Auditing Local Explanations is Hard
Authors: Robi Bhattacharjee
Ulrike von Luxburg
Venue: NeurIPS 2024 poster (2024)
Keywords: explanation
auditing
trust
regulation
Primary area: interpretability_and_explainability
TL;DR: We show that verifying local explanations can require exorbitant amounts of data.

Abstract: In sensitive contexts, providers of machine learning algorithms are increasingly required to give explanations for their algorithms' decisions. However, explanation receivers might not trust the provider, who potentially could output misleading or manipulated explanations. In this work, we investigate an auditing framework in which a third-party auditor or a collective of users attempts to sanity-check explanations: they can query model decisions and the corresponding local explanations, pool all the information received, and then check for basic consistency properties. We prove upper and lower bounds on the amount of queries that are needed for an auditor to succeed within this framework. Our results show that successful auditing requires a potentially exorbitant number of queries -- particularly in high dimensional cases. Our analysis also reveals that a key property is the ``locality'' of the provided explanations --- a quantity that so far has not been paid much attention to in the explainability literature. Looking forward, our results suggest that for complex high-dimensional settings, merely providing a pointwise prediction and explanation could be insufficient, as there is no way for the users to verify that the provided explanations are not completely made-up.

Auditing Local Explanations is Hard
Robi Bhattacharjee University of Tübingen and Tübingen Center robi. bhattacharjeeebaati uni umi-tuebingen. de
Ulrike von Luxburg University of Tübingen and Tübingen Al Center ulrike luxburg@uni ttuediinnnttueeeennnneeee de
Abstract
In sensitive contexts, providers of machine learning algorithms are increasingly required to give explanations for their algorithms' decisions. However, explanation receivers might not trust the provider, who potentially could output misleading manipulated explanations. this work, we investigate an auditing framework which third-party auditor collective of users attempts to sanity-check expla- nations: they can query model decisions and the corresponding local explanations, pool all the information received, and then check for basic consistency properties. We prove upper and lower bounds on the amount of queries that are needed for an auditor to succeed within this framework. Our results show that successful auditing requires potentially exorbitant number of queries particularly in high dimensional cases. Our analysis also reveals that key property the "locality" the provided explanations quantity that so far has not been paid much attention in the explainability literature. Looking forward, our results suggest that for complex high-dina digensinnnsion settings, merely providing a pointwise prediction and explanation could be insufficient, as there is no way for the users to verify that the provided explanations are not completely made-up.
Introduction
Machine learning models are increasingly used support decision making in sensitive contexts such as credit lending, hiring decisions, admittance to social benefits, crime prevention, and so on. In all these cases, would be highly desirable for the customerw/applicnnttsppessss judge whether the model's predictions or decisions are "trustworthy". New Al regulation such as the European Union's Act can even legally require this. One approach that often held up as potential way to achieve transparency and trust is to provide local explanations, where every prediction//eccsion comes with human-undee eadle explanation for this particular outcome (c.g.. LIME (Ribeiro et al. 2016), SHAP (Lundberg and Lee 2017), Anchors RRbeiiro et al. (018)).
be able to
However, in many real-world scenarios, the explanation receivers may necessarily trust the explanation providers (Bordt et al., 2022). Imagine company that uses machine learning tools to assist in screening job applications. Because the company advleed demonstrate fair and equitable hiring, it is plausible that it might bias its explanations towards depicting these properties. And this is easy to achieve: the company under full control of the machine learning model and the setup of the explanation algorithm, and prior literature (Ghorbani et al.) 2019 Dombrowski et al.) 2019) has shown that current explainability tools can be manipulated to output desirable explanations.
This motivates the question: what restrictions or procedures could be applied to prevent such explanation cheating, and more specifically, what are ways verify that the provided explanations
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

(a) Insufficient data for auditing
(b) Sufficient data for auditing
Figure 1: Local explanations (see Section 2.2 for notation): In both panels, set of training points and their classifications f(x) (red/blue, decision boundary in green) are shown. For three training points (one centered at each ball), local linear explanation (gx, Rg) is illustrated where Iu is local linear classifier (black decision boundary) and Rg is local ball centered at a. Panel (a) depicts regime where there is insufficiet data for verifying how accurate the local explanations approximate the classifier f none the provided regions contain enough points to assess the accuracy of the linear explanations. Panel (b) depicts regime with more training points allowing to validate the accuracy of the linear explanations based on how closely they align with the points in their corresponding regions.
are actually trustworthy? One approach to require that the explanation providers completely publicize their models, thus allowing users or third-party regulators to verify that the provided explanations are faithful to the actual model being used. However, such requirement would likely face stiff resistance in settings where machine learning models are valuable intellectual property.
In this work, we investigate an alternative approach, where a third-party regulator or a collective of users attempt to verify the trustworthiness of local explanations, simply based on the predictions and explanations over set of examples. The main idea is that by comparing the local explanations with the actual predictions across enough data one could, in principle, give an assessment on whether the provided explanations actually adhere to the explained model. The goal of our work precisely understand when this is possible.
1.1 Our contributions: data requirements for auditing.
We begin by providing general definition for local explainability that encompasses many popular explainability methods such as Anchors (Ribeiro et al. 20118. Smooth-gras (Smilkov et al. (2017). and LIME (Ribeiro et al. 2016). We define a local explanation for classifier J at point a pair (Rz,gz), where Rt is local region surrounding x, and Oa. is a simple local classifier designed to approximate over R.. For example, continuous data, Anchors always output (Rz, Prr) where R2 is a hyper-rectangle around x and is constant classifier; gradient-based explanations such as Smooth-grad LIME implicitly approximate the decision function f by linear function in local region around x.
Obviously, any human-accessibe explanation that is being derived from such a local approximation can only be trustworthy if the local function 9N indeed approximates the underlying function f on the local region Rz. Hence, necessary condition for local explanation be trustworthy is that the function 92 is close to ff on the region R,,, and this should be the case for most data points x sampled from the underlying distribution.
To measure how closely set of local explanations adheres to the original classifier f, we propose an explainability loss function L, f), which quantifies the frequency with which f differs by more

---

than y from the local classifier IN over the local region R₂ (see Sec. 2.2 for precise definitions). We then introduce a formalism for auditing local explanations where an auditor attempts to estimate the explainability loss (F,, In our formalism, the auditor does so with access to the following objects:
1. A set of data points X = (.1, drawn i.i.d from the underlying data distribution.
2. The outputs of a classifier on these points, f(x) = (((=)))...,(((
3. The provided local explanations for these points E(,,)) - (E.
Observe that in our formalism, the auditor has only restricted access to the machine learning model and the explanations: they can only interact with them through their evaluations at specific data- points. We have chosen this scenario because we believe it to be the most realistic one in many practical situations, where explanation providers try to disclose as little information on their underlying machine learning framework as possible.
In our main result, Theorem 4.T we provide a lower bound for the amount of data needed for an auditor to accurately estimate I., [E, f). A key quantity in our analysis is the locality of the provided explanations. We show that the smaller the provided local regions Rg are, the more difficult becomes to audit the explainer. Intuitively, this holds because estimating the explainability loss relies on observing multiple points within these regions, as illustrated in Panel (b) of Figure T
By contrast, if this fails to hold (Panel (a)). then there is no way to validate how accurate the local explanations are. We also complement our lower bound with an upper bound (Theorem 4.2) that demonstrates that reasonably large local regions enable auditing within our framework.
Our results imply that the main obstacle to auditing local explanations this framework is the locality of the provided explanations. As it turns out, this quantity is often prohibitively small in practice, making auditing practically impossible. In particular, for high-dimensional applications, the local regions R& given by the explainer are often exponentially small in the data-dimension. Thus the explanations cannot be verified in cases where there does not exist any prior trust between the explanation provider and the explanation receivers.
We stress that estimating the local loss (, f) serves as first baseline on the path towards establishing trustworthy explanations. It is very well possible that an explanation provider achieves small local loss (meaning that the local classifiers closely match the global classifier f) but nevertheless provides explanations that are misleading in some other targeted manner. Thus, we view successful auditing in this setting as necessary but not sufficient condition for trusting an explanation provider.
Our results might have far-reaching practical consequences. In cases where explanations are con- sidered important or might even be required by law, for example by the AI Act, it is a necessary requirement that explanations can be verified or audited (otherwise, they would be completely use- less). Our results suggest that in the typical high dimensional setting of modern machine learning, auditing pointwise explanations is impossible if the auditor only has access pointwise decisions and corresponding explanations. In particular, collectives of users, for example coordinated by non-governmental organizations (NGOs), are never the position to audit explanations. The only way forward in auditing explanations would be to appoint a third-party auditor who has more power and more access to the machine learning model, be it access to the full specification of the model function and its parameters, or even to the training data. Such access could potentially break the fundamental issues posed by small local explainability regions in our restricted framework, and could potentially enable the third party auditor to act as a moderator to establish trust between explanation receivers and explanation providers.
1.2 Related Work
Prior work Yadav et al. 2022 Bhatt et al. 2020 Oala et al. 2020 Poland 2022) auditing machine learning models is often focused on applying explainability methods to audit the models, rather than the explanations themselves. However, there has also been recent work (Leavitt and Morcos 2020 Zhou et al. 202T) arguing for more rigorous ways to evaluate the performance various explanation methods. There are numerous approaches for doing so: including performance based on human-evaluation (Tesus al. 2021 Poursabzi-Sangeee et al. 202T). and robustness (Alvarez-Melis and Jaakkola 2018).
3

---

There has also been a body of work that evaluates explanations based on the general notion of faithfulness between explanations and the explained predictor. Many approaches (Wolf al. 2019) Poppi et al. 2021 Tomsett et al.) 2020) examine
specific measures, and typically rely on access to the neural network that would not be present our setting. Others are often specialized to specific explainability tool - with LIME (Visani et al. [2022] Botari et al. 2020) and Shap (Huang)
and Marques-Sine Silva 2023) being especially popular choices.
By contrast, our work considers a general form of local explanation, and studies the problem of auditing such explanations in a restricted access setting, where the auditor only interacts with explanations through queries. To our knowledge, the only previous work in similar setting is (Dasgupta et al.) 2022). in which local explanations are similarly audited based on collecting them on set of data sampled from data distribution. They consider a quantity called the local sufficiency, which directly corresponds to our notion of local loss (Definition 2.3 However, their work is restricted to discrete setting where local fidelity is evaluated based on instances that receive identical explanations. In particular, they attempt to verify that points receiving identical explanations also receive identical predictions. By contrast, our work lies within continuous setting, where local explanation is said to be faithful matches the underlying model over a local region.
A central quantity to our analysis is the locality of an explanation, which is a measure of how large the local regions are. Prior work has rarely measured or considered this quantity, with a notable exception being Anchors method (Ribeiro et al.) (2018) which utilizes it to assist in optimizing their constructed explanations. However, that work did not explore this quantity beyond treating as fixed parameter.
Finally, note that other recent work, such (Bassan and Katz 2023 provides avenues for providing explanations with certifiable correctness, meaning that they provide proof that their accurate reflect the underlying model. We view our work as complementary such methods as our work demonstrates the necessity of such ideas by demonstrating difficulties with using generic local explanation methods.
2 Local Explanations
2.1 Preliminaries
In this work, we restrict our focus to binary classification- - we let denote data distribution over Rd, and f Rd + } be a so-called black-box binary classifier that needs to be explained. We note that lower bounds shown for binary classification directly imply lower bounds in more complex settings such as multi-class classification or regression.
For any measurable set, M C Rd, we let ((M) denote the probability mass assigns M. We will also let supp(u) denote the support of μ. which is the set of all points x such that ((z': : || - z'll r)) > 0 for all r >>l>> 0.
We define a hyper- in Id as a product of intervals, (a1, b1] x ... x (aa, bal. and let Ha denote the of all hyper-rectangles in Rdd. We let Ba denote the set of all - in Rd with the ball of radius r centered at point being defined as B(x, r) = {x': || - x'll < r}.
We will utilize the following two simple hypothesis classes: Ca, which is the set of the constant classifiers over Rd, and La, which is the set of all linear classifiers over Rd. These classes serve as important examples of simple and interpretable classifiers for constructing local explanations.
2.2 Defining local explanations and explainers
One of the most basic and fundamental concepts in Explainable Machine Learning is the notion of a local explanation, which, broadly speaking. is an attempt to explain a complex function's 's behavior at specific point. this section, we describe a general form that such explanations can take, and subsequently demonstrate that two widely used explainability methods, LIME and Anchors, adhere to it.
We begin by defining local explanation for a classifier at a given point. Definition 2.1. For Idd, and f Rd {+1}. a local explanation for f at is pair (Rz, 9w) where Rg C ddd is region containing I, and gx R.g + {11 is classifier.

---

Here, 9N is typically a simple function intended to approximate the behavior of a complex function, f. over the region Rg. The idea is that the local nature of R, simplifies the behavior of f enough to provide intuitive explanations of the classifier's 's local behavior.
Next, we define local explainer
map that outputs local explanations.
Definition 2.2. E is a local explainer if for any f [R + { and any x E RR E(f,z) is local explanation for f at æ. We denote this as E(f x)) ) = (Ra, 9x)
We categorize local explainers based on the types of explanations they output - R denotes a set of regions in RR, and G denotes class of classifiers, Rd - (=1), then we say E E(R, 9) if for all f.z. Eff x) outputs (Ra, 9z) with RS E R and 9x E g.
Local explainers are typically constructed for given classifier / over given data distribution μ.. In practice, different algorithms employ varying amounts access to both / and μl - for example, SHAP crucially relies on data sampled from μl whereas gradient based methods often rely on knowing the actual parameters of the model, f. To address all of these situations, our work takes a black-box make assumptions about how a local explainer is constructed from f and μ.
approach in which Instead we focus on understanding how to evaluate how effective a given explainer is with respect to classifier f and data distribution J..
2.3 Examples of Explainers
We now briefly discuss how various explainability tools in practice fit into our framework of local explanations.
The main idea of Anchors (Ribeiro et al. 2018) is to construct region the input point in which the desired classifier to explain remains (mostly) constant. Over continuous data, it outputs local explainer, E, such that E(x) = (Ra. 9z), where Is is a constant classifier with 9z f(x) for all x' E RRd, and Rg is a hyper-rectangle containing x. It follows say that the Anchors method outputs explainer in the class, E(Ha, Ca).
Anchors:
Gradient-Based Explanations: Many popular explainability tools (Smilkov et al. 2017 Agarwal et al. 2021 Ancona et al.) (2018) explain a model's 's local behavior by using its gradient. By definition, gradients have natural interpretation as locally linear model. Because of this, we argue that gradient-based explanations are implicitly giving local explanations of the form (Rz, Iv). where
R2 B(x,r) r) a small L2 ball centered at æ, and Is is linear classifier with coefficients based on the gradient. Therefore, while the radius and the gradient Ir being used will vary across explanation methods, the output can be nevertheless interpreted as an explainer in & (Ba, fa). where Ba denotes the set of all L2-balls in Rd, and L. denotes the set of all linear classifiers over Rdd
LIME: At high level, LIME (Ribeiro al. 2016) also attempts to give local linear approximations to complex model. However, unlike gradient- based methods, LIME includes an additional feature- wise discretization step where points nearby the input point, .r, are mapped into bimary representation in {0, 1 based on how similar a point is to x. As a consequence, LIME can be construed as outputting local explanations of a similar form to those outputted by gradient-based methods.
Finally, as an important limitation of our work, although many well-known local explanations fall within our definitions, this does not hold in all cases. Notably, Shapley-value (Lundberg and Lee) 2017) based techniques do not conform to the format given in Definition [.1]] as it is neither clear how to construct local regions that they correspond to, nor the precise local classifier being used.
2.4 A measure of how accurate an explainer is
We now formalize what it means for local classifier, I=. to "approximate" the behavior of f in R Definition 2.3. For explainer E and point æ, we let the local loss, L,E be defined as the fraction of examples drawn from the region R2 such that yn and f have different outputs. More precisely, we set
L(E,fe)
Pr (ox 4 f(x))a E Rz). z'op
5

---

is implicitly used to evaluate E. and is omitted from the notation for brevity. We emphasize that this definition is specific to classification, which is the setting of this work. A similar kind of loss can be constructed for regression tasks based on the mean-squared difference between Or and
We contend that maintaining low local loss across most data points is essential for any reasonable local explainer. Otherwise, the explanations provided by the tool can be made to support any sort of explanation they longer have any adherence the original function f.
To measure the overall performance of an explainer over an entire data distribution, it becomes necessary to aggregate L(E, f.z) over all z μ. One plausible way accomplish this would be to average [( x) over the entire distribution. However, this would leave us unable to distinguish between cases where E gives extremely poor explanations at small fraction of points opposed to giving mediocre explanations over a much larger fraction. To remedy this, we opt for a more precise approach in which user first chooses a local error threshold, 0 < Y < 1, such that local explanations that incur an explainabiliy loss under are considered acceptable. They then measure the global loss for E by determining the fraction of examples, I, drawn from μ that incur explainability loss above 7.
Definition 2.4. Let > 0 be a user-specified local error threshold. For local explainer E, we define the explainability loss I,, (E, f) as the fraction of examples drawn from ja that incur local loss larger than 7. That is,
(x, Pr (r 7]. a
We posit that the quantity (E, serves as an overall measure of how faithfully explainer E adheres to classifier f, with lower values of (E, corresponding to greater degrees of faithfulness.
2.5 A measure of how large local regions are
The outputted local region Rg plays a crucial role in defining the local loss. On one extreme, setting R2 to consist of single point, (æ), can lead to perfect loss of 0, the explainer only needs to output a constant classifier that matches f at x. But these explanations would be obviously worthless they provide no insight into beyond its output f(x). On the other extreme, setting Rg Rd would require the explainer to essentially replace I' in its entirety with Sz. which would defeat the purpose of explaining f (as we could simply use Iu instead). Motivated by this observation, we define the local mass of an explainer at a point æ as follows:
Definition 2.5. The local mass of explainer E with respect to point x and function f. denoted A (F,, f,),, is the probability mass of the local region outputted at x. That is, if F(f,x) (Rzz Ir), then
A(E,f Pr [x' x xniup
Ru..
Based on our discussion above, is unclear what an ideal local mass is. Thus, we treat this quantity property of local explanations rather than a metric for evaluating their validity. As we will later see, this property is quite useful for characterizing how difficult it is to estimate the explainability loss of an explainer. We also give a global characterization of the local mass called locality.
Definition 2.6. The locality of explainer E with respect to function denoted A)Ef), is the minimum local mass it incurs. That is, A(E, f) = inf sespplla) A(E, f.).
3 The Auditing Framework
Recall that our goal is to determine how explanation receivers can verify provided explanations in situations where there isn't it mutual trust. To this end, we provide framework for auditing local explanations, where an auditor attempts to perform this verification with as little access to the underlying model and explanations as possible. Our framework proceeds in with the following steps.
1. The auditor fixes a local error threshold 7.
2. A set of points X = fa1...., Fn) are sampled i.i.d from data distribution J..
3. A black-box classifier f applied to these points. We denote these values with f(X)

---

4. A local explainer E outputs explanations for f at each point. We denote these explanations with X)f = (E)f, ,(f,z),,.,,.. _.)
5. The Auditor outputs estimate A (x, E(f.x)) for the explainability loss.
Observe that the auditor can only have access to the the model f and its corresponding explanations through the set of sampled points. only inputs are X, ((X, and E( X). the context of the job application example discussed in Section | this would amount to auditing company based on the decisions and explanations they provided over a set of applicants.
In this framework, we can define the sample complexity of an auditor as the amount of data it needs to guarantee an accurate estimate for (E, f). More precisely, fix data distribution, μ,, classifier, f. and an explainer E. Then we have the following:
Definition 3.1. For tolerance parameters, (1. C2, 5 > 0, and local error threshold, ? > O, we say that auditor, A, has sample complexity [(c,, c2, c2, 6, with respect μ,, E, if for any n 2 ((1,, 62, 6, 7), with probability at least - 5 over X {x1,..., ~ n², outputs an accurate estimate of the explainability loss, Ly (E, That is,
In(1+e)) (E,
S A (X,J(X)) [(), < (T(1-e)) (F, (E
Next, observe that our sample complexity is specific the distribution, μ4, the classifier, f, and the explainer, E. We made this choice to understand the challenges that different choices of μ., f. and E pose to auditor, As will later see, will bound the auditing sample complexity using the locality (Definition) 2.5p.
which is a quantity that depends on μ., f. and E.
How much data is needed to audit an explainer?
4.1 A lower bound the sample complexity of auditing
We now give a lower bound on the amount of data needed to successfully audit an explainer. That is, show that for any auditor A and any data distribution μa can find some explainer E and some classifier f such that A is highly likely to give an inaccurate estimate of the explainability loss. To state our theorem hyper-rectangles in Rd, and that Ca denotes the set of the two constant binary classifiers over IRd Additionally, we will include a couple of mild technical assumptions about the data distribution μ. We defer detailed discussion of them to Appendices A..3 An33and A.1 We now state our lower bound.
the following notation and assumptions. Recall that H.s denotes the set of
Theorem 4.1 (lower bound on the sample complexity of auditing). E1, < 1 be tolerance 48 parameters, and letry < $ be any local error threshold. Let be any non-degenerate distribution, and X > 0 be any desired level of locality. Then for any auditor A there exists a classifier f : Rd + {+1} and an explainer E E(Ha, Ca) such that the following conditions hold.
1. E has locality A(E, f) = A.
2. There exist absolute constants co, c1 > 0 such that if the auditor receives
Co
n
max(e1, 62)A1 l-- max((1.(2)
many points, then with probability at least 1/ over X = (x1,...; Ind ~ 1r, gives an inaccurate estimate of (E, f). That is,
A(X. E(f, & (e,tt))(Eff) - 62 Ly(1 + ez].
In summary, Theorem 4.1 says that auditing an explainer requires an amount of data that is inversely proportional locality. Notably, this result does not require the data-distribution to be adversarially chosen, and furthermore applies when the explainer E can be guaranteed to have remarkably simple form being E(Ha, Ca).
Proof intuition of Theorem 4.1 The main intuition behind Theorem 4. is that estimating the
local explainability loss L J. J, requires us to observe samples from regions Rg, This would allow us to obtain empirical estimate of L(E, f. by simply evaluating the fraction of points
7

---

from Rg that the local classifier, Iw, misclassifies. This implies that the locality À is limiting factor as it controls how likely we are observe data within region Rz.
However, this idea enough isn't sufficient to obtain our lower bound. Although the quantity 2 (x--or))) does indeed serve lower bound the amount of data needed to guarantee seeing large number of points within a region, Rz, it is unclear what a sufficient number of observations within R2 is. Even if we don't have enough points in any single region, Rg. to accurately estimate L(E, f, x), it is entirely plausible that aggregating loose estimates of L(E, f.x) over sufficient number of points x might allow us to perform some type of estimation of (E,
To circumvent this issue, the key technical challenge is constructing a distribution of functions f and fixing m = = (2) such that observing fewer than points from given region, Rg, actually provides zero information about which function was chosen. We include a full proof in Appendix A
4.2 An upper bound on the sample complexity of auditing.
We now show that if À is reasonably large, then auditing the explainability loss (E, f) can be accomplished. As mentioned earlier, we stress that succeeding in our setting is not a sufficient condition for trusting an explainer- - verifying that the local explanations Ir match the overall function f is just one property that a good explainer would be expected to have. Thus the purpose of our upper bound in this section is to complement our lower bound, and further support that the locality parameter À is the main factor controlling the sample complexity of an auditor.
Our auditing algorithm proceeds by splitting the data into two parts, X1 and X2. The main idea is to audit the explanations given for points in / by utilizing the data from X2. If we have enough data, then it is highly likely for us to see enough points in each local region do this. We defer full details for this procedure to Appendix B.I We now give the an upper bound on its sample complexity.
Theorem 4.2 (Upper Bound on Sample Complexity of Algorithm I]. There exists an auditor, A, for which the following holds. Let μ be data distribution, f be classifier, and E be an explainer. Suppose that E has locality X with respect to and f. Let é1, 62, å be tolerance parameters and let y 0 be local error threshold. Then A has sample complexity most
02,1, = (1 x222
This bound shows that the locality is sufficient for bounding the sample complexity for auditing local explanations. We defer a full proof to Appendix B Observe that the dependency on À is ((+) which matches the dependency in our lower bound provided that c1 O.
5 The locality of practical explainability methods can be extremely small
Theorems 4. and 4.2 demonstrate that the locality À characterizes the amount of data needed for an Auditor to guarantee an accurate estimate of the explainability loss I,x (F..)) f). It follows that if is extremely small, then auditing could require a prohibitive amount of data. This leads to the following question: how small is À for practical explainability algorithms? To answer this, we will examine examine several commonly used algorithms that adhere to our framework.
We begin with gradient-based methods, which can be construed as providing an explainer in the class EBB,, La). where Ba denotes the set of L2 balls in IR and Lu denotes the set of linear classifiers. To understand the impact of dimension on the locality of such explainers, we begin with a simple theoretical example.
Let y be the data distribution over RRd that is union of three concentric spheres. Specifically, x / is equally likely to be chosen at uniform from the sets S {x |||||| = a-) S2 = {x |||||| and S3 fo ||ر|||
+ 33. where a, 3 are small d-dependent constants (Defined Appendix C Let f Rd + {+1} be any classifier such that f(z) 1 if S1 U Syy and f(z) = -1 if S2. Observe that μ is particularly simple data distribution over three spherical manifolds, and f is a simple classifier that distinguishes its two parts. We illustrate this distribution in panel (a) of Figure
Despite its simplicity, locally explaining f with linear classifiers faces fundamental challenges. We illustrate this in Figure 2 Choosing large local neighborhood, as done at point A, leads to issues
8

---

Figure 2: An illustration of Theorem 5.1 with the concentric blue and red circles depicting the data distribution j classified by f. and with local explanations being depicted at points A and B. Explanations are forced to either have large local loss (point A) a low local mass (point B).
posed by the curvature of the data distribution, meaning that it is impossible to create an accurate local linear classifier. On the other hand, choosing a neighborhood small enough for local linearity, as done in point B, leads to local regions that are exponentially small with respect to the data dimension. We formalize this in the following theorem.
Theorem 5.1 (A high dimensional example). Let μu, f. be as described above, and let be any explainer in (Ba, La). Let x" be any point chosen the outer sphere, S3. Then E outputs explanation at x² that either has a large local loss, or that has a small local mass. That is, either L(E, f. x²) 2 or A(E, f, 31-d.
Theorem 5.1 demonstrates that if a locally linear explanation achieves even remotely reasonable local loss, then it necessarily must have an extremely small local explanation. This suggests that, gradient based explanations will be exponentially local with respect to the data dimension, d.
We believe that this is also exhibited in practice particularly over image data, where explanations often verified based on perceptual validity, rather than relevance to practical training points beyond the point being explained. For example, the explanations given by SmoothGrad (Smilkov al. 2017) are visualized as pixel by pixel saliency maps. These maps often directly correspond to the image being explained, and are clearly highly specific to the (see c.g. Figure 3 of (Smilkov et al.. 2017)). As result, we would hardly expect the implied linear classifier to have much success over almost any other natural image. This turn suggest that the locality would be extremely small. We also remark that a similar argument can be made for Lime, which also tends to validate its explanations over images perceptually (for example, see Figure Ribeiro al. (2016)).
Unlike the previous methods, Anchors (Ribeiro et al. 2018) explicitly seeks to maximize the local mass of its explanations. However, it abandons this approach for image classifiers, where instead maximizes a modified form of locality based on super-imposing pixels from the desired image with other images. While this gives perceptually valid anchors, the types of other images that fall within the local region are completely unrealistic (as illustrated in Figure 3 of (Ribeiro et al., 2018)) and the true locality parameter is consequently extremely small. Thus, although Anchors can provide useful and auditable explanations in low-dimensional, tabular data setting, we believe that they too suffer from issues with locality for nigh-dimensional data. In particular, we note that it is possible to construct similar examples to Theorem 3.1 that are designed to force highly local Anchors-bart explanations.
Conclusion
Our results in Section demonstrate that the locality of a local explainer characterizes how much data is needed to audit it: smaller local regions lead to larger amounts of data. Mcanwhile, our

---

discussion in Section 5 shows that typical local explanations are extremely local in high-dimensional space. follows that in many cases, auditing solely based on point-wist decisions and explanations is impossible. Thus, any entity without model access, such as collective of users, are never in position to guarantee trust for machine learning model.
We believe that the only way forward is through a more powerful third-party auditor that crucially as more access the machine learning model, as this could potentially break the fundamental challenges posed by small explainability regions. We believe that investigating the precise types of access this would entail as an important direction for future work that might have broad practical consequences.
Finally, although our definition of local explainers encompasses several widely used explanation methods, do note that there notable exceptions such as Shap (Lundberg and Leep (0177). which does not fit into our paradigm. As a consequence, one important direction for future work is expanding framework to encompass other local explanation methods and examine to what degree they can be audited.
Acknowledgements
This work has been supported by the German Research Foundation through the Cluster of Excellence "Machine Learning- New Perspectives for Science" (EXC 2064/1 number 390727645) and the Carl Zeiss Foundation through the CZS Center for Al and Law.
References
Agarwal, S., Jabbari, S., Agarwal, C., Upadhyay, S., Wu, S., and Lakkaraju, H. (2021). Towards the unification and robustness of perturbation and gradient based explanations. In International Conference on Machine Learning (ICML).
Alvarez-Melis, D. and Jaakkola, S. (2018). On the robustness of interpretability methods. arxiv preprint 1806. 08049.
Ancona, M., Ceolini, E., Öztireli, C., and Gross, M. (2018). Towards better understanding of gradient- based attribution methods for deep neural networks. In International Conference on Learning Representations (ICLR).
Bassan, S. and Katz, G. (2023). Towards formal XAI: formally approximate minimal explanations of neural networks. In Sankaramarayanan, S. and Sharygina, N., editors, Tools and Algorithums for the Construction and Analysis of Systems 29th International Conference, TACAS 2023, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2022, Paris, France, April 22-27, 2023, Proceedings, Part volume 13993 of Lecture Notes in Computer Science, pages 187-207. Springer.
Bhatt, U., Xiang, A., Sharma, S., Weller, A., Taly, A., Jia. Y., Ghosh, J., Puri, R., Moura, J. M. F., and Eckersley, P. (2020). Explainable machine learning deployment. In Conference on Fairness, Accountability, and Transparency (FAceT).
Bordt, S., Finck, M., Raidl, E., and von Luxburg, U. (2022). Post-hoc explanations fail to achieve their purpose in adversarial contexts. Conference on Fairness, Accountability, and Transparency (FAccT).
Botari, T., Hvilshøj, F., Izbicki, R., and de Carvalho, A. C. P. F. (2020). Melime: Meaningful local explanation for machine learning models. arxiv preprint 2009.05818.
Dasgupta, S., Frost, N., and Moshkovitz, M. (2022). Framework for evaluating faithfulness of local explanations. In International Conference on Machine Learning (ICML).
Dombrowski, A., Alber, M.. Anders, C. J., Ackermann, M., Müller, K., and Kessel, P. (2019). Explanations can be manipulated and geometry is to blame. In Advances in Neural Information Processing Systems (NeurIPS).
Ghorbani, A., Abid, A., and Zou, J. (2019). Interpretation of neural networks fragile. In AAAI Conference Artificial Intelligence.
10

---

Huang, X. and Marques-Sie Silva, J. (2023). The inadequacy of shapley values for explainability. anxiv preprint 2302.08160
Jesus, S. M., Belém, C., Balayan, V., Bento, J., Saleiro, P., Bizarro, P., and Gama, J. (2021). How can choose an explainer?: An application-groundee evaluation of post-hoc explanations. In '21: 2021 ACM Conference on Faimess, Accountability (FAceT).
Leavitt, M. L. and Morcos, A. S. (2020). Towards falsifiable interpretability research, arxiv preprint 2010.12016
Lundberg, S. M. and Lee, S. (2017). A unified approach to interpreting model predictions. In Advances in Neural Information Processing Systems (NeurIPS).
Oala, L., Fehr, J.. Gilli, L., Balachandran. P., Leite, A. W., Ramírez, S. C., Li, D. X., Nobis, G., Alvarado, E. A. M., Jaramillo- Jaramillo-Guutieree, G., Matek, C., Shroff, A., Kherif, F., Sanguinetti, B., and Wiegand, T. (2020). ML4H auditing: From paper to practice. In Machine Learning for Health Workshop, (MI4H NewrlP...
Poland, C. M. (2022). The right tool for the job: Open Open-source auditing tools in machine learning. arxiv preprint 2206.10613.
Poppi, S., Cornia, M., Baraldi, L., and Cucchiara, R. (2021). Revisiting the evaluation of class activation mapping for explainabilityy A novel metric and experimental analysis. In Workshops of the Conference Computer Vision and Paltern Recognition Workshops (CVPR).
Poursabzi- Sanggeh,, F., Goldstein, D. G., Hofman, J. M., Vaughan, J. W., and Wallach, H. M. (2021). Manipulating and measuring model interpretability. In Conference on Human Factors in Computing Systems (CHI).
Ribeiro, M. T., Singh, S., and Guestrin, C. (2016). "why should I trust you?": Explaining the predictions of any classifier. In Demonstrations Session, Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies.
Ribeiro, M. T., Singh, S., and Guestrin, C. (2018). Anchors:
High-precision -odel-agnostic explanations. In Mcllraith, S. A. and Weinberger, K. Q., editors, AAAI Conference Artificial Intelligence.
Smilkov, D., Thorat, N., Kim, B., Viégas, F. B., and Wattenberg, M. (2017). Smoothgrad: removing noise by adding noise, arxiv preprint 03825.
Tomsett, R., Harborne, D.,, Chakraborty, S., Gurram, P., and Preece, A. D. (2020). Sanity checks for saliency metrics. In (AAAI) Conference on Artificial Intelligence.
Visani, G., Bagli, E., Chesani, F., Poluzzi, A., and Capuzzo, D. (2022). Statistical stability indices for LIME: obtaining reliable explanations for machine learning models. J. Oper. Res. Soc., 73(1):91-101.
Wolf, L., Galanti, T., and Hazan, T. (2019). A formal approach to explainability. In AAAI/ACM Conference on AI, Ethics, and Society (AIES).
Yadav, C., Moshkovitz, M., and Chaudhuri, K. (2022). A learning- thcoretic framework for certified auditing of machine learning models. arxiv preprint 040600
Zhou, J., Gandomi, H., Chen, F,, and Holzinger, A. (2021). Evaluating the quality of machine learning explanations: A survey on methods and metrics. Electronics, 10(5):593.

---

A Proof of Theorem 4.1
A.1 An additional assumption
We also include the assumption that the locality parameter be small compared the tolerance parameters. More precisely, we assume that À < E
We believe this to be extremely mild assumption considering that typically operate in the regime where À exponentially small with the dimension, d, whereas the tolerance parameters are typically between 10 and 10 33
A.2 Main Proof
Proof. Fix E1, Y, and μ. given in the theorem statement. Our goal is to show the existence of classifier f and explainer E so that the auditor, A, likely to incorrectly estimate the parameter, (E, f)) To do so, our strategy will be instead to consider distribution over choices of (,, f), and show that in expectation over this distribution, A estimates L, (F, () poorly.
To this end, we define the following quantities:
1. Let be the explainer given in Section A.4
2. Let f" be the random classifier defined in Section A.4
3. Let n be any integer with
71 S 2592X Smar(er.e2)
4. Let X be random variable for set of points ( Ind drawn i.dd from μ..
5. Let (X) be random variable for ( fz Y has random- ness over both f and X*
6. Let A (Rd)" {=1)", and denote the measure over A" " induced by (X,Y).
7. By definition E's output independent of function, f* Thus, we will abbreviate A's output by writing
A E(),
X)) A(X,YEE)
This emphasizes that both X and the output E are independent of f*
8. We let denote the interval that the auditor seeks to output an estimate That is,
I' = [L, + (E, c2, (2,
Using this notation, we seek to lower bound that the auditor fails meaning we seek to lower bound,
Pr A,(,YY,)) $ 171.
Fx
To do so, let Ti denote the event
7 == ( -ez < (F, S (1)1))) < 1
and T2 denote the event
To 1 + < ( (E,5") (x + 5c2
The key observation is that any estimate, A(X, Y, E), can be inside at most one of the intervals, [] 62, + 62] and [] + 3e2; 2 + 5e2]. Using this, we can re-write our desired probability through the following integration.
12

---

Let (x, y) denote specific choices of (X, Y). Note that in this context, 2 represents a set of points in
(R "r, and y represents a set of labels in {+1]". We then have the following:
$ 1 / Pr[A(z, v, E) r = x, Y = y) do dz)
P Xx
Pr[Ti| x, y (A(a, y. E) $ I1)
A yy - (A(r, y, Bb $ 11) (0 y)
Pr
min (P-TIX-=,Y- 2, x, yl. Pr[T2] = x, 2, - do y),
where the last equation holds because at least one of the events. A(r, y, E) & I and A(x, E) & 12. must hold. To bound this last quantity, utilize Lemma A.9
Let
S =
x, Pr[TIXX = x, = = (x, ==((0.))
2
55
By Lemma
A.9
we have that (S*) 2 8. It follows that
Pr FX
B) E) 2
min
y1, - =x,
= Ix,Y = -,,
=x,-= =ul dr
A"
Pr =x, = pl = = = 8) do v)
min
5
2
do [z, v)
50 5
2
1
((()))
3'
which completes the proof as this implies with probability at least 3. the Auditors estimate is not sufficiently accurate.
A.3 Non-degenerate Distributions
[hncoremm4.]jnchueeee the assumption that μ is non non-degenerate, which is defined as follows.
Definition A.1. We say that data distribution μ over IRd is non-degenerate if for all R4, there exists < i < such that
1A (1x' 24 = xx))== = 0.
Being non-degenerate essentially means that at any point, x, the data distribution has finite probability density with respect to some feature.
This condition any distribution with well-defined density over Rd (i.e. such as Gaussian) and is also met for most practical data-sets in which any of the features globally continuously distributed (i.e. mass in kg over a distribution of patients).
We exclude data distributions with point masses because they can pose particularly simple cases in which there is a strict lower bound on how small the local region assigned to given point can be. For example, in the extreme case where p is concentrated on single point, auditing any model or explanation over is trivial.
We now show useful property of non-degenerate distributions.
Lemma A.2. Let p be a non-degenerate distribution and R a hyper-rectangle. Then R can be partitioned into two hyper-rectangles, R1, R2 such that y ((R)), a (R2) > ((R)
Proof. Let R = (a1, bı] (az, ba) x (aa, ba]- First, suppose that there exists 1 < í < d such that for all r E (a,, bel.
# (fz:2==130 p(R)
13

---

Let
= sup r [ {x 12 ST) _ ((
4
It follows that setting R1 R {z S r²) and R₂ = R \ Rı will suffice as R will have probability mass least x(R) and probability mass most (
Otherwise, suppose that no such exists. Then, thus, there exists v1 72 ................................ Ta) such that ((R {ar I₁ r))) > O. It follows that the point (ri...., ra) violates Definition A.1 which is contradiction.
Thus some exists, which allows us to apply the above argument, finishing the proof.
A.4 Constructing f" and E
We begin by partitioning the support of μ into hyper-rectangles such that each rectangle has probability mass in the interval [ a). We then further partition these rectangles into a large number of equal parts. Formally, we have the following:
Lemma A.3. Let > 0 be fixed, and K be any integer. Then for some integer L > there exists a set of repeanlessangles, {Rİ $ < L, S S K} such that the following hold:
1. R!,...R,
R partition rectangle R4.
2. For all 1 S i L, a S 11 (R)) < 4a.
3. For all 1 iis T. and 1 S < K, P(R.) S (R))
R.)
4K
Proof. First construct ......, R2 by using the following procedure:
1. Begin with the set = {R*} where R a large rectangle containing the support of jr.
2. If contains a rectangle, Rt such that (RR 4ax, then apply Lemma A.2 split into
two rectangles with mass at least ((()) and mass at most 32(
4
3. Repeat step 2 until such rectangles, R, exist.
This process clearly terminate in of rectangles each of which has mass in the desired range, and also must terminate as a single rectangle can only be cut at most
log
times.
log
Next, to construct R2; RR, RKK, we simply utilize an analogous procedure, this time starting with {R,} and replacing with a(R.) 4K
We now construct a fixed explainer, E.
Definition A.4. Let E denote the explainer so that for all x E supp(u), we have E(x) = (Ra. ++)) where R, is the unique hyper-rectangle, R; that contains z, and g+1 is the constant classifier that always outputs +1.
now construct a distribution over functions f, and f* random function that follows this distribution. We have the following:
Definition A.5. Let I* be random classifier mapping Rd to (+1) constructed as follows. Let m be an integer and < -1,.... P2m, Q1, ... 42m S be real numbers that satisfy the conditions set forth in Lemma A.10 Then f is constructed with the following steps:
1. Let be a binary event that occurs with probability }
2. If P occurs, then set r; = P; for 1 <is Pam Otherwise set r qi-
3. If x & U R, then (x) = +1.
4. For each rectangle R,, randomly select 1 < k < 2m uniform.
14

---

5. For each sub-rectangle RV with probability set f(a) -1 for all z E RV, and with probability 1 Tk, set f (*) +1 for all x E RV.
Note that m is constructed based on and which we assume to be provided as in the statement of Theorem 4.1
A.5 Properties of f and
We now prove several useful properties of this construction. To do we use the following notation:
1. We let f denote the random variable representing the way f is generated. We use f = denote the event that f equals specific function R {+1).
2. We let P denote the indicator variable for the binary event used in Section A.4 to construct
f.
3. We let m denote the integer from Lemma A.10 that is used to construction f*
4. We let X = (....... zn) ~ μ² denote a random variable i.i.d selected points from We use x to denote specific instance of X.
5. We let Y (y1...., Un) be random variable over labels constructed by setting y4 f (z:). We similarly use y to denote a specific instance of Y.
6. We let denote the measure over (IR4 x {+1))) associated with (X,Y).
7. We let A denote the domain of the pair of random vectors (X, Y) (as done Section A.2
We begin with a bounds on the probability that we see any rectangle that has large number of points selected from it.
Lemma A.6. Let Ry...., Rr be as defined in section A.4 and as given. Let U denote the subset of A such that
= ((x,8) : 31 Sis 2, X RRI 2 2m).
Then oUU) S 180
Proof. We bound the probability that single rectangle. R., contains at least 2m points from X, and then apply a union bound over all rectangles. By construction, μ (RR,) I 4X, which implics that for each point zj X the probability that X, falls within rectangle R, is at most 4X. Thus, for any set of 2m distinct points from X, the probability that they all fall within R, is at most (4X)am, By taking a union bound over all (2) subsets of 2m point from X, and substituting our assumed upper bound for n (point of Section A.2 we have the following
Pr[[X n R.j 2m] <
(4A)*s 3m
2m
(4)) 2m
2m
(42)2m
2m 2592 max(e1, (2) max((l,ea)
2m
4 s/n A 11 2t
e
= (42)
2m 2592 max(<1, 1 max((1
15

---

By definition (see Lemma A.10 m 2 16 max(ee.e2))
Substituting this, and noting that A 2mm is
increasing with respect to (since À 1), have
2m
Pr[[X n Rd 2 2m) $ (4X)
2m
2m 2592 max (11, c2) max(e1)12)
e8 max((1),)2)
41 (
2m
$ (4X)
2592 max 12 m8 (2)sSaaee))))
96
2m
S (4X)
2592
X
180
Finally, we apply a union bound over all rectangles. Observe that there are at most 1 such rectangles because by construction each rectangle has most X. Thus, total probability is at most A which is at most 180 desired. 180
Next, we leverage the properties from the construction of to bound the conditional probability of P = 1 when (a, y) $ U. Lemma A.7. Let (z, y) be in the support of a so that (Ir y) & U. Then
1
Pr[P = 1|( = (x, v)] Pr ( - (xr,)] 2
Proof. Our main idea will be to use Bayes-rule, and show that Pr[(X, Y) = (c.y)) Pr[(X, Y) (v. v) P = O. This will suffice due to the fact that the prior distribution for P is uniform over {0, 1}. To do so, we first note that X independent from P. For this reason, it suffices to show that
Pr[Y = y 1, = x] Pr[Y = y 0, X = x).
To do so, we will express these probabilities in terms of the real numbers, P1..... ........m P2m and ....... 42m from which they were constructed (see Definition A.5).
For each rectangle, R; (see Lemma Xn Rg follows from step 4 of Definition A.5 the values in Ri; and Y R2 are independent from each other. Thus,
let Y
R² denote the function values of all points in the set
re-write desired probability
L Pr(Y = = 2| [IPr(( R.) (y R.) R,) = (# R.)].
We now analyze the latter quantity for rectangle, R. For convenience, let us relabel indices so that x n R₁ T2,, 31 and n R2 = (,,,...,,11 31 for some integer 2 0. We also let X1...., X1 and Yi..... Yú denote the corresponding values for X R₃ and Y n R,.
We now further assume that that for all xa, Ib E {II...... 21), that va and 26 are contained within different sub-rectangles, Ry R² (see Definition A.5p. this isn't the case, observe that we can simply remove the pair (Ib, yb), as by the construction of f", this will be forced to be identical to (Zas ya).
By applying this assumption, we now have that for given choice of the parameter Ta (step 4 of Definition A.5), the values of yi..... are mutually independent. Utilizing this, we have
2m
Pr Pr((Y)))) = ( R (X R2) (z R.)
yk 2
U&Ps +
1 2
2m
k=
2m
F(P;),
2m
1=1
Where F is polynomial of degree I. Here, the expression, 23
ykPp + simply evaluates to Pj
2
V -1 (as py is the probability of observing -1) and Pb otherwise.
16

---

Next, observe that the only difference when performing this computation for P = 0 is that we use the real numbers, Q1.... 92m instead. Thus, we have,
Pr [Y n R2) = 0. (In
2m
1
yk
yk
+
1 -
2m
2
j=1
k==
F(g));
2m
To show these two expression are equal, by assumption (xr, v) & U which implies that 1 < 2m. Furthermore, by Lemma A.10 Σ Pk 2m gfr all 0 S 1 S 1. It follows that Σim F(Pk) > F(gh), which implies our desired result.
Next, we bound the probability of events related the value of Byy the parameter that the Auditor seeks to estimate.
Lemma A.8. Let Ti denote the event that
1
2 E2 < Ly((+t)) S Lx(1-c) < 12+0 +
Let To denote the event that
1
+ 302 < Tis(+ee) < (1((1-1) S + 562-
2
Then taken over the randomness of the entire construction, Pr[Ti, =1, Pr(To, P 0 where P is the binary event defined above.
T80
Proof. By definition, Pr[P- = 1] = Pr[P- = 0]
1 2'
Thus, it suffices to show that Pr[Ti|P =
1]. Pr[To|P
0] Z 89
90
We begin with the case that = (the case for P = 0 will be similar). For each rectangle, RG let r(Rt) denote the choice of ты made for R& in step 5 of Definition the value of r(R)) nearly determines the local loss that E pays for points in R; with respect f* In particular, if the number of rectanglssg K, is sufficiently large, then by the law of large numbers, we have that with high probability over the choice of f*, for all rectangles R; and for all x R,
A.5 The crucial observation is that
L(E,f" r(R)) 0.01
(1)
Let us fix K to be any number for which this holds, and assume that this value of K is set throughout construction. Next, recall by Lemma A.10 that
P1 < P2 < < Pm. 7(1 -11) < 7(1 221) Pm+1 < P2m
Recall that (R.) is chosen uniform among (pr... ... P2m (step of Definition A.5 It follows from Equation that for any x E R,, and for any a E (1(1 71,7(111)))))))))))))1) + (1) that
for all E Rd] 1
PrIL(E,
Furthermore, because we are conditioning on P 1, the value of ʃ within each rectangle, RG, is independent. This implies that we can bound the behavior of T.a F,, f*) by expressing as a sum of independent variables.
17

---

Let fy(1 (1( a]}, we have by Hoeffding's 's inequality that
[
+ 62 ] = PPr Σ
[
Pr La (a,
E
= - 62
2
1 RR)) (L(F,
([E,,,,, ,x) 2 a for all x E Ra)
E
2
c2
2
+
i=1
2
2 1 - 2exp
E 1 RR.)
2c3
2 1 2 exp
16A
1
179
2 180
180
The penultimate inequality holds since (R,)) S 4A for each R, and because there are at most X
such rectangles. The last inequality holds because e by the assumption in Section A.
Thus by taking union bound over both values of a, we have that L., (*) [
22: 2 e2]
with probability at least 90' This completes our proof for the case / p=11 1.
For P = 0, we can follow a nearly identical argument. The only difference is that the values of q (see
Lemma 10 selected that
PF + 4e2.
This results in the expected loss falling within different interval, and an identical analysis using Hoeffding's 's inequality gives the desired result.
The main idea of proving Theorem 4.1 to show that for many values of X, Y. the conditional probabilities of Ti and To occurring are both fairly large. This, in turn, will cause the Auditor to have difficulty as its estimate will necessarily fail for least one of these events.
To further assist with proving this, we have the following additional lemma.
Lemma A.9. Let St denote the subset of (Ted x {+1))" " such that
2 8 -- ==((0.)) (o. Pr(TT] = (z. v) Pr(Tol (x, 2 5
Then (SS)) 6
Proof. Let S = {xx,)) : Px(Ti((X,Y) = (2,8) < 2) and similarly S/ = {(x, y)
PX, = (z. < }. Then S = (R' x (+1))" (S U.). Thus it suffices to up-
per bound the mass of Sf and Sy. To do so, let U be the set defined in Lemma A.6 Then we have
89
S Pr[Ti,P=
180
Pr[Ti, P = 1|(X,Y) = =(x, yr,,
[1dx{1133"
Pt/Ti,-=1(XX, = (I, - + / JUS
P = (1, y)]do
S
Pr P 11(X,Y) (z, v)ldo
Ami(STU0)
2
(S) + (o(U) -U S)) + 1 (o(A") (0) ((A" ((A") (U)s)))
5
2
(S)) 3 (A \U) + ((U)
5 2
119 1 oS)
180
180
10
18

---

Here we are simply leveraging the fact that Pr(P 1|X, Y = y is precisely 2/2 when 2; y are not in U, and consequently that the probability of I and P = 1 is at most H 1, and & when (z, y) is in the sets S1, U Si and (A" U) \ 5i respectively. Finally, simplifying this inequality gives us (S)) - 12'
completely symmetric argument will similarly give us that ( S 122 Combining these with union bound, it follows that ((5)) 2 8. as desired.
A.6 Technical Lemmas
T8. there exists m > O, and real numbers 0 0 P1, P2. ...... P2m, 91... ....., 42m S such that the following four conditions hold:
Lemma A.10. For all 0 < 62,62 <
1
1. For all 0 S 1 2m 1, 2im pt Σm=1 o;j
2. P1 p2
Pm < 7(1 (211-)n <( 261) < pm++1 S... P2m-
3. 91 S 42 S 9m 9m 9m+1 7(1 + 261) < qm++ mmm
4. 462
ma 1.
Proof. Let / denote the largest integer that is strictly smaller than 8 mmax(2e and let 87
1 It
follows that max(2e1, <2). Let Pt and Qi be defined in Lemma A.11 Let 21. Then follows from the definitions of m, that
m = 21 S
4 max(221, max <
4e2
which proves the first part of property 4 in Lemma A. For the second part, by the definition of we have 7 maxx(2e1.e2) 1. Since 62 I 48
it follows that > which implies
21
+1.
max(2 (2)
Next, let .l....,P4t denote the (sorted in increasing order) roots of the polynomial
(a(x) P ("
7(1 261)
2/c
Since the roots of Pt are explicitly given in Lemma A. it follows that the middle two roots of (x: (which are the values of pm and pm4+1) satisfy
Pm 71 + 26 2c), Pm+1 = 7(1 + 26, + 26).
Because e' > e, these values clearly satisfy the inequalities given by point 2 in the Lemma statement.
Next, define (I...., Qui as the (sorted increasing order) roots of the polynomial,
7(1 1 2(1)
(x(x) Qi
2xc
Again using Lemma A.II we see that
Jm = 9m++1 -((1 2E1).
which satisfies point 3.
To see that P; and qi are indeed in the desired range, simply note that by substitution, both P1 and must be larger than 7(1 + 2c,) - 42(cc).. However, by definition, 4f(2yc) % Thus, this quantity is larger than 0 which implies that P1 and Φi are both positive. Because y < 10 similar argument implies that Pa.. and 92m are at most 1.
Finally, point I follows from the fact that Pı,... P2m and 41, ........ 42m are the complete sets of roots of two polynomials that have matching coefficients for the first 2m coefficients. follows by basic
properties of Newton sums that ΣΦ -E of for 0 < i < 2m and this proves point 1. D
19

---

Lemma A.11. For any 1 > 0, let
Pr(x)) = ((x + (x + +) (x 41 1)) ((x -3)
- 3)
3)... (x -x- 41 + 1))
........
Let Q1(z) = P((x) P())). Then Q1 has 21 distinct real roots over the interval (-41,-14 distinct real roots over the interval 41), and a double root at 0.
Proof. By symmetry, Pf(0) = (7(0) = O, and by definition Qi(0) = 0. It follows that x 0 is double root. Next, fix 1sisl0 5 By definition, have that P/(4i 1) Pi + +1) 0. We also have that
2(1+))
2(1-s)
P((4)) = II (2) -8-1) 1) j=1
II (2j 1).
j=1
Meanwhile, also have that Pi(0) (2) 1))- By directly comparing terms, it follows
that (i) is strictly larger than Pi(O). Thus, by the intermediate value theorem, Q: must have at least one root both (4i 1. 4:) and (4i, 4i + 1). Using a similar argument, we can also show that Q: has at least one root in (4/ - 1, 1,4().
Since Pt an even function, it follows that Qi is as well which means it symmetrically has roots in the intervals (-4i, -4i + 1) for < < I and (-4i 1, 4i) for 1 S S 1-1. Taken all together, we have constructed 2(1 + 1) 4/ distinct intervals that each contain a root. Since Qi also has double root at I = 0. it follows that this must account for all of its roots as deg(Qn deg(P) (P)) = 41.
B Proof of Theorem 4.2
B.1 Algorithm description
The main idea of our auditor, choose of points, X1, and attempt assess the accuracy of their local explanations by using a wealth of labeled data, X2, to validate it. Our algorithm uses the following steps (pseudocode given in Algorithm
audit, is to essentially performs a brute-force auditing where
1. (lines -3) We first partition X based on the tolerance parameters, c <2, ō. X, will be the set of points that we validate, and X₂ will be the set of points we use for validation.
2. (lines 8), For each point æ in X1, we check whether there are enough points from X2 that fall within its local region, Rz, to accurate estimate its local loss.
3. (line 9-13) For each point satisfying the criteria in line 8, we evaluate its empirical local loss and then tally up how many points have a loss that is larger than 7.
4. (line 17) We output the proportion of points with loss larger than y among all points whose loss we measured.
At a high level, we expect this algorithm to succeed as long as we have enough data in each of the local regions induced from points in X1.
B.2 Notation
We use the following:
1. Let 6, 61, 7 the tolerance parameters defined in Definition 3.1
2. Let A A(E, f) denote the locality of E, w.r.t data distribution p.
3. Let X1 be the set of points that specifically being audited.
4. Let X₂ be the set of points being used to audit.
5. Let |X1| m. By definition,
log
6. We set [Xgl n'
By definition, n' stuff.
20

---

Algorithm 1
72,
X), 61, 7,6)
1: m log
12
8
2: k - 2
log 176
egd
3: X1 {21..... 1..........
2m X2 t X |X,
4: r +.
5: for I3 E X1 do
6:
(Ra,
f)
7:
Xi = R2g N2
8:
if it 2 k then
9:
[(F,,, f. + |x1] Enjex; (Ix, (z)) + f(x)))
10:
if f,, = +1.
> y then
11:
else
13:
= 6' + 1. end
15:
end if
end for
17:
Return P48-
7. For any E IRd, we let E(x:) (Rx; In) be the local explanation outputted for xr by
explainer
We also define the following quantities related to estimating how frequently the local loss outputted by the explainer is above the desired threshold, 7.
1. Let r* = Praze [AFES,a)) 2 7(1 + +1).
2. Let g" Pr 1 (1) & =() +(++))))
3. Let b" Prz (LE, S ()1-
Here, r* denotes the probability that point has a large local error, ba, the probability point has low local error, and g², the probability an "in-between" case that nearby the desired threshold, y. By the definition of sample complexity (Definition 3.I.. the goal of Algorithm Tis is to output an estimate that is inside the interval, [r" E2, r" +g gg + E2)-
Next, we define r,g b as versions of these quantities that are based on the sample, X1
1. Let Pra-x, [[(Ef,,>) 2 (1 + ei)]-
2. Let g = Pr [7(1 -1) & ((E.f.x) S (11++1))
3. Let b = Prz [L(Eff,)) S x
Observe that while is drawn at uniform from X, in these quantities, we still use the true loss with respect toe μ. L(E, .), to determine whether it falls into r,g or Because of this, it becomes necessary to define two more fully empirical quantities that serve estimates of r and b (we ignore
as it will merely contribute to a "margin" in our estimation terms).
1. Letr' = -PrawXi
(Prrax,laod))) 4 fxx))aa e R&) 7) and X2 n Rz
log 2(+))
176 log 2(r)1))
2. let b' Prawx, (o(d') # f(x')/o' e Rd) 54) and X2 n R
7g
The final estimate outputted by Algorithm is precisely 7488 Thus, our proof strategy will be to show that for sufficiently large samples, r, r, are relatively accurate estimates of r" 9.","" b², and in turn and D' are relatively accurate estimates of and Together, these will imply that our estimate is within the desired interval, [r", b*).
21

---

B.3
The main proof
Proof.
(Theorem 4.2 Let
12
log
176
44 176
R 2 27 log
log
2
cg0g
By ignoring log factors, we see that 12 = Ō ( 1/4 + ) thus satisfying the desired requirement in
Theorem 42
Let 11 and X2 be as in Algorithm 1 and let m, n' denote Xi| and |X2 respectively. Directly from Algorithm it follows that,
61 log 8
12 n
log ezd log
44 log ego ecd
2
By letting = 4 and l
log 10 27
we have that m 2 2
12 and that log o
log 176
16 cB 62
log
n' 2
log
2
log c8 2
16
4log
16 28
log
ed>2c
k log 8k
de
Our bounds on m, and n' allow to apply Lemmas B. and B.4 along with union bound get that the following equations hold simultaneously with probability at least 1 over X ~ n²:
| - b-rr%l 9" 11,b 87 S,
r(1 - 26) Sr' r be
6(1 26) < re g +.
Recall that our goal is show that / Ir 2, r* g" + 62] holds with probability at least
1 8. Thus, it suffices show that this simple algebraic consequence of equations To this end, we have
r'
(
r(1 - 2c)
r' +
r(1 2τ) + rE + +
r(1 - 2E)
+ b b+ g r
2
+ b 9
r" -
2e
+ br + 9" + 36
6
2
1 36
+ 3t
2 (1 - 3e)
6 2
4e 2c
r" -2-
Here step (a) follows from Equations and 4 (b) from Equation 2
and (c) from the fact that
22
22

---

For the other side of the inequality, we have
(0)
r r +
r' + V
+ be b(1 - 22)
r+ g be
(r + + b)(1 -
r+ g
(r + 6) E) 1-6
9 + (1+22)
r+g+b
r" + 2
3r +2?
1/2 36
r" + + 2c
+ 3E + 26
1- 3E
(
$ (r" + 9 90)(1 + 4c) + 2c(1 + 4e) + 3E 26
S + 9" + 66 + 86 +3c 26
2 /" + +
(e)
$ rr g + 62
Here step (a) follows from Equations 3 and (b) from Equation (c) from the fact that --3e 1+4c, (d) from
fa
S 8 2. and (e) from the c2
II
II
B.4 Concentration lemmas
In this section, show several lemmas that allow to bound the behavior of the random variables r.g. b, r' and 8' (defined section B.2). We also use m and as they are defined in Section B.2 to be the sizes of [X] and [x2] respectively. Finally, we also let ft-
We begin by bounding the differences between r, b and ,","","" b". Lemma B.1. Suppose that m 2
1 log
12 à Then with probability at least 1 5 2 over Xı nm, the
2c2
1, 9'1, 6² S.
Proof. Observe that r is the average of m i.idd binary variables each of which have expected value r*. follows by Hoeffding's 's inequality that
2(cm)²
Pr[Ir r"I cl s 2exp
m
1
12
< exxp
-2e
log
2
6'
By an identical argument, we see that the same holds for Pr[lg ge1 > and Pr[lb- - 641 > c). Applying a union bound over all three gives us the desired result.
Next, we show that if ní' is sufficiently large, then it is highly likely that for any given point we observe a large number of points from X2 within the explanation region, Rg,
Lemma B.2. Let x E supp(u), and let k > 0 be an integer. Suppose that n' > log mr probability at least å over X2 n², RR n X2 k.
Then with
23

---

Proof. Partition X₂ into l sets, X2 X3,....... X2 each of which contain at least
Ing
i.idd points
from J. Because each point is drawn independently, we have that for any 1 S S k
log S2
Pr[X] n R₂ = 0]
Pr L Rel 1 N'
Ing kz
1 (1 A
8k
Σ exp
log
5c
dc
8k
Here we are using the definition of X as a lower bound on the probability mass of Rg
Next, we show that Rg has a sufficient number of points, then it is quite likely for the empirical estimate of the local loss x to be accurate.
log 16 Lemma B.3. Let supp(u), and let k 2(0(1)2-
Then conditioning there being least k
elements from X2 Rz, the empirical local loss differs from the true local loss by at most yei with probability at least 1 8.
be That is,
dc
Pr X2m
[(E,
E (gx(x)) + f(e')) 7a Xx n Rx 1X2 R&l d'EX2nR,
k
8
Proof. The key idea of this lemma is that the distribution of k points drawn from j conditioned on being in R is precisely the marginal distribution over which L(E, is defined. In particular, this means that the points in X2 Rg can be construed i.i.d drawn from the marginal distribution of μ over Rz Given this observation, the rest of the proof is a straightforward application of Hoeffding's inequality, Letting L(E, f,x) = [ ΣxEXXn 1 (9x(x') + f(x')) and K = [X2 n Rx we
have
[ (.E.f.)))(EEE,.5)) > 761 K k S 2 exx Xa
2(K
Pr
K
16
< 2 exx
log Se
8c
desired.
It follows by a union bound that the probability that least one of the sets in (Xi Rs : <issk) is empty is at most g. Thus with probability at least 1 & 8
&
all the sets are non-empty which implies
that RR, n X2)
ki completing the proof.
Finally, we use the previous two lemmas to show that r' and b' closely approximate and
Lemma B.4. Let l 2 log ig
2( and suppose that n'' 2 klog at
Then with probability at least
over X2 pm the following equations holds:
r(1 - 2e) S r' Sr + g be,
b(1 2c) s 6' $ re b
Proof. We begin by defining subsets of X, that correspond to g, b, r' and b. We have
1. Let R = {x E X1 L(E, 2 +1)+))
2. Let (x X1 711 =1) s L(E, f.x) < 7(1 + t)))
24

---

3. Let B= =
f2 X1 : S r(1 -1111) g)]}
log 12
4. Let
xE X1 (x # f(x'))x' R2)>>>) 7) and [xg n Rx
2 1
log 176 rg 2(yc1)"
5. Let B'
x X1: (Pte-xx,lo + (a'))a E Rad 12) and |x2 R
x E
Observe that r, r, b,, and D' are the probabilities that x X1 is in the sets R, G, It', and B' respectively.
Our strategy will be to use the previous lemmas to bound the sizes of the intersections, R P. n B, B' n RR, B' O B'. To this end, let a E be an arbitrary point. By Lemma B.2 with probability at least 1 over X₂ ~ n=" x E R B'. Furthermore, by Lemma B.3 (along with the definition of R),, with probability at most dc inequality, get the following two bounds:
8. x E B'. Applying linearity of expectation along with Markov's
Ex, |Rn (X1 (R'
Pr X2
Rn
\R' (R'N
|R|E
-
|
|R| åc 6
R/c 8"
Ex, R n B']
Pr
Rn B²
|R|e
|R]
K 8
[t|e 8
Applying an analogous line of reasoning stating with x E B, we also have
8
Pr
BU \ (R'
BBc
X2
8"
Pr X2
Bn R
|Ble
Applying a union bound, none of these events occur with probability at least 1 - 5 over X₂ ~ n²d Thus, it suffices to show that they algebraically imply the desired inequalities. To this end, suppose none of them hold. Then we have,
2
R'
X11 R'
O B +
R
+ I
X1
|| + |G| + [R|
[Xa
= + 9 +
R'
X
IR B + WR +1
G| + R n R
[X1]
0+0
|R|
IRN
B' |R (B'U UR)
X1
R
Rlc
|R|
X11
r(1 2c).
The upper and lower bounds on 6' are analogous.
25

---

C Proof of Theorem 5.1
C.1 Definitions and Notation
Definition C.1. Let a 36700166 and | 358172
Definition C.2. Let $1. S2, S3 be three (d - sp-ehersss centered at the origin with radii (1 - a), 1, and respectively for 0 a.
Definition C.3. Let l denote the data distribution that a is selected by first selecting E (1, at uniform, and then selecting æ from S; at uniform. Definition C.4. Let f denote the classifier Ed
{=1} such that
||>|| S
((x
1- 32
< |
11+
8
+1
||^
+++
Definition C.5. Let x² be arbitrary point chosen S3, and let be any linear classifier, and B(a,r) r) be any T2-ball that contains x².
Lemma C.6. There exists x E S2 and
& 01, 02 0g S π such that
Si B(, = C(Si, -a) a), S2 B = C(S2, 02),
S B(arr) = c(S3. 3), 0z),
where C(S,x,0) 0) denotes the spherical cap of angle 0 centered at x on (d - 1)-sphere S (see Definition C.18
C.2
Main Proof
We begin by showing that the structure of the data distribution provides significant difficulty for linear classifiers. At a high level, the curvature the spheres, S1, S2, S3, make separating them linearly only possible for small portions of the sphere. We formalize this with the following lemma. Lemma C.7.
Let 0 2 7. Let x be an arbitrary point on S2, and let Ti (z, 0). Ts(x, 0) denote the sets
Ti 0) =
C( To(x, 0) C(S,, U x(1
3),
Let g Rdd {#1} denote any linear classifier. Then g exhibits loss of least Y/ over the conditional distribution of μ restricted to either T1 or Tz. That is,
1
Pr (g(x') f(x))/z E (x,2x,)) Pr [g(x') # f(x))aa' e Ta(2, x'mpp
Next, show that if the local explanation region B(a, conttais sufficiently large probability mass, then it also must include region that takes the form given by T, or T3 from Lemma C.7
Lemma C.8. Suppose that p(B(a, r)) 2 32-4, 4 Let Ti and T3 be as defined in Lemma C.7 Then there exist S2 and A 2 such that at least one of the following hold:
(x C B(a,r), and p(TT(z,0) 2 2.
((Baar)
T)(2, B), and p(Ta(z.0)
1
((B(ar))
2"
We are now prepared to prove Theorem 5.1
Proof. (Theorem 5.1 Suppose B(a, r) > 31-d, Then by Lemma C.8 there exists 0 > f such that either (x, 0) or Ta 0) is subset of B(a, r) and satisfies the conditions outlined above. Suppose that Ti (z, 8) C B(a, r) (the other case is analogous).
26

---

Let be any linear classifier. Then it follows from Lemmas C.7 and C.8 that the loss incurs over
the conditional distribution μ over (a, r) can be bounded follows:
B(a.r (g(2)) (((=) + [()) 2 Pr(z (1 0)) Pr(n(=) + [())|= (i 0)]
Pr
11 1
23 6'
which concludes the proof.
C.3 Proof of Lemma C.7
We will show that the claim holds for (r, 0) as the proof for Ti (2; 0) is nearly identical (as a < (). Let w E Rd be a unit vector and E R scalar such that
1 [-1 (w. 2) b (w,z)<b
g(=) -
Our main strategy will be to find large set of points within Ts(ar, 8) such that g(2) g(=(1 3)) for all & within this set. This will force to misclassify either 2 or 2 + 3) which will lead to our desired error bound. To this end, define
T
2 (S,, x. 0): g(2) -1, g(((1 + B)) +1, Kr, 2) - cos 8
Lemma C.9.
(T))
((C(522088) 10
Proof. Let a be selected at uniform from
π 0(S2,I,0) (c(S2.2, ($2,2,
UC uC (x)
8
suffices upper bound the probability that g(z) & (=((1 + $)). Let Co = {2: (2, = cos ø]. Our main idea is to condition on & E Co. and then integrate over all choices d. That is, if we let ø denote the random variable representing the angle between x and z, then
Note that definitionally satisfies that (xx 2) S cos
-1, g(=(1 - Pr(g(=) = - 1, g(x(1 + B)) +1] = E -
+ B)) = =1].
We will now bound the latter quantity. Fix any d, and observe that the conditional distribution, z/ can be written as
cos ø + sin where u is a random vector in Rd-1 that is uniformly distributed over the unit sphere, d 2 C Rd-1 Rewriting the condition that g(2) * g(=(1 + 3)) in terms of u. observe that
s(z) 1, 0(= + B)) =1 = (ur, z) < b (w, x(1 + B))
b
<
(w, 2) b
1
b
(x cos Φ, w) $ (w, u sin Φ) S - (x cos σ; w)
1 1+3 3
(w, u) 8, + sin Φ
where s is a constant that depends solely on b, w, x, and Φ. Note that we are using the fact that |b| < (1 + B) as otherwise g would trivially output the same label over all uu).
By applying Lemma C.17 along with the fact that (by definition of ()
B
3
sin
1370d
we have that
3
Pr
E
3,8 s
+
< 10
sin Φ
which implies the desired result.
27

---

(CCs),))) ((C(S2.m,0)
Lemma C.10.
_
Proof. By symmetry, μ (C (S2, H, 3)) = μ (S,, -z, 5)) so suffices to bound one of them.
Since 8 2 by assumption, applying Lemma C.20 we have
(C (S2, 3) 1 (C(22, 2,0))
UC (S2, xx 3))
24 (C (S,, 8))
" (S225, T. 0))
2p (C (S2, 2, 8)
11 (C (S2, V. 4))
sin
x 8
d-2
2
2
sin x
7
<
30*
as d 2 5 in the assumption of Theorem 5.1
We are now prepared to prove the main lemma.
Proof. (Lemma C.7 Let A C(S2, 0) be defined as the set of all points for which g classifies both the point and its image in (1 + B)S₂ correctly. That is,
= {= E C(S2, x, 0) g(z) - -1,9((1 ( B)z) +1}.
By the previous two lemmas, we have
p(AA)
M(T UC(S2, 3) UC(S2 -x, 3)
((C(S2,z,0)
2(C(S2,,,0)) x,
1
10
30 3
Each = A is point for which both 2 and + B)= are correctly classified, and each = C(S2, 0) \ A corresponds either being misclassified, (1 B) being misclassified. It follows that the overall accuracy of g over Tz(x, 0) is at most
1 2 (52
[g(2)) f())] S 2 (m.
Pr
Pr
[a $ AA]
2~C(S22m.0)
1 2
1+
[2 E AA)
Thus g must incur loss least 3 over (z, 0), as desired.
C.4 Proof of Lemma C.8
Throughout this section, we assume that p(B(a, r)) 3' Lemma C.11. max(#1, 02 0z) 2 3.
Proof. Assume towards a contradiction that this does not hold. Let be as in Lemma C.6 Then by the Definition of (Definition C.3 and Lemma C.6l it follows that
μ( (B(aa r)) (CC(S), (1 a), 01)) (CC(S,,r.0.) 02)) + ((C(Ss, x(1 + 83, 0x))
1
3 (v((1) + (0,) + (0a))
V
where @ is as defined in Section C.6 However, Lemma C.19 implies that v (2) < 31 31-d 31 31-d, This contradicts our assumption ((B(a, r)) and implies the desired result.
28

---

Lemma C.12. r21 -a.
Proof. Lemma C.11 implies that B(a, r') must intersect some sphere among S1, S2, S3 in spherical cap of angle least Basic geometry implies that 2 min(rad(S:), (aa())))rr(()))))) rad(S2), rad(5s) where (S)( denotes the radius of S,. The desired result follows from the fact that - a rad( < rad(S2), rad(Sa)
Lemma C.13. 002 max (0i, 03)1 S 4d'
Proof. We first compute 01, 02, 03 in terms of a,r,a a, and B. We begin with 02, and note that the expressions for 0, and 0g can similarly derived. To this end, have
S2 n B(a {or ||a||| 1, - r}
{or: ||-||| 1, (I. 2(,r, a) (a,a) $ r2)
x |||||| = ( |||||| ||a||
+ a² 12
2a
where we use denote |||]| in a slight abuse of notation. follows from Lemma that
1 1 a² p2
cos 02 =
2a
We can similarly show that
(1 (1=a)²+ a² -2
(1 (1+ a²
cos 01
cos 0g-
2(1 2(1aa)a
2(1 + 3)a
Let h IR + R be the function defined as h(s)
Thus,
28a
cos 01 hh(1 - cos 02 = h(1), cos 0g h(1 + 3).
Note that in cases where h is outside of the interval |-1, (meaning 0; would be defined), simply set 9 equal to π and 0 respectively, as these quantities still accurately describe the intersection between (a, r) and the corresponding sphere, S..
Case 1: 0 < a < 2 By definition, r)) contains x² and therefore intersects S3. It follows from the triangle inequality that r 2 1 + _ However, this implies that B(a, r) must contain the entirety of S2 and S₁, which implies that 0 02 max(@1, 0g) thus implying the lemma statement.
Case 2: g <a < 1-a r > 1 + 23, then B(a, r) will contain S1, S2 and Ss. which implies 01 = 02 = 03 = m (implying the lemma statement). Thus, assume < 1 233
Diffcrentiating w.r.t. s gives
2
h'(s) = 2a
1+
s2
29

---

By Lemma C.12 x² 2 a², which implies that (s) is nonnegative for s E a1-a, 1 1+ Furthermore, we have that over the interval, [1 a, 5]. 22 a
(s))
1
(1 + 28)²
1
1+
3
(1-a)
1 4, + 3.75
1
3
(1-a)
1
1+ ((0.25) 3.75(0..25)
-
1+
3
0.875
4
8"
This is obtained by substituting appropriate upper and lower bounds for r, 0, 8, a, and B3 Because (s) is nonnegative over the interval, must have that h(1 a) I h(1) S h(1 + (3) which implies
01 2 02 2 03 (as cos a decreasing function). It follows from our upper bound on h((s) that
cos 82 cos (max(01, ps))
cos(O2) cos(01)
h(1) - h(1 0.)
1 1((s)ds
ds
1-a
4a
3
Applying Lemma C.14 implies that 10, max(0), S 8 8/8 statement.
1 which implies the lemma
32
Case 3: a a>>1~6-
First suppose that la - > 3. If > a +3, then the triangle inequality implies that S S2, S3 C B(a, r) which implies the desired result. On the other hand, if r < 3, then we must have a >> 3. and that B(a, r) is disjoint from S1, S2, S3 which again implies the desired result. Thus, we assume that aa rl < 3.
We now use similar strategy to the previous case, and bound the derivative, h/ 1((s). By substituting that aa r| < 3, we have, for 8 E [1 a, + 3].
2 a
[N((s)
1 1
2a
$2
(2a + +3)
+
2a
82
(2a + (3++3)3))
+
2a
(1-a)²
(2a + 3)(3)
+
2a
(0.875)2
x
(1 + 4(2a + 3))
2a
(13 + 8a)
2a
< 44+ = 14.
30

---

Here we are exploiting the fact that - a 2 v3
3 0.65. It follows by the same argument given in Case
2 that cos 22 cox(m)a((f1 (3))] I 143. Applying Lemma C.14 implies [82 - max(01, (,)1 -
4v143 1 desired.
4d
Now we are ready to prove the lemma.
Proof. (Lemma C.8) Let æ be as Lemma C.6 and let 0 max(01, 02 0z). Then by applying
Lemma C.6 to the Definition of y (Definition gives us
#r (B()rr)) (C((51 .01 a.), 01)) (C(22, 02)) (C(Ss, x01 B3,
1 (0,) = (02) + (03))
1
3 3
< (00)
Here V denotes the function defined in Section C.6
Next, let 0 = min(max 000,0) 02). Let Ti (x, 0) and Ta 0) be as defined in Lemma C.7 Observe
that if 0, 2 03. then
Ti(x,0) S (05000){CSS,,.(11000))00CCC3111,
C B(a,r),
and otherwise,
Ta 8) S C(S,, x01 + 3), 03) UC(22 x, 02) S B(a,r).
Thus, least one of these sets is part of r.. We now show that these sets have the desired mass. By the definition 0",, we have
u(Ti(x,O) (TT (x. 0))
2,(C(S2,,z,0) 0))
r(B(a,r)) p (( 3p((C(2,, x. 0*))
Next, Lemma C.11 implies that l" >
3. and Lemma C.13 implies that 0* - 0 s 4d'
1 It follows that
1
1
0 02 0"
2
0"
[
4d
4d
Substituting this, we find that
2p (C x,, 0))
(0)
3/ xC
400)))
2 (0 (1- 1a))
3
((()))
2 (
d-1
1
3
4d
2
1/4
3
2
where the last steps follow from Lemmas C.19 and
C.16
This completes the proof.
C.5 Technical Lemmas
Lemma C.14. Suppose Φ1, 62 E [0, m] such that cos($))) - cos(122) S c. Then (h - -dbl S4Ve.
Proof. WLOG, suppose Φi S Φ2. Let x 02 Φ1.
31

---

Using the sum to product rules, it follows that
a 2
cos Φ1
C08
02
Φ 02
11
+
+2
sin
sin
2
2
11
+
02
2 2sin
sin
2
2
However, observe that x
02
21
and that
21
0+0+ 2. It follows that
2
01+00 E 12. I1. which implies that sin
@1
+.2
sin 2. Substituting this, we have
02
2 sin
sin
sin
We now do casework based on First suppose that x: 2 3. Then 2 2sin / = 11 By definition, so it follows that - 4/a, implying the desired result.
Otherwise, i 5. then sin + f. as the function + sin(l) & is nonnegative the interval [0, /.. Substituting this, we see that E Thus Sec 4/c, as desired.
Lemma C.15. For 0 S c and 0 S sin(co) csin(0).
Proof. Let l(0) = sin(c0) esin(O). Observe that ʃ(0) O. Furthermore, for 0 [0, m]. we have f0(0) = ccos( cdf) - c cos = c (coss (cl) cos( Since cos is decreasing function on the interval [0, n]. it follows that cos(ce) ct) 2 cos(0), which implies f'(0) 2 0. Thus f is non-decreasing on the interval, and the desired incquality holds.
Lemma C.16. For all x > 1, (1 2)=²² 21
Proof. Let f( = (1- It is well known that lim f(x) and lim, f(x) = 1. Thus suffices to show that f() a non-increasing function. To do so, we will show that In f(x) is non-increasing by taking its derivative. We have
(In f(x))
dx (x 1) 8-1
d
dx
d
((x 1) In(x 1) (xr 1) l)z)
dr
In(x 1) x-
x x-1) [n((x) + x-1
x
(In(x) - In(x - 1))
dt
dt
0.
Lemma C.17. Let be a point chosen at uniform over Sy, and let w be fixed unit vector. Then if t < 1370 then for any s E R.
Pr(( 2) E [s. f 1
10
32

---

Proof. Let & denote the random variable that represents the angle between and z. Applying Lemma C.14 it follows that for some choice of s' E IR that
Pw( 2) E [s, + ~ Pr(O E [s' + 4v1..
0
We now bound this quantity by utilizing the quantity v (defined in Section C.6 We have,
Se' / +Iv sin (d-2) ødo
Pr(O E (6',8' + +V0
So sin sin (d-)) 2) Φdo
2 2 2 222 sin (d 2) ed
2 So sin (d-2) gdd
v 1 2vt)
v (
Here we have simply chosen the interval of length 4 that maximizes the corresponding the integral.
Next, we continue by applying Lemmas C.19 and C.16 to get
V 1
2Vt)
Pr(O E 18,8 8 + 4V1
V/ (5)
4VE
d-1
$1-
π
d-1
29d
(9(d-1)
1/29
29d
29d 1
1/29
29d
1/29
$
10
as desired.
C.6 Spherical Caps
Definition C.18. Let S be a (d 1) sphere centered at the origin, let 0 < 0 S π be angle, and let E be a point. We let C(S, x, 0) denote the spherical cap with angle 0 centered at x, and consists of all points, x' E 5dl-1, such that (2,2") ||||||||||||
cos Φb.
Here we take the convention of associating C(S,, Fy, 0) with both the empty set and with {aa). While these are distinct sets, they both have measure 0 under We also associate C(S,, x,, 7) with the entirety of S,.
We let v (0) denote the ratio of the (d s)-suffcce area of the region, C(S, x 0), to the (d- --ssrfaeee area of the entire sphere. Thus, (8) denotes the fraction of the sphere covered by a spherical cap of angle 0. By standard integration over spherical coordinates, we have
(0) = So0 sin (d-2) ΦdΦ
So sin (d-2) Φd
Next, we bound (0) with the following incquality.
33

---

Lemma C.19. Let 0 S 0 S т and let 0 - c
1. Then
V((O)
(0) 2 dd-1
Proof. By applying Lemma C.15 to the definition of v, we have the following manipulations.
V (c0) (Ø)
J sin d-2 000
So sin d-2 0d0
Jo sin" d- (cu)(cdu)
So sin d 0d0
S0 (csin(u)) = (cdu)
S aind=2 0d0
d-1
We similarly have upper bound on this ratio.
Lemma C.20. Let O < 0 < and 0 S S 1. Then
(cf) (0)
sin cω d-2 sin ò
Sc
Proof. We similarly have,
(((O)
Jo oo sin 2d20
0d0 Jo sin d-2 0dd
1 (Ø)
S0 sin -- 2 (cu)
So sin d-2 0d0
d-2
cin ce 10dh (sin(u) sin di
(edu)
S sin 0d0
sin cΦ
sin
Here we are using the fact that b
is non-decreasing function for E m0,
sin f
34

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: we mention all main results in both the abstract and introduction. Furthermore everything within these sections is revisited in the body.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: all our assumptions are clearly stated, and we use the limitations of our methods as avenues for future work. We also stress that our framework is by no means comprehensive for evaluating local explanations.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "I "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
35

---

Answer: [Yes]
Justification: this is a theory paper, and doing so is its main focus. our proofs are all included in the appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [NA]
Justification:
This is a theory paper.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
36

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [NA]
Justification:
This is theory paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run reproduce the results. See the NeurIPS code and data submission guidelines (https
/ "nipsscc/puullc//uui Sotpe///ggideeeeeCeuuuuubbibbi ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [NA]
Justification: this is theory paper
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [NA]
Justification: this is theory paper
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
37

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eтror rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [NA]
Justification: This is theory paper
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http::/:///aaapp..coo/o/o//////a
Answer: [Yes]
Justification: this paper does not utilize any datasets or human subjects. It also does not contribute towards any of harm.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: we discuss consequences of our results. Because they are theoretical, we don't believe our results can be used a directly harmful manner.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
38

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: no models or data are in this paper.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [NA]
Justification: no code models are used.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
39

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
No released assets
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: no human subjects
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
No human subjects
Guidelines:
The answer NA means that the paper does involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
40


Reviews:
[{"review_id": "6PwQBAaZ0x", "reviewer": "Reviewer_KRVz", "summary": "This paper provides theoretical results on how many queries are required for an auditing framework for local explanations of machine learning algorithms (e.g., neural networks).", "questions": "-\tCan you establish or provide a reference hat show how the local loss / explainability loss is a good indicator for manipulation from an adversarial attack (or disingenuity design)? This is critical for the scope and implications of your analysis.\n-\tPlease comment on whether the proposed auditing scheme is indeed the only way to establish a local explainer (fitting your constraints) taking into account the suggestions above.\n-\tCan you comment on how the results might \n-\tL 117 please change reference to Shap to the acronym SHAP\n-\tL 337 please change reference to the Lime algorithm to its acronym: LIME\n-\tL 440 where does the 2592 come from in the denominator for the bound on $n$?\n-\tHow well would the framework work if you chose some K examples to audit around instead of drawing sample i.i.d.?", "limitations": "-\tAnalysis is for a binary classifier", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper is well motivated with a widely interesting and relevant topic. The approach is theoretical, and rigor is provided through proofs in appendices. The authors connect their work to popular algorithms: Gradient based approaches, Lime, and Anchors.", "weaknesses": "The authors acknowledge that the local loss estimation is, in their argument, only a necessary but not sufficient condition for trust. They do not establish or reference any evidence that manipulation would result in the local loss as a good indicator of untrustworthiness. As a result, the analysis serves more as a potential validation scheme for the limited types of algorithms that meet their linearity requirement (e.g. Anchors or LIME). This drastically narrows the scope and implications of their analysis. Unless this can be firmly established the title, abstract, and conclusions of the paper should be amended to reflect the correct scope of its claims\nFurthermore, there are plenty of reasons (and examples) where interpretation methods are demonstrated to be frail to the *input* (e.g. Ghorbani). This would likely not pass the audit but would not be evidence that the $E$ has been altered. I think this speaks to some confusion in the setup of the paper as to what “trust-worthiness” is. The authors present it as trust between the user and provider rather than trust in the robustness of the explainability metric which is, I argue, closer to what their results seem to reflect.\nAdditionally, it is not clear to me that this is the only way to test explainability metrics with limited access (e.g. data points, classifier outputs, and local explanations).  For example, these metrics are popular because they match so well to human “expert” knowledge. You show someone the pcitre of the shark from Smilkov et al and they agree that they see “shark-like” shapes in the SmoothGrad output. Consequently, one could imagine the case where sampling in a *non-local* fashion would trace whether the same features matching human “experts” appear. \nUltimately the proposed methodology seems entirely impractical (which is sort of the point).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the review and the detailed questions. In order\n\n1. As we mention in our global rebuttal, we do not believe the local loss is sufficient for preventing adversarial attacks. We rather believe that maintaining a low local loss is one of many necessary components required for a trustworthy explanation. We intentionally do not define trustworthiness, we are rather just showing that auditing one part of it can be difficult from a data perspective. \n\n2. Our scheme isn't intended to encapsulate ways to \"establish a local explainer.\" It is rather meant to reflect plausible settings where an Auditor might seek to audit explanations provided by some entity that desires to protect information about their models. \n\n3. Could you finish this question in a comment? We'd be happy to respond during the next period of the review.\n\n4-5. Thank you, we will fix these. \n\n6. This is a constant chosen simply for mathematical reasons. It is merely designed to make the algebra within our bounds to work out and is not tight (as our goal is to simply provide an asymptotical lower bound). Replacing it with a different constant would simply result in changing values of $\\epsilon$ and $\\delta$. Note that for small values of $\\lambda$ (in high dimensional data), this constant would be easily dominated by $\\lambda$. \n\n7. This is an interesting question. This would depend a lot on the manner in which the K examples are chosen. While it appears that querying samples from a single local region would allow for very quick estimation of the local loss, we believe that ensuring that these examples are \"in-distribution\" would pose a technical challenge. In particular, the auditor would have to have some notion of what constitutes a \"realistic\" example. We believe this is an interesting direction for future work.\n\nWe would additionally like to respond to some of the other points raised in the \"Weaknesses\" section. As we mention in our global rebuttal, we don't feel that our setting is too limited to bear relevance, and we also aren't quite sure what the \"linear assumption\" being referenced is. As we mentioned in answer 1 and in our global rebuttal, we do not define trust as the local loss. We rather argue that a low local loss is necessary but not sufficient for there to be trust.\n\nFinally, as we mentioned in answer 2, our paper is designed to examine a natural default way in which a set of explanations might be audited. In fact, one of the implications of our results is precisely the necessity for other methodologies.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "RMFTNfIAag", "reviewer": "Reviewer_cVCK", "summary": "The paper proposes an auditing framework to verify the truthfulness of explanations by a third-party in scenarios where there is no trust. Bounds on sample complexity are provided that depend on the locality (minimum local mass) of the explanation. Further, the authors discuss that for gradient-based explanations in higher dimensions, locality tends to be small to achieve a reasonable explanation loss. Smaller locality increases the provided bounds on the amount of data required for the audit.", "questions": "1. Do you have any guidance or suggestions on how users should choose the local error threshold, $\\gamma$? \n2. How useful are the bounds in Section 4 for reasonable values of locality and low explanation loss, such as when the decision boundary is nearly locally linear? In this case, can you provide any empirical estimates on the lower and upper bounds in Theorems 4.1 and 4.2?", "limitations": "The authors discuss the limitations of the paper with respect to the explanation algorithms.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The topic of the paper is important for policymakers and the XAI research community in general, as it suggests that in natural scenarios where there is no trust, it is difficult to verify whether the local explanation is truthful to the model without actually knowing the model. \n2. The paper provides upper and lower bounds on sample complexity for auditing local explanations. \n3. The analysis includes gradient-based explanations and discusses how to generalize to other methods, including LIME and Anchors.", "weaknesses": "1. Regarding the soundness of the auditing framework, could you please comment on the motivation for the company to provide all of the required data (especially local regions) to the auditor? When the requested dataset is sufficiently large, the third-party company could potentially recover the model along with all the classifier outputs, local regions, and other information.\n2. Figure 1 is hard to fully understand without reading the paper. It’s not intuitive which data points are explained and why, in panel (b), there is sufficient data for the audit. Could you please provide more explanation in the figure caption or simplify the figure?\n3. Section 5 and Theorem 5.1 present an existence proof. However, the example considered in Figure 2 (a) is very specific. Can you elaborate on how often you expect this data distribution to occur in real-world datasets or discuss the value/range of locality for other likely data distributions?\n\nMinor:\n1. $E(f, x_i)$ is used in Section 1 but defined in Section 2.\n2. Please specify $\\epsilon_1$, $\\epsilon_2$, $\\delta$, and $\\gamma$ in Theorem 4.2 or mention that you are operating under the same conditions as in Theorem 4.1, if applicable. Also, Algorithm 1 is referenced before it is defined.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their detailed review. We will first respond to the listed weaknesses.\n\n1. As we mention in our global rebuttal, we believe our setting reflects cases where an Auditor might have access to a set of explained cases by default. For example, applicants to a bank for loans could, in principle, pool their explanations to provide a dataset with which an Auditor could operate within our setting. We will discuss further in the final version of our paper, and will include examples of cases where our setting could plausibly apply. \n\n2. We appreciate the feedback on figure 1, we will certainly add more detail to the caption and simplify the figure by removing the green decision boundary and including enough points to visually demonstrate the concept of \"enough data for auditing.\" \n\n3. The key issue posed by Figure 2 is the curvature in the data manifold. Thus, we believe that cases with high dimensional and highly curved data manifolds would pose similar issues as the decision boundary involved would seldom be linear. A detailed empirical investigation of this is left as a direction for future work.\n\n4-5. Thank you, these will both be fixed. \n\nRegarding the direct questions:\n\n1. We believe $\\gamma$ to be largely application based, and for this reason chose to leave it as a user-specified parameter. However, one basic guiding principle might be to set $\\gamma$ similarly to the general loss of the classifier being explained. For example, it doesn't seem necessary to require local explanations with a corresponding local loss of 0.001% for a classifier with a 30% misclassification rate. \n\n2. Our local and upper bounds are designed for arbitrary, potentially complex classifiers. We chose this as the default starting point for theoretical analysis. We believe that studying more restricted cases of classifiers could be very interesting and promising. For example, we believe that ensuring a classifier satisfies some degree of smoothness (i.e. close to locally linear decision boundaries) could plausibly greatly reduce the amount of data needed for auditing.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "H0LYhm54h5", "reviewer": "Reviewer_6haQ", "summary": "This work studies an auditing framework in the eXplainable Artificial Intelligence (XAI) area. Specifically, the authors consider the scenario where a group of third-party auditors or users attempt to perform a sanity check on the provided explanations. The framework allows the auditors to query the model prediction and local explanations. Based on the proposed framework, this paper presents a theoretical analysis of the sample complexity of auditing.", "questions": "1. L51-52: Why do the authors claim LIME to be a gradient-based method?\n2. Definitions 2.1 and 2.2 are limited to black box $f:\\mathbb{R}^d\\rightarrow \\{\\pm 1\\}$. Can this constraint be relaxed to more general settings? For example, is it limited to a binary decision boundary?\n3. The main theoretical results of Theorem 4.1 have many presumptions that are not justified. For example, why is the “user-specified” local error threshold assumed to be 1/3?", "limitations": "The limitations of this work are discussed in L194-197, where the authors admit that the definition “local explanation” is narrowed down to fit a. I agree with the limitation and appreciate the authors for clearly stating this issue. However, my concern is that this can be severe and greatly undermine the application scenarios of this work. More details are in the weakness section.", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "This paper targets a very important aspect of XAI studies. It considers the deployment phase where users do not trust the provided explanations. This is a usually overlooked perspective in the XAI community.", "weaknesses": "1. This work focuses on local explanations defined in section 1.1 L48-49 and section 2.2 L155-162. These presumptions limit the scope of this paper to the surrogate model method (such as LIME, MUSE [1], etc.), where a glass-box explainer is used to approximate black box’ predictions in the neighborhood of input data. This greatly limits the impact of this work as such surrogate-model explanation methods only take a very small part of local explanation methods. Local explanations are not limited to surrogate model methods. It can refer to explanations regarding individual input samples instead of the entire data manifold or even regarding the model itself [2]. \n2. In the context of this paper, the authors claim that gradient-based explanations are surrogate model explanation methods (i.e. “local explanation method” under the definition of this paper) in L181-188. The authors define that $g_x(x) = (\\nabla_xf(x))^Tx$, which is the summation of input x gradient attributions. This corresponds to the prediction $f(x)$ only if $f$ satisfies homogeneity [3]. On the contrary, suppose $\\phi_f(x)\\in\\mathbb{R}^d$ is the explanation of SHAP, then $g_x(x):=(\\phi_f(x))^T\\mathbf{1} = f(x)$ can accurately reflects the prediction. Therefore, the definition of the explainers studied in this work is ambiguous and may require more rigorous considerations.\n\nIn summary of points 1 and 2, the formulation of the framework in this work is flawed. \n\n3. There is no empirical verification of the proposed theoretical results, which significantly undermines the contribution of the theoretical analysis. Note that a continuous function is always bounded on the closed neighborhood of x. Therefore, it is essential to empirically test whether the proposed bounds are tight. A theoretical demonstration is also appreciated.\n\n4. [minor] To stay consistent, “Lime” in L337 should be revised to “LIME”.\n\n5. While the motivation that users/auditors may not trust the explanation system and want to audit the model is an interesting and realistic setup, the proposed framework lacks practical contributions. Specifically, the formalism described in L64-66 and L236-242. can be difficult to satisfy.\n\n**Reference**\n\n[1] Lakkaraju, H., & Bastani, O. (2020, February). \" How do I fool you?\" Manipulating User Trust via Misleading Black Box Explanations. In *Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society* (pp. 79-85).\n\n[2] Adebayo, J., Gilmer, J., Muelly, M., Goodfellow, I., Hardt, M., & Kim, B. (2018). Sanity checks for saliency maps. *Advances in neural information processing systems*, *31*.\n\n[3] Hesse, R., Schaub-Meyer, S., & Roth, S. (2021). Fast axiomatic attribution for neural networks. *Advances in Neural Information Processing Systems*, *34*, 19513-19524.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their review. We will begin by addressing the listed weaknesses\n\n1. As we mention in our global rebuttal, we respectfully disagree that the considered explanations are too limited. LIME and Anchors are both reasonably utilized methods in practice, and more generally we believe our general formulation captures a meaningful subset of explanation methods. \n\n2. We will clarify further what we meant in lines 181-188 in the final paper. We never state that $g_x(x) = (\\nabla_x f(x))^t x$. We rather meant that $g_x$ should be some linear classifier that matches these coefficients. In particular, we would also fit a bias term so that $g_x$ agree with $f$ at the point $x$. Additionally, as mentioned in our global rebuttal, our framework does not consider SHAP. \n\n3. We have left an empirical validation of our results for future work. We believe that the theory provided is sufficient for meaningfully arguing the difficulties posed by local explanations that are too local. We view the results of this paper as serving as a \"theoretical demonstration.\" \n\n4. Thank you, this will be fixed.\n\n5. Could you please elaborate on what you found lacking in our framework? Additionally, what precisely about our framework can be \"difficult to satisfy.\" Please see our global rebuttal for our general argument for the utility of our framework. \n\nNext, we will address the direct questions\n\n1. We will correct this to be more precise in our general paper. While technically speaking, LIME does not use a gradient, we believe that at a high level it uses similar ideas to Gradient based methods by providing a local \"linear-like\" approximation to the general classifier. \n\n2. We believe the binary classification setting is sufficiently relevant to be independently considered. However, we note that our lower bound directly extends to more general classification settings as binary classification is a subtask of multiclass classification. We also believe that our lower bound can be relatively easily adapted to regression by simply replacing the 0-1 loss used to define the local loss with an MSE based loss. \n\n3. Could you specify specifically which assumptions are not justified? Furthermore, the user-specified threshold $\\gamma$ is not set to $\\frac{1}{3}$, it is instead assumed that $\\gamma \\leq \\frac{1}{3}$. This is an extremely mild assumption considering that a local loss above $\\frac{1}{3}$ would be considered egregiously inaccurate in most settings.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HSFh9MEtD2", "reviewer": "Reviewer_mYL9", "summary": "The paper addresses the challenges in verifying the accuracy of local explanations for machine learning models, especially when the model is not fully known and access to it is limited. The primary focus is on minimizing the number of times the model and explainer are accessed during the auditing process. The contributions of the paper are as follows:\n\n**C1. Defining Auditing of Local Explanations:** The paper provides a formal definition of what it means to audit local explanations. It sets the groundwork for systematically evaluating the reliability of these explanations, which are crucial for understanding and trusting machine learning models.\n\n**C2. Importance of the Region’s size**: It highlights that the region to which the local explainer applies is a critical property. Understanding the scope and limits of where the explanation is valid is essential for accurate auditing. This insight helps in identifying when and where an explanation might fail to represent the model correctly.\n\n**C3. Bounds on Auditing Complexity**: The paper establishes both lower and upper bounds on the sample complexity required for auditing local explanations. These bounds are presented as functions of the newly identified property, which is the region’s size. This provides a theoretical framework for understanding the minimal and maximal data requirements for effective auditing.", "questions": "See Weaknesses.", "limitations": "--", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "**S1. Framework for Auditing**: It proposes a theoretical framework for auditing local explanations, which is a significant step towards developing more rigorous and reliable methods for verifying the trustworthiness of explanations provided by machine learning models.\n\n**S2. Identification of Key Metrics**: The introduction of the explainability loss function, provides a quantifiable measure for evaluating local explanations for the original model, offering a systematic way to assess explanation quality.\n\n**S3. Highlighting the Importance of Locality**: The analysis which provide upper and lower bounds highlights the importance of the \"locality\" of explanations, bringing attention to a previously underexplored aspect in the explainability literature.", "weaknesses": "**W1. Lack of Evaluation**: The paper does not include an evaluation on real-world datasets. Although the authors suggest that their results could have significant practical implications (“Our results might have far-reaching practical consequences”), an initial step should be to perform evaluations on actual data to validate their findings.\n\n**W2. Limited Discussion with Previous Research**: The paper could benefit from a more thorough discussion of how its findings relate to and build upon previous research in the field. Specifically, the authors mentioned that [Dasgupta 2022] is the most similar to their work, except it is limited to discrete explanations rather than continuous. However, it is not clear whether, in the discrete setting, the proposed work aligns with Dasgupta’s consistency metric, sufficiency metric, or if it does not coincide with any of these previous metrics.\nIt may also be worth discussing and comparing with the recent work of [Bassan 2023], which suggests a verification method for finding minimal sufficient explanations.\n\n- Dasgupta, S., Frost, N. and Moshkovitz, M., 2022. Framework for evaluating faithfulness of local explanations. In International Conference on Machine Learning\n- Bassan, S. and Katz, G., 2023. Towards formal XAI: formally approximate minimal explanations of neural networks. In International Conference on Tools and Algorithms for the Construction and Analysis of Systems\n\n**W3. Focus on a Specific Type of Explanations**: In the paper, the presentation is a bit misleading because it suggests that explanations can be general. However, the focus is on one type of explanation – those that approximate the true model on a region of examples. This is not a general (local) explanation method, even though it includes quite a few types of explanations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their thoughtful review. We will respond to each weakness in order.\n\nW1. We agree that empirical validation is an important direction for further work, and will emphasize this in the final version of our paper. We chose to take a theoretical focus because the main result of our work is a lower bound that applies to any algorithm. \n\nW2. We thank the reviewer for the added reference, and will include a more detailed comparison with prior works in the final version of our paper. With regards to Dasgupta et. al., it is indeed correct that the notion of \"local consitency\" (Definition 1) provided in their paper precisely matches our notion of \"local loss\" (Definition 2.3) when the region they define, $C_\\pi$, is construed as a local explanation region. However, a key difference with their work is that ours provides lower bounds on the amount of data needed to estimate the local loss (over the entire distribution), and this result is the main point of our paper.\n\nWith regards to Bassan and Katz, we agree that their work provides an interesting idea for provably correct local explanations (thus, in some cases, circumventing the need for an audit). By contrast, the results in our work are designed to apply to any local explanation scheme. \n\nW3. We agree that our work is limited to a certain type of \"local explanation\" and doesn't encapsulate explanation methods such as SHAP.  As we explained in our general rebuttal, we will make sure to carefully outline the scope of our paper in the final version. We will also emphasize in the final paper that studying other types of local explanation methods is an important and interesting direction for future work.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their detailed and thoughtful reviews. It appears that there are 3 main points of contention regarding our paper. First, that the set of "local explanations" being considered is either too limited or not carefully enough analyzed, second, that the local loss is not a good indicator of a model's trustworthiness, and third, that the mode of limited interaction between the auditor and the explanation provider is not sufficiently realistic. We will address these three points separately.

We define a local explanation broadly as a local classifier coupled with a local region. We will further clarify in our paper that this does NOT include "local" methods such as SHAP (in which no local region is provided). However, this definition does include LIME, Anchors, and certain kinds of gradient based methods (where a gradient implies that a linear classifier is implicitly being used). We believe that these listed methods are sufficiently used by practitioners to be worth consideration. While our work only considers linear and constant local classifiers, we believe this to be a strength rather than weakness as our work is centered on providing a lower bound for auditing (which means our bounds will carry over to more complex classes of local classifiers as well). 

With regards to the local loss, we will further clarify (as we did in line 55 of our paper) that maintaining a low local loss is a necessary but not sufficient condition for being a trustworthy explanation. We completely agree that a low local loss does not imply that an explanation is trustworthy. We are rather claiming that it is self evident that explanations with a large local loss are intrinsically meaningless and untrustworthy. Because of this, our auditing framework encapsulates one necessary component that any auditing framework most address, and this means our lower bound has implications beyond our setting. In particular, circumventing the difficulties posed by our lower bound must require one of our assumptions to be broken which would require either further access for the auditor, or a different kind of explanation being provided. 

Finally, our mode of interaction between the explainer and the auditor is inspired by cases of collective action. In principle, we believe that an auditor could obtain a sample of explanations by aggregating outputs provided across a large sample of users. For example, in the case where a bank provides local explanations for loan approvals to applicants, an auditor could (with proper consent) aggregate the explanations provided for a sample of applicants and audit the bank. Note that this would not require any further information from the bank beyond the explanations it is already required to provide.

Meta-review: The paper provides valuable insights into the challenges of auditing local explanations and establishes a foundation for future work in this area, and I thus recommend accepting it. 
The authors' rebuttal was appreciated by the reviewers. They acknowledged the need for empirical validation but argued that such validation is challenging given the generality of their theoretical results -- please make sure to discuss this aspect in your final version, should the paper make the cut.  Please also make sure to improve the discussion of related work and to clarify the scope of your study.
Decision: Accept (poster)