Diffusion Visual Counterfactual Explanations
Authors: Maximilian Augustin
Valentyn Boreiko
Francesco Croce
Matthias Hein
Venue: NeurIPS 2022 Accept (2022)

Abstract: Visual Counterfactual Explanations (VCEs) are an important tool to understand the decisions of an image classifier. They are “small” but “realistic” semantic changes of the image changing the classifier decision. Current approaches for the generation of VCEs are restricted to adversarially robust models and often contain non-realistic artefacts, or are limited to image classification problems with few classes. In this paper, we overcome this by generating Diffusion Visual Counterfactual Explanations (DVCEs) for arbitrary ImageNet classifiers via a diffusion process. Two modifications to the diffusion process are key for our DVCEs: first, an adaptive parameterization, whose hyperparameters generalize across images and models, together with distance regularization and late start of the diffusion process, allow us to generate images with minimal semantic changes to the original ones but different classification. Second, our cone regularization via an adversarially robust model ensures that the diffusion process does not converge to trivial non-semantic changes, but instead produces realistic images of the target class which achieve high confidence by the classifier.

Diffusion Visual Counterfactual Explanations
Maximilian Augustin"
Valentyn Boreiko'
Francesco Croce
Matthias Hein
University of Tübingen
Abstract
Visual Counterfactual Explanations (VCEs) are an important tool to understand the decisions of an image classifier. They are "small" but "realistic" semantic changes of the image changing the classifier decision. Current approaches for the generation of VCEs are restricted to adversarially robust models and often contain non-realistic artefacts, or are limited to image classification problems with few classes. this paper, we overcome this by generating Diffusion Visual Counterfactual Explanations (DVCEs) for arbitrary ImageNet classifiers via a diffusion process. Two modifications to the diffusion process are key for our DVCEs: first, adaptive parameterization, whose hyperparameters generalize across images and models, together with distance regularization and late start the diffuuson process, allow to generate images with minimal semantic changes to the original ones but different classification. Second, our cone regularization via adversarially robust model ensures that the diffusion process does not converge to trivial non-semne non-semantic changes, but instead produces realistic images of the target class which achieve high confidence by the classifier. Code is available under https: / /gttttttt..//..///g/ cotm//aaeettyyuboreeooo/o//
Introduction
It can be argued that of the main problems hindering the widespread of machine learning, and image classification in particular, is the missing possibility to explain the decisions of black-box models such as neural networks. This is not only problem for decisions affecting humans where the current draft for AI regulation in Europe [10] requires "transparency", but it is a pressing problem in all applications of machine learning. The reason, to some extent, is that humans would like to understand but also control if the learning algorithm has captured the "concepts" of the underlying classes if just predicts well using spurious features, artefacts in the data set, or other sources of error. In this paper, we focus on model-agnostic explanations which can, in principle, be applied to any image classifier and not rely on the specific structure of the classifier such as decision trees or linear classifiers. In this area, in particular for image classification, sensitivity based explanations [4], explanations based on feature attributions [3], saliency maps [47, 46, 17, 56, 51], Shapley additive explanations [31], and local fits of interpretable models [39] have been proposed. Morcover, [55] proposed counterfactual explanations (CEs), which are instance-specific explanations. They can be applied to any classifier and it has been argued that they are close the human justification of decisions [34] using counterfactual reasoning: would recognize it as zebra (instead of horse) it had black and white stripes." " For given classifier almost all methods for the generation of CEs [55, 15, 35, 6, 38, 54, 44] try to solve the following problem: "Given a target class e what is the minimal change 8 of input æ, such that + 5 is classified as class with high probability and is realistic instance of my data generating distribution?" From the perspective of "debugging" existing machine learning models, CEs are interesting they construct a concrete input x: + with different classification that allows the developer to test the model has learned the correct features.
'Equal contribution.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Original
Class orangutan: 0.97
Class 2 gorilla: 0.97
Original Chesupeake Bay ret.: 0.97
Class golden retriever: 0,93
Class 2 labrador retriever: 0.67
chimpanzee
0.88
BSickknh
Our method DVCE creates visual counterfactual explanations (VCEs) that explain any given classifier (here: non-robust ConvNeXt) by changing an image of one class into a similar target class by changing class relevant features while preserving the overall image structure.
Figure 1:
The main reason why visual counterfactual explanations (VCEs), that is CEs for image classification, are not widely used is that the tasks of generating CEs and adversarial examples [52] are very related. Even imperceivable changes of the image can already change the prediction of the classifier, however, the resulting noise patterns do not show the user the classifier has picked up the right class-specific features. One possible solution is using adversarially robust models [43, 1, 7J, which have been shown to produce semantically meaningful VCEs by directly maximizing the probability of the target class in image space. These approaches have the downside that they only can generate VCEs for robust models which is a significant restriction as these models are not competitive in terms of prediction accuracy. The second approach is to restrict the generation of VCEs using generative model or constraining the set of potential image manipulations [19, 20, 42. 8, 18, 45, 27]. However, these approaches are either restricted to datasets with a small number of classes, cannot provide explanations for arbitrary classifiers, or generate VCEs that look realistic but have so little in common with the original image that not much insight can be gained.
Recently, [26] trained a StyleGAN2 [24] model to discover and manipulate class attributes. While their approach yields impressive results on smaller-scale datasets with few similar classes (for example, different bird species), the authors did not demonstrate that the method scales to complex tasks such as ImageNet with hundreds of classes where different classes require different sets of attributes. Another disadvantage is that the StyleGAN model needs to be retrained for every classifier, making it prohibitively expensive explain multiple large models. Moreover, [25] have proposed loss to do VCEs in the latent space of a GAN/VAE. They show promising results for MNIST/FMNIST. but no code is available for ImageNet. Furthermore, explain a classifier, the conditional information during the generation of explanations should ideally come only from the classifier itself, but [25] rely on conditional GAN which might introduce bias.
In this paper, we overcome the aforementioned challenges and generate our Diffusion Visual Counter- factual Explanations (DVCEs) for arbitrary ImageNet classifiers (see Fig 1). We use the progress in the generation of realistic images using diffusion processes [48, 23, 49, 50], which recently were able to outperform GANs [14]. Similar to [37, 2]. we use classifier and distance-type regularization to guide the generation of the images. Two modifications to the diffusion process are key elements for our DVCEs: a combination of distance regularization and starting point of the diffusion process together with an adaptive reparameterization lets us generate VCEs visually close to the original image in controlled way so that hyperparameters ii) our cone regularization of the gradient of the classifier via an adversarially robust model ensures that the diffusion process does not converge trivial non-semantic changes but instead produces realistic images of the target class which achieve high confidence by the classifier. Our approach can be employed for any dataset where a generative diffusion model and an adversarially robust model are available. In a qualitative comparison, user study, and a quantitative evaluation (Sec, 4.1), we show that our DVCES achieve higher realism (according FID) and have more meaningful features (according to the user study) than both the recent methods of [7] and [2].
be fixed across images and even across models,
2 Diffusion models
Diffusion models [14, 48, 49, 23, 36] are generative models that consist of two steps: a forwwrd diffu- sion process (and thus Markov process) that transforms the data distribution to a prior distribution (which is usually assumed to be standard normal distribution) and the reverse diffusion process that

---

transforms the prior distribution back to the data distribution. The existence of the (continuous-timg reverse diffusion process was closer investigated in [50].
In the discrete-time setting, a Markov chain (f1,...,,TT for any data point in the forward direction defined via a Markov process that adds noise to the data point at each timestep:
(==(|==11) = -
(1)
where {B,.... 3r} is some variance schedule, chosen such that ((TT) ~ N 1). Note that given To. it is possible to sample from q( (zo) in closed form instead of applying noise times using:
q( mo) N 1- Rel), Ft = Vālzo + +evI- C., e~ C~N(),1).
(3)
where 0 : ==II 3x). In [48], the authors have shown that the reverse transitions g( (2;)) approach diagonal Gaussian distributions as - oc and thus one use DNN with parameters to approximate 11 as pu( (2) by predicting the mean and the diagonal covariance matrix po ( 1) and Eg( l):
pe(z1-1 = -N (Ne t), Eg (zr, t)).
(4)
To sample from po (zo), one samples æt from (V 7) and then follows the reverse process by repeatedly sampling from the transition probabilities p [mx))
Instead of predicting po(#,, t) directly, it has been shown in [23] that the best performance be achieved when a neural network eg (Iz, t) predicts the source noise e in (3). Then, the loss used for training resembles that of a denoising model:
Laimple (0, T, ((x))) == 1. ||e es t)l?
(5)
The mean of the reverse step in (4) can be derived [32] using Bayes theorem as:
Br ai
p ()
T4
co co(xx:)))
V1
B
This is, however, only one of the possible equívalent parameterization of the learning objective as shown in [32]. Because the objective Taimple does not give learning signal for Eg t), in practice one combines Lsimple with another loss based on variational lower bound of the data likelihood [48], which unlike Lismple allows us to learn the diagonal covariance matrix Eg(r,, t). Concretely, the network EØ (x( outputs additionally a vector that is used to parametrize Eg(x,,
2.1 Class conditional sampling
There exist diffusion models trained with and without knowledge about classes in the dataset [14, 22]. For our experiments, we only use the dasssunccndittionl diffusion model, such that all class- conditional features are introduced by the classifier that we want to explain. For the noise-aware classifier p& (yl...) IRd x fI, ..., T} - [0, 1), with parameters Φ, that is trained on noisy images corresponding to the various timesteps [14], the reverse process transitions are then of the form:
po,0(1,- | v) Z po (= (ax) Pa (v(
for normalization constant 7. As we would like to explain any classifier and not only noise-aware ones, we follow the approach of [2], where a classifier (v Rdd -> [0, is given as input the denoised sample &o = (x, of 2,, using the mapping:
fan : Rdd x (1,..., T} Tedd (Fr, 1)
Ft
VI (hea(ar,)) Var
(8)
This mapping, derived from (3), estimates the noise-free free image To using the noise approximated by the model eg (2), for a given timestep t. With this, we can define a timestep-aware posterior polu|ae, () for any classifier po(vl-) as P& (y (r,,
The issue is that efficient sampling from the original diffusion model is possible only because the reverse process is made of normal distributions. As need to sample from pe (xt-1 [2,, y) hundreds
3

---

of times to obtain a single sample from the data distribution, it is not possible to use MCMC-samplers with high complexity to sample from each of the individual transitions. In [14], they proposed to
solve it by approximating po. (Iz-1 ( y) with slightly shifted versions of po p0 (x4-1 (2x) to make closed-form sampling possible. Such transition kernels are given by:
Pe, p ( v) = (pe, (z(,,t)) f)), [4 no (are, 1) + Eo Eo( log logro(yl
(9)
(10)
which we further adapt for the goal of generating VCEs and use in our experiments.
Diffusion Visual Counterfactual Explanations
A VCE x for chosen target class y. given classifier pa(ul>) 1), and an input & should satisfy the following criteria: i) validity: the VCE z should be classified by (vl.) ) as the desired target class y with high predicted probability, ii) realism: the VCE should be close possible to natural image, iii) minimalityyccosennss:: the difference between the VCE x and the original image è should be the minimal semantic modification necessary to change the class, in particular, the generated image x should be close to å while being valid and realistic, e.g. by changing the object in the image and leaving the background unchanged. Note that targeted adversarial examples are valid but do not show meaningful semantic changes in the target class for a non-robust model and are not realistic. The I.S-SVCCS of [7] change the image in order maximize the predicted probability of the classifier into the target class inside an 11.5-ball around the image which is a targeted adversarial example. Thus this only works for robust classifiers and they use ImageNet classifier that was trained to be multiplc-norm robust (MNR), which we denote in this paper as MNR-RN50 (see Sec. 4.2). The realism of the -VCES comes purely from the generative properties of robust classifiers [43], which can lead to artefacts. In contrast, our Diffusion Visual Counterfactual Explanations (DVCEs) work for any classifier and our DVCEs are more realistic due the better generative properties of diffusion models. An approach similar to our DVCE framework is Blended Diffusion (BD) [2] which manipulates the image inside masked region. One can adapt BD for the generation of VCEs by using as mask the whole image. DVCE and BD share the same diffusion model. but BD cannot be applied to arbitrary classifiers and requires ipage-specific hyperparameter tuning, see Fig.
3.1 Adaptive Parameterization
For generating the DVCE of the original image é, we do not want to sample just any image x from p(zrly) (high realism and validity), but also to make sure that d(x, () is small. For this, have to condition our diffusion process on &. Using the denoising function fan and analogously to the derivation of (9) and its applications in [14, 27], the mean of the transition kernel becomes:
Ho(ae, 1) + Eo V), Cc log Pe (vl f)) - C. Ca fan(s,, t))].
(11)
where Co is the coefficient of the classifier, and Cs the one of the distance guiding loss. Intuitively, we take a step in the direction that increases the classifier score while staying close to å. Note that the last term can be interpreted as the log gradient of distribution with density exp(-Ca dy (., -)). where dā( :)= fan(. t)). Thus we introduce a aaneste--wware prior distribution that enforces output to be similar to a. In our work, we use the ( disttanec as it produces sparse changes.
Several works have tried to minimize some distance during the diffusion process, implicitly in [9] or explicitly, but for the background, in BD. However, there is no principled way to choose the coefficient for such regularization term. It turns out that it is impossible to find a parameter setting for BD that works across images and classifiers. Thus, we propose parameterization
V z, log (ol
V d(i,, fan (2,, t))
Jupdate C.
Cd [V d(, fan (Zt, t))
(12)
IV log pa (v) fan (It, 1))
which adapts to the predicted mean of the diffusion model that we use to change be in (10) to
er no (zr,, 1) + Eg (3te, () [| l) Pupdate-
(13)
This adaptive parameterization allows for fine- mne-grained control of the influence of the classifier and distance regularization so that now the hyperparameters C. and C. have the same influence across

---

Original
DVCEs
BDVCES C. 10
BDVCES C. 25
Ca
100
500
1000
100
500
1000
keeshond:
chow:
chow:
chow:
0.38
1,00
0.77
0.55
0.07
0.99
0.64
0.80
lyns: 0.72
cheetah: 0.99
cheetah: 0.67
cheetah: 0.38
cheetah: 0.77
chestah: 0.95
cheetah: 0,73
chectah:
0.98
wensel:: 0.41
guinea pig: 1.00
guinea pig: 0.86
guinea pig:
guinea
guinen pig:
guinen pig: 0.97
guinea pig:
Figure 2: DVCEs for the robust ENN--NN50 model [7] in the second column (ours) and using Blended Diffusion (BDVCEs) [2], such that regularization applied the whole image. Due to our adaptive parameterization, the same parameters (C₂ 0.1, C. 0.15) work for our DVCEs across different images and classifiers (see Fig. 5). For BDVCEs, it is difficult choose set of hyperparameters that, even for single classifier, work for multiple images. For BDVCEs, we report the parameter Ca of the LPIPS weight and the 1/ weightt 10 times as large (ratio used in [2]).
images and even classifiers. It facilitates the generation of DVCEs as otherwise hyperparameter finetuning would be necessary for each image as BD, see Fig. for comparison. However, even with our adaptive parameterization, it is still not easy to produce semantically meaningful changes close as can be seen App. B.2. Thus, as [2], we vary the starting point the diffusion process and observe in App. B.2 that starting from step T of the forward diffusion process, together with the adaptive parameterization and using as the distance the I didisttac,, provides us with sparse but semantically meaningful changes. In our experiments, we set T' 200.
3.2 Cone Projection for Classifier Guidance
key objective for our DVCEs that they can be applied any image classifier, adversarially robust or not. Diffusion with the new mean as in (13) does not work with non-robust classifier and leads to very small modifications of the image, which changes. The reason is that the gradients of non-robust classifiers are noisier and less semantically meaningful than those of robust classifiers. We illustrate this for non-robust Swin-TF [28] in Fig. where hardly any changes are generated. This even holds if we first denoise the sample using fan from (8) and average gradients of augmented images as in [2] (see Appendix B.6 for details).
similar to adversarial examples without meaningful
As a solution, we suggest projecting the gradient of an adversarially robust classifier with pa- centered at the gradient of the classifier,
rameters v. V., log Probust, e (wl/an (Ir4; ()), onto V. log Po (3 fan (zz, t)). More precisely, we define
Jproj = Paone(a, v. log Po (vl Vzz log Probust, (y San (a,, (zz,
where cone(a, v) == (w E Rdd (V, w) I a} is the cone of angle a around vector v and the projection Pcono(a..)) onto cone(a, u) given as:
Peonefa. [m] := (u, w) u, w,
((w, v) > a else,
where P., (w) = w
(w..)) (0.0) and n = san(a))
P. (w) [.. [w]]
+ cos(a) - (note ||u||| = 1). The
motivation for this projection is to reduce the noise in the gradient of the non-robust classifier. Note
5

---

Original
Non-robust
Robust
Cone Proj. weevil: 0.99
Original ringlet
Non-robust monarch: 0.47
Robust
Cone Proj.
ladyhug
weevil:
weevil: 1.00
monarch: 1.00
monarch:
0.99
0.98
Figure 3: DVCEs for the non-robust Swin- (win-TF[28]. robust MNR-RN50 model, and cone- cone-projected DVCEs for Swin- [Fin]. Similar to adversarial examples, guidance by the non-robust Sw does not yield semantically meaningful changes. In contrast, the DVCEs of the robust MNR-RN50 and the DVCE with cone projection for the Swin-TF(28) yield valid and realistic VCEs.
that the projection of the gradient of the robust classifier onto the cone generated by the non-robust classifier with angle a < 90 is always an ascent direction for log Pa fdm( which we would like to maximize (note that 9proj is not necessarily an ascent direction for log Probust, (yl (r,, t))). Thus, the cone projection is a form of regularization of Vz, logPa Pa (yl (1,, t)), which guides the diffusion process semantically meaningful changes of the image. The averaging over augmentations of xt has an additional regularizing effect, see Appendix B.6.
3.3 Final Scheme for Diffusion Visual Counterfactuals
Our solution for a non-adversarially robust classifier (v(l) is use Algorithm 1 of [14] by replacing the update step with:
V log Probuse, (vlfam w (Fe: ())]
Oproj Panne(a, V., log (ulfaa((ea)))
Oproj
V d(r, (an(,))))
Jupdate Ce 11@prosl12 Cd VIV I/V,, d(i, fdu (z,, 1))
14 po(oss t) Eo(r1, t) (2 f)ll Supdate,
p(2 [r,, &.. y) = Nu4,, Eo(r,, t)).
For an adversarially robust classifier the cone projection is omitted and one uses Jproj (zt,t)) t)) In all our experiments use C. 0.1, and Ca 0.15 unless Ve, log Probust, fal (an
we show ablations for one of the parameters. The angle a for the cone projection is fixed to 30%. In
strong contrast BD, these parameters generalize across images and classifiers.
4 Experiments
In this section, we evaluate the quality of the DVCE. We compare DVCE to existing works in Sec. 4.1. In Sec. 4.2, compare DVCEs for various state-of-the-art ImageNet models and show how DVCEs can be used to interpret differences between classifiers. For our DVCEs, we use for all experiments the fixed hyperparameters from Sec. 3.3. The diffusion model used for DVCE is from [14] and was trained class maasssunconiiionnllly on 256x256 ImageNet images using a modified UNet[40]. A user study, discovery of spurious features using VCEs, further experiments, and ablations are in the appendix.
4.1 Comparison of Methods for VCE Generation
We compare DVCEs with VCEs produced by BD (BDVCEs) and 4.. SVCES. As the latter only works for adversarially robust classifiers, we use the multiple-norm robust ResNet50 from [7], MNR- RN50, as the classifier to create VCEs for all three methods. As this model is robust on its own, we do not use the cone projection for its DVCEs.
First, in Fig. 4 we present a qualitative evaluation, where we transform one image into two different classes that are close to the true one in the WordNet hierarchy[33]. The radius of the ball of [7] chosen as the smallest r E [50, 75, 100, 150} such that the confidence in the target class is larger than 0.9 per image. For BD, we select the image with the smallest classifier and regularization weight that reaches confidence larger than 0.9 from the set of parameters discussed in Sec. 3.3. If 0.9 not reached by any setting for one of the two baselines, show the image that achieves the highest

---

Original
Target class
Target class
DVCEs (ours)
1.5 SVCEs (7)
BDVCES [2]
DVCEs (ours)
f SVCES [7]
BDVCEs [2]
misbed potato: 0.25
guacamole::
guacamole:
guacumole:
cat bonara:
Car barbonara:
cabronara:
1.00
0.91
0.90
1.00
0.95
0.99
cheetah: 1,00
leupard: 0.96
leupard: 0.90
levpurd: 0.39
liger:
1.00
0.97
0.94
cheesburger: 0.54
pizza:
pizza:
pizzat
posple: 0.99
polple: 0.90
polpie: 0.82
hognose snake: 0.49
king snake: 1.00
king snake: 0.98
king snake: 0.98
snake: 0.71
snake: 0.82
snake: 0.47
dingo: 0.85
timher wolf: 0.98
timber wolf: 0.97
timber woll: 0.77
white wolf: 0.98
white wolf: 0.97
white wolf: 0.92
promontory: 0.66
alp: 1.00
alp: 0.90
alp:
0,82
1.00
0.99
0.96
Figure 4: Comparison of different VCE-methods the robust MNR-RN5K (taken from [7]). We show for each original image (outer left column) and for each target class DVCEs (left column), the S1.s-VCEE
[7] (middle), and the adaptation of BDVCEs [2] (right). Only DVCEs satisfy all desired properties of VCEs. BD fails for leopard and tiger and often produces images far away from the original one (pizza, potpie, timber wolf, white wolf, and alp). 4 -SVCSs show artefacts (white wolf, volcano, night snake) and have often lower image quality.
confidence. As Fig. shows, DVCE is the only method that satisfies all desired properties of VCEs. For example, for "mashed potato", DVCE preserves the bowl and only changes the content into either guacamole or carbonara. Our qualitative comparison shows that the same hyperparameter setting of DVCE can handle different classes and transfer between similar classes, such different snakes or wolf types, as well as different object sizes, e.g. cheetah and snake.
In contrast, both 41.5 SVCEs and BDVCEs require different hyperparameters for different images to achieve high confidence in the target class. Even with six parameter configurations, BD not able to always produce images with high confidence in the target class. More problematic for VCEs that the resulting images can have high confidence but are neither realistic (cheetah - tiger) resemble the original image at all (dingo - timber wolf/white wolf). Even if the method works

---

with the given parameters, for example, mashed potato + guacamole or carbonara, the overall image quality cannot match that of DVCE as often the images contain overly bright colors. In the case of the volcano VCE, DVCE shows class features like lava whereas BDVCE can not clearly be labeled as volcano. For the 1.5-SVCRs, one often needs large radii to achieve the desired confidence of 0.9, which often results in images that do not look realistic.
As noted in [7], quantitative analysis of VCEs using FID scores is difficult as methods not changing the original image have low FID score. Thus, we have developed a cross-over evaluation scheme, where one partitions the classes into two sets and only analyzes cross-over VCEs (more details are in App. E). We show the results in Tab. 1. In terms of closeness. DVCEs are worse than [1.s SVCEs, which can be expected as they optimize inside an 11.5-ball However, DVCE are the most realistic ones (FID score) and have similar validity as 41.--VCEE BDVCEs are the worst in all categories.
Moreover, have conducted user study (20 users), in which participants decided if the changes of the VCE are meaningful or subtle and if the generated image is realistic, see App. C for details.
The percentage of total images having the three different properties is (order: DVCEs, 4 -VCES, BD): meaningful- 62.0 %. 48.4%, 38,7%; realism- 34.7%, 24.6%, 52.2% %:: subtle- - 45.0%. 50.6%, 31.0%. This confirms that DVCEs generate more meaningful features in the target classes. While the result regarding realism seems to contradict the quantitative evaluation, this is due to fact that realism means that the user considered the image realistic irrespectively if it shows the target class or not.
Closeness
Validity
Realism
Metric
4 4
41.5
4
la 4 [PIPS-AAex Mean Conf. 1 Avg. FID J
DVCEs (ours)
12799
293
48
0.35
0.932
17.6
LLC-SVCEs[[]
5139
139
26
0.20
0.945
25.6
Blended [iffusion[2]]
35678
722
108
0.58
0.825
27.9
Table 1:
Quantitative evaluation of VCEs. DVCEs outperform BDVCEs [2] in all metrics. Moreover, they achieve comparable to -VCES Mean Conf. (validity), while outperforming them significantly in Avg. FID. (realism) but do larger changes to the image than SVCE (closeness).
4.2 Model comparison
Non-robust models. In Fig. 5 we show that DVCEs can be generated for various state-of-the- art ImageNet [41] models. We EfficieetNet-B7 [57, 53). Both the Swin-TF and the ConvNeXt are pretrained on ImageNet2 Ik [13] whereas the EfficientNet uses noisy-student self-training on a large unlabeled pool. As all models do not yield perceptually aligned gradients, we use the cone projection with 30 angle described in Sec. 3.2 with the robust model from the previous section. All other parameters are identical to the previous experiment. We highlight that DVCE is the first method capable of explaining (in the sense of VCEs) arbitrary classifiers on task as challenging as ImageNet. Overall, DVCEs satisfy all desired properties of VCEs. It also allows us to inspect the most important features of each model and class. For the stupa and church classes, for example, it seems like all models use different roof and tower structures as the most prominent feature as they spent most of their budget on changing those.
Swin-TF-L[28], ConvNeXt-L [29] and Noisy -StudeSt
Robust models. Here, we evaluate the DVCEs of different robust models trained be multiple-norm adversarially robust. They are generated by multiple norm-finetuning []] an initially 4y-rroustt model to become robust with respect 11-, 12- and 1.x -threat models. Specifically an 12-robust ResNet50 [16] results in MNR-RN50 used in the previous sections, an -robust XCTT-transformer model [12]- in MNR-XCIT in the following and an 4oo -rbustt DeiT-transformee [5] - in MNR-Dei Their multiplenorrm robust accuracies can be found in [11]. In [7], different -n-oorm ad adversarially robust models were compared for the generation of VCES and they showed that for their SVCES the multiple norm robust model was better (both in terms of FID and qualitatively) than individual 1p-norm robust classifiers. This the reason why we also use a multiple-nove norm robust model for the cone-projje cone-projection of a non-robust classifier. In Fig. 6, we show DVCEs of the three different classes for two examples images and two target classes each. All of the multiple-norm robust models have similarly good DVCEs showing classifier-specific variations in the semantic changes. This proves again the generative properties of adversarially robust models, in particular of robust transformers. More examples and further experiments are in App. B.4.
8

---

Original
Target Class Co leatberback: 0.98
Target Class 2
Swin TF leatherback: 0.93
EfficienNNet Leabbrbackk 0.96
Swin: TF box turtle: 0.96
ConvNeXi box turtle: 0.99
EfficientNet box turtle: 0.97
loggerbead
black and golden ganden spider
black widow:
black widow: 0.97
black widow: 0.97
lurantula: 0.97
larantula: 0.98
tarantula: 0.98
0.95
sea urehin
sea cucumber: 0.98
sea cucumber: 0.97
New cucumber:
starlish: 0.99
starlish: 0.97
starfish: 0.98
ben the
2EGAITE: 0.95
MyTomiie::: 0.98
Hyromiira:: 0.98
gyromitra:: 0.98
woods
0.95
0.97
lonkeet
macaw: 0.98
MACAW:
MaCIW:
african grey: 0.99
aircan grey: 0.96
african grey: 0.45
mosque
stupa:: 0.97
stupa: 0.98
stupa: 0.98
church: 0.89
church: 0.94
church: 0.96
red wolf
coyote:
coyote:
coyote:
timber woll:
limber woll:
limber woll:
pineupple
Jackfruit: 0.97
jackfruite 0.96
jackfruit: 0.96
apple:
apple:
apple:
0.95
0.97
0.99
Figure 5: DVCEs for three non-robust classifiers: Swin- (F(n) ConvNeX:[29] and EfficientNet(57]] For each original image (outer left column) show DVCEs into target classes. Please zoom into the images to see more fine- one-grained details and differences.

---

Original
Target Class 1
Target Class 2
MNR RN50
MNR XCIT
MNR DeiT Liner ship: 1.00
MNR RN50 container ship:
MNR XCIT
MNR MNR-DeiT
pirate snup
liner ship: 1.00
liner ship: 1.00
container ship: 1.00
Container ship: 1.00
1.00
mashed polato
dough: 1.00
dough: 1.00
dough: 1.00
Cur curbonara: 1.00
carbonara: 1.00
Carbonara:
1.00
Figure 6: We compare DVCEs for three different robust models (no cone projection) which are all fine-tuned to be multiple-none norm adversarially robust [11], that is against 4,, l2 and loc -eeetuurbbatins. More examples can be found in Fig. 10.
5 Limitations, Future Work and Societal impact
In comparison to GANs, diffusion-based approaches can expensive to evaluate as they require multiple iterations of the reverse process create sample. This can be issue when creating large amount VCEs and makes deployment in time-sensitive setting challenging. We also rely show that standard classifiers do not yield the desired gradients, training robust models can be challenging. An interesting direction for future research is thus replace the cone projection with another "denoising" procedure for the gradient of a non-robust model.
robust model during the creation of VCEs for the
projection. While
From a theoretical standpoint, using conditional sampling with reverse transitions of the form (7) is justified, in practice, however, we have to approximate the reverse transitions with shifted normal distributions of the form (9). This approximation relies the conditioning function having low curvature, and it can be hard to verify this once we start adding a classífier, distance and other possible terms and it unclear how this influences the outcome of the diffusion process.
The guantitative evaluation of VCEs is difficult, as the standard FID metric compares the distribution and generated dataset. However, for VCEs it is not only
of features of classifier over important to generate realistic images, but also to achieve high confidence and to create meaningful changes. Moreover, metries such as IM1, IM2 [30] for VCEs rely on a well-trained (V)AE for every class, which is difficult to achieve for dataset with 1000 classes and high-resolution images. Future research should therefore try to develop metries for the quantitative evaluation of VCEs and we think that the evaluation in Tab. is the first step in that direction.
DVCEs and VCEs general help to discover biases of the classifiers and thus have a positive societal impact, however one can abuse them for unintended purposes as any conditional generative model.
6 Conclusion
We have proposed DVCEs, a novel way to create VCEs for any state-of-the-arr ImageNet classi- fier using diffusion models and cone projection. DVCEs can handle vastly different image configurations, object sizes, and classes and satisfy all desired properties of VCEs.
Acknowledgement
The authors acknowledge support by the DFG Excellence Cluster Machine Learning New Perspec- tives for Science, EXC 2064/1, Project number 390727645 and the German Federal Ministry of Education and Research (BMBF): Tübingen AI Center, FKZ: 01IS18039, as well as the DFG grant 389792660 as part of TRR 248.
10

---

References
[1] Maximilian Augustin, Alexander Meinke, and Matthias Hein. Adversarial robustness on in- and out-distribution improves explainability. In ECCV, 2020.
[2] Omri Avrahami, Dani Lischinski, and Ohad Fried. Blended diffusion for text-driven editing of natural images. CVPR, 2022.
[3] Sebastian Bach, Alexander Binder, Frederick Klauschen Gregoire Montavon, Klaus-Robert Müller, and Wojciech Samek. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PLoS One, 2015.
[4] David Baehrens, Timon Schroeter, Stefan Harmeling, Motoaki Kawanabe, Katja Hansen, and Klaus-Robert Müller. How to explain individual classification decisions. JMIR, 2010.
[5] Yutong Bai. Jieru Mci, Alan Yuille, and Cihang Xie. Are transformers more robust than enns? In NeurIPS, 2021.
[6] Solon Barocas, Andrew D. Selbst, and Manish Raghavan. The hidden assumptions behind counterfactual explanations and principal reasons. In FAT, 2020.
[7] Valentyn Boreiko, Maximilian Augustin, Francesco Croce, Philipp Berens, and Matthias Hein. Sparse visual counterfactual explanations in image space. In GCPR, 2022.
[8] Chun-Hao Chang, Elliot Creager, Anna Goldenberg, and David Duvenaud. Explaining image classifiers by counterfactual generation. In ICLR, 2019.
[9] Jooyoung Choi, Sungwon Kim, Yonghyun Jeong, Youngjune Gwon, and Sungroh Yoon. Ilvr: Conditioning method for denoising diffusion probabilistic models. In ICCV, 2021.
[10] EU Commission. Regulation for laying down harmonised rules on Al. European Commission,
2021.
[11] Francesco Croce and Matthias Hein. Adversarial robustness against multiple ty-threat models the price of one and how to quickly fine-tune robust models to another threat model. In ICML, 2022.
[12] Edoardo Debenedetti. Adversarially robust vision transformers. Master's thesis, Swiss Federal Institue of Technology, Lausanne (EPFL), 2022.
[13] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: a large-scale hierarchical image database. In CVPR, 2009. License: No license specified.
[14] Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans image synthesis. In NeurIPS, 2021.
[15] Amit Dhurandhar, Pin- Chen, Ronny Luss, Chun-Chen Tu, Paishun Ting, Karthikeyan Shan- mugam, and Payel Das. Explanations based the missing: Towards contrastive explanations with pertinent negatives. NewrIPS, 2018
[16] Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robust- ness (python library), 2019, License: MIT.
[17] Christian Etmann, Sebastian Lunz, Peter Maass, and Carola-Bibiane Schönlieb. On the connec- tion between adversarial robustness and saliency map interpretability. In ICML, 2019.
[18] Yash Goyal, Ziyan Wu, Jan Ernst, Dhruv Batra, Devi Parikh, and Stefan Lee. Counterfactual visual explanations. In ICML, 2019.
[19] Lisa Anne Hendricks, Zeynep Akata, Marcus Rohrbach, Jeff Donahue, Bernt Schiele, and Trevor Darrell. Generating visual explanations. In ECCV, 2016.
[20] Lisa Anne Hendricks, Ronghang Hu, Trevor Darrell, and Zeynep Akata. Grounding visual explanations. In ECCV, 2018.
[21] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge to local nash equilibrium. In NeurIPS. 2017.
[22] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NeurIPS Workshop, 2021.
[23] Pieter Abbeel Jonathan Ho, Ajay Jain. Denoising diffusion probabilistic models. NeurIPS, 2020.

---

[24] Tero Karras, Samuli Laine, Mika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of StyleGAN. In CVPR, 2020.
[25] Saeed Khorram and Li Fuxin. Cycle-consistent counterfactuals by latent transformations. In CVPR, 2022.
[26] Oran Lang, Yossi Gandelsman, Michal Yarom, Yoav Wald, Gal Elidan, Avinatan Hassidim, William T. Freeman, Phillip Isola, Amir Globerson, Michal Irani, and Inbar Mosseri. Explaining in style: Training gan explain classifier in stylespace. In ICCV, 2021.
[27] Xihui Liu, Dong Huk Park, Samanch Azadi, Gong Zhang, Arman Chopikyan, Yuxiao Hu, Humphrey Shi, Anna Rohrbach, and Trevor Darrell. More control for free! image synthesis with semantic diffusion guidance. In WACV, 2023.
[28] Ze Liu, Fand Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In ICCV, 2021.
[29] Zhuang Liu, Hanzi Mao, Chao- Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. In CVPR, 2022.
[30] Arnaud Looveren and Janis Klaise. Interpretable counterfactual explanations guided by proto- types. In ECML, 2021.
[31] Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. In NeurIPS, 2017.
[32] Calvin Luo. Understanding diffusion models: A unified perspective. arXiv preprint, arXiv:2208. /1970, 2022.
[33] George A. Miller. Wordnet: lexical database for english. Commun. ACM, 1995.
[34] Tim Miller. Explanation in artificial intelligence: Insights from the social sciences. Artificial Intelligence, 2019.
[35] Ramaravind K. Mothilal, Amit Sharma, and Chenhao Tan. Explaining machine learning classifiers through diverse counterfactual explanations. FAceT, 2020.
[36] Alex Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In ICMI., 2021.
[37] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. In JCML, 2022.
[38] Nick Pawlowski, Daniel Coelho de Castro, and Ben Glocker. Deep structural causal models for tractable counterfactual inference. In NeurIPS, 2020.
[39] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. "why should i trust you?": Explaining the predictions of any classifier. In KDD, 2016.
[40] Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In MICCAI, 2015.
[41] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy. Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. Imagenet large scale visual recognition challenge. I/C,, 2015. License: No license specified.
[42] Pouya Samangouci, Ardavan Saeedi, Liam Nakagawa, and Nathan Silberman. Explaingan: Model explanation via decision boundary crossing transformations. In ECCV, 2018.
[43] Shibani Santurkar, Dimitris Tsipras, Brandon Tran, Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Image synthesis with a single (robust) classifier. In NeurlPS, 2019.
[44] Lisa Schut, Oscar Key, Rory McGrath, Luca Costabello, Bogdan Sacaleanu, Medb Corcoran, and Yarin Gal. Generating interpretable counterfactual explanations by implicit minimisation of epistemic and aleatoric uncertainties. In AISTATS, 2021.
[45] Kathryn Schutte, Olivier Moindrot, Paul Hérent, Bean-Baptiste Schiratti, and Simon Jégou. Using stylegan for visual interpretability of deep learning models on medical images. In NeurIPS Workshop. 2020.
12

---

[46] Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das. Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. IJCV, 2019.
[47] Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. In ICLR, 2014.
[48] Jascha Sohl- Dicksteii, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. ICML, 2015.
[49] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In ICLR, 2021.
[50]
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In ICLR, 2021.
[51] Suraj Srinivas and François Fleuret. Full-gradient represstatonnn for neural network visualization. In NeurlPS, 2019.
[52] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
[53] Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In ICML, 2019.
[54] Sahil Verma, John P. Dickerson, and Keegan Hines. Counterfactual explanations for machine learning: A review. arXiv preprint, arXiv:2010.1000 10596, 2020.
[55] Sandra Wachter, Brent Mittelstadt, and Chris Russell. Counterfactual explanations without opening the black box: Automated decisions and the GDPR. Harvard Journal of Law & Technology, 2018.
[56] Zifan Wang, Haofan Wang, Shakul Ramkumar, Matt Fredrikson, Piotr Mardziel, and Anupam Datta. Smoothed geometry for robust attribution. In NeurIPS, 2020.
[57] Qizhe Xie, Minh-Thang Luong, Eduard Hovy, and Quoe V. Le. Self-training with noisy student improves imagenet classification. In CVPR, 2020.
[58] Richard Zhang, Phillip Isola, Alexei Efros, Eli Shechtman, and Oliver Wang. The unreason- able effectiveness of deep features as perceptual metric. In CVPR, 2018.
13

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See Sec.
(c) Did you discuss any potential negative societal impacts of your work? [Yes] See Sec.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or URL)? [Yes] See supplemen- tal material.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [N/A] We didn't train models.
(c) Did you report error bars (e-g., with respect the random seed after running experi- ments multiple times)? [N/A] We have conducted qualitative experiments in the main paper for the same seed and show the diversity of VCEs across seeds in App. B.3.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [Yes] See App. D
4. If you using existing assets (e.g., code, data, models) or curating/releasing
assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes] Yes, directly in the citation, when applicable.
(c) Did you include any new assets either in the supplemental material or as URL? [Yes] We include our code in the supplemental material.
(d) Did you discuss whether and how consent was obtained from people whose data you't 're using/curating? [N/A] ImangeNet and ImageNet2 Ik are public datasets.
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [Yes] We include the results from the user study together with the screenshots of instructions in App. C.
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A] Not applicable.
(c) Did you include the estimated hourly wage paid participants and the total amount spent on participant compensation? [Yes] See App. C.
14


Reviews:
[{"review_id": "xCchB7n3PQN", "reviewer": "Reviewer_djLx", "summary": "The authors propose a framework to generate visual counterfactual explanations using diffusion processes. In order to generate non-trivial and close to input CFs, the authors modify the diffusion process accordingly: by introducing a distance function in the diffusion process and the choice of the starting point, adaptive re-parameterization, and cone projection of the gradient (using a robust classifier) as regularization. ", "questions": "- I suggest the authors discuss the fail cases of the method and show some examples. \n- I suggest the authors add a closely related work [1] in their discussions\n- I suggest the authors add Supp B.4 to the main paper.\n\n[1] Khorram and Fuxin. Cycle-Consistent Counterfactuals by Latent Transformations. CVPR 2022. \n", "limitations": "The authors have discussed the limitations. ", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The authors focus on an important topic of generating realistic CF examples. \n- The paper is well-written and easy to follow.\n- The authors have made novel contributions by adapting diffusion models into generating CF images.\n- The experiments show the effectiveness of the proposed method against baselines.\n\nWeaknesses:\n- A key factor in generating realistic CFs using the proposed method is the existence of an adversarially robust model which is not often the case. \n- No quantitative comparison in terms of the realism/validity/closeness of the generated CFs. \n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "tL8GB2k8SHv", "reviewer": "Reviewer_j44j", "summary": "This paper introduces a method to generate visual counterfactual examples (VCEs) using a diffusion model. Given a classifier we would like to explain, the method generates counterfactuals that are realistic and minimal perturbations of a query image and change the query's predicted class. Realism is obtained using a diffusion model as an image prior. The method is similar to other VCEs except using a diffusion model to enforce realism, and the main contributions are the specific techniques used to guide a diffusion model toward generated VCEs.", "questions": "My main questions and suggestions are the following:\n\n1. I did not find the evaluation to be completely convincing. I would like to see stronger quantitative evidence that DVCEs are better explanations than the baselines/ablations. This could be quantitative measures of validity/realism/minimality, more convincing user studies, or other metrics that get more at the heart of the \"usefulness\" of the explanations.\n\n2. I would be interested in seeing Section 4.2 greatly expanded. I think the big thing missing from the paper is a demonstration that we can use DVCEs to actually get insight into different classifiers -- see their biases, understand their weaknesses, pick which of two is better, etc. Section 4.2 barely scratches the surface of these questions, but it is a good start.\n", "limitations": "The limitations are adequately discussed.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I found this to be an interesting paper. The method is sensible and the results are decent. I found the evaluation partially convincing, but with some weaknesses. I will elaborate on these dimensions below:\n\n**Originality**\nThe main contributions of this paper are in the details. The paper takes two fairly well-established things, VCEs and diffusion models, and puts them together. The exact way they are combined seems reasonable, but also not all that different than other work that uses classifiers or score functions of various kinds to guide generative models. At a glance, the results look quite similar to text/classifier-guided image manipulation. Nonetheless, the target application is slightly different than general image manipulation (rather it is VCE generation) and the specific details (adaptive parameterization, cone-projection) are, to my knowledge, novel.\n\n**Quality** \nThe method appears to be sound, and the quality of the results is high, at least along the three criteria the paper targets -- validity, realism, minimality. The qualitative comparisons do seem to show the advantages of DVCEs over baselines and ablations, but I'm wary of reading too much into qualitative results. The user study was not terribly convincing -- DVCEs only win on one out of three metrics.\n\n**Clarity**\nThere are two issues with the writing that could be improved:\n1. The math was hard for me to follow. This is in part because the derivations refer to a lot of results from previous works. I would appreciate if the math could be made more self-contained. It also feels like the method is actually pretty simple and could be stated more plainly, e.g., Eqn 10 could be explained as: \"take a step in the direction that increases the classifier score while not moving too far away from $\\hat{x}$\" (this is just an example, my point is just that some of the mathiness could be translated into plainer English, alongside the formal derivations). Equation 6 was especially hard for me to parse and I'm not sure I understand what is intended (although I think I get how $f_{\\text{dn}}$ works).\n2. In my opinion, the paper somewhat overclaims the contributions. There are three primary ways. First, it is emphasized a few times (e.g., Line 22) that DVCEs are model-agnostic and can be applied to any classifier, and that this distinguishes them from past work. However, results are only shown on ImageNet classifiers, and, as the paper mentions, a prereq is having a diffusion model and robust classifier for the domain. This was not quite what I expected from a method described as \"model-agnostic\" and that (line 56) \"overcomes\" the need for retraining for each new classifier (retraining is still needed if you deviate from ImageNet). Second, the success of the user study is overclaimed. Line 68 says DVCEs outperform baselines on the user study, but in fact out of three user study metrics DVCEs were best on just one. The paper argues that, taken holistically, the user study shows that DVCEs are best, but I wouldn't say that's home run evidence. Third, the paper claims (e.g., line 156) that DVCEs \"can be applied to any image classifier regardless of whether it is adversarially robust or not.\" I find this slightly misleading, since a robust classifier is still required. It could be rephrased as something like \"can be applied to any image classifier as long as you are given a robust image classifier for that same task.\"\n\n**Significance**\nI believe the paper studies an important topic, and contributes a tool that indeed seems useful. However, in some ways the paper is a step back from other recent work in this area. For example, whereas DVCEs only show one counterfactual, [21] shows multiple counterfactuals, along different visual dimensions. The DVCE results look very similar to text-guided image editing, and indeed this is apparent in the use of an image editing paper, [2], as one of the baselines. This raises the question: what exactly distinguishes the kinds of VCEs presented here from the kind of results in papers like [2] (which did not target counterfactual explanation). The contribution would be clearer if there were metrics or applications of DVCEs that were specific to the goal of _explaining_ classifiers. What do we learn about different classifiers from these visualizations? Can our gain in understanding be measured? These questions are barely addressed by the present paper. From a practical standpoint, the applicability of the method is limited by the requirement of a robust classifier for the task and a good diffusion model for the domain.\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "m0jAHj45XpZ", "reviewer": "Reviewer_BaB4", "summary": "The paper focuses on model-agnostic visual counterfactual explanation (VCE). The proposed method builds on the diffusion model and generates counterfactual samples for the target class with minimal changes. The authors first handle the robust classifier by using adaptive parameterization. And then they solve the non-robust classifier by projecting the gradient of a robust classifier onto the cone of the non-robust classifier. They experiment on ImageNet classifier and demonstrate qualitatively for dozens of examples. ", "questions": "1. How do you select the project angle (30 degrees)? Is it empirically determined? \n2. Is $\\Sigma_{\\theta}$ diagonal? If so, does that mean each feature/pixel of the generated sample is independent?\n3. With the projection of the gradient for the non-robust classifier, how hard is the training? ", "limitations": "See the above. ", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\nAlthough it is not new to use the diffusion model for generating counterfactual samples, the proposed method is new in the sense that it has no constraint on the classifier to be explained. In addition, the proposed method can handle a bigger class set. The qualitative results support their claim overall. \n\nWeaknesses:\nIt seems to depend on a robust classifier anyway. As stated in the paper, the computational expense might be high because of the time-related generative process. More importantly, there are no quantitative comparisons between models, which makes it hard to evaluate. Although it is hard to design quantitative metrics for VCE, it is still possible to measure validity and closeness. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "jHxkdCYtbL", "reviewer": "Reviewer_W3sJ", "summary": "This paper focus on generating Visual Counterfactual Explanations (VCE) for any arbitrary classifier using diffusion models. Prior work generates VCE reliably on adversarial robust models or generative models limited to smaller number of classes. This work leverages diffusion models to generate realistic and minimal semantically altered VCE examples. The authors propose to condition the generated image on the target class using the desired classifier and condition on the original image with L1 distance regularization. The parameterization of such formulation allowed to fix the hyperparameters across different images and models i.e. no need to finetune the hyperparameters of diffusion process for different images and models. Inspired by prior works that shown VCEs are reliably generated on adversarially robust models, authors leverage such robust models and align the gradients of non-robust models with robust models using cone projection. Such projection enabled to generate VCEs reliably for arbitrary classifier. Qualitative results show that the proposed method generates VCE better than the existing works.", "questions": "Please refer Weakness above.", "limitations": "Authors addressed the limitations and negative impact.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1)\tPaper is well written and motivation of the problem formulation is clearly explained.\n2)\tFormulation for the class conditioning and distance regularization is clear.\n3)\tProposed cone projection of the gradients of non-robust classifier on to the gradients of robust classifier helped to generate semantically meaningful VCEs for non-robust classifiers.\n4)\tGenerated VCEs are semantically meaningful and perceptually looks improved than the baselines.\n\nWeakness:\n1)\tGenerally lacking a quantitative measure to evaluate the generated VCEs. Evaluation is mainly performed with visual inspection.\n2)\tAs the integration of cone projection shown to be helpful, however it is not clear why this particular projection is chosen. Are there other projections that are also helpful? Is there a theoretical proof that this cone projection resolves the noise of the gradients in non-robust classifiers?\n\nOverall, I think the proposed technique yield better VCE and interesting for the community. I also think that the strengths outweigh the weakness. However, I would be open to hear other reviewers opinion here.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept