Denoising Diffusion Path: Attribution Noise Reduction with An Auxiliary Diffusion Model
Authors: Yiming Lei
Zilong Li
Junping Zhang
Hongming Shan
Venue: NeurIPS 2024 poster (2024)
Keywords: Diffusion Models
Interpretability
Integrated Gradients
Path Integration
Primary area: interpretability_and_explainability
TL;DR: Constructing a denoising path integration for attribution of deep neural networks by applying diffusion models, showcasing significant noise reduction in attribution maps and higher AUC values.

Abstract: The explainability of deep neural networks (DNNs) is critical for trust and reliability in AI systems. Path-based attribution methods, such as integrated gradients (IG), aim to explain predictions by accumulating gradients along a path from a baseline to the target image. However, noise accumulated during this process can significantly distort the explanation. While existing methods primarily concentrate on finding alternative paths to circumvent noise, they overlook a critical issue: intermediate-step images frequently diverge from the distribution of training data, further intensifying the impact of noise. This work presents a novel Denoising Diffusion Path (DDPath) to tackle this challenge by harnessing the power of diffusionmodels for denoising. By exploiting the inherent ability of diffusion models to progressively remove noise from an image, DDPath constructs a piece-wise linear path. Each segment of this path ensures that samples drawn from a Gaussian distribution are centered around the target image. This approach facilitates a gradual reduction of noise along the path. We further demonstrate that DDPath adheres to essential axiomatic properties for attribution methods and can be seamlessly integrated with existing methods such as IG. Extensive experimental results demonstrate that DDPath can significantly reduce noise in the attributions—resulting in clearer explanations—and achieves better quantitative results than traditional path-based methods.

Denoising Diffusion Path: Attribution Noise Reduction with An Auxiliary Diffusion Model
Yiming Lei', Zilong Li', Junping Zhang', Hongming Shan
Shanghai Key Laboratory of Intelligent Information Processing,
School of Computer Science, Fudan University Institute of Science and Technology for Brain-Inspired Intelligence &
MOE Key Laboratory of Computational Neuroscience and Brain- Insii-ed Intelligence & MOE Frontiers Center for Brain Science, Fudan University {ymlei, hmshan @fudan. edu. cn
Abstract
The explainability of deep neural networks (DNNs) is critical for trust and relia- bility in Al systems. Path-based attribution methods, such as integrated gradients (IG), aim explain predictions by accumulating gradients along path from a baseline to the target image. However, noise accumulated during this process can significantly distort the explanation. While existing methods primarily concentrate on finding alternative paths to circumvent noise, they overlook a critical issue: intermediate-stee step images frequently diverge from the distribution of training data, further intensifying the impact of noise. This work presents a novel Denoising Dif- fusion Path (DDPath) tackle this challenge by harnessing the power of diffusion models for denoising. By exploiting the inherent ability of diffusion models to progressively remove noise from image, DDPath constructs piece-wise linear path. Fach segment of this path ensures that samples drawn from a Gaussian distri- bution are centered around the target image. This approach facilitates gradual reduction of noise along the path. We further demonstrate that DDPath adheres essential axiomatic properties for attribution methods and can be seamlessly integrated with existing methods such as IG. Extensive experimental results demon- strate that DDPath can significantly reduce noise in the attributions resulting in clearer explanations and achieves better quantitative results than traditional path- path-based methods.
Introduction
Deep neural networks (DNNs) have achieved remarkable success in various tasks, but their opaque decision-making processes remain significant challenge and are critical to those high-staking scenarios like medical diagnosis [i] and autonomous driving [2]. Explainable Artificial Intelligence (XAI) aims to bridge this gap by providing insights into how DNNs make their predictions, where the commonly used interpretation methods include class activation mapping (CAM)-based [3,4, 5, 6, 7] and path-based methods [8, 9, 10, 11, 12].
Theoretically, the path-based methods comply with the rigorous axiomatic properties, such as the im- symmetry--reserrvngg
plementation invariance and symmetry- preserving [8], contributing significantly to the interpretation field, and we also focus on this kind of technique. Path-based attribution methods, such integrated gradients (IG) [8] that is based on game-theoree thhe--the idea [13], offer valuable tool for XAI by accumu- lating gradients along path from baseline image the target image being explained. However,
Corresponding author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

P2
P
P3
x/
z0
0
0
t/T
Steo
(a) Traditional path
(b) Denoising diflusion path
(c) Soltmax prediction slong the path
Motivation illustration of DDPath. The symbol x' denotes the baseline image and æ the target image. (a) The existing paths are irrelevant to data distributions. (b) The proposed denoising diffusion path approaches the distribution of real data. (c) Traditional IG [8] and SmoothGrad [9] struggle to maintain a continuously increasing Softmax probability along the integration path. This behavior can be counterintuitive and contradict human cognition, where the confidence in prediction should generally rise as evidence accumulates. In contrast, the proposed DDPath achieves a more natural behavior by ensuring continuously increasing Softmax probability along the path, even if the path itself exhibits fluctuations.
Figure 1:
these methods suffer from a crucial limitation: noise accumulation along the path. This noise can significantly distort the explanation, making it difficult to identify the features truly contributing to the DNN's decision.
Existing approaches primarily focus on finding alternative paths to bypass noise regions. SmoothGrad progressively added noise the image and achieved the effect of noise reduction, and the authors have verified that adding noise can help reduce noise during inference [9]. Blur IG successively
blurred the input image with the Gaussian kernels that varied along the path [10]. Blur IG does not require a pre-defined "baseline" image which is critical to the original IG [8]. Guided IG is general concept, i.e., a superset of path methods, which avoids the unrelated regions with high gradients by minimizing the attributions at every feature (or pixel) across this superset [11]. While the above alternatives can be beneficial, they neglect an essential issue: during the path construction, the intermediate-sto independent the input image, resulting in them deviating significantly from the data distribution the DNN was trained on. This distribution shift further amplifies noise and hinders interpretabilityy
images were modified manually by operations like noising or blurring, i.e.,
In this paper, we intend reduce explanation noise for path methods from a new perspective: the explanation noise stems from the distribution shift of intermediate-step images when calculating their gradients along the path, because the shifted images offer biased predictions for pre-trained classification model (Fig. I(c)), then influence the attributions. Hence, it is necessary to make the distributions of intermediate-ster images closer that of the original input image, so that the gradients back- proopprppggtted from accurate predictions are more relative to classes. As shown in Fig. (a)) the traditional paths Pi, Pz. and P3 are independent of the input distribution even though they have the same starting point and the endpoint. Therefore, we aim to develop a path that simultaneously approaches the real data and implies progressive noise reduction.
Inspired by the recently advanced diffusion models, which progressively add noise in the forward process and denoising during the reverse sampling process [14, 15, 16]. is natural to correlate the reverse denoising process with the attribution path. On the other hand, the reverse process can recover the images that comply with the original data distribution despite the noisy intermediates. To this end, we propose a Denoising Diffusion Path (DDPath) for the attribution of deep neural networks. First, we define a novel denoising diffusion path that aligns the attribution path with the reverse sampling process by scaling the sampling steps. This enables the attribution path to incorporate the ability of generative modeling of diffusion models and the resultant intermediate-step images possess the approximated distributions with that of a classification model. Similar to existing path methods, the DDPath also approximated by Riemann approximation [8, 12]. Furthermore, we demonstrate that the DDPath satisfics the corresponding axioms. Second, the DDPath can be easily combined

---

with previous path methods and we developed the DDPath-IG, 3DPath-BlurIC, and DDPath-GIG. In practice, we apply the pre-trained glassifier-guided diffusion model to construct the DDPath [16]. Note that we do not attempt to investigate many advanced diffusion models in this paper, we pay more attention to exploring the reverse diffusion process to work with DNN attribution, which has not been discussed in previous attribution studies.
Contributions. We summarize the main contributions of this paper as follows. (i) We propose a novel Denoising Diffusion Path (DDPath) for DNNs attribution. (it) DDPath is theoretically compatible with current path-based methods, and we develop DDPath-IG, DDPath-GIG counterparts enhancing the baseline methods. (iii) DDPath can be easily implemented by applying a pre-trained classifier- -urided diffusion model. (iv) Experimental results demonstrate the effectiveness of DDPath on both qualitative saliency maps and quantitative evaluations of insertion and deletion scores and accuracy information curves (AIC) [17, 12].
and
2 Related Work
tradient-based attribution. Integrated gradients (IG) [8] is designed to address the shortcomings of traditional saliency maps. By integrating gradients along straight-line path from baseline image to the target image, IG adheres to the sensitivity axiom and implementation invariance axiom. This property guarantees that the generated explanations are interpretable and consistent. While IG has been significant advancement in XAI, subsequent research has focused on further improving its performance and addressing its limitations. Boundary-baac -based integrated gradient [18] enhances precision with a boundary search mechanism and better baseline selection, while adversarial gradient integration (AGI) seeks higher accuracy through non-linear ascending trajectories [19]. However, AGI relies heavily on the quality of adversarial samples. Efforts like guided integrated gradients (GIG) address noise in the IG path, but GIG suffers from computational cost and limitations to image data [1]]. Similarly, Fast-IG [20] and expected gradient (EG) [21] face limitations in efficiency or dependence on input features. These shortcomings in existing gradient-based methods motivate our work on DDPath. DDPath aims to provide cleaner and more interpretable attributions by tackling noise accumulation along the integration path. DDPath is designed to realize the progressive emergence of the image signal and gradual noise reduction along the path.
Classifier-guided diffusion models. Recent advanced diffusion models like score-based diffusion models [22] and denoising diffusion probabilistic models (DDPMs) [14] have greatly facilitated the progress of generative modeling tasks. Of particular relevance to our work is the concept of classifier-guided diffusion models introduced by Ho el al. [23]. This framework guides the diffusion process using a pre-trained classifier, essentially learning to "reverse" the noise addition and correctly reach an input the classifier recognizes. This establishes a crucial link between diffusion models and classification tasks, paving the way for their application in interpretability, which is precisely the focus of DDPath. By leveraging this concept, DDPath benefits from the model's ability to progressively remove noise. This denoising capability directly tackles the challenge of noise accumulation in the attribution path, leading to cleaner and more interpretable explanations. Notably, explicitly constructing an attribution path with diffusion models has not been discussed in current attribution studies.
Preliminary
Before introducing our DDPath, we recall the path-based attribution framework and the corresponding axioms to be satisfied.
Integrated gradients (IG) [8] is pioneer work for deep visual model attribution with complete axiomatic properties, resulting in enormous axiomatic-basse attribution methods. Assume that the F deep neural network to be explained, IG accumulates gradients along a linear path (G((a) = x' + aax - x') via path integration:
A = /''
OF(1 1G (a)) (a)
da.
(I)
on.0 (a)
da
3

---

Denoising Diffusion Path
2b (x) mo)
Ø7-2
TT-1
2T
Po me)
py (2(22)))
N ((uo(m)), Eo(z)))
Eo(m:))
N ((u Ee(er)
Parameter frozen
Pre-trained diffusion model
Classifier guidance
Figure 2: Illustration of DDPath. At each step in the DDPath, the images are sampled from pre-trained diffusion model guided by classifier Φb
Current approaches focus on finding a better path, ie., @r((a) Da ignoring the intermediate points
af(r(a)) that is referred to as the inherent distribution shifts. On the other hand, an appropriate 0x((a))
baseline essential to traditional path-based attribution methods. The black baseline (or black image) suits IG better than a noise baseline, and this also causes difficulty in attributing black or dark regions of interest. Andrei et al. addressed this obstacle by applying both black and white baselines [17]. Hence, these manually designed baselines have their own biases. In this paper, the proposed DDPath simply work with noise baseline with which existing methods cannot work well.
The sensitivity axiom dictates that if single feature changes between a baseline and target image while causing different predictions, the attribution method must assign non-zero attribution score to the differing feature. Otherwise, the attribution method might be insensitive to crucial changes.
Sensitivity.
Implementation invariance. An attribution method follows the implementation invariance prin- ciple when, for the same pair of input data and predicted output, regardless of the specific neural network architecture or implementation details, the attribution scores remain consistent.
Denoising Diffusion Path
For the target image æ and a baseline x', traditional attribution mainly considers - 2//, i.e. the differences between the i-th feature of the image and baseline, measuring how the classification model can behave with the gradual appearance of the i-th feature. In our diffusion path, such differences turned to the gradual appearance of images while the disappearance of noises, there are no direct relationships between intermediate steps and the original noisy baseline in that the sampling of the reverse diffusion process generates these intermediate images. It is practically implemented with Riemann approximation that will be discussed in Sec. 4.3.
Definition 1. (Denoising Diffusionn Path or DDPath) This path is a piece-wise linear function [24, 25} built upon the reversely sampled sequence with maximum step number T: .T. Lt, 2t-1,..... Bo. which is defined as
7(a) = aæa, Ea ~ Na Na(Ha E.
(2)
where ÆT is the noisy signal baseline and To is the finally sampled image, each piece No (aaa()) , E. (æ)) is a set of samples complied with a Gaussian distribution with mean and variance concerning the target image æ. The diffusion sample step t is aligned with the path coefficient by setting a = E [0.
Theoretically, DDPath is also a type of definition in terms of set of all possible paths, which is similar the adaptive path GuidedIG [11] and Shapley values [26]. That say, for each loop from the baseline to the target image, the path is composed of sampled images from every piece Na (pt (ar), E, (ar)). For the rest of this paper, the 7(x)) denotes the proposed DDPath without specific statement.

---

4.1 Attribution with DDPath
Based on Definition I, we discuss how to attribute along the DDPath. Specifically, we showcase that DDPath-IG, @DPath-BlurIG, and DDPath-Guidedee enhance the corresponding baseline methods. First, for the DDPath-IG, we can directly replace the linear path in Eq. (1) with the DDPath:
Definition 2. (DDPath-IG) Given a diffusion model Eg pre-trained using classifier guidance, fo is the corresponding pre-trained classifier, for the i-th feature in the input of class y, its attribution is the integrated gradients along the DDPath:
f (F()((a) dr((a) da, 7(0) odaa Da ~ Na(ooo()), Eo(x)), (3)
DDPath-IG & A.
a= dr:(a) da
the (a((o()), Eo(x)) denotes the distribution parameterized by the diffusion model Eg, and po( = p. po(z) + k EV., log (o(y)aa)) The p and are scaling factors controlling the mean and the gradient term variation.
critical problem of sampling with the diffusion model is that the generated images are diverse when sampling from the noise signals. In DDPath-IG, the sampling centered at the target image, i.e., the mean and variance are calculated by the original image æ. We use the same sampling strategy for the following DDPath-Blute and DDPath -IG.
solve this obstacle by simply enforeing
Definition (DDPath-BlurIG) Given the Gaussian kernels along the path parameter a, Lix y, v,a))
En=-oo Le +242² (aa) m, - m-), then the attribution of the i-th feature obtained
Em= by:
xa
T ÖF(L(x, v,) 0L az) Ote DDPahh-luriG A A Σ DIx.y,o.)
dog T
where the t is the number of steps in the Riemann approximation, and t- T [10].
DDPath-BB Blurh- applies the DDPath and blurs the sampled images along the denoising path. That is to say, it scales the spaces of all sampled pieces in Definition while preserving the data distributions within pieces to approach the real data distribution in Fig. 1.
Definition 4. (DDPath-GG) Given an IG path 70 (a) [8] and a DDPath 7(a), the objective of DDPah-GIG defined as:
OF(r(a)) dr((a) da da + A ''' (n((a) -G((o) da, (5)
DDPath-GIG & arg min
@x((a))
where À is the coefficient that balances the two terms, N is the number of features (or pixels), and T contains all possible paths of DDPath.
In Definition 4, the traditional path is replaced with our DDPath, and in practice, the is implemented by repeating random sampling loops. Therefore, the first term of Eq. (5) aims to find a better denoising path ((a) that avoids those regions causing noisy explanations, and the second term ensures the diffusion path does not deviate severely off the shortest path, decreasing the likelihood of crossing areas that are too out-of-distribution.
4.2 Axiomatic Properties of DDPath-IG
In this section, taking DDPath-IG as an example, we show that it satisfies the axiomatic properties in [8]. First, the DDPath-IG satisfies the sensitivity that the image differs from the noisy baseline, and then the partial derivatives of differing features are non-zero. Second, the DDPath agnostic to the architecture of DNNs so that the DDPath-IG also satisfies the completeness that Σ A; F(x)) - F(x') [27, 28, 8]. Third, the calculation partial derivatives DDPath-IG follows the chain rule so that the attributions are invariant to network implementations, therefore the DDPath-IG satisfies the implementation invariance. Fourth, recall that the IG is the unique path method that symmetry-preserving (Theorem in [8]), the DDPath-IG also maintains this property.
5

---

Algorithm Algorithm of DDPath-IG.
Require: Target image and its label y, the initial noisy baseline x' randomly sampled from Gaussian; target model F(-), diffusion trained classifier has the diffusion model Eg, total number of step T.
Return: Attribution for the target image æ: A + 0t= 9t-
1: for = 0 to T do
2:
t ===00 then
3:
Ct x²'
Noise baseline
4:
else
5:
3t x²d
P Sampled image in t step
6:
end if
7:
p
1 t.
Scaling coefficients b Update sampling mean Sampling b Calculate gradients
8:
Ho (2:) = p ( - VVa log (o
9:
x/ (i(ūg(()) Ez()))
((F())))
10: 9t del
11: end for
4.3 Implementation with Cluidede Diffusion Sampling
To ensure clarity, we reiterate that this paper concentrates on establishing a correlation between the attribution path and the reverse diffusion process. Specifically, we implement the DDPath-IG with pre- pre-trained diffusion model trained with classifier guidance [16]. The algorithm of DDPath-IG is shown in Algorithm and the algorithms of DDPath DDPath-BlurIG BlurIG and DDPath-Gii are provided in the Appendix. The implementation of the integral is also approximated by the Riemman approximation, taking DDPath-IG as an example:
(F(x:) t dx.
A lim
T .t.
(6)
For the classifier-guided diffusion sampling in [16], the sampling mean (0o(2) / VEV,,, m. log (v(()),) scales the classifier gradient term with that corresponds to the sampling steps f. However, in this work, the proposed denoising path should guarantee consistency between the baseline and the target image. Therefore, in Definition 2, the sampling mean is centered at the image æ while the classifier gradients are calculated via step-wise intermediate images Tt, and we simple scaling scheme with p and
f T
K= T
This scheme is reasonable in that at the very beginning of sampling, we not expect the mean to shift severely ensuring less data distribution shift. For the variance term, the gradients Va, are noisy because of the inaccurate predictions at initial steps. With the increase of t, more accurate gradients can be obtained by more correct predictions. Hence, the sampling means (a)(x) become mainly dominated by this gradient step-wise inputs, demonstrating that the DDPath progressively enables the increasing prediction scores preserving data distribution along the path.
5
Experiments
5.1
Experimental Setup
Datasets.
Following previous studies [10, 11. 12], we evaluate the effectiveness of DDPath on the validation set of ImageNet-IK [30] that contains 50, 000 images of 000 classes. Furthermore, we conducted pointing game experiment on MS COCO validation set [31].
Models and basclines. For the classification model, we use ResNet-50 [32] and VGG-16/-19 [29] as backbone. The baseline attribution methods are Guided-BP [33], IG [8], Smooth IG [9]. Blur IG [10], and Guided IG [11]. All the experiments are implemented by PyTorch [34] and conducted on an NVIDIA A100 GPU. The number of sampling steps for DDPath methods is 250.

---

IG
SmoothGrad
Insertion
Delction
K::
SmoothGred: 12.57
SmeothGradi 0.33
Blur 21.48
0.6
Bluric; 0.33
20.28
0.5
DDPatr NS: 28.35
DDPath- 0.48
GIG
BlurGG
DDPath-IG
0.4
0.3
0.0
0.0
1.0
1.0
IG
SmoothGrad
1.0
Insertion Curve
0.8
Deletion Curve
G 2.6
0.7
Bluris:
IG: 46
GiC:
0.6
SmoothGrad
0.5
Blunti: 41.33
0.4
GIG
BluriG
DDPath-IG
GIG: 44.32
DDPath-IG: 65
0.2
0.1
0.0-
0.0
0.2
0.4
6
0.8
10
0.0
02
0.4
0.6
0.8
1.0
IG
SmoothGrad
1.0
G: 13.69
SmoothGrad: 12.1
0.8
Bluric:
GK:: 12.55
SmoothGrad 56 01
DDPath IG: 10.7
Blurfs: 58.72
GIG
BlurIG
DDPath IG
0.4
0.4
DDPath-iG: 62 08
0.0
0.0-
Figure 3: Comparison of saliency maps and corresponding Insertion and Deletion curves. Image examples are selected from the ImageNet- 1k validation set. The classification model is the pre-trained VGG-19 [29].
5.2 Interpretation Ability
Following previous DNN interpretation works [35, 36), compare the Insertion and Deletion scores and provide the corresponding curves and the saliency maps in Fig. 3. The insertion process starts with blurred image, and then iteratively injects original image information (3.6% of total pixels) into the blurred version, guided by the saliency map values. Regions with higher saliency scores are prioritized for insertion, gradually revealing the informative parts of the original image and leading to its full reconstruction. Conversely, deletion identifies relevant pixels (3.6%) in the blurred image based the saliency map and replaces them with their corresponding values from the original image. This process essentially "unmasks" the informative regions by strategically replacing noise with the original content. In Fig. 3, we can see that the DDPath-IG captures more comprehensive information and more details of the object, e.g., the birds' wings and lobster feet. For the insertion and deletion curves, the DDPath achieves better quantitative insertion AUC values, indicating the image information progressively injected is more important. Although DDPath does not obtain the best deletion AUCs, this is trivial significant improvement on Insertion and better saliency maps. More saliency maps are provided in Figs. 6 and in Appendix.
5.3 Length of Path
In this section, we investigate the path length (or sampling steps for DDPath). Fig. shows the saliency maps of different methods increased steps. With the path length increase, baseline

---

Table 1: Quantitative comparisons of different interpretation methods on ImageNet validation set in terms of Insertion and Deletion. Overall Insertion Deletion.
Guided BP
Smooth Grad
DDPath -BlurIG
DDPath -GIG
DDPath
Model
Metric
BlurIG
GIG
-IG
Insertion
21.2
21.7
20.9
19.2
22.3
21.2
23.5
25.9
VGG-16
Deletion,
15.4
14.8
15.0
13.3
13.5
14.1
13.8
12.7
Overall
5.8
6.9
5.9
5.9
8.8
7.1
9.7
13.2
Insertion
21.8
21.1
20.6
24.1
25.6
27.8
VGG-19
Deletion!
14.0
13.5
13.8
13.2
14.0
12.4
12.3
12.1
Overall
7.8
9.7
7.3
7.4
10.1
10.0
13.3
15.7
Insertion
32.2
33.8
32.5
25.6
27.8
36.4
38.9
45.1
ResNet-50
Deletion
13.8
13.5
12.8
12.4
12.5
12.0
12.7
Overall
18.4
20.3
18.3
12.8
15.4
23.9
26,9
32.4
GIG
DDPath-IG
Step:
Figure 4: Comparison saliency maps and corresponding Insertion and Deletion curves obtained by different methods. Image examples are selected from the ImageNet-IK lk validation set. The classification model is the pre-trained VGG-19 [29].
methods are difficult to obtain interpretation performance gains further while achieving attribution noise reduction. Although they achieve considerable saliency maps at early steps, they still exhibit weaker noise reduction effect. IG exhibits little variances on saliency maps which is caused by linear path. GIG tends to find an adaptive path resulting less structural consistency along the whole path. The DDPath-IG provides with a consistent emergence of the salient regions while preserving consistent structures of the object. From the curves at the right part in Fig. 4, we can see that DDPath performs worse the carly stages, and it obtains more improvements by increasing the path length, however, the baselines gain less.
5.4 Pointing Game COCO
To evaluate the effectiveness of DDPath in pinpointing the most salient pixels, we conducted "pointing game" on the MS COCO 2017 validation set. This approach, similar to those used in Score-
Hits CAM [6] and Group-CAM [7], assesses localization accuracy. We calculated the metric Hits Missus quantify how well the identified salient pixels coincided with the annotated bounding boxes in the data, where the "Hits" counts the number of the most salient pixels that fall in the bounding box, and "Misses" otherwise. Higher scores indicate that DDPath excels at highlighting the most relevant image regions for the model's prediction. In Table 2. the DDPath counterparts consistently outperform baseline methods, and we argue that this is severely caused by noisy salient pixels shifted away from the target objects, i.e., out of the bounding box. For example, in Fig. 3, the GIG of the first case, GIG and BlurIG the second case, and SmoothGrad in the third case. Therefore, the DDPath not only reduces those noises but also avoids the incorrect salient pixels.

---

Table 2: Pointing game evaluation on MS COCO 2017
validation set.
Model
IG
DDPath-IG
BlurIG
DDPath-BlurG
GIG
DDPath-GIC
VGG-16
42.3
44.7
45.0
47.2
45.2
46.3
VGG-19
43.4
45.2
45.3
48.9
44.9
47.1
ResNet-50
45.2
46.9
46.6
50.0
47.2
50.5
5.5 Ablation Study
Scaling scheme. First, we discuss the scaling scheme defined in Eq. (7). The above experiments involving DDPath used = T, T tains stably decreased weight for sampling mean. Here, we reverse such scaling as = $. K = - & to enable a smaller mean and larger variance at the initial steps. In Table 3, we compare the two scaling schemes in terms of Insertion (Ins.), Deletion (Del.), and ac- curacy information curves (AIC) [17, 11]. We can see that the Reverse setting performs worse than the Default, demonstrating that sampling with smaller mean and a larger variance at early steps is inferior in preserving information from the input image. Com- pared with the baseline methods, the DDPath with Reverse scaling performs better in AIC and Insertion, showing the considerable effect of avoiding distri- bution shift with DDPath. However, DDPath with Reverse scaling achieves higher deletion values, and we claim that this is due to the larger initial variance the whole image,
L by default, which main-
Dafach
Dafa.lt
Figure 5: Saliency maps by different scaling schemes.
caused edge detection effect which compromises the target object. In Fig. 5, the Reverse results highlight more noises and more edges, neglecting the inner regions of the objects.
Attribution with noise. Here, compare the manually adding noise with DDPath. In Table 4, we implement Noise counterparts for IG, BlurIG, and GIG. SmoothGrad also a method of constructing a noisy path. Compared with Table 1, IG-Noise, BlurIG-Noise, and BlG-Noise obtain slight improvements against the vanilla versions in terms of AIC and Insertion, but they are still inferior to DDPath versions. This verifies that the DDPath enables better noise reduction and accurate predictions for the points on the path.
Table 3: Ablation on Scaling Scheme.
Method
Scaling
AIC
Ins.
Del.
Table 4: Comparison of Adding Noise.
IG
15.3
23.3
13.5
Default
18.9
27.8
12.1
Method
AIC
Ins.1
Del.j
DDPath-IG
Reverse
16.2
24.8
14.5
IG-Noise
15.8
23.5
13.3
BlurIG
20.4
20.6
13.2
BlurIG-Noisc
21.5
20.6
13.6
Default
24.5
24.1
14.0
DDPath-BluriG
GIG-Noise
14.3
21.0
12.5
Reverse
20.2
21.9
14.3
SmoothGrad
16.6
21.1
13.8
GIG
15.0
22.4
12.4
Default
19.7
25.6
12.3
DDPath-GIG
Reverse
17.7
24.5
13.2
6 Conclusion
This paper introduces the Denoising Diffusion Path (DDPath). novel approach for mitigating noise accumulation path-based attribution methods. DDPath leverages the power of diffusion models to construct a path where noise is progressively removed, leading to significantly cleaner and more interpretable attributions. We demonstrate that DDPath adheres to essential axiomatic properties and integrates scamlessly with existing methods like Integrated Gradients, requiring only

---

pre-trained classifier- classifier-uiiedd diffusion model. Extensive evaluations showcase the superiority of DDPath compared to traditional path-bat bash-based methods, achieving explanations with less noise and better alignment with the DNN's decision-making process.
Broader impact and limitation. This paper brought new insights into the attribution of DNNs with simple implementations, i.e., classifier-guided diffusion, and it will trigger more related research in this direction by applying more advanced diffusion models. Moreover, it also provides a possible way of investigating the knowledge of large language models via diffusion models realize the true vision-language consistent explanations. A key limitation of DDPath is that it requires longer path (more sampling steps) than current methods.
Acknowledgements
This work was supported in part by National Natural Science Foundation of China (Nos. 62306075, 62101136, 62471148, and 62176059), and China Postdoctoral Science Foundation (No. 2022TQ0069).
References
[1]
Long Chen, Shaobo Lin, Xiankai Lu, Dongpu Cao, Hangbin Wu, Chi Guo, Chun Liu, and Fei- Wang. Deep neural network based vehicle and pedestrian detection for autonomous driving: A survey. IEEF Transactions on Intelligent Transportation Systems, 2234):33343224, 2021.
[2] António H Ribeiro, Manoel Horta Ribeiro, Gabriela MM Paixão, Derick M Oliveira, Paulo R Gomes, Jéssica Canazart, Milton PS Ferreira, Carl R Andersson, Peter W Macfarlane, Wagner Meira et al. Automatic diagnosis of the 12-lead ecg using a deep neural network. Nature communications, 11(1):1760, 2020.
[3] Bolei Zhou, Aditya Khosla, Agata Lapedriza, Aude Oliva, and Antonio Torralba. Learning deep features for discriminative localization. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pages 2921-2929, 2016.
[4] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-CAM: Visual explanations from deep networks via gradient- based localization. In Proceedings of the IEEE International Conference on Computer Vision, pages 61 2-66,6,,220 2017.
[5] Aditya Chattopadhay, Anirban Sarkar, Prantik Howlader, and Vineeth N Balasubramanian. Grad-CAM++: Generalized gradient-based visual explanations for deep convolutional networks. In 2018 IEEE winter Conference on Applications of Computer Vision, pages 339-847,4 2018.
[6] Haofan Wang, Zifan Wang, Mengnan Du, Fan Yang. Zijian Zhang, Sirui Ding, Piotr Mardziel, and Xia Hu. Score-CAM: Score-weighted visual explanations for convolutional neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and pattern Recognition Workshops, pages 24 25, 2020.
[7] Qinglong Zhang, Lu Rao, and Yubin Yang. Group-CAM: Group score- weighted visual explana- tions for deep convolutional networks. arXiv preprint arXiv:2103.13859, 2021.
[8] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In International Conference Machine Learning. pages 3319-3328, 3328, 2017.
[9] Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenberg. Smooth- grad: removing noise by adding noise. arXiv preprint arXiv:1706.0382 2017.
[10] Shawn Xu, Subhashini Vemugopalan, and Mukund Sundararajan. Attribution in scale and space. In Proceedings of the JEEE//VF Conference on Computer Vision and Pattern Recognition, pages 9680-9689, 2020.
10

---

[11] Andrei Kapishnikov, Subhashini Venugopalan, Besim Avci, Ben Wedin, Michael Terry, and Tolga Bolukbasi. Guided integrated gradients: An adaptive path method for removing noise. In Proceedings of the IEEE/CVF Conference on Computer Vision and pattern Recognition, pages 5050-5058, 2021.
[12] Ruo Yang. Binghui Wang, and Mustafa Bilgic. IDGI: A framework to eliminate explanation noise from integrated gradients. Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, 2023.
[13] LS Shapley RJ Aumann. Values of non-atomic games. 1975.
[14] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-688 68500, 2020.
[15] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2020.
[16] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 14:8780-8794 2021.
[17] Andrei Kapishnikov, Tolga Bolukbasi, Fernanda Viégas, and Michael Terry. XRAI: Better attributions through regions. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4948-4957, 2019,
[18] Zifan Wang, Matt Fredrikson. and Anupam Datta. Robust models are more interpretable because attributions look normal. Proceedings of Machine Learning Research, 162, 2022.
[19] Deng Pan, Xin Li, and Dongxiao Zhu. Explaining deep neural network models with adversarial gradient integration. In Thirtieth International Joint Conference on Artificial Intelligence (IJCAI), 2021.
[20] Robin Hesse, Simone Schaub-Meyer, and Stefan Roth. Fast axiomatic attribution for neural networks. Advances in Neural Information Processing Systems, 34: 19513-95244, 2021.
[21] Gabriel Frion, Joseph D) Janizek, Pascal Sturmfels, Scott M Lundberg, and Su-In Lee. Improving performance of deep learning models with axiomatic attribution priors and expected gradients. Nature machine intelligence, 3(7):620-63) 2021.
[22] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2020.
[23] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
[24] Daniel D Lundstrom, Tianjian Huang, and Meisam Razaviyayn. A rigorous study of integrated gradients method and extensions to internal neuron attributions. In International Conference on Machine Learning, pages 14485-14508, 2022.
[25] Naveed Akhtar and Mohammad AAK Jalwana. Towards credible visual model interpretation with path attribution. In International Conference on Machine Learning, pages 457, 2023.
[26] Lloyd S Shapley et al. A value for n-person games. 1953.
[27] Alexander Binder, Grégoire Montavon, Sebastian Lapuschkin, Klaus Robert Müller, and Woj- ciech Samek. Layer-wise relevance propagation for neural networks with local renormalization layers. In 25th International Conference on Artificial Neural Networks and Machine Learning, ICANN 2016, pages 63-71, 2016.
[28] Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Learning important features through propagating activation differrnnces. In International conference machine learning, pages 3 3145-3153, 2017.
[29] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.15580 2014.

---

[30] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, 115:211-252, 2015.
[31] Tsung-Yi Yi Lin, Michael Maire, Serge J. Belongie, Lubomir D. Bourdev, Ross B. Girshick, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll' I, and C. Lawrence Zitnick. Microsoft COCO: common objects in context. CoRR, abs/1405. 50.02.22.,, 2014.
[32] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and paltern recognition, pages 770-778, 2016.
[33] Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin Riedmiller. Striving for simplicity: The all convolutional net. International Conference on Learning Representations, 2015.
[34] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019.
[35] Vitali Petsiuk, Abir Das, and Kate Saenko. RISE: Randomized input sampling for explanation of black-box models. In British Machine Vision Conference, page 151, 2018.
[36] Yiming Lei, Zilong Li, Yangyang Li, Junping Zhang, and Hongming Shan. Lico: explainable models with language-image consistency, Advances Neural Information Processing Systems, 36, 2023.
[37] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.655 2014.
[38] Byeongjun Park, Sangmin Woo, Hyojun Go, Younoung Kim, and Changick Kim. Denoising task routing for diffusion models. In The Twelfth International Conference Learning Representations.
12

---

A Appendix
A.1 Algorithms of DDPath-BluriG and DDPath-GIG
Algorithm 2 Algorithm of 10PPth-BBlurGs
Require: Target image æ and its label y, the initial noisy baseline x' randomly sampled from a Gaussian; target model F(-), diffusion trained classifier has the diffusion model Ep, total number of step T', the (-step Gaussian blur kernels L(t).
Return: Attribution for the target image æ, A 7 I-1 9t-
1: for = 0 to T 1 do
2:
if' [ == then
3:
Zt =
> Noise baseline
4:
else
5:
3t = x²x
b Sampled image step
6:
end if
7:
4.
Scaling coefficients Update sampling mean
8:
jig (ar) = ppp (x)
EV.. loglo(y)ae)).
9:
2t ~ (x)) (x)); x. L(x'(,)) () & Sampling and Gaussian blur on sampled image
((F(.)))
10: 9i de
> Calculate gradients
11: end for
Algorithm 3 Algorithm DDPath-GIG.
Require: Target image X noise baseline X randomly sampled from Gaussian, target model F(.), diffusion trained classifier has the diffusion model &g, total number of step T, gradient of the function grad(x), target fraction of features change at each step p E (0, 1].
Return: aftr, the attribution for target image X
1: deotal f |
[| x + X attr +- zeross of
Initilization
2: for +- to T do
3:
if = then
4:
X
Assign noise baseline
5: else
6:
end a/}
Sampled image in step
7:
8:
P (x( = T: [lg(1) K VV,, log Po (v(ke)).
Scaling coefficients b Update sampling mean Sampling
9:
a' ~ (() Ex(x)))
11:
repeat until <
y: 00, V/ X dearget drotai(1 4); deurrent + ||ac X
13:
if diarget deurrent then break
15:
end
17:
Assign to S the fraction of features with the lowest absolute gradient values: S illyal S fraction(p. !yl)
dg - Eies x. - x! 0 deurrent dearget temp +- ar
19:
ds
20:
i > then
2; X YES
22:
else
T; (1 6)æ, ViES
24:
end if
y1 0, Vi oo; attr; attr; + (x, temp:)y Vi
26:
end for
13

---

A.2 More results of saliency maps obtained by VGG-19
Input
IG
Smooth IG
Blur IG
Guided IG
DDPath IG
Figure 6: Saliency maps obtained by VGG-19.
14

---

A.3 More results of saliency maps obtained by ResNet-50
Input
IG
Smooth IG
Blur IG
Guided IG
DDPath IG
Figure 7: Saliency maps obtained by ResNet-50.
15

---

64x64 128x128
256x265
512x512
Figure 8: Saliency maps generated by DDPath-IG using diffusion models of varying sizes.
A.4 Different diffusion model sizes
To investigate the diffusion model size, apply the released diffusion models by [16]. Note that these diffusion models of different sizes correspond to different image resolutions, including 64 x 64, 128 x 128, 256 256, and 512 x 512. The visualization results can be found in Fig. 8. We can that larger models generate larger resolutions of saliency maps, and they illustrate more fine-grained details.
A.5 Effects adversarial examples
We applied two approaches to generate adversarial samples, one is the fast gradient sign attack (FGSM) described by Goodfellow et al. [37]. and the other is adding simple Gaussian noise. We compared the results IG and DDPath-IG in terms of Insertion and Deletion values, these results and the saliency maps shown in Fig. 9. Interestingly, the IG generated saliency maps with degraded quality, while the DDPath-IG are more robust to adversarial samples (FGSM and Gaussian).
IG
DDPath-IG
IG
DDPath-IG
Clean
Del:
Dal:
FGSM
Gaussian
Figure 9: Saliency maps for adversarial examples generated by FGSM and Gaussian.
A.6 Additional scaling scheme
We evaluated our DDPath by setting = 1 (+) and K (1) with both = 0.5 and 2, and we note that the linear scaling used this paper is equal to that of a As shown in Table we can see that the DDPath-IG surpasses the baseline IG among different values, indicating the effectiveness of our DDPath. When a 2, the weight the mean term decreases slowly at early step, ensuring better preservation of the main object in the images. Besides, the weight of the class-related variance term increases fast at higher steps, enabling better preservation discriminative information and object details, and this is consistent with the mechanism of task weights in [38]. In
16

---

contrast, when 0.5, the variance weight increases fast at early steps while the noises are still severe. Hence, the class-related information can be affected by the noises while influencing the classification results and attribution qualities as shown in Fig. 10. The setting of is trade-off our experiments.
Table 5: Scaling with different values using VGG-19 target model.
Model
IG
DDPath-IG (0.5)
DDPath-IG (1.0)
DDPath- IG (2.0)
VGG-16
42.3
44.7
45.0
47.2
VGG-19
43.4
45.2
45.3
48.9
ResNet-50
45.2
46.9
46.6
50.0
== 0.5
=
a d= 2
Input
IG
DDPath-IG
Figure 10: Saliency maps generated by different scaling schemes with 10.5,1,2).
17

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The contributions clearly stated, and we have highlighted the scope of DNN autibutoo/ineepcaaooieppppaaaaop
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
The limitations have been discussed and included in the conclusion section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
18

---

Justification:
this work does not provide theoretical theorems and proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: have described the data and algorithms to reproduce the results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
19

---

Answer: [No]
Justification: The data employed in this study are the publicly available, and the underlying source code will be released later.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results. See the NeurlPS code and data submission guidelines (https:
/edoeSCSuumm ssi ssiinnsssiiiiiii sesionnyocy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: the experimental setting and details are clearly stated in the Experiments section.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[NA]
Justification: our results do not involve statistical analysis.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
20

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: we have stated in the Experiments section.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https /ett://nneuippee http://///....hiiccceeeeeeeeee
Answer: [Yes]
Justification: we have reviewed NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: in the Conclusion section, we have highlighted that the proposed method can inspire more research on DNN attribution using diffusion models.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
21

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: the pre- pre-trained diffusion model used in this paper has been publicly released on GitHub.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: the code, data, and models were cited in our paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
22

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: no new assets involved.
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
no crowdsourcing involved.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: no potential risks incurred by study participants involved.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
23


Reviews:
[{"review_id": "VEdydUjZop", "reviewer": "Reviewer_qJDk", "summary": "This paper proposes Denoising Diffusion Path (DDPath), a method to reduce noise in path-based attribution for deep neural networks. DDPath uses diffusion models to create a path with decreasing noise, resulting in clearer attributions. It can be integrated with existing methods like Integrated Gradients and maintains axiomatic properties. Experiments on ImageNet and MS COCO show DDPath outperforms traditional methods in producing clear explanations and improving metrics like Insertion and Deletion scores. The paper includes analysis, comparisons, and discussion of limitations.", "questions": "- Does image variation resulted from diffusion model demonstrate more correlation with image semantics than previous image variation methods?\n- Does the improvement in attribution quality provide significant improvement in attribution-based applications?\n- Does the attribution quality vary as pertained diffusion model size/quality varies?\n- If an image is generated from adversarial attack on diffusion model, will the attribution quality be impacted?", "limitations": "The author discusses limitation of the method that it requires longer paths.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Smart problem framing: The paper identifies a key issue in attribution methods - noise accumulation. It cleverly uses diffusion models' denoising ability to address this, showing good understanding of both attribution techniques and recent advances in generative models.\n- Clear method explanation: The proposed DDPath method and its variants are explained clearly, with the paper showing how it maintains important properties while improving interpretability. The mathematical exposition is very clear.\n- Thorough testing: The experiments compare the method on ImageNet and COCO datasets using multiple metrics (Insertion, Deletion, AIC) against several baselines. Ablation studies provide insights into how different components affect performance.", "weaknesses": "- Computational cost: The method requires significantly more sampling steps (250) than traditional attribution methods, which could limit its practical application in time-sensitive scenarios or for large-scale analyses.\n- Marginal quantitative improvements: While the paper shows improvements over baseline methods, the differences in quantitative metrics (e.g., Insertion and Deletion scores in Table 1) are relatively small. This raises questions about the practical significance of the improvements, especially given the increased computational cost.\n- Unconvincing visual results: The saliency maps presented in Figure 3 do not demonstrate a dramatic improvement over previous methods. While there are some differences, they are subtle and it's not immediately clear that DDPath provides substantially clearer or more interpretable attributions than existing techniques.\n- Limited to classification models: The paper only demonstrates the method's effectiveness on image classification tasks. There's no exploration or discussion of how DDPath might apply to or perform on non-classification models, such as regression, detection, or generative tasks.\nReliance on pre-trained diffusion models: The approach depends on having a suitable pre-trained diffusion model, which may not always be available for all domains or tasks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating the smart problem framing, clear method explanation, and thorough testing. We would like to address your concerns as follows:\n\n**W 1: Computational cost**\n\nWe acknowledge that the current DDPath might be computationally inefficient. However, we argue that the consistent quantitative performance gains can offset its increased computational cost. As demonstrated in Figure 4, DDPath exhibits superior denoising capabilities with more sampling steps, a characteristic NOT observed in other methods. Also, we agree with the reviewer that improving the computation efficiency is important in future studies, *e.g.*, combining Consistency models [ICML 2023] and one-step diffusion [CVPR 2024].\n\nIn addition, we emphasize that this paper primarily explores the alternative path formulation based on advanced diffusion models, hoping it can inspire more exciting studies on diffusion-based DNN attribution.\n\n**W 2: Marginal quantitative improvements**\n\nFirst, while the DDPath did not achieve a substantial performance gain over existing SOTA methods, it consistently demonstrated competitive improvements. In previous studies, the Score-CAM (Ins. 38.6) exhibited a 2.9% increase in insertion AUC when compared to the baseline Grad-CAM (Ins. 35.7) [CVPR 2020]; the CGC [CVPR 2022] improved the Insertion score to 52.16 against the baseline with 48.60 (3.56% improvements). In our paper, the DDPath-IG surpassed the IG, BlurIG, and GIG by 4.2%, 3.1%, and 2.3%, respectively. Additionally, from cases in Figure 3, we can see the superiority of DDPath in terms of Insertion and Deletion curves, demonstrating that DDPath captures more discriminative class-aware information. Hence, these findings suggest that DDPath represents a promising potential for future advancements in DNN attribution.\n\nSecond, this paper is the first exploration of integrating diffusion models into DNN attribution, which has shown considerable effectiveness, and practically, since the DDPath can be fused with forward and backward processes of DNNs, it potentially provides new perspectives for explainable training and trustworthy AI.\n\n**W 3: Unconvincing visual results**\n\nWe clarify that we aim to mitigate the noise in saliency maps to ensure that the model's predictions are solely driven by relevant features. This is critical to XAI. In Figure 3, we can see less noise obtained by DDPath, especially in discriminative regions like the heads and wings of birds, or the legs of lobster. In Figures 6 and 7 in the Appendix, we can see more significant visual results, especially those images containing multiple objects.\n\n**W 4: Limited to classification models**\n\n**Application tasks**: Current popular studies in XAI, especially the path-based methods, focused on image classification task, so as to this paper. Theoretically, the DDPath does not support the regression or detection tasks due to the step images are generated by classifier-guided diffusion model without regression or detection guidance.\n\n**Reliance on pre-trained diffusion models**: Recall that our motivation is to make intermediate images along the path to correlate with the original data distribution and then reduce the prediction bias and explanation noise. Since the original diffusion model was trained with no conditions, we applied the classifier-guided diffusion model to make the intermediate images within the path have class information. Fortunately, the diffusion model in [1] was trained on the ImageNet dataset, facilitating our interpretation study on ImageNet. Indeed, for the interpretation of other domains, it is better to have a classifier-guided diffusion model pre-trained on those domains.\n\n**Q 1: Image variation and semantics**\n\nTaking integrated gradient (IG), a typical attribution method, as an example, the intermediate images are generated by independently injecting image intensities into a black baseline image. This generation process has no correlation with semantic information. For DDPath, in line 8 of Algorithm 1, the sampling mean involves the conditional probability $p_{\\phi}(y | x_{t})$, which incorporates class information into generated intermediate images.\n\n**Q 2: Improvement in attribution-based applications**\n\nOne of the typical attribution-based applications is weakly-supervised localization, i.e., localizing objects in the images with only class labels rather than bounding boxes. The pointing game in section 5.4 is also an application that verifies the performance of localizing objects through saliency maps, where the annotated bounding boxes in MS COCO are used as ground-truth labels. The results in Table 2 (of the paper) show improvements obtained by DDPath.\n\n**Q 3: Diffusion model size**\n\nTo investigate the diffusion model size, we apply the released diffusion models by [1]. Note that these diffusion models of different sizes correspond to different image resolutions, including $64\\times 64$, $128 \\times 128$, $256 \\times 256$, and $512 \\times 512$. The visualization results can be found in Figure A1 in the attached PDF file. We can see that larger models generated larger resolution of saliency maps, and they illustrate more fine-grained details.\n\n**Q 4: Attribution for adversarial samples**\n\nThanks for your concern. We applied two approaches to generate adversarial samples, one is the Fast Gradient Sign Attack (FGSM) described by Goodfellow et. al [2], and the other is adding simple Gaussian noise. We compared the results of IG and DDPath-IG in terms of Insertion and Deletion values, these results and the saliency maps are shown in Figure A2 in the attached PDF file. It is interesting that the IG generated saliency maps with degraded quality, while the DDPath-IG are more robust to adversarial samples (FGSM and Gaussian). Additionally, the Insertion and Deletion values of DDPath-IG are superior to IG.\n\n[1] Diffusion Models Beat GANs on Image Synthesis, NeurIPS 2021.\n\n[2] Explaining and Harnessing Adversarial Examples, ICLR 2015.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LQP25MoOLT", "reviewer": "Reviewer_2oA3", "summary": "This paper proposes a Denoising Diffusion Path (DDPath) to address the challenge in path-based attribution methods, where intermediate steps often deviate from the training data distribution. By leveraging the denoising power of classifier-guided diffusion models, DDPath constructs a piece-wise linear path to ensure gradual denoising, resulting in cleaner and more interpretable attributions. It also demonstrates that DDPath satisfies the axiomatic properties and can be integrated seamlessly with existing methods like Integrated Gradient.", "questions": "* Please clarify the details of the diffusion model mentioned in the weaknesses.\n\n* Although DDPath requires multiple feed-forward of the diffusion model and the classifier, there is no analysis of the time-complexity comparison with other methods.\n\n* What about using denoising task weights in DTR [1] instead of a linear scaling scheme? For example, defining each scaling factor as $\\rho = 1 - {(\\frac{t}{T})}^{\\alpha}$ and  $\\kappa = {(\\frac{t}{T})}^{\\alpha}$, and experiments with $\\alpha = 0.5, 2$ provide a tighter connection to the diffusion model.\n\n[1] Park et al., Denoising Task Routing for Diffusion Models, ICLR 2024.", "limitations": "The authors have discussed them.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The proposed DDPath is interesting as it intuitively addresses the challenges in the previous works.\n* The paper validates the effectiveness of DDPath through comprehensive experiments on various interpretation methods and classification models, along with ablation studies.", "weaknesses": "* I am not sure about the details of the Algorithm 1. What is the input timestep for the pre-trained diffusion model and the classifier? Do noisy baselines $\\textbf{x}_{t}$ align with the noise scheduling in diffusion models?\n\n* I am confused about the use of the diffusion model. Why the diffusion model is used to estimate the noise from the target image $\\textbf{x}$? Is the target image a noisy image?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating the interesting idea of the proposed DDPath and comprehensive experiments. We would like to address your concerns as follows:\n\n**Weakness 1: About details of the Algorithm 1**\n\nFirst, the input timestep is $t \\in [0, \\ldots, T-1]$, and $t$ also denotes the steps along the path. \n\nSecond, we would like to clarify that the $x’$ is the baseline, and the $x_{t}$ are sampled by the pre-trained diffusion model. Hence, the sampled images $x_{t}$ are aligned with the noise scheduling process, and they consist of the attribution path.\n\n**Weakness 2: About the diffusion model**\n\nWe apologize for the confusion. Here, we clarify the motivation for using a diffusion model as follows. Intuitively, we intend to investigate the denoising power of diffusion models in reducing explanation noise. However, the unconditional diffusion models cannot guarantee that the finally sampled image is consistent with a target image to be explained, furthermore, unconditionally sampled images have NO class or semantic information. Consequently, we applied the classifier-guided diffusion model to generate step images within the attribution path. \nSpecifically, the target image $x$ is an RGB image rather than a noisy image, distinct from the noisy images typically associated with diffusion models, as shown in Algorithm 1. Our implementation focuses on the Reverse process to sample step images, and as outlined in line 8 of Algorithm 1, the sampling mean incorporates class probability $p_{\\phi}(y|x_{t})$, aligning our approach with the generative nature of diffusion model.\n\n**Question 1: Clarification on diffusion model**\n\nPlease refer to the responses of Weakness 1 and Weakness 2 for clarification on the diffusion model.\n\n**Question 2: Time-complexity comparison**\n\nThanks for pointing out this issue. For traditional attribution methods like IG, the time complexity is $\\mathcal{O}(n)$, where $n$ denotes the number of forward-back processes with respect to the target model. When combined with DDPath, for example, the DDPath-IG, the time-complexity increases due to the reverse sampling process of classifier-guided diffusion models, i.e., $\\mathcal{O}(m)$, where $m$ is the number of the guided reverse sampling process. Hence, within one attribution step, the time complexity of DDPath-IG is $\\mathcal{O}(m) + \\mathcal{O}(n)$. In Table R1, we compare the attribution time of IG and DDPath-IG, due to the simple sampling strategy we use, the DDPath-IG requires more time. However, the proposed DDPath has the potential to reduce sampling steps (or the path length) by combining more efficient diffusion sampling strategies with fewer sampling steps. Then, the DDPath will also be more efficient in practice. This is what we are working on for the next version of DDPath.\n\nTable R1 Comparison of attribution time for one image using VGG-19 as the target model\n\n| Method | Time (s) |\n| --- | --- |\n| IG | 2.5 |\n| DDPath-IG | 22.5 |\n\n**Question 3: About denoising task weights in DTR**\n\nThanks for your valuable comment. The DTR is an interesting idea of creating separate information pathways within a single diffusion model by selectively activating different subsets of channels for each task. Per your concern, we evaluated our DDPath by setting $\\rho = 1 - (\\frac{t}{T})^{\\alpha}$ and $\\kappa = (\\frac{t}{T})^{\\alpha}$ with both $\\alpha = 0.5$ and $\\alpha = 2$; and we note that the linear scaling used in this paper is equal to that of $\\alpha = 1$. \n\nAs shown in Table R2, we can see that the DDPath-IG surpasses the baseline IG among different $\\alpha$ values, indicating the effectiveness of our DDPath. When $\\alpha=2$, the weight of the mean term decreases slowly at the early step, ensuring better preservation of the main object in the images. Besides, the weight of the class-related variance term increases fast at higher steps, enabling better preservation of discriminative information and object details, and this is consistent with the mechanism of task weights in [1]. In contrast, when $\\alpha=0.5$, the variance weight increases fast at early steps while the noises are still severe, hence, the class-related information can be affected by the noises while influencing the classification results and attribution qualities. The setting of $\\alpha=1$ is a trade-off in our experiments.\n\nFor visualizations of different settings, we showcased the corresponding saliency maps in **Figure A3** in the attached **PDF** file. This experiment helps us complete the study of the scaling scheme.\n\nTable R2 Scaling with different $\\alpha$ values using VGG-19 target model\n\n|  | IG | DDPath-IG (0.5) | DDPath-IG (1.0) | DDPath-IG (2.0) |\n| --- | --- | --- | --- | --- |\n| Insertion$\\uparrow$ | 23.2 | 26.6 | 27.8 | 27.4 |\n| Deletion$\\downarrow$ | 13.5 | 12.4 | 12.1 | 12.0 |\n| Overall$\\uparrow$ | 9.7 | 14.2 | 15.7 | 15.4 |\n\n[1] Park et al., Denoising Task Routing for Diffusion Models, ICLR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "eMd1JPyHUL", "reviewer": "Reviewer_rjLS", "summary": "This paper proposes an approach to interpreting deep neural networks, specifically they focus on a path-based approach where they utilize the denoising ability of the diffusion model to construct a path to be integrated to compute the attribution of the target image.", "questions": "see weaknesss", "limitations": "The authors briefly discuss their limitations", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. I am not an expert in the field of interpretability, and the idea of combining diffusion modeling with a path-based approach seems novel to me.\n\n2. Better quantitative results were achieved compared to existing path-based methods", "weaknesses": "1. The presentation in Section 3 is somewhat abbreviated, for example, there is no definition of the lower x^', which can be confusing to those unfamiliar with this area.\n\n2. The proposed method requires the introduction of classifier-guided diffusion, which requires a pre-trained diffusion and noise-aware classifier, and it is not clear whether the method is applicable when not belonging to a predefined category or when the category is difficult to define.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating the novelty of the proposed method and better quantitative results compared to existing methods. We would like to address your concerns as follows:\n\n**Weakness 1: Presentation in Section 3**\n\nThank you for pointing out these issues. We will provide a more detailed description of integrated gradient (IG) in Section 3 so that it will be more friendly to those readers who are unfamiliar with this area. Specifically, the $x’$ denotes a baseline image, *i.e.*, starting point of the integration path, which can be a **black** image or a **noisy** image.\n\n**Weakness 2: Lack of introduction of classifier-guided diffusion and whether the method is applicable when no predefined category is given**\n\nThank you for the suggestion. In the current version of the manuscript, we have mentioned the classifier-guided diffusion model [1] in Section 2. To enhance the readability, we will add a brief introduction of the classifier-guided diffusion model in Section 3 in the future version as below: “The classifier-guided reverse process conditioned the $p_{\\theta} (x_{t}|x_{t+1})$ on class label $y$, then deriving a sampling strategy of $x_{t-1} \\sim \\mathcal{N} (\\mu + s \\Sigma \\nabla_{x_{t}} \\log p_{\\phi}(y|x), \\Sigma)$. In this paper, we let the $\\mu = \\mu_{\\theta} (x)$ to ensure the intermediate images are centered at the target image.”\n\nFor the second question, when there are no pre-defined categories for target images, the DDPath can also work because the pre-trained diffusion models and classifiers are fixed, and any target image can obtain classification results from the final Softmax output and corresponding saliency maps through back-propagation. However, the only concern is that we cannot guarantee the correctness of the classification result and whether this classification result matches well with the saliency map.\n\n[1] Diffusion Models Beat GANs on Image Synthesis", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear Reviewers,

We thank all the reviewers for their thorough summaries and valuable feedback. All the reviewers appreciated the **Novelty** and interesting idea of this work. The reviewers appreciate that our DDPath, combining diffusion models and DNN’s attribution, is Smart, Interesting, and Novel (**qJDk**, **2oA3**, **rjLS**) while intuitively addressing the challenges in previous works (**2oA3**), the experiments are comprehensive (**qJDk**, **2oA3**) and demonstrate the effectiveness of DDPath and better quantitative results (**qJDk**, **2oA3, rjLS**), clear method explanation and mathematical exposition (**qJDk**).

We have posted detailed responses to each reviewer and deeply appreciate your further feedback on whether our responses adequately address your concerns. If you have any additional comments or questions, we will try our best to address them.

Per Weakness 3 and Questions 3 and 4 of **qJDk**, Question 3 of **2oA3**, the following **attached pdf file** provide more saliency maps generated by diffusion models of different sizes (**qJDk**), adversarial examples (**qJDk**), and different scaling schemes (**2oA3**):

- Figure A1: Saliency maps generated by DDPat-IG using diffusion models of varying sizes.
- Figure A2: Saliency maps for adversarial examples generated by FGSM and Gaussian.
- Figure A3: Saliency maps generated by different scaling schemes with $\alpha \in \{0.5, 1, 2\}$.

Best,

The authors

Meta-review: This paper has received consistent feedback from all three reviewers. The reviewers engaged in thorough discussion and rebuttal, with most of their concerns being addressed, ultimately reaching a consensus. The paper proposes a novel Denoising Diffusion Path (DDPath) for DNN attribution, which can be easily implemented using a pre-trained classifier-guided diffusion model. Comprehensive experiments  and ablation studies validate the effectiveness of DDPath. Therefore,  the AC  has decided to accept this paper.
Decision: Accept (poster)