An Analysis of Concept Bottleneck Models: Measuring, Understanding, and Mitigating the Impact of Noisy Annotations
Authors: Seonghwan Park
Jueun Mun
Donghyun Oh
Namhoon Lee
Venue: NeurIPS 2025 poster ()
Keywords: concept bottleneck models
label noise
Primary area: deep_learning
TL;DR: Label noise in CBMs cripples prediction performance, interpretability, and interventions via a few susceptible concepts. We combat this with sharpness-aware training and entropy-based concept correction, restoring the robustness of CBMs.

Abstract: Concept bottleneck models (CBMs) ensure interpretability by decomposing predictions into human interpretable concepts.
Yet the annotations used for training CBMs that enable this transparency are often noisy, and the impact of such corruption is not well understood.
In this study, we present the first systematic study of noise in CBMs and show that even moderate corruption simultaneously impairs prediction performance, interpretability, and the intervention effectiveness.
Our analysis identifies a susceptible subset of concepts whose accuracy declines far more than the average gap between noisy and clean supervision and whose corruption accounts for most performance loss.
To mitigate this vulnerability we propose a two-stage framework.
During training, sharpness-aware minimization stabilizes the learning of noise-sensitive concepts.
During inference, where clean labels are unavailable, we rank concepts by predictive entropy and correct only the most uncertain ones, using uncertainty as a proxy for susceptibility.
Theoretical analysis and extensive ablations elucidate why sharpness-aware training confers robustness and why uncertainty reliably identifies susceptible concepts, providing a principled basis that preserves both interpretability and resilience in the presence of noise.

An Analysis of Concept Bottleneck Models: Measuring, Understanding, and Mitigating the Impact of Noisy Annotations
Seonghwan Park, Jueun Mun, Donghyun Oh, Namhoon Lee
POSTECH (seonghwan, Brrigghwwn..ark,.... , donghyunoh, nanagynoonon,,mmhon namhoon [eee) ac kr
Abstract
Concept bottleneck models (CBMs) ensure interpretability by decomposing pre- dictions into human interpretable concepts. Yet the annotations used for training CBMs that enable this transparency are often noisy, and the impact such corrup- tion is not well understood. In this study, we present the first systematic study of noise in CBMs and show that even moderate corruption simultaneously impairs prediction performance, interpretability, and the intervention effectiveness. Our analysis identifies a susceptible subset of concepts whose accuracy declines far than the average gap between noisy and clean supervision and whose corrup- tion accounts for most performance loss. To mitigate this vulnerability we propose two-stage framework. During training, sharpness-aware minimization stabilizes the learning unavailable, we rank concepts by predictive entropy and correct only the most uncertain ones, using uncertainty as a proxy for susceptibility. Theoretical analysis and extensive ablations elucidate why sharpness-awar training confers robustness and why uncertainty reliably identifies susceptible concepts, providing principled basis that preserves both interpretability and resilience in the presence of noise.
sensitive concepts. During inference, where clean labels are
Introduction
Despite decade of breakthroughs in deep learning, the inner-workings of end-to-end neural networks remain largely clusive [35, 24, 34]. This lack of transparency stems from their reliance on complex, high-dimensional internal representations, which offer limited insight into their decision-making process [37, 8]. Concept bottleneck models (CBMs) are designed to address this opacity by first predicting a set numan-interpreetar
concepts, which serve as an intermediate representation for deriving the final decision [19, 3, 38]. For instance, when it comes to the bird species classification problem [54], they first predict the concepts of the bird such as tail shape or body color, and then, infer the bird class based on these attributes, making the decision more understandable (e.g., "this bird HEERMANN GULI because is gray and black in color with an orange beak!").
Formally, a CBM is trained on triplets of input E Rd, binary concept vectors E {0, 13 and output y. The concept predictor g : + e maps each input its k-dimensional concept vector, and the output predictor f: c y consumes those concepts to produce (see Figure la). This two-stage process offers practical advantage, which is. domain experts can step in and edit the predicted concepts at inference, process known as concept-level intervention [19]. For example, changing 'has stripe' from yes no, while keeping other concepts such 'number
legs', can shift the prediction from ZEBRA to HORSE without retraining and can recover much of the lost accuracy. Interventions further support counterfactual analysis [53], allowing users ask "what if" scenarios
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

0%
84 0%
74.3%
84.3%
Noise
40%
10%
40%
10%
a.88.4 8.8%%
g
Target (
Inpet
(e)
Concepts
(+)
30%
(a) CBMs under noise
(b) Task accuracy
(c) Concept alignment
(a) Noisy concept annotations arise easily in CBMs. (b. c) On the CUB [54] dataset, raising the noise level to 40% lowers task accuracy from 74.3% to 4.0% and reduces interpretabil- ity-asseeeed by the concept alignment score [61], which measures semantic alignment between learned representations and ground truth concepts from 84.3% to 58.4%.
Figure 1:
by manipulating concepts rather than raw pixels. Such human-in-the-loww interactivity is central to the appeal of CBMs and underscores the need to safeguard concept fidelity.
Despite their potential, we identify critical issue inherent in CB Ms: their reliance concept annotations for training. This requirement entails extensive labeling efforts, and because of that, can easily introduce annotation errors, i.e., noisy concept labels. Unlike end-to-end models, such noise directly corrupts the intermediate concept bottleneck, the very foundation CBMs rely upon for interpretability and prediction, potentially rendering them more vulnerable performance degrada- tion under imperfect labels. Such noise can arise from human mistakes, subjective disagreements, and inconsistencies in annotator expertise, and yet. its impact CBMs has been largely overlooked.
In this work, we provide the first systematic investigation into the impact of noisy annotations on CBMs, by comprehensively measuring its extent, understanding its underlying mechanisms, and mitigating its detrimental effects.
Specifically, our study reveals that noise significantly compromises key characteristics of CBMs, i.e. interpretability, intervention effectiveness, as well prediction performance (see Figure for basic results). We discover that this degradation is primarily driven by a specific set of concepts that are highly susceptible to noise, whose accuracy drop largely accounts for overall performance declines. To mitigate these negative effects, we propose two strategies. First, we utilize sharpness- aware mini- mization (SAM) [10] during training to build robustness, particularly for sensitvvn concepts. Second, observing that susceptible concepts often have high predictive uncertainty, quantified by entropy [41], we adopt an uncertainty-basee
intervention strategy at inference [21, 20, 43]. This strategy prioritizes correcting high- -nccrrncetyantty concepts, enabling targeted interventions that signifi- cantly improve overall task performance. Extensive empirical results validate the effectiveness of this combined approach, consistently recovering the reliability of CBMs despite the presence of noise.
Our key contributions are summarized as follows:
Section 2.
We present the first comprehensive and systematic characterization of noise's 's impact on CBMs, demonstrating that even moderate level of noise significantly degrades predictive performance, interpretability, and intervention effectiveness.
Section 3.
To deepen our understanding noise effects on CBMs, we identify a susceptible set, small subset of concepts that suffer significant accuracy loss, and demonstrate that overall performance decline is largely driven by these localized failures.
Section 4.
To neutralize the risk of the susceptible set, we introduce two mitigation strategies: integrating sharpness minimization during training and implementing an uncertainty- based intervention at inference. Our suggestion supported by theory and validated through extensive empirical evidence.
2
Measuring Impact
In this section, we systematically measure the impact of noise on CBMs across three key dimensions: prediction performance, interpretability, and intervention effectiveness. We begin by outlining our experimental setup (Section 2)1), followed by an evaluation of the noise effects on prediction performance (Section 2.2), interpretability (Section 2.3), and intervention effectiveness (Section 2.4).

---

63
63
97
Concept Align. (%)
83
Task AcC, (%6
Task Acc. (%)
57
Concept Acc,
311
-1
89
67
Concoge
Target
0.0
0.1
0.2
0.3
0.4
0.0
0.1 0.2 0.5
0.4
0.0
0.1
0.2 0.3 0.4
0.0
0.1 0.2
0.3
0.4
Nois Rale
Noise Rate
Noise Rale y
Noise Rate
85
Concept Acc. (%)
Concept Align. (%)
Task Acc. (%6
73
78
74
71
43
Concapt Tagut
74
68
0.1
0.4
0.
0.1
0.3
0.1
0.2
0.4
Noise Rate
Naise Rate
Noise Rate
Noise Rate y
(a) Task accuracy
(b) Source of degradation
(c) Concept accuracy
(d) Concept alignment
Figure 2: Impact of noise on CBMs. (a) Task accuracy degradation; (b) Source of degradation; (c) Concept accuracy degradation; (d) Decline in interpretability measured by the concept alignment score. The top row represents the CUB dataset, and the bottom row shows results for AwA2 dataset.
2.1 Experimental Setup
Our experiments follow the settings proposed by Koh al. [19], using Inception [47] as the concept predictor y and linear model as the target predictor f. We introduce noise into the CUB [54] and AwA2 [58] datasets to study noise impacts CBMss. Specifically, each binary concept label E {0, is independently flipped with probability to simulate concept noise 2. For target noise Y, each class label y is randomly changed to a different label, uniformly sampled from the remaining classes, also with probability y, This formulation of target noise is standard in the literature [31, 57, 26], and we adopt parallel strategy for concept noise.
2.2 Prediction Performance
We begin by examining how noise impacts pre-
10F
10
diction performance. As shown in Figure 2a,
increasing noise levels lead to a consistent de-
cline accuracy. For instance, introducing 30% noise into the Aw A2 dataset results in a 9.4% drop in accuracy, while the same noise level in the CUB dataset leads to dramatic 5 51% decline.
(a) Clean
(b) Concept
(c) Target
Even modest noise has surprisingly strong ef- feet on Ms,s, with just 10% noise in CUB causing 16.6% drop in accuracy. To better un- derstand this vulnerability, we compare three types of noise: (i) concept-only noise, (ii) target-only noise, and (iii) combined noise (see Figure 2b). We find that concept noise alone leads to almost the same performance degradation the combined case, suggesting that corrupted concept labels are the primary driver performance loss. This conclusion is further supported by Figure 3, which visual- izes internal representations using t-SNE [51] for three classes (e.g.. BLACK-FOOTED ALBATROSS ()), WINGED BLACKBIRD (+), and YELLOW-HEADED BLACKBIRD (+)). Compared clean supervision, concept noise severely distorts the class wise clustering of embeddings, while target noise causes minimal disruption. These results demonstrate that concept-level corruption not only reduces prediction accuracy but also undermines the semantic structure of Iearned representations.
Figure 3: t-SNE [51] visualization of model repre-
sentations under different noise settings.
2.3 Interpretability
Next, we assess the effect of noise on interpretabilityy As shown Figure 2c, concept prediction accuracy declines from 96.5% in clean conditions to 85.4% with 40% noise on the CUB dataset. Despite appearing modest, the 11.1% drop notably compresses the margin over random guessing in binary classification tasks, where minor concept prediction enrors can compound and severely

---

Blue Upperparts (ya
Blue Upperparts (ya 021
Blue Upperpars 0
Cheap nactrit
Grop nitlen
(a) 7 = 0.0
(b) = 0.2
(c)
Figure 4: t-SNE [51] visualizations of 'blue upperparts' concept embedding learnt in CUB with sample points colored red if the concept is active and blue if the concept is inactive in that sample. As noise ratio increases, the concepts are clearly entangled making concepts unreliable.
90
90
30
83
E
TaOk Acc. (36)
Tosk-A (N0)
Tack (%)
DaA ACC (%)
500
-3
30
30
25
10
20 Interventions
20 60 Interventions
10
Interventions
Interventions
(a) Random
(b) UCP
(c) CCTP
(d) Incorrect, CUB (e) Incorrect, AwA2
Figure 5: (a, b, c) Impact of noise on the effectiveness of CBM interventions using Random, UCP, and CCTP strategies under varying noise levels in the CUB dataset. (d, Effects of performing incorrect random concept interventions at different noise rates in CUB and AwA2 dataset.
impair target prediction in CBMs. Beyond accuracy, interpretability critically relies on semantic coherence of learned representations. Thus, we measure interpretabilityy using the concept alignment score (CAS) [61], quantifying semantic alignment between learned representations and ground-truth concepts (see Figure 2d). We find CAS decreases substantially with increasing noise, e.g., for each additional 10% increment noise, CAS drops by approximately 7% on the CUB dataset, indicating severe degradation in interpretability.
Qualitative t-SNE [51] visualizations further illustrate this interpretability decline (see Figure 4). Clean embeddings for the specific concept 'blue upperparts' show distinct, semantically mean- ingful clusters corresponding to active (i.e., red circles) and inactive (i.e., blue circles) concept instances. However, increasing noise levels result in ambiguous, less separable clusters. Thus, noise compromises the explanatory power and reliability of concepts, diminishing interpretability. Additional examples are provided in Appendix D.12.
2.4 Intervention Effectiveness
Finally, we investigate how noise limits the utility of post-hoc interventions, utilizing three concept selection strategies proposed by Shin et al. [43]: (i) Random, which samples concepts uniformly [19]; (ii) UCP (uncertainty of concept prediction), which ranks concepts by predictive uncertainty: (iii) CCTP (contribution of concept target prediction), which selects concepts exerting the greatest influence on the target prediction. Implementation specifics are detailed in Appendix C.5.
As shown in Figure 5a-5c, the benefits of intervention are increasingly constrained as noise levels rise (i.e., the accuracy curves translate downward along the y-axis). Under the Random strategy, correcting every concept in model trained with clean supervision yields near-optimal performance at 99.8% accuracy. However, this upper bound progressively declines to 98.4%, 95.7%, 89.4%, and 53.1% as the noise level increases from 10% to 40%. Notably, even exhaustive intervention at 40% noise fails to recover the performance of the clean model without any intervention. Similar trends are observed for the advanced intervention methods (e.g.. UCP and CCTP), indicating that the errors induced by noisy supervision in CBMs cannot be rectified through post-hoc correction alone.
To further evaluate robustness, we deliberately assign incorrect values to selected concepts, emulating the inevitable inaccuracies of expert intervention. As shown in Figure 5d-5e, CBMs trained on clean data tolerate small number of such mistakes with only marginal performance decline. Under noise,

---

100
Concept Aoc. (%)
40
20
Sumseppible
5008-500 eeoas 0265 8668
(Sorted) Concepts
Figure 6: Impact of noise individual concept accuracy. We evaluate the noise effects concept predictions for LE CONTE SPARROW. As noise increases, accuracy declination becomes increasingly uneven across concepts. Concepts are sorted by their accuracy difference between 40% and 0% noise.
however, even slight intervention errors precipitate pronounced additional loss, revealing fragility that limits the practical utility of concept-level correction in realistic human-expert workflows.
3 Understanding Mechanisms
In this section, we further analyze how noise affects the internal mechanisms CBMs, separately examining the concept predictor and the target predictor f. We begin with the observation that noise induces non-uniform degradation of individual concept accuracies (Section 3.1). We then assess how noise disrupts the alignment between concepts representations and target predictions (Section 3.2).
3.1 Non-Uniform Degradation of Concept Accuracy
To understand the noise impact on CBMs, we analyze individual concept accuracy for a specific class, LE CONTE SPARROW, from the CUB dataset. We vary noise rates y E {0, 0.2, 0.4} and measure accuracy across each concept.
Ditributionn Concept
As shown in Figure 6, although noise is introduced uni- formly across all concepts, accuracy degradation is notably uneven. While the majority of concepts remain compar- atively resilient, distinct minority suffers a dispropor- tionately large decline. We designate this minority as the susceptible concept set, defined as
Sate
S [c Aacce; > Aace
where Aacce, acc acc., noisy represents the accu-
2000 2000
4000
Concept Frequency
racy drop for concept c, and Aace denotes the mean drop
across all 112 concepts. Under this criterion, approxi- mately 23% of the concepts are identified as susceptible, suggesting heightened vulnerability to label corruption, likely rooted in greater semantic ambiguity.
Figure 7: Concept frequency distribu- tion (KDE). The distribution under noisy conditions (e.g.. 20%. 40%) differs sub- stantially from that of the clean dataset.
To better understand this phenomenon, we plot the concept frequency distributions using kernel density estimation (KDE) [5] in Figure In the clean dataset, concept occurrences are imbalanced, with many low-frequency and a few high-frequency concepts. As noise increases, however, this distribution becomes more uniform; at 40% noise, most concepts occur roughly 2,000 times. This shift may reduce the ability of model to learn rare but informative concepts, the effective signal-to- noise ratio for such concepts deteriorates. Identifying and understanding these vulnerable concepts essential, their degradation can disproportionately affecct downstream performance, which we explore in the next section.
3.2 Disruption Representation Alignment
We next examine how noise during training reshapes the correspondence between learned repre- sentations and their associated target classes. In a noise-free setting we first identify the five most influential representation dimensions (i.e., concepts) for the class LE CONTE SPARROW. These
5

---

0.5
10:0-:0
Nobo 1.050
0.3
Wolght
0.3-
0.1
0.1-
apperaatt
lack
STERE:
spparzarts
sppartal
Conceegz
(a) Le Conte Spartow
(b) Importance shift in key concepts
(c) Key concepts under 40% noise
Figure 8: Effect of noise on representation alignment. (b) Top most influential (i.e., key) concepts for LE CONTE SPARROW in a clean setting and tracks how their influence shifts as noise increases. (c) Top 5 influential concepts under 40% noise. In both figures, bars blue denote positive weights, while red indicate negative weights, illustrating how noise reshapes concept importance.
dimensions align with meaningful visual attributes such 'white upperparts' and 'grey back'. Their importance is quantified by the absolute magnitude of the weights in the linear target predictor f. a widely used proxy for feature saliency [25, 22, 6]. We then trace how these saliency values change as the proportion of corrupted labels increases.
As illustrated in Figure 8b, when the noise level is moderate (f.e., 20%) the relative ordering of the predictive dimensions is largely preserved. At a higher noise level (i.e., 40%), however, their saliency declines markedly. Informative dimensions lose influence, whereas irrelevant spurious ones gain dispropprtionnaell large weights (see Figure 8c). Specifically, dimensions linked to 'grey back' or 'yellow upper tail' receive minimal weight, while related attribute such 'orange upper tail' is assigned a negative weight. These shifts indicate a pronounced misalignment between the learned representations and their intended semanties.
We further relate this effect to concept-level susceptibility. In Figure 6, its five most influential dimensions, indicated with red arrows, coincide with the concepts most susceptible to noise. The same pattern emerges across the full dataset. Among 200 classes, 189 display an exact overlap between the five most influential dimensions and the noise-susceptible set. This widespread overlap exposes a critical weakness, i.e., when concepts that are noise-sensitive coincide with distorted representations, performance degrades sharply. Thus, the intersection of susceptibility and disrupted alignment emerges as a principal source of instability, emphasizing the need for robust training methods prevent representation collapse under noisy supervision.
4 Mitigating Effects
We have shown that noise severely degrades the key aspects of CBMs, primarily due to subset of concepts (i.e.. susceptible concept set) that are especially vulnerable to noisy supervision and frequently coincide with representational misalignments. To address this, we introduce two mitigation strategies that operate different stages of the model lifecycle: during training and inference. First, we incorporate sharpness-awan minimization (SAM) [10] at training time to improve the prediction accuracy of susceptible concepts (Section 4.1). Then, at inference time, we apply an uncertainty-bant intervention strategy that prioritizes corrections unreliable concept predictions (Section 4.2).
4.1 Training-Tinn Time Robustness via SAM
Sharpness-aware minimization. SAM induces parameters w that lie in flat regions of the loss landscape, yielding models that are less sensitive to perturbations and therefore generalize more reliably. Its objective is
min max Etrain (aainnWwa E): |eel
Parsin Gradient updates are then computed + ē(w). By steering solutions toward flatter optima, SAM attenuates the performance degradation caused by noisy labels and other small perturbations [10, 2], rivaling the best dedicated noisc-robust training methods [17, 62, 1].
where the inner maximization is approximated by ē(w) = V Vurariin (w)

---

Table 1: Comparison of concept accuracy, task accuracy, and CAS under different noise levels for BASE and SAM. SAM consistently enhances robustness across all evaluation metrics. Red values indicate the performance improvement achieved by SAM relative to BASE.
CUB
AWA2
METHOD
METRIC
200.
==
0.2
CONCEPT Acc
96.52.00
13.63
42.00
78, 50
78 78.08
75 25
BASE
TASK Acc
74.31+b.
50. 3S+at
1 3.99
86, 48-00
82, 34-444
41 85-10
CAS
84.31
71,80
58. 44
76,43
74,97
68.54
CONCEPT Acc
97.19=t.1
(40
78. (-0
78.47#05/40030
75. 3..551::440000
SAM
TASK Acc
78.96208114400
14.21487))3
4.95:14/40.00
47.75
85.7328-4443.00
46.53=142444.000
CAS
87.45
(2.
60.4 (1.00
(7.744
15.09
70.10=m0::2..00
SAM improves accuracy by stabiliz- ing susceptible concepts. We compare SAM-trained CBMs with SGD-traines ones (i.e., BASE) across concept accuracy, task accuracy, and CAS the CUB and AwA2 datasets under varying noise levels. As shown in Table 1, SAM consistently im- proves all metrics across noise conditions.
Table 2: Concept accuracy of susceptible and non- susceptible concepts. SAM improves accuracy in the noise-sensitive susceptible group. A indicates the gain of SAM over BASE for susceptible concepts.
NOISE
OPTIMZER
OVURALL
SUSCEPUBLE:
NON-SUSSEEPTIBLE
0.0
BAS6
97.1980.3
96.52.10.
91.611000
66.45119
Notably, even modest gains in concept ac- curacy lead to substantial improvements in downstream task performance. For in-
7-
SAM
92.5420.3
70.3050.7
+3.55
98.93.00.3
0.4
BAME
SAM
85.42:50.0
86. 36-91-00.1
43.65
39.38230
+4.07
98.64
98.61:20.2
stance, under 40% noise in AwA2, 0.60% increase in concept accuracy leads to 4.68% gain in task accuracy. Previous work [2] attributed the robustness of SAM against noise to its é r--gullarization on final layer weights and intermediate activations. In Appendix A, we extend the theoretical analysis of Baek al. [2] to CBMs, demonstrating that the same regularization effect holds.
We also emphasize that SAM is particularly effective at recovering concepts in the susceptible concept set. Table 2 shows that while concept accuracy in the non-susceptible set remains stable, SAM yields substantial gains in the susceptible set across all noise levels, e.g., yielding gains of +3.85% and +4.07% under 20% and 40% noise, respectively. These findings underscore the effectiveness of SAM in selectively enhancing the learning of noise-sensitive concepts, thereby enhancing both predictive robustness and model interpretability under corrupted supervision.
4.2 Inference- Robustness via Uncertainty-Guide Intervention
Intervention guided by susceptibility sig- nificantly enhances performance. Al- though training with SAM effectively mit-
90
Julnuiiiity
7000 soc (%)
Sprcan
Avi
To0 AOC
igates the adverse effects of noise, additional performance gains are achievable through targeted inference-time interventions. Mo- tivated by our earlier findings that only a small subset of concepts significantly con- tributes to performance degradation, we pri- oritize corrections based on susceptibility, de- fined as the magnitude of accuracy decline under noise. Specifically, we select the five most susceptible concepts per class for correction. As shown in Figure 9, susceptibility- corrections significantly outperform baseline interventions across varying noise levels. Remarkably. correcting even single highly susceptible concept can yield accuracy improvements of around 10% at higher noise intensities (e.g., 20% and 30%). Moreover, fewer than five targeted interventions frequently achieve or surpass the accuracy of models trained on clean data. These findings underscore that noise disproportionately affects a small subset of highly predictive and noise-sensitive concepts, and that targeted correction of these concepts substantially restores overall model performance.
of Intervertions
of Irienvertionss
Interwetiion lons
(a) 7 = 0.1
(b) = 0.2
(c) = 0.3
Figure 9: Intervention results comparing baseline and musceptibillty--asee corrections. The dotted line indi- cates the clean-model accuracy without intervention.
concept Susceptibility can be reliably approximated by uncertainty. While susceptibility- selection is highly effective intervention strategy, it is not feasible to perform in realistic scenarios since requires the access to a model trained with clean labels. To circumvent this challenge, we explore predictive uncertainty as practical surrogate for susceptibility. Intuitively, concepts
7

---

1.0
Normalized Entropy
Noralized Entrop
Hormaltzed Entropy
0.5
9.5
2.4
2.4
Suscaptb
Suomerth
p-00
Scmeethe p.00 202
0.7
F2
Nonas
Nenas
Susceptible
Susceptble
Succeptible
Non DUScopabl
suscepdble
EuScopaDl
Normalized
Normalized Concept
Normalized
(a) = 0.1
(b) 0.2
(c) 0.3
Figure 10: Correlation between uncertainty and susceptibility. Scatter plots show predictive uncer- tainty (normalized entropy; y-axis) versus susceptibility (normalized accuracy drop; x-axis) across all concepts. Pearson correlation values (p) are reported separately for susceptible and non son-susceetibbe sets, revealing positive correlation in the former and no notable trend in the latter.
Table 3: Task accuracy the CUB dataset under varying noise levels 7 and numbers of interventions n, comparing combinations of training strategies (BASE, SAM) and intervention methods (Random, Uncertaint--guides The combination of SAM training and uncertainty-guide intervention consis- tently yields the highest accuracy, rapidly recovering performance with only a few interventions.
== 0.0
7 0.2
7= 0.4
BASE RANDOM
74.3+0.3
75.6#0.4
76.8tu.
50.3
56.2#0.7
62.1#10
4.0
4,8
6.3
BASE UNCERTAINTY
74.3
81.820.6
87 020.7.0
50.34:06
71.2417
82.0214
4.022..6
6.922.
10.74:14
SAM RANDOM
79.0=t0.7
80.1#06
81.1
$4.2
$9.9
65 65.6209
5.0=1.2
5.6taa
7.1
UNCERTAINTY
79.0
86.240.
54.24..
75.240
85.1200
5.0-1.
8.041.
12.44
that contribute little to target prediction or are noise-sensitive should exhibit elevated uncertainty. measure the Pearson correlation between concept-level uncertainty
To validate this hypothesis, (quantified by the entropy of their predictive distributions [41]) and susceptibility. As depicted in Figure 10, we observe positive correlation within the subset of susceptible concepts, whereas no consistent relationship emerges among non-susccetiible concepts. These results suggest that predictive uncertainty effectively, though not definitively, reflects susceptibility induced by noise, supporting its use as a practical criterion for inference- time interventions. In Appendix B, we provide theoretical justification demonstrating that, under reasonable assumptions, uncertainty-bant -based selection asymptotically approximates susceptibility- -bsed concept selection.
Uncertainty-based intervention markedly improves accuracy by targeting susceptible concepts. Building on the observed correlation between predictive entropy and susceptibility. uncer- tainty provides principled signal for inference-ting interventions, Guided by the survey of Shin et al. [43], we employ uncertainty of concept prediction (UCP), which ranks concepts according to entropy H(C) [41] and prioritize corrections of the most uncer- tain ones. illustrated Figure 11, UCP consistently outper- forms baseline methods such as Random selection and CCTP, with margin improvement increasing at higher noise intensities. These results indicate that incertainty-based interventions effec- tively approximate susceptibility-baat based strategics, successfully identifying and rectifying noise-sensitive concepts.
Task Acc. (%)
60
40
UCP
20
3.0.0
CCTP
RAND
10
# of Interventions
Figure 11: Task accuracy under different intervention strategies (e.g., UCP, Random, CCTP).
Finally, we present our culminating experiment, examining the combined effects of training-time mitigation via SAM and inference- ceterence-timeeeee corrections through UCP. Table 3 demonstrates that integrating SaM-based training with uncertainty- -uidde interventions nearly recovers the accuracy of cleanly trained models using only five targeted interventions at 20% noise. In stark contrast, models without SAM and using ran- dom corrections fall short even after ten interventions. 'aken together, these findings underscore the complementary benefit of combining sharpness-aware training with uncertainty-drive interventions, substantially enhancing robustness and preserving interpretability under noisy supervision.

---

5 Discussion
On the independence assumption Our primary objective to provide systematic analysis of how noise affects the performance and interpretability of CBMs. To isolate basic effects and to evaluate mitigation strategies in a controlled setting, we sought an experimental design in which concept noise and target noise can be manipulated independently. This design allows us to vary each factor without confounding and to attribute observed changes to a single source of corruption. For this reason, we considered the independence assumption a reasonable and transparent starting point for an initial analysis across a range of noise levels.
Nonetheless, we acknowledge that in real-world data, concept and target noise may be correlated. To account for this, include additional experiments under more realistic conditions, simulating a correlated noise scenario where concept corruption occurs only when the target label is flipped, thereby inducing dependence between concept and target noise. The corresponding results are provided in Appendix D.4. In summary, even under dependent noise, the positive association between uncertainty and susceptibility persists for susceptible concepts. This pattern remains consistent across noise levels and indicates that our analysis and mitigation approach are effective in more realistic correlated noise settings. However, as the dependent noise considered here still relatively simple, is important to account for more complex correlation structures that may arise in real-world data.
Benign appearance of target noise In our experiments, we observed that CBMs are highly sensitive to concept noise but relatively robust to target noise. This robustness can be attributed to the structure of the CBM, where the target predictor f. following prior work [19], is implemented as a single linear layer mapping concepts to the target. Its limited capacity makes it less able to overfit noisy target labels, reducing sensitivity to target corruption. Moreover, CBM training primarily burdens the concept predictor g. When y produces stable, accurate concept representations, /' operates on relatively clean inputs, so even severe target noise has a muted effect on final accuracy.
Generalization across CBM variants We primarily analyzed the impact of noise on CBMs using the most representative formulation, the original CBM [19]. To assess whether our methodology, particularly the application of SAM, generalizes to other CBM variants, we extend our analysis accordingly. Specifically, we evaluate several representative variants (e.g., CEM [61], ECBM [59], AR-CBM [14], and SCBM [52]) to investigate how the presence of noise influences their performance. As summarized in Appendix D.2, all variants exhibit clear degradation in both concept and task accuracy as the noise level increases.
We further investigate whether the ability of SAM mitigate the susceptible sets generalizes across different CBM variants. For SCBM, SAM showed clear improvements over SGD: at 20% noise, 75.8 vs. 74.9 (+0.9), and at 40% noise, 60.1 vs. 56.4 (+3.7). For AR-CBM and CEM, the gains were smaller: AR-CBM at 20% noise 71.9 vs. 71.3; at 40%, both 53.9; CEM at 20%, 73.3 vs. 73.1; 40%, 54.6 vs. 54.5. These results indicate that the benefits of SAM vary across CBM variants and that resilience to susceptible concepts may depend on the underlying model design. While our focus remains on CBMs, we acknowledge that developing a broader and systematic framework encompassing multiple variants is important for understanding generalization under noisy conditions.
Generalization across modalities CBMs are now being explored beyond vision, including settings that combine CBMs with large language models [49, 46]. The core CBM process first predicts concepts and then predicts the final target, which does not depend on a specific modality. Recent LLM based CBM studies employ a similar two stage design, so we expect our main findings to transfer to these settings. That said, concept annotated datasets for LLM are not yet systematically established. An important next step is to curate well-defined concept annotated datasets suitable for L.IM applications and to analyze how label noise in such datasets affects CBMs.
Rationale for employing SAM We adopted SAM based on prior findings by Baek et al. [2], which demonstrate that SAM is representative and often effective approach for alleviating label noise, and it can outperform alternative methods [62, 1, 17]. In our experiments, SAM also mitigated the impact of noisy concept annotations CBMs, particularly for susceptible concepts, confirming its suitability as a mitigation method in this setting. We do not claim that SAM is the only solution; rather, we present as one effective approach to the observed problem and note that identifying other suitable mitigation methods for different CBM variants is also important.

---

6 Conclusion
Further analyses Beyond the primary experiments, we undertook suite of supplementary studies to deepen evaluation of noise robustness in CBMss First, performed ablation studies comparing alternative training strategies across varying noise levels. Second, we benchmarked our framework against representative mitiigainn baselines. Third, we evaluated robustness several advanced CBM variants under diverse noise configurations. Finally, we carried out auxiliary experiments probing orthogonal aspects of resilience. Comprehensive results are available in Appendix D.
Comparisons Prior work has pursued robustness in related settings, yet each tackles a distinet aspect. Sinha et al. [44] analyzed adversarial perturbations of continuous concepts to develop defenses against malicious attacks, Sheth and Ebrahimi Kahou [42] enforced disentangled representations via auxiliary losses to improve generalization under distribution shifts, and Penaloza et al. [30] proposed a preference-optmmizatee objective to reduce noise sensitivity. In contrast, our study offers the first unified framework that measures, explains, and mitigates noise effects through the combined use of cerppness-wwar training and eneertainty-guidee correction. Theoretical analysis and extensive empirical evaluation substantiate the effectiveness of this unified approach.
Limitations Despite the substantial robustness gains provided by our framework, several limitations warrant further investigation. First, the method assumes well-calibrated uncertainty estimates, which an assumption that may not hold data-scarce or highly imbalanced regimes. Second, the reliance on linear target predictor, while beneficial for interpretability, may hinder generalization with more complex decision boundaries. Third, our study is confined to binary concept labels; extending the framework to hierarchical, multi-class, or continuous concepts remains promising avenue for future work. Addressing these limitations would further enhance the practical utility of CBMs in real-world environments characterized by noisy or incomplete supervision.
tasks
Future work Our research opens up new avenues for future research. First, extending our mitigation strategy to hierarchical, multi-class, or continuous concept spaces [32, 29] would enable applications such as fine-grained scene understanding and clinical severity grading. Second, the wider adoption of concept labels generated by large language models [60, 27, 45, 46] calls for systematic study of their noise properties and their downstream impact on CBMs, which may offer important insights for both annotation protocols and model design. Third, incorporating semi-supervised objectives [16] and using active selection to identify the most informative concepts can decrease reliance on expensive or error-prone human labeling. Progress in these areas will further advance the deployment of robust and interpretable CBMs in real-world scenarios where supervision is noisy or incomplete.
Closing remark This analysis of CBMs establishes three core contributions as follows:
Measuring impact We demonstrate that even moderate noise markedly diminishes the central strengths of CBMs (e.g., predictive performance, interpretability. and intervention efficacy) thereby revealing their vulnerability imperfect supervision.
i. Understanding mechanisms We disclose that a small subset of susceptible concepts can account for the majority of performance degradation. When these concepts coincide with misaligned representations in the target predictor, they trigger pronounced performance decline. ii.. Mitigating effects We propose a two-stage strategy: (i) sharpness- aware minimization during training, which stabilizes moise-sensitive concepts; and (ii) eepeettaint-guuidee intervention at inference, which corrects only the most unreliable concept predictions. Both components are theoretically motivated and supported by extensive empirical evidence.
Collectively, these contributions establish a principled framework for building concept- models that remain reliable and transparent in the presence of noisy supervision.
Acknowledgement
This work was partly supported by the Institute of Information & communications Technology Planning & Evaluation (ITTP) grants TRS-2019-1119106,, Artificial Intelligence Graduate School Program (POSTECH), RS-2022-11220959, (part2) Few-Shot learning of Causal Inference in Vision and Language for Decision Making), and the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) IRS-2023-00210466
10

---

References
[1] E. Arazo, D. Ortego, Albert, N. O'Connor, and K. McGuinness. Unsupervised label noise modeling and loss correction. In ICML, 2019.
[2] C. Back,, Kolter, and Raghumathan. Why is sam robust to label noise? In ICLR, 2024.
[3] M. Bahadori and D. E. Heckerman. Debiasing concept-based explanations with causal analysis. In ICLR, 2021.
[4] X. Chen, C.-J. Hsich, and B. Gong. When vision transformers outperform resnets without pre-training or strong data augmentations, In ICLR, 2022.
[5] Y.-C. Chen. A tutorial on kernel density estimation and recent advances. Biostatistics & Epidemiology, 2017.
[6] H. Cheng, M. Zhang, and J. Q. Shi. A survey on deep neural network pruning: Taxonomy, comparison, analysis, and recommendations. IEEE TPAMI, 2024.
[7] Deng, W. Dong. R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. Imagenet: large-scale hierarchical image database. In CVPR, 2009,
[8] Y. Dong, H. Su, J. Zhu, and F. Bao. Towards interpretable deep neural networks by leveraging adversarial examples. In AAAI Workshop on Network Interpretability for Deep Learning, 2019.
[9] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021.
[10] P. Foret, A. Kleiner, H. Mobahi, and B. Neyshabur. Sharpness-aware minimization for efficiently improving generalization. In ICLR, 2021.
[11] X.-J. Gui, W. Wang, and Z.-H. Tian. Towards understanding deep learning from noisy labels with small-loss criterion. In IJCAI, 2021.
[12] Y. Guo and R. Greiner. Optimistic active-learnig using mutual information. IJCAI, 2007.
[13] B. Han, Q. Yao, X. Yu, G. Niu, M. Xu, W. Hu, I. Tsang, and M. Sugiyama. Robust training of deep neural networks with extremely noisy labels. In NeurlPS, 2020.
[14] M. Havasi, Parbhoo, and Doshi Velez. Addressing leakage in concept bottleneck models. In NeurlPS, 2022.
[15] K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In CVPR, 2016.
[16] L. Hu, T. Huang, H. Xie, X. Gong, C. Ren, Z. Hu, L. Yu, P. Ma, and D. Wang. Semi-supervised concept bottleneck models. arXiv preprint arXiv:2406. 18992, 2024.
[17] I.. Jiang, 7. Zhou, Leung, L.-J. Li, and I.. Fei-Fei. Mentorne: Learning data-driven curriculum for very deep neural networks on corrupted labels. In ICLR, 2018.
[18] D. Kingma and J. Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
[19] W. Koh, Nguyen, Y. Tang. S. Mussmann, E. Pierson, B. Kim, and P. Liang. Concept bottleneck models. In /CML, 2020.
[20] D. D. Lewis. A sequential algorithm for training text classifiers: Corrigendum and additional data. In Acm Sigir Forum, 1995.
[21] D. D. Lewis and J. Catlett. Heterogeneous uncertainty sampling for supervised learning. In Machine Learning Proceedings. Elsevier, 1994.
[22] H. Li, A. Kadav, I. Durdanovic, H. Samet, and H. Graf. Pruning filters for efficient convnets. In ICLR, 2017.

---

[23] X. Ma, Y. Wang, M. E. Houle, S. Zhou, S. Erfani, S. Xia, S. Wijewickrema, and J. Bailey. Dimensionality-driven learning with noisy labels. In ICML, 2018.
[24] B. Mittelstadt, C. Russell, and S. Wachter. Explaining explanations in ai. In FAccT, 2019.
[25] C. Molnar. Interpretable Machine Learning- 2025, ISBN 978-3-911558-03-5, URL https: io/ // //hristtophm wwtpssophm.ggtuu..... gittuu..i/iitteteeeeeeeeeeeeeeee wwwinnerpreettleeeeeeeeeeee -olobbkk..
[26] R. Müller, Kornblith, and G. F. Hinton. When does label smoothing help? In NeurlPS, 2019.
[27] T. Oikarinen, S. Das, L. M. Nguyen, and T.-W. Weng. Label-free concept bottleneck models. In ICLR, 2023.
[28] OpenAl. ChatGPT. https://openai. http:/ppaaa...commmboo//cctttttt 2023.
[29] K. Panousis, D. Ienco, and D. Marcos. Coarse-to-fine concept bottleneck models. In NewrIPS, 2024.
[30] E. Penaloza, T. H. Zhang, L. Charlin, and M. E. Zarlenga. Preference optimization for concept bottleneck models. In ICLR Workshop on Human-Al Coevolution, 2025.
[31] G. Pereyra, G. Tucker, J. Chorowski, L. Kaiser, and G. Hinton. Regularizing neural networks by penalizing confident output distributions. 1rXiv:1701.0648. 2017.
[32] Pittino, V. Dimitrievska, and R. Heer. Hierarchical concept bottleneck models for vision and their application to explainable fine classification and tracking. Engineering Applications of Artificial Intelligence, 2023.
[33] G. Pleiss, T. Zhang, E. Elenberg, and K. Q. Weinberger. Identifying mislabeled data using the area under the margin ranking. In NeurlPS, 2020.
[34] Räuker, A. Ho, Casper, and D. Hadfield-Menell Toward transparent ai: survey on interpreting the inner structures of deep neural networks. In IEEE SaTML, 2023.
[35] C. Rudin. Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead. Nature machine intelligence 2019.
[36] C. Rudin, C. Chen, Z. Chen, H. Huang, L. Semenova, and C. Zhong. Interpretable machine learning: Fundamental principles and 10 grand challenges. Statistic Surveys, 2022.
[37] W. Samek, Wiegand, and K.-R. Müller. Explainable artificial intelligence: Understanding. visualizing and interpreting deep learning models. arXiv preprint /rXiv:/708.0820 2017.
[38] Y. Sawada and K. Nakamura. Concept bottleneck model with additional unsupervised concepts. IEEE Access, 2022.
[39] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra. Grad-cam: Visual explanations from deep networks via gradient-bar based localization. In ICCV, 2017.
[40] B. Settles, M. Craven, and S. Ray. Multiple-instamee active learning. In NeurlPS, 2007.
[41] C. E. Shannon. A mathematical theory of communication. The Bell system technical journal, 1948.
[42] Sheth and S. Ebrahimi Kahou. Auxiliary losses for learning generalizable concept-based models. In NeurlPS, 2023.
[43] S. Shin, Y. Jo, S. Ahn, and N. Lee. A closer look the intervention procedure of concept bottleneck models. In JCML, 2023.
[44] S. Sinha, M. Huai, J. Sun, and A. Zhang. Understanding and enhancing robustness of concept- based models. In AAAI, 2023.
[45] D. Srivastava, G. Yan, and T.-W. Weng. Vlg-chm: Training concept bottleneck models with vision-language guidance. In NeurIPS, 2024.
12

---

[46] C.-E. Sun, T. Oikarinen, B. Ustun, and T.-W. Weng. Concept bottleneck large language models. In ICLR, 2025.
[47] C. Szegedy, Vanhoucke, Ioffe, Shlens, and Z. Wojna. Rethinking the inception architec- ture for computer vision. In CVPR, 2016.
[48] C. Tan, J. Xia, L. Wu, and S. Z. Li. Co-learingg Learning from noisy labels with self-supervision. In ACM Multimedia, 2021.
[49] Z.. Tan, I.. Cheng, S. Wang, B. Yuan, J. Li, and H. Liu. Interpreting pretrained language models via concept bottlenecks. In PACKDD, 2024.
[50] S. Thulasidasan, T. Bhattacharya, J. Bilmes, Chennupati, and Mohd- Yusof. Combating label noise in deep learning using abstention. In ICML, 2019.
[51] L. Van der Maaten and G. Hinton. Visualizing data using t-sne. JMLR, 2008.
[52] M. Vandenhirtz. S. Laguna, R. Marcinkevičs, and J. Vogt. Stochastic concept bottleneck models. In NeurlPS, 2024.
[53] S. Wachter, B. Mittelstadt, and C. Russell, Counterfactual explanations without opening the black box: Automated decisions and the gdpr. Harvard Journal of Law & Techhology, 2017.
[54] C. Wah, S. Branson, Welinder, Perona, and Belongie. The caltech-uesd birds-200-2011 dataset. Technical Report CNS-TR- TTR-2011-001, California Institute of Technology, 2011.
[55] Q Wang, B. Han, T. Liu, G. Niu, J. Yang. and C. Gong. Tackling instance-dependent label noise via universal probabilistic model. AAAI, 2021.
[56] Y. Wang, X. Ma, Z. Chen, Y. Luo, J. Yi, and J. Bailey. Symmetric cross entropy for robust learning with noisy labels. In ICCV, 2019.
[57] A. Waswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. Gomez, L. Kaiser, and I. Polo- sukhin. Attention is all you need. In NeurlPS, 2017.
[58] Y. Xian, C. H. Lampert, B. Schiele, and Z. Akata. Zero-shot learning comprehensive evaluation of the good, the bad and the ugly. IEEE TPAMI, 2018
[59] X. Xu, Y. Qin, L. Mi, H. Wang, and X. Li. Energy-based concept bottleneck models: Unifying prediction, concept intervention, and probabilistic interpretations. In ICLR, 2024.
[60] Y. Yang, A. Panagopoulou, S. Zhou, D. Jin, C. Gallison-Buree and M. Yatskar. Language in bottle: Language model guided concept bottlenecks for interpretable image classification. In CVPR, 2023.
[61] M. E. Zarlenga, P. Barbiero, G. Ciravegna, G. Marra, F. Giannini, M. Diligenti, F. Precioso, S. Melacci, A. Weller, P. Lio, et al. Concept embedding models. In NeurIPS, 2022.
[62] H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz. mixup: Beyond empirical risk mini- mization. In ICLR, 2018
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Section 2, 3, and 4.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Section 6.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
14

---

Justification:
Appendix A and B.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: Detailed implementation instructions are provided in Appendix C.3.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
15

---

Answer: [Yes]
Justification: The datasets used in this study are publicly available. Detailed implementation instructions provided in Appendix C.3, and the complete code will be released upon publication.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (uttps://nips.. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results, See the NeurIPS code and data submission guidelines (https:
paips.cc/publl
ht//guidesss Codeeubmis sereebbmisssiiee caisooooiccyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Section 2.1 and Appendix C.3.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[Yes]
Justification: Section 2, 3, and Appendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
16

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Appendix C.3.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https /tttrrpp///urips... ccpps.cc///poo wwtppcccpppcceeeeeeeeeeeee wtt.eeetihhiiieeennncnnnenc
Answer:
[Yes]
Justification: The authors have reviewed the NeurlPS Code of Ethics and confirm that this research complies with its principles.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: This paper focuses on foundational research aimed advancing interpretable machine learning. As such, it does not directly engage with specific societal applications, making discussion of concrete societal impacts not applicable.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper does not involve the release of data models with high risk of misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification; All original sources of code and datasets used in this work have been appropri- ately cited, and their licenses and terms of use have been fully adhered to.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version the asset used and, possible, include URI
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g.. website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms use in package should be provided. For popular datasets, paperswi wwwodeettoo...... com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
18

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
This work does not introduce or release any new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moddl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This study does not involve crowdsourcing or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Bthies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This study does involve crowdsourcing or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
19

---

16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
Justification: LLMs were used for writing and editing assistance. They did not contribute to the core methodology, scientific rigorousness, or originality of the research.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: :/ops///n /ttp///een...///eeee for what should or should be described.
20

---

Contents
Theoretical Analysis for Sharpness-Aware Minimization for CBMs
B Theoretical Justification for Uncertainty-Basee Intervention
23
Experimental Details
24
C.1 Datasets
25
C.2 CBM Training Strategies
25
C33 Implementation Details
25
C,4 Label Noise Injection
26
C.5 Concept Selection Criteria
27
D Additional Experiments
27
D.I Effect of Training Strategies under Noise
27
D.2 Robustness CBM Variants under Noisy Supervision
................................
28
D.3 Additional Evidence of Disrupted Representation Alignment
28
D.4 Robustness under Diverse Noise Scenarios
29
D.5 Comparative Study of Noise Mitigation Methods
29
D.6 Evaluating Concept Noise L.M--Generated Annotations
30
D.7 Effect of Target Predictor Complexity
31
D.8 Impact of Noise Intervention Effectiveness
31
D.9 Comparison of Prediction Accuracy between SAM and BASE Optimizer
32
D.10 Robustness of CBMs across Backbone Architectures
32
D.11 Additional Evidence that Susceptibility Approximates Uncertainty
33
D.12 Concept-Level Qualitative Results
33
D.13 Noise Injection Protocol
34
A Theoretical Analysis for Sharpness-Aware Minimization for CBMs
Definition A.1 (2-Layer Concept Bottleneck Model (CBM)). In 2-layer CBM, the input x E Rd is used predict k binary concepts c [e1, 02, ..... Ck), where ej 10,1). The model consists of two layers. For each concept a shared first layer extracts intermediate activations, while a distinct second layer is specifically designed predict that concept:
First layer:
Wx, where W E Tgaxd is the weight matrix, and E m represents the intermediate activations.
Second layer: g(w,, (1),2) (1g, Wa.), where vy E IRm is the weight vector associated with concept Cj.
The predicted probability for each concept ej computed using the sigmoid activation:
1
o(g(w,, x))
1 e "(wy.a)
Definition A.2 (Binary Cross-Entropy (BCE) Loss). The Binary Cross-Entropy (BCE) loss for single concept 9j is defined as:
[(w,, -c; log(o(((()x - (1 c;) log(1 x(g(w,,))),
(4)
21

---

where g(w,, x) is the model output for concept cj. The total loss for all l concepts is given by:
C(
Σ I,
(5)
Definition A.3 (Sharpness-Aae Aware Minimization (SAM)). SAM optimizes the following objective to minimize the sharpness of the loss landscape:
min max L(w + x,,,C), W
(6)
TellaSp
where e {(2)) represents perturbations applied to W and v respectively, and p controls the magnitude of the perturbation. For 2-layer CBM, Ej = E is applied to W and Vj. respectively.
Before starting the analysis, we define the following variants of SAM:
1-SAM: Vw+el(w + e, x, = to + e, x)) wewee + 0i
Jacobian SAM: A J-SAM L(w + EE t) = to(-ff(w, V fw + E, E,
Here, J-SAM applies the SAM perturbation only to the Jacobian term. Baek et al. [2] has demon- strated that the majority of the effectiveness of SAM is also reflected in J-SAM. Following previous work, we analyze the efficacy of SAM in CBM using the J-SAM.
Proposition A.4. CBM with 2-layer deep linear network g(w,, (v), (vz, W x)). J-SAM introduces adaptive ez-reuularization on both the intermediate activations and the final layer weights.
Proof. The SAM update for the first-layer weight W in CBM is given by:
-Vw+em ((, =
( + 2.,
(7)
j=l
(o(go(u, - -c))))))) + { )xT
(8)
(o(g(w,, c, (a (o(((r),))) Gj22
)x
(9)
| | W. x, c)ll2
j=l
Vw((w,,,,c) p(a(g(w;,=))) -,,²² |V c)
(10)
where: Wx is the intermediate activation, and the SAM update for the second-layer weight uj given by:
-V
cyte 1 tE, = (a((g(,,,)) cW + )
(11)
(a((((w5,)) cW + E (g(u,, x)) ciuue
2f )x (12)
-V 0j) plo(g(w3, x)) cj)
Σ (o) -;) c0)1/ [VL(w, n c)ll
(13)
Proposition A.4 demonstrates that SAM introduces penalty based the intermediate activations zæ Vw w scaled by the squared prediction error, along with factors P and scalar factor. Additionally. SAM imposes weight norm penalty on the final-layer weights v, V., 2 |/ا ??, which is similarly scaled by the prediction error and a scalar factor. Following the original work, by regularizing the weight, SAM facilitates focused learning on clean data while mitigating the influence of noisy data by maintaining manageable loss levels for clean data and capping the loss growth for noisy data.
22

---

B Theoretical Justification for Uncertainty-Based Intervention
We present theoretical justification for selecting intervention concepts based predictive uncer- tainty in CBMss. Specifically, we show that uncertainty- -absed selection approximates the susceptible intervention set, i.e., the set of concepts whose correction yields the greatest expected improvement in task performance.
Let C = (C...... Gx) denote the vector of predicted concept values produced by CBM trained on potentially noisy concept labels, and let c* = .c....., Gg) denote the corresponding ground-truth concept labels. Let f be the target predictor and the task loss function.
Definition B.1 (Susceptibllity). The susceptibility of concept ca is defined as the expected reduction in loss achieved by correcting the prediction & to its ground-truth value dt
6 (z.9)) [e(f(C). y) ((f((Cs), v)l,
(14)
where قー denotes the concept vector è with the i-th entry replaced by ct.
Since 2 encodes the consequences training-tima time noise, 6, quantifies how the model's noise-induced uncertainty at inference translates into potential performance gains through targeted correction.
Definition B.2 (Predictive Uncertainty). The predictive uncertainty of concept e, quantified Shannon entropy [41]: = H(2)) = - log - - (1- log((1 -3)..
(3).
(15)
Definition B.3 (Concept Subsets). Let 5 = (f1..... 5x) and (uI,..., uk) denote the vectors of susceptibility and uncertainty across all concepts. We define the top-s subsets:
S (o) {i E [b]] 6, ranks among the top-8 8) U := (op,(u)
(16)
{i E [k] u, ranks among the top-s in u}
(17)
Our objective is to characterize conditions under which the uncertainty-ranin rrakedd set U approximates the true susceptibility-ranke ranked set S.
Assumption B.4 (Linear Target Predictor and First-Order Approximation). Assume the target predictor is linear: [(²) = w for some E TRik, and that l is differentiable.
Applying a first-order Taylor expansion of ((-s)) v) around C yields:
E(f(C- = ((f((). y) + Vel(f(e).)) (
(18)
dl
= =((f(E), y) +
(cf - -;);
(19)
which implies:
de
8, Rz E
(G: - 4)
(20)
0c;
By the chain rule:
08
0e
0f
dl
Wi,
(21)
06
0f
86
0f
0t
6,
E
W)
(22)
0f
Assumption B.5 (Lipschitz Continuity and Boundedness of Loss Gradient). Assume that the loss öt gradient 8f L--Lipschitz continuous:
de 0f (S1, σ5 (22 w) T.Js f2l for all fi, f2 E R.
Ot
(23)
Moreover, suppose that the predicted value f(c) lies within a bounded interval [a, b) C TR. Then, for any reference point E [a, it follows from Lipschitz continuity that:
0e (I().)
0l क.
S
(Jo v) L.()) - Sol M,
(24)
0f
for some constant M. This ensures that the gradient magnitude is uniformly bounded over the domain of interest.
23

---

Simplification. To isolate the effect of uncertainty, we assume |w;] is approximately constant across all concepts. Under this simplification and Assumption B.5:
8 Elia -c.1--
(25)
Assumption B.6 (Linear Relationship Between Uncertainty and Prediction Error). In binary classifi- cation, assume E (0, 1) and of E {0. 1). The expected absolute ervor is given by:
E| c: 28, (.))
(26)
Observe that both 21,(1 - (3) and the entropy H())) are symmetric about & = 0.5 and attain their maximum at this point. Assume that the expected absolute error approximately proportional the predictive uncertainty:
ElG; - - 7 for some 7 >> 0,
(27)
where u, H(C.) denotes the entropy- uncertainty of concept C2. Under this approximation, the susceptibility admits the following linear-nois. model:
d; oct, Eis
(28)
where a > O and e, is zero-mean noise term with finite variance. Definition B.7 (Kendall's Tau Distance), Given two rankings лs and Tu of l items, the Kendall's s Tau distance counts the number of discordant pairs:
T ( TT) == (((i,))
j. (TT(i) - (((())=<())))))))) (T) - Ta(i)) oH
(29)
Lemma B.8 (Ranking Consistency via Kendall's Tau). Suppose ô; = cru; + Si. where the es are independent, zero-mean, and have bounded variance. Let ws and Th denote the rankings induced by and u, respectively. Then as o² +
EIT TT)l +.
(30)
Proof. For any pair (i,j), we can write:
6, - 5, a(4 - Uz) + (c. -,)-
(31)
As o² + 0, the perturbation term 6; - S vanishes probability, Therefore,
P (s; σÿ) sign(u; u,)] - 0.
(32)
Summing over all concept pairs establishes the result.
Proposition B.9 (Approximate Recovery of the Susceptible Set). Under Assumption B.4 and B.5, and assuming the linear-noise model (28), the uncertainty-batt based top-s set U recovers the susceptibility- bused set S the low-noise regime:
lim P(u = 1. -0
(33)
Proof. By Lemma B.8, the rankings n. and na converge in probability as the noise variance σ² tends zero. Since both i4 and S are determined by the top-s indices in their respective rankings, their equality follows in the limit.
This analysis provides both intuitive and formal support for the of uncertainty-guidee interventions in CBMs. While the assumptions (e.g., constant weight or the approximate linear relationship between entropy and prediction error) may not hold strictly in practice, empirical evidence (see Figure 10) demonstrates a consistent and positive correlation between predictive uncertainty and susceptibility. validating the practical utility of this approach.
C Experimental Details
This section presents detailed information datasets, CBM training strategies, implementation settings, label noise injection, and concept selection criteria. Some content may overlap with the main paper.
24

---

C.1 Datasets
This study employs two real-world datasets that are widely used in prior work for evaluating the performance of CBMs under diverse conditions. CUB [54] is a -na-graided bird classification dataset consisting of 5,994 training and 5,794 test images. Following Koh al. [19]. we utilize 112 of the 312 most frequently occurring binary attributes for concept supervision [19, 61, 59]. AwA2 [58] benchmark for zero-shot learning comprising 37,322 images spanning 50 animal categories, each annotated with 85 binary attributes used as concept labels [59]. For both datasets, we adopt the preprocessing strategy described in Koh al. [19], applying random color jitter, horizontal flipping, and cropping to resolution of 224 224 during training. At inference time, images are center-cropped and resized to the same resolution.
C.2 CBM Training Strategies
Following Koh et al. [19]. we consider three training strategies for the concept predictor g and the target predictor f: (i) Independent: The two components are trained separately. The target predictor f is trained using the ground-truth concepts c via
= argmin Eex(t v,
(34)
while the concept predictor 9 is learned independently as
argmin Σ &cs (1)(()))))
(35)
At inference time, the final prediction is obtained by composing f()x)); (ii) Sequential: This strategy first trains the concept predictor 9 as above, and subsequently optimizes the target predictor f using the predicted concepts ((=); (iii) Joint: The concept and target predictors are trained simultancously by minimizing a combined loss:
f.g
argmin f.9
Σ
ey (x(((o( (0) Σ Nec
((((()
(36)
Here, fc, IR X XR + R4 denotes the loss function for the j-th concept, and by R X R. denotes the loss for target prediction. Our main experiments are conducted using the Independent strategy, and comparative results for the other strategies are provided in Appendix D.I.
C.3 Implementation Details
For concept prediction, fine-tune Inception V3 [47], pre-trained ImageNet [7], on the CUB [54] and AwA2 [58] datasets. The target predictor f is implemented as a single-layer linear classifier, following the standard setup in Koh et al. [19]. All experiments are conducted with three random seeds, and we report the average performance. Training and evaluation are conducted on NVIDIA GeForce RTX 3090 (24GB), RTX A6000 (48GB), and A100 (80GB) GPUs. The code is available at wttpgghhubb.oomoo---potttteeee
For the independent and sequential strategies, we trained with a learning rate of 10-3, All models are trained for 500 epochs using a batch size of and momentum of 0.9. We apply weight decay of 4 x 10-3 and reduce the learning rate by a factor of 0.1 when the validation loss does not improve for 10 consecutive epochs. Early stopping is triggered after 15 epochs. To address class imbalance in concept labels, adopt weighted cross-entropy loss as in Koh et al. [19]. For models trained with the SAM optimizer, the sharpness parameter p is selected via grid search over {0.01, 0.05, 0.1). while all other training hyper-paramedt are kept consistent with the baseline. The optimal p is selected based on task accuracy.
learning rate of 10-2; the joint model is
All additional CBM variants shown in Appendix D.2 are trained on the CUB dataset for 300 epochs using the Adam optimizer [18] with a fixed learning rate of 10-4, following Vandenhirtz et al. [52]. For the independently trained autoregressive CBM [14], training is scheduled such that two-thirds of the total epochs are allocated to learning the concept predictor g. and the remaining one-third to the target predictor f. consistent with Vandenhirtz et al. [52]. We employ ResNet-18 18 [15] as the
25

---

backbone for CEM, SCBM, and autoregressive CBM, and ResNet-101 for ECBM. The batch size is to 256 for CEM, SCBM, and autoregressive CBM models, and 64 for ECBM. When applying SAM to these models, we perform a grid search over p E {0.01, 0.05, 0.1), while keeping all other training syper-parameters aligned with those used for the Adam baseline.
We conduct a targeted hyperparameter search for each label noise mitigation technique evaluated in Appendix D.5, including label smoothing regularization (LSR) [47], symmetric cross-entropy learning (SL) [56], and SAM. For each method, we tune the corresponding parameters (see Table 4), such as the smoothing factor e for LSR, regularization coefficients a and 5 for SL, and the sharpness radius p for SAM, under varying levels of noise (7 E {0.0, 0.1, 0.2, 0.3, 0.4}). The best hyperparameters are selected based on task accuracy.
Table 4: Hyperparameter search ranges for label noise mitigation methods. Here, g and f refer the concept predictor and target predictor in the CBM framework, respectively.
Assignment
Method
Hyper-parameter
Search Range
Model
7 = 0.0
? == 0.1
7 = 0.2
? 0.3
initial L.
{0.01, 0.001, 0.0001]
}
g
0.0001
0.0001
0.001
0.0001
0.01
0.01
0.01
0.01
LSR
epsilon
[0.1, 0.2)
g
0.1
0.2
0.1
0.2
0.2
0.2
initial LR
{0.01, 0.001, 0.0001]
g
0.001
0.001
0.0001
0.01
0.01
0.01
0.01
0.001
1.0
5.0
0.1
SL.
alpha
(0.1, 1.0, 5.0)
5.0
0.1
beta
[0.1, 1.0]
g
0.1
0.1
0.1
1.0
0.1
0.1
1.0
1.0
initial LR
[0.01, 0.001, 0.0001)
g
0.0001
0.0001
0.0001
0.0001
0.01
0.01
0.01
0.001
SAM
rho
(0.1,
/
0.2
0.2
0.1
0.2
0.2
0.2
0.1
0.1
C.4 Label Noise Injection
To simulate real-world annotation errors, we introduce synthetic label noise following two widely used paradigms: symmetric noise and asymmetric noise [23, 50, 33, 13, 55, 11]. Additionally, consider grouped noise for concept corruption. These settings enable systematic evaluation of CBM robustness under varying noise conditions.
i. Symmetric noise. Each class label is randomly flipped to one of the remaining N - 1 classes with uniform probability. Specifically, for dataset with N classes, the probability of mislabeling a sample as any incorrect class is N-T. This simulates class-independen,, uniformly distributed noise. An analogous strategy is applied to concepts, where each concept label is flipped uniformly to a different one.
i. Asymmetric noise. Labels are deterministically flipped to adjacent classes in cyclic manner. Specifically, each class label reassigned to (i + 1) mod N, simulating structured noise patterns often observed in ordinal or semantically neighboring categories. For concept labels, a similar procedure is applied: the label of the i-th concept is flipped, and the label of the ((i + 1) mod K) concept is also perturbed, thereby modeling concept-level misannotations between adjacent semantic dimensions.
ii.. Grouped noise. Concept labels are randomly corrupted within predefined semantically coherent groups (e.g., "wing color"), representing annotation inconsistencies typically arising in domain- specific settings.
Symmetric noise captures general annotation uncertainty, asymmetric noise models systematic labeling biases, and grouped noise reflects domain-driven confusions within related concept groups. Together, these diverse noise settings constitute a comprehensive testbed for assessing the robustness of concept-based models. Experimental results under these conditions presented in Appendix D.4.
26

---

Figure 12: Task accuracy of CBMs trained with different strategies on the noisy CUB (left three) and AwA2 (right three) datasets. The radar charts illustrate task performance for the Independent (IND), Sequential (SEQ), and Joint (JoI) training paradigms under varying noise levels.
Table 5: Concept prediction accuracy of CBMs noisy CUB and Aw A2 datasets. Concept accuracies below 75% are highlighted, indicating significantly reduced interpretability under noise.
CUB
AWA2
STRATEGY
7
==0.1
7
7= 0.3
7=
7=
7 =
7
y=
7
IND
96.5kaa
93.8
91.6in.
89.1de.
85.4202
78.5=0s
78.42.0.
78.14
77.34ma
75.34m.
Seg
96.5+ta
93.8+u.
91.6t0.0
89. 14011
85.4
78.5=ox
78.4+t0s
78.1+t0.
77.3+0.
75.34o.
J01
92.4da.
85,91n.
78.41n.
67.6212
57.3
77.8=0a
74.2:104
70.1
65.41na
$7.41m2
C.5
Concept Selection Criteria
This section provides a detailed explanation of the concept selection criteria, extensively analyzed in previous work [43]. We present three criteria (Random, UCP, CCTP) addressed in the main paper, followed by additional criteria (LCP, ECTP, EUDTP) discussed in Appendix D.8.
i. Random. Concepts are selected uniformly at random as a baseline method, following Koh al. [19]. Formally, each concept assigned random score: 8; L((0, 1). This serves as reference for evaluating other selection criteria.
ii. Uncertainty of concept prediction (UCP). Concepts with the highest prediction uncertainty are prioritized [21, 20]. Scores are assigned using entropy: 8; = H(2). where H. denotes the entropy function. For binary concepts, this simplifies to 8; = 1/ 0.5|. This method selects concepts whose uncertainty potentially impairs target prediction accuracy.
iii. Contribution on concept on target prediction (CCTP). This criterion selects concepts based on their contributions to target predictions. Contributions are quantified as: 8; = Σ) C4 deg where fj is the output for the j-th target class, and M is the total number classes. This approach is inspired by interpretability methods for neural networks [39].
0f
iv. Loss on concept prediction (LCP), Concepts are selected based on the prediction loss compared
ground truth, defined 5; = G ca). lower prediction error typically correlates with improved target prediction. However, this method is impractical during inference since ground- truth labels
available test time.
Expected change in target prediction (ECTP). This criterion prioritizes concepts whose correction results in the greatest expected change in the target predictive distribution. Scores are (2a, (32,
()) + 2, KI. (We,= ll where DKL. is the Dallback-Leiblee divergence, and Dā==0 Ia denote target predictions after interventions. The intuition is to intervene concepts whose rectification significantly alters the target prediction [40]. vi. Expected uncertainty decrease in target prediction (EUDTP). Concepts that lead to the largest expected reduction in the entropy of the target predictive distribution upon intervention are selected. Formally, scores are defined as 8; = (1 2 ) =o) + 2 ( - H(7). This method favors concepts that substantially reduce target prediction uncertainty when cor- rected [12].
defined as 8; (1 - 2; DKL
D Additional Experiments
D.1 Effect of Training Strategies under Noise
CBMs can be optimized with three training paradigms: independent, sequential, and joint (see Appendix C.2 for details). We evaluate their robustness by reporting task-level and concept-level accuracy across different noise ratios Figure 12 presents task accuracy across training strategies,
27

---

40%
10%
40%
10%
40%
10%
40%
10%
(a) CEM
(b) ECBM
(c) Autoregressive CBM
(d) SCBM
Figure 13: Task accuracy of CEM [61]. ECBM [59], Autoregressive CBM [14], and SCBM [52]
under varying noise levels on the CUB dataset. Task accuracy consistently drops as noise increases.
Table 6: Concept prediction accuracy of CBM variants on the noisy CUB dataset under BASE and SAM optimization. Concept prediction accuracy declines with increasing noise in all cases.
BASE
SAM
METHOD
=
7= 0.1
7 0.2
7 0.4
0.0
7= 0.2
0.3
CEM
94.720.0
87.620.
79.2
69.820.
60.0:2.4
95.1
88.320.3
80.010.2
70.5
60.210.3
ECBM
96.410.2
95.7200
93.5
90.24.4
85.72a.
96.91s.1
94.120.
90.8=m0
86.410.
AR-CBM
95.1+a.
87.4 87.4+00
79.1+0.2
69.8+eo
60.0+ta2
95.5+a.
88.2+0.
80.1+0.2
70.8-aa
60.6+0..2
94.6
89.7500
83.240.
73.62oa
62.1
94.74b.1
90.2:0..
84.240.1
75.7=34
66.516.7
with accompanying radar plots visualizing noise tolerance; larger and more regular polygons reflect greater robustness to noise.
Every training paradigm suffers noticeable degradation as label corruption intensifies. On Aw A2, for instance, the joint model starts with the best clean accuracy but still drops from 88.8% 81. 81.7% when 40% of the labels are noisy. The independent and sequential variants fare even worse and largely collapse on CUB under the same noise level. Table 5 further reveals declines the concept level. Although the joint paradigm better preserves task-level performance, its concept accuracy plunges below 75% once the noise ratio rises above roughly 30% on CUB and exceeds about 10% on AwA2. Because the joint objective simultaneously minimizes task and concept losses, it compromises concept fidelity as label quality declines. These findings corroborate earlier evidence of perfommanc-intterpeaabiiil tradeoff [36] and underscore the need for training methods that preserve the robustness CBM under noisy supervision.
D.2 Robustness of CBM Variants under Noisy Supervision
We also investigate the effects of noise on several CBM variants, including CEM [61], ECBM [59], autoregressive CBM [14], and SCBM [52], trained on the CUB dataset with noise levels E [0.0, 0.4]. Figure 13 presents task accuracy, while Table 6 reports concept prediction accuracy under both the standard Adam optimizer (BASE) and Starpness-awan minimization (SAM).
All CBM variants exhibit notable degradation in both task and concept accuracy noise increases. Among them, ECBM achieves the highest concept accuracy across most settings, likely due to its energy-based formulation. However, its performance also deteriorates substantially under high noise levels, reaffirming the vulnerability of current CBM designs to noisy concept supervision. Training these variants with SAM provides modest but consistent improvements across all settings. These gains suggest that SAM offers generalizable enhancement to CBM robustness. Nonetheless, the overall sensitivity of all variants highlights the ongoing need for more resilient training strategies. In this regard, S SAM represents a promising direction for improving both performance and interpretability under noisy supervision.
D.3 Additional Evidence of Disrupted Representation Alignment
In Section 3.2, we illustrated how noise disrupts the representation alignment for the class Le Conte Sparrow. Here, we provide additional qualitative results for the class Brewer Blackbird, which demonstrates a comparable degradation pattern.
28

---

0.5
0.4
We-ght
0.3
0.25
0.2
0.3
300032
Camieppt
(a) Brewer Blackbird
Importance shift in key concepts
(c) Key concepts under 40% noise
Figure 14: Effect of noise on representation alignment. (b) Top 5 most influential (i.e., key) concepts for BREWER BLACKBIRD in clean setting and tracks how their influence shifts noise increases. (c) Top 5 influential concepts under 40% noise. In both figures, bars blue denote positive weights, while red indicate negative weights, illustrating how noise reshapes concept importance.
As shown in Figure 14, at moderate noise level (i.e., 20%), the relative ordering of predictive dimensions remains quite well preserved. In contrast, at higher noise levels (i.e., 40%), the saliency of informative dimensions deteriorates significantly, while irrelevant or spurious concepts become disproportionately influential. These findings further substantiate our conclusion that noise induces representational misalignment, and when this misalignment coincides with susceptible concepts, it becomes key driver of instability in CBMs under noisy supervision.
D.4 Robustness under Diverse Noise Scenarios
We further investigate CBM performance der realistic noise scenarios, specifically asym- metric [13] and grouped noise, using the CUB dataset. Asymmetric noise cyclically misla- bels categories (e.g., confusing similar animal species), while grouped noise randomly corrupts labels within similar concept groups (e.g., wing color) as discussed in Appendix C.4.
Concept Acc. (96)
96
Task Acc. (9%
5g
82
Syn
Syym
75
0.1
0.2
Noise Rate
Noise Rate Y
As shown in Figure 15, CBMs experience sub- stantial performance degradation under both noise types, broadly consistent with trends ob- served under symmetric noise. While both asymmetric and grouped noise lead slightly more pronounced declines in concept accuracy higher corruption levels (e.g., 40%), the overall performance patterns remain comparable. These findings indicate that CBMs are generally vulnerable to various forms of label noise, reinforcing the need for robustness strategies that extend beyond simple symmetric corruption and account for more realistic noise scenarios.
(a) Task accuracy
(b) Concept accuracy
Figure 15: Performance degradation under sym- metric, asymmetric [13] and grouped noise on CUB dataset across different noise levels.
Furthermore, beyond introducing noise independently, also considered more practical scenarios where concept and target noise can be correlated. To examine this case, we simulated a correlated noise model and evaluated the relationship between susceptibility and uncertainty. Specifically, first corrupted the target labels, and concept noise was injected only when the target label was flipped, thereby inducing dependence between concept and target corruption. As illustrated in Figure 16, the positive relationship between uncertainty and susceptibility remains evident for susceptible concepts. This trend is consistent across different noise levels, suggesting that our analysis and mitigation approach remain effective under more realistic correlated noise conditions.
D.5 Comparative Study Noise Mitigation Methods
To validate the effectiveness of SAM in mitigating noise, we compare with two representative baselines: label smoothing regularization (LSR) [47] and symmetric cross-entropy learning (SL) [56].

---

Normalized Entrpy Score
Normalized Entropy Score
Normalized Entroyy
5.00.605
Susceptible S.s-pp
Susceptible Non-suscApUble
Susceptibee 022
0/
a/s
0.
1.6
1.
Normalized Drop Concept Acouracy
Normalized Drop in Concept Acouracy
Normalized Drop Concept Accuracy
y= 0.1
(b) 0.2
(c) y = 0.3
Figure 16: Correlation between predictive uncertainty and susceptibility on CUB under realistic conditional noise model. The target label is corrupted first, and concept labels are corrupted only when the target has been perturbed. Pearson correlation coefficients (p) are reported separately for susceptible and non-susceptible sets, showing a positive correlation in the former.
LSR addresses overconfidence by softening class labels, while SL incorporates both standard and reverse cross-entropy losses to suppress the impact of noisy annotations.
Table 7 summarizes task and concept accu- racy across noise levels. Across all condi- tions, SAM consistently outperforms LSR and SL. Under clean supervision, SAM achieves task accuracy of 79.7%, surpass- ing LSR (72.8% and SL. (70.6%). Its ad- vantages are more pronounced under noise: at 20% and 30% corruption, SAM out- performs the second-best method by 6.1% and 8.4% in concept accuracy, respectively. These results demonstrate the robustness of SAM in noisy settings. While our evaluation focuses on selected methods, other techniques (e.g., co-teaching [48] or MentorNet (17]) offer promising alternatives through sample selection and teacher-student training. Integrating such techniques with CBMs represents a valuable direction for future work. Overall, these results position SAM as an effective and scalable approach for robust concept-based learning, as further supported by theoretical insights in Appendix A.
Table 7:
Comparison of concept and task accuracies across diverse label-noise mitigation methods on CUB.
NOISE RATIO
METHOD
METRIC
7.000
0.2
0.3
LSR
CONCEPT
TASK Ace
95.9=u.
72.8:0..
91.3+a0
60.4
86.5eau
46. 26.8
15.02129
70.7+77
CONCEPT Acc
95.0mmn
91.54a1
86.62n2
81.6122
TASK ACC
70.6+13
60.5+9.
48.0+17
27.0+75
CONCEPT Ace
97.3-us
95.1+a.1
92.7+0:
90.0e01
SAM
TASK Ace
79.7
67.7
50.4#20
26.6
D.6 Evaluating Concept Noise in LLM-Generated Annotations
Recent studies have explored using large lan- guage models (LLMs) automatically generate concept sets for CBMs [60, 27, 25]. We identify two main approaches to assess the noisiness of such annotations: (i) evaluating whether LLMs can define concepts accurately by comparing them to expert-curated datasets, and (ii) assess-
Table 8: Performance comparison between LLM- generated and ground-truth concept annotations.
CONCEPT
A ANNOTATION SIM.
TASK Acc.
LLM-BASED GROUND-TRUTH
21.8
74.3
ing whether LLMs can reliably annotate individual samples using a fixed expert-defined concept set. Here, we focus on the second approach. Using the concept vocabulary from the CUB dataset, we prompt an LLM (i.e., ChatGPT [28]) to annotate each target class.
As shown in Table 8, the resulting annotations agree with human-labeled ground truth only 21.8% of the time, revealing a significant misalignment. This highlights key issue, i.e., general-purpon LLMs often produce annotations that diverge from expert standards, introducing new source of noise. To assess the effect of this noise, we trained a CBM on the LLLM-anotater dataset. This model achieved 68.5% accuracy, a 5.8% drop from the baseline trained on expert annotations. Unlike traditional concept noise, which often stems from human inconsistency, Minduuddd noise may arise from the the limited domain grounding and generalization of model. These findings expose the current limitations of L.L --geeratdeedd concept supervision and reinforce the broader challenge of label noise in building robust and interpretable CBMs, particularly in high-stakes domains.
30

---

10
-3 5
3 3 8
2 T0
Thek ACC ON
Thsk ACC 194 &
Taa AUC 19A
10
3
100
3
M
of Intervercioos
of Inseppentonns
Df mnreantiooss
of Intrrmaioons
0f vnntiinttion
27 wt.. sesdoo
(h1
Tock Fob.
5d
(a) Random
(b) UCP
(c) CCTP
(d) LCP
(c) ECTP
(f) BUDTP
Figure 17: Impact of noise on the intervention effectiveness of CBMs using Random, UCP, LCP. CCTP, ECTP, EUDTP strategies under varying noise levels. The top row represents the CUB dataset, and the bottom row shows results for AwA2 dataset.
D.7 Effect of Target Predictor Complexity
Here, we examine how the structure of the target predictor affects robustness un- der noisy conditions. central premise CBMs is that linear predictor promotes interpretability; however, this simplicity may come at the cost of reduced expressive- ness, particularly in tasks requiring more complex decision boundaries. This trade- off makes the choice of f a critical design factor. To explore this, we replace the standard linear predictor with a shallow non-linear alternative (i.e., a two-layer feedforward network) and train both models under identical conditions.
Table 9: Performance comparison of the f model under different noise types and levels of non-linearity.
NOISE
OPTIMIZER
LINEARITY
7. 0.0
7= 0.2
= 0.4
LINEAR
74.3:0.3
50.3:.0.7
4.0=0.7
BASE
NON-LINEAR
73.5#0.2
47,412
3,620.3
LINEAR
79.0+t0.6
54.240.7
5.0-14
SAM
NON-LINER LINEAR
78.3:10.6
51.61:1.8
4.1
As shown in Table 9, the non-linear variant consistently underperforms its linear counterpart, with performance degrading more severely as noise increases. These results suggest that non-linear predictors more susceptible to overfitting noisy concept representations, thereby undermining generalization. Due to the concept bottleneck imposed by CBMs, increasing the complexity of f does inherently enhance predictive accuracy; rather, it can exacerbate the propagation of noise from the concept layer to the output. Overall, these findings indicate that under noisy conditions, simpler target predictors may offer greater robustness. However, this conclusion is drawn from a preliminary comparison between a linear and two-layer model. Exploring a broader range of non-linear architectures and incorporating regularization techniques may offer valuable insights into the trade-off between expressiveness and robustness.
D.8 Impact of Noise on Intervention Effectiveness
As outlined in Appendix C.5, we evaluate six concept selection strategies for intervention: Random, UCP, CCTP, LCP, ECTP, and EUDTP. While the main paper focuses on the first three, here we provide extended analysis of the remaining strategies (e.g.. LCP, ECTP, and EUDTP) for more comprehensive evaluation.
Figure 17 presents task accuracy improvements achieved through concept-level interventions on the CUB and AwA2 datasets under varying levels noise. Across both datasets, observe consistent pattern: the effectiveness of interventions diminishes as the noise level increases, irrespective of the intervention selection strategy. These findings corroborate our main results and further demonstrate that noise significantly compromises the reliability of concept-based interventions. Moreover, for all intervention methods, the upper bound on task accuracy (which corresponds to interventions applied to all concepts) systematically decreases with increasing noise levels. This downward trend underscores the importance of incorporating robustness-awes aware selection criteria when designing intervention strategies for noisy environments.
31

---

Table 10: Comparison concept and task accuracy between BASE and SAM on the CUB and AwA2.
NOISE
TRAINING STRATEGY
OPTIMIZER
METRIC
0.1
0.2
0.3
0.4
A
CUB [54]
DATASET
CONCEPT ACC
93.8
91.6+o.0
89.1+0.0
85.4
BASE
TASK ACC
$7.7=20
50.3
23.3
4.0=zu.7
INDEPENDENT
CONCEPT Acc
94.6#t.1
92.5#t0.1
89.7
86.3
+0.8
SAM
TASK ACC
61.8#1.8
54.2
28.5+114
5.0=14
+3.6
CONCEPT AcC
93.8+0.0
91.6-to.0
89.1+:0.0
85.4+t..1
BASE
TASK ACC
66.6:10.4
6
47.0+t1.7
6. 1.1.
SEQUENTIAL
CONCEPT ACC
94.6:10.1
92.5:t0.1
89.7::011
86.3:1..1
+0.8
SAM
TASK ACC
70.5#0.6
63.5
50.1
10.7#6.0
+4.0
CONCEPT Acc
85.910.5
78. 48.4
67.611.2
57.3
BASE
TASK ACC
75.2
69.2
59.8tv.3
50.1
JOINT
CONCEPT AcC
86.020.2
1
68.0+..8
57.940.3
+0.3
SAM
TASK
76.1
19.9.
60.810.4
50.6
+0.8
AWA2 [58]
DATASET
CONCEPT Acc
78.410..8
78.1 180.7
07.31:0.3
75.3
BASE
TASK ACC
85.5
82.3
77.1
41.9110
INDEPENDENT
CONCEPT Acc
78.620.7
78.5
77.940.7
75.911.
+0.5
SAM
TASK ACC
88.1
85.7+t04
78.6128
46.5
+3.0
CONCEPT Acc
78.4#0.8
18.1
77.3+o.
75.3
BASE
TASK ACC
87.6#t.3
85.8+t0.3
81.8+1.1
70.1
SEQUENTIAL
CONCEPT Acc
78.620.7
5
77.940.7
75.911.3
+0.5
SAM
TASK Acc
89.5
88.0
82.61a.1
69.626.3
+1.1
CONCEPT AcC
74.2:0..4
70. 10.1::0 1
65.4
57,410.2
BASE
TASK ACC
84.2
83.0+to.3
82.2+0.1
81.7
JOINT
CONCEPT ACC
74.9
72.7
67.7+0.7
58.9
+1.8
SAM
TASK ACC
89.0sto.1
88.4++0.2
87.3+0.2
86.6:50.3
+5.1
D.9
Comparison of Prediction Accuracy between SAM and BASE Optimizer
Table 10 reports the overall task and concept prediction accuracy of CBMs trained with SAM and the baseline (BASE) on the CUB and AwA2 datasets under various noise settings (y {0.0, 0.2, 0.4)). Across all noise levels and types, SAM consistently outperforms BASE in both concept and task accuracy, demonstrating its robustness to noise.
These results suggest that SAM is more effective than BASE at mitigating the impact of noisy labels, maintaining higher accuracy across different CBM training paradigms. On the CUB dataset, for example. SAM yields notable gains for both independent and sequential models, achieving average improvements of 0.8% and 3.6% in concept and task accuracy for independent, and 0.8% and 4.0% for sequential, respectively. On AwA2, the largest improvements are observed in the joint setting, with increases of 1.8% in concept accuracy and 5.1% in task accuracy. Overall, these findings confirm that SAM enhances CBM robustness across datasets and training strategies, effectively reducing the adverse effects of noise irrespective dataset characteristics.
D.10 Robustness of CB Ms across Backbone Architectures
To assess the impact of backbone architecture on the robustness of CBMs under noise, conduct experiments using two distinct architectures: ResNet-18 18 [15] and VIT-B/16 [9]. These models are trained on the CUB dataset with varying levels of noise (y {0.1, 0.2, 0.3, 0.4)). We also compare the performance of the standard SGD (i.e., BASE) optimizer with the SAM optimizer [10].
Table 1 presents the task and concept prediction accuracies for each configuration. Our findings indicate that, regardless of backbone architecture, CBMs experience significant performance degradation as noise increases. However, models trained with the SAM optimizer consistently exhibit improved robustness compared those trained with SGD. Specifically, SAM yields average task accuracy improvements of 5.07% for ResNet-18 and 7.31% for ViT-B/16 under noisy conditions.
32

---

Table 11: Impact of noise on different CBM backbones. CBMs implemented with ResNet- 18 and ViT-B/16 exhibit notable performance degradation under increasing levels of noise. The application of SAM consistently alleviates this degradation across all noise settings.
BASE
SAM
BACKBONE
METRIC
7
7
0.2
7
0.4
7
0.2
7 0.4
A
CONCEPT Acc
95.23
90.40
81.28
95.98
92.70
81.78
+1.19
RESNET-18
TASK Acc
69.14
49.14
0.90
73.32
60.55
0.52
+5.07
CONCEPT Acc
96.04
89.06
82.76
96.74
90.95
85.84
+1.89
VIT-B/16
TASK ACC
73.66
31.05
1.69
77.87
47.26
3.19
+7.31
These results align with the observations of Chen et al. [4], who demonstrated that ViTs are prone to converging sharp local minima, making them more sensitive to optimization challenges. The application of SAM, which promotes flatter loss landscapes, effectively mitigates this issue, leading to enhanced generalization and robustness. Consequently, while the choice of backbone architecture influences the degree of sensitivity to noise, the adoption SAM emerges as critical factor in enhancing the resilience of CBMs to noisy annotations.
D.11 Additional Evidence that Susceptibility Approximates Uncertainty
In Section 4.2, we demonstrated the CUB dataset that susceptibility can be effectively approximated by uncertainty. Here, we provide additional results on the AwA2 dataset, which exhibit similar trends.
As shown in Figure 18, positive correlation between uncertainty and susceptibility consistently appears across datasets. While the AwA2 dataset shows a mild negative correlation within the non- susceptible set, this does not contradict the strong positive relationship observed among susceptible concepts. These findings support that our analysis captures general and indeeedeend pattern.
Nomelzert E-teray Stooe
Nomeekzed srory Store
Eneropy Score
Nomettzed Entrrop
0.500
Suateztlee
Suxcstbiee
Suscept
Suscept Non-aacoettll
Suscept bd Nonvsacccctlee
60 222
64
do
a'2
25
1.
00 52
D4
1.2
Nomalzed Drop in Concept.oouuurg Acouracy
Nomalized Drop in Contept
Normalized Drop Concopt.Aocuuuccy
(a) 7 0.1
(b) 0.2
(c) 7 0.3
Figure 18: Correlation between uncertainty and susceptibility on AwA2. As with the CUB dataset, Pearson correlation coefficients (p) are reported separately for susceptible and non-susceptible sets, showing a positive correlation in the former. A negative correlation appears in the non-susceptible subset but does not alter the positive relationship observed for the susceptible subset.
D.12 Concept-Level Qualitative Results
In Section 2.3, we presented qualitative t-SNE [51] visualizations to illustrate how noise deteriorates the interpretability of learned concept representations. Here, we provide additional qualitative results focusing on subset of representative concepts related to bird morphology and coloration. Specifically, we examine the spatial clustering patterns of concept predictions for various bill shapes (e.g., Curved Bill. Spatulate Bill, and All Purpose Bill) as well as wing colors (e.g., Blue Wings and Orange Wings). These concepts were selected based on their semantic diversity and prevalence in the dataset. The resulting visualizations further confirm that increased noise disrupts the cluster structure of concept embeddings, reducing the ability of model to maintain separable and interpretable representations.
33

---

By
Cuvre (ym
taccal Acwes
Conact Nowee
Curved Bill
Spatuate
(b) Spatulate Bill
Aliquepone 1.
B1
Ai: puppppaee DJ
(c) All All-purpose Bill
Saae Winee Ey 3.00
Bss Winge Ey- 02)
Siue winge (y 4
(d) Blue Wings
Orange (y-00) 8)
Orange Winga 0.2)
Orange Wirg 1pm 24
Decre
(e) Orange Wings
Qualitative results: t-SNE [51] visualizations of various concept embeddings learnt in CUB with sample points colored red if the concept is active and blue if the concept is inactive in that sample. As noise ratio increases, the concepts are clearly entangled making concepts unreliable.
Figure 19:
D.13 Noise Injection Protocol
In Figure 6. noise injected at the concept level with different random seeds, which can substantially influence how the results are interpreted. To assess whether the same concepts are consistently identified as susceptible across different noise realizations (or whether susceptibility varies randomly) we report the susceptible concepts obtained for each seed in Figure 20. We find that similar concepts are repeatedly identified as susceptible across seeds, indicating structural sensitivity rather than random variation.
34

---

Seed1
100
Concept Acc, (%)
60
40
Seed2
100
Concept Acc, (%)
80
60
20
Mart Tee0s: of
ym02
Seed3
100
Concept Acc. (%)
80
60
40
20
faaae bod tof rob 2o hastenaded sasti 32d sino fosteatttaaaoo Mi2
Concept Index (Not Sorted)
Figure 20: Susceptible concept across random seeds. Susceptible concept sets are identified for each random seed, and similar concepts are consistently detected across seeds.
35


Reviews:
[{"review_id": "IgD00dgrnW", "reviewer": "Reviewer_B7SW", "summary": "This work investigates how label noise corrupts concept bottleneck models (CBMs), degrading their prediction accuracy, interpretability, and intervention utility. The authors identify that performance loss is caused by a vulnerable subset of concepts, those most sensitive to annotation errors. To address this, the authors introduce (1) sharpness-aware training to stabilize concept learning and (2) inference-time entropy ranking to detect and correct only the most noise susceptible concepts. The framework preserves CBM reliability under noise while maintaining full interpretability, supported by theoretical analysis and empirical validation.", "questions": "1. If only a small subset of concepts is susceptible noise, does this limit the practical impact of label noise on CBMs if they do not occur on susceptible noise?\n2. Figure 10 shows unclear separation between susceptible and non-susceptible concepts. Are these patterns consistent across different datasets. How many datasets have the authors evaluate?\n3. Is noise applied independently to each concept or the entire dataset? This significantly affects interpretation of the results.\n4. For globally applied noise, does the model consistently identify the same concepts as susceptible across different noise instantiations, or does susceptibility vary randomly? I suggest the authors track these susceptible concepts.\n5. Target noise does not affect the performance, even at 40% corruption, which seems odd. Why?\n6. In Figure 7, why do many initially low frequency concepts show frequency rise (2000x+) after noise injection?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. Investigating noisy labels in CBMs presents a meaningful study to learning with noisy labels.\n2. The work conducts extensive and thoughtful experiments, thoroughly analyzing the impact of noise across multiple dimensions.\n\nWeaknesses:\n1. Since SAM improves performance even on clean data, its specific role in mitigating noisy impacts remains unclear.\n2. The noisy impact is highly dependent on hyperparameters (e.g., epochs, learning rate) and noise type. These settings should be explicitly clarified in Sections 2–3 for reproducibility.\n3. Experiments were run across three different GPUs, making replication difficult. At minimum, the same hardware should be used for comparable experiments, and results should specify the GPU used.\n4. The observed noise effects resemble Subclass-Dominant Label Noise (SDN) [1], where intra-class attributes influence robustness. A direct comparison would strengthen the analysis.\n\n[1] Subclass-Dominant Label Noise: A Counterexample for the Success of Early Stopping", "was_revised": true, "final_justification": "The authors have provided a thorough response that addresses most of my concerns. As my primary issues have been resolved, I maintain my original score, 5 Accept.", "rebuttal": "We sincerely thank the reviewer for recognizing the value of our work and providing constructive feedback. We address the reviewer’s specific comments below and welcome any further discussion.\n\n---\n\n**Role of SAM under clean and noisy conditions**\n> Since SAM improves performance even on clean data, its specific role in mitigating noisy impacts remains unclear.\n\n\nThank you for this observation. SAM is known to enhance generalization even in clean settings, and we observe a similar effect for CBMs. Our primary focus, however, is not merely the generalization benefit of SAM but how SAM specifically mitigates label noise within CBMs. In particular, as shown in Table 2, we find that SAM tends to reduce prediction errors concentrated on **susceptible** concepts, i.e., those most sensitive to annotation errors. This indicates a selective, structural mitigation effect beyond an overall accuracy increase.\n\n\n---\n\n\n**Reproducibility**\n> The noisy impact is highly dependent on hyperparameters and noise type (e.g., epochs, learning rate). These settings should be explicitly clarified in Sections 2-3 for reproducibility.\n> Experiments were run across three different GPUs, making replication difficult. At minimum, the same hardware should be used for comparable experiments, and results should specify the GPU used.\n\n\nThank you for the thoughtful feedback. Most hyperparameters (e.g., epochs, learning rates) are specified in Appendix C.3. We agree that placing the essential settings in the main text would aid readers, and we will move the relevant details into Sections 2-3 in the final version.\n\n\nRegarding hardware, the majority of experiments were run on NVIDIA RTX 3090, with some on A6000 and A100 due to compute availability. Although not all comparisons were executed on identical hardware, all comparative experiments were performed under same conditions (e.g., random seeds and hyperparameters), so we believe that hardware differences do not materially affect the conclusions. To further strengthen reproducibility, we will re-run the experiments that were not on the 3090 so that comparable results are consolidated on the same GPU.\n\n\n---\n\n\n**Comparison with SDN**\n> The observed noise effects resemble Subclass-Dominant Label Noise (SDN), where intra-class attributes influence robustness. A direct comparison would strength the analysis.\n\n\nWe appreciate the pointer to this closely related work. There are clear parallels. For example, our t-SNE visualizations show entanglement across classes under noise, qualitatively similar to the observations of SDN. In addition, the noise setting of SDN is related to our grouped noise setting (Appendix C.4 and D.4). Interpreting the subclasses of SDN as units analogous to our concepts makes the similarity more apparent.\n\n\nA key difference is scope and objective. SDN focuses on a case where early stopping fails to alleviate label noise in DNNs and proposes a remedy. Our study quantitatively analyzes how concept noise affects interpretability, intervention effectiveness, and prediction accuracy in CBMs, and proposes an integrated mitigation framework spanning both training (SAM) and inference (uncertainty-guided intervention). We will incorporate an explicit discussion of SDN in the final version. Thank you for the valuable suggestion.\n\n\n---\n\n\n**Impact of label noise on susceptible sets**\n> If only a small subset of concepts is susceptible noise, does this limit the practical impact of label noise on CBMs if they do not occur on susceptible noise?\n\n\nThank you for the question. If noise does not occur on the susceptible set, the overall impact on a CBM can indeed be limited. While non-susceptible concepts may also experience some degradation, our results indicate that the aggregate performance drop is largely driven by noise on the susceptible concepts. Thus, we expect the effect of noise is substantially reduced when it does not target them.\n\n\n---\n\n\n**Susceptibility across datasets**\n> Figure 10 shows unclear separation between susceptible and non-susceptible concepts. Are these patterns consistent across different datasets. How many datasets have the authors evaluate?\n\n\nThank you for raising this point. While the main paper analyzes susceptibility on CUB, we agree it is important to examine whether the pattern generalizes. We therefore conducted the same analysis on AwA2 as an additional experiment; results are summarized below.\n\n\n`Correlation between uncertainty and susceptibility on AwA2`\n| Noise Ratio | Susceptible Concepts | Non-susceptible Concepts |\n|---|---|---|\n| $\\gamma$ = 0.1 | 0.540 | -0.560 |\n| $\\gamma$ = 0.2 | 0.355 | -0.382 |\n| $\\gamma$ = 0.3 | 0.175 | -0.167 |\n\n\nThese results suggest that a positive correlation between uncertainty and susceptibility persists across different datasets. While the AwA2 dataset exhibits a clear negative correlation within the non-susceptible set, this does not undermine the positive relationship observed in the susceptible set. This extension supports that our analysis captures a more general pattern.\n\n\n---\n\n\n**Noise injection protocol**\n> Is noise applied independently to each concept or the entire dataset? This significantly affects interpretation of the results.\n> For globally applied noise, does the model consistently identify the same concepts as susceptible across different noise instantiations, or does susceptibility vary randomly? I suggest the authors track these susceptible concepts.\n\n\nWe appreciate the question and suggestion. In the main paper, noise is applied at the concept level. Also, the susceptible concepts identified for each random seed are reported below.\n\n\n`Susceptible concepts across seeds`\n| Seed | Susceptible Concepts (Unsorted) |\n|---|---|\n| Seed 1 | 4, 7, 9, 10, 13, 20, 21, 23, 25, 28, 32, 39, 44, 53, 56, 58, 76, 77, 89, 91, 96, 102, 104, 107 |\n| Seed 2 | 4, 7, 10, 13, 20, 21, 23, 25, 28, 30, 32, 53, 56, 58, 75, 76, 77, 89, 91, 96, 102, 107 |\n| Seed 3 | 4, 7, 10, 13, 20, 21, 25, 28, 30, 36, 53, 56, 58, 63, 70, 75, 76, 77, 91, 96, 99, 107 |\n| Intersection | 4, 7, 10, 13, 20, 21, 25, 28, 53, 56, 58, 76, 77, 91, 96, 107 |\n\n\nWe observe that similar concepts are repeatedly identified as susceptible across seeds, suggesting structural sensitivity rather than random fluctuation.\n\n\n---\n\n\n**Why target noise appears benign**\n> Target noise does not affect the performance, even at 40% corruption, which seems odd. Why?\n\n\nThank you for raising this. In our CBM configuration, the target predictor $f$ follows prior work [1] and is a single linear layer from concepts to the target. Its limited capacity makes it less able to overfit noisy target labels, reducing sensitivity to target corruption. Moreover, CBM training primarily burdens the concept predictor $g$. When $g$ produces stable, accurate concept representations, $f$ operates on relatively clean inputs, so even substantial target noise has a muted effect on final accuracy. We will expand our discussion of this phenomenon in the final version.\n\n\n---\n\n\n**Concept frequency shift under noise**\n> In Figure 7, why do many initially low frequency concepts show frequency rise (2000x+) after noise injection?\n\n\nThank you for the question. Before noise injection, the dataset has a favorable signal-to-noise ratio and some concepts appear very rarely. Under uniform concept noise, each concept value is flipped with a fixed probability, which increases the chance that originally rare concepts appear due to random perturbations. As a result, low-frequency concepts can experience sharp relative increases in frequency. We view this as a distributional shift induced at the data-level by the noise process rather than a change in the model’s intrinsic prediction tendency.\n\n\n---\n\nReferences\\\n[1] Koh, Pang Wei, et al. \"Concept bottleneck models.\" ICML, 2020."}, {"review_id": "xTe6hFoqZy", "reviewer": "Reviewer_uGj9", "summary": "This paper examines how label noise, encompassing both concept label noise and task label noise, impacts Concept Bottleneck Models (CBMs). Specifically, this work shows that (1) a CBM’s task and concept accuracies are highly susceptible to noisy label annotations, (2) concept noise is the primary source of degradation, (3) concept-label-noise-induced degradation can be attributed to small set of “susceptible” concepts, which can then be targeted during intervention to improve the effectiveness of an intervention, and (4) noise-aware losses such as Sharpness-Aware Minimization (SAM) can alleviate some of the effects of label noise. This work evaluates all these elements primarily for traditional CBMs across two datasets: CUB and AwA2. This empirical evaluation is then complemented with two theoretical results on the effect of introducing SAM to a CBM’s training and on using concept uncertainty as a proxy for identifying the set of susceptible concepts.", "questions": "I am currently leaning towards rejecting this work, given that I am not entirely convinced that the results presented in this work, as they are currently framed, are substantially different from those discussed in previous works. Below, I list some questions whose answers I believe could potentially add clarity or further improve this manuscript. If I have misunderstood anything at any point, please do not hesitate to let me know (sorry in advance if so!).\n\n1. **[Significance + Originality, Critical]** I have some serious concerns regarding the novelty and significance of this paper. To help with this, it would help if you could elaborate on the following points: (1) Why are the results introduced in Section 2 not to be expected given known issues of training DNNs with noisy inputs? (2) Why are the results in Section 3.2 surprising, given that, as argued above, it is expected that in the limit, all noisy concepts will become indistinguishable? (3) Why are the SAM results in section 4.1 unexpected, given that SAM is a general-purpose optimization technique that can be applied to most DNNs, including CBMs, without much modification? (4) Why are the results in Figure 11 something unexpected, given that Shin et al. already discuss that in detail in their work? (5) How does the UCP baseline compare to the “susceptibility”-based intervention policy proposed earlier in the paper?\n2. **[Quality + Clarity, Critical]** Could the authors please explain why comparisons against other relevant CBM variants or mitigation pipelines were entirely pushed to the appendix without any discussion of them in the main paper’s body? For example, if results for other potential mitigation approaches are already in the appendix, why should one not discuss them in the main body, where SAM is evaluated? Similarly, if other CBM variants have been evaluated as part of the study, why not include those results in the main body? The decision to include these in an appendix that is barely discussed in the main paper seems unusual, as they are important baselines that one would expect to have as comparisons in the main figures, not hidden in the appendices. Because of this, I believe that this work may benefit from a potentially significant rewrite of the experimentation section, focusing more on unexpected aspects.\n3. **[Quality, Critical]** I have some concerns about whether SAM works in CBMs for the reasons claimed in this paper. For example, why do we not see similar improvements in robustness for other CBM variants (e.g., CEMs, ECBMs, etc) when we use SAM to train them (as seen in Table 6 of the appendix)?\n4. **[Significance + Quality, Major]** Why is the goal of this work different from that of Penaloza et al. [1], as argued in Section 5? That work also seems to propose a way for mitigating label noise in CBM models. I am aware that they don’t conduct a complete study of label noise on CBMs (instead, they assume that CBMs are sensitive to this noise), but the aim to mitigate the effect of this noise seems to be shared between this paper and [1]. Given that [1] may be considered concurrent to your work, however, I only mark this as a major concern rather than a critical concern (however, at the very least, [1] should be adequately characterised in this work).\n5. **[Quality, Minor]** What are the “embeddings” used in Figure 4? Are these CEM embeddings? If so, all of these important details should be immediately clear from the text.\n6. **[Quality, Minor]** Why are interventions done at a per-concept level rather than at a group-level for datasets such as CUB, where there are groups of known mutually-exclusive concepts? This approach deviates from standard practices when evaluating models on this dataset, so it would benefit from further clarification.\n\n### Minor Suggestions\n\nRegarding suggestions for the presentation, the following are possible very minor errors and typos that could be addressed before a camera-ready version:\n\n1. **[Nit, Potential Typo, Very Minor]** It is unclear what “it” refers to in “it first predicts…”  (line 24). If it is “CMBs”, then it should be “they” or, to make it even clearer, explicitly “CBMs” or “a CBM”.\n2. **[Nit, Presentation]** The use of a circular plot in Figure 1 for representing a noise vs accuracy relationship, rather than a standard/traditional simple scatter/line plot, is a bit unusual. This may be just my personal preference, but it is much easier to read a standard scatter plot in a horizontal fashion than in a radial fashion. As such, I would reconsider the choice of plot for this figure to make the paper easier to parse and read. A similar comment applies to Figures 12 and 13 in the appendix (the former could also benefit from a larger font for the labels).", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 1, "strengths_and_weaknesses": "Thank you for this very interesting work; I enjoyed reading it and found it easy to follow (thanks!). Below, I describe what I believe are this work’s main strengths and weaknesses:\n\n### Strengths\n\n1. **(S1) [Significance, Major]** This paper examines a highly popular XAI framework, namely concept bottleneck models (CBMs), from the perspective of robustness. As such, it has the potential to be of interest and use to a large subset of the NeurIPS community.\n2. **(S2) [Quality, Major]** The sheer number of evaluations in the entire paper is very large, although a significant chunk of them are left entirely in the appendix (and are not discussed at all in the main body of the paper). Within those experiments discussed in the main body, the figures and tables are, for the most part, really easy to parse, read, and understand.\n2. **(S3) [Originality, Minor]** Although, as argued below, this work’s originality could be stronger (as it mostly evaluates results that are to be expected given previous works), the theoretical results introduced in the appendix are interesting and new. This is particularly true for the results in Appendix B, as those in Appendix A are new but appear to be a simple readjustment of previous work by Baek et al.\n4. **(S4) [Clarity, Minor]** The paper is very clearly written and well-organized.\n\n### Weaknesses\n\n1. **(W1) [Originality + Significance, Critical]** Although it is always important to verify expected claims empirically and theoretically, in my opinion, most of the results presented in this work are to be expected based on well-known limitations of DNNs (not just CBMs). For example, if dataset noise increases, it is well-known and expected that we will struggle to learn a classifier (which, if used as the input of yet another classifier, as in CBMs, that new combined downstream classifier will also struggle). Similarly, if noise increases on features such as concepts, then it is expected that, in the limit, all concepts will become indistinguishable from each other.  Therefore, as noise increases, it is not unexpected that all concepts become equally (although spuriously) important to any model trained on them (as seen in Section 3). Similar points apply to the other observations/results of this paper (including intervention results and the mitigating experiments, which use an already-existing mitigation approach for DNNs to improve robustness in CBMs). Because of this, I have some hesitations about the potential novelty and contribution of this work vis-à-vis already well-established results.\n2. **(W2) [Quality, Critical]** The study of label noise in the main body of the paper is restricted uniquely to traditional CBMs. This leaves aside a wealth of better-performing, highly popular methods that have emerged since, including CEMs, ProbCBMs, ECBMs, Post-hoc CBMs, Label-free CBMs, Stochastic CBMs, and others. These are only discussed in the appendices. This seems like an odd decision given that they are important considerations. More importantly, however, looking at the SAM results for these baselines casts some doubts on whether the results improvements from SAM observed in CBMs in the main body of the paper properly generalize. Please see below for specific questions regarding this.\n3. **(W3) [Quality, Critical]** The evaluation of the proposed mitigation approaches is lacking a non-trivial evaluation baseline in the main body (i.e., not discussed in the appendix). This is particularly important if the main contribution for this mitigation pipeline is applying an already existing method to CBMs (if that's the case, then the novelty could be in explaining WHY one should use SAM over any of the other existing approaches to deal with label noise). Moreover, the SAM experiments would significantly benefit from explaining how SAM compares against recently proposed concept-specific methods that aim to handle the exact same problem (e.g., [1], although I am aware this paper might've come concurrently with this work). Similarly, the concept intervention experiments for the proposed policy in Figure 9 do not include any non-trivial intervention policies (e.g., Coop [1] or UCP and CCTP). These are later discussed in Figure 11, but they appear to be discussed as if these results were previously unknown. However, the efficacy of UCP w.r.t. a random baseline and CCTP was well-known from the paper that introduced both. What would be more relevant for this paper is to see how it compares to the policy “susceptibility”-based policy introduced here.\n4. **(W4) [Clarity, Major]** Many key results are included and discussed only in the appendix (e.g., comparisons for different CBMs, against other mitigation strategies, etc). Yet, several of these appendix experiments are critical and more important than those expected from previous works, such as those in Section 2 and Figure 11. Therefore, I would strongly suggest that the authors reconsider the structure and discussion of these results in the main paper. At the very least, the main takeaway of the results discussed in the appendices should be included in the main paper (currently, there is no easy way to navigate the appendices other than reading them end-to-end, as there are no mentions of the main messages of each appendix anywhere in the main body of the paper). \n5. **(W5) [Quality, Major]** Some of the experiments, for example, the results summarized in Figure 1 and the visualizations reported in Figure 4, are hard to interpret or are missing key details. See below for specific questions.\n\n### References\n\n1. Penaloza et al. Preference optimization for concept bottleneck models. In ICLR Workshop on Human-AI Coevolution, 2025.\n2. Chauhan et al. \"Interactive concept bottleneck models.\" *Proceedings of the AAAI Conference on Artificial Intelligence*. Vol. 37. No. 5. 2023.", "was_revised": true, "final_justification": "I have increased my score to a \"Borderline accept\" (4) after the rebuttal by the authors. This is because, although I believe there is value in verifying expected results do hold in practice, I am still struggling to frame most of the results in this work (except from those regarding the susceptible concept set) as entirely unexpected/novel results. Nevertheless, given that this is a well-written paper with a lot of empirical evaluations of important scenarios, I can see its value even if the core ideas are not entirely novel. As such, I am a borderline with a slight tendency towards acceptance as NeurIPS may not be the best venue for this type of work.\n\nTo further understand this reasoning, please refer to my comment in our rebuttal discussion where I outline how the authors addressed some of my concerns.", "rebuttal": "We sincerely thank the reviewer for the thoughtful, constructive, and detailed feedback. We address the reviewer’s specific comments below and welcome any further discussion.\n\n---\n\n**Unexpected findings**\n\nWe appreciate the reviewer’s point. This work, however, presents results that were not previously documented and are difficult to anticipate.\n\nFirst, it is commonly believed that CBMs allow one to correct the final prediction via intervention even when a concept is mispredicted. From this view, one might expect that models trained with noisy concepts would readily recover performance through intervention. Our experiments contradict this expectation. As shown in Section 2.4, when CBMs are trained on datasets with concept noise, the intervention effectiveness itself is substantially reduced, so the expected recovery does not materialize. Given that real deployments often rely on concept sources with nontrivial noise, this indicates that intervention may fail to operate as intended and can lead to unexpected failure.\n\nSecond, CBMs degrade in a qualitatively different manner from standard DNNs under the same noise level. For example, on the CUB classification task with 0%, 20%, and 40% noise, a DNN exhibits a relatively moderate decline (79.7 → 65.9 → 53.0), whereas a CBM shows an abrupt collapse (74.3 → 50.3 → 4.0). This occurs because the two-stage structure of CBM propagates errors in concept prediction directly to the target predictor. The evidence shows that CBMs are considerably more vulnerable to concept noise than is typically assumed.\n\nThese findings reveal an inherent sensitivity of CBMs to concept noise and underscore the need to recognize this vulnerability and develop appropriate mitigation techniques in order to build reliable CBMs.\n\n---\n\n**Significance of our work**\n\nWe appreciate the constructive comment. The significance of our study can be summarized in three parts.\n\n* To our knowledge, this is the first systematic analysis of the noisy concept annotation problem in CBMs, a practical issue that can arise from human error and subjective judgment yet has remained largely unattended. We show, through multi-faceted analyses, that such noise negatively affects all core CBM properties: interpretability, intervention effectiveness, and predictive performance.\n\n* We find that degradation is not uniform across concepts. Rather, it concentrates on a subset that is **susceptible** to noise. This small set explains most of the accuracy decline and therefore drives the overall performance drop.\n\n* To mitigate the risks posed by susceptible concepts, we propose sharpness-aware minimization during training and uncertainty-guided intervention at inference. We provide broad empirical results and theoretical support demonstrating that these strategies are effective at restoring the reliability of CBMs.\n\n---\n\n**Why SAM**\n\nWe understand the reviewer’s concerns. We adopted SAM because prior work by Baek et al. [1] indicates that SAM is a representative and often effective approach for alleviating label noise, and it can outperform alternative methods [2, 3, 4]. In our experiments, SAM also handled noisy concept annotations in CBMs, especially for susceptible concepts. As noted in Appendix D.3, we do not claim SAM is the only solution; rather, for the purposes of this work, we present it as one effective approach to the observed problem.\n\n---\n\n**Compare to [5]**\n\nThank you for the comment. We clarify the differences from the concurrent work [5]. While [5] shares the motivation that CBMs are sensitive to label noise, it primarily focuses on improving the learning objective, assuming this sensitivity without further investigation. It does not provide a comprehensive analysis of how noise affects all key CBM components (e.g., interpretability, intervention effectiveness, and predictive performance). In contrast, our work quantifies noise effects across these core properties, identifies their causes, and proposes an integrated mitigation framework spanning both training and inference. We will make this distinction clearer in the main text.\n\nWe also conducted additional comparisons between SAM and CPO from [5], which modifies the loss from a preference optimization perspective and focuses primarily on joint CBM training, with sequential training as a secondary case. We report comparisons between them in the table below.\n\n`Concept Accuracy`\n|Model|Type|0%|10%|20%|30%|40%|Avg|\n|-|-|-|-|-|-|-|-|\n|CBM(seq)|Vanilla|94.9|89.0|81.0|71.1|60.6|79.3|\n|“|CPO|95.5|89.9|80.6|70.3|60.0|79.3|\n|“|SAM|95.3|90.0|82.4|**72.3**|**61.3**|80.3|\n|“|CPO+SAM|**95.7**|**91.3**|**82.7**|**72.3**|60.7|**80.5**|\n|CBM(joint)|Vanilla|94.6|88.5|80.3|70.4|60.2|78.8|\n|“|CPO|70.5|64.5|61.9|58.8|53.9|61.9|\n|“|SAM|**95.2**|**89.4**|**81.6**|**71.5**|**60.9**|**79.7**|\n|“|CPO+SAM|70.8|66.3|63.0|58.9|53.8|62.6|\n\n`Task Accuracy`\n|Model|Type|0%|10%|20%|30%|40%|Avg|\n|-|-|-|-|-|-|-|-|\n|CBM(seq)|Vanilla|66.5|48.2|33.8|17.5|5.0|34.2|\n|“|CPO|68.8|51.9|32.9|15.0|5.0|34.7|\n|“|SAM|69.0|52.1|**37.5**|**20.0**|**6.1**|**36.9**|\n|“|CPO+SAM|**69.5**|**54.9**|36.4|18.5|5.4|**36.9**|\n|CBM(joint)|Vanilla|66.0|52.2|34.8|16.2|4.6|34.8|\n|“|CPO|70.6|63.5|55.8|47.3|36.1|54.7|\n|“|SAM|69.9|54.5|37.0|16.8|5.0|36.6|\n|“|CPO+SAM|**73.7**|**67.3**|**60.0**|**51.1**|**40.6**|**58.5**|\n\nThe main takeaways are: (1) In joint training, CPO tends to yield higher target accuracy, while SAM tends to preserve concept accuracy better; (2) In sequential training, SAM generally outperforms CPO, and combining the two can sometimes achieve the highest performance. These results suggest that two approaches are complementary and potentially usable together.\n\n---\n\n**On Appendix materials**\n\nThank you for the helpful comments. We placed the label noise mitigation experiments in the Appendix because the alternative methods did not achieve improvements comparable to SAM, so we treated them as supporting results. We referenced these analyses in the main conclusion under “further analyses”, and in the final version we will make the connection to Section 4.1 explicit.\n\nWe also placed SAM on CBM variants experiments in the Appendix because they showed trends similar to the main results and due to space constraints. In light of your comments, we revisited these analyses and added further evaluations across CBM variants. In particular, we examined the effect of SAM on susceptible concepts. For SCBM, SAM showed clear improvements over SGD: at 20% noise, 75.8 vs. 74.9 (+0.9), and at 40% noise, 60.1 vs. 56.4 (+3.7). For AR-CBM and CEM, the gains were smaller: AR-CBM at 20% noise 71.9 vs. 71.3; at 40%, both 53.9; CEM at 20%, 73.3 vs. 73.1; at 40%, 54.6 vs. 54.5.\n\nThese results indicate that the effect of SAM differs across CBM variants, and that resilience on susceptible concepts may depend on model design. While our study centers on CBMs, we agree that a systematic analysis across variants is important; we will reflect these points in the main text and consider a broader framework that covers such generalization in future work.\n\n---\n\n**Uncertainty-guided intervention**\n\nThank you for the comment. There seems to be some confusion regarding Figure 11. Our goal there is not to newly propose uncertainty guided intervention, but to analyze why this strategy becomes more effective when label noise is present. We state this explicitly in the paper. Our new observation is that the relative improvement of uncertainty-guided intervention increases as noise grows, a point that was not detailed in [6].\n\nThe core message of Figure 9 is that prioritizing interventions by susceptibility is effective. To make this clear, we compare the susceptibility-based policy not only with a random policy but also with stronger baselines. The comparative tables are included below.\n\n`Noise 10%`\n|Task Acc.|0|1|2|3|4|5|\n|---|---|---|---|---|---|---|\n|Susceptibility|61.9|**69.2**|**74.8**|**79.7**|**83.7**|**86.1**|\n|UCP|61.9|66.1|69.3|72.4|75.3|77.6|\n|CCTP|61.9|62.3|62.9|63.7|64.8|66.3|\n|Random|61.9|62.8|63.5|64.4|65.1|65.9|\n\n`Noise 20%`\n|Task Acc.|0|1|2|3|4|5|\n|---|---|---|---|---|---|---|\n|Susceptibility|51.9|**65.3**|**75.0**|**82.0**|**86.6**|**89.4**|\n|UCP|51.9|57.7|63.1|68.0|71.8|75.3|\n|CCTP|51.9|52.8|54.1|55.8|57.9|59.8|\n|Random|51.9|53.2|54.8|55.9|57.4|58.7|\n\n`Noise 30%`\n|Task Acc.|0|1|2|3|4|5|\n|---|---|---|---|---|---|---|\n|Susceptibility|33.1|**47.5**|**60.8**|**71.3**|**78.7**|**83.3**|\n|UCP|33.1|38.4|44.0|49.6|54.3|58.9|\n|CCTP|33.1|34.2|35.7|37.9|40.9|43.7|\n|Random|33.1|34.3|35.9|37.6|38.9|40.5|\n\nThese results show that prioritizing susceptible concepts remains an efficient intervention policy even against non‑trivial strategies such as UCP and CCTP. Accordingly, we believe the validity of our core intervention strategy is well supported.\n\n---\n\n**Minor points**\n\nWe appreciate the careful, detailed feedback. We will correct the noted typographical issues and revise figures to improve readability in the final version. The embeddings in Figure 4 refer to the representations produced by the concept predictor $g$. Interventions are conducted at the individual concept level to analyze the effect of each concept on prediction through controlled intervention. If group-level evaluations are preferred, we are happy to add those experiments upon request.\n\n---\n\nReferences\\\n[1] Baek, Christina, Zico Kolter, and Aditi Raghunathan. \"Why is SAM robust to label noise?\" ICLR, 2024.\\\n[2] Zhang, Hongyi, et al. \"mixup: Beyond empirical risk minimization.\" ICLR, 2018.\\\n[3] Arazo, Eric, et al. \"Unsupervised label noise modeling and loss correction.\" ICML, 2019.\\\n[4] Jiang, Lu, et al. \"Mentornet: Learning data-driven curriculum for very deep neural networks on corrupted labels.\" ICML, 2018.\\\n[5] Penaloza, Emiliano, et al. \"Preference optimization for concept bottleneck models.\" ICLR Workshop on HAIC, 2025.\\\n[6] Shin, Sungbin, et al. \"A closer look at the intervention procedure of concept bottleneck models.\" ICML, 2023."}, {"review_id": "2nVc2b6uDk", "reviewer": "Reviewer_s86p", "summary": "This paper presents a comprehensive study on how noisy concept annotations affect Concept Bottleneck Models (CBMs), which are designed to enhance interpretability in machine learning by predicting human-understandable concepts before making final predictions. The authors demonstrate that even moderate levels of noise in concept labels can significantly degrade CBM performance across three dimensions: predictive accuracy, interpretability, and the effectiveness of human interventions. They identify a subset of concepts that are disproportionately affected by noise and are primarily responsible for the observed performance degradation.\n\nTo understand the mechanisms behind this vulnerability, the authors analyze how noise impacts individual concept predictions and their alignment with target outputs. They find that noise does not affect all concepts equally. A small group of concepts suffers severe accuracy drops, often due to semantic ambiguity or low frequency in the dataset. These “susceptible concepts” also tend to be the most influential in determining the final prediction, meaning their corruption has an outsized impact. Furthermore, noise disrupts the alignment between concept representations and target predictions, leading to misinterpretations and reduced model reliability.\n\nTo mitigate these effects, the authors propose a two-stage framework. During training, they apply Sharpness-Aware Minimization (SAM), which encourages the model to find flatter minima in the loss landscape, thereby improving robustness to noisy labels. SAM is shown to significantly improve both concept and task accuracy, especially for the susceptible concepts. During inference, they introduce an uncertainty-guided intervention strategy that prioritizes correcting the most uncertain concept predictions. This approach leverages entropy as a proxy for susceptibility, enabling targeted corrections that restore much of the lost performance with minimal intervention.\n\nThe paper provides both theoretical and empirical support for the proposed methods. The authors derive formal justifications showing that predictive uncertainty correlates with susceptibility under reasonable assumptions. Empirical results across multiple datasets and CBM variants confirm that combining SAM with uncertainty-guided interventions consistently outperforms baseline methods. Notably, correcting just a few highly uncertain concepts can recover performance close to that of models trained on clean data, even under high noise conditions.\n\nThis study offers a principled and practical framework for enhancing the robustness of CBMs in noisy environments. It highlights the importance of identifying and protecting noise-sensitive concepts and demonstrates that targeted training and inference strategies can preserve both interpretability and predictive power. The authors also discuss limitations, such as the reliance on binary concept labels and linear predictors, and suggest future directions including extensions to hierarchical or continuous concepts and the integration of semi-supervised learning. This work lays a strong foundation for deploying interpretable models in real-world settings where annotation noise is inevitable.", "questions": "What are the main factors beyond ambiguity and low prevalence in the dataset that make certain concepts more susceptible?\n\nHow does SAM improve the robustness of CBMs compared to other noise mitigation techniques?\n\nWhy do you think predictive entropy is a good surrogate for susceptibility? Can you explain the intuition?\n\nHow do you think your results might generalize to other modalities?\n\nHow do you think real world noise might differ from the simulated noise in this study, and how might that alter your results?", "limitations": "Limitations are thoughtfully considered and addressed within the paper.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n-\tThis is the first comprehensive study that systematically investigates the impact of noisy concept annotations on CBMs.\n-\tThe paper is well written with clear language and a clear articulation of the problem the authors seek to address.\n-\tThoughtful experiments by the authors lead to insightful results around the subset of concepts responsible for degrading performance.\n-\tThe mitigation strategies proposed are both theoretically sound and empirically validated.\n-\tThe authors consider the practical implications and limitations of their work.\n\nWeaknesses:\n-\tThe paper only gives consideration to one modality, vision, and does not touch on generalizability to other modalities.\n-\tThe noise is simulated and random, which may not reflect real world noise in annotations.", "was_revised": true, "final_justification": "I thank the authors for their additional comments and answers to my questions. My final score remains the same.", "rebuttal": "We sincerely thank the reviewer for recognizing our work as insightful and comprehensive, and for providing thoughtful feedback. Below, we address the specific comments and welcome any further discussion.\n\n---\n\n**Why SAM improves robustness**\n> How does SAM improve the robustness of CBMs compared to other noise mitigation techniques?\n\nThank you for the insightful question. SAM optimizes by attenuating the sharpness of the loss landscape, which reduces the model’s sensitivity to noise and small perturbations. This, in turn, curbs unnecessary overfitting and promotes more stable learning under label noise. In addition, we observe that SAM tends to reduce errors specifically on susceptible concepts, providing a selective and structured mitigation where noise-induced errors concentrate.\n\nFurthermore, our theoretical analysis shows that, within the CBM structure, SAM implicitly induces an $\\ell_2$-regularization effect on the final layer weights and intermediate activations, thereby lowering the sensitivity of the model to label corruption. This analysis explains why SAM yields stronger robustness in CBMs than alternatives that do not influence these internal mechanisms as directly.\n\n---\n\n**Predictive entropy as a proxy for susceptibility**\n> Why do you think predictive entropy is a good surrogate for susceptibility? Can you explain the intuition?\n\nThank you for the thoughtful question. The intuition is as follows. When a concept label is noisy, the corresponding concept does not present a consistent pattern in the data and thus is not learned reliably during training. The model then struggles to form a confident decision for that concept, which manifests as high predictive entropy. In contrast, informative and consistent concepts typically yield low entropy because the model can make confident predictions. Based on this intuition, we regard predictive entropy as a practical indicator of concept susceptibility.\n\n---\n\n**Generalization across modalities**\n> How do you think your results might generalize to other modalities?\n\nThank you for the question. CBMs are now being explored beyond vision, including settings that combine CBMs with large language models [1, 2, 3]. The core CBM process first predicts concepts and then predicts the final target, which does not depend on a specific modality. Recent LLM based CBM studies employ a similar two stage design, so we expect our main findings to transfer to these settings.\n\nThat said, concept annotated datasets for LLM are not yet systematically established. An important next step is to curate well-defined concept annotated datasets suitable for LLM applications and to analyze how label noise in such datasets affects CBMs.\n\n---\n\n**Real world noise**\n> How do you think real world noise might differ from the simulated noise in this study, and how might that alter your results?\n\nThank you for the important question. In the main paper, we focus on uniform noise, but Appendix D.4 includes additional experiments under more realistic conditions (e.g., asymmetric, grouped noise). These experiments indicate that our core findings remain qualitatively stable.\n\nBecause real world noise often depends on particular concepts and on their relation to the target, we also simulate noise with dependencies between them. Specifically, we first corrupt the target label and then add concept noise only when the target has been changed. The results below summarize the correlation between uncertainty and susceptibility under this practical setting.\n\n`Correlation between uncertainty and susceptibility on practical noise`\n| Noise Ratio | Susceptible Concepts | Non-susceptible Concepts |\n|---|---|---|\n| $\\gamma$ = 0.1 | 0.646 | -0.487 |\n| $\\gamma$ = 0.2 | 0.624 | -0.315 |\n| $\\gamma$ = 0.3 | 0.549 | -0.128 |\n\n\nEven when noise exhibits such dependence, the positive correlation between uncertainty and susceptibility persists. We agree that considering diverse noise types is essential for broad applicability, and we appreciate the suggestion.\n\n---\n\n**Additional factors behind susceptibility**\n> What are the main factors beyond ambiguity and low prevalence in the dataset that make certain concepts more susceptible?\n\nThank you for the valuable question. Beyond ambiguity and low prevalence, we believe two additional properties can increase susceptibility: (1) **Context dependence.** Even for the same concept, its visual realization can vary with class, pose, or background, creating polymorphism. In such cases, the mapping from input $x$ to concept $c_i$ can become locally nonstationary, which destabilizes the decision boundary and leads to large performance drops even under mild noise; (2) **Inter-concept correlation.** When concepts are correlated, or when concept predictor $g$ shares internal representations across concepts, noise can interfere through these shared components, indirectly perturbing neighboring concepts and making their decision boundaries less stable.\n\n---\n\nReferences\\\n[1] Tan, Zhen, et al. “Interpreting pretrained language models via concept bottlenecks.” Pacific-Asia Conference on Knowledge Discovery and Data Mining, 2024.\\\n[2] Sun, Chung-En, et al. “Concept bottleneck large language models.” ICLR, 2025.\\\n[3] Bhan, Milan, et al. “Towards Achieving Concept Completeness for Textual Concept Bottleneck Models.” arXiv preprint arXiv:2502.11100 (2025)."}, {"review_id": "YzDOOfi2Fs", "reviewer": "Reviewer_WqB3", "summary": "This paper provides an empirical analysis, backed up by some theoretical arguments, of how concept bottleneck models (CBMs) are affected by noisy concept annotations. The authors identify noisy concept supervision in training data as a major source of downstream performance degradation. They claim that this effect is primarily driven by a subset of so-called “susceptible concepts.” To mitigate the issue, the authors propose two strategies: sharpness-aware minimization (SAM) during training and uncertainty-guided interventions at inference. Experiments on two real-world datasets support their conclusions.", "questions": "1. The theory in Appendix B compares $f(\\hat{c}_i)$ with $f(c^*_i)$, focusing on the error in predicting concept $i$. However, how does this prediction error relate to the *training noise rate*, which is the central focus of this paper? The setup seems to conflate inference-time uncertainty with training-time corruption—could the authors clarify this connection?\n2. Related to W1), how do the authors position their findings in light of prior work (e.g., Shin et al., Penaloza et al., Sheth & Kahou), which also studied intervention strategies and robustness in CBMs? What distinguishes this work?\n3. The definition of susceptible concepts is based on a greater-than-average drop in accuracy under noise. But what if a concept suffers a large decline yet contributes negligibly to the final prediction (e.g., in a linear bottleneck model, if its weight is close to zero)? Shouldn't the uncertainty-aware intervention take into account concept relevance?", "limitations": "The paper lists several limitations which are fair.\n\n---\n\nOverall, this is a well-written and timely paper that provides a useful empirical analysis of CBMs under noisy supervision. However, in my opinion, it falls short of the NeurIPS bar in terms of novelty and conceptual contribution. The main techniques used are existing ones, and the findings, while insightful, are largely expected. I would encourage the authors to consider submitting to a workshop or resubmission after strengthening the theoretical and/or methodological contributions.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 1, "strengths_and_weaknesses": "### Strengths\n\n1. The paper presents a systematic empirical study of the effects of noise in CBMs, including detailed analyses of prediction performance, interpretability, and intervention effectiveness.\n2. It offers practical insights for working with noisy concept annotations.\n3. The study is timely, especially given the growing use of LLM-generated concept labels, which are prone to noise.\n4. The theoretical derivations connecting susceptibility and predictive uncertainty provide additional support and motivation for the intervention strategy.\n\n### Weaknesses\n\n1. **Lack of Novel Methodology.** The paper does not introduce any fundamentally new methods. Both SAM and uncertainty-based interventions are existing techniques that are simply applied to this setting. The novelty is limited to empirical observations and analysis, which—though valuable—do not represent a significant conceptual advance.\n2. **Limited number of datasets.** For a paper whose main contributions are empirical, the use of only two datasets (CUB and AwA2) is limiting. The findings would be more convincing if demonstrated on a broader range of settings.\n3. **Predictable Findings.** Several results—such as the degradation of interpretability and performance under noise, or the benefits of targeting uncertain predictions—are somewhat expected. While clearly and rigorously shown, these insights are incremental.", "was_revised": true, "final_justification": "Author's responses and additional experiments addressed my concerns.", "rebuttal": "We sincerely thank the reviewer for recognizing the practicality and timeliness of our work and providing thoughtful feedback. Below, we address the specific comments and welcome any further discussion.\n\n---\n\n**Significance of our work**\n> The paper does not introduce any fundamentally new methods. Both SAM and uncertainty-based interventions are existing techniques that are simply applied to this setting. The novelty is limited to empirical observations and analysis, which–though valuable–do not represent a significant conceptual advance.\n\nWe appreciate the constructive comment. The significance of our study can be summarized in three parts.\n\n* To our knowledge, this is the first systematic analysis of the noisy concept annotation problem in CBMs, a practical issue that can arise from human error and subjective judgment yet has remained largely unattended. We show, through multi-faceted analyses, that such noise negatively affects all core CBM properties: interpretability, intervention effectiveness, and predictive performance.\n\n* We find that degradation is not uniform across concepts. Rather, it concentrates on a subset that is **susceptible** to noise. This small set explains most of the accuracy decline and therefore drives the overall performance drop.\n\n* To mitigate the risks posed by susceptible concepts, we propose to use sharpness-aware minimization during training and uncertainty-guided intervention at inference. We provide broad empirical results and theoretical support demonstrating that these strategies are effective at restoring the reliability of CBMs.\n\n---\n\n**Unexpected findings**\n> Several results–such as the degradation of interpretability and performance under noise, or the benefits of targeting uncertain predictions–are somewhat expected. While clearly and rigorously shown, these insights are incremental.\n\nWe appreciate the reviewer’s point. This work, however, presents results that were not previously documented and are difficult to anticipate.\n\nFirst, it is commonly believed that CBMs allow one to correct the final prediction via intervention even when a concept is mispredicted. From this view, one might expect that models trained with noisy concepts would readily recover performance through intervention. Our experiments contradict this expectation. As shown in Section 2.4, when CBMs are trained on datasets with concept noise, the intervention effectiveness itself is substantially reduced, so the expected recovery does not materialize. Given that real deployments often rely on concept sources with nontrivial noise, this indicates that intervention may fail to operate as intended and can lead to unexpected failure.\n\nSecond, CBMs degrade in a qualitatively different manner from standard DNNs under the same noise level. For example, on the CUB classification task with 0%, 20%, and 40% noise, a DNN exhibits a relatively moderate decline (79.7 → 65.9 → 53.0), whereas a CBM shows an abrupt collapse (74.3 → 50.3 → 4.0). This occurs because the two-stage structure of CBM propagates errors in concept prediction directly to the target predictor. The evidence shows that CBMs are considerably more vulnerable to concept noise than is typically assumed.\n\nThese findings reveal an inherent sensitivity of CBMs to concept noise and underscore the need to recognize this vulnerability and develop appropriate mitigation in order to build reliable CBMs.\n\n---\n\n**Positioning relative to prior work**\n> how do the authors position their findings in light of prior work (e.g., Shin et al., Penaloza et al., Sheth & Kahou), which also studied intervention strategies and robustness in CBMs? What distinguishes this work?\n\nWe appreciate the question. \n\n**Shin et al. [1]**: The focus is different from ours. They propose and evaluate various intervention strategies and analyze their effects. Our work systematically analyzes how noise degrades CBM behavior and proposes practical mitigation for this noise setting. We further show, both theoretically and empirically, that uncertainty-guided intervention approximates a susceptibility-based intervention, supporting its utility under noisy supervision.\n\n**Penaloza et al. [2]**: They share the motivation that CBMs can be sensitive to label noise and propose model improvements, **assuming they are vulnerable to noise**. In contrast, our contribution is a comprehensive analysis of _how_ concept noise affects interpretability, intervention effectiveness, and predictive performance, together with an integrated mitigation framework that operates at both training and inference.\n\n**Sheth and Ebrahimi Kahou [3]**: Their goal is different. They investigate that CBMs can learn irrelevant concept representations and target robustness under distribution shift. We study concept noise that arises naturally in practice, identify the key drivers of failure through a systematic analysis, and propose simple and effective strategies to mitigate the resulting risks.\n\n---\n\n**Broader range of settings**\n> For a paper whose main contributions are empirical, the use of only two datasets (CUB and AwA2) is limiting. The findings would be more convincing if demonstrated on a broader range of settings.\n\nWe appreciate this concern and will include additional results in the final version. We conducted two complementary experiments in the tables below.\n\nAlthough the main paper analyzes susceptibility primarily on CUB, we replicated the analysis on AwA2. We observe that the positive correlation between uncertainty and susceptibility persists. While the non-susceptible set shows a more negative correlation in AwA2, this does not weaken the positive correlation within the susceptible set.\n\nTo better reflect practical conditions where concept and target may be dependent, we designed a dependent noise model. We first corrupt target labels, then add concept noise only when the target changes. The positive correlation between susceptibility and uncertainty remains under this more realistic setting.\n\n`Correlation between uncertainty and susceptibility on AwA2`\n| Noise Ratio | Susceptible Concepts | Non-susceptible Concepts |\n|---|---|---|\n| $\\gamma$ = 0.1 | 0.540 | -0.560 |\n| $\\gamma$ = 0.2 | 0.355 | -0.382 |\n| $\\gamma$ = 0.3 | 0.175 | -0.167 |\n\n\n`Correlation between uncertainty and susceptibility on practical noise`\n| Noise Ratio | Susceptible Concepts | Non-susceptible Concepts |\n|---|---|---|\n| $\\gamma$ = 0.1 | 0.646 | -0.487 |\n| $\\gamma$ = 0.2 | 0.624 | -0.315 |\n| $\\gamma$ = 0.3 | 0.549 | -0.128 |\n\n---\n\n**Linking theory to training noise**\n> The theory in Appendix B compares $f(\\hat{c}_i)$ with $f(c^*_i)$, focusing on the error in predicting concept $i$. However, how does this prediction error relate to the _training noise rate_, which is the central focus of this paper? The setup seems to conflate inference-time uncertainty with training-time corruption–could the authors clarify this connection?\n\nThank you for raising this point. In Appendix B we intentionally define the intervention effect at inference as $\\delta_i := E_{(x, y)} [\\ell(f(\\hat{c}), y) - \\ell(f(\\hat{c}_{-i}), y)]$ to quantify how much the loss decreases when intervening on concept $i$. The key point is that $\\hat{c}$ is produced by a predictor trained on noisy concept labels. Hence $\\hat{c}$ already reflects the training noise rate, and so does $\\delta_i$.\n\nAlthough the analysis is formulated at inference, it is grounded in predictions from a model affected by training-time corruption, which connects inference-time uncertainty to the training noise rate. We will make this linkage explicit in the revision.\n\n---\n\n**Concept susceptibility and relevance**\n> The definition of susceptible concepts is based on a greater-than-average drop in accuracy under noise. But what if a concept suffers a large decline yet contributes negligibly to the final prediction (e.g., in a linear bottleneck model, if its weight is close to zero)? Shouldn’t the uncertainty-aware intervention take into account concept relevance?\n\nWe appreciate the insightful observation. We agree that some concepts may suffer large accuracy declines yet have limited impact on the target. In our experiments, such cases were not frequent, but accounting for this possibility would improve diagnostic precision. As a direction for future work, we plan to incorporate measures of concept relevance into the evaluation. This extension would better capture rare cases where accuracy decline does not translate into downstream impact.\n\n\n---\n\nReferences\\\n[1] Shin, Sungbin, et al. \"A closer look at the intervention procedure of concept bottleneck models.\" ICML, 2023.\\\n[2] Penaloza, Emiliano, et al. \"Preference optimization for concept bottleneck models.\" ICLR Workshop on Human-AI Coevolution, 2025.\\\n[3] Sheth, Ivaxi, and Samira Ebrahimi Kahou. \"Auxiliary losses for learning generalizable concept-based models.\" NeurIPS, 2023."}, {"review_id": "IhZiCOPm9c", "reviewer": "Reviewer_AKL9", "summary": "This paper investigates the impact of concept-level noise in Concept Bottleneck Models (CBMs), focusing on a realistic scenario where the supervision signal on intermediate concepts is imperfect. The authors conduct a systematic study on how concept noise affects downstream prediction performance, interpretability, and intervention effectiveness. To mitigate the model’s vulnerability to noisy concepts, they propose two complementary techniques: sharpness-aware minimization during training, and uncertainty-based intervention during inference. Experimental results across multiple datasets demonstrate the effectiveness of the proposed solutions.", "questions": "The noise simulation process appears oversimplified. As described in the paper: \"each binary concept label $c_i \\in {0,1}$ is independently flipped with probability $\\gamma$ to simulate concept noise $\\hat{c}$. For target noise $\\hat{y}$, each class label $y$ is randomly changed to a different label, uniformly sampled from the remaining classes, also with probability $\\gamma$.\"\n\nHowever, as the authors themselves note in lines 31–33, \"changing concepts can shift the label.\" This indicates that concept and target label noise are not necessarily independent in real-world scenarios. Given this, how do the authors justify the assumption of independence between noisy concepts and noisy labels in their experimental setup? Would the proposed methods remain effective under a more realistic, correlated noise model?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strenghts:\n\n1. The paper offers a systematic and well-structured investigation into how concept noise influences various aspects of CBMs.\n\n2. The writing is clear and logically organized, making the paper easy to follow.\n\n3. The proposed methods are simple, practical, and effective in improving model robustness under noise.\n\nWeaknesses:\n\n1. The assumptions regarding the noise generation process are arguably too simplistic. In Section 2.1, this process ignores potential dependencies between concepts and labels.", "was_revised": true, "final_justification": "It mainly addresses my previous concerns. So I will raise my original score from boardline accept to accept.", "rebuttal": "We sincerely thank the reviewer for acknowledging our works as practical and well-organized, and for providing thoughtful feedback. Below, we address the specific comments and welcome any further discussion.\n\n---\n\n**On the independence assumption**\n> The assumptions regarding the noise generation process are arguably too simplistic. In Section 2.1, this process ignores potential dependencies between concepts and labels.\n> The noise simulation process appears oversimplified. As described in the paper: “each binary concept label $c_i \\in \\{0, 1\\}$ is independently flipped with probability $\\gamma$ to simulate concept noise $\\hat{c}$. For target noise $\\hat{y}$, each class label $y$ is randomly changed to a different label, uniformly sampled from the remaining classes, also with probability $\\gamma$.\n> However, as the authors themselves note in lines 31-33, “changing concepts can shift the label.” This indicates that concept and target label noise are not necessarily independent in real-world scenarios. Given this, how do the authors justify the assumption of independence between noisy concepts and noisy labels in their experimental setup? Would the proposed methods remain effective under a more realistic, correlated noise model?\n\nThank you for this insightful comment. Our primary objective is to provide a systematic analysis of how noise affects the performance and interpretability of CBMs. To isolate basic effects and to evaluate mitigation strategies in a controlled setting, we sought an experimental design in which concept noise and target noise can be manipulated independently. This design allows us to vary each factor without confounding and to attribute observed changes to a single source of corruption. For this reason, we considered the independence assumption a reasonable and transparent starting point for an initial analysis across a range of noise levels.\n\nWe agree that in many practical settings concept and target noise can be correlated. To examine this case, we additionally simulated a correlated noise model and evaluated susceptibility and its connection to uncertainty. Concretely, we first corrupted the target label; only when the target changed did we inject concept noise, thereby inducing dependence between concept and target corruption. The results are summarized below.\n\n`Correlation between uncertainty and susceptibility on practical noise`\n| Noise Ratio | Susceptible Concepts | Non-susceptible Concepts |\n|---|---|---|\n| $\\gamma$ = 0.1 | 0.646 | -0.487 |\n| $\\gamma$ = 0.2 | 0.624 | -0.315 |\n| $\\gamma$ = 0.3 | 0.549 | -0.128 |\n\n\nEven under dependent noise, the positive association between uncertainty and susceptibility persists for susceptible concepts. This pattern is consistent across noise levels and indicates that our analysis and mitigation approach remain effective in a more realistic correlated noise setting."}]

Author rebuttal:

Meta-review: This work examines how label noise, encompassing both concept label noise and task label noise, impacts Concept Bottleneck Models. Specifically, this work shows that a CBM’s task and concept accuracies are highly susceptible to noisy label annotations,  concept noise is the primary source of degradation, and concept-label-noise-induced degradation can be attributed to small set of “susceptible” concepts, which can then be targeted during intervention to improve the effectiveness of an intervention, and (4) noise-aware losses such as Sharpness-Aware Minimization (SAM) can alleviate some of the effects of label noise. 

The reviewers agreed after some rebuttal time that this is a well-written and timely paper that provides a useful empirical analysis of CBMs under noisy supervision and should be accepted to NeurIPS. In the final version, the authors should provide a clearer explanation and additional experiments regarding "On the independence assumption", as suggested by the reviewers, to improve the narrative.
Decision: Accept (poster)