DEXTER: Diffusion-Guided EXplanations with TExtual Reasoning for Vision Models
Authors: Simone Carnemolla
Matteo Pennisi
Sarinda Samarasinghe
Giovanni Bellitto
Simone Palazzo
Daniela Giordano
Mubarak Shah
Concetto Spampinato
Venue: NeurIPS 2025 spotlight ()
Keywords: Explainability
Activation Maximization
Diffusion Models
LLM
Primary area: deep_learning

Abstract: Understanding and explaining the behavior of machine learning models is essential for building transparent and trustworthy AI systems. We introduce DEXTER, a data-free framework that employs 
diffusion models and large language models to generate global, textual explanations of visual classifiers. DEXTER operates by optimizing text prompts to synthesize class-conditional images that strongly activate a target classifier. These synthetic samples are then used to elicit detailed natural language reports that describe class-specific decision patterns and biases. Unlike prior work, DEXTER enables natural language explanation 
about a classifier's decision process without access to training data or ground-truth labels. We demonstrate DEXTER's flexibility across three tasks—activation maximization, slice discovery and debiasing, and bias explanation—each illustrating its ability to uncover the internal mechanisms of visual classifiers. Quantitative and qualitative evaluations, including a user study, show that DEXTER produces accurate, interpretable outputs. Experiments on ImageNet, Waterbirds, CelebA, and FairFaces confirm that DEXTER outperforms existing approaches in global model explanation and class-level bias reporting. Code is available at https://github.com/perceivelab/dexter.

DEXTER: Diffusion-Guided EXplanations with TExtual Reasoning for Vision Models
Simone Carnemolla
Matteo Pennisi
Sarinda Samarasinghe
Giovanni Bellitto'
Simone Palazzo'
Daniela Giordano'
Mubarak Shah² Concetto Spampinato'
University of Catania
University of Central Florida
simone. carnemolla@phd. unict.it
matteo, pennis pennisi@unil situnict..ii....
Abstract
Understanding and explaining the behavior of machine learning models essen- tial for building transparent and trustworthy AI systems. We introduce DEX- TER, a data-free framework that employs diffusion models and large language models to generate global, textual explanations of visual classifiers. DEXTER operates by optimizing text prompts to synthesize dlass-conditional images that strongly activate target classifier. These synthetic samples then used elicit detailed natural language reports that describe class- slass-ppecffic decision patterns and biases. Unlike prior work, DEXTER enables natural language explanation about a classifier's decision process without access to training data or ground- truth labels. We demonstrate DEXTER's 's flexibility across three fasks-activation maximization, slice discovery and debiasing, and bias explanation-eadd illus- trating its ability to uncover the internal mechanisms visual classifiers. Quan- titative and qualitative evaluations, including a user study, show that DEXTER produces accurate, interpretable outputs. Experiments on ImageNet, Waterbirds, CelebA, and FairFaces confirm that DEXTER outperforms existing approaches in global model explanation and class-level bias reporting. Code is available https:/ thtbbb. http/pprceivveee dexter..
Introduction
How can systematically uncover and explain deep visual classifier's decision-makine process in a way that is both comprehensive and auman-itterpretable?
This question is crucial as Al systems are increasingly deployed in high-stakes applications, where interpretability and trust are as important as accuracy. However, the lack of transparency in model reasoning, often exacerbated by the reliance spurious correlation--irrele irrelevant features that dis- proportionately influence predictions- undermines confidence in these systems, making decisions difficult justify. For instance, ImageNet-trainee classifiers have been shown favor background textures or lighting conditions over intrinsic object properties [40, 9]. Addressing these issues requires explainability techniques that extend beyond local attribution, offering global perspective model's 's reasoning patterns, biases, and learned representations.
Existing methods for model explainability, such as GradCAM [38] and Integrated Gradients [42] provide local explanations and require data. These methods focus on analyzing individual predictions by attributing importance to specific pixels or regions in image. While these methods are extremely useful for highlighting areas of interest, they do not offer global understanding of model behavior. In
Equal contribution.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

contrast, activation maximization techniques [26-28] have been instrumental in globally visualizing the features learned by neural network, but the generated images are often abstract and challenging to interpret. While existing methods offer useful insights into model behavior and feature representations, they often fall short of capturing the global reasoning patterns and biases behind predictions. In particular, visual explanations can be hard to interpret and may lack the ability to convey high-level reasoning or reveal subtle spurious correlations-ist issues that are often better addressed through complementary textual explanations [18, 6, 16, 3].
Text-based explanations offer an accessible complement to visual methods [11], but they often lack global perspective or clarity, Recent work [16, 2, 10], including Natural Language Explanation (NLE) methods [29, 36, 15]. combines visual and textual cues reveal model biases, but typically relies on labeled data, annotations, or pretrained vision-language mappings [2].
We propose DEXTER, a framework that generates human-interpretable textual explanations, covering the glohal reasoning patterns and biases of visual classifiers. DEXTER operates in a fully data-free setting by leveraging the generative capabilities of diffusion models and the reasoning power of large language models (LLMs). At its core, DEXTER optimizes soft prompts, which are mapped discrete hard prompts, in order to guide caffusion-based image generation process. This ensures that the generated images are aligned with the outputs of a target classifier, capturing the features and concepts prioritized by the model. The generated images are then analyzed by an LLM, which reasons across them to provide textual explanations of the classifier's 's decision- decision-making process. By combining image generation and textual reasoning, DEXTER not only overeomes the interpretability challenges of visual explanations but also provides global understanding of model behavior, including identifying spurious correlations and biases, without requiring access any training data or ground truth labels.
Thus, the core main contributions of DEXTER are:
Global explanations: A high-level understanding of model decisions, identifying key features, biases, and patterns beyond local attribution.
Data-free approach: DEXTER requires only the trained model for explanations, unlike existing methods, that employ training or ground-trute data.
Bias identification and explanation: Uncovering and describing spurious correlations to support model debiasing.
Natural language reasoning: LLM-ggnneraed textual explanations that enhance inter- pretability over purely visual methods.
We evaluate DEXTER across three tasks: (1) activation maximization to reveal model-prioritized
features, (2) slice discovery to detect underperforming subpopulations, and (3) bias explanation to identify spurious correlations. Experiments use SaliendmageNet [40], Waterbirds [35], CelebA [21], and FairFaces [ataeets widely used in fairness and interpretability research. Across tasks, DEXTER demonstrates strong performance, offering meaningful insights into model behavior.
2 Related work
Activation Maximization (AM) interprets neural networks by generating inputs that maximize neuron activations [7]. Early methods often produced unrealistic, uninterpretable images [39, 25], later improved through regularization [23] and generative priors [26]. DiffExplainer [30] introduced diffusion- image generation guided by soft prompts, which improve realism but lack semantic transparency. This work points toward token-wise optimization, but this direction remains underex- plored. In contrast, DEXTER builds on this line by replacing soft prompts with discrete (hard) tokens, which are interpretable and enable both visual and textual global explanations. Although once central to model interpretabiliity AM has seen limited progress in recent years, partly because the resulting images-whie optimized for neuron activation are often difficult to interpret semantically, making it challenging to draw clear, causal insights about model behavior. The field has largely shifted toward attribution methods-s e.g., GradCAM [38], Integrated Gradients [42], which are computationally efficient and provide intuitive saliency maps, though they are inherently local and data-dependent. Other efforts in feature visualization [49] offer insights into internal representations but require training data and remain focused on visual output. DEXTER revives AM by leveraging modern

---

diffusion models and discrete prompt optimization to produce class-level, multimodal explanations in a fully data-free setting.
Explanation of visual classifiers. Textual and Multimodal Explanations seek to complement visual saliency with natural language justifications. Approaches like Multimodal Explanations [2], and post-hoc counterfactuals [2] align vision and language to explain model decisions. However, these methods often rely on ground-truth labels or annotated datasets and or limited to instance-level explanations. In contrast, DEXTER provides global, class-wise explanations without supervision or access to data.
Natural Language Explanation (NLE) methods aim to generate human-readable justifications, typically using -tAestyle benchmarks [29, 36, 15]. Recent approaches integrate vision and language into unified architectures [37, 36). but remain supervised and local. DEXTER differs by producing global textual reports through unsupervised classifier probing-without without labels, data, or task-specific fine-tuning.
Slice Discovery identifies dataset subpopulations where a model underperforms, offering a tar- geted way reveal and explain systematic failures in classifier behavior. Traditional methods analyze embeddings, gradients, or misclassifications [1. 24, 41, 48], while recent approaches leverage CLIP's joint text-visual embeddings [8, 12, 47] use LLMs to generate captions and extract key- words [44, 16]. Bias-to-Texi (B2T) extracts pseudo-bias labels from misclassified image captions, and LADDER[10] generates bias hypotheses from low-confidence predictions, clustering samples via LLM--erived pseudo-atue antrio-attributs. Unlike these data- detendeennd methods, DEXTER discovers and explains biases in fully data- free manner, relying only on the classifier's internal behavior.
3 Method
DEXTER's s framework, shown in Fig. 1, integrates three key components: text pipeline for optimizing prompts, a vision pipeline for the image generation process, and a reasoning module using a vision-languag model (VLMM). DEXTER begins by optimizing soft prompt to condition BERT model [5] to fill in masked tokens in a predefined sentence. The resulting prompt guides the stable diffusion process to generate images that maximize the activation of set of target neurons (e.g. classification heads) in given visual classifier. The generated images are then analyzed by the VLM, which reasons across multiple images to provide coherent, human-readable textual explanations of the model's decision-making process.
3.1
Text pipeline
The text pipeline has the goal of optimizing a textual prompt to suitably condition the diffusion model. We pose prompt generation as masked language modeling task, and employ a pretrained and frozen BERT model for this purpose. The structure of the textual prompt to be produced is fully customizable, and can be controlled by combining portions of fixed text with set of mask tokens. For the sake of clarity and without loss of generality, we will assume that the textual prompt has the structure of a sequence mi are set to BERT's MASK]token Let temb be the embedding of t, including positional encoding. In order to alter BERT's behavior, which would naturally tend to replace m. with the most likely tokens based on its pretraining, we also prepend to the input sequence a learnable soft prompt p E R Pxd consisting of a sequence of P vectors, with d being the dimensionality of BERT's embedding space [17]. The full input sequence to BERT is thus [p, temb]. We read out the logits corresponding to the masked tokens, i.c., [I.....,Iy, IyJ. where each 1 E IR and V is BERT's vocabulary size. Each
[tried: 1, ....... m where trxed the portion of fixed text and all
logit vector 1, is mapped to differentiable one-hot vector O, E {0, 13", oo,, = 1, through Gumbel-softmax [22, 13] (with temperature 5 = 1), from which the corresponding predicted token f, (1,..., V} is retrieved. The resulting text prompt can be recovered as [trxed, fi...., [.]].
At this point, a practical problem arises, in that standard implementations of diffusion models (e.g..Stable Stable Diffusion [34]) CLIP's text encoder [31] employed embed textual prompts into conditioning vector. Unfortunately, BERT's and CLIP's
s vocabulary overlap only partially. To address this issue, we employ a translation matrix M E {0, 13Vx VxW to map each one-hot vector o, to its corresponding representation in CLIP's vocabulary, of size W. In M, each row contains single 1, indicating the index of the corresponding token in the CLIP vocabulary. Thus, given an original one- hot vector o, provided by BERT, we can translate it into its CLIP equivalent through of (C) o,M, indexing a token 2,0) in CLIP's vocabulary. For unassigned BERT tokens, the corresponding rows in
3

---

DEXTER
Vision Classifier
Goal: Invessigato class "bee" an
Pipelliee
Vision Pipelline
Trorpe
Soft
pictues
Egood
271
Tranzlation
CLIP)
Stable Dillusion
Sample Storage
Maokod Tokcn
BERI
bard Daxt Peoiig
Poediction etiiow
Sogt
Erood
[TLORER]
Vision Classifier
Gurr Sultmax
CLIP Encoder
asd Outgue
Lamgs with
Invastigated Clazs
Reasoning Module
Biae Report:
Depsiarns
ansigsis
Clowes
Bloced Basylus
Captioner
VLM
Figure I: DEXTER investigates classifier biases by optimizing a learnable soft prompt generate text prompts. These text prompts condition diffusion model to generate images that maximize the activation of the target class in the vision classifier. Images that correctly activate the target class are stored and later captioned for Bias Reasoning, A VLM reasons using these captions to produce uanraan-nnndtttdaablle textual explanations of the model's decisions and potential biases. More details and clarifications about the pipeline can be found in the Appendices A and B.
M are entirely zero. As a result this design, the model learns to avoid predicting BERT tokens that do not have valid mapping in CLIP, as they correspond to zero indexing vector o (C) which would provide a meaningless representation when multiplied by the CLIP embedding look-up table.
The textual prompt used to condition the diffusion model is thus trised, 20 "............................... ...... ac)
Thanks to
Gumbel-Softmax activation and linear mapping between vocabularies, the whole process fully differentiable, allowing us optimize the soft prompt p. which is the only learnable parameter, through classic backpropagation.
3.2
Vision pipeline
The goal of the vision pipeline is to synthesize realistic and interpretable image that maximizes the activation of set of neurons of visual classifier. In the following, refer "neurons" in a generic way, regardless of whether they encode features (i.e., neurons in intermediate layers) classes (i.e., neurons in the output layer, after applying softmax). Given the predicted textual
prompt tixed, (C) gC) (with all tokens ensured to belong to CLIP's vocabulary as explained in
Sect. 3.1), we feed to CLIP's text encoder to obtain an embedding vector e. This vector then used to condition pretrained and frozen diffusion model d. In this work, use Stable Diffusion, due to its widespread adoption and versatility generating high-quality images from textual descriptions. Let I h be the target frozen visual classifier, pretrained over set of C' classes, providing as output the responses Hence,
subset K selected neurons, whose activations we intend to maximize. obtain the selected activation vector The whole vision pipeline is differentiable, enabling the definition an optimization objective for n, which directly affects the learnable soft prompt p in the text pipeline.
f (d (c)).
In order guide the generation process to describe the behavior of the visual classifier, we introduce neuron activation maximization loss Lact that encourages learning textual prompt and synthetic

---

image that maximizes the response of the selected n neurons. We define Lat as:
K
Lact
lact (n4)
where n, is the activation of the i-th element in n, and lust depends on whether n, is feature neuron or class neuron:
Last (n:)
Tki log niy
if my is feature neuron
ny is class neuron
3.3 Masked pseudo-labels prediction
In our preliminary experiments, observed that, when using the activation maximization objective only, the gradient propagated to the learnable soft prompt p in the text pipeline was too small, slowing down
preventing convergence. To address this issue, introduce, in the text pipeline, an auxiliary mask prediction task to provide a shorter backpropagation path to p. The design of the auxiliary task gives the opportunity associating masked tokens with subsets of target neurons, in order to encourage the mapping between neuron activations and specific portions of the textual prompt.
add another explainability feature to our approach:
To facilitate this, we initialize a set of pseudo-labels V/....., MN. one for each mask token position mi. ... m. Each pseudo-label y/ {l..... V} is associated with reference loss L, initialized to +oc, and with the set of reference neurons N₁ S f1. KJ. At each optimization step, for each mask token m, BERT predicts the logits 4, from which we compute the (standard) softmax vector s; and the corresponding predicted token f,, following the notation introduced in Sect. 3.1. We define the aggregated activation loss Lage, for the set of associated reference neurons:
Lagg.
Σ (a)()))) JEM,
Then, if Lagg, smaller than the corresponding reference loss Li, we update both the pseudo-label y/ < & and the reference loss L; + Luge,i If the pseudo-label yi has been set for m, (and the corresponding reference loss L; is finite), we add cross-entropy loss term Lyaaski with $t, being the j-th element of the softmax vector s,. This approach ensures that the pseudo- labels continually refined to better align with the activation patterns of the target neurons as training progresses, while constraining the model's parameters to remain within a region of the parameter space that corresponds meaningful, interpretable configurations. After the first iteration, where all Y: are set, the overall loss function L is then:
log St.y
Jas (ms)
Σ log 81,y
A possible issue that may arise is the prediction of outlier tokens that could randomly decrease the activation loss, which would possibly update the pseudo-labels spurious values. To prevent this, for each masked token position m,, we maintain a history of aggregated losses for each word predicted during the optimization process, using the history mean for comparison with the reference loss L,- For instance, let us assume that masked token m; has been mapped by BERT to vocabulary token
t" in training iterations, building up a list of corresponding aggregated losses [c()) (T)
agg.
Instead of comparing L; with the most recent aggregated loss ((T) "gg.i" we check whether:
T
U agg.
Lis
(5)
T
and only in this case do update Lj. This approach prioritizes the prediction of words with lower historical activation loss, preventing the selection as pseudo-target outlier words that lead random loss fluctuations.
5

---

Performance analysis
4.1 Datasets
To demonstrate the versatility and effectiveness DEXTER as a global explanation framework, we design a comprehensive evaluation protocol that reflects the core dimensions of model interpretability: feature relevance, bias identification, and semantic alignment. We evaluate DEXTER across four key tasks: visual explanation, activation maximization, bias discovery, and bias text explana- tion, using four widely adopted datasets that enable rigorous and complementary assessments of interpretability. Each dataset was selected for its alignment with specific evaluation goal and its established use in the literature.
SalientImageNee [40] is used to evaluate both visual explanations and activation maximization. It a curated subset of ImageNet designed to analyze model reasoning through object and context annotations. For each class, the top-5 neural features- highly activated units in the penultimate layer-are are annotated as either spurious or core, based on whether they reflect incidental or meaningful correlations with the target label. This enables fine mne-grained assessment of DEXTER's s ability to highlight robust, semantically grounded features in both explanation and feature synthesis settings. Waterbirds{35] and CelebA(21] serve benchmarks for bias discovery. Waterbirds introduces spurious correlations between bird species and backgrounds (e.g.. land vs. water), providing a con- trolled environment for evaluating slice discovery and DEXTER'S s ability to surface underperforming subpopulations. CelebA offers over 200,000 annotated face images with 40 binary attributes (c.g.. gender, hairstyle, glasses), allowing us to assess how DEXTER identifies biases in classifier behavior related to demographic and semantic features.
FairFaces [14] is finally used for bias text explanation, focusing on the articulation of systematic spurious correlations in facial classification tasks. With over 100,000 images balanced across seven demographic groups, enables rigorous evaluation of how DEXTER captures and communicates bias in decision-making across diverse populations.
For each evaluation task, detailed optimization strategies, training procedure, VLM prompts and other information are provided in the appendix.
4.2 Results
We evaluate DEXTER's visual explanations through quantitative metrics and user study, then assess its performance in bias discovery, mitigation, and explanation, showcasing its ability to identify spurious correlations and enhance fairness. Finally, an ablation study examines the impact of individual components and DEXTER's s effectiveness in optimizing text prompts for activation maximization, comparing it to existing methods.
4.2.1 Visual Explanations
We evaluate DEXTER's s visual explanations through qualitative and quantitative comparisons with DiffExplainer, the only prior method that shares similar diffusion-basee generation pipeline, on the SalientImageNet in order to assess the semantic relevance and clarity of the synthesized explanations. For qualitative analysis, we conducted user study (see Appendix H), involving 100 participants on Amazon Mechanical Turk, to further assess the interpretability of DEXTER's s visual explanations compared DiffExplainer's (the methods with the highest CLIP-IQA scores in Tab. 6). Par- ticipants compared images generated by DiffExplainer and DEXTER alongside GradCAM-bbsed attention heatmaps from SagientlmageNet, evaluating similarity across three feature categories: per- ceptual features featuures (shape, texture, color), conceptual features (semantics, context), and cases where no similarity was perceived (None). As shown Fig. 2, DEXTER was preferred for conceptual features, while DiffEExpaaier was favored for perceptual attributes. Notably, DEXTER received fewer None responses, indicating stronger alignment with classifier attention regions. A chi-square test (x2 = 15.36, p = 0.032) confirms a significant difference, with post-hoc analysis highlighting None and conceptual features as key contributors.
Fig. 3 presents an example of visual and textual explanations generated by DEXTER for Robus- tResNet50 [40], focusing on the 5 most active features in the penultimate layer for the dog sled class, which are all categorized as spurious in Salient DEXTER--eneratter images align more effectively with the classifier's attended regions compared to those generated by DiffExplainer. Furthermore, DEXTER provides textual descriptions that clearly explain the semantics of each

---

User Study Praferances for Visual Explanations
& 31.2%
Percentage of Preferences
6-5.6%
Festures
Feature
Figure 2: User study results on SalientImageNet: Participants evaluated the alignment between classifier attention and visual explanations, categorized into perceptual features (shape, texture, color), conceptual features (context, semantics, multiple elements), and no alignment.
neural feature, offering an interpretable account of the classifier's reasoning. This approach enhances interpretability and enables users to either identify spurious correlations, such as the ones in the dog sled class where none of the five most important features actually include sled, or confirm the classifier's 's reliance meaningful, task-relevant attributes.
For quantitative evaluation, compare DEXTER DiffExplainer using CLIP-IQA and Semantic CLIP-IQA [43] (Appendix D). DEXTER achieves higher scores (0.94 + 0.03 / 0.96 + 0.03) than DiffExplainer (0.89 0.09 0.90 + 0.05), indicating better semantic alignment and consistency. Additional comparisons with GAN-based methods [45, 23, 26] further confirm the advantage of diffusion-basee explanations.
Extended details/examples on the visual explanation task are in Appendix D.
winter
wolf
buck
glacier
DEXTER
DrfExpllamer
Inseggentt
Salient
Feat
Feat 1
Feat 2
Feat
Feat 4
Figure 3: DEXTER and DiffExplainer explanations for RobustResNet50 on "dog sled", showing spurious t features as core visual elements.
4.2.2 Slice discovery and debiasing
The goal of slice discovery is to identify subgroups of data where the model exhibits worse perfor- mance compared to the rest of the dataset. We assess slice discovery and debiasing performance using CelebA and Waterbirds datasets. In the former, the task the "blonde" class including low proportion of men (representing slice). The Waterbirds dataset tackles "waterbird"/landdirrr classification, and is built so that portion of waterbird images feature land background, and vice versa, thus introducing slice per class. We perform slice discovery with DEXTER by first identifying words that maximize the activation of given class. Specifically. we leverage DEXTER's optimization process obtain several descriptive words for each class. Fol- lowing this step, as done by Kim et al. [16], we compute the CLIP similarity between the discovered words and the images the dataset: images with high similarity are identified as belonging to a slice. We thus train debiased classifier using Distributionally Robust Optimization (DRO) [35, 32] and evaluate the classification accuracy on the identified slices. We compare this approach with ERM [35], LIF [24], GEORGE [41], JTT [19], CNC [46], DRO [35], LADDER [10] and DRO-B2T [16]. As
"blondde""non-blondd"
classification, with
7

---

shown in Tab. 1, DEXTER outperforms state-of-the-ee of-the--tttrrrr- art methods on worst-slice prediction for CelebA and achieves comparable results on Waterbirds, deriving descriptive words directly from the model without relying on training data. Additional details on the slice discovery task and results are given in Appendix E.
Table 1: Performance on slice discovery and debiasing.
CelebA
Waterbirds
Method
Data
GT
Worst
Avg.
Warst
Avg.
ERM
47.7 1 2.1
94.9
62.6
0.3
97.3
LI:
77.2
78.0
91.2
GEORGE
54.9 1.9
94.5
7..2
95.7
1.7
88.1
89.3
CNC
88.8
0.9
89.9
88.5
1.3 0.3
90.9
90.0
93.3
89.9
91.5
LADDER
80.2 1.010.. 0.4
89.8
92.4
0.8
93.1
DRO-BE B2T DEXTER(OUrS)
0.9
93.2
90.7
92.1
91.3 + 0.01
91.7
0.
92.0
4.2.3 Bias explanation
To evaluate DEXTER's ' ability identify and explain biases in classifiers, conduct analysis using the FairFaces dataset [14]. Specifically, we train two binary classifiers to distinguish between two age groups: 20-29 (class 1) and 50-59 (class 2). These classifiers
trained two variants of the FairFaces dataset: (1) a balanced dataset with equal male and female representation in both classes, (2) dataset where males overrepresented in class 1, and females are overrepresented in class 2. These variations allowed us to systematically assess how biases in the training data are reflected the classifier's behavior and how well DEXTER captures these biases.
To generate bias reports for a given classifier, DEXTER produces 50 images that maximize the model's prediction for the target class. Each image is captioned using a VLM (ChatGPT-44 mini), and the list of captions is used to prompt another instance of the VLM to generate a textual bias report. This approach ensures that the generated reports reflect only the classifier's internal representations and socision-making processes (more details about VLM hallucination evaluation in appendix I). Figure showcases excerpts of two generated bias reports.
Report Overrepresentation of training
3. Sender Resresentation: The sligtt overrerreentaatinn of sale subjects in the captions could sugaest a biss is the training date, which my not sqully reprosent young vome..
System Fronut
Captions
nodel does not appear omibit significant identifying the class 28 yeurs old indivisuuls.
Report No gender bias
Figure 4: DEXTER explanation reports. Report analyzes classifier trained a FairFaces variant with male overrepresentation in class 1, while Report 2 corresponds to a balanced dataset.
We evaluate DEXTER's bias reports through two complementary approaches:
1. User Study. In addition the earlier study, participants evaluated and ranked DEXTER's bias reports for two classifiers. Informed of dataset biases, they assessed report accuracy, clarity, and interpretability. We report human Mean Opinion Scores (MOSpunans- 1-5 scale), and complement them with automated evaluations: MOSLLM from VLM and G-eval [20] metrics, including G-evalgon for consistency with classifier behavior. These scores jointly assess the linguistic, structural, and explanatory quality of DEXTER's 's outputs.
Comparison with training-derived reports. We compare DEXTER's data-free free reports those generated from training set images using the same pipeline (captioning + LLM-based reporting). Their similarity is quantified via sentence transformer similarity (STS) [33], measuring alignment with data- grounde biases.
Table 2 shows strong agreement between human (MOShamans) and model (MOSLIM) ratings (statis- tical validation in appendix F.2), with all scores across MOS and G-eval metrics exceeding 3 and

---

approaching 4 indicating consistent perceptions of the reports as good to excellent. High STS scores further confirm that DEXTER's s reports, generated without data, align closely with saining-derivee insights. This demonstrates DEXTER'S ability to capture model biases fluently, faithfully, and without supervision. The bias reasoning enabled by DEXTER also facilitates disparity analysis across a variety of classifiers (from transformers to CNNs) as shown in Fig. 8 of the supplementary, where we compare ViT, AlexNet, ResNet50, and RobustResNet50 on ImageNet classes.
Full methodological details and report samples are provided in Appendix F and the supplementary.
Table 2: Evaluation of DEXTER bias reports generated for classifiers trained on FairFaces. The columns "w Bias" and "wo Bias" refer to models trained on datasets with and without gender bias, respectively, for each age group.
Class D (20-29)
Class (50-59)
Mean
Metric
Rias
w/o Bias
Bias
w/o Bias
STS
0.92
0.85
0.91
0.91
0
G G-evaloo
4.58 +: 1.00
4.80
0.47
3.86 1: 0.84
3.68 +: 0.85
4.19 0.52
MOS
4.29 1: 0.63
4.80
0.37
4.63 0.44
4.19
1 0.74
4.48 1: 0.22
MOSsamane
3.89 = 0.61
4.10 0.67
3.88 = 0.79
1.01 0.69
4.2.4 Ablation Study
We investigate how prompt design, auxiliary optimization, and multi-target strategies affect DEX- TER's s ability to generate effective and interpretable visual explanations. Using 30 SalientImageNet classes (15 labeled with spurious and 15 with core features), we compare four prompting strategies by generating 100 images per class and measuring classifier activations: (1) class label only, (2) ChatGPT-gennrated descriptions, (3) captions from DiffExplainer, and (4) DEXTER's optimized prompts. As shown in Table 3, DEXTER achieves the highest mean score (75.43), effectively maximizing both spurious (63.00) and core (87.86) features. In contrast, the baseline and ChatGPT perform moderately, while DiffExplainer underperforms.
We then ablate the role of prompt length and auxiliary loss Lmask by comparing single-word vs. multi-word optimization, with and without auxiliary supervision. Single-word prompts lack expressiveness (mean 23.73), and multi- prompts without auxiliary loss are unstable (mean 11 11.83). Introducing Lmmn improves both cases, with the best performance achieved when combining molti-word prompts and auxiliary loss (75.43). This highlights the importance of pairing rich prompts with stable optimization to align explanations with classifier behavior. The standard deviations reported in Tables 3 and may appear high due to the variation in activation strength across different classes, as some classes are consistently activated and others only partially. For instance, while some classes were activated in 100 out of 100 generations, others were only in 20 out of 100, As a result, this large variation across classes naturally leads to high overall standard deviation. Full ablation details are provided in Appendix G.
Finally, we evaluate the faithfulness and robustness of DEXTER's explanations by testing for bias propagation and LL hallucinations. In the first test, we injected adversarial cues (e.g., using lion for tiger) into prompt initialization to assess whether upstream biases from BERT or Stable Diffusion would affect outputs. DEXTER consistently recovered class-relevant features, showing robustness to such distortions. In the second test, we extracted the most salient visual cue from each generated text report and added it to the image prompt; the resulting increase in classifier activation confirms that the cues contained in the text explanation reflect model-relevant features rather than hallucinations. Full details and statistical validation provided in Appendix I.
5
Limitations
While DEXTER delivers detailed, data-free global explanations. it is computationally demanding: prompt optimization takes 10 minutes per class, though generating 100 images and the final bias report is fast (~15 seconds without backpropagation), making it suitable for offline use. Since DEXTER relies on Stable Diffusion, there a risk of NSFW outputs; to mitigate this, we apply its built-in safety checker to filter and discard inappropriate images during generation.

---

Table 3: Comparison between text-prompting strategies for maximizing the target class.
Method
Spurious
Core
Mean
Baseline
43.06 = 38.86
86,40 + 23.83
64.73 + 31.34
ChatGPT description
41.20 = 40.78
78.53 + 34.02
59.87 + 37.40
DiffExplainer
33.20 + 41.07
47.66 + 44.80
39.83 42.93 75.43 23.17
DEXTER (ours)
63.00 + 31.20
87.86 15.14
Table 4: Ablation results for single-word and multi-word prompt optimization, with/without the auxiliary task L-mas-
Configuration
Spurious
Core
Mean
Single-word
11.13 1 27.38
36.33 - 38.45
23.73 32.91
+ Leask
34.00 32.72 15.53 = 27.93
53.86 1 44.64
43.93 38.68
Multi-word
8.13 - 18.74
11.83 23.33
+ Lmask
63.00 + 31.20
87.86 = 15.14
75.43 + 23.17
Conclusion
We introduced DEXTER, a framework for globally explaining deep visual classifiers by combining diffusion- based activation maximization with textual reasoning. Unlike existing methods, DEXTER operates in a fully data-free setting, deriving insights solely from the classifier's internal repre- sentations. Experiments on SalientImageNer, Waterbirds, CelebA, and FairFaces demonstrate its effectiveness in uncovering spurious and core features, identifying dataset subpopulations, and gen- erating human- -uadabbe bias explanations. Ablation studies confirmed the impact of multi-wore prompts and auxiliary optimization, while user studies validated the clarity and relevance of DEX- TER's 's textual explanations. Future work will extend its capabilities to multimodal models and on refining textual reasoning.
Acknowledgements
Simone Carnemolla, Matteo Pennisi, Giovanni Bellitto, Simone Palazzo, Daniela Giordano, and Concetto Spampinato have been supported by the European Union Next Generation EU, Mission 4 Component 2 Line 1.3, through the PNRR MUR project PE0000013 FAIR "Future Artificial
Intelligence Research" (CUP E63C22001940066)
References
[1] Chirag Agarwal, Daniel D' souza, and Sara Hooker. Estimating example difficulty using variance of gradients. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition, pages 10368-10378, 2022.
[2] Sacid Asgari, Aliasghar Khani, Amir Hoscin Khasahmadi, Aditya Sanghi, Karl D.D. Willis, and Ali Mahdavi Amiri. texplain: Post-hoc textual explanation of image classifiers with pre-trained language models. In ICLR 2024 Workshop on Reliable and Responsible Foundation Models, 2024. URL httpss//openreviiee
[3] Shi Chen and Qi Zhao. Rex: Reasoning- aware and grounded explanation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15586-15595 2022.
[4] Yashar Deldjoo. Understanding biases in chatgpt- recommender systems: Provider fairness, temporal stability, and recency. ACM Trans. Recomm. Syst., 2024. doi: 10.1145/3690655. URL https://dol: /ttt::://do..or//1...
org/10. 1145/3690655
[5] Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint 1:X0v:1800.04805, 2018.
10

---

[6] Finale Doshi-Velez and Been Kim. Towards a rigorous science of interpretable machine learning. In arXiv preprint arXiv:1702.086000 2017.
[7] Dumitru Erhan, Yoshua Bengio, Aaron Courville, and Pascal Vincent. Visualizing higher-layer features of a deep network. University of Montreal, 1341(3):1, 2009.
[8] Sabri Eyuboglu, Maya Varma, Khaled Kamal Saab, Messer, Jared Dunnmon, James Zou, and Christopher Re. Domino: Discovering systematic errors with cross-modal embeddings. In International Conference on Learning Representations.
Delbrouck, Christopher Lee-
[9] Robert Geirhos, Patrick Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness, 2019.
[10] Shantanu Ghosh, Rayan Syed, Chenyu Wang, Clare B. Poynton, Shyam Visweswaran, and Kayhan Batmanghelich. Ladder: Language driven slice discovery and error rectification, 2025.
URL https://arxi... prggabs///08.....////// 07832.
[11] Lisa Anne Hendricks, Zeynep Akata, Marcus Rohrbach, Jeff Donahue, Bernt Schiele, and Trevor Darrell. Generating visual explanations. In European Conference on Computer Vision (ECCV), pages 3-19. Springer, 2016. doi: (10077978--3311-44449333
[12] Saachi Jain, Hannah Lawrence, Ankur Moitra, and Aleksander Madry. Distilling model failures as directions in latent space. In The Eleventh International Conference on Learning Representations.
[13] Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterizztion with gumbel-softmax. In International Conference on Learning Representations, 2017.
[14] Kimmo Kärkkäinen and Jungseock Joo. Fairface: Face attribute dataset for balanced race. gender, and age for bias measurement and mitigation. Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision ( (WACV), pages 1548-1558, 2021.
[15] Maxime Kayser, Oana-Maria Camburu, Leonard Salewski, Cornelius Emde, Virginie Do, Zeynep Akata, and Thomas Lukasiewicz. e-vil: A dataset and benchmark for natural language explanations in vision- langune tasks, 2021. URL https: //tp://aaavvv//aa org/ w.wss/110 03761.
[16] Younghyun Kim, Sangwoo Mo, Minkyu Kim, Kyungmin Lee, Jaeho Lee, and Jinwoo Shin. Discovering and mitigating visual biases through keyword explanation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pallern Recognition, pages 11082-11092. 2024.
[17] Brian Lester, Rami AI-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3045-3059, 2021.
[18) Zachary C. Lipton. The mythos of model interpretability: machine learning, the concept of interpretability is both important and slippery. Queue, 16(3):31-57, 2018. doi: 10.1145/ 3236386.3244340..
[19] Evan Liu, Behzad Haghgoo, Annie Chen, Aditi Raghunathan. Pang Wei Koh, Shiori Sagawa, Percy Liang, and Chelsea Finn. Just train twice: Improving group robustness without training group information. In International Conference on Machine Learning, pages 6781-6792. PMLR, 2021.
[20] Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu. G-eval: Nig evaluation using gpt-4 with better human alignment. In Proceedings the 2023 Conference on Empirical Methods in Natural Language Processing, pages 251 1-2522, 2023.
[21] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. wild. In Proceedings of International Conference Computer Vision (ICCV), December 2015.
Deep learning face attributes in the
[22] C Maddison, A Mnih, and Y Teh. The concrete distribution: A continuous relaxation of discrete random variables. In Proceedings of the international conference on learning Representations. International Conference on Learning Representations, 2017.
11

---

[23] Aravindh Mahendran and Andrea Vedaldi. Visualizing deep convolutional neural networks using natural pre-images. International Journal of Computer Vision, 100:233-2555 2016.
[24] Junhyun Nam, Hyuntak Cha, Sungsoo Ahn, Jaeho Lee, and Jinwoo Shin. Learning from failure: De-biasing classifier from biased classifier. Advances in Neural Information Processing Systems, 33:20673-20684, 2020.
[25] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 427-436, 2015.
[26] Anh Nguyen, Alexey Dosovitskiy, Jason Yosinski, Thomas Brox, and Jeff Clune. Synthesizing the preferred imputs for neurons in neural networks via deep generator networks. In Advances in Neural Information Processing Systems (NeurIPS), pages 3387-3395, 2016.
[27] Anh Nguyen, Jason Yosinski, Jeff Clune, Alexey Dosovitskiy, and Thomas Brox. Plug & play generative networks: Conditional iterative generation of images in latent space. arXiv preprint arXiv:16/2.00005, 2017.
[28] Chris Olah, Alexander Mordvintsev, and Ludwig Schubert. Feature visualization. Distill, 2(11), 2017. doi: 10.2391 500007
[29] Dong Huk Park, Lisa Anne Hendricks, Zeynep Akata, and Trevor Darrell. Multimodal explana- tions: Justifying decisions and pointing to the evidence. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 8779-8788, 2018.
[30] Matteo Pennisi, Giovanni Bellitto, Simone Palazzo, Isaak Kavasidis, Mubarak Shah, and Concetto Spampinato. Diffexplainer: Towards cross-modal global explanations with diffusion models. Computer Vision and Image Understanding, 262: 062:104559, 2025. ISSN 1077-3142.
[31] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning.
pages 8748-8763. PMLR, 2021.
[32] Hamed Rahimian and Sanjay Mehrotra. Distributionally robust optimization: A review, arXiv preprint arXiv: 05659, 2019.
[33] N Reimers. Sentence-bert: Sentence embeddings using siamese bert-networks. arXiv preprint [tt::1908.10084 2019.
[34] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[35] Shiori Sagawa, Pang Wei Koh, Tatsunori B Hashimoto, and Percy Liang. Distributionally robust neural networks. In International Conference on Learning Representations, 2019.
[36] Fawaz Sammani and Nikos Deligiannis. Uni-nlx: Unifying textual explanations for vision and vision-language tasks, 2023. URL https: httpe:://axxvvvoee httgg/bbs/330/ 2308, 09033.
[37] Fawaz Sammani, Tanmoy Mukherjee, and Nikos Deligiannis. NIx-gpt: A model for natural language explanations in vision and vision-languee langugee tasks, 2022. URL https://arxiv org/ abs/2203. 05081.
[38] Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das. Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. 2017 IEEE International Conference on Computer Vision (ICCV), pages 618-626, 2017. doi: 10. 109//CCV.2017.74.
[39] K Simonyan, A Vedaldi, and A Zisserman. Deep inside convolutional networks: visualising image classification models and saliency maps. In Proceedings of the International Conference on Learning Representations (ICLR). ICLR, 2014.
12

---

[40] Sahil Singla. Sebastian Lapuschkin, Wojeiech Samek, Alexander Binder, and Klaus-Robert Muller. Salient imagenet: How to discover spurious features in deep learning? Advances in Neural Information Processing Systems (NeurIPS), 2022.
[41] Nimit Sohoni, Jared Dunnmon, Geoffrey Angus, Albert Gu, and Christopher Ré. No subclass left behind: Fine-gramd grained robustness coarse coarse-grained classification problems. Advances in Neural Information Processing Systems,
2020.
[42] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In International Conference on Machine Learning, pages 3319-3328. PMLR, 2017.
[43] Jianyi Wang, Kelvin CK Chan, and Chen Change Loy. Exploring clip for assessing the look and feel of images. In AAAI, 2023.
[44] Olivia Wiles, Isabela Albuquerque, and Sven Gowal. Discovering bugs vision models using off-the-shelf image generation and captioning. In NeurIPS MI. Safety Workshop.
[45] Jason Yosinski, Jeff Clune, Anh Nguyen, Thomas Fuchs, and Hod Lipson. Understanding neural networks through deep visualization, 2015.
[46] Michael Zhang, Nimit Sohoni, Hongyang R Zhang, Chelsea Finn, and Christopher Ré. Conrect-n-contrast: A contrastive approach for improving robustness spurious correlations. arXiv preprini urXiv:2203.01517 2022.
[47] Yuhui Zhang, Jeff Z HaoChen, Shih-Chema Huang, Kuan-Chich Wang, James Zou, and Serena Yeung. Drml: Diagnosing and rectifying vision models using language. In NeurlPS ML Safery Workshop, 2022.
[48] Bowen Zhao, Chen Chen, Qian Wei Wang, Anfeng He, and Shu-Tao Xia. Combating unknown bias with effective bias-conflicting scoring and gradient alignment. In Proceedings of the AAAI conference artificial intelligence, volume 37, pages 3561-3569, 2023.
[49] Roland S. Zimmermann, Janis Borowski, Robert Geirhos, Matthias Bethge, Thomas Wallis, and Wieland Brendel. How well do feature visualizations support causal understanding of cnn activations? In Advances in Neural Information Processing Systems (NeurIPS), volume 34, pages 11730-11780 1174,, 2021.
13

---

A Glossary
K The cardinality of the set of neurons of interest, which contains both neurons in intermediate and oulput layers of the vision classifier
M translation matrix that maps the BERT vocabulary to the CLIP embedding space
Lact Neuron activation maximization loss. Used determine if the text prompts and images activate the desired neurons of the visual classifier (Eq. 1)
Lagg
Aggregated activation loss. Used also to determine if pseudolabels for Lmask (Eq. 3)
mmakk
cross-entropy loss between the BERT [MASK] token predictions and saved pseudolabels
p The learnable soft prompt in DEXTER
t A sequence consisting of lixed and N [MASK] tokens
femb 'hee embedding of i, including the positional encoding
fixed Text tokens corresponding to "A picture of a"
The BERT vocabulary size, 30522
W
Thhe CLIP vocabulary size, 49408
B DEXTER Algorithm
Algorithm DEXTER
Goal: Investigate class Vision Classifier f
1: Initialize soft prompt
2: for iteration 1 to N do
3: Encode p + [xxed + [MASK] tokens
4: Obtain BERT logits for masked token prediction
5:
Apply Gumbel-Softmax to to obtain the predicted token f
6:
Use translation matrix M to convert to the CLIP vocabulary ((C) iM
7:
Compute CLIP text embedding
[())
8:
Generate image with diffusion model conditioned on e
9:
Apply cross-entropy loss Lact with ground truth to f(((())
Apply auxiliary loss Timask on using the previous logit with the highest class activation
11: Update p
12: end for
C Training hyperparameters
We adopt CLIP as the text encoder and Stable Diffusson v1.4 as the diffusson model. To reduce inference time, employ the Latent Consistency Model (LCM) LoRA adapter uuiing 4 inference steps. DEXTER is trained with a batch size of (i.e., one image per iteration) and learning rate of 0. across all tasks. the following sections (Appendices D, E and F), the term optimization steps refers to the number of iterations performed to optimize the trainable soft prompt. Each optimization step consists of: predicting the masked token, generating an image, and obtaining the visual classifier's prediction.
In the following, detail the parameters and hyperparameter settings described in Sections 3.1 and 3.2: for the textual prompt sequence [axed m., ........ m,), we use "'a picture of [MASK] " in the single-word optimization scenario, whereas for multi-word optimization, the fixed prompt is "a picture of [MASK] with [MASK] and [MASK] and [MASK] and [MASK] and [MASK]
We set the sequence P of soft prompts to (see Sect. C.1), with each embedding having dimension 768, matching BERT's embedding space. The temperature for the Gumbel softmax is kept at
2 Hugging Face Stable Diffusion id: htt.://ooorrrc....oooraaads----. sdv1-5. "Huggin Face LoRA id: aatent-coneistency/lcaa
14

---

its default value of 1.0.
All experiments ran in half preei-rooiiion on three H100 GPUs. Prompt optimization takes 10 minutes class, while generating 100 images and the final bias report takes ~15 seconds without backprop- agation. DEXTER is designed for offline, global auditing, with cost aligned its goal of delivering comprehensive model insights.
C.1 Number of soft prompts experiments
We set to keep the setup minimal and stable. DEXTER, the soft prompt guides BERT in selecting hard tokens via masked language modeling, rather than encoding semantics directly. Expressiveness comes from composing multi-token prompts (typically 5-6), not from prompt dimen- sionality. Experiments with P > 1 show that increasing P expands the parameter space and weakens the classifier's gradient signal, destabilizing optimization in our data-free setting, as shown in Table We report mean and standard deviation for 8 randomly selected classes (4 core, 4 spurious).
Table 5: DEXTER's performance using diffent number of P.
P
Spurious
Core
Avg
81.25 + 18.99
94.25 4.38
87.75 + 11.68
3
75.00 + 29.00
44.50 = 35.89
59.75 = 32.44
73.50 + 25.66
74.00 42.75
73.75 + 34.20
10
21.25 + 31.17
67.75 + 40.01
44.50 + 35.59
D Visual Explanation Details
This appendix provides additional details the evaluation of visual explanations generated by DEXTER, complementing the discussion presented in Section 4.2.1. Specifically, we outline the methodology behind CLIP-IQA, our proposed Semantic CLIP-IQA metric and the comparison between DEXTER and prior activation maximization works. Following, comprehensive analysis of neural feature maximization. These insights further substantiate the findings reported in the main paper and demonstrate the robustness of DEXTER in generating interpretable visual explanations.
D.1 Quantitative evaluation metrics: CLIP-IQA and Semantic CLIP-IQA
CLIP-IQA [43] is metric originally introduced to evaluate image quality. In this work, we leverage CLIP-IQA to compare the quality images generated by DEXTER against those produced by other approaches. Specifically, CLIP-IQA calculates the similarity between generated images and two fixed prompts, returning the probability that an image is closer in similarity to the first prompt rather than the second. The fixed prompts used in the original formulation are "Good photo." " and "Bad photo."
To incorporate semantic relevance into image quality assessment, propose Semantic CLIP-IQA.
This metric follows the same evaluation protocol as CLIP-IQA but replaces the fixed prompts with class-specific prompts: "Good photo of a [CLASS]" " and "Bad photo of a [CLASS]", This modification ensures that the evaluation captures not only general image quality but also the semantic alignment between the generated images and the target class.
We here also report in Table a quantitative comparison of visual explanation quality across existing activation maximization methods. The comparison highlights the significant performance gap between older GAN-based or optimization-base DEXTER demonstrates superior alignment and consistency, validating its ability to generate more meaningful and semantically grounded visual explanations.
approaches and diffusion- based methods. In particular,
D.2 Neural Feature Maximization
Neural feafure maximization refers our strategy to generate images that emphasize the neural features, as defined in SalientImageNet (i.e., the features of the penultimate layer of the model), learned by neural network for given class. By optimizing the input image to maximize the activation of
15

---

Table 6: Quantitative comparison between DEXTER and existing activation maximization
methods for visual explanations
Method
CLIP-IQA
Semantic CLIP-IQA
Yosinski et al. [45]
0.37 + 0.19
0.33 + 0.23
Mahendran and Vedaldi [23]
0.82 + 0.15
0.72 + 0.15
Nguyen et al. [26]
0.74 + 0.21
0.57 1 0.30
DiftExplainer [30]
0.89 + 0.09
0,90 + 0.05
DEXTER (ours)
0.94 + 0.03
0.96 + 0.03
specific neural features, this method allows for an interpretable visualization of what the model has learned to recognize as distinctive for class. This approach is useful for understanding how deep learning models make decisions and can help identify potential biases or spurious correlations in their predictions.
In our work, neural feature maximization is performed using 2,000 optimization steps with a single word prompting strategy (see Sect. 4.2.4). We employ RobustResNettO the visual classifier for this task. Table reports the 30 classes selected from the SalientlmageNet dataset, consisting of 15 classes containing spurious features and 15 with only core features. Specifically, we selected all 15 classes from SalientImageNet in which all top-5 features were marked as spurious. Additionally, we randomly selected another classes from SalientImageNer where all top-5 features marked as core.
Table 7: Bias and Non-Bias Classes
Bius Classes
Non-Bias Classes
Class idx
Class Name
Bias
Class idx
Class Name
Bias
706
patio
985
duisy
sanglasses
291
lion
horizontal bar
292
figer
795
ski
486
celle
X
379
howler monkey
465
hullesproof vest golf ball
X
890
volleyball
574
X
801
snorkel
582
grocery store
X
981
ballplayer
635
magnetic compass
X
746
puck
514
cowboy boot
416
balance beam
609
jeep
537
dogsled
624
library
miniskint
rifle
space bur bathing cap
847
tank
433
879
unbrella
785
seat belt
971
bubble
X
Figure extends Figure by reporting additional comparison between DEXTER and DiffExplainer across different classes (the full set of comparisons is provided in the supplementary). While DiffEx- plainer effectively maximizes shapes, colors, and textures, its outputs often lack realism, converging on abstract or pattern-like images. In contrast, DEXTER, owing to its textual anchor, more reliably yields semantically coherent representations of the features highlighted by the SalientImageNet heatmaps. This visually confirms the results of the user study reported in Fig. 2.
16

---

Label dos (Jep))
Label 706 (Patic)
Label 985 (Daisy)
Label (Bathing Cap)
Peakure 13B0
Parton
121
23.0
Packere
Fastar 38B
Pedaam Postlar
2013
Pactor
Porter
ARA
Figure 5: Comparison of DiffExxlainer and DEXTER with respect to Salientlmagenet for the neural feature maximization task, covering different classes. The left column displays classes without spurious features, whereas the right column shows classes with spurious features.
17

---

E Slice Discovery Details
This appendix provides additional details on slice discovery and debiasing using DEXTER, comple- menting the discussion in Section 4.2.2.
Figure extends Figure to better explain the Slice Discovery pipeline used by DEXTER. We use the Waterbirds dataset as example, which consists of two classes: Landbirds and Waterbirds. The majority of the landbirds samples are visibly on land, and similarly the majority of the waterbirds in/near water. While overall this is easy task for most classifiers, want to ensure high performance on the small amount of images where the birds are not in their natural habitats (landbirds on water, waterbirds on land).
Text Encader
Sinlarity
pend ocean
Biased and Unbiased slices
Words
Top
land
CUP Image Encoder
Landbird Waterbird
on land
on land
Dattneet
(Landbirds)
(Wwneebbrds))
Landbird
Waterbird
on water
on water
Classifier
Clnas 0 Gandbirds)
Cless (Waterbirds)
Figure 6: Pipeline for Slice Discovery with DEXTER. The top-k words associated with a class are encoded using the CLIP Text Encoder and compared with image encodings from the biased dataset. The appropriate slice determined based on the similarity between text and image embeddings, along with the ground truth labels of the dataset images. The dataset is then labeled into four categories: waterbird on water, waterbird on land, landbird on land, and landbird on water (see right side).
DEXTER identifies the words explaining an input visual classifier, as presented in Sect. 3. Specifically, given classifier f and target class c, it optimizes text prompt to extract words We Wel,..., Wook (Tab. 8). Each word Wis is encoded using CLIP's text encoder to obtain an embedding tai and the class prototype is defined the average embedding: &c Σ tei Then, following the approach in B2T [16], at inference time, each image T; of the dataset is encoded into vy using CLIP's image encoder. The similarity between the image and the class is then computed as:
of top-k class
CLIP score similarity(Uj,,
If an image has an higher similarity with the class-words that correspond to its real class it is labeled as unbiased slice (e.g. an image belonging to class landbirds with an higher similarity with landbirds class-wond words), while if an image has an higher similarity with its counterpart class it is labeled as biased slice (e.g. an image belonging class landbirds has an higher similarity with waterbirds class- class-words). Fig. 7 presents the ROC curves obtained using the CLIP-based matching approach on the Waterbirds dataset, in comparison with other SOTA slice discovery methods [16, 8, 12]. The results illustrate how effectively the training images are partitioned into the four groups (waterbird on water, waterbird on land, landbird on land, landbird on water) by the DEXTER-derived words. Finally, we follow the debiased training scheme from [35] to train debiased classifier on the dataset.
In all our slice discovery experiments, we & both for CelebA and Waterbirds. We used 1000 DEXTER optimization steps and single word prompting (see Sect. 4.2.4) as an activation maximization strategy to discover the above words. Tab. 8 reports the discovered words for both datasets, where class 0 of CelebA has been left blank as in B2T [16].
E.1
Top-k words selection details
The top-k words Table were obtained by running the DEXTER pipeline multiple times (specifi- cally k=4 timeless). In each run, we recorded the final (single) pseudo-token selected by the masked language model the end of the optimization. To encourage diversity across runs, we excluded previously selected words from the candidate pool before each run. However, we also evaluated
18

---

Table 8: Class-wise words discovered by Dexter for Waterbirds and CelebA datasets.
Dataset
Class
Class 1
Waterbirds fence, woods, jungle, backyard
seas, sea, lake, harbor
CelebA
woman, person, head, girl
Table Comparison between multi-run top-k word selection (ours) and single-run frequeney- ranked top-k selection.
Method
Fl-score Class
Fl-score Class
B2T
0.99
0.75
0.98 ==
10
0.67
0.98
0.66
ours
0.99
0.76
how using sampling frequency ranking may affect slice discovery results. In particular, we computed results using word frequency-based ranking, evaluating performance with the top k 5 and k 10 most frequent words. We compare these results against our proposed sampling strategy and B2T for reference. As shown in Table 9, our strategy with a single word yields superior performance.
1.0
1.0
True Positive Rate
True Positive Rate
0.8
0.8
0.6
0.6
ERM Confidence
ERM Confidence
0.4
Domino
0.4
Domino
Fallure Direction
Failure Direction
B2T
B2T
DEXTER
DEXTER
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
1.0
False Positive Rate
False Positive Rate
(b) Waterbird
(c) Landbird
Figure 7: ROC curves for slice discovery on the Waterbirds dataset. Each curve is obtained by comparing the slice assignments predicted by each method with the ground-truth slice labels released with the dataset.
F Bias Reasoning Details
Given classifier f and class c, we optimize prompt t" such that a diffusion model generates images Fi, may FM that maximize the classifier's output for c. Each generated image correctly predicted by the classifier captioned using a vision-language model
producing descriptions d4 (g:())) language model h then summarizes the captions into single report, describing the features associated with class e and possible biases. This process is fully data-free: both image generation and reasoning depend only on the model's behavior. For bias reasoning, we generate 50 images classified as the target class using DEXTER over the course of up to 5,000 optimization steps, employing murdi-word prompting strategy. These images are then captioned using ChaiGPT-40 mini with the designated Caption System Prompt (detailed below). Subsequently. another instance of ChatGPT. 4o mini analyzes these captions using the following Report System Prompt extract key class attributes and identify potential biases in the model. To generate the captions and the reports with ChatGPT-40 mini we set a lemperature of 0.2 to mitigate hallucinations, The max tokens parameter is set to O, allowing unrestricted response generation. The top_p is fixed at 1.0, while both the frequency_penaee and the presence_penalye are set to 0.0. Finally, the model generates n output.
19

---

We conducted multiple experiments on different visual classifiers:
The reports presented in Fig. 4 and Appendix were obtained by analyzing a ResNet18 model trained on the FairFaces dataset.
Figure 8, instead, provides a bias/not bias categorization for ViT, AlexNet, ResNet50, and RobustResNet50,, all trained on the ImageNet- 1000 dataset, rather than full bias reasoning reports. Supplementary material contains the full bias reports for all the 30 classes (see Table 7) when analyzing RobustResNet50.
Caption system prompt
You are axxistant apecialized analysing picturex.
generate
detailed description.
You will be given picture and you will have to describe it inserting all the key attributes that you find that
could be inherant.
Keep the description short (ooe sentence) while including all the attr attribateo.
have raturn only description
image. Don't raturn other information.
Don't describe the image in postic vay, just deacribe the visual elacenta.
Don't inclldde information about the that not visible.
Don't include any information
image features age festurea. aubject person describe ethmicity
description.
Xeep the description short (one sentence) while including all the key attributas.
Sramples:
Ingut image: [IMG]
Tegut: bact: Deacr bbe the isage
Ostput: [CAPTION]
Report system prompt
Context:
Clasa Activation Maxinizatios (CNN) This task involves aslyyinn images generated through approach ideatifies trained
enhance analysis, use patterus prompt intagrated with Stable Diffesion zodel. The seft prozpt is optinized to coudition Stable Diffusion to create inages that nazixize the activation chosen class. For each generated inage, if the prodicted class aligas the
strongly activate specific
etored.
Analysis: Given trainable soft prozpt and a Stable diffucion model. We optinize the seft prozpt to conditionate stable diffusion generate picturea that zazinize the prodiction class. If the cluss than
predicted
of
caption
Taak: diven liat of sentences that you will zeceive, you have to reason ou the kay Bbtre that the sodel uses to paxinize specific class. Than you've to do zeport with the explanation of your reasoning. The saying if othervise you aust explain sky biased
If not biased.
the class biased you must explain shy
write the follow this structurs: Title:
Class Activacion Musinization for the "CLASB_
Ryposhesis Model
the class to analyze will be given the user with the 1ist of suntences. The shaps of the usez will be
User:
"Class:
(CLASS)
Captions:
[LIST OF SENTENCE))
20

---

F11 Gender Bias Reports
In this section, we report DEXTER's 's reports obtained by analyzing the ResNet18 classifier trained on the FairFaces dataset. As described in Section 4.2.3, we conducted two training procedures for this visual classifier. In the first procedure, we injected gender bias across the classes, whereas in the second, we employed a balanced training set.
Report for class (20-29 years) of biased classifier (overrepreseentation of men)
The analynte ouggeete that the class '20 to 29 years old people' may exhibit cono blas. While the model captures
a range of othnccities and gesdere, the eephaste on certain skin tones, facial featuree, and expressions could lead exeved representation
considered 'youtaful',
Skin Tone Bias: The trequent mention of light brown and nodiur brom skin toses may indicate a bias tovards thene totes, potentially negl ectingg a broader spectri of skin colore that also represent youth.
Facial Feature Blac: The focus on apecitic facial features that are octen idealized in media could lead to definition of youth, which
not encerpass the full divereity young adulte.
Gundez Representation: The alight focus on the overropreentacion troining data, shich may not equally represent young vozea.
male subjects could suggest bias in the
in conclusion, while the model suceeefully idectifies attributes ascociated with the class '20 to 29 yeare old people," is essential zecognize the fully eaccepass diversity equitable ropresentation acress all denographice.
biases representation. The xodel's predictions zay age scoup, indicaring need for more balanced training data. to encuze
Report for class 0 (20-29 years) of a balanced classifier (equal representation of men and women)
Baxed on the analyaia of the model, it doea not agpear to wahibit significant bisa in identifying the class years individuals. The diveraity in
aye color, tone, gender regrasntation suggesta that rodal is capabla recogiizin broad agectrun of individuaa within this age group- The focua on sell-defined facial features and neutral expresnions aligua with common pacceptiona of youug adulta, and the inclusion of various ethnic bacigrounds indicater as incluxive appronch. In conciuusion the class of 20 years old people, repreanted the sodel, doea consistent with diverse and inclusive represestation of young adulta.
bissed. The attributes identified
Report for class (50-59 years) of biased classifier (overrepreseentttion of women)
Based on analyaia of the aodal, can coscluded that class '50 years old people? is bisse.. The
blas stens from several factors:
Reprasentation of Age: The nodel pradoninently featurea youthful characteriation which may not ancurately
reflect the physical appaazance individuda aged 50 to This suggeats the sodel say be influenced
societal standards that equato youthfulness with sttractiveses, leading to a uisrgressstatton of target age group.
Ethmic and Gunder Blas: The emphasia on lighter sin tenes and the prodexinance of fenale aubjecta indicate diversity. thth the 50 to 58 age range.
perpetuata stereotypes fail represent the diveraity individuals
Societal Starsotypes: The sodel's reliance on seatral or serious expressions may reflect socistal sterectypea about older individuals, which can further aber the rapresstattion of this conclusion, shile doea so through leas that biased tovarda certain physical charactaristica, expressions, danographic representat ions. This hight hightights the importance of enauring diverse and reprosntaciive ive training data to miti nitigate bisd in nachine learsing models.
sodel. attespta anxinise the activation the class '50 years people,'
Report for class 1 (50-59 years) of a balanced classifier (equal representation of men and women)
Based on the analycte, it appears the clase to 59 years people" not inherently blased. model meconsfully captures range of attributes that retlect the diveresty of individonle within this age group. Bosever, there are potential blases the representation of expressions and the predenizance of cerious or neutral
ma fully encerpass the enotional spectrun ot individuals aged 50 to 59, Moreover, the model's training data individuals chould look or behave. For instance, the exphasis on serious expressions may insdverteatly reinforce the sterectype that older adults are lees exprecesve or joytul. In conclusion, while the class itself is not biased, the ropresentation of cortain attributes, particularly expressions and castional portrayals, zay besefit from broader range of depictions avoid reinforcing stereotypes assoctated with aging.
lumcee its perception age, patentially leading stereotypes
21

---

F.2 Bias Report Quality Assessment Metrics
In this section, we provide additional explanations for the metrics used to evaluate the quality of DEXTER's 's bias reports, as shown in Table 2. Following Liu et al. [20], use the G-eval consistency metric, which involves prompting a large language model (LLM) to assess a text's factualness, scoring each report scale from I to 5. Since the original prompts for these metrics were designed for summarization, we create the following G-eval Consistency Prompt to better align with our
task.
Following the G-eval format, we use the Mean Opinion Score of LLM (MOSLIM) metric. This metric uses the MOSLIM prompt asking the LLM to rate between and the generated reports according how well the report accurately describes the existence of bias in the classifier. Additionally, the MOShumans score represents the average rating given by participants in the user study.
For both the G-eval and MOSLLM configurations, we adopt the same settings as Liu al. [20]. Specifically, we use gpt-4-0613 with a temperature of 2, max_tokens = 0, top-p 1.0, frequency-penalty
and presence_penalty
To enhance response diversity, we generate n = 20 outputs. Furthermore, in both G-eval and MOS LLM system prompts, we provide the same evaluation instructions that given to human evaluators during the user study, also following the best practices to reduce hallucinations provided by [4].
To assess whether the LLM's mcan-opinion scores are statistically indistinguishable from those assigned by human annotators, applied an independent-aamples two one-sided equivalence test (TOST). The test compared the distribution MOS to that MOShumans obtaining a < 0.05. Thus, within the predefined equivalence bounds (#:0.5 for Likert scale), the LLM's ratings can be considered statistically equivalent to human judgments, indicating strong agreement between the two sets of scores.
G-eval Consistency system prompt
Instruccions for Braluation=e: In
trained visual claseitier tuice: using with gender-biased iragex.
Second, using balanced dataset.
tack classifier:
effectively
textual description ideatifies the presence
eeliinual Clarrifierwe: à nachine learning rodel, trained distinguss betceen tuo classes (e-gr, Clase 1: 22 29 years old people" Class *50 59 years old people"). carafully. keep
you
open
revieving, and refer to it as zoeded.
Eraluation Criteria:
Consietency (1-6) the factual aligunent betueen the question and the description. factually consietent descriptics contains statements that are entailed by the question. Ammotators vare also asked to penalize descriptions that costained ballucinsted
Eraluation Stops:
question carefully and compare the question. points of the question, and it it precents then in clear and logical order. 3. Assign scoze for consistency Descriptien' based Draisstion Critoria.
the
pointa.
description
description covers topic koy
scale of to E, vhere is "Sad Description" and "Ercellon:
Exaxple:
Queation:
(Question)>
Descriptios:
((Description))
DNLY):
Consistency (1-6):
22

---

MOSLLM system prompt
*=Instructions for Broluationre: In this task, se trained vieual claseifier twice:
1. Pirat, using dataset: with gender-blased irages. Second,
balanced dataret.
avaluate effectivaly a gieen testusl description identiffes the presence absenow pender b135 in the vicual classifier:
eeviouull Clarsitieree: à nachine learning model trained dietinguieh betseen classes (e-go> Glaze +20-20 years people"
years peopla").
Please rake sure you read and inderstand there instructions carefully. Pleaze keep this docuzent open while
Sralustion Oriterta:
Opinton (1-5)
description based etfectivenees:
1: Bad description (fails to identify bias or provide relevan: details).
2: Poor description (coze effort to address blas, but lacits clarity or completenese).
3: Neutral (adequate but not insightful; partially addresses blas)
mostly thorough addreseing Excellent deecrsption (comprohmnevv, clear, and detailed in 1dmstifying biar),
description
5:
Eralustion
Read the question carefully and ideatify the sain topic and key points.
2. Read the description and compare the question. Check if the description covers the zain topic and xty Assign scoze Descraption based on the Bralsatiion Critoria.
question,
clear logical order.
5,
Description"
Question:
[(uuettion)
Descriptios:
((Dacription)>
Svaluation Forz (scores (NLY):
Rating (1-5):
23

---

F.3 Bias identification of multiple vision classifiers
In Fig. 8 we report an example of disparity analysis across VIT, AlexNet, ResNet50, and Robus- tResNet50 for multiple ImageNet classes. By revealing class-specific biases and failure patterns, DEXTER helps identify where each model struggles and can guide data collection efforts when biases are consistently observed across classifiers. To select key neural features for these classifiers, we ranked penultimate-layer neurons by their weights to each class and selected the top 5, mirroring the Salient ImageNet method but without any training data.
Tiger (292)
Jeep (609)
Shorkel (801) Baseball player (981)
Alaxtet
Not blased
Diased
Biased
Biased
RobuntRasket5 ParsNart5
Blased
Not blated
Not biosed
Blased
Blased
Figure 8: Bias analysis across classifiers and Sageent classes. Each cell shows DEXTER- generated visual explanations and bias assessments ("Biased" "Not Biased"). While Lion is unbiased across models, Jeep is biased in ResNet50 but not in its robust version. Baseball Player remains biased in all models, suggesting dataset-level bias.
24

---

G Additional details on Ablation Study
Hrration
teratiie
100 tiemti
go
g
picture of [Lobrery]
A picture
[ibbnar]]
pictare
[ibbray)]
Encoder
Text Enooder
Text Encoder
Activation Scores 93%
Stable Diffusion
Stalle diffusion
stable Diflusion
Cloolter
Cansther
Pradicted Clana:
Precicted Cleax:
Predicted Classt Library
Figure 9:
Procedure to compute the percentage activations.
In this section, we provide further details on how we compute the activation score reported in Table and Table 4. As shown in Figure 9, once the word(s) are obtained at the end of the optimization process, we prompt Stable Diffusion to generate 100 distinct images using fixed prompt tixed (from the optimization stage) concatenated with the discovered word(s) & We then sum all inference steps in which the visual classifier predicts the target class. Figure 10 illustrates examples of the different text-prompt strategies, described in Table 3, alongside their corresponding activation scores for the class Tiger and the class Snorkel.
Class Tiger (Not spurious)
Class Snorkel (Spurious)
Baseline
100%
stcture tiger
picture of sweret
41%
stcture with striped and srange
ChatGPT Baseline
100%
eaplanss sit Jeas
6%
Iceelay ioc
A cleus of steeping tiger
DiffExplainer
100%
veering couu ospictec uner atte........
28%
ptccure a rige woth toger tiger
picture of ea1 Hitt ferzis and just
DEXTER cu..
Sonea
sarting
Figure 10: Examples of corresponding text prompts and generated images for class activation maximization. For non-spurious class like tiger, generated images easily activate target class. However, in the case of the snorkel class, DEXTER able to generate significantly more images that maximize the activation, and exposes the other features the model pays attention to.
25

---

H
User Study Details
What kind of similarity there between the red area the target image and the generatel image? Select one of the option below.
Sepel
Ocnnsholi
CShops
OCooia
Cianetiall
Conket Conreal OWeer
sisia
Caluur smner oalur
Semantoa ein conteete eg hook, nevireow
Sovrrl denwntt the dictarns share avveral on vindlrctes lng chloy
Figure 11: Example of question from the first section of the user study.
Each user study consisted of two parts. The first part aimed to assess the ability of DEXTER to visually highlight the focus of the target classifier for a specific neural feature, while the second part evaluated the accuracy of the textual bias reports generated by DEXTER.
In the first part of the study, each participant was presented with 15 randomly images (explaining specific feature in SalientImageNee) drawn from the outputs of DiffExxlainer and DEXTER. An example is shown in Fig. 11. Participants were asked assess whether the generated image accurately represented the attended region of the real image based on attributes such as color, shape, texture, material, context, or semantic similarity. Additionally, two extra options were provided: "Several Elements" for cases where multiple similarity criteria were met, and "None" for instances where none of the criteria applied.
The second part of the study aimed to evaluate the ability of DiffExplainer reports to detect the presence of bias in the target classifier. The target classifier trained both with and without gender bias, and participants were presented with all four reports generated by DEXTER. Examples of questions for class 0 (20-29 years old) are provided in Fig. 12 and Fig. 13, corresponding to the models trained with and without the injected gender bias, respectively. Participants were asked to rate, scale from 1 to 5, the extent to which the generated report reflected the presence absence of bias.
The user study conducted with 100 distinct MTurk workers, with average completion time of 10.32 minutes. Each feature explanation in the first part received an average of 10.38 responses for DiffExplainer and 10.82 for DEXTER. To minimize response variability, participants were required to provide textual justification for their answers in both sections of the questionnaire before submission. The compensation for each worker was $0.50.
I Diffusion and LLM's Hallucination evaluation
L.1 Randomness in the diffusion generation process
To assess the stability of Stable Diffusion, we performed intra-class evaluation using DEXTER's s final prompt. Across three independent runs (100 images each), we measured activation scores with the target model. If the image generation is unstable, scores will vary significantly. Instead, our consistent results indicate stability. We report mean and standard deviation for 8 randomly selected classes (4 core, 4 spurious) across three independent runs (Tab. 10).
26

---

Civan visual for to recogrize individuals agad where gender biss was introduced through an overppeeenttaaion men, does the descripti pptionnooonn below accurstely identify the presence gender bis in opinion?
wiest sepacts for 1I8 win' pnd my estuum sie
Nan hes Ble The Frequatt aeeiton of light brow one vollee trou skis for myr bnftcrts
lactal fasure alaei The ficar cleciicc theial feat not caa are oftee iaee in nedia caile
Repreerratinn reseraatins The Lapi the wer up reseraaiio
saljecca stul augjest
catos
29 sid smuulty mumi Lan ro mour lord Lut burde an momrii ane
description
Excellent desortitoo
2iaer can wibr
ooaeption Exallit dorippoo
Figure 12: Example of question from the sec- ond section of the user study (biased).
Given a visual classiller trained recogrize idtly duals aged 20 23, where gender blas was removed by ansuring equal ropresentation men and women, the description below accurabely identity the abeance of gender dias in your opinion?
arolysts aeci.,
siguftcce kits sentthytag
te tlas to 20 yor ste uncatdeiion he dives by an hai salar sun
intiralal witkin sigeets
lacall trusd murosiio
The
remen pervention yoer seitt,, tnctiete ng reresettdd the aidel, ras me own he bitee, The attritacee ideeiiiied are crnelivve with duense inclatur reariee young
Bed destriiioon
Excellen desorittion
Bad gron esscrator
3
4Gud alon
S deriiptinn
Theme sind d dats
Figure 13: Example of a question from the sec- ond section of the user study (not biased).
Table 10: Intra-class evaluation of randomness in Stable Diffuuson generation process.
Type
Class
Avg
Spurious
890
55.33 + 2.49
795
79.00 + 1.63
655
96.66 + 0.94
706
100.0 + 0.00
Core
291
100.0 + 0.00
486
95.66 + 1.24
514
86.66
+ 1.24
624
95.66 + 1.88
I.2 Bias propagation
To verify that DEXTER's outputs align with the classifier-rather than reflecting biases from BERT or Stable Diffusion we ran a robustness test. We manually injected spurious cues into prompt initialization (e.g.. replacing the starting auxiliary pseudo-target with lion for the class tiger) to simulate strong upstream bias. Then, for each class in SalientlmageNet subset of our paper (split into "core"" and "spurious" categories), we generated 100 images and measured how often the classifier activated the correct class. We report average classifier activation scores (as defined in Tab. 3 of the paper) for spurious, core classes, and their average. These results in Tab. show that even with adversarially biased prompts, DEXTER recovers class-relevant visual patterns, aligning with the
27

---

classifier. Classifier-dris driven optimization helps correct upstream bias and grounds both visual and textual outputs in model behavior.
Table 11: Comparison of Spurious, Core, and Average scores under different bias conditions.
Condition
Spurious
Core
Avg
Injected Bias
65.3
88.4
76.8
No Bias
63.0
87.6
75.4
We also evaluated how DEXTER compensates for bias propagation. Specifically, we recorded the sequence of words selected pseudotargets during optimization. This was done for both the biased setting and the standard setting, where the initial pseudotarget is chosen randomly. As shown in the Table 12, in both cases DEXTER consistently converges toward the most meaningful word, with the selection path gradually shifting from a random concept to the intended target. This trajectory suggests that the optimization process does not simply lock onto the first spurious core concept it encounters, but instead explores a range of semantically plausible candidates before progressively refining the prompt toward stable and interpretable solution, indicating non-greedy and convergent behavior rather than an early commitment driven by the mask pscudo-label loss. Convergence analysis through keyword trajectory during the DEXTER optimization process. The Table 12 illustrates how DEXTER transitions from initially random concepts to progressively more semantically coherent and domain-specific words, demonstrating convergence toward stable explanation.
1.3 Analysis of LLM hallucination impact
Given that large language models can generate statements influenced by their prior knowledge rather than by factual evidence, systematically assess the fidelity of our reports and how much they are aligned with the visual classifier decision-making process. We aim to ensure that each report highlights genuine visual patterns exploited by the classifier rather than hallucinated elements. Concretely, for each of the 30 SalientImageNet classes in our experimental setup (Tab. 7), we verify whether the single most salient visual cue extracted from the corresponding DEXTER report truly grounded. Given a class e we form
BASELINE PROMPT: "a picture of a [c]", CUE PROMPT: "a picture of [c] with [cue]o ... and [[cue]n'.
where n is the total number of cues obtained automatically from the generated reports via GPT-4o mini class-cues extractor. Then, we generate 100 images per prompt with Stable-Diffusion and measure the Activation Score (AS) on the frozen RobustResNet50 used throughout the paper (4.2.4). cue is grounded when Ane > ASpnseline: otherwise neutral wrong.
Statistical significance & confidence interval. For each class we measure A, ASque,
A SSnwveline Across the 30 classes we obtain
À 16.33 pp,
SA 23.84 pp.
The two-sided 95% confidence interval is
Â + 97.55.29
77.43, 25.24] pp.
30
Both a paired f-test (t(29) = 3.79, p= 7.8 10-4) and a Wilcoxon signed-rank test (W = 19, p 2.9 10-4) confirm that the improvement is statistically significant.
Aggregate results. Table 13 contrasts the mean Activation Scores for the two prompts. Adding the report cue raises the mean score from 64.73% to 81.06% % (+16.33 pp).
20/30 classes (67%) improve (peak +-8 pp for miniskirt), confirming that the cues capture genuinely discriminative evidence.
classes already achieve 100 with the baseline prompt; the eue therefore leaves perfor- mance unchanged.
28

---

Table 12: Word-wise convergence path for biased unbiased initialized prompt.
Grocery Store (582)
Patio (706)
Biased
Not Biased
Biased
Not Biased
motel
fan
restaurant school house
head
library
coffin
book
wedding
factory
party
pool the
restaurant
factory
residence republic tree window house
party
distillery
wedding
market
motel
supermarket
bakery
courtyard
supermarket
terrace
patio
Table 13: Activation Scores averaged over 30 classes (t/L: eue better/worse than baseline).
Prompt
Mean AS (%)
A
Class split
Baseline
64.73
Cue (report)
81.06
+16.33
20 34 7=30
3 classes degrade:
bubble
A = -5 pp; the cue is correct but pertains only to subset of bubble instances.
tanks rifle
A -1 pp (100 % - 99 %); negligible loss.
A pp: the cue "individuals dark clothing" marking the sole clear failure.
Overall assessment. DEXTER explanations are therefore strongly grounded: 27 out of 30 classes the cue is beneficial neutral, and only one class (rifle) exhibits evidence of hallucination. In the two minor degradations (bubble,tanke ttanks) the reports still isolate genuine-though partial- viiuull cues.
Evaluation Implications. The consistent increase classifier confidence when report-derived cues are injected into the prompt demonstrates that DEXTEr's 's explanations faithfully align with the model's decision boundary, rather than reflecting spurious or hallucinatory artifacts. Together with the text-based metries reported in Table 2 for the FairFaces dataset (G-Eval consistency, STS, MOS), these findings confirm that DEXTER delivers genuinely grounded insights into the visual classifier's decision-making process.
Pipeline Robustness. Furthermore, this evaluation implicitly validates the collaborative operation of all pretrained components (BERT, CLIP, Stable Diffusion, VLM) in our optimization pipeline. The target visual classifier guides the prompt optimization. BERT selects discriminative keywords, the diffusion model generates contextually relevant images, and the captioning VLM produces faithful captions. As a result, the end-to-end process avoids propagating biases or hallucinations from intermediate models and yields explanations that are solidly grounded the classifier's 's behavior.
I.4 Baseline prompts vs Cue prompts
This section, referring to Sec. I.3, reports the system prompt used to extract the relevant visual cues from DEXTER's textual explanations. Furthermore, Table 14 compares class-wise activation scores produced by the baseline prompt "A picture of a [CLASS]" and by the CUE-enriched prompt. Large gains appear for classes that were poorly activated in the baseline (e.g., space bar improves from - 57 hockey puck from 0 - 79). The results demonstrate that adding concise semantic cues markedly improves class-specific guidance and reduces hallucinations during image generation.
29

---

Report's cues extractor system prompt
You are an acsistant that reads biar-onalyyie report about an Ixageliet clase and extracts concrete vicual cues that the regort clains are iegortant for that class.
Your task
Identify up
phrasee
are explacttly nentioned in the report;
describe tangible
appeaz ixage (objecta, attributes, background, actious); are likely to trigger the classifier according to the report.
your ansver 1800 two fielde:
"' jaonn "kuy-jhrrmes" ("phoumei", "phisss"" ...l, "Cull-prsape:: "a picture of a <CLASS> with "phreset" and "phrase2" and ..."
30

---

Table 14: Activation maximization scores for each class: comparison between the baseline prompt "A picture of a (CLASSJ" and the CUE prompt obtained from the DEXTER's reports.
Class
Baseline prompt
A8 CUE prompt
AS
volleyball
picture of volleyball
66
A picture of volleyball with young women playing and mixed gender teams and variety of scenarios
78
space bar
A picture of space bar
6
A picture of space bar grid layouts with framed artworks and black-and-wiil andd-white imagery
57
unbrella
A picture of an umbrella
95
A picture of an umbrella with vibrant outdour scenes and garden scenes
100
baschall player
picture of baseball player
98
A picture of basehall player with female athletes and softhall
100
bubble
picture bubble
picture bubble with whimsical
balance beam
picture of balance beam
0
A picture of balance beam with athletic attire and physical activities indocr training euvirenments group dy dynamics and artistic performances
27
cowboy hoot
picture of cowhny hoot
83
A of cowhoy bont with various types boots
patio
picture patio
A picture patio mudern outdoor spaces and affiient homes and specific landscaping styles
expansive
tank
A picture of a tank
100
A picture of tank with camouflage and military cavironment armored
99
dark glasses
picture of dark glasses
8
A picture of dark glasses with facial hair and an older man
daisy
A picture of daisy
100
A picture of daisy with vihrant colors and natural contexts and daisics
100
howler monkey
picture of howler monkey
0
A picture of howler monkey with lush, green environments and natural babitat
liger
picture a tiger
100
A picture of tiger with striped and natural habitat and majestic posture
100
library
picture library
picture of lihrary books organized area and spacious room with furniture and people
belt
picture belt
A picture seat belt with homan subjacts
picture
A picture a rifle with individuals dark clothing jackets and sunglasses and siming
grocery store
picture grocery
picture grocery store with diversity food and
presence of people and colorful displays
snorkel
picture of snorkel mask
41
A picture of a snorkel mask with young individuals and sharks
94
dogsled
picture dogsleed
A picture dogsled with snowy landscapes human animal internction and specific dog hreeds
magnetic compass
picture of magnetic compass
A picture magnetic compass with silver compass pendant and craftsmanship and design
horizontal
picture of horizontal bur
A of borizonial bar sports and athletic envirocment
picture ski
A picture
young individuals with
100
miniskirt
picture of miniskirt
19
A picture of miniskirt with women wearing miniskirts
100
lion
A picture of a lion
100
A picture of lion with distinctive physical traits and social habitat
100
hehavior
internctions
hackey puck
picture of puck
A picture of puck with ice hockey gameplay and player confrontations
swimming cap
picture swimming cap
A picture swimming cap with children joyful scenarios
with adults and certain bair types and smiling expressions
bulletproof
picture bulletproof vest
A picture bulletprouf with casual attire
vello
picture of cello
100
A of cello with musical instrument
100
golf
picture golf
A picture golf hall spherical objects white
jeep
picture of jeep
100
A picture of jeep, landrover with off-road capability
100
Mean
64.73
81.06
31

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction of the DEXTER paper clearly and accurately reflect the paper's s contributions and scope. The three central use cases mentioned in the abstract (activation maximization, slice discovery and debiasing, and bias explanation) all thoroughly addressed and empirically validated in the main body. Additionally, the introduction carefully outlines both the limitations of existing work and how DEXTER addresses them, reinforcing that the scope of the claims is realistic and well-motivated.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We have added "Limitations" section in the document that provides areas where DEXTER could benefit from improvement.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specifiiattin,, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
32

---

3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: The paper does not include any formal theoretical results, theorems, or proofs.
Its contributions methodological and empirical, focusing the design, implementation, and evaluation of the DEXTER framework rather than on theoretical analysis.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: The paper includes all necessary information to reproduce main exper- imental results, with detailed implementation instructions provided in the appendix. It specifies datasets, models, evaluation metrics, and experiment settings. The appendix covers optimization strategies, prompts, training procedures, and evaluation protocols, Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
33

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, described in supplemental material?
Answer: [No]
Justification: While the datasets publicly available the code will be released upon acceptance.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https:
/ chiiss.c/ppblll. wwwpc//g////eeeeeee CoodeSubeeeeeeee wattamiissiiooooiiiiiiio
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The whole experimental setting has been defined in both the main paper and the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: All main tables in the paper report results across different random seeds using mean and standard deviation. To assess whether the I.L.-generated mean opinion scores (MOS were statistically equivalent to those provided by human raters (MOShunans),
34

---

conducted a Two One-Sided Test (TOST) on the paired MOS values presented in Table 2. For the hallucination evaluation (Sec. I.3), we report both statistical significance and confidence intervals, validated using paired t-test and Wilcoxon signed-rank test.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errоrs is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
The paper provides information about hardware and time execution in the "I "Limitations" section of the main paper and in the appendix.
Justification:
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: http:://eeuup..eeee hwtpeeppp...ppulceeeeaeeeeeeee.e cc/ppbllic/.hhicsuudieeee
Answer: [Yes]
Justification: The research adheres to the NeurIPS Code of Ethics. It does not involve human subjects beyond anony user studies conducted via established platforms, uses publicly available datasets, and emphasizes transparency, faimess, and bias identification. The proposed method (DEXTER) is explicitly designed improve model interpretability and promote responsible Al use by revealing biases and spurious correlations in classifiers.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
35

---

The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [No]
Justification: Although the paper does not explicitly discuss the social impacts of DEXTER, it implicitly highlights, indicated in the introduction, the growing need for tools capable of interpreting Al models as they become increasingly sophisticated. In this context, DEXTER aims enhance the trustworthiness of these models, fostering a positive impact on the community that relies on them.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out, For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: The paper discusses in the "Limitations" section the potential risk of gen- erating NSFW content with Stable Diffusion and explains that a safety checker has been implemented to mitigate this issue.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
36

---

12. Licenses for existing assets
Question:
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
Table 15: Assets used and licence information.
Asect
Type
Gilbob/
Saliencinageet
dira
nen commercial research non commercal research
singlasaiil Eelaaliet, imagener
[40)
Waterhinds
data
knkpungwe//nnogg
[35]
Celes
dara
hrpp:l/mmiihhcco cahi: edn helpojccttCleebb..oo
[21]
PunFaces
duza
CCBY-A 4.0
joojefairtace
[14]
Apache license
http:/hnnggingface.com colgoogle
[5]
CLIP
Pretrineed Model
MIT Tscrse
upens//CLPP
[31]
Stable Diffosion
Pretrained Model
CheativeLL RAIL
hnps:hhugsingtaee coistalle diftusion Sisuble diftusion
[34]
OgenAl terms
hntp::/jlafeemmpeeee operni comlaeeooeeeeeeoroooo
OpenAl
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL..
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. wwt.cooo/aaaaaaa damaaatssess has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-pace re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: While the paper introduces DEXTER as novel framework and reports experimental results using standard datasets, does not release new datasets or models as our proposed method aims to explain pretrained model (classifier) using other pretrained frozen models.
Guidelines:
The answer NA means that the paper does not release assets. Researchers should communicate the details of the dataset/code/model part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
37

---

Answer: [Yes]
Justification: All information about the user study conducted in this work is provided in both the main paper and the appendix, including the results and the questionnaire administered to human evaluators. The appendix contains the full text of the questionnaire as well as details about participant compensation for each HIT.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/teview based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [Yes]
Justification:
The paper explicitly describes the use large language models (LLMs) as central and original component of its methodology. In DEXTER, LLMs are used to generate textual prompts and provide human-ime sumaa-interprettbbe explanations of visual classifier behavior.
Guidelines:
The answer NA means that the core method development in this research does not involve L.LMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: : //tpr//eeur////e/ee cc/Conffeennceeeeee for what should or should not be described.
38


Reviews:
[{"review_id": "XvngRcfz1F", "reviewer": "Reviewer_jRsB", "summary": "The paper introduces a novel, data-free framework, DEXTER, to generate global multimodal explanations for vision classifiers. It leverages diffusion models for image generation and large language models (LLMs) for textual reasoning, providing interpretability without requiring training data or labels. The paper evaluates DEXTER on multiple interpretability tasks including activation maximization, slice discovery, and bias explanation, using standard datasets like ImageNet, Waterbirds, CelebA, and FairFaces.", "questions": "1- During training, in each optimization step, how many inference steps were taken for LCM? Is it just 1 inference step?\n2- How can Semantic CLIP-IQA achieves higher score than CLIP-IQA? Provide intuition. Does this mean some images are good photo of [CLASS] but is not a good photo?\n3- Can you please provide comments on how to efficiently select feature neurons if they are not provided in a dataset?", "limitations": "### Possible additional limitations of the proposal\n- **Dependence on foundation models:** Another possible limitation is that DEXTER requires VLM and Stable Diffusion need to have conceptual/semantics understanding of common objects. For example, when investigating chest-X-ray-image related classes but Stable Diffusion was not pretrained with Chest X-ray images. So \n- **Generalization to other complex tasks or other visual classifiers:**\n  + The current evaluation only experimented with one visual classifier, RobustResNet50, which fails to demonstrate the ability to generalize DEXTER performance on other visual classifiers. \n  + The paper focuses on image classification models. It is unclear how well the approach would generalize to detection, segmentation, or multimodal tasks involving reasoning across modalities beyond vision and text.\n  + The pipeline is customized for class-wise analysis, which may not scale well to instance-level explainability in domains like medical imaging.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths\n### Contribution is novel\n- DEXTER that extracts global, class-wise or feature neuron model explanations without any access to data or labels is highly novel. This advances the field of post-hoc interpretability significantly.\n- DEXTER generates multimodal explanation combining text explanation, textual reasoning, and visual synthesis. This advances the explanations more human-interpretable than existing visual-only or textual-only approaches.\n### Thorough Evaluation and Benchmarks\n- DEXTER was evaluated on four well-motivated tasks using four corresponding datasets.\n- Performance is validated with quantitative and qualitative metrics, user studies, and ablation studies. \n### Correctness\n- To the best of my knowledge, the proposal appears to be sound. Although DEXTER includes foundational models like BERT, StableDiffusion, and CLIP, but the whole process was designed such novel and well that the whole process is fully differentiable allowing to optimize soft prompt p which is the only learnable parameter. \n\n## Weaknesses:\n### Proposal's presentation can be improved\n- The paper lacks of a formalization of generating bias reasoning and slice discovery. Bias reasoning and slide discovery are illustrated in Figure 1 as main contributions of the paper beside DEXTER. However, their current descriptions seem to be dataset-dependent as they are given only along with specific datasets in the Section Performance Analysis. Also, Slice Discovery was experimented only with class neuron? This will raise the question whether Slice Discovery can be applied for feature neuron or not?\n- The selection of P in soft prompts was neither discussed nor analyzed. The advantages/disadvantages of P > 1 compared with P = 1 demand futher analyses.\n- There is no discussion on how to determine key neural features efficiently. The paper only provided use cases where neural features are already included in the used dataset SalientImageNet.\n- d(e) used in the formula n = f(d(e)) demonstrated that the diffusion model is applied one time per optimization step during training (i.e., the number of inference step for Stable Diffusion is 1). Is this correct? This demands further clarification.\n- The design choice of loss function in Formula (2) needs discussion. Is that because if n_i is class neuron, 0 <= n_i < 1, the corresponding loss is at logarithm scale, and if n_i is feature neuron, n_i can be much greater, thus the corresponding loss is at linear scale?\n- The paper did not discuss the potential issues of the randomness in each stable diffusion's inference step i.e., d(e) during training.\n- o_i^{(C)} = Mo_i seems not correct. Should it be o_i^{(C)} = o_i M?\n- The experimentation results showed that DEXTER prefers conceptual while DiffExplainer prefers perceptual. However, it is yet unclear for which of their design differences attributed for those observations.\n- Formula (4) is not well-defined. The uses of subscriptions j and i in \\Sum_{j=1}^N log s_{i, y_i} are confused. \n- How can Semantic CLIP-IQA achieves higher score than CLIP-IQA? Provide intuition. Does this mean some images are good photo of [CLASS] but is not a good photo?\n\n### Additional limitations of the proposal\n- **Dependence on foundation models:** Another possible limitation is that DEXTER requires VLM and Stable Diffusion need to have conceptual/semantics understanding of common objects. For example, when investigating chest-X-ray-image related classes but Stable Diffusion was not pretrained with Chest X-ray images. So \n- **Generalization to other complex tasks or other visual classifiers:**\n  + The current evaluation only experimented with one visual classifier, RobustResNet50, which fails to demonstrate the ability to generalize DEXTER performance on other visual classifiers. \n  + The paper focuses on image classification models. It is unclear how well the approach would generalize to detection, segmentation, or multimodal tasks involving reasoning across modalities beyond vision and text.\n  + The pipeline is customized for class-wise analysis, which may not scale well to instance-level explainability in domains like medical imaging.\n\n### Other minor comments:\n- To the best of my knowledge, the target class should be one of the best pseudo-lables returned, and such pseudo-labels are not of interests. How to avoid this? Considering the example in Figure 1 where the investigation class is `bee`, how DEXTER avoids return the pseudo-labels as `bee` which is not of interests.\n- The claim `DiffExplainer [31] introduced diffusion-based image generation guided by soft prompts, improving realism but at the cost of interpretability: soft prompts are continuous vectors with no semantic transparency. ` is not precise. Indeed, [31] includes section 4.4 `towards text explanations` to instruct how to provide textual explanations (eventhough this was not fully investigated in the paper)\n- The textual explanations rely on LLM captions and summarization, which may introduce hallucinations—although mitigated, this remains a concern.", "was_revised": true, "final_justification": "The authors' responses have successfully addressed my confusion and concerns about the proposed framework. \n\nDue to the acknowledged limitations of the proposed framework, in particular its generalization to other complex tasks or other visual classifiers, I couldn't increase my score.", "rebuttal": "We thank the reviewer for the careful evaluation of our work and the thoughtful comments. Below, we address the identified weaknesses (W) and limitations (L), providing clarifications and details to improve the manuscript’s clarity and rigor.\n\n**[W1 - Formalization of generating bias reasoning and slice discovery]**\n\nAppendices C and D already provide high-level explanations of the two methods. In the final version, we will include the following explicit formulations for bias reasoning and slice discovery, emphasizing that both are fully dataset-independent, relying only on model behavior without access to training data or labels.\n\n**Formalization of slice discovery**\n\nDEXTER performs slice discovery without using training data. Given a classifier f and a target class c, it optimizes a text prompt to extract a set of top-k class words\n$W_c = {w_{c1}, \\ldots, w_{ck}}$.\nEach word $w_{ci}$ is encoded using CLIP’s text encoder to obtain an embedding $t_{ci}$, and the class prototype is defined as the average embedding:\n$\\bar{t}c = \\frac{1}{k} \\sum t_{ci}$.\n\nAt inference time, each image $x_j$ is encoded into $v_j$ using CLIP’s image encoder. The similarity between the image and the class is then computed as:\n$\\text{CLIPScore}(x_j, c) = \\text{similarity}(v_j, \\bar{t}_c)$.\nThe predicted class $\\hat{y}_j$ is the one with the highest similarity.\n\nIn binary classification settings, slices are defined by prediction outcomes:\n- If $\\hat{y}_j = y_j$, the image is assigned to the unbiased slice.\n- Otherwise, it belongs to the biased slice.\n\nPrompt optimization does not require access to the dataset, which is only used for scoring. This approach aligns with prior definitions of slices (e.g., Kim et al.) as input subgroups where the classifier exhibits systematic bias. While DEXTER performs slice discovery using class neurons, it also supports feature neurons, allowing broader applications (see Sec. 4.2.1).\n\n**Formalization of bias reasoning**\n\nGiven a classifier f and class c, we optimize a prompt $t^*$ such that a diffusion model generates images\n${x_1, \\ldots, x_M}$ that maximize the classifier’s output for c.\nEach generated image is captioned using a vision-language model g, producing descriptions $d_i = g(x_i)$.\nA language model h then summarizes the captions into a single report\n$r_c = h(d_1, \\ldots, d_M)$, describing the features associated with class c and possible biases.\nThis process is fully data-free: both image generation and reasoning depend only on the model’s behavior. As shown in Appendix D, the resulting explanations align well with those derived from real data.\n\n**[W2 - Number of P in soft prompts]**\n\nWe set P = 1 to keep the setup minimal and stable. In DEXTER, the soft prompt guides BERT in selecting hard tokens via masked language modeling, rather than encoding semantics directly. Expressiveness comes from composing multi-token prompts (typically 5–6; see Appendix A), not from prompt dimensionality. Experiments with P > 1 show that increasing P expands the parameter space and weakens the classifier’s gradient signal, destabilizing optimization in our data-free setting, as shown by these results:\n\n| P   | Spurious       | Core          | Avg           |\n|-----|----------------|---------------|----------------|\n| 1   | **81.25 ± 18.99**  | **94.25 ± 4.38**  | **87.75 ± 11.68**  |\n| 3   | 75.00 ± 29.00  | 44.50 ± 35.89 | 59.75 ± 32.44  |\n| 5   | 73.50 ± 25.66  | 74.00 ± 42.75 | 73.75 ± 34.20  |\n| 10  | 21.25 ± 31.17  | 67.75 ± 40.01 | 44.50 ± 35.59  |\n\n**[W3 – Determining key neural features]**\n\nWe used RobustResNet50 for neural feature selection due to the availability of pseudo-ground truth from Salient ImageNet. For other classifiers (Appendix D.3), we ranked penultimate-layer neurons by their weights to each class and selected the top 5, mirroring the Salient ImageNet method but without any training data. This highlights DEXTER’s fully data-independent design.\n\n**[W4 -  $n = f(d(e))$ --> diffusion model is applied once]**\n\nWhile the diffusion model is invoked once per optimization step, its diffusion process consists of 4 denoising steps. We will include this detail in Appendix A.\n\n**[W5 - Formula (2)]**\n\nCorrect. For class neurons (bounded in $[0,1]$), we use $\\log(n_i)$ to encourage confident predictions. For unbounded feature neurons, we use a linear objective ($–n_i$) to directly maximize activation.\n\n**[W6 - Randomness in diffusion's inference step]**\n\nThis is an important point. To assess the stability of Stable Diffusion, we performed intra-class evaluation using DEXTER’s final prompt. Across three independent runs (100 images each), we measured activation scores with the target model. If generation were unstable, scores would vary significantly; instead, consistent results indicate stability. We report mean and standard deviation for 8 randomly selected classes (4 core, 4 spurious) across three independent runs:\n\n| Type      | Class | Avg              |\n|-----------|-------|------------------|\n| Spurious  | 890   | 55.33 ± 2.49     |\n|           | 795   | 79.00 ± 1.63     |\n|           | 655   | 96.66 ± 0.94     |\n|           | 706   | 100.0 ± 0.00     |\n|           |       |                  |\n| Core      | 291   | 100.0 ± 0.00     |\n|           | 486   | 95.66 ± 1.24     |\n|           | 514   | 86.66 ± 1.24     |\n|           | 624   | 95.66 ± 1.88     |\n\n\n**[W7: $o_i^{(C)} = Mo_i$ incorrect]**\n\nRight. The formula is $o_i^{(C)} = o_i M$ and will be corrected in the final revision.\n\n**[W8 - Explanation for DEXTER preferring conceptual while DiffExplainer perceptual ones]**\n\nDEXTER conditions generation via text: it optimizes a BERT-based prompt decoded into a multi-token hard prompt for a text-to-image diffusion model, yielding semantically rich outputs. DiffExplainer instead optimizes a soft prompt in the diffusion latent space, without language supervision, often producing low-level patterns (e.g., texture, color) with less semantic coherence. This difference explains why DEXTER generates more conceptually grounded images, as shown in Figure 3 and confirmed by our user study (Appendices B.2, F).\n\n**[W9 - Formula (4)]**\n\nWe have corrected the indices in the formula:\n$$\n\\mathcal{L} = \\sum_{k=1}^K l_{\\text{act}}(n_k) - \\sum_{i=1}^N  \\log s_{i,y_i}\n$$\n\n**[W10 - Semantic CLIP-IQA vs CLIP-IQA scores]**\n\nThe higher Semantic CLIP-IQA scores are not due to better image quality, but due to the use of class-specific prompts (e.g., “a good photo of a [CLASS]”), which enhance semantic alignment. In contrast, standard CLIP-IQA uses a generic prompt, lacking class-level grounding. As a result, the two metrics are not directly comparable, as prompt design influences the similarity evaluation.\n\n**[L1 - Dependence on foundation models]**\n\nWhile explanation quality depends on the underlying foundation models, DEXTER’s modular design supports easy adaptation to other domains. In medical imaging, for example, it can integrate models like PubMedBERT for prompts and diffusion models trained on X-rays or MRIs. This requires careful model selection to align medical terms with visual content, but does not alter DEXTER’s core architecture or functioning.\n\n**[L2 - DEXTER Generalization]**\n\nThe reviewer raised three important issues: (1) generalization to other visual classifiers, (2) applicability to tasks beyond classification, and (3) scalability to instance-level explainability.\n\n1) We chose RobustResNet50 for main experiments due to biased annotations in Salient ImageNet. However, as shown in Appendix D.3, we also applied DEXTER to AlexNet, ResNet50, and ViT. Results show consistent ability to investigate model-specific bias across both CNNs and transformers. For instance, Jeep shows bias in AlexNet/ResNet50 but not in ViT/RobustResNet, while Snorkel shows bias across all models.\n\n2) DEXTER was designed for image classification, producing class-level global explanations. We acknowledge that tasks like detection or segmentation involve instance-level, spatial outputs. While not yet applied to these tasks, DEXTER’s modular design could support extensions—e.g., by conditioning on predicted regions or masks. Enabling such reasoning would require additional mechanisms and is a promising direction for future work.\n\n3) DEXTER was designed to provide class-wise, global interpretable insights into the decision-making process of a visual classifier. By construction, it does not target per-sample (instance-level) explainability and may overlook fine-grained variations that are better captured by local methods (e.g., GradCAM, IG, LIME-X). However, while it doesn’t produce per-sample explanations, combining it with slice discovery enables subgroup-level conceptual explanations, thus offering a path toward multi-level interpretability. \n\n**[Minor comments]**\n\nDue to space constraints, we address minor comments 1–3 collectively.\n\n1) The words generated by DEXTER indicate whether a class relies on spurious features. Core classes yield words closely aligned with the label, while spurious ones produce unrelated or contextual terms (e.g., “snow” or “trees” for dogsled). To capture this, we use multiple mask tokens, enabling richer, more informative prompts. Core classes show token convergence; spurious ones diverge. Recovering the class label suggests the classifier focuses on meaningful, non-spurious features.\n\n2) We agree and will revise the statement. While DiffExplainer [31] briefly mentions text explanations (Sec. 4.4), DEXTER extends this with a full pipeline that optimizes prompts for both image generation and semantic explanation. We will clarify this connection in the final version.\n\n3) We acknowledge the potential for LLM hallucinations. To address this, we implemented mitigation strategies and evaluated consistency in Appendix G.2. By linking visual activation cues to generated text and measuring alignment (Table 10), we show that DEXTER’s explanations are generally robust and reliable to LLM hallucinations."}, {"review_id": "A38j3tledy", "reviewer": "Reviewer_xK8N", "summary": "This paper introduces DEXTER, a framework for generating images that strongly activate targeted neurons in a given classifier. \nIts key components are :\n- a frozen Language Model (LM), pre-trained to perform Masked Language Modeling (MLM), which is used to fill in masked tokens in a template prompt, conditioned by a soft prompt vector;\n- a frozen CLIP text encoder that encodes the hard prompt completed by the LM;\n- a Stable Diffusion model that generates images conditioned by the embedding produced by the CLIP text encoder.\n\nThe LM’s soft prompt vector is the only trainable component in the pipeline.  \n\nThe words filled in by the LM can be used to identify spurious correlations learned by the classifier or for interpreting neural features. A bias report for the classifier can also be obtained by using a VLM to caption a set of generated images and then prompting the same VLM to analyse all the captions.", "questions": "Questions\n\n1. Are the activation scores in Tables 3 and 4 the mean activations for the correct class across multiple images? If so, could the authors also provide the corresponding standard deviations?\n\n2. In Appendix C how are the top-k words from Table 7 selected? Is the pipeline run multiple times and the top word of each run is selected (the last pseudo-target of $\\mathcal{L}_{mask}$), or do the author select the top-k words based on the activations produced in a single run?\n\n3. For the words in Table 7, could the authors provide the scores used to rank them, as well as the frequency at which they were sampled in the optimization process? (this is related to question 2 and the discussion below)\n\nWhile the method can be used to identify spurious correlations (SCs) learned by the classifier (the experiments on the Waterbirds and CelebA datasets), the diversity of the proposed words seems a bit low (Appendix Table 7), at least when compared to methods such as B2T[1], Lg[2] or WASP[3]. This is not a major issue, as the identification of SCs is not the main goal of DEXTER, unlike the previously mentioned works. \n\nHowever, I was wondering if qualitative improvements could be made in this regard by simply selecting more words sampled from the MLM encoder in the optimization process. For example, by ranking the sampled words by the strength of the produced activations in the classifier and presenting them in this order, together with the number of times they were sampled from the MLM encoder. This information should be freely available and I think that it would make for an interesting addition to the Appendix. \n\nIt could also offer more insights on how the optimization process works - does it explore multiple valid SCs in this setup and then converges to one of them, or does it simply lock onto the first SC that it finds? A slight concern would be that the mask pseudo-label loss ($\\mathcal{L}_{mask}$) might limit the exploration of potential SCs. \n\nThis type of analysis could also be done for the experiment in Appendix G.1, where the pseudo-label is initialized with the wrong class.\n\nSuggestions:\n- The results in Section 4.2 are a bit hard to parse - e.g. the caption of Table 3 doesn’t seem to offer any sort of hint as to what those numbers represent. I think the clarity of the presented results should be improved in this regard.\n- There are a few typos that should be fixed  - $\\mathcal{L}$mask, on page 9, lines 319 and 322.\n\n[1] Kim et al. \"Discovering and mitigating visual biases through keyword explanation.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.\n\n[2] Zhao et al. \"Language-guided detection and mitigation of unknown dataset bias.\" arXiv preprint arXiv:2406.02889 (2024).\n\n[3] Paduraru et al. “WASP: A Weight-Space Approach to Detecting Learned Spuriousness.” arXiv preprint arXiv:2410.18970 (2024).", "limitations": "The authors analysed the limitations of their method in Section 5.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The framework is modular - the models used in the pipeline can be replaced with newer or specialized ones for domain-specific classifiers;\n2. It can perform bias or spurious correlation identification in a data-free manner - it does not require access to the training data of a classifier in order to identify spurious correlations that the classifier has learned;\n3. The framework’s effectiveness is proven in multiple tasks (activation maximization, slice discovery, bias explanation).\n\nWeaknesses:\n1. As noted by the authors, the framework is rather demanding in terms of hardware resources because it needs to perform backpropagation through the MLM encoder, the CLIP text encoder used to condition a diffusion model, the diffusion model itself and the targeted classifier;\n2. The initial objective (maximizing neural activations) is difficult to optimize, most likely due to the length of the backpropagation chain. To address this issue, the authors resorted to an auxiliary loss $\\mathcal{L}_{mask}$ added after the MLM encoder, which encourages the encoder to predict words that have historically led to higher activations in the classifier. Without this second loss term the results obtained in Table 4 are drastically lower for the multi-word prompt optimization;\n3. The diffusion model can generate additional objects besides what is expressed in the textual prompt, thus inducing some uncertainty with regards to what actually leads to an increased activation for a neuron - a concept mentioned in the textual prompt or a different one that is additionally generated by the diffusion model. This matters in the slice discovery application, but not as much for the bias explanation one, where the generated images are separately captioned and the bias report is generated from these extended captions; \n4. Each component in the pipeline limits the concepts that the framework can identify as important for the classifier (words that the MLM encoder tends to predict in the template prompt and are also in the vocabulary of CLIP’s text encoder, or concepts that the diffusion model can generate), but this can be addressed by upgrading any lacking component (assuming that an appropriate replacement exists)", "was_revised": true, "final_justification": "DEXTER, the framework introduced in this work is flexible and validated for multiple tasks.\n\nThe authors have addressed the concerns of the reviewers in their rebuttal and clarified aspects related to the methodology and the presented results.\n\nThe authors compare DEXTER with DiffExplainer, a prior method that they built upon, highlighting the improvements and benefits brought by their novel additions.\n\nThe  hardware requirements of the framework are justified by the nature of the application - model explainability - and the authors have taken measures to reduce this limitation (e.g., using modules that are more computationally efficient).\n\nOverall, the proposed procedure seems sound and effective. Integrating the reviewers’ feedback should improve the clarity of the paper.", "rebuttal": "We thank the reviewer for the careful evaluation of our work and the thoughtful comments. In the following, we provide clarifications and further insights in response to the weaknesses (W) and questions (Q) raised.\n\n**[W1 – Computational Demand]**\n\nWe appreciate the reviewer’s observation. As noted in the limitations section, DEXTER’s optimization involves multiple frozen models, which can be resource-intensive. To mitigate this, we adopt half-precision arithmetic and latent-consistent diffusion, which significantly reduce runtime. While the prompt optimization step takes ∼10 minutes per class, the final explanation generation is very efficient (∼15 seconds), making the framework practical for offline, global interpretability tasks.\n\n**[W2 – Optimization Difficulty of Activation Objective]**\n\nWe agree that the activation maximization loss alone can lead to slow convergence. The auxiliary pseudo-label loss was introduced specifically to address this issue, and as shown in our ablation (Table 4), it substantially improves performance, especially in multi-word scenarios. We see this not as a workaround, but as a targeted mechanism to improve convergence and interpretability.\n\n**[W3 – Spurious Object Generation by Diffusion Model]**\n\nWe acknowledge that diffusion models may generate elements beyond the text prompt. However, our optimization loop includes feedback from the classifier, which gradually narrows the generation space to align with the desired activation patterns. As a result, off-topic generations tend to be rare and are filtered out over time. This is particularly effective in slice discovery, where consistency across images is critical.\n\n**[W4 – Vocabulary and Generative Constraints]**\n\nWe agree that the intersection of vocabularies and model capabilities can limit the expressiveness of the generated explanations. However, the modular nature of our framework allows for straightforward integration of improved components, such as larger MLMs or more expressive diffusion models. We see this as a promising direction for future enhancement.\n\n**[Q1 – Activation Scores in Tables 3 and 4]**\n\nTables 3 and 4 report the mean activation scores across the 30 classes analyzed by DEXTER. For each class, we generated 100 images using the optimized prompt (e.g., for the class “ski,” 77 out of 100 generations activated the target neuron). The reported scores reflect the average number of successful activations per class.\nAs requested, we also provide the corresponding standard deviations. These may appear high due to the variation in activation strength across different classes, some classes are consistently activated, while others only partially so. For instance, while some classes were activated in 100 out of 100 generations, others only in 20 out of 100. As a result, this large variation across classes naturally leads to a high overall standard deviation.\nAs requested by the reviewer, below we report the scores from Tables 3 and 4, followed by their corresponding standard deviations:\n\nTab. 3 main paper: Comparison between text-prompting strategies for maximizing the target class.\n\n|         | **Spurious**       | **Core**           | **Mean**           |\n|-|-|-|-|\n| **Baseline** | 43.06 ± 38.86      | 86.40 ± 23.83      | 64.73 ± 31.34      |\n| **ChatGPT**  | 41.20 ± 40.78      | 78.53 ± 34.02      | 59.87 ± 37.40      |\n| **Diffexplainer** | 33.20 ± 41.07 | 47.66 ± 44.80      | 39.83 ± 42.93      |\n| **DEXTER**   | **63.00 ± 31.20**  | **87.86 ± 15.14**  | **75.43 ± 23.17**  |\n\nTab. 4 main paper: Ablation results for single-word and multi-word prompt optimization, with/without the auxiliary task $\\mathcal{L}_{mask}$.\n\n|                             | **Spurious**       | **Core**           | **Mean**           |\n|-|-|-|-|\n|**DEXTER single mask**          | 11.13 ± 27.38      | 36.33 ± 38.45      | 23.73 ± 32.91      |\n| **DEXTER single mask + $\\mathcal{L}_{mask}$**    | 34.00 ± 32.72      | 53.86 ± 44.64      | 43.93 ± 38.68      |\n| **DEXTER multi mask**           | 15.53 ± 27.93      | 08.13 ± 18.74      | 11.83 ± 23.33      |\n| **DEXTER multi mask + $\\mathcal{L}_{mask}$**     | **63.00 ± 31.20**  | **87.86 ± 15.14**  | **75.43 ± 23.17**  |\n\nImportantly, across all conditions, DEXTER achieves both higher average activation scores and lower standard deviations compared to previous methods, indicating more robust and consistent performance. We will include this clarification and full results in the final version.\n\n**[Questions 2 and 3 - Selection of top-k words from Table 7]**\n\nThe top-k words in Table 7 (Appendix C) were obtained by running the DEXTER pipeline multiple times (specifically k=4 timeless). In each run, we recorded the final (only one) pseudo-token selected by the masked language model at the end of the optimization. To encourage diversity across runs, we excluded previously selected words from the candidate pool before each new run.\nWe fully agree that using ranked words, rather than only one,  would provide valuable insight into the optimization process and the identification of spurious correlations. Indeed, we adopted a similar ranking procedure in other parts of our framework (e.g., in the bias report and activation score evaluation), specifically:\n\n- We track all candidate prompts (e.g., “a picture of a [WORD] with [WORD]…”) generated during optimization.\n- For each, we compute an activation score by generating 100 images and measuring how many are classified as the target class.\n- The prompt with the highest activation score is selected as the final output.\n\nHowever, as suggested, we also evaluated how using sampling frequency ranking may affect slice discovery results. In particular, we computed results using word frequency–based ranking, evaluating performance with the top k = 5 and k = 10 most frequent words. We compare these results against our proposed sampling strategy and B2T for reference. As shown, our strategy with a single word yields superior performance.  \n\n| Method          | F1-score Class 0 | F1-score Class 1 |\n|-|-|-|\n| B2T             | **0.99**             | 0.75             |\n| k = 10          | 0.98             | 0.67             |\n| k = 5           | 0.98             | 0.66             |\n| ours | **0.99**             | **0.76**             |\n\nWe believe the above results can be explained with the fact that running multiple independent optimizations, each targeting a single word and discarding previously discovered ones, encourages exploration of diverse semantic directions. In contrast, a single optimization run using the top-k words tends to converge quickly and remains confined to a narrow neighborhood of semantically related tokens. This behavior limits the variety of the discovered words and, consequently, the coverage of distinct slices. Nonetheless, we agree that a more systematic analysis of the full distribution of sampled words, as well as the design of more efficient selection strategies, represents a promising direction for future work.\n\nRegarding the analysis on how DEXTER compensates for bias propagation in Appendix G.1, we recorded the sequence of words selected as pseudotargets during optimization. This was done for both the biased setting (i.e., under the same conditions as those reported in Appendix G.1) and the standard setting, where the initial pseudotarget is chosen randomly. As shown in the table below, in both cases DEXTER consistently converges toward the most meaningful word, with the selection path gradually shifting from a random concept to the intended target. This trajectory suggests that the optimization process does not simply lock onto the first spurious or core concept it encounters, but instead explores a range of semantically plausible candidates before progressively refining the prompt toward a stable and interpretable solution, indicating a non-greedy and convergent behavior rather than an early commitment driven by the mask pseudo-label loss.\nConvergence analysis through keyword trajectory during the DEXTER optimization process. The table illustrates how DEXTER transitions from initially random concepts to progressively more semantically coherent and domain-specific words, demonstrating convergence toward a stable explanation.\n\n| Grocery Store (582) |                | Patio (706)        |                 |\n|-|-|-|-|\n| **Biased**           | **Not Biased** | **Biased**          | **Not Biased**  |\n| motel                | fan            | restaurant          | head            |\n| library              | coffin         | school              | book            |\n| wedding              | factory        | house               | man             |\n| party                | sale           | pool                | the             |\n| restaurant           | factory        | residence           | republic        |\n| party                | distillery     |                     | tree            |\n| wedding              | market         |                     | window          |\n| motel                | supermarket    |                     | house           |\n| bakery               |                |                     | courtyard       |\n| supermarket          |                |                     | terrace         |\n|                      |                |                     | patio           |\n\n\n\n\nWe will include these details in the revised Appendix and clarify how it complements the simpler last-token strategy used for Table 7. \n\n\n**[Suggestions: The results in Section 4.2 are a bit hard to parse… / There are a few typos that should be fixed…]**\n\nWe will revise the results and captions in Section 4.2 and Tables 3–4 to improve clarity. Specifically, we will add the following explanation:\n\n“We generate 100 images per class and report the percentage of images that activate the target class.”\n\nWe also thank the reviewer for spotting the typos in the loss term $\\mathcal{L}_{\\text{mask}}$ (page 9, lines 319 and 322), which will be corrected."}, {"review_id": "jjl5wKKggf", "reviewer": "Reviewer_cbH4", "summary": "The paper proposes a framework for generating ​global, textual explanations​ of visual classifiers without requiring training data. It first optimizes text prompts which are applied to generate class-specific images that maximally activate a target classifier. Then it utilizes large language models to analyze synthetic images to produce natural language reports on model behavior and decision patterns. The framework can be operated in tasks like activation maximization, slice discovery for debiasing and bias explanation.", "questions": "I welcome the authors' comments on the concerns outlined in the weaknesses section of my review and their input to clarify any points I may have misunderstood.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. Novel residual-like mask pseudo-labels prediction to support the integrated differentiable process for optimizing text prompts. The design can make joint optimization possible rather than treat prompt generation and image synthetis separately.\n2. Flexible application in various tasks. The method is applicable across tasks like bias detection, feature visualization, debiasing, which might be very useful in model performance improvement.\n3. Abundant and reasonable emprical design and results. Following multiple applicable tasks, it prepares sufficient qualitative and quantitative results to support claim well.\n\nWeaknesses:\n1. Unorganized method illustration. From section 3.1-3.3, in fact there are a lot of steps with complicated notations, K, V, agg, act, .etc, which is a huge chaos. Then it is hard to follow. Even if there is an overall loss function in section 3.3, it only works after certain pseudo-label has been set. So, the order and dependancy among different steps are unclear. A clear and integrated algorithm pipeline might be helpful.\n2. Insufficient details for some key steps. In section 3.3, for each pseudo-label $y_{i}$, its aggregated activation loss L_{agg, i} is initialized and optimized upon a subset of reference neurons $\\mathcal{N}_{i}$. It is unclear how the subset is defined or changed across the optimization process.", "was_revised": true, "final_justification": "I decide to maintain the rating 5 considering all the reviews and response from the authors. The main reasons are:\n1. For my concerns of unclear model pipeline, the authors addressed it by clarifying with simple and straightforward steps, which also matches my understanding. \n2. For the confusions of neuron subset selection, which also mentioned by other reviewers, the authors provides clear and convincing answers.\n3. For other technical points mentioned by other reviewers, most of them are addressed. Some are left for further improvement or exploration in the future.\nIn view of all factors above, I have such a conclusion and decision.", "rebuttal": "We appreciate the reviewer’s careful reading of our paper and the insightful feedback. Below, we respond to the main questions (Q), aiming to clarify and strengthen our contribution.\n\n\n**[Q1 - Unorganized method illustration]**\n\nWe acknowledge that Sections 3.1–3.3 involve several interdependent steps and notations, which may appear complex at first read. To improve clarity, we will revise the paper to include:\n- A streamlined algorithm-style summary of the full pipeline;\n- An updated illustration (Figure 1) that explicitly shows the data flow across components;\n- A glossary clarifying key notations (e.g., M, K, V, agg, act).\nFor clarity, here is a high-level overview of the pipeline:\n1) Section 3.1 main paper\n   - We begin with a visual classifier that we want to investigate if it is biased on a class (e.g. \"bee\")\n   - We form the input for a BERT model as follows: [Soft Prompt] + [\"A picture of a\"] + [Masked Tokens]\n   - The BERT model is tasked with predicting the masked tokens, in the initial steps, it will likely predict the most common words it is pretrained on (e.g. \"man\")\n   - The predicted BERT token is translated into the corresponding CLIP token using the Gumbel Softmax and the translation matrix defined in Sec. 3.1 as $M$.\n2) Section 3.2 main paper\n   - This token is then encoded with the sentence \"A picture of a\" using a CLIP Text Encoder to form the encoded sentence \"A picture of a [PREDICTED CLIP TOKEN]\"\n   - This encoded sentence is used to text-condition a Stable Diffusion model and generate a corresponding image\n   - The generated image is then classified using the investigated visual classifier, and a cross-entropy (CE) loss is obtained.\n3) Section 3.3 main paper\n   - To update the soft prompt we sum the cross-entropy with the masked loss (w.r.t. the pseudo-label obtained in the previous iteration as described in 9-10) and backpropagate across the full pipeline\n   - We update the dictionary where we store the historical CE losses for each token\n   - To supplement the weak training signal, on successive iterations, we use the token having the lowest mean historical loss as a pseudo-label to supervise the future predicted BERT tokens with a masked loss. This allows us to boost the training signal when updating the soft prompt\n   - Over many iterations, the soft prompt will condition the BERT encoder to predict the most relevant word to maximize the model's prediction of the investigated class. In the Figure 1 example, the model's most relevant word is \"flower\" when maximizing the class \"bee\". This indicates that the model is inherently biased on the \"bee\" class.\n\nThese clarifications and structural improvements will be included in the final version.\n\n**[Q2 - Insufficient details for some key steps]**\n\nWe thank the reviewer for the observation. In the case of RobustResNet50, neural feature selection is guided by pseudo-ground truth from Salient ImageNet, which is precisely why we chose this model for our in-depth evaluation. For other classifiers lacking such annotations, the subset of reference neurons used to compute the aggregated activation loss $\\mathcal{L}_{\\text{agg}, i}$ is defined statically before optimization and remains fixed throughout. Specifically, we select the top-k neurons $\\{n_1, …, n_k\\}$ in the penultimate layer with the highest connection weights to the target class output. This ensures that optimization is consistently influenced by the most class-relevant neurons. We will clarify this detail more explicitly in the revised version.  We will clarify this point more explicitly in the revised version."}]

Author rebuttal:

Meta-review: I wish to thank all reviewers and the authors for their work and the extensive discussion.

**Strengths:**

- The core idea of generating global explanations of an image classifier without access to the training data (just the name of the class to be explained) is striking in its simplicity and wide-ranging applicability. Multiple reviewers highlighted the core contribution and I would add that this contribution is likely of wide interest in the NeurIPS community.
- Multiple reviewers also highlighted the flexibility of the approch in terms of easily exchangeable modules (Reviewer xK8N) or adjustability to different tasks (Reviewer cbH4).
- All reviewers emphasized the quality of the evaluation with abundant data sets, tasks, and baselines, as well as a user study.

**Weaknesses:**

- Multiple methodological issues were raised by the reviewers (with Reviewr cbH4 in particular calling the method illustration 'unorganized' and mentioning 'insufficient details for some key steps'). Fortunately, thanks to extensive replies by the authors during the discussion phase (including new results and tables) these concerns could be addressed during the discussion phase.
- One particular concern by Reviewer jRsB was the high computational demand of generating explanations. While the authors agreed that the prompt optimization is rather demanding with ca. 10 min. per class, each single explanation generation is efficient (ca. 15 seconds). This satisfied the reviewers but should probably clarified as 'price tag' of the method.

Overall, after discussions, all reviewers consistently voted to 'accept' and I concur.

I would also concur with Reviewer cbH4 that the clarifications during discussion should be integrated into the main paper for the camera ready.
Decision: Accept (spotlight)