H-SPLID: HSIC-based Saliency Preserving Latent Information Decomposition
Authors: Lukas Miklautz
Chengzhi Shi
Andrii Shkabrii
Theodoros Thirimachos Davarakis
Prudence Lam
Claudia Plant
Jennifer Dy
Stratis Ioannidis
Venue: NeurIPS 2025 poster ()
Keywords: Hilbert-Schmidt Independence Criterion (HSIC)
Salient Feature Learning
Latent Space Separation
Primary area: general_machine_learning
TL;DR: H-SPLID learns salient features via latent space decomposition and we provide theoretical guarantees w.r.t. input perturbations.

Abstract: We introduce H-SPLID, a novel algorithm for learning salient feature representations through the explicit decomposition of salient and non-salient features into separate spaces. We show that H-SPLID promotes learning low-dimensional, task-relevant features. We prove that the expected prediction deviation under input perturbations is upper-bounded by the dimension of the salient subspace and the Hilbert-Schmidt Independence Criterion (HSIC) between inputs and representations. This  establishes a link between robustness and latent representation compression in terms of the dimensionality and information preserved. Empirical evaluations on image classification tasks show that models trained with H-SPLID primarily rely on salient input components, as indicated by reduced sensitivity to perturbations affecting non-salient features, such as image backgrounds.

H-SPLID: HSIC-based Saliency Preserving Latent Information Decomposition
Lukas Miklautz Chengzhi Shi Andrii Shkabrij Theodoros Thirimachos Davarakis Prudence Lam² Claudia Plant Jennifer Dy Stratis loannidis
Department of Machine Learning and Systems Biology, Max Planck Institute
of Biochemistry, Martinsried, Germany "Northeastern University, Boston, MA, USA Facullyy of Computer Science, University of Vienna, Vienna, Austria *Doctoral School Computer Science, University of Vienna, Vienna, Austria Research Network Data Science, University of Vienna, Vienna, Austria
Abstract
We introduce H-SPLID, a novel algorithm for learning salient feature representa- tions through the explicit decomposition of salient and non-salient features into separate spaces. We show that H-SPLID promotes learning low-dimensional, task-relevant features. We prove that the expected prediction deviation under in- put perturbations is upper-bounded by the dimension of the salient subspace and the HillbettSchhid Independence Criterion (HSIC) between inputs and repre- sentations. This establishes a link between robustness and latent representation compression in terms of the dimensionality and information preserved. Empirical evaluations on image classification tasks show that models trained with H-SPLID primarily rely on salient input components, as indicated by reduced sensitivity perturbations affecting non-salient features, such as image backgrounds.
Introduction
The acquisition of salient, task-relevant features from high-ding high-dimensional inputs constitutes a fundamen- tal challenge in representation learning. Such features offer multiple advantages, including reduced dimensionality (2), enhanced generalization and transferability [42 30), and improved robustness 222 [2]. Nevertheless, learning true salient features remains challenging, many neural networks operate within single, entangled latent space that mixes task-relevant signals with redundant infor- mation 66 38) We illustrate this sensitivity using a simple diagnostic test in Figure [ classifier trained to predict the left digit in an image of double digits should ignore perturbations to the right digit, which is irrelevant to the label. However, in practice, we observe that neural networks with high test classification accuracy on the left digits exhibit significant performance drop when sub- jected to a high- riggntude adversarial PGD 34 attack (E 1.0) on the right digits, revealing their dependence on irrelevant, non- non-salient features. This corroborates several empirical and theoretical studies B 36 19] showing that redundant dimensions enhance vulnerability attacks. Driven Latent Information
by these findings, we introduce H-SPLID (HSIC-based Saliency-Preserve Decomposition), a new method that learns salient features by explicitly decomposing the latent space into two subspaces coupled with information compression regularization: a Now-dimensional salient space, which contains features essential for classification, and a non-salieni space, which captures the remaining input variability. Training the same neural network above with H-SPLID alleviates the dependence on irrelevant features to a large degree, as shown on the right side of Figure Crucially, H-SPLID is significantly less sensitive to right digit perturbations, without any prior knowledge of the redundant region or adversarial training.
Equal contribution. Shared supervision. Main work done during a research stay at Northeastern University.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Cross-Entropy
H-SPLID
Entangled Space
Salient Space
Nom Con-Salient Space
Train to classify left digit 6
ACC:
2. Alttcck after training
Comectly Tihee
ACC: 31.76
ACC: 87.46
9.C: 9.41
H-SPLID learns to ignore irrelevant input by decomposing the latent space into salient and non-salient components. Left: A simple diagnostic test for saliency, where the model is trained to classify the left digit (only labels for the left are provided) and it should ignore the right. Middle: A model trained with cross-entropy loss achieves high test accuracy (96.86%) but produces entangled representations, making it sensitive to perturbations on the right digit (accuracy drops to 31.76% under high-maanitude PGD attack). Right: H-SPLID separates the latent space into salient subspace, which captures dlas-dissriminative structure (ACC 97. 17714 and a non-salient subspace, which contains no class-relevant information (ACC 8.57%). This separation enables robustness to perturbations on irrelevant input (ACC 87.46%), showing proper learning of salient features. Embeddings are visualized using t-SNE [33
Figure I:
We extend this analysis in our experiments by applying adversarial attacks to the background of
COCO (28) images, applying image corruptions to medical images of skin lesions (9] and further
show that H-SPLID improves the transfer accuracy of ResNet-based (20) classifiers trained on
ImageNet (II] under real-world perturbations [58] (55. In addition our empirical evidence,
theoretically prove that the expected change in predictions under input perturbations is bounded by the dimension of the learned salient subspace and the Hilbert-Schmid Independence Criterion (HSIC) [6 between inputs and salient representations. This establishes a formal link between robustness and the salient representation. Our main contributions are:
We propose H-SPLID, a novel algorithm that promotes the learning of salient features by decomposing the network's latent space into salient and non-salient subspaces.
We prove that the two key design components of H-SPLID, namely, dimensionality re- duction of the salient subspace, together with the HSIC between inputs and salient latent representations, upper bounds the expected change in predictions under input perturbations. Moreover, show that the above HSIC and reduced salient space dimensionality bounds the volume the input domain that is vulnerable to perturbations.
We empirically demonstrate that H-SPLID learns salient features by leveraging attacks and other perturbations against non-salient regions of image, such as its background.
2
Related Work
Salient Feature Learning. Saliency methods in interpretability aim to identify input features that influence a model's prediction the most. Traditional post hoc approaches include gradient-based methods [44] [88. Class Activation Maps (CAMs) [3] 54], and perturbation-ban
methods [31] 41).
Unlike post hoc interpretability methods, however, H-SPLID aims to learn latent salient features for given task, such as image classification. Existing works on salient feature learning include saliency-
guided training for interpretabilityy (22 and saliency- based data augmentation [8] 52 methods that can complement our approach. However, H-SPLID does not use saliency maps as auxiliary signal to improve training R 52 or pretrained models [ to generate them. Moreover, the division of the latent space into "salient" and "non-salient spaces, as in H-SPLID, is comparatively unexplored in literature. Contrastive Analysis (CA) methods [ I (7 leverage this concept by learning explicit "common" and "salient" latent spaces with separate encoders via external supervision. While they

---

share the idea of learning separate spaces with H-SPLID, they rely on dedicated target dataset containing the salient class, and a background dataset with samples exhibiting non-salient features. In contrast, our method does not rely on external data, and learns an initial unified latent space, before partitioning it into salient and non-salient dimensions.
Feature Decomposition and Selection. Feature selection methods aim to identify a subset of input features that is most predictive of the target variable [61 18], with popular approaches including L1 regularization [49] and Group-Lasso regularization [62]. Similar to these methods, H-SPLID transforms and selects features during training. but diverges in its approach through its decomposition of the latent space. For the task of clustering, Miklautz et al. [37] recently introduced the idea of latent space partitioning, whereas H-SPLID embeds this split directly into classifier's training loop, using labels to shape the salient vs. non-salient space. Moreover, H-SPLID incorporates the HSIC penalty [32) to regularize the statistical dependence between the inputs and salient features from each subspace, ensuring that the salient subspace retains only task-relevant information while the non-salient subspace absorbs redundant variability, thereby reducing feature dimensions.
Adversarial Robustness and Saliency. We use adversarial attacks evaluate the quality of the learned salient features. Several studies have begun exploring the interplay between saliency and robustness 122
51 17 29]. Among these methods, many require adversarial training [34 which
is not only computationally demanding, but also tailored to specific attacks, An alternative line of research seeks enhance robustness without adversarial training. Multiple works [19 3 56 [3 have attributed adversarial vulnerability to the network's s reliance on high-dimensional task-irrelevant features. For instance, Alemi et al. 3 hypothesize that neural networks falsely rely on task-irrelevant features from the training data, negatively impacting robust generalization. Melamed et al. [36] show, under a simplified two-layer model, that when data is confined to a low-dimensional manifold, there exists an off aff-manifold space in which weights remain mostly unchanged and can be exploited by adversarial perturbations. Haldar et al. [9] demonstrate that when there are redundant latent dimensions, off- ff--manifold attacks can lead to decision boundaries that rely on task-irrelevant feature dimensions. Fischer [33 introduced an information bottleneck (50) to compress input information and preserve task-relevant features without adversarial training. Wang al. [56] extends this framework to the HSIC bottleneck [32), upon which H-SPLID is built. Importantly, H-SPLID departs from the HSIC bottleneck penalty, and introduces separate terms for salient and non-salient features. Our method also improves upon the guarantees Wang et al. (56), tightening their bounds to account for the impact of the dimensionality reduction induced by H-SPLID.
3 Methodology
3.1 Problem Setup
We consider k-class classification over dataset D ((x,, y:)) X V. where X' C Rd
is compact input space, y C R is the label space, and each input x; X is associated with the corresponding one-hot class label y; E V. The neural network he Rd + R* consists of an encoder followed by a linear layer. The encoder, denoted by fo X + R with parameters ub E I?, maps an input x to a latent representation z E R C RT i.e., z = (x). The linear output layer, !w : R + &R& computes the & logits using parameters W E &x i.e., gw(z) = Wz. Thus, we can express the neural network he = gw fo with parameters 0 (vb W]. Hence, the prediction of sample i is ý: = fx Lastly, parameters 0 = {2b, W] are trained by minimizing the cross-entropy loss with softmax layer, i.e., Loe (D; 4 E ((xi, y;, 0), where Eyey
yx 0) E Uj log(o, (f)) and or (y) ex. /E, e is the softmax function : R Rk.
3.2 Saliency-Aware Latent Decomposition
We introduce a representation learning framework that separates latent features into salient (i.e., task-relevant) and non-salient (i.e., task-irrelevant) components. The model is trained with a struc- tured objective that integrates classification, geometric regularization, and statistical independence constraints, producing representations that improve both predictive performance and robustness. An overview of our method is shown in Figure
3

---

salient space Z,
non-salient space Z,
pertubation
embeediing space
WiA PISTOCA, Z.)
M,
sullest waikk
encoder
M
nott-salinze
31
non-sallent Information
Figure 2: Overview of H-SPLID. The salient information for classifying the black bear is encoded in the salient space 2s, whereas the background information is encoded the non-salient space Zn, allowing H-SPLID to be more robust to perturbations d of the background.
Given the encoder Sap we introduce a learnable diagonal mask matrix M, = diag (0, 1 where 3 E {0, } selects salient (task-relevant) features. The complementary non-salient mask is defined as M, = I M,. The latent representation z = fw (x) E is then decomposed into the following salient and non-salient representations: with being a vector of 1.
M,z B o and nn M,, (1- (1-B)
Define (y:); as the j-th element of the y; label. Then, classification is performed using only the salient component of the latent space 2, E 2, and the corresponding cross cross-entropy loss is given by:
Lee (D,,M.)
Σ (y)) log(o()))), with ý w (x)
(I)
3.3 Regularizing and Preserving the Separated Features
While the saliency masks enable latent space partitioning, the quality and stability of this separation depend on additional constraints that encourage discriminative utility. We achieve this via two regularization mechanisms: masked clustering losses and Hilbert-Schmidt Independence Criterion (HSIC) 16 penalties.
Let X XI,,..,,Xn) Xn] E gdxn be the matrix of input vectors and Z = f E R be the matrix of latent vectors for n samples, with masked variants z, M. and Z, M, For each class k. let Cs denote the set of indices with label k, and define μ4 as the class centroid and μ as the global centroid of latent vectors. We define the following masked norm-based losses 337:
K Σ Σ k=IE
L. M.)
|M, (M)2= (.,
Σ MM. 11l1 (2)
Loss L. encourages the clustering of class-specific representations in the salient subspace, strength- ening its discriminative capacity. Each class has simple uni-modal form which further removes redundant information. The loss C, aligns the other features globally across samples in the non- salient space and captures shared variation. Moreover, by capturing task-irrelevant variations-an -uch as background information non non-salient features help isolate predictive factors in the salient space, enhancing robustness and disentanglement. To further promote robust but accurate decompositions, we incorporate two additional HSIC terms:
Pg HSIC(X, 2.) + P., HSIC((Y Z..).
As HSIC a measure of similarity (see Appendix A). the term HSIC(X, Z.) reduces the dependence between the input features and the salient subspace, thereby removing redundant information. Simi- larly, HSTC(Y, Z,) reduces the dependence between label information in the non-salient subspace. We use the unbiased empirical estimator [16] of HSIC:
( Z.)
ΣΣ>
(n
j=1i=l

---

where K₂ and K2 have elements K26.)) = kx X,) and Ken.) (M, M,Z,), and H
I- n _11 is the centering matrix.
Putting everything together, we define H-SPLID's overall training objective as:
L(D; M,, M.) Ao M,) + X,C, v, M.) + An M.) + Ps HSIC(X, Z,) + Pn. HSIC(Y, Z,),
(5)
where Z. Rmxx are the concatenated salient and non-salient latent representation, and Aoe; Aa, AR, Ps, Pr. 2 0 are scalar weights. Training amounts to solving the following constrained optimization problem:
min O.M,
L(D; MI,
(6a)
subject to
M, Ms
2; fx(x),, Vi E nn.
(6b)
1
μ= 1 Σ 24-
F =
Zi
(6c)
C
iECk
t=1
3.4 The H-SPLID Algorithm
We solve Problem (6) using alternating optimization procedure over the neural network parameters and the diagonal mask matrix M, E mm (see Algorithm in Appendix B) each outer epoch
the procedure consists of two alternating steps:
(a) Latent Representation Update (Fix M., optimize 0): Given fixed mask (((-1), update the
encoder parameters {4p W] by minimizing the loss L as in Eq. (5) using minibatch stochastic gradient descent with B C DD for epoch:
e - 0 V (( (1 ",M())
where the class means μ4 and global means μ are computed based on the minibatch via Eq. (6c).
(b) Mask Update (Fix 0, optimize M,): With updated latent representations z, forro) (x:), optimize the following optimization problem to learn the masks M(.) M
min 3
XgC. (Z M.) + An Cn (Z Mn)
(7a)
subject to
M, (f),
M, = I M..
(7b)
Miklautz et al. (37] show that Prob. has closed-form solution:
Am EzeD(Zi 11,)
B
A L K k=l Execr (2)))² An Ex (u,)' Vi (l,...,m),
where the global mean μ and class means μ4 are computed from the full dataset via Eq. 66 use moving average when updating the masks to improve convergence (See Algorithm Tine 11 in Appendix B). The above optimization yields a continuous mask 3 [0, 1]"". After convergence, obtain binary version by thresholding each entry at 0.5. In practice, using the continuous mask directly gives similar results, as the learned values typically concentrate near or 1.
We
3.5 Theoretical Guarantees
In our experiments, study whether H-SPLID relies on salient vs. non-salient features by examining the trained network's response to perturbations to task-irrelevant portions of the input (e.g., the right
digit in Fig.[[] []] an image background in the COCO dataset in Section 4 etc.). Wang et al. (56) showed that HSIC regularization terms promote feature invariance and improve robustness even without adversarial training; we extend their analysis by integrating HSIC regularization (Eq. K with salient space isolation (Eq. (2). which structurally separates dlas-discriminaaive and redundant information so, we make the following assumptions on the kernel families used
the representation space.
in the regularization terms Eq. 3
5

---

Assumption 3.1 (Kernel Function Boundedness and Universality). Let K2 : X x X' - Raxd and : 2 R be continuous positive-definice kernels defined on compact metric spaces X' and 2, respectively. Let F and G denote their associated RKHSs. We assume that:
1. The kernels are universal on X' and 2, i.e., FF is dense in Rd) and G is dense in C(2,R% under the supremum norm topology;
2. All functions in these RKHSs are uniformly bounded the pointwise 2-norm, that is,
Ky sup
|| < 00, and Kg = sup | 00; feF
gEg
where II == su (x)]22
Many widely used kernels are known to be universal on compact subsets of Rd including the Gaussian (RBF), Laplacian, and Matérn kernels [46 45]. Universality ensures that the RKHS is rich enough to approximate any continuous function
the domain, while boundedness holds automatically on compact input spaces when the kernel is continuous. These properties collectively justify the use of besnel-based function classes for comparing or aligning with neural network outputs, particularly when both are assumed to operate over compact, bounded input spaces.
As is common when modeling bounded inputs 33 40 we use the truncated multivariate normal X 2 - x||s where
(tMVN) distribution: x ~ (0, o²Ia), with density p(x) = j exp
R > 0 denotes the truncation radius, o² >> 0 is the variance parameter, and C' is the normalization constant. Our main robustness guarantee shows that the sensitivity of the model prediction is controlled by (a) the dimensionality of the salient space and (b) the HSIC between the inputs and salient representations.
Theorem 3.2 (HSIC-Based Robustness Bound). Let x be sampled from a IMVN distribution x ~ NR o² La), and let the neural network he E + Rh be differentiable almost everywhere with an L-Lipschitz encoder fe and bounded linear output layer with || S B. Suppose the RKHSs associated with K₂ and K₂ satisfy Assumption 3.1 with kernel sup-norm bounds K5, Kg. Let 8 = || MMllo be the count of non-zero entries of the salient mask. Then, for all perturbation maps 5 Rd + Idd such that [|0(x)ll2 S for all x E X. the expected output deviation satisfies
from
Ex (x + 0xx)) he (x)]la) S RRBvks(LR. + (0)12)) HSIC(x, 2.) + +(r))
(9)
o²K
where z, M,f is the salient representation and (W, }/} denotes the collection of neural network parameters.
The proof of Theorem 3.2 can be found in Appendix C Intuitively, with stronger information compression imposed by minimizing both the HSIC term (thereby reducing HSIC(x, 2,)) and the masks (thereby reducing the salient mask support s |M, the model is forced to rely only on salient features: Theorem 3.2 suggests that, in this case, the perturbation is more likely to end up in the non- non-salient space. and the majority of the attack does not contribute to the change of the output of the neural network, as | + 6(x)) - ho (x)]] stays small for any perturbation map d(-) with |8(x)]l2 I r. From technical perspective, our theorem differs from Wang et al. [56] in two aspects. First, we sharpen the dependence of the upper bound on the power of the perturbation; this allows us explicitly link it to the dimension of the salient mask Second, we extend their binary classification framework (i.e., k = 1 with one output value) to multi-class classification (with arbitrary k) to cover a wider range of classification models.
Additionally, we can quantify how perturbations will trigger prediction changes from the vol- ume of the entire input domain. In particular, define the salient-active region X'(c) := {x E X'R || V (x)(x))l > e}. Under the tMVN distribution, the probability that an input falls into this region equals its measure: a (X)(e) P (I (x)]lr follows:
>).. We can bound this probability as
Corollary 3.3 (Salient Region Volume Bound via HSIC). Under the same assumptions of Theorem 3.2 for any threshold e > O, the probability that a random input falls into the salient-active input region is upper bounded by
(RBvks hs LR (0)l2)
HSIC(X, 2.) + +o(1)
Px Xx([VV/o(xx) > -
(10)
0² o2KrKg

---

Dataset
Encoder Model fe
Input size
Perturbation type
Categories
C-MNIST
LeNet-3 ReaNes-18
61
atack right digit +
COCO subset (bear, elophant, giraffe, zehra)
3 224 x 224
PGD and AA attack (block, background. full) 1O
4
ISIC/2017 (nevus, melamoma, sehor- theic keratnsis)
ResNet-50
3 224 224
Real world corruttions (brightness, de-
3
focus, occlusion) 21]
ImageNet 9
ResNet-50 ResNet-50
3.x 224 224
Background manipulation and removal
368
CounterAnimal (Common Counter)
3 X
Counterfactual backgrounds
45
Table I: Datasets and corresponding models. grounds/contexts are manipulated in our evaluations.
"Perturbation type" summarizes how back-
(a)
(b)
Figure 3: (a) Samples from the CounterAnimal dataset. Common set (left), counter set (right). (b) Adversarial aftacks on non-salient features. We attack the non non-salient background of COCO images (left) given their corresponding block (upper right) or background mask (lower right) to test whether models successfully learned salient features.
Thus, Corollary 3.3 implies that the volume of the salient-active region is tightly controlled by the dimensionality of the salient space and the HSIC between inputs and the salient representation. The proof is in Appendix
4 Experiments
In this section, we describe our datasets, comparison methods, experiment setup, and performance metrics. Additional runtime experiments. implementation details, and hyperparameter tuning and configuration protocols provided in the Appendix F Our code is publicly available at httpps// / github. cwm/neu- saannnpprrallHlaa HHSDID
Datasets and Encoder Models We evaluate H-SPLID on synthetic and natural image benchmarks, spanning five datasets and three architectures (Table D. We create synthetic Doncatenated-MNT MNNIST (C-MNIST) dataset (see Fig. T by concatenating two MNIST digits with the left digit as the class label. We use LeNet-3 27 26 as an encoder. We construct four-class subset of COCO 28 (bear, elephunt, giraffe, zebra), coupled with a ResNet-18 (20] encoder. ISIC-2017 is a medical imaging dataset [9. ImageNet-9 -9 (IN-9) (58), encompasses 368 classes from ImageNet- KK instantiated in three variants: Original images, MixedRand variant in which object foregrounds are put onto random- class backgrounds, and an Only-FG variant with backgrounds entirely removed (See Figure 4 CounterAnimal (CA) [55]. splits iNaturalist wildlife photos into Common set (exhibiting typical backgrounds) and a Counter set (featuring atypical yet plausible backgrounds) (see Fig. 3a). We use ResNet-50 an encoder for ISIC-2017 and ImageNet derived datasets.
Comparison Methods. demonstrate how H-SPLID focuses on task-relevant characteristics, we compare with several methods for feature selection and weight regularization, including weight decay (L2 regularization) (25). L1 regularization [49], Group-Lasso regularization [62]. and two activation-sparsiiy variants one applying L1 penalty to the penultimate layer's activations and another applying a Group-Lasso penalty across those activations to promote instance-level sparsity. Finally, compare against HBaR (56) under non-adversarial training, and vanilla baseline trained only with cross-entropy loss. Appendix provides further details on training and implementation.
CountteAniiall is benchmark split (Common/CConter) over multiple species; we follow its predefined taxonomy and report performance across the two splits rather than fixed class count.
7

---

No Atk.
Block Atk.
Background Atk.
Full Atk.
Comp.
6=
25G
205
255
253
255
255
255
255
255
Va.
98.1=0.44
56.
51.3+1.3
55.1
75.2+0.2
56.6+0.2
34.4+0.1
55.9=0.2
34.2+0.3
WD
94.3+0.7
43.9+0.5 57.240.4
76.9=0.8
76.3=0.0 59.9+0.3 43.0+0.1
57.8+0.1
40.7=0.2
GLA
97.120.6
60.4+1.2 70.4+0.8 78.8+0.8 75.120.2 57. 57.4 35.3+0.3
57.5+0.3 37.
PGD
GLW
92.6*1.1 45.4=0.5 47.2+0.5 58. 58.040.6 72.6+0,0 58,4+0.0 42.9+0.1 54,9=0.1 41.2=0.22
LSA
97.1=0.4 57.3+1.2 63.5+0.5 71.9+0.6 71.2+0.1 54.1+0.3 33.7+0.2 51.7+0.2 35,0=0.4
LSW
96,0=0.6
43,2+0.5 42.5+0.8 57.0=0.4 73.5+0.0 55.6+0.1 37.0+0.1 53.1+0.1 1
HBaR
97.1+0.4
17.4+1.3 54.0#1.1 67.0+1.2 77 77.9+0.1 60.2+0.3 39.9+0.3 62.420.2 41.920.3
Ours
97.9+0.3 71.9+0.7 68.540.5 72.3+0.4 78.0+0.1 68.9+0.5 57.5+0.2 66.520.1 58.920.4
Va.
98.1+0.4
42.8+0.2 21.0=0.88 19.9#0.6
86.1 41.6+0.1 26.440.2 45.5+0.1 1
WD
94.3=0.7 38.5+0.8 23.0+0.7 22.5#0.6 74.1=0.0 53.4+0.1 38.7+0.1
53.5+0.0 29.3#0.0
GLA
97.1=0.6
43.3#1.0 27.2+1.0 28.9+1.2 64.6#0.1
39.8+0.1 26.8+0.2 45.5+0.0 21.0=0.1
GLW
92.6#1.1 41.3+0.8 24.6+0.8 23.1+0.6 71.1=0,1 52.0+0.0 38.840.1 52.1#0.0 29.5=0.0
LSA
97.1=0.4 40.9+0.7 25.5+0.6 25.7:0.6 62.620.1 39.5+0.1
25.3+0.2 42.4+0.1 20.3
LSW 96.0=0.6 37.5+0.6 20.640.7 20.5+0.5 69.7=0.0 47.3+0.1
31.8+0.2 47.3+0.0 20.520.1
HBaR 97.1+0.4 39.5+0.9 21.440.8 29.2+0.4 70.1 45.4+0.1 31.4+0.3 50.4+0.1 25.2+0.2
Ours 97.9=0.3 62.1+0.4 48.8+0.3 48.3+0.5 74.2+0.0 59.6+0.2 52.6+0.1 60.4+0.1 48.8+0.2
Table 2: Measuring saliency with adversarial attacks on COCO. H-SPLID (Ours) improves robustness to adversarial attacks compared to most baselines, with the largest performance gains observed under stronger background-aaggeted attacks (two middle columns). Here, AA denotes AutoAttack, while PGD denotes Projected Gradient Descent. The attack magnitude is indicated using ratios of pixel values, with the strongest attack being 255
255 All models are trained without adversarial data. Va., WD, LSA, LSW, GLA, and GLW denote Vanilla, Weight Decay, L1 Sparse Activations, L1 Sparse Weights, Group-Lasso Activations, and Group-Lasso Weights, respectively.
We train H-SPLID and all comparison methods exclusively on clean data without employing adver- sarial attacks or having access to saliency masks. In all datasets, we employ 80-20 validation split
for tuning, and use held-out test sets for final evaluation. Following prior art [32 60 59 56), use
the Normalized Cross Covariance Operator [14 to get a scale-insensitive HSIC penalty, All methods are evaluated using clean test accuracy (over three seeds) and robust test accuracy under different attacks, described below.
Testset Attacks. Methods are evaluated w.r.t. a broad array of attacks on non-salient features at test-time. On C-MNIST, we evaluate predictive performance against PGD attack on the saln-na right digit. For COCO experiments, we pretrain a ResNet-18 (20) from random initialization for 100 epochs with cross-entropy, followed by 200 epochs of method-specifie training before evaluating on the held-out test set. We test PGD and AA in three ways: random blocks of pixels in the background, pixel perturbations in the background, and full-image attacks. On ISIC-2017, we use a ResNet-50 pretrained on ImageNet for feature extraction, train a three-clase head for 50 epochs, and then run 50 epochs of weethod-specinfe training. We test robustness under real-world corruptions (brightnesss defocus blur, and snow/occlusion from the corruptions benchmark (21) applied to non-salient regions (non-lesion pixels). We use IN-9 and CA for transfer learning experiments as follows. First, we train a ResNer-50 (20 initialized from ImageNet-1K K pretrained weights (Torch Vision R55) for 20 epochs of method-specae -peecfffe training on ImageNet-1K- IK. Then, we test the model on the IN-9 (the original IN-9 and its MixedRand and Only-FG variants) and also on CA (CA-Common and CA-Counter) evaluation sets (see Table
PGD is implemented via 10 iterations with a step size = 0.0156 and AutoAttack 10 is imple- mented using the rand ensemble. Attacks per block (Block Atk., see Fig. (3b) are confined single randomly placed block in the background, with size 1 x 4 of the image dimensions. Attacks restricted to background pixels (Block Atk., Background Atk., see Fig. 3bb use saliency masks, which are available for COCO and IS1C-2017. Full attacks (Full Atk.) are across the entire image. PGD and AA Attacks are conducted over a range of levels, with each configuration repeated across five random seeds. Additional implementation details and hyperparameter settings are provided in Appendix F
8

---

No Perturb. Brightness
Defocus
Occlusion
Va.
7,,45 66.43:12.277 63.77::..88 62.8713.081
WD
75.63=1.555 67.53+22.800 64.57:2.295 63.55:138851
LSA
75.62=1.211 66.50:2.171 64.33+1.653
62.27=4.256
LSW 75.30=1.040 66.13:2.432
63.22:42.506
62.70:3.810
GLA 75.38=1.383 66.50:13.136
61.32:14.501
62.68:2.969
GLW 70.65+4.118 60.23++6.698
58.63++9.564 60.62+5.697
HBaR 75.90==0.844 68.70+1.942 65.62++2.058 66.18 16.08133001
Ours 76.78=:0.778 70.00=11.619 68.38 6..56
Table 3: Measuring saliency with real-world perturbations on ISIC-2017. H-SPLID (Ours) achieves the best robustness across lighting (brightness), blur (defocus), and occlusion (snow) when perturbations are restricted to non-salient regions. All models are trained without adversarial data. Va., WD, LSA, LSW, GLA, and GLW denote Vanilla, Weight Decay, L1 Sparse Activations, L1 Sparse Weights, Group-Lasso Activations, and Group-Lasso Weights, respectively.
4.1 Results
Controlled attack Benchmark COCO. We quantitatively demonstrate the ability of H-SPLID learn salient features on the four-class COCO benchmark by evaluating adversarial robustness under block, background, and full-image perturbations. As shown in Table 2 H-SPLID achieves 57.5% under background-only PGD attacks at e 3/255, with the closest competitor attaining 43.0%. Even when attacks span the entire image, H-SPLID sustains 58.9% accuracy under PGD attack with c 2/255, surpassing the 34.2% of the vanilla network and 41.9% of the best performing competitor. Against the stronger AutoAttack ensemble, H-SPLID consistently outperforms all baselines in robustness to adversarial perturbations.
These results show that explicitly decomposing latent features into salient and non-salient subspaces delivers substantial robustness gains, with the most pronounced improvements occurring under background-onle perturbations, validating that H-SPLID effectively isolates redundant information. Moreover, robustness gains are achieved without any adversarial training, demonstrating that H- SPLID's 's latent decomposition strategy yields inherently saliency preserving representations.
Medical imaging Benchmark ISIC-2017. To further assess domain generality and robustness, we evaluate H-SPLID the ISIC-2017 skin lesion classification dataset [9] (three classes: nevus, melanoma, seborrheic keratosis). We perturb only non-salient regions (e.g., non-lesion pixels) and adopt three real-world corruptions from the corrpptions benchmark [21]: brightness (lighting), defocus blur (blur), and snow (which effectively occludes small patches; we report as occlusion). Results averaged over 10 random seeds.
These medical imaging results mirror our COCO findings: explicitly separating salient from non- salient latents confers consistent robustness gains under realistic, non-adversarial corruptions, espe- cially when perturbations target only non-salient regions. Together with Table this strengthens the evidence that H-SPLID learns daliency-preserving representations that generalize beyond natural images to specialized clinical domains.
Saliency Benchmarks. We measure the saliency of model on the ImageNet-9 and CounterAn- imal benchmarks. In Table H-SPLID attains the highest accuracy on the IN-9 test set (76.7%), outperforming the vanilla baseline by 2.7% and exceeding the next best regularization method by over 1%. When the backgrounds are entirely removed (Only-FG), H-SPLID once again surpasses all methods with 64.5% test accuracy, demonstrating its ability to distill object-centric features. On the more challenging MixedRand variant, it achieves a 59.5% test accuracy, substantial 3.1% gain over the strongest baseline. On the CA Common set, which preserves typical contextual correlations, H-SPLID matches the top performing method (80.3% vs. 80.7%). Finally, on the CA Counter set of atypical contexts, surpasses all competitors with 60.6% test accuracy, a 2. 1% improvement over the HBaR model. The consistent performance across original, background-alters shifted datasets demonstrates that the explicit separation of salient and non-salient subspaces in H-SPLID yields representations that transfer more robustly to new tasks and real-world perturbations.
and contextually

---

Method
IN-9
Only-FG
MixedRand CA-Common CA-Counter
Vanilla
74.0
60.5
51.2
78.3
58,4
Weight Decay
72.6
58.4
51.2
77.3
54.4
Group Lasso Activations
75.3
63.8
55.7
79.9
58.3
Group Lasso Weights
73.0
60.0
50.6
78.3
57.1
L1 Sparse Activations
74.8
62.9
56,4
80.7
58.1
L1 Sparse Weights
73.7
61.3
51.9
78.1
54.7
HBaR
73.6
63.3
53.8
79.3
58.5
H-SPLID
76.7
64.5
59.5
80.3
60.6
Table 4: Transfer accuracy ImageNet-9 and CounterAnimal saliency benchmarks H-SPLID achieves the highest accuracy on the most challenging splits (MixedRand and CA-Counter), demon- strating the robust transferability of its learned representations.
Method
No Atk. Background Atk.
Full Atk.
AceLic
98.30
33.75+0.1
35.29=0.5
AceLie + XgL, duan
97.52
43.69#0.2
44.12+0.3
AceLee + H&HSIC Z.) P., HSIC(Y, Z..)
96.74
42.71+0.3
45.87+0.8
H-SPLID (full L)
97.59
57.12+0.3
58.4440.2
Table 5: Ablation of loss terms on COCO. Accuracy under no attack, Background Attack 3/ 3/255), and Full Attack (c = 2/255) using PGD. Attacks run with five random seeds. The complete objective delivers the highest robust performance.
Loss Term Ablations. We ablate the loss components according to their conceptual grouping, namely cross-entropy (Lee), cross-entropy loss with space separation (Lee + L. + L,). cross-entropy loss with HSIC components (Ler + HSIC(X, Z.) + HSIC(Y, Z,.) and the full H-SPLID loss (C). The mask computation (Section 3.4 remains unchanged across all ablations (the difference is whether the clustering loss terms L. L., are optimized). All ablations are performed starting from the best-performing COCO model (Appendix F.4) by removing individual components of the full L objective. Each loss combination was independently tuned to achieve its best performance, As shown Table [S] simply using the cross-entropy loss yields poor background robustness (33.75%). Adding the C, and L,, terms or the HSIC penalties improves robustness to approximately 43-46%, while maintaining clean accuracy above 96%. The complete objective results the best robust performance (57.12%) while maintaining competitive clean accuracy (97.59%) We further assess the sensitivity of H-SPLID its hyperparameters in Appendix G.2
Limitations & Conclusion
Limitations. H-SPLID assumes the presence irrelevant information in the input, as well as sufficiently diverse dataset in which class-specifie features occur across varying contexts. If particular feature always co-occurs with the same context, H-SPLID cannot separate salient from non-salient information, since both appear inseparably knowledge to resolve. Further, we restricted our analysis to image data, where the distinction between salient and non-salient regions is intuitive to humans. Investigating whether similar decompositions apply to other data modalities remains an exciting direction for future work.
challenge that would require external
Conclusion. We introduce H-SPLID, novel method for salient feature learning that decomposes the latent space of a neural network into task-relevant and fask-irrelevant components during training. Unlike prior work, H-SPLID performs supervised feature selection an end-to-end manner, without relying on external saliency annotations. Our theoretical analysis provides formal insight into how this decomposition promotes compact and informative representations. Empirically, we show that H-SPLID learns class- disissi-siiiiiiaiive features and naturally reduces reliance on irrelevant input variations. In future work, we would like to combine H-SPLID with self-supervised models such as I-JEPA [), with the goal of learning features that generalize better to downstream tasks. Additionally, we plan to explore the decomposition of salient and non-salient spaces other data modalities, including graphs, text, and multi-modal data.
10

---

Acknowledgments and Disclosure of Funding
We gratefully acknowledge support from the National Science Foundation through grant CNS- 2414652. Further, this work is supported in part by NIH SU24CA264369-03, We acknowledge the EuroHPC Joint Undertaking for awarding this project access to the MareNostrum supercomputer (hosted at BSC, Spain), MeluXina (operated by LuxProvide, Luxembourg), Deucalion (hosted at the Minho Advanced Computing Center, Portugal), and Discoverer (hosted at Sofia Tech, Bulgaria) through EuroHPC Access allocations.
References
[1] A. Abid and Y. Zou. Contrastive variational autoencoder enhances salient features. ArXiv, abs/ Dtss/1902.04601, 2019. URL URLttts::://pp www.aticcscoolarr............aa. org/Corpus : 66153367
[2] A. Abid, M. J. Zhang, V. K. Bagaria, and J. Zou. Exploring patterns enriched in dataset with contrastive principal component analysis. Nature Communications, 9(1):2134, May 2018. ISSN 2041-1723, doi: 10.1038/<4446--088-000 0144--88-.. URL https:///os: wwwooo//............ 10. 1038/ 841467-018-04608-
[3] A. A. Alemi, I. Fischer, V. Dillon, and K. Murphy. Deep variational information bottleneck. arXiv preprint arXiv: 1612.0061,,00110, 2016.
[4] M. Assran, Q. Duval, Misra, P. Bojanowski. Vincent, M. G. Rabbat, Y. LeCun, and N. Ballas. Self-supervised learning from images with a joint-embedding predictive architecture. In CVPR, pages 15619-15629 IEEE, 2023.
[5] B. Aydemir, D. Bhattacharjee, T. Zhang, M. Salzmann, and S. Süsstrunk. Data augmentation via latent diffusion for saliency prediction, 2024. URL htt.t:ttt////xiii/ www.aiwww.....oooooooooo.eoooeet hts///b///24// 07300
[6] Y. Bengio, A. C. Courville, and P. Vincent. Representation learning: A review and new perspectives. IEEE Transactions on Pattern Analysis and Machine Intelligence, 35:1798-1828, 2012. URL https:: //api. www.eeeiicccooiiiooooeoo
org/ Corpus 393948
[7] C. Carmeli, E. D. Vito, A. Toigo, and V. Umanità. Vector valued reproducing kernel hilbert spaces and universality, 2008. URL /ttpp:://axxi.......//
/000 0807 1659
[8] M. Chen, Wang, S. Tang, F. Zhu, H. Yang, L. Bai, R. Zhao, D. Qi, and W. Ouyang. Saliency guided contrastive learning on scene images, 2023. URL httpss//s//// org hbspg//bb/////2// 11461
[9] N. C. Codella, D. Gutman, M. E. Celebi, B. Helba, M. A. Marchetti, S. W. Dusza, A. Kalloo, K. Liopyris, N. Mishra, H. Kittler, al. Skin lesion analysis toward melanoma detection: challenge at the 2017 international symposium on biomedical imaging (isbi), hosted by the international skin imaging collaboration (isic). In 2018 IEEE / 15th international symposium on biomedical imaging (ISBI 2018), pages 168-172. IEEE, 2018
[10] Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble diverse parameter-free attacks. In International conference machine learning, pages 2206-2216. PMLR, 2020.
[11] J. Deng, W. Dong, R. Socher, L. Li, and Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. leee, 2009.
[12) C. Etmann, S. Lunz, P. Maass, and C. Schoenlieb. On the connection between adversarial robustness and saliency map interpretability. In K. Chaudhuri and R. Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Pro- ceedings of Machine Learning Research, pages 1823-1832. PMLR, 09-15 Jun 2019. URL https: ftttp:://proceeding mlr press/v97/etmante
html
[13] I. Fischer. The conditional entropy bottleneck. Entropy, 22(9):999, 2020.

---

[14] K. Fukumizu, A. Gretton, X. Sun, and B. Schölkopf. Kernel measures of condi- tional dependence. In Platt, D. Koller. Y. Singer, and S. Roweis, editors, Ad- vances in Neural Information Processing Systems, volume 20. Curran Associates, Inc., 2007. URL. bttpss//prroceedingg neurips. cttpeiisscccpappeeee htcp/pppe__ffeeeeeee ffilee//paeer/200///iie
pdf
[15] D. Greenfeld and U. Shalit. Robust learning with the Hilbert-schmidt independence criterion. In H. D. III and A. Singh, editors, Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 2759-3768. PMLR, 13-18 Jul 2020.
[16] A. Gretton, O. Bousquet, A. Smola, and B. Schölkopf. Measuring statistical dependence with hilbert-schmidt norms. In International conference on algorithmic learning theory, pages 63-77. Springer, 2005.
[17] A. Guesmi, N. S. Aswani, and M. Shafique. Exploring the interplay of interpretability and robustness in deep neural networks: A daliency-guided approach, 2024. URL attps://arxiy org/abs/2405.00 06278
[18] I. Guyon and A. Elisseeff. An introduction to variable and feature selection. J. Mach. Learn. Res., 3:1157-1182, 2003.
[19] R. Haldar, Y. Xing, and Q. Song. Effect of ambient-intrinsic dimension gap on adversarial vulnerability, In International Conference on Artificial Intelligence and Statistics, pages 1090- 1098. PMLR, 2024.
[20] K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In CVPR, pages 770-778. IEEE Computer Society, 2016. doi: 10.1109/CVP.22016.990
[21] D. Hendryeks and T. Dietterich. Benchmarking neural network robustness common corrup- tions and perturbations. In International Conference on Learning Representations, 2019. URL
[22] A. A. Ismail, H. C. Bravo, and S. Feizi. Improving deep learning interpretability by saliency guided training. In A. Beygelzimer, Y. Dauphin, P. Liang, and J. W. Vaughan, editors, Advances in Neural Information Processing Systems, 2021. htt.//ttppp//ppeeveeeee..u http://pppaeeeeeeeeeteffooooum id=x4zs7eC-Bal
[23] H. Kim. Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950. 2020.
[24] D. P. Kingma and J. Ba. Adam: A method for stochastic optimization. In Y. Bengio and LeCun, editors, 3rd International Conference on Learning Representations, ICLR 2015, San Diego. CA, USA, May 7-9, 2015, Conference Track Proceedings. 2015. doi: 10.48550/arXiv. 1412.6980.
[25] A. Krogh and Hertz. A simple weight decay can improve generalization. Advances in neural information processing systems, 4, 1991.
[26] Y. LeCun, B. Boser, J. S. Denker, D. Henderson, R. E. Howard, W. Hubbard, and L. D. Jackel. Backpropagation applied to handwritten zip code recognition. Neural computation, 1(4): 541-551, 1989.
[27] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2324 1998. doi: 10. 72.9777
[28] T.-Y. Lin, M. Maire, Belongie, J. Hays, P. Perona, D. Ramanan, Dollár, and C. L. Zitnick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part 13, pages 740-755 Springer, 2014.
12

---

[29] C. Liu and J. JaJa. Feature prioritization and regularization improve standard accuracy and adversarial robustness. In Proceedings of the Ewenty-Eightt International Joint Conference on Artificial Intelligence, IICAI-19, pages 2994-3000. International Joint Conferences on Artificial Intelligence Organization, 7 2019. doi: 1.224963/jjcai.2211/44 URI. https 7/doi.org/1i 200..24933//13 ijcai 2019/415
[30] M. Long, Y. Cao, J. Wang, and M. Jordan. Learning transferable features with deep adaptation networks. In F. Bach and D. Blei, editors, Proceedings of the 32nd International Conference on Machine Learning, volume 37 of Proceedings of Machine Learning Research, pages 97- 105, Lille, France, 07-09 Jul 2015. PMLR. long15. html
mml. mlr press/v37/
[31] S. M. Lundberg and S.-I. Lee. A unified approach to interpreting model predictions. In Proceed- ings of the 31st International Conference on Neural Information Processing Systems, NIPS' 17, page 4768 4777, Red Hook, NY, USA, 2017. Curran Associates Inc. ISBN 9781510860964
[32] W.-D. K. Ma, J. Lewis, and W. B. Kleijn. The hsic bottleneck: Deep learning without back propagation. Proceedings of the AAAI Conference on Artificial Intelligence, 34(04):5085- 5092. Apr. 2020. doi: 10. 1609/aaii....ooo http///aiii3404..5009 v34i04.5950. URL https://ojs aaai , rindxn
[33] H. Maatouk, D. Rullière, and X. Bay. Truncated multivariate normal distribution under nonlinear constraints. 2024.
[34] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
[35] T. maintainers and contributors. Torchvision: Pytorch's computer vision library. https //ithub. wtt.//ottoo/ooiiiiiiioiooo 2016.
[36] O. Melamed, G. Yehudai, and G. Vardi. Adversarial examples exist in two-layer relu networks for low dimensional linear subspaces. Advances in Neural Information Processing Systems, 36: 5028 1728-5049,200 2023.
[37] L. Miklautz, L. G. M. Bauer, D. Mautz, S. Tschiatschek, C. Böhm, and C. Plant. Details (don't) matter: Isolating cluster information in deep embedded spaces. In Z..H. Zhou, editor, Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21, pages 2826-2832. International Joint Conferences on Artificial Intelligence Organization, 2021. doi: 00.2496//jccai2222//388 httpss//////o org/ 10. 200.222963/jjaaa http:///caaa.22////3333 Main Track.
[38] M. Montero, Bowers, R. Costa, C. Ludwig, and G. Malhotra. Lost in latent space: Examining failures of disentangled models at combinatorial generalisation. In A. H. Oh,
A. Agarwal, D. Belgrave, and K. Cho, editors, Advances in Neural Information Processing Systems, 2022. URL [RRLittts///ppeeeeeviee wwwpeeerreiiee.eeeefrrrrrrrr nett/forumiid--yylTtti.
[39] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Z. Yang. Z. Deto, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang. J. Bai, and S. Chintala. Pytorch: An im- perative style, high-performance deep learning library. In H. M. Wallach, H. Larochelle, A. Beygelzimer, F. d' Alché-Buc, E. B. Fox, and R. Garnett, editors, Advances in Neu- ral Information Processing Systems 32: Annual Conference on Neural Information Pro- cessing Systems 2019, NeuriPS 2019, December 8-14, 2019, Vancouver, BC, Canada. pages 8024 8035, 2019. URL https: p/poee///rroceeiings parroceedings.neuiip..... htt.s/erseesp.pppee//////... pttppppper/219//asall Abstraatt-bssttttt... Attmract.ttttl.
[40] P. Ray, D. Pati, and A. Bhattacharya. Efficient bayesian shape-restricted function estimation with constrained gaussian process priors. Statistics and Computing, 30:839-853: 2020.
[41] M. T. Ribeiro, S. Singh, and C. Guestrin. "why should i trust you?": Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on
Knowledge Discovery and Data Mining, KDD '16, page 1135-1 144, New York, NY, USA, 2016. Association for Computing Machinery. ISBN 9781450342322. doi: 10.1 49449/99999772299777778
URL TRLhttts:: atttps://doi. org 10.
2939778
13

---

[42] A. S. Ros and F. Doshi Velez. Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In Proceedings of the Thirty-Seconel AAAI Conference Artificial Intelligence and Thirtieth Innovative Applications of Artificial Intelligence Conference and Eighth AAAI Symposium on Educational Advances Artificial Intelligence, AAAI18/AAII18//AN 18. AAAI Press, 2018. ISBN 978-1-57735-800
[43] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra. Grad-cam: Visual explanations from deep networks via gradient- based localization. In 2017 IEEE International Conference on Computer Vision (ICCV), pages 618-626, 2017. doi: 10. 10911CC.2201..74
[44] K. Simonyan, A. Vedaldi, and A. Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. In Y. Bengio and Y. LeCun, editors, 2nd International Conference on Learning Representations, ICLR 2014, Banff. AB, Canada, April 14-16, 2014, Workshop Track Proceedings, 2014. URL.attp://arxix org/ abs 111//1112222 6034
[45] B. K. Sriperumbudur, K. Fukumizu, and G. R. Lanckriet. Universality, characteristic kernels and rkhs embedding of measures. Journal of Machine Learning Research, 12(7), 2011.
[46] I. Steinwart. On the influence of the kernel on the consistency of support vector machines. Journal of machine learning research, 2(Nov):67-93,, 2001.
[47] I. Steinwart and A. Christmann. Support Vector Machines. Springer Publishing Company, Incorporated, 1st edition, 2008. ISBN 0387772413.
[48] M. Sundararajan, A. Taly, and Q. Yan. Axiomatic attribution for deep networks. In Proceedings of the 34th International Conference on Machine Learning Volume 70, ICML' 17, page 3319-3325 3328. JMLR.org, 2017.
[49] R. Tibshirani. Regression shrinkage and selection via the lasso. Journal of the Royal Statistical Society Series B: Statistical Methodology, (8(1))267-288 1996.
[50] N. Tishby and N. Zaslavsky. Deep learning and the information bottleneck principle. In 2015 IEEE Information Theory Workshop (ITW), pages 1-5, 2015. doi: 10.1199/T..2015/13311....
[51] D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry. Robustness may be at odds with accuracy. International Conference on Learning Representations, 2019. URL https://openrevier new/forumm ? 1dd=Sxxb30cyy
[52] A. F. M. S. Uddin, M. S. Monira, W. Shin, T. Chung, and S.-H. Bac. Saliencymix: A saliency guided data augmentation strategy for better regularization. In International Con- ference Learning Representations, 2021. URL https://openreriew..eee wtw.reeiiiiiieetettouiriiiei. MOQKkBBTTQ
[53] L. Van der Maaten and G. Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008
[54] H. Wang, Z. Wang, M. Du, F. Yang, Z. Zhang, S. Ding, P. Mardziel, and X. Hu. Score-cam: Scire-weighted visual explanations for convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 24-25, 2020.
[55] Q. Wang, Y. Lin, Y. Chen, L. Schmidt, B. Han, and T. Zhang. A sober look at the robustness of clips to spurious features. In NeurIPS, 2024.
[56] Z. Wang, T. Jian, A. Masoomi, S. Ioannidis, and J. G. Dy. Revisiting hilbert-schmidt information bottleneck for adversarial robustness. In NeurlPS, pages (966599,,0011,
[57] E. Weinherger, N. Beebe Beebe-Wang, and S.-I. Lee. Moment matching deep contrastive latent variable models. In AISTATS, pages 2354 2354-2371, 2022. URI https::/pproceeednggs wow.eiiinninmm..m...mmmm.m.mm..m press/
v151/weinberger22.. html
[58] K. Xiao, I.. Engstrom, A. Ilyas, and A. Madry. Noise or signal: The role of image backgrounds in object recognition. In ICLR. OpenReview.net, 2021.
14

---

[59] J. W. J.,
Li, and H. Yuan. Dependency maximization forward feature selection algorithms based on normalized cooasncoe operator and its approximated form for high-dimensional data. Inf. Sci., 617(())4114444,, Dec. 2022. ISSN 0020-0255. doi:
htl.htttss:/doi.or///1t orwp::....r.10......... 1016/ ins. 2022.10.099
[60] M. Yamada, W. Jitkrittum, L. Sigal, E. P. Xing, and M. Sugiyama. high-dimensional feature selection by feature- wise kernelized lasso. Neural Computation, 26:185-207, 2012. URL
https://agg semanticscholas org/CorpusID::20 274277
[61] L. Yu and H. Liu. Efficient feature selection via analysis of relevance and redundancy. Journal of machine learning research, 2:1205-12 Dec. 2004. ISSN 1532-4435.
[62] M. Yuan and Y. Lin. Model selection and estimation in regression with grouped variables. Journal of the Royal Statistical Society Series B: Statistical Methodology, 68(1):49 (00 2006.
15

---

A Technical Preliminary
Hilbert Space. A Hilbert space is complete inner product space. More formally, a real complex vector space H. is called Hilbert space if it is equipped with an inner product (--) that induces norm x V(. J',,,, under which H is complete; that is, every Cauchy sequence in H The inner product structure generalizes the geometric notions of angle and length, while completeness ensures that limits of convergent sequences remain in the space. Examples include g", L spaces of square-integrail functions, and reproducing kernel Hilbert spaces (RKHSs).
converges to limit
Reproducing Kernel Hilbert Space (RKHS). Let X' be a nonempty set. A Hilbert space H. R is called reproducing kernel Hilbert space if there exists positive definite kernel k X x X + IR such that, for every x E X, the function (xx,,) :) E H and the reproducing property holds: that is, for all E H and x E X,
[(x = (J, k(x; 1)
Hilbert-Schmidt Operator [16]. Let JF and G be separable Hilbert spaces, and let A F G be bounded linear operator Then called Hilbert-Schmide operator for any orthonormal bases (1:) C F and (gj 1= C G, the following Hilbert-Schmidt norm is finite:
| = Σ
(ffi9)) < 00.
(11)
=1
Cooss-oovariance Operator. Let E X, 2 E 2 be random variables and let F and G be RKHSs over X' and Z. Then, the cross-covariance operator Cxz F the unique linear operator such that
(f,Cxzg) Covlf(x). =E [(f(x)) (aae))-[[ffooe B[f(x)))(g(z) - Eig()))
(12)
for all / /EF,gE9
Proposition A.1 (Covariance Bounded by HSIC 16 (5I). Let X X and E be random variables, and lei F and G be RKHSs X and 2, respectively. Then the scalar covariance bounded by the Hilhert-Schmidi Information Criterion, iee, the Hilbert-Schmide Schmidt norms of the cross-covariance operators:
sup Covlf(x), S HSIC, z) = ||xx2llss
(13)
SEFgEG
The above proposition is the HSIC for the scalar value RKHS defined in Gretton al. (16) To connect the above scalar value function spaces to vector-value spaces, we use the external direct sum below.
External Direct Sum of Hilbert Spaces. Let Hi...., Hs be Hilbert spaces. We can then denote the vector-valued Hilbert space H via the external direct
H + HH = fk) H,}
(14)
which is equipped with the inner product ;fff,...,ff)..... (o.......k)),.. := Et n.. The corresponding norm is given by I|fll == (E+-1 [l,, l12e,
1/2
which makes H. itself a Hilbert space.
Moreover, if we construct the RKHS by the direct sum, i.c., H == + j=l Hj, the resulting space H a vector-valued RKHS (7].
Next, we define the corresponding covariance matrix for a vector-valued RKHS. Let f: X + R and g + & be vector-valuee functions, and (x, 2) be random variables jointly distributed over X x Z. The covariance matrix between and g is defined as:
Covlf(x).g(z)) == E [f((x - El (z)) - Elg()))) E R
(15)
"Separable Hilbert spaces implies the spaces have complete orthonormal basis.
16

---

Algorithm Alternating Optimization of and M,
1: Input: Dataset D = {(x; 16)) - initial 0 M I; Pstep [0, 1]:
2: for epoch
do
Step 1: Update 0 via SGD (minibatches)
3:
for each minibatch B do
4:
Compute latent codes (x:) for E B
5:
Compute minibatch means: [14 k==
6:
Compute loss C(B; 0, M,, M.)
7:
Update 0 + 0 Ve end for
8:
Step 2: Update M, via closed-form solution
9:
Compute 2; = fu (x;) for all E
10:
Compute dataset means: μa. {
11:
for each feature dimension i to do
An ExeD(z - 11;)² No 2 Exec, (z: (Mx)i)² An EnED(Ei 14.2
(Ma)i Butep (M,) + (1 Bstop)
12: end for
13: end for
14: Return: ( !
Hilbert-Schmidt Independence Criterion (HSIC) The HSIC [16] is kernel-based measure of de- pendence. Let X' Rdd and Z C m be random variables. Let also + 9 and F = I Fy vector-valued RKHSs over the input and representation domains with values, respectively (i.., direct sums of scalar RKHSs). The cross-covariance operator Cxz 9 FF is the unique linear operator such that (J. (xzgx Cxv(f(x), (x) - (x)())))(((z)) E[g()))), for all E F, E g. The vector-valued HSIC between x and is defined as
HSIC 2) =
(.5) x2 IHs.
(16)
where (t.) CX is the cross-covariance operator between G; and Fj. and || ||ss denotes the Hilbert-
Schmidt norm. This quantity upper-bounds the scalar covariances [15]
Coviff (z)] < |1C las--
sup
We can empirically estimate HSIC within O(n accuracy 16 given n i.i.d. samples {(x, y:) 1 via:
HSIC Z)
1) tr(K,HH,llt),
(17)
j= i=1
where K2 and K2 have elements K K2 = (x;, xy) and K K k2,2,,2)), while H
I 1 111 is the centering matrix.
Notation Summary. Summariss the notation used in the main paper and Appendix.
B H-SPLID Pseudocode
Algorithm| contains pseudo-code for H-SPLID, i.e., the alternating optimization algorithm presented in Section 3.4 to solve Problem (6).
17

---

Table Summary of Notation and Terminology
Symbol
Description
Domains and Variables
X Rd
Input domain (bounded subset of Rd))
R Rm
Representation domain (output of encoder)
Z C
R
Salient representation domain (output of encoder)
R
Output/logit space
X
NR((0,o01a
Truncated multivariate normal ball of radius R Output representation of the network
Z = (x)
Functions and Network Components
(x)
i-th coordinate projection function
f R
T--Lipschitz encoder network
M E Rmxm
Diagonal binary mask matrix (entries in {0, 13)
8 ::= tr(M)
Number of active (nonzero) dimensions in the mask
W E R
Linear weight matrix after masking
Sw - Rb
Final ippresentationndomeee function (e.g., linear layer)
he = Sw ft
Full neural network from input to output
Norms and Constants
Euclidean (vector) norm
Frobenius norm for matrices
Maximum absolute value across components (for vectors)
2
Supremum of 2-norm: |l supxex (l
B = WI
Max row-wise & norm of the weight matrix W
Nx R
Sup-2-norm bound of input: ||<||| I R
N2 Bvks(LR (0)l2))
Sup-2-norm bound on gw fup Perturbation is bounded by
| r
Kernel and RKHS Quantities
kx, Kz F.G
Universal kernels on input and representation domains RKHSs induced by xxx and kig
KF, Kg HSIC(x, z)
Kernel Sup-2-norm bounds
Hilbert-Schmidt Independence Criterion between X and z
Loss and Perturbation
8 E Rd [(ho(x), Le
Input perturbation with ||ō||2 S r
Loss function for prediction and ground-truth
Lipschitz constant of the loss in its first argument
C Proof of Theorem 3.2
We next show that the output of a masked neural network is uniformly bounded in sup-norm under standard Lipschitz and compactness conditions. This provides the foundation for connecting the model class to the vernel-boudder spaces introduced above.
Lemma C.1 (Bounded NN with Saliency Space), Let X C fx E Rd: ||x||2 R} be a bounded input space, and let fo X + R. be an L-Lipschitz encoder. Consider network hg(x) WM f (x) where W 1kxm is linear weight matrix satisfying || S B, and M E mm is diagonal binary mask with at most nonzero entries. Then, the network output is bounded in sup-norm:
| == sup [l/o())l2 S xEX
(18)
The proof deferred to Appendix D.I
This bound shows that the sparsity level the mask plays a direct role in constraining the model's output magnitude, which is essential for robustness.
18

---

To connect neural network outputs to kernel-based function spaces, we reparameterize the neural network ho())
fM, (.) by (w(z,) Wz,. Then, we show how the gw belongs bounded subset of (.)
Corollary C.2 (Bounded Function Spaces). By redefining the neural network in Lemma C.1
!W
belongs the following closed ball:
gW CN2 = {o [ C(Z, |091 N = Bvks (1)
(19)
where llg|lo..2 = supzez (z ll2 denotes the sup-2-norm
This corollary imposes uniform boundedness of the neural network output values via Iw on repre- sentations over the compact domain X, ensuring that the function belongs to bounded subset of continuous function spaces C²N= See Appendix D.2 for the proof.
Given the RKHSs F and G in Assumption 3.1 we define the rescaled RKHS spaces F and &
Nx = K
Nz Kg f [ee
S:
and و =
(20)
Thus, we establish the equivalence between the rescaled RKHSs and the bounded continuous function spaces.
Lemma C.3 (Rescaled RKHS Equals Co(A' R).). Given Assumption 3.1 and the continuous uni-
versal kernel kn therein, its corresponding RKHS F, and a bounded continuous function space Co R2) such that
C
Nxx = {s C(X, |1/1 S Nx),
then we have the rescaled RKHS space
{ Nx K2
$
(21)
satisfying
=
(22)
where F ===" == denotes the closure of I w.rl. the || 1bx.
Similarly, we can show that the rescaled C₂ = loo. See Appendix D.3 for the proof.
Moreover, as we have two spaces containing functions that are different by a scalar, we are interested in how the supremums of the covariance relate between spaces.
Lemma C.4 (Scaling of Supremum Covariance - Sum Version). Let F and G be vector-valued RKHSs over X and Z. respectively. Then, for all Mg and X, holds:
2, E Z. the following
= My 9x) sup
ΣΣ
(() (23)
sup
J=1 JEEF
j=1 1= Mef.
where f= (f S/MF f E F} and likewise for G.
See Appendix DD4 for the proof.
Lastly, given the supremum of covariance of the function space containing the neural network, we need to use the variant Stein's Lemma to bound the gradient the neural network.
Bounded Domain). Let be sampled from a truncated multivariate normal (1MVN) distribution, iee, with density p(x) =
Lemma C.5 (Stein's Lemma for Scalar- Valued Functions
(- 1x 20² 1 R supported on the compact domain XR == {x E Rd Ed ||x| S R), where C. is the normalization constant. Let h Rd + R be a differentiable almost everywhere such that Elah(x) < 0o and [h(x)] < Nx for all Xg. Then for all E (1....,d).
C. exp
Oh(x)
E
Cov [z,, h(x) (R))
(24)
Ox;
o2
19

---

where the truncation error term satisfies
NaCaRd--
1i2
|ea(R() S
exp
C
2n
and Ca is the surface area of the unit sphere B.a.
See Appendix D.3 for the proof.
Then, formally state the proof of Theorem 3.2
Proof. Step 1. Continuous function spaces C and C
Let : X + Rd denote the identity map, defined by xx() This vector-valued function can be
decomposed into scalar coordinate projections:
क. (x) Nis for i I....,d.
Since the input domain X' C Rd is contained within a Euclidean ball of radius R, we have [xx(x))l2 z R for all x E X. Therefore, the identity function satisfies:
Nx = || R.
and lies in the vector-valued bounded continuous function space C₂ (K,R)) R.). Correspondingly, each coordinate function belongs to the subspace n, E C
Now consider the function gw Z + RR* on the representation domain Z. From Corollary C.2 the
composed function gw o M. over X' satisfies:
N₂ == BykssLR [0)
Similarly, over the representation space 2, we have gw E C, (z, IR*, and each scalar component Pw
C
Step 2. Equivalence between RKHS and continous function spaces.
By Lemma
we can rescale the RKHS F and Assumption 3.1 as
[ and g: { K
Nx
(N2 N2 g g
(25)
Kg
so that their closure are equivalent to the bounded continuous function space Cx and C as in step 1.
Nx According to Lemma C.4 if we set My == Kr Mg Ka
relate covariance bounds between
N2 the RKHSs (F and G) and the rescaled RKHSs (F and ف) through rescaling.
k
sup
(x)
(26)
IEFFs S.
#=1 1=1
KyKg
d ΣΣ
sup
(2)
(Lemma C.4
Nx j=1 i=1 A.E.
KrKg Σ
NxxN j=1 i=1 f,EFF
sup
(x),
(closure under sup-norm)
d ΣΣ #=1 t=1 i
KFFKg
sup
(xx
(Lemma C
NxN2
20

---

where the second last line applies closure under the sup-norn (preserving the supremum), and the last line substitutes the equivalent bounded continuous function space by Lemma C.3
Step 3. Bound covariance continuous function spaces with HSIC.
Then, based on Eq. 16
we obtain:
k ΣΣ
sup
& HSIC(x, (x)
2.).
(27)
f EE:E
Combining eq. (26) and eq.
we have
Nx (x)(
sup
HSIC(xx,2.)
(28)
KzKg
El E &E
As shown in Step I, we have n. E CNx ha 0h. and the following holds
ΣΣ
sup J=1 2-1 n. E. Ag E
(ov(xi(x),1g) 10) (x))
Nx 2x.).
(29)
KyKg
Step 4. Bound the gradient with covariance.
By Lemma
C.5
the following holds
Ohg (x)
CovlX;,
(x)]
S
sup m. . E
Cov(mi(x),,1) 11 (x)]. (x)])
(30)
d2
0²
Combining
(29) and (30) gives:
Oh
(x) Ox:
NxNz K=Kg
HSIC(x, + +ER
(31)
j=1
Consider the first-order Taylor expansion in Euclidian ball of radius around x X: that is,
ho(x + 8) hx Jhp (x)5 o(r).
(32)
for all x E X' and all 8 E Rd s.t. | r.
Consider now a measurable perturbation function on X' as 5 Rdd > IRd, such that
sup xEX
(33)
As Eq. holds for all x, pairs, for all X, we have that:
ha(x + 8(x)) - ho(x)= Tne (x)((() + o(r).
(34)
We thus have that, for all x E X:: ho ((x)) he(h)ox(l)))))
- J (x) 8 (xx (xx)|1 |1, + o
(35)
< Jho (x) r [6(x) ||| + o(r)
by Cauchy-Schwartz,
(36)
$ r Jno (x) F + o(r)
by Eq. 33
(37)
Hence, it follows that:
E [ + 6(x)) hx( S E E [ho (X) || + o(r)
(38)
rRBvssh
+ (1f
HSSICX, 2.) o(r),
(39)
o² o²KrKg
where the last inequality follows from Eq. 31 and the fact ss o(1), due the exponentially decaying term.
21

---

D Proof of Lemmas used in Theorem 3.2
D.I Proof of Lemma
Proof. Let Wn. n E T and M, Rexm be the pruned matrices selecting the active coordinates corresponding to the nonzero entries of the mask. Then the function can equivalently rewritten
as
h(x) = W,M,fo(x).
(40)
Since foz is L-Lipschitz and ||x||| S R, follows that
[x) ( S L.R,
(41)
thus
(x) < (0) + LR, Vx E.
(42)
The masking operation M selects coordinates from (x), and can be equivalently represented via M, E Re a selector matrix with exactly nonzero entry per row and more than one nonzero per column. Then
[x)x( < (x)]2x)
(43)
The corresponding reduced weight matrix W, E Rx* selects the columns of W associated with the active coordinates. Since || [W,yllo B, it follows that
W.lle S Bvks.
(44)
and thus
12 & W.lle S Bvks.
(45)
where ||-||æ is the Frobenius norm. Hence, for any X,
[|(x)]l2 = W,M.fu(x)]l < Wolla=p|lM. (x) S BVK (O])0)
(46)
Taking the supremum over x E X concludes the proof.
D.2 Proof of Corollary
Proof. As we have shown in Lemma C.I
have:
sup
h (xxx s BVkK(LR++ lIf
x
Moreover, since the NN can be expressed as ho(.) = (.), we have:
[VM] S B 11f+ xEX
sup
Therefore, we can upper bound Iw as:
sup
[gw (z)ll2 = sup
[M2lla < Bvks(LR 11 (0)ll))
2
ze
Moreover, as gw a continuous function, we finish the proof.
D.3 Proof of Lemma
Proof. Step 1. F.
Since ki continuous and X' compact, follows from Lemma 4.28 of Steinwart and Christmann 47 that all f E F are bounded and continuous. Hence, for any f E F, we have
Nx K
Nx Ky
||/ Nx.
(47)
00,2
22

---

This implies that every function in F belongs to C, Since C, is closed in the || follows that
|loo.2 norm, it (48)
F C C
Step 2. C. CNxxx CF
Let E cNMx, Define h: = RF Nx
Then,
K
|
|1o1 Ky, Nx
(49)
so h E (R) and is bounded in sup-norm. Since F is universal by Assumption, 3.1 is dense llbo.2 norm. Therefore, there exists a sequence {fr} C F such that
in C, (.,,,'' R*) under the ||
lim II - -1lloo,,2 1-0000
(50)
Define the corresponding rescaled sequence f... the limit,
Nx fn F, and set 9 == Nx h g. Computing K
K
Nx
Nx
lim IIaa م11 22000
lim n=000
(fn - 11)
lim n
II hlloc,2 = 0.
(51)
Ky
K
00.2
Thus, = = F.
D.4 Proof of Lemma C.4
Proof. We show that
Esup sup (0x( S MxMs Σ sup (x) (z Ja famn
(x)
3,8 f3.8
For each pair (j, let (f F, and (0,1) } C. Go be sequences converging to the limit
gh (x), (z.)) = sup lim Cov (x 200
(52)
f3.
Define the rescaled sequences:
( 1
1
p()
1 =
(53)
My
Mg
Then, by the bilinearity of the covariance operator, we have
CovlS (x), (z.)] MrMs Cov (00 (x) (z.)),
(54)
and taking the limit:
sup Cov (x()))x))( = lim Cov( (x), (1fh (2x))
(55)
fi
10000
MM lim Cov Cov ((), (z.)) < MrMo sup Cov (z(())))))) n00
(z.)).
Iz
(56)
Summing over all i,j yields the result.
Furthermore, the reverse inequality follows from the same argument.
23

---

D.5 Proof of Lemma C.5
Proof. Step 1 (Integration by Parts). Let o(x) = exp
|x|| 20
and define f(x) = h(x)o(x).
Applying the product rule:
0 ah(x) x(x) + 1(xx) 06(x)
0z, [(x)= dx,
(57)
dzi
Rearranging:
@h(x) ((x)
a (h(x))(x)) h(x) axb(x)
(58)
dz; dz; Integrating over X' and applying the divergence theorem gives:
Ox:
S (h(x))(x)) de = - Joxn h(x))(x))((x) dS))x)
(59)
Oz,
where v(x)
x is the outward unit normal and vx(xx) = &.
|x]]
Thus:
@h(x) 6(x) dx = I (x))
/ hixx) 21 N'x
-h2 (() dx.
(60)
XR
ox;
Jaxa
Step 2 (Pass to Expectation Form). Dividing through by C = Sprln 6(x) dx, the normalization constant, gives:
0h(x) 0z,
1 -2 [(xM(x) 2 | / (xx))())(,x))d))
(61)
Step 3 (Bounding the Boundary Term). Since [x,(x) S 1 and [x(x) S
Nx on Xn. we have: vi
Mr ((x) ds(x)
Nx Vk
(-
R2
/
< cxp
202 (-202)
ds(x).
(62)
|=||=
The surface area of the sphere is:
dS(x)
CyRd-1
(63)
|=
where the constant Cd > O is the surface area of a d-dimensional unit sphere, depending only on Thus, we can bound the error term as
NxCaRd-1
R²
exp
(64)
VKC
20
Then, as - oc, we have:
NxCaRd-1
12 2r
kd
V&C
exp
= o(1),
(65)
since the exponential decay dominates polynomial growth.
E Proof of Lemma 3.3
Proof. Under the same assumptions as in Theorem 3.2
recall the HSIC bound on gradients in eq.
31
as
Ohl (x)
Nx KrKG
EE
HSIC(x, 2.) + +
(66)
Or;
24

---

Table License and source compliance for each dataset.
Dataset
URL
License
ImageNet- IK [1]
image-net.org
ImageNet Terms
ImageNet-9 [58
GitHub
Inherits ImageNet Terms
COCO 28
cocodataset.org
CC 4.0 (annotations) Flickr TOU (images) Inherits iNaturalist Terms
CounterAnimal 155
countcrammal Jountrranmal.glhub.i
ISIC-2017
9
ISIC Challenge
CC-0
C-MNIST
(our codehase)
Inherits MNIST Terms (CC BY-SA 3.0)
Thus, we can bound the Frobenius norm of the gradient as
Öhg Or;
(1)
(x)
< NNxNz 0² KrKg
E| (x)o(x)]l
HSIC(x, 2.) + +CR)
(67)
By Markov incquality, we have
P(IV > 5) =
(68)
Thus, plugging eq. 67 to eq. 68
have
Nx HSIC 2.) + +ER)
(x)
E)
(69)
E02
K=Kę
_²a As the error term en = O(e 20
we have
NxNz
HSIC(x, 2.)) + t(1).
P([V > >) S Eσ²
(70)
KyKę
Substituting the Nx, Nz, we finish the proof.
F
Reproducibility Details
F1
Datasets
COCO is segmentation dataset consisting of labeled images of various species of animals (See Figure For our experiments, we utilize subset the dataset composed of images drawn from one of four labels. The four species were carefully selected to ensure the largest possible dataset containing images without overlapping labels. Since we use the dataset for image classification, each sample should belong to one class and thus include animals from one and only one of the four selected classes. During pre-processing, the dataset is resized to 224x224 pixels. Finally, segmentation information is used to construct 224x224 masks, where the 0 entries denote the pixels occupied by the animal (salient object) in the original image. These masks specify the portion of the image shielded from adversarial perturbations. The splits created from the public training data of COCO by splitting them into train (4509 samples), validation (1127 samples) and test (141) samples).
C-MNIST is a synthetically constructed variant of the original MNIST dataset [27]. To generate it, first load the standard 28x28 single-channel digit images. Subsequently, each sample is randomly paired with another digit using a fixed seed for reproducibility. The two images are concatenated along the width to form 56x28 composite, then symmetrically zero-padded to uniform 64x64 resolution. During training and evaluation, we treat only the left-hand digit as the classification target, ensuring each composite image belongs to exactly one class. We use 80% of the original train split of MNIST as training data and 20% as validation data. For testing we use the test set of MNIST, where also create image pairs described above.
To assess whether H-SPLID attends preferentially to salient objects rather than background cues, we evaluate it two complementary benchmarks: (1) CounterAnimal (CA) (55), which splits iNaturalist
25

---

Only-FG
Mixed-Rand
Figure 4: Samples from the three ImageNet9 variations: IN-9 (original), Only-FG, and Mixed-Rand.
wildlife photos into a Common (exhibiting typical backgrounds) and Counter set (featuring atypical yet plausible backgrounds, see Figure[3a). and (2) ImageNet-9 (IN-9) [58]. defined as a subset of ImageNet-IK IK consisting of 368 categories, instantiated in three distinet variants: Original images, a MixedRand variant in which object foregrounds are transposed onto random-class backgrounds, and an Only-FG variant with backgrounds entirely removed (See Figure
Table 7 provides each dataset's source URL and applicable licensing terms.
F22 Implementation
The HBaR code was adapted from the original codebase, which is publicly available at GitHub (under MIT License). For weight decay, we reuse the PyTorch [39] implementation and pass it directly the optimizer. We re-implemented the following regularization methods: Group Lasso Weights, Group Lasso Activations, LI Sparse Activations, and L1 Sparse Weights. For both the Projected Gradient Descent (PGD) 34 and AutoAttack (AA) [10] adversaries, we utilize our version of the TorchAttacks 22 library, that is adapted for masked attacks.
F33 Software and Hardware Setup
built our pipeline in Python, leveraging the PyTorch [39] library. To conduct our experiments, we use two identical internal servers running Ubuntu 22.04.3 LTS ("Jammy Jellyfish") on a 5.15.0- 84 x86 64 kernel. Each server equipped with two Intel Xeon Gold 6326 processors (16 cores each, thper-threaded for total of 64 logical CPUs), 512 GiB of RAM, and a single NVIDIA A100 80 GB GPU. For the ablation studies and experiments conducted on the ISIC-2017 dataset, additionally made of EuroHPC compute resources, including MareNostrum (BSC, Spain), MeluXina (LuxProvide, Luxembourg), Deucalion (MACC, Portugal), and Discoverer (Sofia Tech, Bulgaria).
F.4 Hyperparameters
We divide our hyperparameters into two groups: those shared by all models, and those tuned or adapted per method and dataset.
Shared parameters. All I ResNet-50 and COCO ResNet-18 18 experiments use the Adam optimizer (24 with 3, = 0.9, 33 = 0.999, = 10 We perform an initial grid search on vanilla ResNet-18, sweeping the learning rate over {10-3 10 10 10 6] in logarithmic steps, and select LR x 10 for all subsequent runs. The batch size is set to 256, and weight decay is 0 by default (except in weight-decay experiments). For the C-MNIST experiments
use LeNet-3 26 with a 1024 embedding space, (as in Figure 1.. we use the learning rate of LR = x 10 and train for 50 epochs from random initialization.
For both COCO and ImageNet- KK we use Vision 35 augmentations. Training augmentations include (1) Random Resized Crop to a 224 224 patch (scaling and cropping with random area and aspect ratio), (2) Color Jitter applied with probability p 0.8 (brightness +-40%, contrast +-40%, saturation +20%, hue +10%), (3) Random Grayscale with p 0.2, (4) Random Horizontal Flip with
26

---

Table Hyperparameter tuning ranges per method and dataset.
Method
Parameter
ImageNet-IK
COCO
Weight Decay
Awd
(10-1,10-2
10-6)
{10-1,10-2
LI Sparse Activations
Aact
{10-1,10-2 ................................ 10
{10-1,10-3 ................................ 10
Group Lasso Activations
Aact
{10-1,10-2 ..... 10 10
{10-1,10-2
10
LI Sparse Weights
Aweights
{10-1,10-2
60
{10-1,10-2
Group Lasso Weights
Aweights
{10-1,10-2
10 10-6)
(10-),10-2 10-6
HBaR
Az
0.000,0,,0005,00000
0.005,
Xg
10,0000,,0005,00
(0,0.001,0.01,00
a
1.0..0)
(..5,
H-SPLID
X
(0,0
(0,0.1,0.5,
An
{0,0.05.0.1;
00.0005,0.1,1.0
Ps
(0,0.1,
(0.0.1,0.15.0.53
Pn 0.0, 0,,1,,,,,0,,,,,,,,,,,,,,,,,, 10.0000,,,1111.,5,,0220000
Table 9: H-SPLID best hyperparameters for ImageNet-1K and COCO.
Parameter
ImageNet-1K COCO
Suitt_ fuit_fraction
20%
100%
Bupdate_fractt fraction
5%
100%
Batep
0.995
0.8
A
0.1
0.1
An
0.1
0.2
Ps
0.1
0.5
Pn
0.1
0.05
Shared space variation
0.1
0.025
p= 0.5, (5) Random Solarize with threshold 0.5 and 0.2, followed by (6) ToTensor and (7) Nor- malization using per-channel means and standard deviations (ImageNet defaults [0.485, 0.456, 0.406), [0.229, 0.224, 0.225] or COCO-computed statistics). At test time, inputs are first resized so that the shorter side is 256 px, then center-cropped to 224 x 224, and finally passed through ToTensor and the same Normalization.
Tuning strategy and per-method tuning ranges. We employ identical hyperparameter tuning strategies for H-SPLID and all comparison methods. 30% of the training corpus is randomly sampled for ImageNet, while the complete training set is used for all other datasets. In either case, 20% of the samples are used to constitute the validation set. Hyperparameters are optimized via grid search by selecting the model configuration exhibiting the highest robust validation accuracy the end of training, which robustness measured with respect to Projected Gradient Descent (PGD) knowledge of salient non-salient regions is used. We use 1 for ImageNet and = 255
attacks applied to the entire image, dataset-specific perturbation budgets of e = 255
2 for COCO. These values
were chosen to be strong enough to select for more robust models, while at the same time being not too strong to induce model collapse to random accuracy, so we can use the metric for model selection. Based this selection criterion trained each method COCO three times and selected the run with highest robust accuracy for validation. For ImageNet we only trained one run. Importantly, no information pertaining to the salient non-salient regions is leveraged during the tuning. Table g summarizes the grid ranges we search for each method on ImageNet- K and COCO.
H-SPLID selected settings. After tuning above, the final hyperparameters chosen for H-SPLID on each dataset are listed Table 9 In all H-SPLID runs we also set Aee 10 to balance the cross-entropy scale. Due to the scale of ImageNet-IK, we introduce two scheduling parameters: (i) @init_fractonn
fractions the fraction of training data used to compute the initial mask values (20% for ImageNet- 1K, 100% for COCO), and (ii) Supdate fraction- which determines the amount of training data that must be processed before updating masks (5% of the dataset for ImageNet- IK, corresponding to multiple updates per epoch; 100% for COCO, corresponding to one update per epoch).
27

---

Table 10: Best parameters per comparison method.
Method
Parameter ImageNet-1K COCO
Weight Decay
Awd
10-5
10-3
LI Sparse Weights
Aweights
10
10-5
Group Lasso Weights
Aweights
10
10-3
LI Sparse Activation
Aact
10
10
Group Lasso Activation
Xact
10-4
10-5
HBaR
X
10-3
5-3
X
10
5-2
5
5
Table 11: Timing experiments on the COCO dataset.
Method
average training time per epoch (in seconds)
Vanilla
37.121 (#: 6.032)
Weight Decay
37.687 (# 6,680)
Group Lasso Weights
37.353 (= 6.151)
Group Lasso Activations
37.354 (#: 6.455)
L1 Sparse Activations
37.564 (#: 6.494)
L1 Sparse Weights
37.450 (#: 6.217)
HBaR
45.739 (# 5.895)
H-SPLID
42.852 (# 9.672)
Table 12: Runtime of ImageNet-Ile IK experiments.
Method
Runtime
Vanilla
11h 27m
Weight Decay
10h 22m
Group Lasso Activations
10h 20m
Group Lasso Weights
10h 25m
LI Sparse Activations
9h 53m
L1 Sparse Weights
10h 30m
HBak
12h 04m
H-SPLID
14h 6m
Baseline feature selection/regularisstiio methods. regularization strength found for each of the comparison methods.
Finally, Table 10 reports the single best
G A Addtional Experimental Results
G.1 Training Time Comparison
COCO Dataset. The COCO experiments presented in the previous sections were executed for a total of 300 epochs on different machines with varying background workloads. To compare and report the computational intensity of the different training methods, the experiments on a single machine, albeit for a reduced number of epochs. Table [ the average training time per epoch for the various training methods employed on the coco dataset. Those methods were executed for only 20 epochs on the same A 100 GPU with 100 GB memory, whence the average time per epoch was computed.
repeated
ImageNet-1K 1K Dataset. The ImageNet- KK experiments were run for 20 epochs an internal server (see Appendix F33) that was not exclusively reserved for these trials, leading to varying background workloads. Logging was enabled throughout, with H-SPLID performing evaluations on the validation set every epochs (during which additional metrics were recorded), while all other methods were evaluated every 10 epochs. These factors may contribute to H-SPLID's longer runtime. As result,
28

---

Table 13: Sensitivity Ae-
As
Clean Acc. (%)
PGD c=1/255
PGD c=2/255
PGD c=3/255
Salient Dim.
0.01
97.73
74.12
58.5440.33
37.59+0.38
96
0.05
98.37
04.47+0.19
57.90+0.30
37.3
101
0.10
98.23
76.51
60.0310.38
40.61
108
0.20
97.73
73.52+0.25
57.0810.15
37.07
107
0.50
98.02
74.0610025
59.9611043
41.12
107
1.00
97.52
74.63+0.23
60.7510.32
40.26
51
Table 14: Sensitivity to An.
An
Clean Acc. (%)
PGD
PGD c-2/255
PGD c=3/255
Salient Dim.
0.01
97.80
72.66+0.17
55.02:1.299
35.83
199
0.05
98.23
76.61
60.03+0.38
40.61+0.20
108
0.10
98.09
76.4010.09
61.06:10.42
40.52
29
0.20
97.45
79.02+0.11
68.0110.33
57.07
14
0.50
61.30
50.40+1.03
43.95
35.07
5
1.00
32.74
32.7440.00
32.74+0.00
32.74
0
the runtimes reported in Table 12 should be taken only overview and rough estimate rather than precise timing measurements. Due to the high computational cost of ImageNet- IK experiments and the lack of exclusive server access, precise timing experiments with exclusive access conducted only on the COCO dataset (See Table III.
G.2 Hyperparameter Sensitivity on COCO-Animals
We conduct the sensitivity analysis starting from the best-performing configuration COCO, varying Ae: An, Pe: Pr. Ssep while keeping all other settings fixed. In Tables [7 we report clean accuracy (%), PGD robustness at E 2, /255, and the Iearned salient dimensionality. Increasing A, Pn. generally improves robustness and compresses the salient subspace up to a regime where excessive regularization degrades performance. Ps yields modest robustness gains with gradual salient-space shrinkage, and A₂ exhibits mild non-monotonic trend around the optimum. For Ssuep very small values (e.g.. 0.1) lead to model collapse, while intermediate values (0.3-0.5) reduce clean accuracy despite moderate robustness gains. Larger values (0.8-0.9) maintain high accuracy, with Sstp 0.8 achieving the best results. Overall, the best configuration attains salient subspace of 14 (out of 512) dimensions with strong robustness.
29

---

Table 15: Sensitivity to As-
Ps
Clean Acc. (%)
PGD 6-1/255
PGD c-2/255
PGD c=3/255
Salient Dim.
0.01
97.73
75.18
59.14
38.244:.33
126
0.05
98.37
73.5610.13
55.01
32.64
120
0.10
97.59
74.43+0.18
58.3140.12
36.98:10.14
116
0.20
97.87
75.7610.009
59.9910.17
40.18:1..00
113
0.50
98.23
76.61
60.0310.38
40.61+#0220
108
1.00
98.02
77.7610.12
61.3510.60
41.87
104
Table 16: Sensitivity Pn-
Pn
Clean Acc. (%)
PGD 6- 1 255 PGD c-
PGD c-3/255
Salient Dim.
0.01
98.09
74.5910.17
57.0740.21
37.76:10.29
124
0.05
98.23
76.61
60.03
40.61
108
0.10
97.52
76.48
59.8010.30
39.33
86
0.20
97.52
0..11
57.76+0.114
37.93+0.44
57
0.50
32.74
32.74
32.74.00000
32.74:0.000
0
1.00
32.74
32.74+0.00
32.74.1.00
32.74
0
Table 17: Sensitivity to Bsaep
Seep Clean Ace. (%)
PGD c=1/255 PGD 2-2/255
PGD c=3/255
Salient Dim.
0.1
32.74
32.74+0.00
32.74+1.000
32.74+0.00
0
0.3
84.55
71.23+0.08
63.40+0.12
54.16+t0.12
27
0.5
85.12
71.2010.16
63.2310.25
54.4311.26
30
0.8
97.59
78.3340.21
69.4510.29
57.9211.11
14
0.9
97.66
73.9840.12
57.82+0.46
36.68
108
0.99
98.44
74.50+0.15
57.3540.36
33.95
490
30

---

Table 18: Learning-rate study on COCO-Animals, Salient/Full is measured in a 512-d feature space.
Method
Clean Acc. PGD c/255 PGD cm2/255 PGD
cm AA cm22555
AA c- Salient/Full
H-SPLID IRR
35.23
35.23-0.00
15.23+0..00
35.23440000
35,23++0.00
35.234-0.00
35.23+-0.00
0/512
LR=0.0005
69.4410.16
14/512
H-SPLID LR=0.000U5
96.53
64.89=0.11
46,78:2.211
28.84:0:224
56.1720.10
33.9820.17
23.26::025
33/512
35.07.1.233
46.82.10.07
G.3 Effect of Learning Rate
To verify the effect of learning rate, we vary the learning rate (LR) around the best hyperparameter setting by powers of ten (see T8) Results indicate strong influence both robustness/accurage and the learned subspace: LR = x 10 yiclds the best overall performance with a compact salient subspace (14/512), lower LRs underfit and produce diffuse salient representations, and higher LR collapses training.
31

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We provide empirical evidence for our claim of learning salient features using adversarial attacks against non-salient features. Our theoretical claims are supported with proofs. We show that the output deviation is bounded by HSIC and the salient space dimensionality and also bound the region that could be vulnerable to attacks with HSIC the the salient space dimensionality.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. It is fine to include aspirational goals as motivation long it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We provide a dedicated paragraph with limitations in the Conclusion
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged
the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
32

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: We present the assumptions in Section 3.5 and the proofs appears in Ap-
pendix C Appendix D and Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We detail our experimental setup in Section Appendix F describes the implementation details, our hyperparameter-tunee
procedure, and the exact settings used train our models. In Table we provide links to download the datasets used. We are submitting code alongside the supplementary materials and will open-source it, together with the best- pert-perfoniin models, upon acceptance.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
33

---

(d)
The authors should provide scripts to reproduce all experimental results for the new reproducible, they We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: In Table we provide links to download the datasets used. The C-MNIST dataset can be constructed using our code. We are submitting our code alongside the supplementary materials and will open-source it, together with the best-performing models, upon acceptance. We include "README" file that details the environment setup, folder and script structure, and execution instructions for our method and all comparison methods.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://niis. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ttps.cc/public//uutee
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We detail our experimental setup in Section 4 mentation details, our hyperparameter-tunie procedure and lists the exact settings used to train our models. Data splits are described in Section F.T and in Section
Appendix Appendix(Fdeseribbl descrribes imple-
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
34

---

Answer: [Yes]
Justification: We provide standard deviations over attacks for COCO, where our method, H-SPLID outperforms other methods
than standard deviations (see Section and Table 2 but with no dedicated statistical significance testing. The experiments on ImageNet were performed using single seed due to their computational cost. We used train, val and test splits for all experiments and provide details on data splits in Section F.]
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
The timing experiments (Appendix G provide relevant information on compute resources. Details the hardware used are given in Appendix F3
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification:
We read and followed the Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
35

---

The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss the potential scientific impact of producing salient latent represen- tations in the introduction and related work. We do not see a direct relation between our work with any other societal impacts.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairesss considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our work does not have high-risk of misuse and we do not release data.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
36

---

Answer: [Yes]
Justification: We provide licenses and citations of used datasets in Table 7 We cite original code packages and repositories in Appendix F2
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of in the thcode
package should be provided. For popular datasets, pawerssi.ppppiiiiaa.... pacerssithcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's ss creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We detail model training in Appendix Fand Section Appendix F. describes how the C-MNIST dataset was constructed. Licenses for all assets are specified in Table
and F22
The submission and all supplementary materials have been anonymized.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: No use of human subjects or crowdsourcing.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
37

---

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: No use of human subjects crowdsourcing.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: LLMs only used for writing assistance.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our L.LM policy atts::://eerrrpsccc///ofeeeeeeee for what should or should not be described.
38


Reviews:
[{"review_id": "kkdjKE5yOB", "reviewer": "Reviewer_P27a", "summary": "This paper presents H‑SPLID, an algorithm that explicitly separates salient from non‑salient features by learning two disjoint latent sub‑spaces. The authors demonstrate its effectiveness on two image‑classification benchmarks and under two adversarial attack settings.", "questions": "1. What was the selection criteria for the COCO subset?\n2. Why didn't the authors provide more experiments on several classifiers?", "limitations": "yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The paper is technically sound and its claims are supported by a thorough theoretical analysis in both the main text and the appendix.\n- The empirical evaluation is comprehensive and well explained.\n- The exposition is generally clear, and the authors provide code and full hyperparameter details, ensuring reproducibility. \n- Explicitly disentangling salient and non‑salient latent dimensions is a novel contribution that remains underexplored in existing work.\n\nWeaknesses:\n- Lack of tests with alternative backbones (e.g., ViT, Inception, VGG).\n- Parts of the methodology appear unnecessarily intricate and could be streamlined (e.g. Sec. 3.1)\n\nIf the approach works on a broader set of architectures and tasks, it could meaningfully influence saliency‑based robustness research.", "was_revised": true, "final_justification": "Rebuttal responses clarified my doubts, I consider this paper valuable", "rebuttal": "# Response to Reviewer P27a\n\nWe appreciate the reviewer’s positive feedback on our work, particularly their recognition of the novelty of our method and the thoroughness of our empirical and theoretical analysis. We address all remaining concerns and questions below.\n\n---\n\n### **W2:** Streamlining of methodology section (e.g. Sec. 3.1)\n\nWe appreciate the suggestion to improve the clarity of the methodology section. In the camera-ready version, we will streamline the presentation of Section 3 by reorganizing the conceptual flow and presenting the loss terms in a more concise and intuitive manner. We will also polish the overall writing and notation to improve readability and precision.\n\n---\n\n### **Q1:** Selection criteria for the COCO subset\n\nWe selected a COCO subset in which the object of interest is correlated with its background. We focused on images of animals in their natural habitats—e.g., giraffes in the savannah—where background and object are contextually linked. We also chose non-overlapping classes (e.g., excluding dogs and humans, which frequently co-occur) and prioritized images where the background occupies a large portion of the image, like for images of animals in the wild, to have enough room for attacks on the background. This setup provides a challenging test-bed for our approach, which learns salient object-specific features and non-salient background features. We will clarify this selection criterion in the paper.\n\n---\n\n###  **W1 and Q2:** Additional experiments on different classifiers (alternative backbones)\n\nWe would like to clarify that our experiments already incorporate a variety of backbone architectures. Specifically, we use two ResNet variants of different capacities—ResNet18 for COCO and ResNet50 for ImageNet—as well as LeNet-3 [1] for C-MNIST (see Figure 1 and Appendix *F.4 Hyperparameters*).\n\nIn response to Reviewer HCiM’s suggestion to include a text-based dataset, we further evaluated H-SPLID on the ERASER Movie Reviews dataset [2], a benchmark with human-annotated rationales.\n\nWe adopted the DistilBERT language model [3] as a new backbone and assessed robustness using the HotFlip adversarial attack [4], which we adapted to adversarially perturb $l$ letters of non-salient \"background\" words. Here, we define the salient words by the rationale masks provided by human annotators. For example, given the text: \"In this movie, **the acting is great!** The soundtrack is run-of-the-mill, **but the action more than makes up for it**.\", the highlighted part was the rationale by a human annotator and the remaining words serve as \"background\" words that will be attacked.\n\n\nThus, the sentiment analysis setup probes whether the model relies primarily on core (rationale) features or is sensitive to noise in peripheral content.\n\n| Method            | Clean Accuracy | HotFlip-1 Accuracy | HotFlip-3 Accuracy | Max Accuracy Drop |\n|-------------------|----------------|---------------------|---------------------|--------------------|\n| DistilBERT with weight decay       |**90.5%**          | 76.4%               | 73.9%               | -16.6%              |\n| H-SPLID (Ours)     | 86.4%          | **82.9%**           | **75.4%**           | **-11.1%**          |\n\nFor HotFlip attacks with $l=1$ and $l=3$ H-SPLID outperforms the DistilBERT baseline. These preliminary results suggest that H-SPLID can transfer to different backbones and even to different modalities, such as text. Based on this result we see the in-depth study of H-SPLID across modalities as promising future work.\n\n---\n\nWe thank the reviewer for their thoughtful feedback and will revise the final version to further improve the presentation and highlight the generality of H-SPLID.\n\n---\n\n\n### References\n\n[1] Y. LeCun, B. Boser, J. S. Denker, D. Henderson, R. E. Howard, W. Hubbard, and L. D. Jackel.381 Backpropagation applied to handwritten zip code recognition. Neural computation, 1(4):382 541–551, 1989.\n\n[2] DeYoung, Jay, et al. \"ERASER: A Benchmark to Evaluate Rationalized NLP Models.\" *Transactions of the Association for Computational Linguistics*, 2020.\n\n[3] Sanh, Victor, et al. \"DistilBERT, a Distilled Version of BERT: Smaller, Faster, Cheaper and Lighter.\" *arXiv preprint* arXiv:1910.01108, 2019.\n\n[4] Ebrahimi, Javid, et al. \"HotFlip: White-Box Adversarial Examples for Text Classification.\" *Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics*, 2018."}, {"review_id": "HVlpNNalPn", "reviewer": "Reviewer_XsTp", "summary": "This paper aims to learn salient features for supervised learning tasks, separating out non-salient features into a subset of the feature space dimensions. Unlike previous methods, the proposed H-SPLID algorithm learns to separate these salient and non-salient features without additional data that goes beyond the data used for supervised learning. The loss function contains 3 types of terms. The cross entropy term is the cross entropy loss when predicting from only the salient features. The masked clustering terms encourage features to match mean features, with class-specific means for salient features and a global mean for non-salient features. Lastly, the HSIC terms minimize the dependence between the data and the salient features as well as the labels and the non-salient features. The H-SPLID algorithm minimizes the loss function through alternating optimization of the neural network and the saliency mask. H-SPLID is supported by a theoretical result that bounds the change in model prediction by the HSIC of the data and the salient features. Experiments show that the method improves robustness to adversarial attacks and transfer accuracy for saliency benchmarks. An ablation additionally shows that performance degrades when only a subset of the loss terms are used.", "questions": "Q1: I think the end of line 115 should use the identity matrix as in line 114.\n\nQ2: Is there a difference between $L_{ST}$ and Equation 5? It’s ambiguous why the different notation for the loss differs from the left side of Equation 5. Did you introduce the additional notation for when a minibatch is used instead of the full dataset? Are $L_s$ and $L_n$ used in both steps of H-SPLID or just the mask update?\n\nQ3: The equation after line 152 made me confused about the definition of $\\beta$. My initial assumption was that $\\beta$ was a vector of 0 or 1 values. But instead line 113 says that $\\beta$ is exactly one 0 or 1 value, which doesn’t make sense in the context of the mask definition in the previous line. Line 112 seems to best correlate with the equation after line 152, which seems to imply that each of the elements of $\\beta$ lie in the range $[0, 1]$, although that definition is a bit overly broad since it doesn’t capture the diagonal nature of the mask matrix.\n\nQ4: What variable is the expectation in Equation 9 taken with respect to? Looking at Appendix C suggests to me that it is with respect to $\\delta$, but I would like that to be more explicitly stated.", "limitations": "Yes.", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "S1: The design of the experiments is well documented, including a detailed description of the datasets, methods, experiment process, and performance metrics. It seems like the experiment could be reproduced even without the code that is additionally provided.\n\nS2: The proof in Appendix C appears to be a significant improvement over previous work and represent a lot of effort on the authors’ part. Although I am not familiar enough with some of the mathematical concepts to give a rigorous evaluation of the proof, I do not see any errors. The outline of the proof provided by some of the guiding text was very useful for understanding the logic of the proof.\n\nW1: The mathematical notation has various issues throughout the paper (Q1-4). These issues reduced clarity and necessitated educated guesses as to some specifics of the method.\n\nW2: It’s unclear to me how much benefit there is in learning non-salient features. Are these features expected to frequently be turned into salient features throughout training? As I understand it, the non-salient features do not affect the final prediction.", "was_revised": true, "final_justification": "The authors have very eloquently resolved the clarity issues I raised with the paper, so I have raised my recommendation to a strong accept.", "rebuttal": "# Response to Reviewer XsTp\n\nWe thank the reviewer for their thoughtful and detailed assessment of our work. We are particularly grateful for their recognition of the clarity and reproducibility of our experimental design, and the effort invested in the theoretical analysis. We also appreciate the positive remarks on the structure and accessibility of the proof provided in Appendix C. We address the remaining questions and concerns below.\n\n---\n\n### **W2:** Clarification on the role and benefit of learning non-salient features\n\nThank you for the thoughtful question. While non-salient features do not directly affect the final prediction, they play an important role during training, as salient features are defined in contrast to them. Their presence is therefore essential. By capturing task-irrelevant variations—such as background noise—non-salient features help isolate predictive factors in the salient space, enhancing robustness and disentanglement. These features are not expected to become salient over time; rather, the model learns a stable partition of latent dimensions based on the H-SPLID loss. We will clarify this in the paper.\n\nMore broadly, our approach serves as a novel form of regularization. Although deep neural networks are highly expressive, their performance can degrade due to entanglement with irrelevant features. By jointly learning the classification task and the decomposition into salient and non-salient components, our method improves robustness, as shown in our experiments. In essence, H-SPLID encourages the network to focus on the most relevant information during training.\n\n---\n\n### **Q1:** Typo in line 115 (identity matrix)\n\nThank you for pointing out the typo. We will fix it.\n\n---\n\n### **Q2a:**  Difference between $L_{ST}$ and Equation 5? \n\nWe apologize for the typo and confusion. They are the same thing. We will unify the notation. \n\n### **Q2b:** Are $L_s$ and $L_n$ used in both steps of H-SPLID or just the mask update?\n\n$L_s$ and $L_n$ are used in both steps. As they will allow backpropagation to update the encoder $f_\\psi$. \n\n---\n\n### **Q3:** Definition of β and range of its values\n\nThank you for pointing out this ambiguity—we apologize for the omission in the original text. To clarify, we apply a hard threshold to the continuous solution for $\\beta$, mapping it to $\\lbrace 0, 1 \\rbrace^d$. While the optimization initially produces a continuous vector $\\beta \\in [0,1]^d$, we threshold each component at 0.5 to obtain a binary mask. We first experimented with using the continuous solution directly (i.e., without thresholding), and found that the learned values typically concentrate near 0 or 1. As a result, both variants—the soft (continuous) and hard (thresholded) masks—perform similarly in practice. We will revise the manuscript to explicitly define $\\beta$ as a vector in $\\lbrace 0, 1 \\rbrace^d$, clarifying its role as the diagonal of the mask matrix, and to explain the thresholding procedure it entails.\n\n---\n\n### **Q4:** What variable is the expectation in Equation 9 taken with respect to?\n\nThe expectation in Equation (9) is taken with respect to $x$, i.e.:\n\n$\\mathbb{E}_x\\lbrack \\cdot \\rbrack$, \n\nwhere $x$ is sampled from the data distribution. The perturbation $\\delta$ is an arbitrary vector constrained in norm by $r$, and not a random variable. This distinction is explicitly stated in the theorem and elaborated in Appendix C, but we acknowledge that the notation in Equation (9) could have been clearer. To avoid any confusion, we will revise the equation to use $\\mathbb{E}_{x}$ explicitly in the camera-ready version.\n\n---\n\nWe appreciate the reviewer’s careful reading and the opportunity to clarify the content of our paper. We have already incorporated the reviewer's suggestion into our manuscript."}, {"review_id": "hY64QXLnzY", "reviewer": "Reviewer_76kv", "summary": "This paper introduces H-SPLID, an algorithm for learning salient feature representations through explicit decomposition of latent spaces. The H-SPLID approach leverages information compression regularization and the Hilbert-Schmidt Independence Criterion to promote compact and informative representations within a task-relevant subspace. Some experimental results are provided which demonstrate H-SPLID’s efficacy in mitigating the vulnerability to irrelevant input variations, linking representation dimensionality and robustness.", "questions": "- Does the learning rate influence the final outcome, e.g. for the salience subspace versus the non-salient subspace?\n- Why PGD over any other attack?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n+ Figure 1 is compelling and informative, demonstrating the strengths of the proposed approach in a visual manner with a clear t-SNE visualization.\n+ The problem is of significance to the community - the ability to learn representations robust to irrelevant input is a foundational requirement for deploying deep neural networks in real-world scenarios.\n\nWeaknesses:\n- Relying heavily on adversarial attacks to demonstrate robustness is a somewhat narrow approach. While it’s effective to some extent, exploring the method's performance under more natural, real-world perturbations would be more valuable. (Suggestions: lighting, blur, occlusion, etc)\n- There is a limitation in the experimentation on COCO and ImageNet datasets - extended analysis beyond these and ResNet models would make for a more compelling demonstration of the capabilities of the proposed H-SPLID. Even evaluations on a medical imaging dataset for example would convey better the breadth of applicability of the approach as well as robustness to “real world” corruptions.", "was_revised": true, "final_justification": "In final evaluation and in light of the author rebuttal responses (including thorough analysis and extended results, which they promise to include in the revision), I update my recommended score to reflect a better balanced paper with clear contributions.", "rebuttal": "# Response to Reviewer to 76kv\n\nThank you for your thoughtful feedback. We appreciate the recognition of the problem’s significance—learning representations robust to irrelevant input is indeed essential for real-world deployment of deep neural networks. We address the open questions and concerns below.\n\n---\n\n### **W1 and W2:** Additional results on medical imaging dataset and real world perturbations\n\nWe would like to clarify that while we do explore the effect of adversarial attacks on the COCO dataset (Table 1), our evaluation already incorporates datasets offering additional perspectives on robustness. For instance, the ImageNet9 [1] dataset (see Figure 4) introduces background modifications, with its MixedRand version occluding the background of the ImageNet images with background taken from other natural images (see Figure 4 in Appendix F for an example). Furthermore, we already include experiments with natural, real-world perturbations using the Counter animals [2] dataset (abbreviated as CA-Counter in Table 2). The counter animals dataset is derived from iNaturalist wildlife photos and is split into a common subset (featuring typical backgrounds) and a counter subset (with atypical yet plausible backgrounds). For example, as shown in Figure 3a, a common background for an ice bear is a winter landscape, whereas an atypical background for an ice bear would be green grass.\n\nIn response to Reviewer HCiM’s suggestion to include a text-based dataset, we further evaluated H-SPLID on the ERASER Movie Reviews dataset [3], a benchmark for sentiment analysis that provides human annotated rationales.\n\nWe fully agree that the inclusion of a **medical imaging dataset** would further strengthen the paper's demonstration of broader applicability and robustness. To this end, we have conducted new experiments on the ISIC-2017 skin lesion classification dataset [4], which comprises three classes: nevus, melanoma, and seborrheic keratosis. For this, we used a ResNet-50 pre-trained on ImageNet for feature extraction and trained a three-class classification head for 50 epochs, followed by 50 epochs of method-specific training. Model tuning and selection were conducted based on the procedure outlined in Appendix F.4.\n\nTo evaluate robustness against the reviewer-suggested **real-world perturbations**: lighting, blur, and occlusion - we utilized the implementations of brightness, defocus blur, and occlusions$^1$ from the corruptions benchmark [5]. Following the analysis in the paper, we perturbed only the non-salient regions, such as non-lesion pixels. The results averaged over 10 random seeds are presented below:\n\n\n| Model | Clean Acc | Brightness | Defocus Blur | Occlusion|\n|---|---|---|---|---|\n| **H-SPLID** | **76.78±0.778** | **70.00±1.619** | **68.38±1.376** | **69.50±1.716** |\n| **Group Lasso Activations** | 75.38±1.383 | 66.50±3.136 | 61.32±4.501 | 62.68±2.969 |\n| **Group Lasso Weights** | 70.65±4.118 | 60.23±6.698 | 58.63±9.564 | 60.62±5.697 |\n| **HBaR** | **75.90±0.844** | **68.70±1.942** | 65.62±2.058 | 66.18±3.013 |\n| **L1 Sparse Activations** | 75.62±1.211 | 66.50±2.171 | 64.33±1.653 | 62.27±4.256 |\n| **L1 Sparse Weights** | 75.30±1.040 | 66.13±2.432 | 63.22±2.506 | 62.70±3.810 |\n| **Vanilla** | 75.45±0.986 | 66.43±2.527 | 63.77±2.388 | 62.87±3.081 |\n| **Weight Decay** | 75.63±1.545 | 67.53±2.980 | 64.57±2.295 | 63.55±3.851 |\n\nOur method, H-SPLID, outperforms the competitors across all three perturbation types on the ISIC-2017 dataset, further demonstrating its robustness to more natural, real-world perturbations and its applicability in specialized domains like medical imaging. We thank the reviewer for the suggestion and we will incorporate the medical imaging dataset analysis into the revised paper.\n\n\n----\n\n$^1$ The snow perturbation is effectively occluding small patches of the image with white snow, thus we refer to it as occlusion. An example is given in Figure 1 of the original paper [5].\n\n---\n\n### **Q1:** Does the learning rate influence the final outcome, e.g. salience subspace versus the non-salient subspace?\n\nYes, the learning rate is an important hyperparameter for deep learning methods in general, and our H-SPLID approach is no exception to that. We conducted additional experiments on the COCO-Animals dataset w.r.t. the learning rate, where we take the model with the best hyperparameters and vary the learning rate by powers of ten to test the learning rates influence.\n\n| Method                   | Clean Acc     | PGD ε=1/255 | PGD ε=2/255 | PGD ε=3/255 | AA ε=1/255 | AA ε=2/255 | AA ε=3/255 | Salient Dim. / Full Dim. |\n|--------------------------|---------------|-------------|-------------|-------------|-------------|-------------|-------------|----------------------------|\n| **H-SPLID LR=0.005**     | 35.23 | 35.23±0.00 | 35.23±0.00 | 35.23±0.00 | 35.23±0.00 | 35.23±0.00 | 35.23±0.00 | 0 / 512 |\n| **H-SPLID LR=0.0005**    | 97.87 | 80.01±0.15 | 69.44±0.16 | 56.95±0.34 | 75.18±0.08 | 58.64±0.17 | 50.40±0.19 | 14 / 512 |\n| **H-SPLID LR=0.00005**   | 96.53 | 64.89±0.11 | 46.78±0.21 | 28.84±0.24 | 56.17±0.10 | 33.98±0.17 | 23.26±0.23 | 33 / 512 |\n| **H-SPLID LR=0.000005**  | 92.49 | 54.30±0.03 | 35.07±0.23 | 17.53±0.20 | 46.82±0.07 | 21.59±0.16 | 11.92±0.11 | 450 / 512 |\n\nOur experiments demonstrate that the learning rate significantly influences both: the model’s performance, as well as the learned salient dimension. Specifically, a learning rate of 0.0005 yielded the best overall performance, achieving the highest clean accuracy and robustness across different strengths of PGD and AutoAttacks (AA). At this learning rate, the salient dimension was found to be 14 out of 512. Lower learning rates (e.g., 0.000005 and 0.00005) resulted in progressively lower accuracy and robustness, indicating that the model did not learn an informative salient representation. Notably, a learning rate of 0.000005 resulted in a significantly higher salient dimension (450/512), suggesting that a very low learning rate might lead to a less compact salient space. Conversely, a higher learning rate (0.005) led to a complete collapse of performance, with the model failing to learn any meaningful representation (salient dimension of 0/512). We will include these results in to the paper.\n\n---\n\n### **Q2:** Why PGD over any other attack?\n\t\nWe would like to draw the reviewer's attention to Table 1, where we not only compare robustness w.r.t. PGD, but also to AutoAttack. AutoAttack serves as a strong attack that uses an ensemble of diverse parameter-free adversarial attacks.\n\n\n---\nWe thank the reviewer for the extensive feedback and will revise the final version by including the suggested experiments and clarifications. These will further strengthen our work.\n\n---\n\n\n### References\n\n[1] Kai Yuanqing Xiao, Logan Engstrom, Andrew Ilyas, Aleksander Madry: Noise or Signal: The Role of Image Backgrounds in Object Recognition. ICLR 2021\n\n[2] Qizhou Wang, Yong Lin, Yongqiang Chen, Ludwig Schmidt, Bo Han, Tong Zhang: A Sober Look at the Robustness of CLIPs to Spurious Features. NeurIPS 2024\n\n[3] DeYoung, Jay, et al. \"ERASER: A Benchmark to Evaluate Rationalized NLP Models.\" *Transactions of the Association for Computational Linguistics*, 2020.\n\n[4] Codella N, Gutman D, Celebi ME, Helba B, Marchetti MA, Dusza S, Kalloo A, Liopyris K, Mishra N, Kittler H, Halpern A. \"Skin Lesion Analysis Toward Melanoma Detection: A Challenge at the 2017 International Symposium on Biomedical Imaging (ISBI), Hosted by the International Skin Imaging Collaboration (ISIC)\". arXiv: 1710.05006\n\n[5] Dan Hendrycks and Thomas Dietterich: Benchmarking Neural Network Robustness to Common Corruptions and Perturbations. ICLR 2019."}, {"review_id": "KVxPjNUswT", "reviewer": "Reviewer_HCiM", "summary": "H-SPLID presents a method to decompose a network’s latent space into a low-dimensional salient subspace (task-relevant) and a non-salient subspace (task-irrelevant), using learnable binary masks and regularization via norm-based clustering losses and HSIC penalties. The authors prove (Theorem 3.2) that the expected prediction change under small input perturbations is upper-bounded by the HSIC between inputs and the salient representation, and the dimension of that subspace. Empirically, H-SPLID improves robustness to adversarial attacks targeted at backgrounds (COCO animals) and transfer performance on saliency benchmarks (ImageNet-9, CounterAnimal) without adversarial training", "questions": "1. More experiments on diverse datasets and modalities should be presented.\n2. More studies about the parameters should be presented.", "limitations": "See weakness and questions.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "I am not an expert on this domain. I have some questions as follow\n1. Experiments focus on image classification with fixed ResNets; no tests on other modalities (text, graphs) or real robotics pipelines. The synthetic MNIST concatenation and filtered COCO subsets do not capture the complexity of real-world feature entanglement.\n2. The method introduces five new parameters (λₛ, λₙ, ρₛ, ρₙ, mask-update rates) and mask-update schedules (β-fractions, α-smoothing). Yet no study quantifies sensitivity or provides guidelines.\n3. HSIC computation is O(n²) per minibatch—how does this scale to larger batch sizes or high-dimensional embeddings? Have the authors considered linearized/approximate HSIC estimators to reduce compute?", "was_revised": true, "final_justification": "I have carefully read the comments from the other reviewers as well as the authors’ rebuttal. I believe the authors have addressed my concerns, and I concur with the other reviewers on the contributions of this work. Therefore, I am revising my rating to borderline accept.", "rebuttal": "# Response to Reviewer HCiM\n\nWe thank the reviewer for their feedback and are happy to address all concerns raised below.\n\n---\n### **W1 and Q1:** Focus on image classification, inclusion of complex, real world data and additional modalities such as text\n\nThank you for raising these important points. Since they concern multiple aspects of our work, we address each part individually below.\n\n**Focus on image classification.**\n\nOur main experiments are based on image classification tasks, as saliency concepts—such as foreground and background—are particularly well-defined and interpretable in computer vision. This makes it a natural domain for evaluating H-SPLID’s ability to disentangle salient and non-salient features. To this end, we tested H-SPLID on several challenging CV benchmarks.\n\n**Inclusion of complex, real-world data.**\n\nAs shown in Table 2, we evaluate H-SPLID on datasets that explicitly model real-world feature entanglement. For instance, ImageNet9 [1] and its MixedRand variant (see Figure 4, Appendix F) introduce background shifts by replacing image backgrounds with those from other real-world classes, enabling evaluation under natural distribution changes.\n\nWe also include the CounterAnimals dataset [2] (CA-Counter in Table 2), derived from iNaturalist wildlife images, which contrasts typical and atypical contexts (e.g., a polar bear on snow vs. grass; see Figure 3a). This setup provides a realistic test of generalization under spurious correlations.\n\nIn addition, and in response to Reviewer 76kv (W1 & 2), we evaluated H-SPLID on the ISIC-2017 skin lesion classification dataset [3], comprising three real-world medical classes. H-SPLID consistently outperformed baselines under multiple real-world perturbations (see our response to Reviewer 76kv for details).\n\n**Inclusion of additional modality - text data**\n\nIn contrast to saliency in images, modalities such as text involve more nuanced, task-specific definitions of saliency, where the notion of foreground versus background is less explicit. As such, further exploration is required to understand how H-SPLID's decomposition applies across modalities and how to appropriately define and measure saliency in those contexts. However, to illustrate the potential of H-SPLID beyond vision, we conducted an experiment on a text classification task using the ERASER Movie Reviews dataset [4]. In this benchmark, each example is annotated with human-provided rationales, which we treat as salient tokens and the task is to predict the reviews' sentiment (positive or negative). \n\nAn example from ERASER movie reviews benchmark: \"In this movie, **the acting is great!** The soundtrack is run-of-the-mill, **but the action more than makes up for it**.\" The highlighted texts are the rationales for the positive review. These are annotated by human experts. All other tokens we consider as non-salient (background). \n\nWe adopted a new backbone—DistilBERT [5]—and evaluated robustness using the HotFlip adversarial attack [6], adapted to perturb *non-salient* tokens only. This setup tests whether the model relies on core (rationale) features or is vulnerable to noise in peripheral content. \n\nBased on the gradient, a HotFlip-1 attack would change one letter. Using the example above:\n*Attacked text:* \"In this movie, the acting is great! The soun**T**track is run-of-the-mill, but the action more than makes up for it.\" --> Changing the sentiment prediction from positive to negative.\n\nUsing limited hyperparameter tuning for H-SPLID, it improves adversarial robustness over the DistilBERT baseline, reducing the accuracy drop under both 1-token and 3-token perturbations:\n\n| Method            | Clean Accuracy | HotFlip-1 Accuracy | HotFlip-3 Accuracy | Max Accuracy Drop |\n|-------------------|----------------|---------------------|---------------------|--------------------|\n| DistilBERT      | 90.5%          | 76.4%               | 73.9%               | 16.6%              |\n| H-SPLID (Ours)     | 86.4%          | **82.9%**           | **75.4%**           | **11.1%**          |\n\nThese results, while preliminary, suggest that H-SPLID can improve robustness even in textual domains. We acknowledge, however, that stability and generalization across modalities such as graphs and robotics pipelines remain open challenges. Arguably, an in-depth analysis and application of H-SPLID in domains such as text would be an independent contribution in its own right, perhaps even a separate paper.\n\n---\n### **W2:** Sensitivity study of introduced hyperparameters\n\nWe conducted a detailed hyperparameter sensitivity analysis on the COCO-Animals dataset by varying one hyperparameter at a time, starting from the best-performing configuration. The tables below report the model’s performance in terms of Clean Accuracy (\\%), PGD adversarial robustness across different attack strengths, and the dimensionality of the salient space. Each table shows how changes to a single hyperparameter affect these metrics while keeping all others fixed.\n\n| λₛ | Clean Acc. (%) | PGD ε=1/255 | PGD ε=2/255 | PGD ε=3/255 | Salient Dim. |\n| --- | --- | --- | --- | --- | --- |\n| 0.01 | 97.73 | 74.12±0.07 | 58.54±0.33 | 37.59±0.38 | 96 |\n| 0.05 | 98.37 | 74.47±0.19 | 57.90±0.30 | 37.48±0.33 | 101 |\n| 0.10 | 98.23 | 76.61±0.15 | 60.03±0.38 | 40.61±0.20 | 108 |\n| 0.20 | 97.73 | 73.52±0.25 | 57.08±0.15 | 37.07±0.34 | 107 |\n| 0.50 | 98.02 | 74.06±0.25 | 59.96±0.43 | 41.12±0.38 | 107 |\n| 1.00 | 97.52 | 74.63±0.23 | 60.75±0.32 | 40.26±0.21 | 51 |\n\n| λₙ | Clean Acc. (%) | PGD ε=1/255 | PGD ε=2/255 | PGD ε=3/255 | Salient Dim. |\n| --- | --- | --- | --- | --- | --- |\n| 0.01 | 97.80 | 72.66±0.17 | 55.02±0.29 | 35.83±0.48 | 199 |\n| 0.05 | 98.23 | 76.61±0.15 | 60.03±0.38 | 40.61±0.20 | 108 |\n| 0.10 | 98.09 | 76.40±0.09 | 61.06±0.42 | 40.52±0.30 | 29 |\n| 0.20 | 97.45 | 79.02±0.11 | 68.01±0.33 | 57.07±0.10 | 14 |\n| 0.50 | 61.30 | 50.40±0.03 | 43.95±0.32 | 35.07±0.15 | 5 |\n| 1.00 | 32.74| 32.74±0.00 | 32.74±0.00 | 32.74±0.00 | 0 |\n\n| ρₛ | Clean Acc. (%) | PGD ε=1/255 | PGD ε=2/255 | PGD ε=3/255 | Salient Dim. |\n| --- | --- | --- | --- | --- | --- |\n| 0.01 | 97.73 | 75.18±0.14 | 59.14±0.27 | 38.24±0.33 | 126 |\n| 0.05 | 98.37 | 73.56±0.13 | 55.01±0.24 | 32.64±0.31 | 120 |\n| 0.10 | 97.59 | 74.43±0.18 | 58.31±0.12 | 36.98±0.14 | 116 |\n| 0.20 | 97.87 | 75.76±0.09 | 59.99±0.17 | 40.18±0.20 | 113 |\n| 0.50 | 98.23 | 76.61±0.15 | 60.03±0.38 | 40.61±0.20 | 108 |\n| 1.00 | 98.02 | 77.76±0.12 | 61.35±0.60 | 41.87±0.17 | 104 |\n\n| ρₙ | Clean Acc. (%) | PGD ε=1/255 | PGD ε=2/255 | PGD ε=3/255 | Salient Dim. |\n| --- | --- | --- | --- | --- | --- |\n| 0.01 | 98.09 | 74.59±0.17 | 57.07±0.21 | 37.76±0.29 | 124 |\n| 0.05 | 98.23 | 76.61±0.15 | 60.03±0.38 | 40.61±0.20 | 108 |\n| 0.10 | 97.52 | 76.48±0.16 | 59.80±0.30 | 39.33±0.16 | 86 |\n| 0.20 | 97.52 | 75.41±0.11 | 57.76±0.14 | 37.93±0.44 | 57 |\n| 0.50 | 32.74 | 32.74±0.00 | 32.74±0.00 | 32.74±0.00 | 0 |\n| 1.00 | 32.74 | 32.74±0.00 | 32.74±0.00 | 32.74±0.00 | 0 |\n\nThe hyperparameter sensitivity study on the COCO-Animals dataset highlights that $\\lambda_n$ and $\\rho_n$ are key to balancing adversarial robustness and the dimensionality of the salient space. Notably, the best model exhibits a salient dimensionality of just 14 (out of 512), indicating highly effective compression of salient features.\n\nIn general, increasing $\\lambda_n$ and $\\rho_n$ improved robustness and reduced the salient dimension, although very high values led to performance collapse. For $\\lambda_s$, robustness initially improved before slightly declining, while increasing $\\rho_s$ yielded modest but consistent gains in robustness—both also contributing to a reduction in salient dimensionality. We will include the remaining analysis on mask update rates and scheduling strategies in the camera-ready version of the paper.\n\n### **W3:** Scaling of HSIC computation to high-dimensional embeddings\n\n\n**Empirical scalability.** Our method is practically feasible, as demonstrated by competitive training times on large-scale datasets such as ImageNet-1K with a ResNet50 backbone (embedding dimension 2048), as shown in Tables 9 and 10. This suggests that H-SPLID is viable for real-world applications. Moreover, further approximations can extend its scalability while preserving statistical reliability and interpretability.\n\n**Approximation strategies.** While we adopt the HSIC implementation from HBaR [7], various approximation techniques can further reduce its cost. Block-based HSIC [8], for example, partitions each minibatch into blocks of size $B$, computes HSIC within each block, and averages the results. This reduces complexity to $\\mathcal{O}(Bn)$, making it suitable for large batches. In addition, general kernel approximation methods such as random Fourier features and Nyström approximations [8,9] offer promising directions for future extensions.\n\n\n---\n\nOverall we want to thank the reviewer for the detailed feedback, it helped to further improve our paper. \n\n---\n\n\n### References\n[1] Xiao, et al: Noise or Signal: The Role of Image Backgrounds in Object Recognition. ICLR 2021\n\n[2] Wang, et al. A Sober Look at the Robustness of CLIPs to Spurious Features. NeurIPS 2024\n\n[3] Codella, et al. Skin Lesion Analysis Toward Melanoma Detection: A Challenge at the 2017 International Symposium on Biomedical Imaging (ISBI). arXiv: 1710.05006\n\n[4] DeYoung, et al. ERASER: A Benchmark to Evaluate Rationalized NLP Models. ACL, 2020. \n\n[5] Sanh, et al. DistilBERT, a Distilled Version of BERT: Smaller, Faster, Cheaper and Lighter. *arXiv preprint* arXiv:1910.01108, 2019.\n\n[6] Ebrahimi, et al. HotFlip: White-Box Adversarial Examples for Text Classification. ACL, 2018.\n\n[7] Wang, et al. Revisiting hilbert-schmidt information bottleneck for adversarial robustness. NeurIPS 2021.\n\n[8] Zhang,et al. Large-scale kernel methods for independence testing. Statistics and Computing, 28(1), 2018.\n\n[9] Ninh and Pagh. Fast and scalable polynomial kernels via explicit feature maps. KDD 2013."}]

Author rebuttal:

Meta-review: This paper aims to learn salient features for supervised learning tasks, separating out non-salient features into a subset of the feature space dimensions. Unlike previous methods, the proposed H-SPLID algorithm learns to separate these salient and non-salient features without additional data that goes beyond the data used for supervised learning. The loss function contains 3 types of terms. The cross entropy term is the cross entropy loss when predicting from only the salient features. The masked clustering terms encourage features to match mean features, with class-specific means for salient features and a global mean for non-salient features. Lastly, the HSIC terms minimize the dependence between the data and the salient features as well as the labels and the non-salient features. The H-SPLID algorithm minimizes the loss function through alternating optimization of the neural network and the saliency mask. H-SPLID is supported by a theoretical result that bounds the change in model prediction by the HSIC of the data and the salient features. Experiments show that the method improves robustness to adversarial attacks and transfer accuracy for saliency benchmarks. An ablation additionally shows that performance degrades when only a subset of the loss terms are used.

The reviewers praised the exposition, technical soundness, algorithmic novelty, and results of the paper. They raised various questions and asked for several experiments. The authors address these effectively in the rebuttal. In the end all reviewers were positive to paper acceptance although most expressed a relatively low confidence in their assessment.
Decision: Accept (poster)