S., and Urtasun, R. Instance-level seg- mentation for autonomous driving with deep densely con- nected mrfs. In Computer Vision and Pattern Recognition (CVPR), 2016.
Zhou, B., Khosla, A., Lapedriza, A., Oliva, A., and Torralba, A. Learning deep features for discriminative localization. In Conference on Computer Vision and Pattern Recogni- tion (CVPR), 2016.
13

---

Pixel-level Certified Explanations via Randomized Smoothing
A. Implementation Details
A.1. Attribution Methods
LRP (Bach et al., 2015) Following (Montavon et al., 2017; Arias-Duart et al., 2021; Rao et al., 2022), we use the configuration that applies the c-rule to the fully connected layers in the network, with = 0.25, and the ++ to the convolutional layers, except for the first convolutional layer where
the zule.
Occlusion (Zeiler & Fergus, 2014) Occlusion uses sliding window of size K and stride over the input. Following (Rao et al., 2022), use K- 16, 8 for the imput layer and K = 5, = 2 for the final layer.
RISE (Petsiuk et al., 2018b) We use total of N 6000 randomly generated masks per layer. Masks are initially generated on low-resolution grid of size (with default 6), where each cell is activated with probability 0.1. Each binary grid is bilinearly upsampled and cropped to match the input dimensions. The implementation supports CNN-like 4D tensors, following the setup in (Rao et al., 2022), as well as ViT-like 3D tensors.
A.2. Vision Transformer ViT-B/16
While evaluating attribution methods at the input layer for Vision Transformers is standard, evaluating them at the final layer requires modifications to the attribution logic. In CNNs, the final layer contains activations in the form of 3D tensor of shape (C, H, W), where C' is the number of channels and (H, W) correspond to spatial locations at a lower resolution compared to the imput image. This structure aligns naturally with the input image and is usually interpolated (i.e., resized) to match its dimensions.
However, Vision Transformers (e.g., ViT-B/16 (Dosovitskiy et al., 2020)) process the image as a sequence of patches, with each patch treated as a token. The final feature representation prior to classification is typically of shape (N, D), where N is the number of tokens (including the [CLS) token), and D is the hidden dimension (e.g., 768 for ViT-B/16). For ViT-B/16 and a 224x x 224 input image, this results in N = 197 tokens: 1 [CLS) token and 196 patch tokens, where each patch corresponds to 14 x 14 grid in the original image (a result of dividing 224 by 16).
To enable attribution on ViTs, we discard the [CLS] token and reshape the remaining 196 tokens into (14, 14) grid, analogous CNN feature maps. This allows us treat patch embeddings spatial features and apply attribution methods at the final layer similarly to how they are applied in CNNs. We adapt our attribution logic to extract these reshaped features, which are then bilinearly interpolated to the original image size.
We have extended all attribution methods to be ViT-compatible, with the exception of LRP (Bach et al., 2015) and CAM (Zhou et al., 2016), due to the lack of direct extensions for these methods.
B. Evaluation of certified attributions on 5 models: ResNet-18, W-ResNeet50-2, ResNet-152, VGG-11 and ViT-B/16
B.1. Certified Robustness (% certified)
We assess attribution robustness on five different models using the %certified metric evaluated at the input and final layers across certified radii (R = 0.10, 0.17, 0.22) in Figure and sparsification (K" = 50, 30 and 10) in Figure 10. Note that ViT-B/16 not evaluated on CAM and LRP. The general trend of reduced certification rates by increasing the certified radius R, well reduced certified top K% pixels by decreasing K holds across all five models.
Input layer LRP and RISE exhibit the highest robustness, they also maintain relatively high Secrtified scores across all three radii values in Figure 9. Interestingly, they also maintain a balance in certified top K% pixels by decreasing K in Figure 10.
Final layer Though Grad and GB still seem the most robust on CNNs in Figure 9, they localize very poorly, this is because they produce grid-like almost constant attributions at the final layer of the CNN architecture, due to max-pooling.
VIT-B/16 Gradient- based methods exhibit low robustness on ViT-B/16 comparable to their CNNs performance on both the input and final layers in Figure 9. Interestingly, RISE maintains the same performance of having high robustness across
14

---

Pixel-level Certified Explanations via Randomized Smoothing
both architecture types, with the highest at radius R 0.10 the final layer on ViT-B/16. Activation bbased methods perform poorly the transformer model compared CNNs the final layer. This is likely due the lack of spatially structured convolutional features in ViTs, which affects the quality and stability of activation-based attributions when applied to token-bast based representations. We discuss this implementation detail in App. A.2.
Input layer
Final layer
Beckgropess abin
ResNet-18
W-ResNet-50-2
182
VGGII
WT--R118
ResNet-18
W-
ResNet-152
VGGII
VIT-R/16
000-
73-
of
20-
0117
0.10
011
8.17
0.30
0.22
0.10
6.17
0.30
0.17
0.22
0.10
0:17
5.00
6.12
0.10
(8)
30%
Pattulless
000
23-
of
0117 0.
0.22
0.17
9.17
6,10
0.10
Certided rndirs (10 at
30%
Un0
Activation
23-
of
Cortited rndras
0.17 0.000
(20
at
010
305
0.17
0.16
0.22
0.17
0.10
0.22
Groci
GBB
1x3
IntGGed
LTP
RISE
Deoluston
Cam
GradCrm
GradCam-++
AblattonCam
LegerCam
Studting Logie (LRP)
Owniled
(Derlest)
Ceniifel
(Nelian)
Alanais
Figure 9: Comparison of the per-pixel certification rate certified against the certified radius R on all 5 models across backpropagation, activation and perturbation methods. (Left) shows evaluation at the input and (Right) the final layer. The darkest shades denote %certified pixels, while brightest denotes abstain @.
Imput layer
Final layer
HessNet-18
W-HesNNet-Sin
ResNet-132
VGGL1
VEI-1/166
ResNet- W-ReeNed-50-
ResNet-152
VGGI
VIT-1/16
Baekpoppae cf
90
37
10
10
50
50
30
30
10
50
30
00
30
32
10
50
30
00
20
10
10
20
Spansticalion parumeter
(AC)
Pectubaaie
100
of
01
50
10
30
00
10
(0
(0
20
00
10
60
00
C0
10
90
30
10
Spursiliadãon parssttder (KC)
100
Activation
of
20
30
10
60
50
10
30
30
50
10
10
60
101
Sparsification parsmeter
(K") at.
0.10
Groe
GR
1:C3
IntGred
IRR
PISE
Deelusim
Cam
GradlCocm
GoeICam-+
AblatiunCCam
LayerCaam
Stading Logle (LAP)
Gentifee
(Tarlove)
Clrtited
(Xeehor)
Alettal
Figure 10: Comparison of the per-pixel certification rate (% certified) against sparsification values K on all models across backpropagation, activation and perturbation methods. (Left) shows evaluation the input and (Right) the final layer.
15

---

Pixel-level Certified Explanations via Randomized Smoothing
B.2. Certified Localization (Certified GridPG)
Input layer
Final layer
ResNet-18
W-BeesNet-50-22
ResNet-152
VGG11
VIT-B/16
ResNet-18
W--ReNee-000-2
ResNet-152
VGGI1
VIT-B/16
(2 1-00-
6225
800
030
0.10
0.22
0.00
Certibed rodins (30)
DCN
Patartation
1025-
10.22-
Certileed cudinn (3) DCN
9:77
0.17
022
Adtivaionn
1-00-
0:30
0.22
0.17
0.30
0.22
0.32
Cerkifeed cullin (3) N-- 507
cantoou
Grod
1xG
IntGr
LRP
RISC
Occltzton
Coma
GradCon:
GroCCam++
AblictoCCam
LeyerCam
Figure 11: Comparison of the certified localization (Certified GridPG) against the certified radius R on all 5 models across backpropagation, activation and perturbation methods. (Left) shows evaluation at the input and (Right) at the final layer.
Input layer
Final layer
R8
W-ReeNee-50-22
R82
VIT-B/16
ResNet-18
W-RosNet-5002
ResNet-132
VGGIT
VIT-B/16
Badercipagatan
(1.00 1.000
0.93
0:25
15
20
20
10
231
50
10
30
201
50
10
60
10
50
Spanifirattion parmetter
(RC) mt
0.10
Puttucbetion
(3
1.00
00.0
201
00
244
50
10
50
31
201
50
10
10
56
Spariiicotion parometer (KC) at
0.10
Activatioe.
1.00
35
10
60
50
10
20
10
30
50
50
30
10
30
50
10
70
Sparillcation pinumeter (3K) ot.
0.10
raadom beselliee
Good
LRP
Ocsliion
GradCoun
GaodClam
AbdacioncCam
LayerCiam
Figure 12: Comparison of the certified localization (Certified GridPG) against the sparsification values K on all models across methods. (Left) shows evaluation the input and (Right) the final layer.
Input layer In Figures 11 and 12, backpropagation and perturbation methods demonstrate effective localization at the input layer across all models, except VGG-11. This is likely due to the absence of skip connections in VGG-11, which hampers gradient flow and impedes signal propagation to the input. In contrast, activation- based methods perform worse than random across all models, they rely solely high-level forward activations from the final layers, lacking direct correspondence with input pixels.
Final layer At the final layer, all attribution methods generally yield higher localization scores compared to the input layer, as shown in Figures and 12. This improvement particularly evident activation and perturbation methods, which align better with the spatial structure final-layer features. However, exceptions are observed in Grad and Guided Backpropagation (GB), which underperform relative to other methods.
16

---

Pixel-level Certified Explanations via Randomized Smoothing
C. Impact of varying the certification strictness (hyperparameterr 7)
One of the hyperparameters in our certification setup T E (0.5, 1J, which sets a threshold for the top class probability of a pixel to certify it (discussed in Section 4.2 and defined in Eq. 5). The higher the value of т, the more strict the certification condition is. We investigate the effect of increasing on &certified and Certified GridPG of all attribution methods in Figure 13.
Input layer
Final layer
ResNet-18
W-ReeNee-50-22
ReeNet-152
VGGL1
VIT-B/16
ResNet-18
W-RReNeet-50-2
ResNet-152
VGGI1
VIT-B/16
Beckgnopegtinn
000-
116
0.00
0.75
0:5
0.00
0.75
036
0575
0.00
0.00
0.75
6:45
0.75
036
0.00
0.75
0.50
0.91
0.75
0:5
0101
0.75
240
probobility
Partuzhaiion of
0n1-
0: Top probahility
0:75
0.00
0.55
D:5
0.00
0.75
6.95
040
0.75
0/6
0.90
0.75
0.55
0.00
9:75
DED
0.75
0.55
0.00
0.75
0.5
0:00
5/5
0:95
0.50
0.5
0.55
Activation
of
0,60
0.75
0.6
5:00
075 ())
0.00
0.70
0:35
0.60
0.70
0.60
0.99
0.75
0.00
0.00
0.70
6:93
0.60
0.70
0.90
0.99
0.75
0.50
3.00
0.75
0.35
0.00
0.70
0.5
Top
prolishliily
Geoc.
GBB
Ixt
Intirea
LRP
RISE
Oocluston
Cum
GradUiio
GondUam 4-4
AblatioCCam
LayerCaa
Stauting Logic (LRP)
Certided
(Dhatione)
Certifed (Kerkann)
Alwtaia "s" (Ligated)
(a) The certification rate (Sccetiiiedd) against the top class probability values т.
Input layer
Final layer
18
W-RosNeet6002
RosNet-112
VGG
WT-RR116
ResNet-18
W-ReeNet-5002
RosNet-1122
VGGH
WT-B/116
Backgropega
1-00-
1000
000-
Top dless probabiling
0:30
0:75
0.00
0.00
0.50
0.75
0:25
0.00
0.50
0.75
0.75
0.35
0.0
0.83
Pattuhation
1,00
0.30
R22
000
0.
0.
0:00
probahility
0.7
nic
0335
0.00
8:6
0.90
0.5
3.35
0.00
0.75
0:00
0.90
0.75
0.56
0.00
0.55
0.9
0.00
0.70
0.96
Actieetan
0.90
1821
0,50
probohilite
8.30 ndc
6.35
0.35
0.00
0.76
0.06
0.00
0.00
6.35
0:36
0.50
336
0,50
0.75
0.90
6.75
0.36
010
0:3
rindom
Insedias
Gaud
CBB
LRP
RUSE
Occhtsion
Camn
GradCau:
GrodCam
AblacionCCam
LayerCamn
(b) Certified GridPG against top class probablity values
Figure 13: The performance of attribution methods in terms of Øcertified (a) and Certified GridPG (b) by increasing the top class probability (making the certification more strict)
Effect of r on certified In Figure 13, we observe that increasing 7 lowers the certification rate of all methods, except for Grad and GB at the final layer, since they produce almost constant grid-like patterns at that layer in ResNet18. At the highest value of r = 0.95, the performance of methods drops to 0, indicating for the need of increasing the number of samples to able to certify under the strict condition imposed by a high T.
17

---

Pixel-level Certified Explanations via Randomized Smoothing
Effect of Certified GridPG In Figure 13 (b), interestingly, increasing 7 from 0.60 0.75 boosts the localization performance of all methods (with the exception of activation methods completely failing the input layer). This indicates that by imposing more strict certification setup, only the most confident pixels are certified to top K% in attribution output, which also localizes better. Hence, we use default value of - = 0.75 throughout the paper.
D. GridPG and Certified GridPG
To understand how attribution methods maintain localization under input noise, we analyze the relationship between the original localization score (GridPG) and the certified localization score (Certified GridPG) in Figure 14. This comparison helps assess the robustness of each method's localization ability when subjected to noise during certification. At the input layer (Figure 14, top), IRP outperforms all methods, striking balance in both metrics. Backpropagation-bn activation-bass methods exhibit higher Certified GridPG than their respective GridPG scores. This increase may be attributed to the certification process rejecting incorrect positive evidence located outside the correct subimage in the grid, thereby boosting the certified localization score. At the final layer (Figure 14, bottom), RISE the only method that achieves a higher Certified GridPG than GridPG, demonstrating its ability improve localization when subjected to input noise. Meanwhile, all other methods roughly lie on the diagonal, showing equal values of Certified GridPG and GridPG. GradCam achieves the highest scores in both GridPG and Certified GridPG (with the exception of ViT-BI ViT-B/16), indicating that its localization performance remains consistent between the raw and certified outputs.
and
ResNet-18 Certified GridPG
W-ResNet-50-2 Certified GridPG
ResNet-153 Certified GridPG
VGG11 Certified GridPG
ViT-B/16 Certified GridPG
0.75
Input
GridPG
0.50
0.25
0
0.75
Final GridPC
0.50
0.25
0
0.25
0.50
0.75
10
0.25
0.50
0.75
10
0.25
0.50
0.75
10
0.25
0.50
0.75
10
0.25
0.50
0.75
Best
$
GB
83
IntGrad
RISE
Cam
GradCam++
LayerCam
Grad
88
IxG
LRP
Occlusion
GradCam
AblationCam
Figure The performance of attribution methods on ResNet18 in terms of original GridPG score against Certified GridPG.
E. Impact of varying sparsification and certified radius on certified visuals
We present qualitative examples showing the certified visuals on ResNet-18 (Figures 15 and 16) and additionally ResNet- 152 (Figures 17 and 18) of all attribution methods by varying the sparsification parameter (K 50%, 25%, 10% and 5%) and certified radius (R 0.10, 0.17, 0.22).
As the radius R increases with higher noise levels (α), all methods abstain more and certify fewer top K% pixels. Amongst backpropagation based methods, only LRP, Grad and GB show certified top K% pixels in the overlayed output, whilst IxG and IntGrad almost abstain from all top K% pixels at all radii. notable observation is that activation high-quality overlayed certified maps across all noise levels (certified radii) on both models ResNet-1e 18 and ResNet-152. Perturbation- based methods maintian high-quality overlayed maps across all certified radii.
methods show
18

---

Pixel-level Certified Explanations via Randomized Smoothing
As K decreases, fewer pixels are certified within the top K%, while more pixels fall within the lower (100 5%% across methods. At smaller K values (e.g., K 5%), most methods highlight more distinctive features. Overlaying certified attribution maps across different K values offers insights into the relative pixel importance for each method.
19

---

Pixel-level Certified Explanations via Randomized Smoothing
Certifee
Certified
K-50%
K-5%
Ke50g
Ke0%
R-O 10
d=0.15
3--0
R-0.11
o 0.25
GB B-
10112
R-0 22
R-0 10
R-0 13
R-
--
B- 1000
R-011
0-0.35
R-013
RISE So993 1
22
0-0.3
R- 22
R-
R-0.00
o- 0.15
B-010
023
R=0.1
-
Cam
Re
R-0.32
0-333
R--0
R=0.10
o-035
R-0:10
Grddaam
R-0.12
0-025
SmoCame
R-022
2-0.35
3-022
3-00 10
d-0.15
R--0 10
AlcaiinCamn
Can
R-033
0-0.33 0-025
X-031
R=0.22
R-0 32
Roltom (1 D0-K1%
Top 50%
Top 25%
5%
Figure 15: Example image and certified attribution maps on ResNet-18 of methods at different sparsification (K) and certified radius K values. SS (Smoothed Sparsified) is evaluated K 50%. The "Overlayed" last column shows the certified top K % pixels from row-wise certified maps different K values, with lower K taking precedence for each pixel.
20

---

Pixel-level Certified Explanations via Randomized Smoothing
Certified
Cartifled
x+0
X-50%
K=25%
K-5%
Dverlayed
55
K=50%
K=25%
Kw55%
Overlayed
2=0.10
0=0..5
Rent
Grad
Re011
CR
R=:027
d-
Ree.22
Rc-0.22
d'-03
Ree 10
e=0.5
Re0100
0-0.15
Red Re
TeiDhwe
BC
RE0
d-
Re022
R=-022
d 0:33
R=010 0:35
Red
R=011
2-
RESE
R=0 112
0-025
Re
--
0=:022
0-0.35
Re0:12 Red
R=-010
d 0.55
Occusin
Cam
R=-012
0-025
Ren
R=022
d
Ree 17 Reo 10
RE:012 17 R=0.10
d=035
GracCam
DrddCim
-0 d= 0.25
Red22
R=022
d- 6:25 0=0.15
R=-022 RE012 12 R=0.10
01-115
AbtatooCCa Reb 17 Red
TayerCam
d= 0-025
Re-022
Bottom (100-K0%
Top 50%
Top 25%
Top 5%
Figure 16: Example image and its certified attribution maps ResNet-18 of all methods at different sparsification (K') and certified radius K values. SS (Smoothed Sparsified) is evaluated at K = 50%. The "Overlayed" last column shows the certified top % pixels from row-wise certified maps at different K values, with lower K taking precedence for each pixel.
21

---

Pixel-level Certified Explanations via Randomized Smoothing
Gerifed
Oerifed
Contiidd
ONE
Messaaan dw O.0.
(a) RcsNet-18
(b) ResNet-152
Figure 17: Certified attribution maps ResNet-18 (a) and ResNet-152 (b) of all methods at different sparsification (K) and certified radius K values. SS (Smoothed Sparsified) is evaluated K 50%. The "Overlayed" last column shows the certified top K% pixels from row-wise certified maps at different K values, with lower K taking precedence for each pixel.
22

---

Pixel-level Certified Explanations via Randomized Smoothing
Cerifed
Derifed
Contiid
ONE ReO
Messaaa dw dA C-SS
2514
RcsNet-18
(b) ResNet-152
Figure 18: Example image and its certified attribution maps ResNet-18 (a) and ResNet-152 (b) of all methods at different sparsification (K) and certified radius K values. SS (Smoothed Sparsified) is evaluated at K = 50%. The "Overlayed" last column shows the certified top K pixels from row-wise certified maps at different K values, with lower K taking precedence for each pixel.
23

---

Pixel-level Certified Explanations via Randomized Smoothing
F. Certified attribution visuals on ViT-B/16
Input
Input
Certified
Certified
SS
K=50%
K=25%
K=5%
Overlayed
SS
K=50%
Km25%
K=5%
Overlayed
Grad
Grad
GB
GB
IxC
IxG
IntCrad
IntCred
RISE
RISE
Ocolusion
Occlusion
Abl Cam CradCam +++ Grad Cam
GradCam H-+ Grad CradCam Cam
AbLCam Cam
LayerCam
LayerCam
Top
Top
Top 3%
Top
Tog:
Top 5%
(a)
(b)
Figure 19: Certified attribution maps of VIT-B/16 of all methods at different sparsification parameter (K) values. SS
(Smoothed Sparsified) is evaluated on n 100 noisy input samples per image and 50%. The "Overlayed" column shows certified top K pixels per row, with lower K taking precedence.
24

---

Pixel-level Certified Explanations via Randomized Smoothing
Grad
GB
IxG
IntGrad
RISE
GradCam
GradCam
AblationCam
LayerCam
SS
Certified
Certified
SS
Certified
Cerlified
Certified
ss
Certified
Certified
SS
Certifie
SS
Certified
Top 50%
Top 25%
Top 10%
Top 5%
Figure 20: Overlayed certified attributions on ViT-B/16 at different K values across methods. SS (Smoothed Sparsified),
which refers to the average the sparsified attributions, evaluated on n 100 noisy input samples per image and at K 50%.
25

---

Pixel-level Certified Explanations via Randomized Smoothing
G. Qualitative Evaluation of Certified Localization
In this section, we present qualitative results using the AggAtt layout introduced by Rao et al. (2022), and adapting for attribution methods evaluated on Certified GridPG at imput and final layers. AggAtt (Rao al., 2022) qualitative evaluation method that generates aggregate attribution maps by sorting maps based their localization scores and grouping them into percentile bins. These bins, with smaller sizes for the top and bottom percentiles, highlight both the best and worst-case performance of attribution methods. This approach provides a comprehensive view of method performance across diverse inputs, emphasizing both consistent trends and distinct failure cases.
In Figures 21 and 22, we show an example from the median position of each AggAtt (Rao et al., 2022) bin for each attribution method the input and final layers, respectively, evaluated on Certified GridPG the top-left grid cell using ResNet-18 (He et al., 2016).
At the input layer, backpropagatton-baas bassdd methods show relatively better localization in the top-left grid cell. LRP (Bach et al., 2015) shows the best localization across these methods, followed by Grad (Simonyan, 2014). Meanwhile, GB (Springenberg et al., 2014) seems to mainly highlight edges in the input irrespective of the grid cell, and IxG (Shrikumar et al., 2017) and IntGrad (Sundararajan et al., 2017) only have very few pixels certified top K pixels within the top-left grid cell. Activation- based methods show poor performance by almost abstaining from the entire grid. This aligns with the poor quantitative performance of these methods at the input layer Figure 6.
26

---

Pixel-level Certified Explanations via Randomized Smoothing
Input layer
0-2
2-5
5-50
50-95
95-98
98-100
Grad
GB
IxG
IntGrad
LRP
RISE
Occlusion
Cam
GradCam
GradCam ++
AblationCam
LayerCam
Figure 21: Examples from each AggAtt for all methods at the input layer using Certified GridPG. White denotes certified "0", black is certified "1" and gray is abstain 2. The percentile bin values are displayed at the top of every column. Default values: = 50%, R = 0.10, = 0.75 and n 100.
27

---

Pixel-level Certified Explanations via Randomized Smoothing
At the final layer (Figure 22), certified attributions from Grad (Simonyan, 2014) and GB (Springenberg al., 2014) show constant pattern where all pixels certified as bottom (100- K)%. The localization of the rest of the methods improves considerably compared the input layer in Figure 21, which agrees with the quantitative results from Figure 6. All other methods show good localization, with the best example coming from Occlusion (Zeiler & Fergus, 2014), which achieves near perfect localization at the first 0 Att bin.
Final layer
0-2
2-5
5-50
50-95
95-98
98-100
Grad
GB
IxG
IntGrad
LRP
RISE
Occlusion
Cam
GradCam
GradCam +
AblationCam
LayerCam
Figure 22: Examples from each AggAtt for all methods at the final layer using Certified GridPG. White denotes
certified "0", black certified "1" and gray abstain Ø. The percentile bin values are displayed at the top of every column. Default values: 50%, R 0.10, 0.75 and n 100.
28

---

Pixel-level Certified Explanations via Randomized Smoothing
Finally, show the AtgAtt (Rao al., 2022) bins for all methods Certified GridPG both layers different sparsification values and certified radii in Figure 23. We that the AggAtt bins in this comprehensive figure reflect the trends in the quantitative results in Figure 5 and Figure 6, well as the qualitative results in Figure 21 and Figure 22.
Input layer
Final layer
K=50%
3=30%
K= 10%
K=50%
K=30%
K= K=10%
Grad
68
160
mn
R=0.10
[d 0.15)
Orciuston
Cas
GradCam
GralCamm
AblatioComm
1x0
mM
LHP
R=0.17
805E
0.25)
GradCam
Graifamm+ 4
AblatioCCa
LayerCaem
Grad
LBPP
RUSE
0.33)
Occtusion
GradCam
AblatonCam
LayerCam
Figure 23: AggAtt Evaluation on Certified GridPG for all attribution methods at the input and final layers across sparsification parameters K and certified radii R values.
29


Reviews:
[{"review_id": "TQz5LaKYfh", "reviewer": "Reviewer_s6h4", "summary": "The paper’s primary contribution is a pixel-level certification framework for attribution methods on deep classifiers, backed by a robust evaluation paradigm and demonstrated through high-quality visuals and quantitative comparisons.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Note:** We include a general response covering global updates and experiments in our comment to Reviewer **itGy**. Please refer to that comment and the supplementary PDF link there.\n\nWe thank the reviewer for raising very fundamental questions regarding the motivation of our work. We clarify that our goal is **not to make attributions robust**, but to **certify their robustness** at the pixel level under input perturbations. This distinction appears to have been misunderstood. Other reviewers recognized our contribution: **WAuF** noted that our method opens “a new direction” in interpretability and **iTN6** highlighted our “robust insights into method performance”.\n\n### Q: What is the problem this paper is trying to address?\n\nWe address the lack of pixel-level robustness guarantees in post hoc attribution methods. As discussed in (Section 2, Robustness issues), small input perturbations can significantly alter attribution maps even when the predictions remain unchanged, undermining trust in explanations, especially in high-stakes domains. Prior work provides only image-level bounds (Section 2, Certified explanations), which lack interpretability (Section 1, L023-L037 Right). We bridge this gap by introducing a certification setting that provides pixel-level guarantees, along with certified metrics for robustness and localization. \n\n### Q: Step-by-step reasoning for “pixel-level robustness should be proven”.\n\n1. For a model to be trustworthy, its explanations must also be trustworthy.\n2. Attribution methods are non-robust under small perturbations.\n3. Existing certified attribution work focuses only non-interpretable image-level numeric bounds.\n4. Pixel-level guarantees are essential to identify trustworthy regions in explanations. In a biomedical setting such as tumor detection from X-rays, a doctor can directly see which pixels the model used to predict cancer. For example, if a model highlights a shaded region as important, but our certification flags it as non-robust, a clinician can be alerted to treat the attribution with caution, potentially influencing their reliance on the model’s prediction.\n5. Thus, the claim is justified to ensure trust in explanations. \n\n### Q: Does the method consider model robustness?\n\nWe agree that model robustness influences attribution robustness [3–5]. However, our goal is to certify attribution robustness for a fixed model, without enforcing or assuming model robustness. **This distinction is crucial**: our certification setting is **attribution-centric**. \n\nTo ensure attributions reflect correct class evidence, we select inputs with prediction confidence $\\geq 0.99$ (Section 6, L224-L227, Right) as in [6], ensuring certified top $K$% pixels reflect correct class evidence. \n\n### Q: What do you mean by certifiably robust explanations?\n\nAttribution maps where each pixel's certified label (important/unimportant) is guaranteed to remain unchanged under input perturbations within an $\\ell_2$-ball around the input (Eq. 5 & Section 3.2). Unstable pixels are abstained from.\n\n### Claim: ”The goal of this paper is trying to make the attribution robust.”\n\n**Clarification:** our goal is to **certify, not improve, attribution robustness**. If a method is not robust, it yields high abstentions and a low %certified scores. \n\n### Q: Does explanation robustness align with faithfulness?\n\nWe agree that attribution robustness doesn’t always reflect faithfulness. **High robustness** may be (i) **Informative**, highlighting class-relevant features (i.e., faithful) or (ii) **Trivial**, by producing constant maps. To disentangle these cases, we introduced Certified GridPG (Eq. 8) to jointly assess robustness and localization, which is actually a very effective sanity check. In Rebuttal Fig. 5, RISE and LRP are both robust and localize well, while methods like Grad and GB are robust at the final layer but fail to localize, due to the constant grid-like patterns they produce on that layer. \n\n### Q: Can you evaluate faithfulness using existing metrics?\n\nCertainly! We thank the reviewer for this valuable suggestion which we believe makes our submission stronger. We include a deletion-based faithfulness analysis in Rebuttal Sec 2, where we progressively remove the certified top K% pixels (lowest to highest) in the input and measure the ground truth class confidence:\n\n1. At the input layer, LRP and RISE cause the steepest confidence drop in the first removal step, indicating high faithfulness. \n2. At the final layer, most methods cause a prediction flip after the first deletion step, showing higher faithfulness to the input layer.\n\nOur analysis shows that **high certified robustness and faithfulness co-exist** (e.g., LRP) . Our framework allows the joint evaluation to identify attribution methods that are robust, faithful, and well-localized.\n\nFurther analysis in Rebuttal Sec 2.\n\n[6] Rao et al. Better understanding differences in attribution methods via systematic evaluations. CVPR, 2022", "claims_and_evidence": "The claims in this paper are well-supported and authors have provided empirical results demonstrating the validity of the claims.", "methods_and_evaluation_criteria": "This is the biggest concern I have regarding this paper. Although the paper's method and results are supporting each other, I am quite confused of what problem this is paper is trying to address, and if this work is still creating an \"explanation\". \n\nFirst, this paper starts with a claim that is not well-accepted in the abstract:\n\n> Certified attribution methods should prove that pixel-level importance values are robust.\n\nI believe this claim is not well-received. Can the authors provide a step-by-step reasoning here. Normally, we provide a certification to a function to check if its output is consistent within a support set (e.g. among adversarial inputs). I am not clear what do we mean by creating certifiable robust explanations, the reasons are as follow:\n\nFor the case of input attribution, the explanation means a subset of input features that are most important to the model. For an attribution to be useful, it must be faithful to the model in the first place [1, 2, 3]. There are many definitions of faithfulness, but in the simplest way at least we want the input attribution to be as sensitive to the input as the model. That is, if the model changes the prediction with some adversarial examples, the input attribution to the benign and the adversarial input should be different. As a result, we observe that attribution robustness naturally come with model robustness [3, 4, 5]. \n\nHowever, the goal of this paper is trying to make the attribution robust, without discussing the robustness of the model itself. Thus, my read is the more robust an attribution is under your certification, it is LESS likely to be a *faithful* attribution. \n\nCan the authors provide some analysis and discussions on whether the certified attribution in this work still accurately capture the model's behavior? You can evaluate the faithfulness scores such as [2].\n\n\n[1] Sundararajan, M., Taly, A., and Yan, Q. Axiomatic attribution for deep networks. In International Conference on\nMachine Learning (ICML), 2017.\n\n[2] Yeh, Chih-Kuan, et al. \"On the (in) fidelity and sensitivity of explanations.\" Advances in neural information processing systems 32 (2019).\n\n[3] Wang, Zifan, Matt Fredrikson, and Anupam Datta. \"Robust models are more interpretable because attributions look normal.\" arXiv preprint arXiv:2103.11257 (2021)\n\n[4] Prasad Chalasani, Jiefeng Chen, Amrita Roy Chowdhury, Xi Wu, and Somesh Jha. Concise explanations of neural networks using adversarial training. In International Conference on Machine Learning, pp. 1383–1391. PMLR, 2020.\n\n[5] Etmann, C., Lunz, S., Maass, P., and Schoenlieb, C. On the connection between adversarial robustness and saliency map interpretability. In Proceedings of the 36th International Conference on Machine Learning, 2019.", "theoretical_claims": "More analytical results are using conclusions or some direct derivatives from randomized smoothing, so they are sound.", "experimental_designs_or_analyses": "I think experiments are useful to support the paper's goal, which is actually problematic. As a result, some important evaluations are missing, such as attribution faithfulness. See my comments in Methods And Evaluation Criteria.", "relation_to_broader_scientific_literature": "This paper is based on randomized smoothing, a technique used to provide probabilistic guarantee of a function. The authors tried to use this method to provide a guarantee of input attribution method, an approach used in explaining a deep model's local decision by identifying a subset of input features that are more relevant than the whole input.", "essential_references_not_discussed": "There is an import stream of work in the relation between model robustness and attribution robustness that are not discussed in this work. Example references are listed in Methods And Evaluation Criteria.", "other_strengths_and_weaknesses": "N/A", "other_comments_or_suggestions": "N/A", "questions_for_authors": "Please see Methods And Evaluation Criteria", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fdt85OEzKp", "reviewer": "Reviewer_WAuF", "summary": "The article proposes a certification method that reformulates the attribution task as a segmentation problem and uses the randomized smoothing technique to ensure the pixel-level robustness of black-box attribution methods. Meanwhile, two metrics, \"percentage of certified pixels\" and \"Certified Grid Pointing Game\", are introduced to evaluate attribution methods from the aspects of robustness and localization ability. The experiments use the ImageNet dataset and the ResNet18 model to conduct research on ten attribution methods from three categories.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Note:** We include a general response covering global updates and experiments in our comment to Reviewer **itGy**. Please refer to that comment and the supplementary PDF link there.\n\n### We thank the reviewer for recognizing the significance of our certification framework, particularly the value of providing pixel-level robustness guarantees and its relevance in safety-critical applications.\n\n\n### Q: Should the method be evaluated on different architectures?\n\nWe agree that broader evaluation across architectures strengthens our conclusions. We extend our experimental results to 3 additional architectures: Wide ResNet-50-2, ResNet-152, and a Transformer-based ViT-B/16. These include deeper CNNs and a transformer, confirming the generality of our method (Rebuttal Section 1).\n\n### Q: Can you increase the readability and cleanliness of the code?\n\nWe appreciate this suggestion. We are restructuring the codebase to include a clear execution guide, ensuring full reproducibility. This will be available in the camera-ready version.\n\n### Q: Should the method be evaluated under different data distributions?\n\nWe used ImageNet to align with prior certified attribution work. We agree that it would be advantageous to extend our evaluation to a different data distribution. Due to limited computational resources during the rebuttal, we prioritized architectural diversity. That said, our method applies directly to other data domains, and we will include such evaluations in the final version. \n\n### Q: Should you cover all important aspects of the performance of attribution methods (e.g., other than %certified and localization)?\n\nWe appreciate the concern and would like to clarify a key point: the goal of our work is **not** to introduce new, but **certify the robustness of existing attribution methods**, which means their original performance on standard metrics *stays unchanged*. Our certification provides context for the end user that allows them to asses which explanations (pixel-wise attributions) to **trust**. To this end, our proposed two certified metrics answer the questions:\n\n1. Does the explanation remain stable under perturbations? (%certified)\n\n2. Do the certifiably robust pixels point to the correct region? (Certified GridPG)\n\nIn summary, our work does not aim to redefine attribution performance metrics, but to provide a certified framework that augments existing methods with trust guarantees, allowing practitioners to assess the trustworthiness of attributions. Our evaluation framework is designed to complement, not replace, standard evaluation.\n\n### Q: Can you comment on the computational cost of the method, and its real-time performance?\n\nCertainly! We agree with the reviewer that the certification process incurs a computational cost due to the Monte Carlo sampling. We use $n=100$ samples per image in our experiments, which suffices to obtain statistically sound guarantees at a reasonable cost. In fact, there is actually seminal work on sampling with noise just to sharpen gradient-based attribution maps, such as SmoothGrad [2], which is shown to be most faithful by a benchmark for interpretability [3]. While, like our work, not designed for real-time deployment, our method is suitable for high-stakes offline settings such as medical diagnostics, legal forensics, and model auditing, where certifiable robustness is essential.\n\n### Q: Does the method need to be adjusted or improved when dealing with different dataset types?\n\nThank you for raising this question, which highlights the practical applicability of our method. Our certification pipeline is model and dataset-agnostic. It treats the attribution function $h(x)$ as a black-box and operates without assumptions on the model or input distribution. Thus, it applies to any domain where attribution is defined.\n\n### Q: Does Certified GridPG cover the localization of small targets?\n\nYes, **Certified GridPG** is explicitly designed to be **invariant** to object **size**. It computes the fraction of certified top $K$% pixels located in the correct subimage within a constructed grid (e.g., $2\\times 2$), regardless of the object’s size (Eq. 8). This formulation extends [1]. Rebuttal Figure 11 and App. E (Figures 12-14), show various qualitative results across layers, certification radii, and sparsification levels.\n\n### Q: Is the certification equally applicable to transformer-based architectures?\n\nCertainly! Our approach does not rely on any architectural properties. We have validated this by including ViT-B/16 in our extended experiments, alongside deeper CNNs (Rebuttal Section 1). \n\n[1] Böhle et al. Convolutional dynamic alignment networks for interpretable classifications. CVPR, 2021\n\n[2] Smilkov et al. Smoothgrad: removing noise by adding noise. arXiv, 2017\n\n[3] Hooker et al. A benchmark for interpretability methods in deep neural networks. NeurIPS, 2018", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "It is applicable, but the number of experimental images and the number of selected models are too limited.", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "In the research of machine learning interpretability, post - hoc attribution methods can indicate the impact of image pixels on classifier predictions. However, they are not robust to minor changes in the input. Previous studies have used regularization techniques or improved sampling methods to enhance robustness, but these lack theoretical guarantees. The pixel - level certification method proposed in this paper addresses this shortcoming. By reformulating the attribution task as a segmentation problem and leveraging the randomized smoothing technique, it theoretically ensures the pixel - level robustness of black - box attribution methods.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Strength\nThe paper proposes a method that reformulates the attribution task as a segmentation problem and uses the randomized smoothing technique to achieve pixel - level robustness certification. This breaks through the limitation of only providing image - level bounds in the past, opening up a new direction for the research on the interpretability of deep learning. It can more accurately evaluate the robustness of pixel importance, enhance the reliability of model interpretations, and is of great significance for applications in safety - critical fields.\n\nWeaknesses\nThe experiments only use the ImageNet dataset and models like ResNet18 and VGG11. The selection of the dataset and models is relatively limited, which may not comprehensively reflect the performance of the method under different data distributions and model architectures, thus restricting the generality of the research results.\n\nThe evaluation of attribution methods mainly relies on two indicators, \"percentage of certified pixels\" and \"Certified Grid Pointing Game\". This may not cover all important aspects of the performance of attribution methods, ignoring other factors that may affect the effectiveness and reliability of the methods, resulting in an incomplete evaluation.\n\nThe Monte Carlo sampling method is used in the certification process. Due to the large number of samples, the computational cost is high. This not only limits the application efficiency of the method on large - scale data and complex models but also may affect its real - time performance and practicality in actual scenarios.", "other_comments_or_suggestions": "No", "questions_for_authors": "The certification method proposed in the paper is applied to the ImageNet dataset in the experiment. When dealing with different types of image datasets, such as medical images and satellite images with special features and distributions, can it still maintain good performance and robustness? If applied to these datasets, does the method need to be adjusted or improved?\n\nAre the two metrics, \"percentage of certified pixels\" and \"Certified Grid Pointing Game\", comprehensive enough to measure the performance of attribution methods? Are there other important aspects that are not covered by these two metrics? For example, in complex scenarios, is there a lack of evaluation of the localization ability for small targets?\n\nThe paper mentions that the high computational cost of sampling in the certification process may limit its practical application. In future research, is there a plan to explore more efficient sampling strategies or computational methods to reduce the computational cost and improve the scalability of the method?\n\nThe experiments are mainly based on ResNet18 and VGG11 models. For models with other different architectures (such as Transformer - based architectures), is this certification method equally applicable? Different architectures vary in feature extraction and representation. How will this affect the certification results?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QoJjwemezW", "reviewer": "Reviewer_itGy", "summary": "The authors proposed a method to provide the certified explanation on the pixel level using the Randomized Smoothing approach. While a lot of techniques authors used are not novel, the overall pixel-level approach could provide a more rigorous insight into assessing the attribution methods from the robustness point of view.\n\n## update after rebuttal\nAuthors updated the experimentation parts including a different (more consistent with other certified segmentation papers) $\\sigma$ and more attribution algorithms (like CAM, LRP). Also, they provided more clear qualitative analysis on the certified shapes. I updated the score from WA to Accept.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to all reviewers \n\nWe thank all reviewers for their thoughtful and constructive feedback. We very much appreciate the diligent and constructive reviews by all reviewers, and believe the additional insights gained in preparing this rebuttal significantly strengthen our work. While we respond to all reviews individually, we would like to draw your attention to the following general points:\n\n## Supplementary PDF\n\nA supplementary PDF with all figures and analyses is available: https://anonymous.4open.science/r/certified-attributions-E80D/ICML25_Rebuttal___Pixel_level_certified_explanations_via_randomized_smoothing.pdf\n\n\n## Key Updates\n\n**Three new architectures:** Added Wide ResNet-50-2, ResNet-152, and ViT-B/16 (**WAuF**, **iTN6**) \n\n**Faithfulness metric:** Deletion-based faithfulness analysis of certified attributions (**S6h4**)\n\n**Two new attribution methods:** Added CAM and LRP (**itGy**)\n\n**Qualitative visuals:** More certified maps for shape and Certified GridPG analysis (**WAuF**, **itGy**)\n\n## Conclusions\n\n- Our certification setup is general enough to scale across **five different architectures** and **twelve attribution methods**.\n\n- **Certified robustness, certified localization and empirical faithfulness are not mutually exclusive**, and some methods strike a balance between the three (e.g., LRP), hence, providing faithful and trustworthy attributions, essential for safety-critical domains.\n\nSincerely,\n\nThe authors\n\n# Response to Reviewer itGy\n\n### Q: Why do you use radii $R= 0.10\\, 0.17\\, 0.22$? \n\nWe follow the common practice from [1] and [2] for Randomizerd Smoothing for segmentation for such values of the radius. The certified radius $R\\coloneqq \\frac{\\sigma}{2} \\Phi^{-1}(\\tau)$ depends on the noise level $\\sigma$ and the top class probability $\\tau$ (Section 4.2). We fix $\\tau=0.75$ and vary $\\sigma \\in \\{0.15, 0.25, 0.33\\}$ to obtain different certified radii. These values ensure the added noise remains visually imperceptible, while enabling a controlled evaluation of robustness across a range of certification strengths.\n\n### Q: Why does Figure 1 use K=40, while the rest use K=50?\n\nWe ran all the analysis with the same $K=40$ and again double-checked this in our codebase. It turned out to be just a typo, Figure 1 indeed uses $K=50$ like the remaining ones. Thank you for pointing this out!\n\n### Q: Can you provide qualitative discussions on shapes of certified pixel-level explanations across methods?\n\nCertainly! We extend the qualitative comparison of certified attribution shapes in Section 7.1 and further detailed in App. A & E.\n\nWe observe that input-layer methods (e.g., Backpropagation and perturbation) produce fine-grained certified regions, often concentrated on small parts of the object (e.g., GB highlighting eyes in Figure 1). In our rebuttal experiments, LRP nicely highlights the object boundaries and its parts with varying importance levels in Rebuttal Figures 10 & 11. In contrast, activation-based methods evaluated at the final layer produce larger and coarser certified regions. More specifically:\n\n- **Backpropagation-based methods** are highly sensitive to perturbations and often abstain, but when certified top $K$% pixels are present, they highlight sharp localized features. LRP seems to provide the sharpest certified attributions.\n\n- **Perturbation-based methods’** coarseness of highlighted regions is influenced by the mask size and generally yield broader certified top $K$% regions than backpropagation-based methods. They also exhibit higher robustness.\n\n- **Activation-based methods** produce lower-dimensional attributions that, when rescaled to the input size, yield coarser certified top $K$% regions. Our framework nicely controls the granularity of such regions via the sparsification parameter $K$, lower values concentrate the certified top $K$% pixels on smaller more important areas (Figure 2).\n\n### Q: Can you mention or compare the CAM method in your evaluation pipeline?\n\nThank you for this suggestion. We now include results on not only ten attribution methods, but also two additional ones: Class Activation Mapping (CAM) [3] and Layer-wise Relevance Propagation (LRP) [4] in Rebuttal Section 3. We notice that Cam highlights coarse certified top $K%$ regions similar to other activation methods, while LRP produces high-quality certified attributions that focus on fine-grained details in the objects in Rebuttal Figures 10 & 11.  \n\n### Q: Should L056 and L638 be changed?\nYes, thanks for pointing the typos out!\n\n\n[1] Fischer et. al. Scalable certified segmentation via randomized smoothing. ICML, 2021.\n\n[2] Anani et. al. Adaptive hierarchical certification for segmentation using randomized smoothing. ICML, 2024.\n\n[3] Zhou et al. Learning deep features for discriminative localization. CVPR, 2016.\n\n[4] Bach et al. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, 2015.", "claims_and_evidence": "Claims:\n1. a pixel-wise certification approach for attribution methods\n2. metrics to compare methods using either the % of certified pixels or Certified GridPG and measuring it for a number of attribution methods (10)\n3. rigorous visualization analysis of the certified pixels at different confident levels\n\nEvidences:\n1. This claim is supported by the work [1] where Randomized Smoothing (RS) for certification of segmentation is applied\n2. Certified analogs of metrics either trivial (%pixels certified) or used from the work [2] making them sound reasonable\n3. Multiple figures in the main portion of text as well as Appendices\n\n\n[1] Fischer, M., Baader, M., and Vechev, M. Scalable certified segmentation via randomized smoothing. In International Conference on Machine Learning (ICML), 2021.\n[2] Rao, S., Bo ̈hle, M., and Schiele, B. Better understanding differences in attribution methods via systematic evaluations. Computer Vision and Pattern Recognition (CVPR), 2022.", "methods_and_evaluation_criteria": "The metrics proposed to measure the certified attribution look reasonable. A rigorous analysis makes the whole paper sound solid.", "theoretical_claims": "The only formula-heavy part is borrowed from either work [1] or [2] (section \"Claims And Evidence\"), so nothing to review.", "experimental_designs_or_analyses": "There are some important things to consider that I'd like to emphasize:\n1. Section 7.2. Why we use radii $R$ = 0.10, 0.17, 0.22? What is the reason behind it? Maybe it is smth used in previous works - need to mention it.\n2. Figure 1 uses $K = 40$ while most of others Figures - 2, 6, 7, etc (Appendix A) use $K = 50$. Why not the same $K$?\n3. While there are a lot of discussions in Section 7, I haven't noticed any qualitative discussions/conclusions on the different shapes of certified pixel-level explanations (wider area vs concentration on the center etc), and analysis of it w.r.t. how different algorithms behave", "relation_to_broader_scientific_literature": "Two main areas: Certified Robustness through Randomized Smoothing + Attribution methods.", "essential_references_not_discussed": "The original seminal work on Class Activation Mappping (CAM) is neither mentioned nor compared - [1]\n\n[1] Zhou, Bolei, et al. \"Learning deep features for discriminative localization.\" Proceedings of the IEEE conference on computer vision and pattern recognition. 2016.", "other_strengths_and_weaknesses": "NA", "other_comments_or_suggestions": "Typos:\n* Line 056, \"determines\" --> \"determine\"\n* Line 638, \"certified radius K values\" --> R", "questions_for_authors": "Just emphasizing \"Experimental Designs Or Analyses\" and \"Essential References Not Discussed\" secitons", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ih2xmHyAde", "reviewer": "Reviewer_iTN6", "summary": "The paper introduces a pixel-level certification approach for black-box attribution methods using Randomized Smoothing. \n\nThe authors reformulate the pixel-level attribution problem into a segmentation task and provide theoretical guarantees adapted from Fischer et al. (2021). \n\nExtensive experiments demonstrate certified robustness and localization metrics across various attribution methods (3) and provide insights into robustness-localization trade-offs.\n\n### Update the Scores after Rebuttal\nAfter rebuttal and checking the author's additional results + Other's Reviews Comments, I am convinced to raise the score, from weak accept -> Accept :)\nJust one tips on Rebuttals, for readability, it is better to keep all the mathematical equation symbols / bold / font consistent (e.g. for Review itgy)!", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Note:** We include a general response covering global updates and experiments in our comment to Reviewer **itGy**. Please refer to that comment and the supplementary PDF link there.\n\n### Q: The method is an extension of Fischer et. al. 2021. Therefore, the theoretical novelty is limited. \n\nWhile our work indeed builds on Fischer et al. (2021)'s certification for segmentation, adapting it to the certified attribution setting, on the pixel-level, is completely novel and non-trivial. The previous work focuses on segmentation models, but it does not contain (1) **The mathematical formulation** for the pixel-level certified attribution setting, (2) **Certified robustness and localization metrics**, (3) **Rigorous comparison** of the robustness-localization tradeoff of certified attributions.\n\n1. **Mathematical formulation:** We are the first to formulate pixel-level certified attributions by sparsifying the attribution map (Eq. 4) and casting the result as a segmentation-like function with binary pixel labels (important/unimportant) that are semantically meaningful in the attribution settings.\n\n2. **Certified robustness and localization metrics:** we introduce two certified metrics to evaluate both the pixel-level certified robustness (%certified) and localization (Certified GridPG) of 12 attribution methods spanning 3 families. Our work is the first to discuss such metrics in a certified attribution setting.\n\n3. **Rigorous comparison of different attribution methods:** by leveraging our contribution in (1) and (2), we benchmark all methods across five architectures (including CNNs and ViTs), certification radii, and multiple sparsification levels. \n\nIn short, our work does not trivially rely on prior work by Fischer et al. (2021) as it includes different novel components that are essential for the certified attribution and evaluation settings that are not obvious apriori. It presents an important data point, and research direction, in the field of certified explainability.\n\n### Q: Is the method generalizable to deeper CNNs (e.g., ResNet101) or transformer-based model (e.g., ViTs)?\n\nWe fully agree with the reviewer that broader evaluation across architectures strengthens our conclusions. In response, we have extended our experimental results beyond ResNet-18 and VGG11 to include three additional architectures: Wide ResNet-50-2, ResNet-152, and a Transformer-based ViT-B/16 (Rebuttal Section 1). This nicely rounds up our analysis of the performance of all attribution methods on many architectures of different design and depths.\n\n### Q: What are the practical benefits of certified pixel-level attributions against non-certified attributions?\n\nCertified attributions provide users with pixel-level guarantees of robustness under input perturbations, allowing them to assess which regions in an explanation are trustworthy. In contrast, standard attribution methods offer no such reliability; highlighted features may be highly sensitive to small input changes. In safety-critical domains such as medical imaging, this distinction is essential. For example, in tumor detection from X-rays, a region attributed as important but uncertified may be unstable and thus misleading. Our framework enables practitioners to identify and rely only on attributions that are provably robust, or abstain when stability cannot be guaranteed.\n\nThus, certified pixel-level attributions provide actionable interpretability: they enhance standard attribution maps with robustness guarantees, enabling more informed decisions about when to trust a model’s explanation, and by extension, its prediction. This capability is essential for integrating AI safely into high-stakes domains.\n\n### Q: Besides certified segmentation, can you discuss more recent certification methods (e.g., using transformer or deeper-CNN)?\n\nThe certification setting based on Fischer et al. (2021) is architecture-agnostic and applies to any black-box model.\n\n### Q: Can you discuss recent datasets and benchmarks for XAI and how they relate to your work?\n\nOur current work focuses on certifying pixel-level robustness of attribution methods, and we evaluate on ImageNet for two reasons: (1) it is the standard benchmark used across prior certified attribution works [2, 3], and (2) it includes complex images where attribution stability is challenging. We leverage the Grid Pointing Game benchmark [4, 1], one of the frameworks for evaluating localization and explanation quality, by introducing Certified GridPG, a certified variant of this benchmark tailored to our setup. \n\n[1] Rao et al. Better understanding differences in attribution methods via systematic evaluations. CVPR, 2022.\n\n[2] Levine et al. Certifiably robust interpretation in deep learning. arXiv, 2019.\n\n[3] Liu et al. Certifiably robust interpretation via renyi differential privacy. AI, 2022.\n\n[4] Böhle et al. Convolutional dynamic alignment networks for interpretable classifications. CVPR, 2021.", "claims_and_evidence": "1) The core theoretical approach heavily relies on prior work by Fischer et al. (2021) (lines 206-219). \n2) The paper’s primary novelty appears limited to extending the certification method to pixel-level explanations. However, the paper does not clearly specify which elements of the theoretical framework are genuinely novel beyond the adaptation. \n3) Equations 4 and 5 alone are insufficient to justify significant theoretical novelty. Clear articulation of the specific theoretical contributions beyond adaptation is needed.", "methods_and_evaluation_criteria": "1) Good Point: the paper features a clear paper structure, covering impact, and ethical considerations. \n2) It also provides extensive supplementary materials, including detailed ablation studies on sparsification parameters, radius values, and layer impacts (Section E, Appendix).\n3) However, the experimental validation exclusively utilizes the ImageNet dataset with shallow CNN architectures such as ResNet18 and VGG11 (lines 221-227). This narrow focus raises concerns about the generalizability of the proposed method. \n4) It is unclear how the certification framework performs on deeper, more contemporary CNN architectures (e.g., ResNet101) or transformer-based models (e.g., Vision Transformers - ViTs).", "theoretical_claims": "1) Claims regarding theoretical guarantees at the pixel level (lines 80-82) are appropriately supported through adaptation of existing theorems (Fischer et al., 2021). This theoretical framework is sound and built clearly on Fischer et al. (2021). Strong claims on novelty and contributions (Section 1, lines 116-117) need clearer distinctions from prior theoretical frameworks. \n2) Empirical claims regarding the robustness-localization trade-off are supported clearly with extensive experiments (Figures 3, 4, 5).", "experimental_designs_or_analyses": "1) The authors extensively evaluate 3 different attribution methods, certification strategies, and the impact of layers and sparsification parameters (Sections 6 and 7), providing robust insights into method performance across several scenarios.\n\n\n2) However, it does not sufficiently discuss or visually demonstrate the practical benefits of certified pixel-level attributions over standard, widely-used XAI visualization methods such as saliency maps, Grad-CAM, or simpler standalone visualization tools. Specifically, it lacks a clear visual or practical argument about why certified pixel-level explanations significantly enhance real-world usability compared to non-certified alternatives.", "relation_to_broader_scientific_literature": "Builds upon Fischer et al. (2021), clearly positioning its contributions relative to existing certified segmentation literature. However, further discussion of recent developments (transformer-based methods and deeper CNN architectures) would benefit contextualization.", "essential_references_not_discussed": "Missing references to recent relevant datasets and benchmarks for explainable AI. There could be even more XAI dataset for testing, only included ImageNet results in the paper.", "other_strengths_and_weaknesses": "See comments above.", "other_comments_or_suggestions": "No.", "questions_for_authors": "1) Clarify explicitly what new theoretical elements you introduced beyond adapting Fischer et al. (2021) Theorem 3.1.\n2) How would your certification framework perform with recent transformer-based models or deeper CNNs like ResNet101? Have such evaluations been considered?\n3) How specifically does certification improve real-world interpretability and trust?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper introduces a pixel-level certification framework for attribution methods, building on randomized smoothing techniques to provide robustness guarantees for saliency-based explanations. The approach is well-executed and includes comprehensive experimental validation, demonstrating its applicability across a range of attribution methods and visualizing the trade-offs between robustness and localization.
Most reviewers initially had concerns but were convinced by the rebuttal. They appreciate the thorough experimental analysis and find the method solid. Reviewer WAuF criticises the limited scope (few models/datasets), the reliance on only two indicators and potential scalability issues. 
Taken together, however, the positive opinions about the paper, e.g., it "opens a new direction in interpretability", outweighs the negative feedback.
Decision: Accept (poster)