On the explainable properties of 1-Lipschitz Neural Networks: An Optimal Transport Perspective
Authors: Mathieu Serrurier
Franck Mamalet
Thomas FEL
Louis Béthune
Thibaut Boissin
Venue: NeurIPS 2023 poster (2023)
Keywords: 1-Lipschitz neural network
explicability
TL;DR: 1-Lipschitz neural networks with optimal transport dual loss yield concentrated, low-noise saliency maps, enhancing explainability and robustness both empirically and theorically

Abstract: Input gradients have a pivotal role in a variety of applications, including adversarial attack algorithms for evaluating model robustness, explainable AI techniques for generating saliency maps, and counterfactual explanations. However, saliency maps generated by traditional neural networks are often noisy and provide limited insights. In this paper, we demonstrate that, on the contrary, the saliency maps of 1-Lipschitz neural networks, learnt with the dual loss of an optimal transportation problem, exhibit desirable XAI properties:
They are highly concentrated on the essential parts of the image with low noise, significantly outperforming state-of-the-art explanation approaches across various models and metrics. We also prove that these maps align unprecedentedly well with human explanations on ImageNet. To explain the particularly beneficial properties of the saliency map for such models, we prove this gradient encodes  both the direction of the transportation plan and the direction towards the nearest adversarial attack. Following the gradient down to the decision boundary is no longer considered an adversarial attack, but rather a counterfactual explanation that explicitly transports the input from one class to another.  Thus, Learning with such a loss jointly optimizes the classification objective and the alignment of the gradient , i.e. the saliency map, to the transportation plan direction. These networks were previously known to be certifiably robust by design, and we demonstrate that they scale well for large problems and models, and are tailored for explainability using a fast and straightforward method.

On the explainable properties of 1-Lipschitz Neural Networks: An Optimal Transport Perspective
Mathieu Serrurier'
Franck Mamalet
Thomas Fe1
Louis Béthune
Thibaut Boissin
Université Paul-Sabatier, IRIT, Toulouse, France
Institut de Recherche Technologique Saint-Exupéry. Toulouse, France
Carney Institute for Brain Science,Brown University, USA
Innovation & Research Division, SNCF, France
Abstract
Input gradients have a pivotal role in a variety of applications, including adversarial attack algorithms for evaluating model robustness, explainable AI techniques for generating Saliency Maps, and counterfactual explanations. However, Saliency Maps generated by traditional neural networks are often noisy and provide limited insights. In this paper, we demonstrate that, on the contrary, the Saliency Maps of I-Lipschitz neural networks, learned with the dual loss of optimal transportation problem, exhibit desirable XAI properties: They are highly concentrated on the essential parts of the image with low noise, significantly outperforming state-of-the art explanation approaches across various models and metrics. We also prove that these maps align unprecedentedly well with human explanations on ImageNet. To explain the particularly beneficial properties of the Saliency Map for such models, we prove this gradient encodes both the direction of the transportation plan and the direction towards the nearest adversarial attack. Following the gradient down to decision boundary is no longer considered an adversarial attack, but rather counterfactual explanation that explicitly transports the input from one class another. Thus, Learning with such loss jointly optimizes the classification objec- tive and the alignment of the gradient, i.c. the Saliency Map, to the transportation plan direction. These networks were previously known to be certifiably robust by design, and we demonstrate that they scale well for large problems and models, and are tailored for explainability using a fast and straightforward method.
Introduction
The Lipschitz constant of function expresses the extent which the output may vary for small shift the input. As composition of numerous functions, the Lipschitz constant of a neural network can be arbitrarily high, particularly when trained for classification task g Adversarial attacks [45] exploit this weakness by selecting minor modifications, such as imperceptible noise, for given example to change the predicted class and deceive the network. Consequently, Saliency Maps 59 gradient output with respect to the input -, serve as the basis for most adversarial attacks and often highlight noisy patterns that fool the model instead of meaningful modifications, rendering them generally unsuitable for explaining model decisions. Therefore, several methods requiring more complex computations, such as SmoothGrad [61]. Integrated Gradient [64], Grad- CAM (55), have been proposed to provide smoother explanations. Recently, the XAI community has investigated the link between explainability and robustness and proposed methods and metrics
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

accordingly [35 12 42 53]. However, the reliability of those automatic metrics can be compromised
by artifacts introduced by the baselines [35] 63
38 30,, and there no conclusive evidence demonstrating their correlation with the human understanding of explanations. To address this, study by [2 suggests completing those metrics with the alignment between attribution methods and human feature importance using the ClickMe dataset 43
31
In [56). authors propose to address the weakness with respect to adversarial attacks by training 1- Lipschitz constrained neural networks with loss that is the dual of an optimal transport optimization problem, called hKR (Eq. D.. The resulting models have been shown to be robust with a certifiable margin. We refer to these networks as Optimal Transport Neural Networks (OTNN) hereafter.
In this paper, demonstrate that OTNNs exhibit valuable explainability properties. Our experiments reveal that OTNN Saliency Maps significantly outperform various attribution methods for uncon- strained networks across all tested sfate-of-the-art Explainable XAI metrics. This improvement is consistent across toy datasets, large image datasets, binary, and multiclass problems. Qualitatively, OTNN Saliency Maps concentrate on crucial image regions and generate less noise than maps of unconstrained networks, as illustrated in Figure | Figure [ presents the Saliency Maps of an OTNN based on ResNer50 alongside its unconstrained vanilla counterpart, both trained on ImageNet [6 In the unconstrained case, the Saliency Maps appear sparse and uninformative, with the most critical pixels often located outside the subject. Conversely, the OTNN Saliency Map is less noisy and highlights significant image features. This distinction is emphasized in Figure[]d) comparing the feature visualization of the two models. Feature visualization extracts the inverse prototypical image for given class using gradient ascent [48 47 The results for vanilla ResNet are noticeably noisy, making class identification difficult. In contrast, feature visualization with OTNN yields clearer results, displaying easily identifiable features and classes (e.g., goldfish, butterfly, and medusa). Furthermore, modifying the image following the gradient direction provides an interpretable method for altering the image to change its class. Pictures a and [b) display the original image, the gradient direction, and the transformation following the gradient direction (refer to Section 4 for details). We observe explicit structural changes in the images, transforming them into an example of another class in both multiclass (MNIST) and high-resolution multi-labels cases (c.g., smile/not smile and blond hair/not blond hair classification). Lastly, large-scale human experiment demonstrates that these maps are remarkably aligned with human attribution on ImageNet (Fig.
We provide a theoretical justification for the well-behaved OTNN Saliency Maps. Building upon the fact that OTNNs encode the dual formulation of the optimal transport problem, we prove that the gradient of the optimal solution at given point x is both (i) in the direction of the nearest adversarial example on the decision boundary, and (ii) in the direction of the image of x according to the underlying transport plan. This implies that adversarial attacks for OTNN are equivalent to traversing the optimal transport path which can be achieved by following the gradient. Consequently, the resulting modification serves both explaining why the decision was A and not B [40]. An optimal transport plan between two classes can be interpreted as global approach for constructing counterfactuals, as suggested in [5 These counterfactuals may not correspond to the smallest transformation for a given input sample but rather the smallest transformation on average when pairing points from two classes. A consequence of this property is that the Saliency Map of an OTNN for an image indicates the importance of each pixel in the modifications needed change the class. It is worth noting that several methods based on GAN (36] or causality penalty [37] produce highly realistic counterfactual images. However, the objective of our paper is not to compete with the quality of these results, but rather demonstrate that OTNN Saliency Maps possess both theoretical and empirical foundations as counterfactual explanations.
adversarial attack and a counterfactual explanation,
We summarize our contributions as follows: first, after introducing the background OTNN and XAI, we establish several properties of the gradient of an OTNN with respect to adversarial attacks, decision boundaries, and optimal transport. Second, we establish that the optimal transport properties of OTNN's gradient lead to a reinterpretation of adversarial attacks as counterfactual explanations, consequently endowing the Saliency Map with the favorable XAI properties inherent in these explanations. Third, our experiments support the theoretical results, showing that metric scores are higher for most of the XAI methods on OTNN compared unconstrained neural networks. Additionally, we find that the Saliency Map for OTNN achieves top-ranked scores on XAI metrics compared more sophisticated XAI methods, and is equivalent Smoothgrad. Lastly, drawing from [22), we emphasize that OTNNS are naturally and remarkably aligned with human explanations, and we present several examples of gradient- based counterfactuals obtained with OTNNs.
2

---

a)
c)
d)
7
OTTN
ResNet50
OTTN
ResNet50
6
<
3
5
8
9
7
Figure 1: Illustration of the beneficial properties of OTNN gradients. Examples a) and b) show that the gradients naturally provide direction that enables the generation of adversarial images a theoretical justification based on optimal transport provided in Section 3. By applying the gradient x'' x [z) to the original image æ (on the left), any digit from MNIST can be transformed into its counterfactual x' (e.g.. turning a into 5). In b), we illustrate that this approach can be applied to larger datasets, such Celeb-A, by creating two counterfactual examples for the closed-mouthe and blonde classes. c), we compare the Saliency Map of a classical model with those of OTNN gradients. which are more focused on relevant elements. Finally, in d), we show that following the gradients of OTNN could generate convincing feature visualizations that ease the understanding of the model's features.
2
Related work
1-Lipschitz Neural network and optimal transport: Consider a classical supervised machine learning binary classification problem on (S,, P) the underlying probability space where Ω the sample space, J a r-algebra on Ω2 and is probability measure on F. We denote the input space X' C IRd and the output space y = {+1}, Let input data æ: Ω - X and target label y: Q -> y are random variables with distributions Pa. Py. respectively. The joint random vector
(x. (2, F) has a joint distribution P defined over the product space X' x V. Moreover, let μ = P( ly = 1) and v = P = -1) the conditional probability distributions of x given the true label. We assume that the supports of S?, μ and are compact sets.
is I-Lipschitz functions over X' (denoted Lipı (X') and only if 2) {z) f(=)ll < x ==I. 1-Lipschitz neural networks have received lot of attention, especially due the link with adversarial attacks. They provide certifiable robustness guarantees [22 49, improve the generalizations (62) and the interpretability of the model (67] The simplest way to constrain a network to be in Lip1 (X)) is to impose this I-Lipschitz property to each layer. Frobenius normalization [54], spectral normalization
function f X - +
[46] can be used for linear layers, and can also be
extended, in some situations, to orthogonalization
66 6).
Optimal transport, I-Lipschitz neural networks, and binary classification were first associated in the context of Wasserstein GAN (WGAN) [7]. The discriminator of WGAN is the solution the Kantorovich Rubiissten dual formulation of the 1- Wassersstei distance [69], and it can be regarded as a binary classifier with carefully chosen threshold. Nevertheless, it has been demonstrated in [56] that this type of classifier is suboptimal, even on toy dataset. In the same paper. the authors address the suboptimality of the Wasserstein classifier by introducing the hKR loss ChKR, which adds a hinge regularization term to the Seantorovich-Rubissteee optimization objective
ChKR (f)
[f(x]] - E [f(x)] + E (m -f(())) xー
(I)
(M
3

---

where m > 0 is the margin, and (z)+ = max (0, 2). We note f the optimal minimizer of 2 The classification is given by the sign of f In the following, the I-Lipschitz neural networks that minimize & will be denoted as OTNN. Given a function f. classifier based on sign (f) and an example æ, adversarial example is defined as follows:
adv(f, = arg min || x - 2 s.t. sign(f(z)) + sign(f())).
ZEX
Since f is 1-Lipschitz function, (x) ) is a certifiable lower bound of the robustness of the classification of (i.e. Vx [f*)())) - || ado(f*,=))l) The function f has the following properties [56] (i) if the supports of μ and // are disjoints (separable classes) with minimal distance o > 0, then for m < 2c, f achieves 100% accuracy; (ii) minimizing L is still the dual formulation of an optimal transport problem (see appendix for more details).
Attribution methods aim to explain the prediction of deep neural network by pointing out input variables that support the prediction - -typccally pixels or image regions for images which lead to importance maps. Saliency (59] was the first proposed white- box attribution method and consists of paok-propagating the gradient from the output to the input. The resulting absolute gradient heatmap indicates which pixels affect the most the decision score. However, this family of methods suffers from problems inherent to the gradients of standard models. Methods such as Integrated Gradient [64] and SmoothGrad [6]] partially address this issue by accumulating gradients, either along straight interpolation path from a baseline state to the original image or from a set of points close the original image obtained after adding noise but multiply the computational cost by several orders of magniuude. These methods were then followed by plethora of other methods using gradients such as Grad-cam (55) or Input Gradient 4 All rely on the gradient calculation of the classification score. Finally, other methods sometimes called black-box attribution methods- - do not involve the gradient and rely on perturbations around the image to generate their explanations [50 20
Explainability and metrics:
However, becoming increasingly clear that current methods raise many issues 2
33 60 such
as confirmation bias: it is not because the explanations make sense to humans that they reflect the evidence of the prediction. To address this challenge, a large number of metrics were proposed to provide objective evaluations of the quality of explanations. Deletion and Insertion methods [50) evaluate the drop in accuracy when important pixels are replaced by a baseline. j/Fidelity method [9] evaluates the correlation between the sum of importance scores of pixels and the drop of the score when removing these pixels. parallel, a growing literature relies on model robustness to derive new desiderata for good explanation 35 12
21. In addition, (35] showed that some of these metrics also suffer from a bias due to the choice of the baseline value and proposed new metric called Robustness-Si. This metric assesses the case to generate adversarial example when the attack is limited to the important variables proposed by the explanation. Other metrics consider properties such as generalizability, consistency (23), or stability [74, 9 of explanation methods. recent approach [43] aims to evaluate the alignment between attribution methods and human feature importance across 200,000 unique ImageNet images (called ClickMe dataset). The alignment between DNN Saliency and human explanations is quantified using the mean Spearman correlation, normalized by the average inter-rater alignment of humans.
53
These works on explainability metries have also initiated the emergence of links between the ro- bustness of models and the quality of their explanations [14 72 57 58 18 19]. In particular, [ claimed that I-Lipschitz networks explanations have better metrics scores. But this study was not on OTNNs and was limited to their proposed metrics.
To end with, recent literature is focusing on counterfactual explanations information on "why the decision was A and not B". Several properties are desirable for these counterfactual explanations [68]: Validity (close sample and in another class), Actionability, Sparsity, Data Manifold closeness. and Causality. The three last properties are generally not covered by standard adversarial attacks and complex methods have been proposed [2
methods, providing
52 71 Since often a causal model is hard to fully-define, recent papers [1] 15) have proposed definition of counterfactual based on optimal transport easier to compute and that can sometimes coincide with causal model based ones. We will rely this theoretical definition of counterfactuals.

---

3 Theoretical properties of OTNN gradient
In this section, we extend the properties of the OTNNs the explainability framework, all the proofs are in the appendix A.I. We note the optimal transport plan corresponding to the minimizer of C In the most general setting, и a joint distribution over j4, V pairs. However when μ and y admit density function [5T] with respect to Lebesgue measure, then the joint density describes deterministic mapping, i.e. a Monge map. Given a (resp. 2) we note
7 (a:) E (resp. μ4) the image of with respect to v. When is not deterministic (on real datasets that are defined as discrete collection of Diracs), we take (xx) the point of maximal mass with respect to
Proposition 1 (Transportation plan direction) Let f an optimal solution minimizing the C Given x ~ y (resp. v) and z Yo (2:), then 31 (resp. & 0) such that Y (a: = x - [=) almost surely.
This proposition also holds for the Cantorovich-Ruuinneee dual problem without hinge regularization, demonstrating that for æ ~ P. the gradient v=f*(x) indicates the direction in the transportation plan almost surely.
Proposition 2 (Decision boundary) Let μ and two distributions with disjoint supports with min- imal distance e and f an optimal solution minimizing the ChKR with m 2e. Given a ~ P, 26 = x the 0 level set of )*
(a: V v (xx) E OX where 0X = ={x' E fx)' 0} is the decision boundary (i.e.
Experiments suggest this probably remains true when the supports of μu and v proves that for an OTNN f learnt by minimizing the C [x)) provides a tight robustness certificate. A direct consequence of is that defined in such such that |t] 2 (x)).
disjoint. Prop.
Let μu and two separable distributions with minimal distance and f an optimal solution minimizing the C with m 2c, given P, adv(f", xx) = Eg almost surely, where I5 1===-ff-m = af
Corollary
This corollary shows that adversarial examples are precisely identified for the classifier based on ChK the direction given by Vz)*((x) and distance by [x)] [==)(( = =If((x)] scenario, the optimal adversarial attacks align with the gradient direction (i.e.. FGSM attack [27]).
In this
This supports the observations made in (56), where all attacks, such as PGD 45 or Carlini and
Wagner [3] applied on an OTNN model, were equivalent to FGSM attacks.
To illustrate these propositions, we learnt dense binary classifier with 2 separate two complex distributions, following two concentric Koch snowflakes. Fig shows the two distributions (blue and orange snowflakes), the learnt boundary (0-Ievelset) (red dashed line). Fig show for random samples from the two distributions, the segments [x. ætg where I, is defined in Prop. 2 As
expected by Prop. 2 Is points fall exactly on the decision boundary. Besides, as stated in Prop.]] each segment provides the direction of the image with respect to the transport plan.
Finally, we showed that with OTNN, adversarial attacks are formally known and simple to compute. Furthermore, since proved that these attacks are along the transportation map, they acquire meaningful interpretation and are no longer mere adversarial examples exploiting local noise, but rather correspond to the global solution of transportation problem.
4 Link between OTNN gradient and counterfactual explanations
The vulnerability of traditional networks to adversarial attacks indicates that their decision boundaries are locally flawed, deviating significantly from the Bayesian boundaries between classes. Since the gradient directs towards this anomalous boundary, Saliency Maps [59], given by g(x) = V f f=))( (=)] fails to represent a meaningful transition between classes and then often lead to noisy explanation (as stated in Section 2)
On the contrary, the experiments, we will demonstrate that OTNN gradients induce meaningful explanations (Sec. 5). We justify these good properties by building link with counterfactual
5

---

V ffcl
(a)
(b)
(c)
Figure 2: Level sets of an OTNN classifier f for two concentric Koch snowflakes (a). The decision boundary (denoted 0X,, also called the O-level set) is the red dashed line. Figure (b) (resp. (c)) represents the translation of the form x' a - f V=) of each point a of the first class (resp second class). (ar, ær] pairs are represented by blue (resp. orange) segments.
explanations. Indeed, according to [1 optimal transport plans are potential surrogates or even substitutes to causal counterfactuals. Optimal Transport plan provides for any sample æ E μ a sample Ya (a) E v,, the closest in average the pairing process. [15] prove that these optimal transport plans can even coincide with causal counterfactuals when available. Relying on this definition of OT counterfactual, Prop. demonstrates that gradients of the optimal OTNN solution provide almost surely the direction to the counterfactual Yn (a) = x tV ff Even if is only partially known, using t f (x), we know that øş is on the decision boundary (Corr. and is both an adversarial attack and a counterfactual explanation and it| 2 f (x)l is on the path to the other distribution.
Thus the learning process of OTNNs induces strong constraint on the gradients of the neural network, aligning them to the optimal transport plan. We claim that is the reason why the simple Saliency Maps for OTNNS have very good properties: We will demonstrate in the Sec thatt, for the Saliency Map explanations:
(i) metrics scores are higher or comparable to other explanation methods (which not the case for unconstrained networks), thus it has higher ranks; (ii) distance other attribution methods such as Smoothgrad is imperceptible; (iii) scores obtained on metrics that can be compared between networks are higher than those obtained with unconstrained networks; (iv) alignment with human explanations is impressive.
5
Experiments
We conduct experiments with networks learnt on FashionMNIST (73.. and 22 binary labels of CelebA 44 datasets, Cat vs Dog (binary classification, 224x224x3 uncentered images), and Ima- genet 17 Note that labels in CelebA are very unbalanced (see Table 2 in Appendix A.2, with for instance less than 5% samples for Mustache or Wearing_Hom
Architectures used for OTNNs and unconstrained networks are similar (same number of layers and neurons, VGG for FashionMNIST and CelebA, a ResNet50 for Cat vs Dog and Imagenet). We also train an alternative of ResNet50 OTNN with twice the number of parameters (50 M). Unconstrained networks use batchnorm and ReLU layers for activation, whereas OTNNs only GroupSort2 (5] (66 activation. OTNNs are built using the DEEL. library, using Björek orthogonalization projection algorithm for linear layers. Note that several other approaches can be used for orthogonalization without altering the theoretical results; these might potentially enhance experimental outcome scores. The loss functions are cross-entropy for unconstrained networks (categorical for multiclass, and sigmoid for multilabel settings), and hKR R (and the multiclass variants see appendix A.2.3) for OTNNs. We train all networks with Adam optimizer given in Appendix A.2.
39 Details on architectures and parameters
http::///gthuuu.com//eelaa/aaa/a distributed under MIT License (MIT)

---

Dataset
Fash. MNIST
CelebA
Cat VS Dog
Imagenet
OTNN
Unest.
OTNN
Unest.
OTNN Unest.
OTNN
Unest.
Attribution
J.FidelityUniform
(f is better)
Saliency
0.156
-0.001
0.244
0.052
0.091
0.080
0.240
0.004
SmoothGrad
0.114
-0.001
0.248
0.018
0.012
-0.004
0.001
-0.002
Integ. Grad.
-0.005
-0.013
0.149
0.093
0.022
0.024
0.046
0.022
Grad. Input
-0.017
-0.009
0.168
0.074
0.013
0,009
0.009
0,000
GradCam
0.215
0.02
0.028
0.002
0.101
0.052
0.029
0.046
Attribution
jFFideity-Zeer
(1 is better)
Saliency
0.246
0,034
0.325
0.082
0.121
0.079
0.147
0.049
SmoothGrad
0.332
0.052
0.324
0.091
0.011
-0.004
0.001
0.002
Integ. Grad.
0.543
0.134
0.400
0.125
0.037
0.027
0.057
0.023
Grad. Input
0.479
0.079
0.439
0.093
0.019
0.004
0.020
-0.001
GradCam
0.161
0.046
0.127
0.061
0.136
0.049
0.048
0.068
Attribution
Stability
Spearman rank (L is better)
Saliency
0.59
0.91
0.51
0.77
0.58
0.69
0.60
0.74
SmoothGrad
0.55
0.82
0.52
0.95
0.64
0.82
0.62
0.82
Integ. Grad.
0.61
0.79
0.52
0.87
0.61
0.76
0.60
0.74
Distance Saliency smoothgrad ( is better)
Saliency 7.5e-03
7.0e-02
3.1e-4
1.4e-1
3.7e-8
4.1e-8
3.7e-8
4.3e-8
Table I: Comparison of XAI metries for different attributions methods and dataset for OTNN and unconstrained networks.
Classification performance: OTNN models achieve comparable results to unconstrained ones, confirming claims of [8: they reach 88.5% average accuracy on FashionMNIST (Table 6). and 81 % (resp. 82%) average Sensitivity (resp. Specificity) over labels on CelebA (Table 6 in Appendix A.3). We use Sensitivity and Specificity for CelebA to take into consideration the unbalanced labels. OTNNs achieve 96% accuracy (98% for the unconstrained version) on Cat vs Dog and 67% (75% for the unconstrained version) on Imagenet. The ResNet50 OTNN with 50M parameters achieves 70% accuracy on Imagenet.
We present the results of quantitative evaluations of XAI metrics to compare the Saliency Map method with other explanation methods on OTNN, and more generally compare XAI explanations methods on these networks and their unconstrained counterparts. On CelebA, we only present the results for the label Mustache, but results for the other labels are similar. Parameters for explanation methods and metrics are given in Appendix A.4. We have chosen to present in TTble/[[wo SoTA XAI metries that enable comparison between OTNNs and unconstrained networks. j/Fidelity metric [)] well-known method that measures the correlation between important variables defined by the explanation method and the model score decreases when these variables are reset to bascline state (or replaced by uniform noise). Another important property for explanations is their stability for nearby samples. In [74,, the authors proposed Stability metrics based on the L2 distance. To better evaluate this stability and make it comparable for different models, replace the L2 distance by 1 1- P. P being the Spearman rank correlation. Other model-dependent metrics are described in the Appendix. Results from the 50M parameter ResNet OTNN are included in the human alignment study (Fig 4 to illustrate that enhancing the model's complexity can bolster both the accuracy and alignment. The following observations be drawn from Table 1
Saliency Map on OTNNS exhibit more fidelity and stability We confirm and amplify the results in 23 Table. D clearly states that for most of the explanation methods, the μFiieeliyy zero or uniform, is significantly higher for OTNNs. And above all, Saliency Map score for OTNNs is always higher than any other attribution method score for unconstrained models. A similar observation holds for the Stability Spearman rank : OTNN scores are better whatever the attribution method.
Saliency Map method on OTNNs is equivalent to other attribution methods:
We observe that the scores from the Saliency Maps and other methods are very similar for OTNN, with Saliency Maps consistently ranking among the top attribution methods. For the unconstrained case, Saliency Maps are occasionally outperformed by other attribution methods. Notably, for the ResNet archi- tecture, attribution methods other than Saliency Maps and GradCAM yield more erratic results for
7

---

Saliency
SmoothGrad
(a) OTNN
(b) Unconstrained
Figure 3: Comparison of Saliency Map and SmoothGrad explanations for (a) OTNN and (b) unconstrained network for, from left to right, CelebA, Cat vs Dog and Imagenet datasets.
fidelity metrics. To highlight these results, we compare the L2 distance between Saliency Maps and SmoothGrad explanations, as suggested by [2 23 65 26). The explanation distances for OTNN are significantly lower than for the unconstrained ones and closely approach zero, indicating that for OTNN, averaging over large set of noisy inputs-as in SmoothGrad-is is unnecessary. This is illustrated Fig
OTNNs explanations are aligned with human ones: Adopting the method presented in 43 using the ClickMe dataset, we follow strictly their experimental methodology and use their code to compute the human feature alignment of OTNN Saliency Maps and compare with the others models tested in [22] more than 100 recent deep neural networks. In Figure 4 we demonstrate that OTNN models Saliency Maps, which also carries a theoretical interpretation as the direction of the transport plan, more aligned with human attention than any other tested models and significantly surpasses the Pareto front discovered by [22]. The OTNN model is even more aligned than ResNet50 model trained with a specific alignment objective, proposed by [22] and called Harmonized ResNer50. This finding is interesting and better capture human visual strategies for object recognition. The implications of these results crucial for both cognitive science and industrial applications. A model that more closely aligns with human attention and visual strategies can provide a more comprehensive understanding of how vision operates for humans, and also enhance the predictability, interpretability, and performance of object recognition models in industry settings. Furthermore, the drop in alignment observed in recent models highlights the necessity of considering the alignment of model visual strategies with human attention while developing object recognition models to reduce the reliance on spurious correlations and ensure that our models get things right for the right reasons.
it indicates OTNNs are less prone to relying on spurious correlations [25]
Using the learnt OTNN on FashionMNIST, CelebA (Mouth Slightly Open label), Cat Dog and Imagenet, Fig. 6 present the original image, average gradients Waff over the channels, and images in the direction of the transport plan (Prop. D.. other samples are given in Appendix A.5. We can that most of the gradients are visually consistent, showing clearly what has to be changed in the input image to modify the class and act as a counterfactual explanation. This less clear for the Imagenet examples. This could be due the difficulty of defining transport plan for each pair of the 1000 classes. However, feature visualizations in Figure I show that the internal representation of the classes is still more interpretable than the unconstraint one. More generally, observe that the gradient gives clear information about how the classifier makes its decision. For instance, for the cat, it shows that the classifier does not need encode perfectly the concept of cat, but mainly to identify the color of the eyes and size of the nose.
Qualitative results:
6 Conclusions and broader impact
In this paper, we study the explainability properties of OTNN (Optimal Transport Neural Networks) that are 1-Lipschitz constrained neural networks trained with an optimal transport dual loss. We

---

0.7
Human feature alignement (%)
0.6
OTNN LARGE
OTTE
Harmonized
0.5
Self-supervised
ConvNet
0.4
Rdv.
Robust
Transformer
0.3
Bigger dataset
Harmonized
0.2
1-Lipschitz
CbmnNNck
VTT
0.1
SimCLR
Swin
0.0
55
60
65
70
75
80
85
Imagenet accuracy
Figure 4: OTNN are aligned with Human attention. Our study shows that the Saliency Map of OTNN model is highly aligned with human attention.
Dress
Pullover
Shirt
Sneaker
Sandal
Bag
Ankle boot
Top
Shirt
Trouser
Coat
Figure 5: Samples of counterfactuals for FashionMNIST dataset on different classes and targets: (left) source image, (center) gradient image, (right) counterfactual of the form æ t fz()) for >>
establish that the gradient of the optimal solution aligns with the transportation plan direction, and the closest decision boundary point (adversarial example) also lies in this gradient direction at distance of the absolute value of the network output. Relying on formal definition of Optimal Transport counterfactuals, we build link between the OTNN gradients and counterfactual explanations We thus show that OTNNs loss jointly targets the classification task and induces gradient alignment to the transportation plan. These beneficial properties of the gradient substantially enhance the Saliency Map XAI method for OTNN s. The experiments show that the simple Saliency Map has top-rank scores on wate-of-thhearr XAI metrics, and largely outperforms any method applied unconstrained networks. Besides, as far as we know, our models are the first large provable I-Lipschitz neural models that match state-of-the-e results on large problems. And even if counterfactual explanations are less compelling on Imagenet, probably due to the complexity of transport for large number of classes, prove that OTNNs Saliency Maps are impressively aligned to human explanations.
Broader impact. This paper demonstrates the value OTNNs for critical problems. OTNNs are certifiably robust and explainable with the simple Saliency Map method (highly aligned with hu- man explanations) and have accuracy performances comparable to unconstrained networks. networks.Though Though OTNNs take 3-6 times longer to train than unconstrained networks, they have similar computational costs during inference. We hope that this contribution will raise a great interest these OTNN networks.

---

CelebA
mouth closed
mouth opened
mouth opened
mouth closed
CclebA
blurry
not blurry
not blurry
blurry
CelebA
rosy cheeks
w/o rosy cheeks
w/o rosy cheeks
rosy cheeks
Cat vs Dog
cat - dog
dog + cat
Imagenet
cabbage butterfly monarch butterfly
great grey owl bald eagle
Figure 6: Samples of counterfactuals from different datasets: (left) source image, (center) gradient image, (right) counterfactual of the form + f( for
Acknowledgments and Disclosure of Funding
This work has benefited from the Al Interdisciplinary Institute ANITI, which is funded by the French "Investing for the Future PIA3" program under the Grant agreement ANR-19-P31A-00044 The authors gratefully acknowledge the support of the DEEL project
References
[1] E. M. Achour, F. Malgouyres, and F. Mamalet. Existence, stability and scalability of orthogonal convolutional neural networks, 2021.
[2] Adebayo, J. Gilmer, M. Muelly, Goodfellow, M. Hardt, and B. Kim. Sanity checks for saliency maps. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS' 18, page 9525-9536. Red Hook. NY, USA, 2018, Curran Associates Inc.
https: bttpp://www.ddett deel.
10

---

[3] L. Ambrosio and A. Pratelli. Existence and stability results in the LI theory of optinal transportation, pages 123-160. Springer Berlin Heidelberg, Berlin, Heidelberg, 2003.
[4] M. Ancona, E. Ceolini, A. C. Öztireli, and M. H. Gross. A unified view of gradient-based attribution methods for deep neural networks. CoRR, 2017.
[5] C. Anil, J. Lucas, and R. Grosse. Sorting Lipschitz function approximation. In K. Chaudhuri and R. Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 291-301, Long Beach, California, USA, June 2019. PMLR.
[6] A. Araujo, A. J. Havens, B. Delattre, A. Allauzen, and B. Hu. A unified algebraic perspec- tive on lipschitz neural networks. In The Eleventh International Conference on Learning Representations, 2023.
[7] M. Arjovsky, S. Chintala, and L. Bottou. Wasserstein generative adversarial networks. In D. Precup and W. Teh, editors, Proceedings of the 34th International Conference on Ma- chine Learning, volume 70 of Proceedings of Machine Learning Research, pages 214-223, International Convention Centre, Sydney, Australia, Aug. 2017. PMLR.
[8] L. Béthune, A. González-Sanz, F, Mamalet, and M. Serrurier. The many faces of I-lipschitz neural networks. CoRR, abs/2104.05097, 2021.
[9] U. Bhatt, A. Weller, and J. M. F. Moura. Evaluating and aggregating feature-based model explanations, In Proceedings of the Tweett-Ninth International Joint Conference on Artificial Intelligence, IJCAI-20, 2020.
[10] Á. Björck and C. Bowie. An Iterative Algorithm for Computing the Best Estimate of an Orthogonal Matrix. SIAM Journal on Numerical Analysis, 8(2):358-34,, June 1971.
[11] E. Black, S. Yeom, and M. Fredrikson. Fliptest: Fairness auditing via optimal transport. CoRR, abs/ htss/996.0021e 2019.
[12] A. Boopathy, S. Liu, G. Zhang, C. Liu, P.-Y. Chen, S. Chang, and L. Daniel. Proper network interpretabiliit helps adversarial robustness in classification. In International Conference on Machine Learning, 2020.
[13] N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39-57. IEEE, 2017.
[14] P. Chalasani, J. Chen, A. R. Chowdhury, S. Jha, and X. Wu. Concise explanations of neural networks using adversarial training. In Proceedings of the 37th International Conference on Machine Learning (ICML), 2020.
[15] L. de Lara, A. González-Sanz, N. Asher, and J.-M. Loubes. Transport- counterfactual models. 0rxiv:2108.13025. 2021.
[16] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. ImageNet: A Large-Scale Hierarchical Image Database. In CVPR09, 2009.
[17] J. Deng, W. Dong, R. Socher, L.J. K. Li, and L. Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. Icee, 2009.
[18] A.-K. Dombrowski, C. J. Anders, K.-R. Müller, and P. Kessel. Towards robust explanations for deep neural networks. volume 121, page 108194, 2022.
[19] C. Eumann, S. Lunz, P. Maass, and C.-B. Schönlieb. On the connection between adversarial robustness and saliency map interpretability, In International Conference on Machine Learning. 2019.
[20] T. Fel, R. Cadène, M. Chalvidal, M. Cord, D. Vigouroux, and T. Serre. Look at the variance! efficient black-box explanations with sobol-based sensitivity analysis. CoRR, abs/211 1.04138. 2021.
11

---

[21] Fel, M. Ducoffe, D. Vigouroux, R. Cadene, M. Capelle, C. Nicodeme, and T. Semee Don't t lie to me! robust and efficient explainability with verified perturbation analysis. arXiv preprint arXiv:2202.07728, 2022.
[22] T. Fel, I. Felipe, D. Linsley, and T. Serre. Harmonizing the object recognition strategies of deep neural networks with humans. Advances in Neural Information Processing Systems (NeurIPS), 2022.
[23] T. Fel, D. Vigouroux, R. Cadène, and T. Serre. How Good your Explanation? Algorithmic Stability Measures to Assess the Quality of Explanations for Deep Neural Networks. In 2022 CVF Winter Conference on Applications of Computer Vision (WACV), Hawaii, United States, Jan. 2022.
[24] Fel, Thomas and Hervier, Lucas. Xplique: neural networks explainability toolbox. 2021.
[25] R. Geirhos, J. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, and A. Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2(1 2(11):665-63 673,, 2020.
[26] A. Ghorbani, A. Abid, and J. Zou. Interpretation of neural networks is fragile. In Association for the Advancement of Artificial Intelligence, 2017.
[27] J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv:1412.6653 [stat.MI.), Dec. 2014.
[28] Y. Goyal, Z. Wu, J. Emstt D. Batra, D. Parikh, and S. Lee. Counterfactual visual explanations. In Proceedings of the 36th International Conference on Machine Learning (ICML), 2019.
[29] I. Guirajani, F. Ahmed, M. Arjovsky, V. Dumoulin, and A. C. Courville. Improved training of wasserstein gans. CoRR, abs/ 001110440000222 2017.
[30] Hase, H. Xie, and M. Bansal. The methods for feature importance explanations. NeurlPS, 2021.
problem in explainability and search
[31] J. Haug, S. Zür, P. El-Jiz, and G. Kasneci. On baselines for local feature attributions. arXiv preprint arXiv:2101.00905 2021.
[32] M. Hein and M. Andriushchenko. Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation. arXiv:1705.088 08475 [es, stat], May 2017.
[33] J. Heo, S. Joo, and T. Moon. Fooling neural network interpretations via adversarial model manipulation. In Advances in Neural Information Processing Systems, volume 32, 2019.
[34] C. Hsieh, C. Yeh, X. Liu, P. K. Ravikumar, S. Kim, S. Kumar, and C. Hsieh. Evaluations and methods for explanation through robustness analysis. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
[35] C.-Y. Hsieh, C.-K. Yeh, X. Liu, P. Ravikumar, S. Kim, S. Kumar, and C.-J. Hsieh. Evaluations and methods for explanation through robustness analysis. In International Conference on Learning Representations, 2021.
[36] Jacob, É. Zablocki, H. Ben- You-es M. Chen, Pérez, and M. Cord. STEEX: steering counterfactual explanations with semantics. CoRR, abs/211 .09094, 2021.
[37] A.-H. Karimi, B. Schölkopf. and I. Valera. Algorithmic recourse: from counterfactual expla- nations to interventions. In ACM Conference on Fairness, Accountability, and Transparency, pages 353-362, 2021.
[38] P.J. Kindermans, S. Hooker, J. Adebayo, M. Alber, K. T. Schütt, S. Dähne, D. Erhan, and B. Kim. The (un) reliability of saliency methods. 2019.
[39] D. P. Kingma and J. Ba. Adam: A method for stochastic optimization. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
12

---

[40] D. Lewis. Causation. Journal of Philosophy, 70(17):556- 567, 1973.
[41] Q. Li, S. Haque, C. Anil, J. Lucas, R. B. Grosse, and J. Jacobsen. Preventing gradient attenuation in lipschitz constrained convolutional networks. PrXiiv/911..00
Apr. 2019.
[42] Z. Q. Lin, M. J. Shafiee, S. Bochkarev, M. S. Jules, X. Y. Wang, and A. Wong. Do explanations reflect decisions? a machine-centric strategy quantity the performance of explainability algorithms. In NIPS, 2019.
[43] D. Linsley, S. Eberhardt, T. Sharma, P. Gupta, and T. Serre. What are the visual features underlying human versus machine vision? In Proceedings the IEEE International Conference on Computer Vision Workshops, pages 2706-2714 2017.
[44] Z. Liu, P. Luo, X. Wang, and X. Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), Dec. 2015.
[45] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. ArXiv, 2017.
[46] Miyato, Kataoka, M. Koyama, and Yoshida. Spectral normalization for generative adversarial networks. ArXiv,
2018.
[47] A. Nguyen, J. Yosinski, and Clune. Multifaceted feature visualization: Uncovering the different types of features learned by each neuron in deep neural networks. Visualization for Deep Learning workshop, International Conference in Machine Learning, 2016. arXiv preprint arXiv:1602.03616.
[48] C. Olah, A. Mordvintsev, and L. Schubert. Feature visualization. Distill, 2(1 2017.
[49] H. Ono, T. Takahashi, and K. Kakizaki. Lightweight Lipschitz Margin Training for Certified Defense against Adversarial Examples. arXiv:/811.0000 [cs, stat), Nov. 2018.
[50] V. Petsiuk, A. Das. and K. Saenko. RISE: randomized input sampling for explanation of black-box models. CoRR, abs/1800.07421, 2018.
[51] G. Peyré and M. Cuturi. Computational optimal transport. Foundations and Trends in Machine Learning, 1((-6)):355200 2018
[52] Rodriguez, M. Caccia, A. Lacoste, L. Zamparo, Laradji. L. Charlin, and D. Vazquez. Beyond trivial counterfactual explanations with diverse valuable explanations. In Int. Conf in Computer Vision (ICCV), 2021.
[53] A. Ross, H. Lakkaraju, and O. Bastani. Learning models for actionable recourse. NeurIPS, 2021.
[54] T. Salimans and D. P. Kingma. Weight normalization: A simple reparameterization to accelerate training of deep neural networks. CoRR, abs/1602.07866. 2016.
[55] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra. Grad-CAM: Visual explanations from deep networks via gradient-based localization. International Journal of Computer Vision, 128(2):336-35, oct 2019.
[56) M. Serrurier, F. Mamalet, A. González-Sanz, T. Boissin, J.-M. Loubes, and E. Del Barrio. Achicving robustness in classification using optimal transport with hinge regularization. In Conference Computer Vision and Pattern Recognition (CVPR') 21), 2021.
[57] H. Shah, P. Jain, and P. Netrapalli. Do input gradients highlight discriminative features? In M. Ranzato, A. Beygelzimer, Y. Dauphin, P. Liang, and J. W. Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 2046-2059, 2021.
[58] H. Shah, P. Jain, and P. Netrapalli. Do input gradients highlight discriminative features? In M. Ranzato, A. Beygelzimer, Y. Dauphin, P. Liang, and J. W. Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 2046-2059. Curran Associates, Inc., 2021.
13

---

[59] K. Simonyan, A. Vedaldi, and A. Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. Bengio and Y. LeCun, editors, 2nd International Conference Learning Representations, ICLR 2014, Banjf, AB, Canada, April 14-16, 2014, Workshop Track Proceedings. 2014.
[60] L. Sixt, M. Granz, and T. Landgraf. When explanations lie: Why many modified bp attributions fail. In International Conference on Machine Learning, 2020.
[61] D. Smilkov, N. Thorat, B. Kim, F. Viégas, and M. Wattenberg. Smoothgrad: removing noise by adding noise, 2017.
[62] J. Sokolic, R. Giryes, G. Sapiro, and M. R. D. Rodrigues. Robust large margin deep neural networks. IEEE Transactions on Signal Processing, 65(16):4265-4288, Aug. 2017.
[63] Sturmfels, Lundherg, and S.-I. Lee. Visualizing the impact of feature attribution baselines. Distill, 2020.
[64] M. Sundararajan, A. Taly, and Q. Yan. Axiomatic attribution for deep networks, 2017.
[65] R. Tomsett, D. Harborne, S. Chakraborty, P. Gurram, and A. Preece. Sanity checks for saliency metrics. In Association for the Advancement of Artificial Intelligence, 2019.
[66] A. Trockman and J. Z. Kolter. Orthogonalizing convolutional layers with the cayley transform. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
[67] D. Tsipras, S. Santurkar, I.. Engstrom, A. Turner, and A. Madry. Robustness may be at odds with accuracy, 2018.
[68] Verma, P. Dickerson, and K. Hines. Counterfactual explanations for machine learning: review. CoRR. abs/2010.10596. 2020.
[69] C. Villani. Optimal Transport: Old and New. Grundlehren der mathematischen Wissenschaften. Springer Berlin Heidelberg, 2008
[70] S. Wachter, B. Mittelstadt, and C. Russell. Counterfactual explanations without opening the black box: Automated decisions and the gdpr. Harv. JL & Tech., 31:841, 2017.
[71] Wang and N. Vasconcelos. Scout: Self-aware discriminant counterfactual explanations. In The IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
[72] Z. Wang, M. Fredrikson, and A. Datta. Robust models are more interpretable because attributions look normal, 2022.
[73] H. Xiao, K. Rasul, and R. Vollgraf. Fashion-mniss a novel image dataset for benchmarking machine learning algorithms. ArXiv, abs/1 ftss/1708.07777, 2017.
[74] C.-K. Yeh, C.-Y. Hsieh, A. S. Suggala, D. Inouye, and P. Ravikumar, On the (in)fidelity and sensitivity of explanations. In NeurIPS, 2019.
14

---

A Appendix
A.1 Additional definition and proofs
Let us first recall the optimal transport problem associated with the minimization of LhKR. R. X,m
/ lx 2|dT + =T( + ==([2)
C [ELipI(0) (0) A(f).
inf
inf (ET
(3)
Jax
Where (2, 2) is the set consisting of positive measures E M ( (t) which are absolutely
continuous with respect to the joint measure du du and das E [p. p(m {)}, dmc E [1 p,
du pm + A]]. We name x the optimal transport plan according to Eq and and f the associated potential function.
Proof of proposition 1: According to [6 we have
IV (=))ll
=
almost surely and
(a (z) (2)( ||a vl)
Following the proof of proposition in 29 and we have
Given Za = a * x + (1 a)y, $ a
= To y/
P P(a,y)~-
1.
1 w|1
So for for a = 1 whe have
(aa(())= x- y =1
P P(a,u)
|| y|1
and then
P (waa))o (v (
Vzf (z) v=f"(z)) - vll)
This prove the proposition I by choosing [ y/
Proof of proposition 2: Let μ and two distributions with disjoint support with minimal distance
and f an optimal solution minimizing the C with m < 2e. According to (56). f is 100% accurate. Since the classification is based on the sign we have : Vo E (x) 2
and
vy E (v) I previous proposition we have
Given E μ and tr (x: = +V (x) and y According to the
f"(x) (x)) = x - yll
f((x) ffy) æ (a - -t
[f(()) -f(()] = [[
f"()) f"(x) = (=))v
(t2 0)
f((x) -f(() =
(Vef(xx) 1) (f"(z) > (1)) <)
(*(x) --(() =t
('()) (x) -t
since (1) < we obtain
(=( 11
Since f is continuous, 31' > 0 such that ats 1'V (x: and ("ms)) 0. We have
1f (x: - fr (xsl) x xs||
(x) x (x fz)
fz(z) Et
15

---

and
(x)))))) f*(v) & ass vl1
-f" & 1|(e - =f - (x - (Vaf(())
(w) S t
(w) s || - y/1
Then, if (x)) < t' we have
(x) (w( <t' + 1|0 y11 (x) (v( <| a vl1
which is contradiction (x) t' and
3g = x (x)
16

---

A.2
Parameters and architectures
A.2.1 Datasets
FashionMNIST has 50,000 images for training and 10,000 for test of size 28 28 x 1, with 10 classes
CelebA contains 162,770 training samples, 19,962 samples for test of size 218 178 x 3. We have used subset of 22 labels: Artractive, Bald, Big tise, Black Hair, Blond Hair, Blurry, Brown Hair, Eyeglasses, Gray Hair, Heavy_Maa _ak_up, Male, Mouth Slightly Open, Mustache, Receding Hairline, Rosy_ Cheeks, Sideburns, Smiling, Wearing Earrings, Wearing Hat, Wear- lipstiik CetaringNeccttee Young.
Note that labels in CelebA are very unbalanced (see Table 2 with less than 5% samples for Mustache or Wearing Hat for instance). Thus we will use Sensibility and Specificity metrics.
Table 2: CelebA label distribution: proportion of positive samples in training set (testing set) [bold: very unbalanced labels]
Attractive
Bald
Big_Now Nose
Black_ Black_Hair
Blond_ Hair
0.51 (0.50)
0.02 (0.02)
0.24 (0.21)
0.24 (0.27)
0.15 (0.13)
Blurry
Brown_ Hair
Eyeglasses 0.06 (0.06)
Gray Hair
SeravyMaakuup
0.05 (0.05)
0.20 (0.18)
0.04 (0.03)
0.38 (0.40)
Male
Mouth Saauth_llghhty_SSS Openn
Mustache 0.04 (0.04)
Receding Hairline
Rosy_ Chhekks 0.06 (0.07)
0.42 (0.39)
0.48 (0.50)
0.08 (0.08)
Sideburns
Smiling 0.48 (0.50)
Wearing Earringg
Wearing Hat 0.05 (0.04)
Wearing Lipstick 0.47 (0.52)
0.06 (0.05)
0.19 (0.21)
Wearing Necktie 0.12 (0.14)
Young
0.78 (0.76)
Cat vs Dog contains 17400 training samples, 5800 test samples of various size.
Imagenet contains IM training samples, 100 000 samples for test of various size.
preprocessing:
For FashionMNIST Images are normalized between [0, 1] with no augmentation.
For CelebA dataset, data augmentation is used with random crop, horizontal flip, random brightness, and random contrast, For imagenet and cat vs dog we use the standart preprocessing of resnet (with no normalization in [0, 1))
A.2.2 Architectures
As indicated in the paper, linear layers for OTNN and unconstrained networks are equivalent (same number of layers and neurons), but unconstrained networks use batchnorm and ReLU layer for activation, whereas OTNN only use GroupSort2 [ 56] activation. OTNN are built using DEEL. library.
I-Lipschitz networks parametrization. Several soltutions have been proposed to set the Lipschitz constant of affine layers: Weight clipping 7 (WGAN), Frobenius normalization (54 and spectral normalization [46]. In order to avoid vanishing gradients, orthogonalization can be done using Björck algorithm [0,. DEEL.LIP implements most of these solutions, but we focus on layers called SpectralDense and SpectralConv2D. with spectral normalization [46] and Björck algorithm [10]. Most activation functions are Lipschitz, including ReLU, sigmoid, but we use GroupSort2 proposed by [5). and defined by the following equation:
GroupSort((z))).22+ [min (I22, #214 max (I26, 12]+1]]
Network architectures used for CelebA dataset are described in Table 3
Network architectures used for FashionMNIST dataset are described in Table 4 The same OTNN ar- chitecture is used for MNIST expermentation presented in Fig. [
distributed under MIT License (MIT)
17

---

Table 3: CelebA Neural network architectures: Sconv2D is SpectralConv2D, GS2 GroupSort2.
L2Pool is L2NormPooling, SDense is SpectralDense, BN is BatchNorm, AvgPool is AveragePooling
Dataset
OTNN
Unconstrained NN
Layer
Layer
Output size
CelebA
Input
Input
218 x 178 X
SConv2D, GS2
Conv2D, BN, ReLU
218 x 178 x
SConv2D, GS2
Conv2D, BN, ReLU
218 x 178 x 16
L2Pool
AvgPool
109 x 89 x 16
SConv2D, GS2
Conv2D, BN, ReLU
109 x 89 x 32
SConv2D, GS2 L2Pool
Conv2D, BN, ReLU
109 x 89 x 32
AvgPool
54 44 32
SConv2D, GS2
Conv2D, BN, ReLU
54 X 44 x 64
SConv2D, GS2
Conv2D, BN, ReLU
54 44 64
SConv2D, GS2
Conv2D, BN, ReLU
54 X 44 X 64
1.2ool
AvgPool
27 22 64
SConv2D) GS2
Conv2D, BN, ReLU
27 x 22 x 128
SConv2D, GS2
Conv2D, BN, ReLU
27 22 128
SConv2D, GS2
Conv2D, BN, ReLU
27 X 22 X 128
L2Pool
AvgPool
13 11 128
SConv2D, GS2
Conv2D, BN, ReLU
13 X 11 X 128
SConv2D, GS2
Conv2D, BN. ReLU
13 11 128
SConv2D, GS2
Conv2D, BN, ReLU
13 X 11 X 128
L2Pool
AvgPool
6 128
Flatten, SDense, GS2
Flatten, Dense, BN, ReLU
256
SDense, GS2
Dense,BN, ReLU
256
SDense
Dense
22
The I-Lipschitz version of resnet50 is described in Table 5 As the unconstrained version, It has around 25M parameters. For the large version, we simply multiply the number channels in hidden layers by 1.5. The unconstrained version is the standart resnet50 architecture. In the case of imagenet we use the pretrained version provided by tensorflow.
Table 4: MasHion Neural network architectures: Sconv2D is SpectralConv2D. GS2 is Group- Sort2, SDense SpectralDense, BN BatchNorm, AvgPool AveragePooling, SGAvgPool ScaleiGHoballAveraeePPooooo LIP) GAvgPool is Global/AveragePoolingg
Dataset
OTNN
Unconstrained NN
Layer
Layer
Output size
FashionMNIST
Input
Input
28 28
SConv2D, GS2
Conv2D, BN, ReLU
28 x
28 x 96
SConv2I), GS2
Conv2D, BN, ReLU
28 28
96
SConv2D, GS2
Conv2D, BN, ReLU
28 x 28 x 96
SConv2D (stride=2), GS2
Conv2D (stride=2), BN, ReLU
14 14 96
SConv2D, GS2
Conv2D, BN, ReLU
14 X 14 X 192
SConv2D, GS2
Conv2D, BN, ReLU
14 14 192
SConv2D, GS2
Conv2D, BN, ReLU
14 X 14 x 192
SConv2D (stride=2). GS2
Conv2D (stride=2), BN, ReLU
X 192
SConv2D, GS2
Conv2D, BN, ReLU
7 X 7 384
SConv2D, GS2
Conv2D, BN, ReLU
X 384
SConv2D, GS2
Conv2D, BN, ReLU
7 X 7 384
SGAvgPool
GAvgPool
384
SDense
Dense
10
18

---

Table 5: 1-lip resnet architecture for Imagenet and cat vs dog: Sconv2D is SpectralConv22,, GS2
is GroupSor12, SDense is SpectralDense. BC is Batchcentering (centeing without normalization).
S1.2npool Scaledl Soatedll2Norm/Pooing22) SGAvgl2Pool is SelleCiioall GAvgPool
is Averael
Layer
output
Input
224 x 224 x
SConv2D 7-64 (stride=2), BC, GS2
112 x 112 x 64
InveribbeeDownSampiig
56 56 256
[SConv2D x 1
64
BC, GS27
SConv2D x 3
64
BC, GS2
x3
56 56 256
SConv2D x
256
BC
add-lip
BC, GS2
SL2npool
28 28 256
SConv2D 1 X 1
128
BC, GS2
SConv2D x 3 128
BC, GS2
x4
28 28 512
SConv2D 1 x 1
512
BC
add-lip
BC, GS2
ST.2npool
14 X 14 512
SConv2D 1 X 1
256
BC, GS27
SConv2D x
256
BC, GS2
x6
14 14 1024
SConv2D 1 x 1
1024
BC
add-lip
BC, GS2
SL2npool
7 7 x 1024
SConv2D 1 x 1
256
BC, GS2
SConv2D 3 x 3
256
BC, GS2
x3
7 7 x 2048
SConv2D 1 X 1
1024
BC
add-lip
BC, GS2
SGAvvg2PPool
2048
cat vs dog imagenet
SDense
1000
A.2.3 Losses and optimizer
An extension of C to the multiclass case with classes. has also been proposed [56] The idea is to learn q 1-Lipschitz functions f1,..., fg. each component fe being one-versus-all binary classifier. The loss proposed was the following
clKR (J (Ji.....)
E
[a(())
E xWp,
[a(x)]
+ A
E (J)),,........ S.()).)))) u) U.P.
with:
H
(m fx(())) + (m fx((:)))
This formulation has three main drawbacks: (i) for large number of classes several outputs may have few or no positive sample within a batch leading to slow convergence, (ii) weight of fz( (the function of the true class) with respect to the other decreases when the number of classes increases. (iii) the expectancy has to be evaluated through the batch, making the loss dependant of the size of the batch.
To overcome these drawbacks, we propose first to replace the Hinge term H with softmax weighted version. The softmax on all but true class defined by:
o (fa())) = Ejjn fx(z)
We can define weighted version of H function:
19

---

Ha (fi(z))........ ... y. f.(
(m- 1on-fflen fx(e))+
E(( * (m kzy
fx(x))+
In this function, the value of (x) for the true class maintains consistent weight relative to the values of other fuuctiinn, regardless of the number of classes. a is temperature parameter. Initially, the softmax behaves like an average as all the values of ft are close. However, during the learning process, as the values of [ increase, the softmax transitions function like maximum. Similarly, if a low value is chosen for the softmax behaves as an average, resulting in one vs all hKR loss.
By choosing a higher value for a, the softmax unbalances the weights. Thus loss persists as one vs all hKR but incorporates re-weighting of the opposing classes for each targeted class.
We also propose sample-wise and weighted version of the KR part (left term in Eq get the proposed loss:
C (J Tc v) = -0((())) (o)((())) (x(()
(5)
Ho (fi( fq(2), m,
It's important that this definition only applys the balanced multiclass case (as in FashionM- nist and ImageNet). In the unbalanced scenario, the weight must be rescaled according to the a priori distribution of the classes.
For CelebA, with hyperparameters is set to 20, and m 1. For FashionMNIST, we use Eq 5 is set to 5, 10 and = 0.5. For cat vs dog À is set to 10 and m 18. For imagenet À is set to 500, a = 200 and m = 0.05.
We train all networks with ADAM optimizer [39 We use batch size of 128, 200 epochs, and fixed learning rate 1c-2 for CelebA. For FashionMNIST we perform 200 epochs with a batch size of 128. We fix the learing rate to 5e-4 for the 50 first epochs, 5e-5 5 for the epochs 50-75, 1e-6 for the last epochs. For cat vs dog we perform 200 epochs with batch size of 256. We the learing rate to le-2 for the 100 first epochs. 1e-3 for the epochs 100-150, le-4 4 for the epochs 150-1 80 and 1e-9 for the last epochs. For imagenet we perform 40 epochs with a batch size of 512. We fix the learing rate to 5 for the 30 first epochs, 5e-5 for the epochs 30-35, 1 for the epochs 35-38 and 1e-9 for the last epochs.
20

---

A.3
Complementary results
A.3.1 FashionMNIST performances and ablation study
Table presents different performance resuts on FashionMNIST. First line is the reference uncon- strained network. Second line shows the performances of the new version of L Table also
shows that the new version of the CAKR in the multiclass case (Eq. 5) outperforms the C R. defined in [56] (Eq. Obviously, the accuracy enhancement is obtained at the expense of the robustness. The main interest of this new loss to provide a wider range in the accuracy/robustnes trade-off.
Table 6: FashionMNIST accuracy comparison with the different version of multiclass L For the
fixed margin, we use the one that performs best by parameter tuning (i.e. 0.5)
Model Unconstrained
Accuracy
88.5
OTNN X.m.
C multiclass version [56 () 10, 0.5)
72.2
(Ours) OTNN A.maa (A 10, 0.5, 10) (Fq.
88.6
A.3.2
CelebA performances
Table 7 presents the Sensibility and Specificity for each label reached by Unconstrained network and OTNN.
As reminder, given True Positive (TP), True Negative (TN), False Positive (FP), False Negative
(FN) samples, Sensitivity (true positive rate or Recall) is defined by:
TP
Sens
TP TP+FN
Specificity (true negative rate) is defined by:
TN TN + FP
Spec
Table CelebA performance results for unconstrained and OTNN networks
Model
Metries: Sensibility/Speeffiiity
Attractive
Bald
Big Nose
Black Hair
Unconstrained
0.83 / 0.81
0.64 / 1.00
0.65 / 0.87
0.74 0.95
OTNN
0.80 / 0.75
0.87 0.83 Blurry 0.49 / 0.99
0.73 0.70
0.78 0.84
Blond Hair
Brown Haiir
Eyeglasses 0.96 1.00
Unconstrained
0.86 / 0.97
0.80 / 0.88
OTNN
0.86 / 0.89
0.66 / 0.72
0.81 / 0.73
0.80 0.89
Hair Gray_Hair 0.62 / 0.99
Heavy_Makeuy
Male 0.98 / 0.98
Mouth Mouth_SSlighty SliitSliighttytpS Open 0.93 0.94
Unconstrained
0.84 / 0.95
OTNN
0.84 / 0.83
0.89 0.83
0.92 / 0.89
0.80 0.89
Mustache 0.47 / 0.99
Receding Hairline 0.47 0.98
Rosy Cheeks 0.46 0.99
Sideburns 0.79 0.98
Unconstrained
OTNN
0.86 / 0.76
0.81 / 0.79
0.82 / 0.80
0.79 0.82
Smiling 0.90 0.95
Wearing Eeerriarrrrsss 0.84 / 0.90
Wearing_Hi _Ha Hat 0.89 / 0.99
Wearing WeerrnggLipstiic
Unconstrained
0.90 / 0.96
OTNN
0.84 / 0.88
0.78 / 0.72
0.86 / 0.90
0.90 0.89
Searing_Neckiee 0.75 / 0..9
Young 0.95 / 0.65
Unconstrained
OTNN
0.87 / 0.86
0.79 / 0.69
21

---

A.4
Complementary explanations metrics
A.4.1 Explanation attribution methods
An attribution method provides an importance score for each input variables 2; in the output f(x).
The library used generate the attribution maps is Xplique (24].
For full description of attribution methods, we advise to read 21 Appendix
We will only
remind here the equations of
Saliency: g(x) = V (x))
(Vf(z+0)) SmoothGrad: g(x) = 6~~(0.166)
SmoothGrad evaluated on 50 samples on a normal distribution of standard deviation a 0.2 around z. Integrated Gradient 64 noted IG, is also evaluated on N 50 samples at regular intervals. Grad-CAM [55], noted GC, is classically applied on the last convolutional layer.
A.4.2 XAI metries
For the experiments we use four fidelity metrics, evaluated 1000 samples of test datasets:
Deletion [50] it consists in measuring the drop of the score when the important variables are set to baseline state. Formally, at step with u the most important variables according an attribution method, the Deletion (k) score given by:
Deletion (k) (
The AUC the Deletion scores is then measured to compare the attribution methods (4 is better). The baseline zn either be a zero value (Deletion-zero), uniform random value (Deletion-umiform)
Insertion [50]: this metric the inverse of Deletion, starting with an image in a baseline state and then progressively adding the most important variables. Formally, at step k, with the most important variables according an attribution method, the Insertion (k) score is given by:
Insertion (k) [
The AUC is also measured compare attribution methods (1 is better). The baseline is the same as for Deletion.
yFidelity 9:: this metric measures the correlation between the fall the score when variables put at baseline state and the importance of these variables. Formally:
pFidelity
Corr (l....d))
Eg(2), f(x) f(F
For all experiments, A is equal to 20% of the total number of variables, and cutting the image in a grid of 20 20 (9 9 for cat vs dog and imagenet). The baseline is the same the one used by Deletion. Being a correlation score, we can either compare attribution methods, or different neural networks on the same attribution method (f better).
Robustness-Se (34]: this metric evaluate the average adversarial distance when the attack is done only on the most relevant features. Formally, given the u most important variables:
- { min) (annii/@oll...aggaa((((e 8)) + (f of = 0
Robustness-Sr =
where &g. 0 indicates that adversarial attack is authorized only the The AUC is measured to compare attribution methods (L is better). Note this metric cannot be used to compare different networks, since depends on the robustness of the network.
We also several other metrics:
22

---

Distances between explanations: to compare two explanation f(z), we use either L2
distance, where p the Spearman rank correlation 23 65 (4 is better).
Explanation complexity: use the JPEG compression size proxy of the Kolmogorov complexity (4 is better).
Stability: As proposed in [74]. the Stability is evaluated by the average distance of explana- tions provided for random samples drawn in a ball of radius 0.3 (0.15 for cat vs dog and p (L is better).
imagenet) around As before, the distance
be either L2
Accuracy: To assess the relevance of explanation [57] use a semi-real dataset, called BlockMNIST, having random null block and evaluate the proportion of top-k feature attribution values within the null block.
A.4.3
Supplementary metric results
In this section we present several experiments and metrics that not able to insert in the of the paper.
Deletion-zero and Insertion-zero are evaluated on CelebA and MaSSI dataset. It is known that the haseline value can be bias for these metrics, and we are convinced that has higher influence with 1 I-Lipschitz networks. Even if results for Deletion-zero and Insertion-zero are less obvious than for Deletion and Insertion Uniform, we can see in Table g that for these metrics, the rank of Saliency is most of the time higher for OTNN.
Table 8: Insertion and Deletion metrics evaluation; GC: GradCam, Gl: Inddient.Input, IG: Integrated Gradient, Saliency Rk: : Rank (comparison by line only bold best score)
Dataset
Network
Deletion-Zero (4 is better)
GC
GI
IG
Rise
Saliency
SmoothGrad
Deletion-Zert
CelebA
OTNN
8.01
7.04
7.05
7.09
6.98 (Rk2)
6.96
Unconstrained
5.77
4.56
4.38
5.07
4.13 (Rk1)
4.51
Fashion- MNIST
OTNN
0.24
0.16
0.15
0.26
0.20 (Rk4)
0.19
Unconstrained
0.33
0.28
0.23
0.16
0.38 (Rk5)
0.39
Insertion-zero (1 is better)
CelebA
OTNN
10.26
11.63
11.58
15.50
10.06 (Rk6)
10.10
Unconstrained
14.24
11.71
12.37
15.70
6.67 (Rk6)
7.65
Fashion-
OTNN
0.31
0.46
0.47
0.36
0.36 (Rk4)
0.39
MNIST
Unconstrained
0.53
0.59
0.68
0.73
0.45 (Rk6)
0.46
To leverage the bias the baseline value, as proposed in (34 we evaluated the Robustness-Si metric, Saliency map on OTNN achieves top-ranking scores. One might argue that scores for unconstrained networks are lower, but this is directly linked to the higher intrinsic robustness of OTNNand thus cannot be compared.
Table 9: Robustness-SR metrics evaluation; GC: GradCam, GI:
Gradient. Input, IG: Integrated Gradient, Saliency Rk Rank (comparison by line only bold best score)
Dataset
Network
Robustness-SR is better) Saliency
GC
GI
IG
Rise
SmoothGrad
CelebA
OTNN
28.54
14.01
13.28
30.54
11.64 (Rk1)
12.65
Unconstrained
11.11
9.19
10.00
15.15
7.38 (Rk2)
7.20
Fashion- MNIST
OTNN
1.69
3.31
3.36
3.27
2.29 (RK3)
2.01
Unconstrained
1.17
1.36
1.17
1.15
1.21 (Rk4)
1.25
The full results for the explanation complexity is given on Table 10 The complexity is still lower for OTNN MashionMNIST, even if the gap with Unconstrained networks is narrower than for CelebA.
Accuracy was also assessed by learning an OTNN (MIP architecture) on BlockMNIST dataset [57] and evaluating the proportion of top-k saliency map values that fall in the null block. Fig presents
23

---

Table 10: Complexity of Saliency map by JPEG compression (kB); lower is better FashionMNIST
CelebA
OTNN
9.48
0.92
Unconstrained
16.84
0.94
several samples of input images and saliency maps BlockMNIST dataset, be compared to Fig. in [57]. It shows that OTNN gradients are almost only on the signal block (digit). And Table II evaluates the proxy metric proposed [57], and confirms that OTNNs saliency maps top-k values point even more on discriminative features than those of adversarial trained networks.
20
co
00
20
20
20
40
40
25
25
25
25
25
25
20
00
00
20
20
25
25
Figure 7: blockMNIST experiments using the proposed OTNN framework (10 blockMNIST images and their respective OTNN gradients). null marks are almost invisible in the gradients
Table 11: Comparison of Proxy metric on BlockMNIST (0 vs. 1) data for OTNNs, standard and robust models (values for the two last directly extracted from (57)
Unmasking fraction k
2.5
10
15
20
25
30
Type of NN
Fraction of top-k pixels in null block
Unconstrained 55
43.8
42.5
44.8
46.5
47.5
48.1
48.4
Adversarial 57
<
<
1
2.3
7.9
16.7
24.2
29.9
OTNN
1
1.8
6.6
16.8
26.0
32.9
24

---

A.5
Saliency Maps and counterfactual examples for cat Complementary qualitative results
In this section, we provide more samples of qualitative results and couterfactual exlanations for OTNN, based on the gradient, i.e. x f(x)V= for >
A.5.1
FasHionMNIST
Fig. gives more results on FashionMNIIST.
Bag
Shirt
Pullover
Ankle
Bag
Coat
Shirt
Bag
Shirt
Dress
->
Shirt
Trouser
Coat
Sandal
Sneaker
Figure 8: FashionMNIST samples
A.5.2
CelebA
We presents results for other labels CelebA. For ethic concerns we have hidden labels that can be subject misinterpretation, such Attractive, Male, Sig_Nose. Fig. Do 27 present more results the labels presented in the core of the paper, SeuuhhSlligtly... Mustache, Wearing_Hor
A.5.3 Cat vs Dog
We present some supplementary comparison of vs dog(Fig. and
A.5.4
Imagenet
Values of accuracy and human feature alignment used for the Fig 4 are described in Tab We
present some supplementary comparison of Saliency Maps Imagenet (Fig. (30). As pointed out previously, model doesn't produce significant counterfacutal explanations Imagenet.
Table Comparison accuracy on human feature alignment of Saliency Maps different models on imagenet [22]
Model
Accuracy
Human Aligment
clip
56.0
0.03
swin
85.2
0.03
vit_convnext
85.8
0.15
inception
81.1
0.25
resnet50 ady
74.8
0.33
resnet50
76.0
0.33
VGG16
71.3
0.35
77.0
0.44
OTNN
67.0
0.54
OTNN large
70.0
0.57
25

---

A
A
r
Figure 9: Samples from label Mouth Mouth_slightly__oe slightly_open: left source image (closed), center difference
image, right counterfactual (open) of form 10 f(x)V,,(<>
26

---

AAE
AAE
NO
MO
A
Figure 10: Samples from label Mouth_sligee south_slightly_open.. left source image (open), center difference
image, right counterfactual (close) of form æ 10 * v
27

---

TZ
Figure 11: Samples from label Mustache: left source image (no mustache), center difference image,
right counterfactual (mustache) of form æ + V. with / E {5, 10, 20}
Figure 12: Samples from label Mustache: left source image (Mustache), center difference image,
right counterfactual (Non Mustache) of form æ - 1 E 1010 10
28

---

20 OR
211 DR
1B1
ET
R
uky
Figure 13: Samples from label Wearing Hat: left source image (No Hat), center difference image,
right counterfactual (Hat) of form x - 1 [.
10
29

---

Figure 14: Samples from label Wearing Hat: left source image (Hat), center difference image, right counterfactual (No Hat) of form t= f(x)) 5, 10
Bald + "not" Bald
not" Bald + Bald
DA
DA
AFL
AFI
ES
ES
Figure 15: Samples from label Bald
30

---

Black Hair +
"not" Black Hair
"not" Black Hair + Black Hair
Figure 16: Samples from label Black Hair
Blond Hair + "not" Blond Hair
"not" Blond Hair
Blond Hair
Figure 17: Samples from label Blond_Har
Blurry + "not" Blurry
"not" Blurry Blurry
Figure 18: Samples from label Blurry
31

---

Brown Hair +
"not" Brown Hair
"not" Brown Hair + Brown_ Hair
Figure 19: Samples from label Brown, Hair
Eyeglasses +
"not" Eyeglasses
"not" Eyeglasses Eyeglasses
Figure 20: Samples from label Eyeglasses
32

---

Gray Hair - "not" Gray Hair
"not" Gray Hair
Gray_Hair Hair
Figure 21: Samples from label Gray_Hai Hair
Hairline + "not" Hairline
AAI
MO
MO
not" Hairline + Hairline
Figure 22: Samples from label Hairline
33

---

Heavy_Makenn Makeup + "not" Sleavy_Maken
"not" Sleavy_Maken
Figure 23: Samples from label _akeuu
Rosy Cheeks + "not" Chsy__Ceeks
"not" Rosy_ Cheekss Rose_Cheeks
Figure 24: Samples from label Cheekss
Smiling + "not" Smiling
"not" Smiling
Smiling
Figure 25; Samples from label Smiling
34

---

Wearing Lipstick + "not" Wearing Lipstick
"not" Wearing Lipstick
Wearing Lipstic
Figure 26: Samples from label Wearing Lipstick
Young + "not" Young
a
ta
"not" Young Young
MO AAE
AAI
Figure 27: Samples from label Young
35

---

(a) OTNN
(b) Unconstrained
Figure 28: Cat vs Dog Saliency Map samples
36

---

Figure 29: Cat vs Dog Saliency counterfactual samples. Left dog to cat, right cat to dog
37

---

(a) OTNN
(b) Unconstrained
Figure 30: Imagenet Saliency Map samples
38


Reviews:
[{"review_id": "7nBrh53vq5", "reviewer": "Reviewer_LnPf", "summary": "The paper presents a theoretical analysis of 1-Lipschitz constrained neural networks that are trained based on optimal transport dual loss for image classification task. The optimal classifier f(.) is trained by minimizing the hinge regularized KR optimization loss. It's been shown that the gradient of optimal solution is aligned with the transportation plan direction and the L1 norm of it at x is a certifiable lower bound of classifier robustness. So the close decision boundary to x is also along with the gradient direction at distance of the lower bound which is |f*(x)|.\n\nThe experimental results show that such a model performs better than its unconstrained counterpart in XAI metrics like \\mu fidelity and stability spearman rank on multiple datasets including FashionMNIST, CelebA, CatvsDog and Imagenet. It's been shown that OTNN models  explanations are more aligned with human attention that makes the model performance more predictable.   ", "questions": "- It's been proven that 1-Lipschitz neural network are as accurate as unconstrained neural networks [ref.1 ], why are the OTNN models are practically less accurate. \n\n- Figure 2 demonstrates the level set of an OTNN binary classifier, how does the unconstrained network decision boundary look like? I appreciate if you could provide the such figure.\n\n- Could you provide the table corresponding to the Figure 4 that clarifies what each of the point in the figure is and what is the exact value of accuracy and human feature alignment in addition to the details of experimental setup that leads to the figure?     \n\n\n\n[ref.1] Béthune, Louis, et al. \"Pay attention to your loss: understanding misconceptions about lipschitz neural networks.\" Advances in Neural Information Processing Systems 35 (2022): 20077-20091.", "limitations": "There is no negative societal impact of this paper as it is a theoretical paper. ", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper provides a theoretical analysis of properties of 1-Lipschitz constrained neural networks. I consider this type of analysis highly valuable to the field! \n\n- The authors provide empirical study about the effectiveness of OTNNs on improving XAI metrics. Considering multiple datasets, it's been shown that the effectiveness is scalable to larger dataset and larger networks. \n\n- Several properties of OTNN gradient has been investigated and shown that, their saliency maps are aligned with human attention that improves the predictability of network behavior. They also draw connection between gradient and counterfactual examples and adversarial attacks to OTNNs.\n\n", "weaknesses": "- While I appreciate the theoretical analysis of OTNNs, they are mostly compilation of analysis in [53] and [26] and [6].\n\n- There is no ablation study on activation functions and normalization methods besides GroupSort and Spectral Norm even on a single dataset. It would be nice to evaluate the empirical effect of network depth on XAI metrics. \n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate your thorough and insightful review, and have taken your valuable feedback into consideration.We are delighted that you mention that “this type of analysis  [is] highly valuable to the field!”\nPlease find below answers to your main questions:\n* Response to Weaknesses:\n   * In fact, properties 1 and 2 are original contributions, not found or proven in prior literature. While the link between robustness and explainability may not be new, our work with the OTNN framework establishes explicitly and theoretically this link, marking a significant novelty. \n  * Furthermore, This paper demonstrates the first results based on OTNN on large scale networks and datasets. This was achieved by slightly modifying the multiclass loss function, resulting in enhanced accuracy.\n   * Regarding the ablation study, the effects of the different 1-Lipschitz layers have been thoroughly investigated for instance  in [48] and [4]. Since OTNN is based on optimal transport, which requires $\\nabla_x f=1$ almost everywhere, we opted for layers that best fit these requirements. Although an ablation study might have value from an XAI perspective, it is beyond the theoretical scope of this paper.\n* Response to Questions:\n   * Despite the fact that 1-Lipschitz networks can be as accurate as unconstrained ones, OTNN and the optimal transport loss impose stronger guarantees than a mere 1-Lipschitz constraint. Notably, it's recognized that robustness guarantees, and by consequence the induced XAI guarantee in our case, influence accuracy. This impact remains negligible for all studied datasets except for  ImageNet (see lines 240-246). For ImageNet, the accuracy of OTNN aligns with several classical networks (see Fig. 4), and provides substantial XAI properties. For a simpler and  fairer comparison, we utilized a standard ResNet architecture, but it remains an open question whether standard architectures are the most suitable for 1-Lipschitz networks (and thus for  OTNN).\n   * The intent of Figure 2 was to demonstrate the unique characteristics of OTNN  and an understandable illustration of Propositions 1 and 2. The level sets of unconstrained networks can be challenging to interpret, given that there are no certificates for the output (output values and gradient norm can be unpredictably high). All our attemps to generate such a figure with unconstrained networks lead to shifted points  $x-f(x)\\nabla_x(f(x))$  far outside the two Koch snowflakes and thus unreadable. \n  * We will incorporate a table with precise values and references of networks of Fig 4 in the final version and  develop the discussion in the main text. The experimental setup strictly followed the methodologies of [35] and [17], and their code was used for our experimentation. We will amend line 278 to make this aspect clearer.\n\n"}, {"review_id": "q9Thlyt75b", "reviewer": "Reviewer_WMVT", "summary": "This paper studies the properties of 1-Lipschitz Neural Networks, and shows that the input-gradients of these models have desirable properties. On a benchmark across several datasets, they find that gradient-based feature attributions from the 1-Lipschitz Neural Networks show substantially better fidelity and stability metrics than those of an unconstrained model. Interestingly, for these networks, they show that adversarial attacks are counterfactual explanations (proposition 1). Overall, this paper adds to the line of work that shows that constrained (or regularized models) show improved input-gradients than unconstrained ones. ", "questions": "See weaknesses section for the questions that I have about this work. \n\nAdditional ones: \n\nI assume Proposition 1 & 2 are new to this work? Or did they appear in previous work? I am not an expert on optimal transport, so I am less familiar with that literature.", "limitations": "The authors discuss societal impact in the conclusions section.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Overall, this is an interesting paper that explores the effect of constraining the Lipschitz constant of a model, and how it endows the model with reliable input-gradients.\n\n**Quality/Clarity**\\\nOverall, this paper is quite well-written and clear. The key point of the paper is stated clearly and well-justified comprehensively across experiments on several datasets. \n\n**Significance/Originality**\\\nI am combining the discussion on significance and originality because I think these are tightly linked for this work. First, I think several of the findings in this paper have been made in other papers (see weaknesses), but the specific settings under which this papers makes its findings are different. To the best of my knowledge, this is the first paper to explicitly and comprehensively quantify the fidelity and stability of explanations from constrained models. Overall, this paper is another important evidence to this line of work.\n", "weaknesses": "The main weaknesses are listed below: \n\n**Lipschitz constant:** Why does it it have to be 1? Is there some range of values for this constant where the model gradients still retain these properties? How were these model trained? It says that they used some library, so I assume the training scheme here is standard and no new innovation there.\n\n**Related work**: My main weakness of this paper has to do with related work. I'll list some here that the paper should engage with. First in [1], the authors show that the gradients of an adversarially robust model become sensitive to the output while those of an unconstrained model are not. In general, adversarially robust models have lower lipschitz constants, so the finding from this work makes sense. The authors should cite this paper. [2] and [3] also contain insights that add to this paper and explain some of their findings. For example that the model has better stability metrics is expected since that is essentially what constraining the lipschitz  constant does. I am not generally surprised by any of the insights discussed in this work, but this is fine, and they make a valuable contribution. However, it would be helpful if they could engage with the relevant literature below.\n\n[1] Shah, Harshay, Prateek Jain, and Praneeth Netrapalli. \"Do input gradients highlight discriminative features?.\" Advances in Neural Information Processing Systems 34 (2021): 2046-2059.\n\n[2] Srinivas, Suraj, et al. \"Efficient training of low-curvature neural networks.\" Advances in Neural Information Processing Systems 35 (2022): 25951-25964.\n\n[3] Dombrowski, Ann-Kathrin, et al. \"Towards robust explanations for deep neural networks.\" Pattern Recognition 121 (2022): 108194.\n\n**Evaluation**: As the authors are probably aware, evaluating gradient attributions is tough. I looked into the fidelity and stability metrics, but I think these are merely passable. To really make concrete conclusions, the authors need a modified setting where ground-truth is known. I hate to be that reviewer that asks for new experiments, but something like the block MNIST evaluation in [1] is needed here to make conclusive claims. Lastly, the human evaluation using the click me dataset is nice, but addresses a different question. Just because an explanation aligns with what a human expects does not mean that the explanation is 'correct' or desirable. You want an explanation that tells you what your model has learnt. If your model has learnt human aligned signals then that is good. Comparing an explanations to humans is more helpful for debugging than for assessing the actual explanation itself. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "\nWe greatly appreciate your thorough and insightful review, and have taken your valuable feedback into consideration. Please find below answers to your main questions:\n* Response to comment on “1-Lipschitz requirement\": The OTNN networks analyzed in this paper are associated with the optimal transport loss (refer to line 106 and subsequent lines), necessitating not only a 1-Lipschitz constraint but also a $\\nabla_x f=1$ almost everywhere. Properties 1 & 2, proven in this paper, would not be applicable if the Lipschitz constant exceeded 1. Besides, as described in the paper l.239, details on OTNN network architectures and training parameters are given in Appendix A.2.\n\n* Response to comment on “Related Work\": We acknowledge in the paper that the link between robustness and explainability has been previously shown, citing three references [11,61,18]. If space permits in the final version, we could include the papers suggested by the reviewer. However, it's worth noting that none of these studies provide a theoretical link between the two elements, which we have proven in the case of OTNN.\n* Response to comment on “Evaluation\": Despite length constraints preventing us from including MNIST evaluation in this paper, Figure 1.a illustrates that the gradients are near perfect for this simple dataset. The inclusion of the blockMNIST study would also be hard  due to the paper length limit. However, we carried out experiments on blockMNIST dataset, and we share them with you in the supplementary pdf rebuttal (see general rebuttal section, the first figure for our Results with OTNN, and the second  for a remainder of the cited paper). We hope that it will convince you that gradients of OTNN (due to optimal transport) are even more relevant than those of adversarial trained networks. And as a consequence, human alignment for OTNNs  is more than just a ‘debugging’ feature, but a real novelty.\n"}, {"review_id": "XtDblUDa30", "reviewer": "Reviewer_4Zh4", "summary": "This paper investigates the explainability properties of optimal transport neural networks, which are 1-Lipschitz constrained neural networks trained with an optimal transport dual loss. By establishing that the gradient of the optimal solution aligns with the transportation plan direction, and the closest decision boundary point (adversarial example) also lies in this gradient direction at a distance of the absolute value of the network output, the authors establish a link between the OTNN gradients and counterfactual explanations. They show that the gradient of OTNN significantly enhances the Saliency Map XAI method, improving several state-of-the-art XAI metrics. ", "questions": "See weaknesses", "limitations": "1-Lipschitz networks are known to be highly constrained and do not provide state-of-the-art accuracy compared to their unconstrained counterparts. the authors should discuss this fact and the limitations of their work.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper is well motivated and well written. \n- The problem tackled by the authors is interesting and important as the interpretability of neural networks is important for a large range of application\n- The figures and empirical results are convincing ", "weaknesses": "It appears that the authors use the DEEL.LIP library to construct the OTNN. The library was proposed by [1] and uses the power iteration to normalize each layer and constrain them to be 1-Lipschitz (see 4.1 of [1]). This approach to training 1-Lipschitz neural networks has recently been shown to be suboptimal [2, 3, 4], and new layers that are 1-Lipschitz _by design_ have been proposed. Can the authors comment on these papers, and can their results be improved with more recent 1-Lipschitz architectures? \n\n\n[1] Serrurier et al. Achieving robustness in classification using optimal transport with hinge regularization, CVPR 2021  \n[2] Meunier et al., A Dynamical System Perspective for Lipschitz Neural Networks ICML 2022  \n[3] Araujo et al., A Unified Algebraic Perspective on Lipschitz Neural Networks, ICLR 2023  \n[4] Wang et al. Direct Parameterization of Lipschitz-Bounded Deep Networks, ICML 2023  \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate your thorough and insightful review, and have taken your valuable feedback into consideration. Please find below answers to your main questions:\n* Response to comment on “1-Lipschitz layers\": In fact, we implement a more complex approach than simple spectral normalization, as explained in appendix A.2.2 and using Deel.lip implementation. OTNNs necessitate $\\nabla_x f=1$ almost everywhere, achievable via orthogonal kernels and GroupSort. Employing a more efficient algorithm to enforce the 1-Lipschitz and orthogonal constraints could be of interest, but it wouldn't change the theoretical results. It might, however, improve the experimental outcome scores without changing the conclusions. A comprehensive comparison of all these methods within the scope of explainability would warrant an independent paper altogether.\n* Response to comment on “Limitations of 1-Lipschitz NN\": On the contrary, as proven in [6], 1-Lipschitz networks can achieve accuracy levels equivalent to unconstrained ones. However, OTNN and the optimal transport loss impose guarantees that exceed a simple 1-Lipschitz constraint. Particularly, it is recognized that robustness guarantees, and in our case the induced XAI guarantees, impact accuracy. This impact remains negligible for all studied datasets  (see lines 240-246), except for  ImageNet on which the accuracy is not in the tail of standard learnt models (see Fig 4) .\n\n"}, {"review_id": "sQimqVMqXO", "reviewer": "Reviewer_7q2B", "summary": "This paper focuses on a special type of 1-Lipschitz neural network named OTNN. The paper analyzes several theoretical properties of OTNN, including the correspondence between gradient direction and the optimal transportation plan from one class to another, the exact analytic solution of the decision boundary and the adversarial sample of OTNN. Furthermore, the paper shows that saliency maps of OTNN can provide meaningful explanation. Experiments also show that on various explanation methods, OTNN outperforms traditional neural networks in three commonly used XAI evaluation metrics.", "questions": "1. It is encouraged to clarify and verify whether the trained OTNN model is almost linear in most of the local regions.\n2. It is encouraged to have a thorough presentation and discussion in the main text about the comparison of classification performance between OTNNs and traditional neural networks.\n3. It is encouraged to conduct experiments on more complicated datasets to verify the theoretical results in Proposition 2 and Corollary 1.", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper focuses on several interesting properties of OTNN, which have not been thoroughly investigated in previous works.\n\n2. The paper is well-written and easy to follow.", "weaknesses": "1. About whether the OTNN model is locally linear. According to reference [48] in the main paper, the norm of the gradient $\\nabla f^*(x)$ is 1 almost surely, and Corollary 1 implies that the adversarial sample is exactly located in the direction of the gradient. These properties seem to indicate that a trained OTNN model is nearly linear. Authors are suggested to clearly explain this issue. Note that I do not mean the whole decision boundary is linear, but a relatively large portion of local regions can be linear, as shown in Figure 2.\n\n2. Current experimental results in the paper show that the performance of the OTNN model is far behind most existing models. Although I do admit that the performance of robust models like OTNN cannot compete with other neural networks, it is necessary to clearly and thoroughly compare the performance of OTNN and traditional neural networks in the main paper. Existing comparison experiments in the paper are not sufficient and are not well presented. Authors are encouraged to include large-scale comparison experiments between OTNN and traditional neural networks, organize the results into a table, and provide some discussion or comments for the comparison in the main text.\n\n3. The dataset (the two concentric Koch snowflakes) used in the experiment in Figure 2 is too simple. The distribution of positive samples and negative samples in Figure 2 exhibit a high level of symmetry, which makes the decision boundary a regular hexagon. However, this toy dataset is not enough for the verification of theoretical results in Proposition 2 and Corollary 1. I suggest that authors conduct experiments on more complicated datasets to verify the theoretical results.\n\n4. Authors are encouraged to visualize the loss landscape of the model trained on the two concentric Koch snowflakes in Figure 2, so as to verify the claim that gradient norm is 1 almost surely and the analytical solution of adversarial sample in Corollary 1 based on this visualization.\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate your thorough and insightful review, and have taken your valuable feedback into consideration. Please find below answers to your main questions:\n* Response to comment on “On almost linear property\": Traditional deep learning models utilizing linear layers (Dense and Conv2D) and activations like ReLU are also piecewise linear functions. Imposing  $\\nabla_x f=1$ almost everywhere only influences the slope of the prediction function in the direction of the decision boundary, a property that is certainly desirable. For instance, the Signed Distance Function outlined in [6] is $\\nabla_x f=1$ almost everywhere and it is proven that it can approximate any decision boundary.\n* Response to comment on “On performance limitation\": As stated in [6], 1-Lipschitz networks can be as accurate as unconstrained ones. Even though OTNN and the optimal transport loss impose guarantees that are stronger than a sole 1-Lipschitz constraint. Notably, robustness guarantees, and in our case the induced XAI guarantee, influence the accuracy. However, This impact remains negligible for all studied datasets (see lines 240-246), except for  ImageNet  on which the accuracy is clearly not in the tail of standard learnt models (see Fig 4) . A comprehensive comparison was performed to produce Figure 4, which includes over 100 state-of-the-art trained models (classical, adversarially trained, VGG, ResNet, and transformers). We propose to include the list of these networks, their accuracy, and alignment scores in the appendix and develop the discussion in the main text.\n* Response to comment on “Figure 2\", the aim of this illustrative example was to sustain the two propositions rather than verify the model's performance. In Figure 2, all gradient norms are equal to 1 (we can include the numerical check in the final paper), and if they weren't, the shifted point $x-f(x)\\nabla_x(f(x))$ wouldn't reside on the 0-level set. Thus, the figure perfectly illustrates propositions 1 and 2.\n* Response to comment on “More complex datasets\", while we cannot sketch the boundary for such high dimensional datasets, we provide in Figure 5 and Appendix A.5 multiple samples for FashionMNIST, CelebA, CatvsDog, and ImageNet datasets, demonstrating that a single step in the gradient's direction  $x-f(x)\\nabla_x(f(x))$ (equivalent to the black and red arrows in Fig2.b) is sufficient to perceptually alter the class (transport the input in direction to  another class). We believe these examples serve as generalizations of Figure 2 for more complex datasets.\n* Response to comment on “loss landscape ”: We dispute “weakness 3”, since the proposed properties are for the gradient of the input $x$ with respect to the logits $f(x)$, and not with respect to the loss (thus loss landscape is out of scope).\n\nWe hope we have satisfactorily addressed your concerns. Happy to provide further clarifications if needed. "}, {"review_id": "iH7IBXveQi", "reviewer": "Reviewer_n7GW", "summary": "In this paper, the authors provide a theoretical connection between 1-Lipschitz Net, also referred to as OTNN, with Optimal Transport, and provide various empirical results showing that gradient-based attributions look sharper and semantically meaningful.\n", "questions": "My major question is pretty high-level: what are the insights from this paper that have not been covered by existing works. \n", "limitations": "Yes", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "One major contribution from the paper is Proposition 1 & 2, showing connections between the gradient direction and the optimal transport theory. The use of level curves aligns with my experience of analyzing properties of decision boundaries and smoothness of landscape. They use fidelity and stability metrics to show gradient-based attributions better capture the model’s behavior compared to standard (i.e. non-smooth) models. Also, I have not seen results using ClickMe and Feature Visualizations on OTTN, so they are also new empirical contributions to me.\n", "weaknesses": "The main weakness of this paper is its novelty or significance. This is because there are already a number of references, like [1, 2, 3], pointing out that robust models are more interpretable. Although many of these works target empirical robust models, 1-Lipschitz networks are simply the ones with stronger robustness guarantees: they are certifiably robust even if you do not enforce them (and will be more certifiably robust if you train them to do so) [4]. Also, there are works showing empirical robust training also improves the landscape smoothness by implicit gradient norm regularization [5]. Thus, connections between explainability and robustness based on 1-Lipschitz nets are only incremental and the insight is marginal from my personal perspective.\n\nI appreciate two propositions that strengthen connections between robustness (more precisely the smoothness of the function) and explainability. I find the take-away regarding robustness and explainability is already well-known in 2023 (as the newest paper I refer to was published in 2021). This paper would be much more useful a few years ago to motivate the research on 1-Lipschitz networks; however, I think there are already a number of works pushing 1-Lipschitz nets forward. From my understanding, the current research problem is to close the gap between the theoretical possibility of learning a smoothing function and the practical difference of learning one on ImageNet-scale models and dataset. Because of the difficulty in scaling up 1-Lipschitz Net to larger datasets, it is actually more practical to do (empirical) adversarial training so we have a model that is both accurate and uses human-aligned features to make predictions. \n\n[1] Christian Etmann, Sebastian Lunz, Peter Maass, and Carola Schoenlieb. On the connection between adversarial robustness and saliency map interpretability. In Proceedings of the 36th International Conference on Machine Learning, 2019.\n\n[2] Francesco Croce, Maksym Andriushchenko, and Matthias Hein. Provable robustness of relu net- works via maximization of linear regions. AISTATS 2019, 2019.\n\n[3] Wang, Z., Fredrikson, M., & Datta, A. (2021). Robust Models Are More Interpretable Because Attributions Look Normal. International Conference on Machine Learning.\n\n[4] Trockman, A., & Kolter, J.Z. (2021). Orthogonalizing Convolutional Layers with the Cayley Transform. ArXiv, abs/2104.07167.\n\n[5] Simon-Gabriel, C., Ollivier, Y., Bottou, L., Schölkopf, B. &amp; Lopez-Paz, D.. (2019). First-Order Adversarial Vulnerability of Neural Networks and Input Dimension. <i>Proceedings of the 36th International Conference on Machine Learning</i>, in <i>Proceedings of Machine Learning Research</i> \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "\nWe greatly appreciate your thorough and insightful review, and have taken your valuable feedback into consideration. Please find below answers to your main questions:\n* Response to comment on “Related Work\": We acknowledge in the paper that the link between robustness and explainability has been previously shown, citing three references [11,61,18].. We are open to incorporating additional papers suggested by the reviewer, given sufficient space in the final version. Similarly, we acknowledge that 1-Lipschitz Networks and Orthogonal layers are active research topics. However, our paper offers a substantial novelty with a theoretical proven link between orthogonality, 1-Lipschitz constraint, robustness, and explainability within the context of optimal transport. Adversarial training, while useful, lacks theoretical guarantees, and the improvements it offers in explainability do not match those provided by our approach. Furthermore, as illustrated in Figure 4 and [17], robust models (including some trained via adversarial training) do not necessarily enhance human alignment and can sometimes even degrade it.\n* Response to comment on “Novelty”: Neither the 1-Lipchitz constraint nor gradient $\\nabla_x f=1$ almost everywhere independently suffice to ensure explainability. The Optimal transport loss, as described in line 311, “simultaneously addresses the classification task and induces a gradient alignment to the transportation plan,” directly impacting the explainability of the Saliency Map. This is a necessary condition for theoretical properties 1 and 2. This represents a novel and significant contribution from our perspective.\n* Response to comment on “difficulty in scaling up”:  We have trained the first certifiable 1-Lipschitz Neural Network on ImageNet with competitive accuracy (70%) and remarkable explainability properties, surpassing state-of-the-art models even at iso-accuracy (Figure 4). This is also an important contribution to the field.\n* Response to comment on “practical issues”: The OTNN approach is applicable to complex tasks (real-world applications are typically less complex than ImageNet) and comes with theoretical guarantees necessary in critical domains (such as transport and healthcare). We hope that it could convince those who care for guarantees that the impact of this approach is even higher than adversarial training methods.\n\nCollectively, these points underscore our viewpoint that the contribution is significant. We hope that it can convince you that this paper takes the field one step further to ‘close the gap’ and is more  than just ‘incremental or marginal’.\n\n"}]

Author rebuttal:
Dear Reviewers,
We extend our gratitude to the reviewers for dedicating their time to thoroughly read and assess our paper. Their critiques have been sharp and insightful, and we appreciate that all four reviewers recommend accepting the paper. Since there is still a shared concern regarding the need to clarify the novelty of this work, which might not have been fully emphasized in the initial submission, we want to address it globally here. 

* Key novelty lies in the **theoretical link** established between orthogonality, 1-Lipschitz constraint, robustness, and explainability within the context of optimal transport. This unique link is **not only due to 1-Lipschitz constraint but also to the chosen loss, based on optimal transport, and $\nabla_x f=1$ almost everywhere properties** imposed on the layers. This theoretical link is proven through **Proposition 1 and 2 which are original contributions**. These allow our proposed framework, OTNN, to offer both accuracy and robustness, and more importantly, an enhanced level of explainability, which is a key requirement in critical domains like healthcare and transportation.
* **First certifiable 1-Lipschitz Neural Network on ImageNet dataset**: We have also demonstrated that our approach, with a slightly modified multiclass Optimal Transport  loss, can be applied to complex tasks as Imagenet with theoretical guarantees. It maintains competitive accuracy (70% with a Resnet50 like architecture) and possesses remarkable explainability properties that surpass those of state-of-the-art models, even at iso-accuracy.
* We agree with your comments on the large literature about the link between robustness and xai, and will reinforce this part in the final paper (3 citations are already in the paper). But  our approach has shown a **clear advantage over previously published methods, offering theoretical guarantees both on robustness and explainability**, and demonstrating increased alignment with human interpretation.

We trust that these enhancements and clarifications to our paper underscore its importance and significance in the realm of explainable AI. We hope that you will reconsider the scoring in light of these arguments.

Moreover, we have diligently incorporated the necessary citations and clarifications into the appropriate sections. We will also address each reviewer’s remaining comments directly. 

Thank you once again for your time and thoughtful critique.


Meta-review: All reviewers acknowledge the importance of both the novel theoretical results as well as the experiments on large datasets and complex tasks. The AC does not find reason to overturn this unanimous suggestion and recommends acceptance. However, as noted by most reviewers, it is crucial to cite and properly discuss the works that try to make an empirical, theoretical, or formal connection between bounded or 1-Lipschitz and robustness and explainability. Quite a few are missing and occasionally statements of originality/novelty are too bold. The camera-ready version is expected to be revised accordingly.
Decision: Accept (poster)