[Re] Improving Interpretation Faithfulness for Vision Transformers
Authors: Izabela Kurek
Wojciech Trejter
Stipe Frkovic
Andro Erdelez
Venue: Accepted by TMLR ()

Abstract: This work aims to reproduce the results of Faithful Vision Transformers (FViTs) proposed by Hu et al. (2024) alongside interpretability methods for Vision Transformers from Chefer et al. (2021) and Xu et al. (2022). We investigate claims made by Hu et al. (2024), namely that the usage of Diffusion Denoised Smoothing (DDS) improves interpretability robustness to (1) attacks in a segmentation task and (2) perturbation and attacks in a classification task. We also extend the original study by investigating the authors’ claims that adding DDS to any interpretability method can improve its robustness under attack. This is tested on baseline methods and the recently proposed Attribution Rollout method. In addition, we measure the computational costs and environmental impact of obtaining an FViT through DDS. Our results broadly agree with the original study’s findings, although minor discrepancies were found and discussed.

Published in Transactions on Machine Learning Research (06/2025)
[Re] Improving Interpretation Faithfulness for Vision Trans- formers
Izabela Kurek' University of Amsterdam
iuabela.kurrdd@sttueen...uu.
Wojeiech Trejter*
wwgjsiech..rrgieresttudddddd.
University of Amsleriam
Stipe Frković University of Amsterdam
stipe./hhooiccesttdeedd.......
Andro Erdelez'
undro.endedee@sstddee....vvw
University of Amsteriam
Reviewed on OpenReview: https: // openreview. net/ forum? id= 28
Abstract
This work aims to reproduce the results of Faithful Vision Transformers (FVITs) proposed by Hu et al. (2024) alongside interpretability methods for Vision Transformers from Chefer et al. (2021) and Xu et al. 2022). We investigate claims made by et al. (2024). namely that the usage of Diffusion Denoised Smoothing (DDS) improves interpretability robustness to (1) attacks in a segmentation task and (2) perturbation and attacks in a classification task. We also exlend the original study by investigating the authors' claims that adding DDS to any interpretability method can improve its robustness under attack. This is tested on baseline methods and the recently proposed Attribution Rollout method. In addition, we measure the computational costs and environmental impact of obtaining an FVTT through DDS. Our results broadly agree with the original study's findings, although minor discrepancies were found and discussed.
1
Introduction
By adopting attention mechanisms that constitute transformers Vaswani et al. 2023). the field of computer vision has experienced significant breakthroughs in tasks such image recognition (Dosovitskiy et al. 2021).
object detection (Zhu et al. 2021), image processing (Chen et al. 2021 and semantic segmentation [Zheng
al. 2021 A notable success is the Vision Transformer (ViT) proposed by Dosovitskiy et al. (2021) which, in addition to its statc-of-tho-art performance, provides an attention vector that can be used to explain its decision-making. However, this approach is not robust to slight input perturbations, leading not only to false classification but also to attention vectors that are misleading interpretability.
Traditional post-hoc interpretability methods have been widely used to analyse ViTs by highlighting im- portant regions in an input image based on attention or gradient-based explanations. They obtain the intermediate self-attention matrices of the model for input and aggregate them alongside heads and lay- happen using various components of the model. Raw Attention (Vaswani et al. 2023) directly uses the attention scores from the last self-attention layer to determine importance (VVasaan et al. 2023). GradCAM (Selvaraju et. al. 2019) uses gradient information obtained during backpropagatiin to determine the importance of each pixel (Selvaraju et al. 2019). Rollout (Abnar & Zuidema, 2020) assumes
ers. Those aggregations
that all attention heads contribute equally and averages them estimate importance (Abnar Zuidemal
"Equal contributions.

---

Published in Transactions on Machine Learning Research (06/2025)
Layer-wise Relevance Propagation (LRP) propagates relevance scores backwards through the network to estimate pixel importances (Binder et al. 2016). Finally, Transformer Attribution (TA) integrates both gradients and relevance scores to find important pixels (Chefer et al. 2021]. The methods output relevance scores for each pixel of the input image, which can be converted into an attention heat map to visualize how relevance regions.
2020j.
Despite the progress of interpretability methods, the vulnerability to adversarial attacks remains critical limitation, small input perturbations can drastically alter their explanations, undermining their reliability, Hu et al. (2024) address this issue by proposing Faithful ViT (FViT), vision transformer that is robust to both performance and interpretability concerns. Unlike standard ViTs, where adversarial perturbations significantly affect interpretability, FVITss ensure that explanations remain stable even under such attacks.
To convert a VIT into an FVIT, they propose Denoised Diffusion Smoothing (DDS), novel plug-in method that combines randomized smoothing and diffusion- basod denoising. Specifically, adds Gaussian noise to an input sample, which is then processed through a guided diffusion model remove the noise. The resulting samples are then fed into ViT of choice for further analysis.
FVITs also contribute to the ongoing debate between post-hoc and model-based interpretability. While post-hoc methods analyze pre-trained models after training to explain predictions, they often lack robust- ness to perturbations. In contrast, FViTs integrate interpretability directly into the model, promising that explanations remain stable under adversarial attacks, thus improving both task performance and model faithfulness.
This paper focuses on reproducing Hu et al. (2024)* experiments, extending the original work by investigating and applying DDS in novel ways, and evaluating the soundness of their main claims. Our results corroborate Hu et al. (2024)ss 's findings that DDS enhances model interpretability and robustness against adversarial attacks, thus reinforcing the broader claim that DDS is a viable method for transforming standard ViTIs into interpretable and robust. FViTs.
2 Scope of reproducibility
Hu et al. 2024g claim that (A) applying DDS to any VIT transforms it into an FVIT, and that (B) FVTTs, unlike standard ViTs, are robust against adversarial attacks both in task utility and, more importantly, in model interpretability. To support their claims, the authors provide mathematical proofs and conduct a series of experiments. Our paper focuses on evaluating the experiments and the main claims derived from them. The following claims tested:
Claim 1:
Applying DDS to a VIT results in more robust segmentations (obtained from an inter- pretability method), particularly under adversarial attacks in an image segmentation task.
Claim 2: Applying DDS to ViT increases the model's classification robustness under sogmentation-informed imput perturbation and adversarial attack in an image classification task.
Furthermore, this paper also expands on the original work by using DDS with methods other than the original TA (Hu et al., 2024). Autribution Rollout. (AR) (Xu et al. 2022), new interpretability method, was shown to offer several advantages over TA (Chefer et al. 2021 and since study examined DDS with AR, this paper aims to fill that gap. Furthermore, Hu ct al. (2024) claim that DDS is a plug-in method to improve performance and robustness against adversarial attacks. Therefore, the addition of DDS to the baseline interpretability methods was also investigated. Namely, our extensions are:
Extension 1: Investigating whether DDS with Attribution Rollout produces better interpretability results than DDS with Transformer Attribution in both aforementioned tasks.
Extension 2: Investigating whether DDS a plug-in method for improving interpretability robust- ness by combining it with baseline interpretability methods in an image segmentation task under adversarial attack.
2

---

Published in Transactions on Machine Learning Research (06/2025)
Lastly, this paper brings to light the possible environmental impacts of applying DDS to ViTs. An investi- gation of the energy usage of DDS compared to other methods was missing in the original study and was therefore performed. Hence, our study also reports these findings:
Impact FVTT's environmental impact is significantly higher than that of all other methods.
3 Background
Faithfulness
Faithfulness refers to how accurately an explanation represents the true reasoning process of a model when making a dccision (Jacovi Goldberg, 2020). It based on three distinctive assumptions:
The Model Assumption: Two models will make the same prediction if and only if they use the same reasoning process.
The Prediction Assumption: On similar inpuls, the model makes similar decisions if and only if its reasoning is similar.
The Linearity Assumption: Certain input parts more important to the model reasoning than others. Morcover, the contributions of different parts of the input are independent of each other.
Robustness
Model robustness denotes the capacity of model to sustain stable predictive performance in the face of variations and changes in the input data (Braiek & Khomh 2024). Specifically, this paper focuses adversarial robustness, which is the extent to which models resist adversarial perturbations.
DDS
DDS is method for transforming standard ViTs into FVTTs with improved interpretability and robustness. It combines randomized smoothing using Gaussian noise with a denoising diffuusion probabilistic model, enhancing the faithfulness of attention maps. Gaussian noise is shown be nearly optimal for this purpose under both la and fx norms.
Interpretability methods
To assess faithfulness, this paper uses post-hoc interpretability methods that produce heat maps highlighting which parts of an image influence the model's decision. These include:
Raw Attention: Uses attention weights from the final layer.
GradCAM: Highlights important regions using gradient- based signals.
Rollout: Aggregates attention across layers to show how information flows.
LRP: Propagates output relevance back through the model.
Transformer Attribution: Combines gradients and relevance for detailed maps.
4 Methodology
Two experiments were carried out to investigate the two aforementioned claims: an image segmentation task under projected gradient deseent (PGD) adversarial attack, and an image classification task under positive and negative perturbation as well as a PGD attack, as described by Hu el. al. (2024) in addition to Chefer et al. (2021). Pre-trained ViT and DeiT models were used for the segmentation task, whereas a pre-trained ViT was used for the classification task (Dosovitskiy al.) 2021 Touvron et al.] (021). Interpretability methods used in Hu et al, (2024); Chefer al. (2021) well as Attribution Rollout by Xu et al. (2022) were investigated. A model combined with an interpretability method produces attention heat maps, which
3

---

Published in Transactions on Machine Learning Research (06/2025)
used to create image segmentations in the segmentation task as well as inform the regions for the perturbation attacks in the classification task.
Furthermore, the original study implemented a qualitative test of the interpretability methods under an attack; attention heat maps computed by the interpretability methods were provided before and after the attack. We recreated these results following the provided demo implementation.
Moreover, we extend the study by investigating the plug-in claims of DDS as well as the potential im- provements of AR. Consequently, the addition of DDS to baseline methods was investigated in the image segmentation task, while the addition to AR was investigated in both segmentation and classification tasks as described. New visualizations are also provided.
The energy usage reported by the cluster was also measured, which was combined with publicly available estimates on national grid carbon efficiency, to estimate the environmental impact.
The code used for the experiments was built on top Hu et al. (2024). which extended the code from Chefer
et al. (2021) by providing the qualitative demo. We further extended Chefer et al. (2021)'s 's code by adding
PGD and DDS to both tasks based the demo implementation by Hu et al. (024)) We also added the
AR interpretability method to the segmentation task following the implementation by Xu et al. (0022 Our code is available at github..com / aeerdelee/re--viil
4.1 Model and Algorithm Descriptions
Following the original study, ViT-Base model introduced by Dosovitskiy et al. (2021) was used for both tasks. It was pro-trained on the ImageNet-21k dataset and uses a resolution of 224x224 Similarly, a
DeiT-base model introduced by Touvron et al. (2021) was also used for the segmentation lask Moreover, a class-nnconditional ImageNet diffusion model at a resolution of 256x256 (Dhariwal & Nichol 2021 was used as the diffusion model in the DDS method
In the Transformer architecture, interpretability methods obtain the intermediate self-attention matrices of the model for imput and aggregate them alongside heads and layers using various components of the model. The pixel relevance scores are used to create attention heat maps of the input image. All interpretabil- ity methods included in Hu et al. (0244) (baselines) are used in the study; these include Raw Attention, GradCAM, Rollout, LRP and TA. The baseline GradCAM and LRP methods were not investigated in the classification task due to long experiment runtimes and ordinary performance in the original study as well as the reproduced segmentation lask. As mentioned, AR was also investigated and implemented according to (Xu al. 2022). Default hyperparameters were used for all of the methods.
The DDS method was implemented following the algorithm description included in the Appendix of Hu et al. 2024). That is, to convert ViT into FVIT, Gaussian noise is added to the input sample. That sample is then denoised using an external model (in our case, a guided diffusion model). After this process, the do-blurred sample is passod to a ViT of choice.
4.2 Metrics
In the scope of the reproduction well as in the extensions, we make use of several performance metrics, which are defined as follows.
Pixel Accuracy (Pix. Acc.) Defined as the proportion of all true positive predictions TP over the number of pixels in the image n, i.e. TP. n
Mean Intersection over Union (mIoU) Defined as the mean of the ratios of intersection and union for Metaxs Melass loU,. In our experiments, we use nolass = with the classes
each of the nelass classes, i.e. _
reprosenting the foreground and background.
Mean Average Precision (mAP) Defined as the mean average precision of the segmentation.
OObtainod from https: http://www...hcctcac..ccce/cet/a
p16 224-80ecf9de pth
*Obtained from http:://dd..ftassplllliieeeeee
hwspeeettttbbeeeeeeeeeeeeeeeeeee wawe_patchh6_______.1 224 224-b5r2efad.ptt
3 Qhtaiine from

---

Published in Transactions on Machine Learning Research (06/2025)
4.3 Datasets
The ImageNet--egmmntttoon subset was used for the image segmentation task (Guillaumin et al. 2014 The subset contains images sourced from the full ImageNet dataset with ground-truth segmentations. Therefore, with a model pre-trained for ImageNet classification, there is no need for fine-tuning or data splitting. The subset consists of 4276 images encompassing 445 classes and 6225 segmentations. The segmentations are binary and only distinguish the foreground from the background. COCO (Lin et al. 2014] and Cityscape (Cordts et al. 2016) datasets were not used due to lack of experiment scripts, pre-trained model weights, and computational resources needed to train the ViT and diffusion models.
The ImageNet LSVRC 2012 Validation Set (Russakovsky et al. 2015) was used for the classification under perturbation and attack t The set contains 50,000 images with corresponding labels equally distributed from 50 classes. Generating attention heat. maps for the full set of images was not feasible due to both computational and time constraints. Therefore, sampling with equal probability weights, no replacement and a preset seed was used. A total of 4000 images were sampled from the validation dataset. This means that the results are not fully representative but should still indicate the general trends of the algorithms.
4.4 Hyperparameters
No hyperparameter search was performed for the experiments; pre-trained VIT and diffusion models were used. Unless specified otherwise, the replicated experiments use the default hyperparameters proposed for DDS, which are a noise level of 8 255 and 45 backward steps for denoising. The process of finding the laithfulness region an FViT extends the typical process found in explainable ViTs by taking the average of multiple samples and performing additional computations, Following the demo implementation of Hf et al. (2024), the number of samples created was 10 for the qualitative visualizations before adversarial attack and in all other cases.
A PGD attack used by Hu et al. (2024). Specifically, unless specified otherwise, the maximum perturbation was set to 255 the step size to 255. and the number of steps to 10. PGD implementation comes from torchattacks library, which is based on the to norm.
used in both tasks; the parameters were left to their default implementation values,
8
4.5 Experimental Setup
Following Hu et al. (2024), Chefer et al. (2021), and Xu et al. (2022), in the image segmentation task, the visualization is considered as a soft-segmentation of the (PGD-attacker image and compared to the Ima- geNet ground truth sogmentation. Performance measured by pixel accuracy, obtained after thresholding each visualization by the mean value, mloU, and mAP, which uses a soft-segmentation obtain score that is threshold-invariant
Again, following Hu et al. 2024) and Chefer et al. 2021 the image classification under perturbation and attack tests follow a two-stage setting. First, PGD attack is applied or not applied, depending on the experiment. Then, a model with an interpretability method (with or without DDS) is used to extract the visualizations from the ImageNet dataset. Then, pixels are masked from an input image and the mean top-1 accuracy of the model measured. In positive perturbation, pixels are masked from the highest relevance the lowest, while in negative perturbation from the lowest to the highest. In positive perturbation, decrease in performance is expected, while in negative perturbation, accuracy should be maintained. Both tests used perturbation in the range of 10 to 90% of the pixels in 10% increments. The AUC of top-1 accuracy over perturbation steps was calculated.
A random seed 44 was used for all experiments.
*Obtained from http://///uuutt..aa.o....//////e from http://///e//ooooooooo////////ta hag.
and https://

---

Published in Transactions on Machine Learning Research (06/2025)
4.6 Computational Requirements
The experiments were run on NVIDIA A100 GPU partitioned into two instances using Multi-Instance GPU technology, effectively utilizing half of the GPU; in addition, 9 cores of Intel Xeon CPUs and 60GB of RAM were utilized. Table 4 in Appendix shows the computational resources used the segmentation and classification tasks.
5 Mathematical Foundation
In the original paper, the authors present formal mathematical definition of what constitutes a Faithful Vision Transformer and proof that the proposed method of Denoised Diffusion Smoothing indeed results in an FVIT agrecing with the aforementioned definition. In this section, these definitions and theorems will be discussed with the aim of this paper not only to provide a reproduction of experimental results, but also to evaluate the proposed mathematical framework of FVIIs.
The definitions and thcorems presented follow closcly the oncs put forward by Hu et al. (2024), but have been slightly rephrased to improve readability. Additionally, our full replications of the authors proofs can be found in the Appendix.
5.1 Faithful ViTs
Let us begin by discussing the definition of Faithful Vision Transformer itself.
Definition 5.1. We call function f Rgxx R= an (R, y. k. Il I1Il-fffffftfff attention module for ViT' if for any given input data and for all x! E Roxn such that || x'll & R, f(x') satisfies
1. (Top-k robustness) V=(J(x'), [()))
2. (Prediction robustness) (()(="), f(z)) y, where ((x'), Ø(z) are the prediction distributions of ViTs based on [(x',, ((x respectively
where V2 x²) = (TTx(t) is lop-k overlap ratio of two veclors. We also call the vector J (xx an (R, 7,7, k. [1)ffothfuul attention for x and the ViTs based on f as faithful ViTs (FViTs).
presents a valuable formal framework of defining faithfulness in Vision Transformers, it seems go against the broadly accepted definition of faithfulness in artificial intelligence, which usually consists of three criteria: Proximity, Connectedness, and Stability (Laugel el al. 2019). In contrast, this definition seems to emphasize stability alone with its priority robustness criteria.
While Definition 5.1
For its utility in further proofs, we also introduce the Rényi Divergence. Definition 5.2. Given two probability distributions P and Q and a E oo), the a-Réngi divergence (P(l))Q) is defined as
P(x)
(a(()) 1- - log E
Q(x)
5.2 Denoised Diffusion Smoothing and Faithfulness
After introducing necessary definitions for FVITs, the authors of the original paper put forward number of theorems allowing us to determine whether ViT is faithful under specifie conditions. In this paper, only the l is discussed all the analogous theorems and their proofs of high similarity. Of the two theorems approached, we were not able to verify the correctnoss in the form they were presented for either of them. In this section, we will present revised versions of the theorems, while their original wording (referred to as Conjectures) can be found in Appendix
Authors do not present a proof for Conjecture in their paper and was found that there exists case where this statement presented as a theorem not true. revised version of this statement is the following theorem:

---

Published in Transactions on Machine Learning Research (06/2025)
Theorem 5.1. If function is an Da, k. ll faaittthful ottention module for ViTs then if
7 < log (1-P(1) P(1) - P(2) +2 ((01)) 1- + +P(z)
we have for all x' such that where
|| - x'|l < R
arg max P ((ū(x) = g) = arg max max P(ū(x') = geg
gEg
where G is the set of classes, P(j) are i-th largest probabilities in {pj}, where pj is the probability that y(x) returns the j-th class.
In short, Theorem 5.1 allows us to make a guarantee that for a faithful attention modulc in discrete classification scenario, within cerlain region, the final prediction of the classifier will not be affected by an alteration of the imput data a. A proof for Theorem 5.1 and at the same time counterexample to Conjecture B.1 will be shown in Appendix B.1
We believe the proof presented in Hu et al. (2024) for Conjecture B.2 is not sufficient to conclude the truthfulness of the presented statement. Authors of the original paper make use of the term utility robustness in their proof, in fact making the second of the two terms in the max function of the faithfulness criterion in the theorem based utility robustness criterion [1] Utility robustness, however, is neither defined nor mentioned anywhere else in the original paper and it is not stated as one of the criteria for an attention module to be considered faithful (as per Definition 5.1). Therefore, its use as a criterion for faithfulness in the original proof of Theorem 5.2 is quite perplexing. Additionally, in their proof, the authors do present a required upper bound to guarantee prediction robustness, but they chose to forego its inclusion in Conjecture B.2
Looking at the first element in the maximum, were not able to follow the proof for that sufficiently well to include it in the revised version of the theorem. Instead, another proof has been presented using result from Liu et al. (2021). which Hu et al. (2024) cite as inspiration for their proof. However, in Hu et al. (2024) 's version of the proof (specifically Lemma B.2) they make choices which we found confusing. They aim to find mingee, (m..)) (w (minimuu divergence to keep top-k robustness) and then upper bound Rényi (.rlgeee.vvvvv.........aeeaa
our understanding, we should be finding the minimum divergence to violate top-k robustness then use that as an upper bound, as then we guarantee that violation of top-k robustness is impossible. These are the steps taken by Liu et al. (2021) Thus, we chose to present this result instead.
divergence with that result to guarantee top-k robustness.
A revised version of the theorem, including the upper bound necessary for guarantecing prediction robustness, is found below.
Theorem 5.2. Consider the function io where w = ((T + 2)), with being the self attention module, T a denoised diffusion model, x imput data and (O, Ixxn). Then it is an (R, Da, 7, k. || - -I)-fathfful attention module for ViT's for any a > 1 if for any input data x we have
RR²
²² max
1-a +
Eiis i.. )
2 log
2ko
1 Eies
2kg
alt
1- P(1) - P(2) + +2 +2(1 (pr ploy
-2 log
where kn ((1 3}}} and S the set of last ky components in top-k indices and the top ko components out of top-k indices.
Theorem 5.2 allows to make a guarantee that an attention module (and henceforth VIT using it) is faithful under specific conditions. The proof is available in the Appendix B.2
More detail Appendix R.2

---

Published in Transactions on Machine Learning Research (06/2025)
5.3 Algorithms
In their paper, Hu et al. (2024) present two algorithms based on the previously presented mathemalical framewor,, allowing for finding FVIT' computationally. Taking into account aforementioned issues, we cannot guarantee the correctness of Algorithm 2's ability to find the faithfulness region of an FVIT, as it is based on Conjecture B.2 Additionally, Algorithm 1 Hu et al. (2024) is an adapted Algorithm 1 put forward by Carlini al. (2023) for guaranteeing adversarial robustness of any classifier. Taking into account our previous note that Definition 5.1 is more similar that of robustness than faithfulness, while we can would rather call it
make guarantees based on Definition 5.1 (based revised Theorems 5.1 and 5.2 robust. VIT.
6 Experimental Results
Briefly, results in both the segmentation and classification tasks exhibit the same general trends in
Hu ct al. (2024), thereby confirming Claims 1 and 2 in Section _ Namely, explanations obtained from an FViT are indeed more robust under atlack compared to regular ViT. However, baseline methods perform worse than in the original study. Instead, the obtained metrics are more consistent with those from Chefer
et al. 2021b.
Applying DDS to Autribution Rollout substantially improved its performance and also achieved the best overall results in both image segmentation and classification. Applying DDS to the baseline interpretability methods, in image segmentation, saw an improvement only for LRP, with no change for the other methods, thereby somewhat confirming the plug-in nature of DDS. Lastly, applying DDS to a VIT resulted in a substantial adverse increase in the environmental impact.
6.1 Reproducing the Original Study
6.1.1 Image Segmentation
Table shows the reproduced and original results of interpretability methods investigated by Hu al. (2024) in the image segmentation task under PGD attack.
Pix.
Acc.
mIoU
mAp
Method
Ours
Hu al.
Ours
Hu al.
Ours
Hu al.
Raw Attention
0.64
0.65
0.43
0.54
0.78
0.82
Rollout
0.72
0.67
0.52
0.56
0.82
0.84
GradCAM
0.67
0.69
0.42
0.58
0.72
0.86
LRP
0.66
0.71
0.40
0.6
0.64
0.88
TA
0.73
0.73
0.52
0.62
0.82
0.9
TA + DDS
0.77
0.76
0.58
0.65
0.85
0.93
Table I: Reproduced and original pixel accuracy, mloU, and mAP results from the ImageNet segmentation task under PGD attack.
Same as Hu et al. [024], the addition of DDS improved TA over all the metrics; however, we found our baselines often did not match the results presented the original study. For example, GradCAM results for mloU range from 0.42 (ours) to 0.58 (Hu et al., 2024) and for mAP from 0.72 (ours) to 0.86 (Hu et al., 2024). In fact, for each of the methods, at least one of the metrics in replication is worse compared to the original study.
Furthermore, the ordering in Hu et al. 2024h is unanimously improving: each method improved over worse ones in all metrics in steady increments. However, our results across methods were less distinct: for example, while TA had a higher pixel accuracy and mAP than Rollout, it had lower mloU.
Lastly, similar to Hu et al. (2024). our study obtained higher metric values with some methods under attack than Chefer et al. (021 without attack. However, the increase substantially smaller than that of Hu

---

Published in Transactions on Machine Learning Research (06/2025)
Pertutaatiore
Partabattons
04
05
With
04
Wilhoot
Mardhod
Tonoformer uttt
087, koyk
rollout
Albeck Tledaos
Atteck Toetiun
Figure 1: The AUC values of the interpretability methods in the image classification task per PGD attack radius under posilive or negalive perturbation. The AUC of the correctly classified images calculated for all perturbation amounts: from 10% to 90% of the pixels removed in 10% increments. For positive perturbation, lower AUC is better, while for negative higher AUC is better.
et al. 2024 A comparison of some metrics obtained for TA and GradCAM across the two studies and ours can be seen in Table 2
A detailed analysis of the discrepancies in the results of Hu et al. (2024). Chefer
et al. 2021 and ours is presented in Appendix
Method
Attack
Pix. Acc.
mloU
mAP
None
Chefer et al. 2021
0.8
0.62
0.86
TA
PGD
Hu et al. 2024
0.73
0.62
0.9
PGD
ours)
0.73
0.52
0.82
None
Chefer et al. 2021
0.64
0.41
0.72
GradCAM
PGD
Hu et al.
2024
0.69
0.58
0.86
PGD
(ours)
0.67
0.42
0.72
Table 2: Results from the ImageNet segmentation task for two methods from Chefer et al. 2022 > Hu et al.
(204), and our study. Bold values represent the best metrics for method across the studies, while italicized represent increase in a metric after an attack.
6.1.2 Image Classification
Figure shows the classification AUC for all perturbation levels for both positive and negative perturbations and different PGD atlack radii.
As mentioned before, the results comparable with those Hu et al. (2024). Compared to Hu et al. (2024), attack radius values had a loss significant. impact on performance and the values do not. match exactly. Nonetheless, the ordering of the
portion of the original dataset and are therefore not completely
methods and general trends of the metrics align with Hu et al.7s results, which can be seen in Figure 5 in
Appendix D
6.1.3 Visualizations
Figure was laken from the original study (Hu et al. 2024 and visualizes the attention heat maps under adversarial corruption. The maps were reproduced by rerunning the authors' qualitative demo with the original hyperparameters and can be observed Figure 3 as can be seen, the images are very similar nearly identical and further show that DDS improves interpretability robustness. Further visualizations of interpretability methods, with different hyperparameters, can be found in Appendix El

---

Published in Transactions on Machine Learning Research (06/2025)
Input
Raw Attention
Rollout
GradCAM
LRP
VTA
Ours
Dog: clean-+
Dog: poisoned-4 +
7/265
Figure 2: Attention heat maps from the original study,
Input
Attention
Rollout
GradCAM
VTA
Ours
Dog: clean-
Dog: poisoned-4
7/266
Figure 3: Reproduced attention heat maps.
6.2 Extending DDS With Other Methods
The results of applying DDS to the baseline interpretability methods and AR for image segmentation are shown in Table 3 As hypothesized in Section 2 adding DDS improved the performance of AR and also achieved the best overall results in image segmentation. With regards to the general plug-in nature of DDS for improving robustness, DDS resulted in similar or improved metrics across all methods and models. Specifically, an improvement was not found only with Raw Attention, Rollout, and LRP with a DeiT model.
Similarly, as hypothesized Section 2 adding DDS improved the performance of AR and also achieved the best overall results image classification; this can be seen in Figure
6.3 Environmental Impact
Methed
800
Va-ills
One concern that was observed during our prelimi- nary experiments was the computational cost of the FVIT achieved through DDS. Therefore, we found it appropriate to measure the environmental im- pact of each interpretabilitty method by reporting its runtime and converting it using the tool pre- sented by Lacoste et al. (2019) with the average carbon efficiency in the Netherlands for 2024 of 370 eqCOz/kWh to validate Impact I The results are shown in Figure 4 with full data available in Ta- ble in Appendix [F] short, applying DDS had a strongly negative impact: applying to each of the interpretability methods increased the runtime and
with DOS
500
400
300
200
100
VI
OeT
Modal
Figure 4: Mean grams of CO2 emitted across inter- pretability methods in the image segmentation task.
emissions over 10 limes in some
"Otaained with noutricity January of 2025.
10

---

Published in Transactions on Machine Learning Research (06/2025)
Model
Method
DDS
Pix. Acc.
mloU
mAP
X
0.64
0.43
0.78
Raw Attention
V
0.67
0.46
0.79
Rollout
X
0.72
0.52
0.82
V
0.76
0.58
0.85
GradCAM
X
0.67
0.42
0.72
V
0.69
0.47
0.76
VIT
X
0.66
0.40
0.64
LRP
d
0.66
0.41
0.65
x
0.73
0.52
0.82
TA
0.77
0.58
0.85
0.74
0.53
0.82
AR
V
0.78
0.60
0.86
X
0.66
0.44
0.78
Raw Attention
0.60
0.38
0.76
Rollout
X
0.68
0.48
0.80
0.67
0.47
0.80
GradCAM
X
0.66
0.39
0.66
0.67
0.47
0.79
DeiT
X
0.62
0.37
0.64
LRP
0.62
0.36
0.64
x 0.68
0.46
0.79
TA
0.79
0.60
0.85
x
0.68
0.45
0.78
AR
0.79
0.61
0.85
Table 3: Extended pixel accuracy, mloU, and mAP results from the ImageNet segmentation task under a PGD attack. Italicized values represent improved metries, while bold ones represent best overall score across methods per model.
7 Discussion
The results confirm that applying DDS produces more robust and stable explanations across multiple tasks, interpretability methods, and ViT models. Specifically, we have confirmed that a PGD attack on the input sample partially resolved with an FViT obtained with DDS. Unfortunately, improvements were not found across all settings. Specifically, no improvements were found for DeiT with Raw Attention, Rollout, and LRP, while very minor improvements were found for ViT with Raw Attention and LRP. A possible explanation for this is that the aforementioned methods do not utilize gradient information opposed to methods uniformly improving under DDS.
Furthermore, we do not agree with additional claims from the authors, namely that DDS is efficient and promising for real-world applications with large-scale data. With runtime multiplied several times, hard to argue for the efficiency of the proposed method, which increases the pixel accuracy by few percent under PGD attack and optimal conditions.
In our reproductions of experiments conducted by Hu et al. 2024 we observed result trends similar to Hu et a.l. (2024), thereby affirming the effectiveness of DDS in improving ViT's robustness against pertur- bations. However, most of our experiments resulted in worse overall metrics than the original paper. We believe this discrepancy with the original paper is due to us not having access to the most. up-to-date imple-
mentation by Hu et al. (2024), the existence of which we were informed of through e-mail communication with the authors, but were not provided with. As our results match more closely with Chefer et al. (2021). we believe this more recent codebase of Hu et al. (2024) might have made overall improvements all the methods, allowing them to report. these state-of-the-art results.
11

---

Published in Transactions on Machine Learning Research (06/2025)
We and Hu et al. (024) report higher values for GradCAM under attack than Chefer et al. (2021) without We double-checked implementations and all three are identical. Since our values are within 0.03 or less of Chefer et al. (2021), there may exist some hardware-based variance. Testing the
attack (see Table 2
segmentation task without PGD attack, we have found out that GradCAM still reports higher values than
in Chefer et al. (2021) (details in Appendix Cp. We are not, however, able to account for Hu et al. (2024) 's
significantly higher results.
Our reproduction of the results found in the study by Hu et al. 2024) had several limitations. Namely, our reproductions were limited to ImageNet datasets, due to not having access to pre-trained models nor the exact methodology of approaching segmentation and perturbation tasks on COCO and CityScape datasets. Furthermore, our reproductions and extensions partially relied on a sparse code repository created by one author of Hu et al. 2024]]; unfortunately, most experiment scripts were missing, resulting in us making necessary assumptions. A more thorough discussion can be found in Section 7.1 We believe these limitations could be addressod by further rescarch and more transparency from the original authors.
We will now go into more detail regarding the reproduction of Hu et al. 20244)ss 's experiments.
7.1 Reproducibility Limitations
We found it to be unproblematic access the baseline methods' implernentttonss discussed in Chefer et al.) (2021) well as AR (Xu et al., 2022) and incorporate it alongside DDS in both segmentation and classifi- cation tasks. Additionally, installation of the working environment (on a Linux-based workspace) proved to be fairly straightforward, making the reproduction of the qualitative demo very easy.
However, we encountered multiple hardships in reproducing the results from Hu et al. 2024 Firstly, an official repository with the code was not listed in the article at the time of writing and we had to base our implementations on a repository by one of the authors containing only a Jupyter notebook for visualizations. We later learned that this repository contained outdated implementations. Secondly, we found multiple discrepancies between the demo notebook and the information specified in the article. One example of this is a demo notebook varying the noise amount between cells, while the article specified a specific nunber.
As we lacked a full implementation of the experimental setup, we also found the information provided in the article to be incomplete, and we had to resort to assumptions made based on the limited implementations in the demo. This includes reporting classification accuracy as part of the results in Table (the equivalent of Table D in this paper), which is never defined in the methodology, hence why it is omitted in our work. In addition, the number of input samples to be processed with DDS and subsequently combined was not precisely defined, leading us to specily the value of 2 for the two lasks taken from Hu et al. (2024)'s 's demo. This has an impact on the computational cost and energy consumed. Nonetheless, the conclusions regarding the environmental impact should still stand with single tass-through of DDS.
Furthermore, some methods (taken from Chefer et al. (0021 and later used by Hu et al. 2024 and Xu et al. (2022g) were not set up a computationally efficient manner: for example, the diffusion denoising process was set up to support batch size of 1, which resulted in the under-utilization of GPUs and longer runtimes.
Lastly, the experiment specifications of the COCO and Cityscape datasets, the details of the segmentation and classification tasks, and how the corresponding ViTs are trained are lacking. This led us to focus on the ImageNet tasks exclusively.
7.2 Future Directions
A key future direction for DDS lies in improving its computational efficiency. To improve efficiency without compromising robustness, one promising approach is to adopt lighter-weight denoisers. Since the robustness of DDS stems from the consistency of denoising rather than model scale, it is feasible to replace large diffusion backbones with efficient, distilled denoising networks (Meng al. 2023), which approximate the behaviour of guided diffusion models while enabling faster inference. These student models can be derived via score distillation or adversarial fine-tuning, and architectures such compact U-Nets may serve
12

---

Published in Transactions on Machine Learning Research (06/2025)
appropriate candidates. Such substitutions can substantially reduce computational demands while preserving interpretabilityy and robustness, making DDS more viable for real-time settings.
Additionally, DDS can benefit from reducing the number of diffusion steps through adaptive noise scheduling (ahoo et al. 2024p. While traditional diffusion models require hundreds denoising iterations, recent work shows strong performance with as few as to steps. By leveraging dynamic step allocation or distilling guided diffusion models, DDS can preserve its effectiveness while significantly lowering computational cost.
7.3 Communication With Original Authors
We contacted the authors by email at the end of January, mostly regarding the implementation details. The authors made aware that the code base that was published, which we have used to reproduce the results, is outdated version and that the paper version will be published soon. However, the paper version never made available to us. We contacted the authors again in April, once again requesting access to the updated codebase and requesting meeting to discuss hyperparameter setup. At the time of writing, the authors have still not responded.
13

---

Published in Transactions on Machine Learning Research (06/2025)
References
Samira Abnar and Willem Zuidema. Quantifying attention flow in transformers, 2020.
URL https://
wwt.:/orggabb///000/ 00928
Alexander Binder, Grégoire Montavon, Scbastian Bach, Klaus-Robert Müller, and Wojcioch Samek. Layer-
wise relevance propagation for neural networks with local renormalization layers, 2016. URL https:
//arxiv.org/ab//1664..00
Houssem Ben Braiek and Foutse Khomh. Machine learning robustness: A primer, 2024. URL
https:
Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and Zico Kolter. (certified!!) adversarial robustness for free!, 2023. URL fettps://aaxiv.orgg//eae h2t////../222...////// 10550
Hila Chefer, Shir Gur, and Lior Wolf. Transformer interpretability beyond attention visualization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 782-791, June 2021.
Hanting Chen, Yunhe Wang, Tianyu Guo, Chang Xu, Yiping Deng, Zhenhua Liu, Siwei Ma, Chunjing Xu, Chao Xu, and Wen Gao. Pre-trained image processing transformer, 2021. URL httpp://aaaat www.aaiwww....aaaaaaoooooooooere org/abs/ abs/
2012.00364
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understand- ing. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 3213-3223,
2016.
Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans on image synthesis, 2021. URL https:
//arxiv. Marxiv.org/aal wrgg/ab/////......///// 2ttp//255550003333
A Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image worth 16x16 words: Transformers for image recognition at scale, 2021. URL
attps://arzxt barg/abs//e 2010. 11929
Matthieu Guillaumin, Daniel Küttel, and Vittorio Ferrari. Imagenet auto-amnotation with segmentation propagation. International Journal of Computer Vision, 110:328 348, 2014.
Lijie Hu, Yixin Liu, Ninghao Liu, Mengdi Huai, Lichao Sun, and Di Wang. Improving interpretation faithfulness for vision transformers. In Forty-first International Conference on Machine Learning, 2024.
URL https://openrevier: wtt.:n/tooormmmmm/dd///dr
Alon Jacovi and Yoav Goldberg. Towards faithfully interpretable nlp systems: How should we define and evaluate faithfulness?, 2020. URL httpps://aaxxv.orggaaaas//////// 03685)
Alexandre Lacoste, Alexandra Luccioni, Victor Schmidt, and Thomas Dandres. Quantifying the carbon emissions of machine learning. arXiv preprint arXiv:1910.00 2019.
Thibault Laugel, Maric-Jeanne Lesot, Christophe Marsala, and Marcin Detyniecki. Issucs with post-hoc 1997/77711600777
counterfactual explanations: a discussion, 2019. URL
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise, 2019. URL htttps://aaxiv.org///// aa0eaaab/.//////eeaee 03113
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 19th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740-755. Springer, 2014.
14

---

Published in Transactions on Machine Learning Research (06/2025)
Ao Liu, Xiaoyu Chen, Sijia Liu, Lirong Xia, and Chuang Gan. Certifiably robust interpretation via renyi differential privacy, 2021. URL http::///axxivoor/aa////000000
Chenlin Meng, Robin Rombach, Ruiqi Gao, Diederik Kingma, Stefano Ermon, Jonathan Ho, and Tim Salimans. On distillation of guided diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 14297-14306, 2023.
llya Mironov. Rényi differential privacy. 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pp. 263-277 233-275. IEEE, August 2017. doi: 10.1109/csf.201..11 URL
CSF 20
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, 115(3):211122)) 2015.
Subham Sahoo, Aaron Gokaslan, Christopher M De Sa, and Volodymyr Kuleshov. Diffusion models with learned adaptive noise. Advances in Neural Information Processing Systems, 37:105730 105779, 2024.
Ramprasaath R. Sclvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. International Journal of Computer Vision, 128(2):336 336-3) October 2019. ISSN 1573-1405. doi:
10.1007//111263-0190000
URL http:///2..dii.or//1000000000000
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention, 2021. URL bttps://arxivv org/ /a////bb/22222 12877
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need, 2023. URL ftttpp:://axxv.orr//bbbbaa abrrg//bs//70...... 1706. 03762
Li Xu, Xin Yan, Weiyue Ding, and Zechao Liu. Attribution rollout: a new way to interpret visual transformer. Journal of Ambient Intelligence and Humanized Computing, 14:163-173) 2022. URL
https://api semantccscholar www.oorrpssD:221192222222
Sixiao Zheng, Jiachen Lu, Hengshuang Zhao, Xiatian Zhu, Zekun Luo, Yabiao Wang, Yanwei Fu, Jianfeng Feng, Tao Xiang, Philip H. S. Torr, and Li Zhang. Rethinking semantic segmentation from a sequenco-to- sequence perspective with transformers, 2021. URL
Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable deir: Deformable transformers for end-to-end object detection, 2021. URL htttps://aaaa
15

---

Published in Transactions on Machine Learning Research (06/2025)
A
Computational Resources
Wall Time
CPU Util.
CPU Eff.
Experiment
Model
Method
DDS
(hhamm)
(hhemm)
(%)
X
00:59
04:45
53.38
Raw Attention
10:06
13:50
15.21
X
00:57
04:43
55.53
Rollout
10:04
13:41
17.31
GradCAM
X
00:48
04:35
62.68
09:46
13:30
15.35
ViT
X
00:57
04:43
55.46
LRP
10:04
13:48
15.22
X
00:57
04:43
55.53
TA
10:08
15:45
17.26
AR
x
00:58
04:51
55.40
10:06
15:44
17.30
Segmentation
00:57
04:43
54.97
Raw Attention
10:13
14:01
15.26
00:57
04:43
55.13
Rollout
10:03
15:40
17.32
00:43
04:29
69.57
GradCAM
09:53
13:36
15.31
DeiT
X
00:57
04:42
55.43
LRP
10:03
13:46
15.23
X
00:58
04:43
54.45
TA
10:08
15:52
17.40
X
00:56
04:43
55.94
AR
V
10:08
15:45
17.28
Raw Attention
X
00:38
05:33
NA
Rollout
X
00:37
05:39
NA
Classificatior
ViT
TA
X
00:37
05:26
NA
V
09:14
83:12
NA
AR
X
00:35
05:14
NA
V
09:07
83:16
NA
Table 4: Computational resources used in the image segmentation and classification tasks.
CClassification results reported for negative perturbation and PGD attack radius 255 for both generation of visualizations and subsequent classification. Runtimes for the full experiment roughly 10 times longer. CPU Efficiency was reported due small technical the server.
16

---

Published in Transactions on Machine Learning Research (06/2025)
B Proofs of Theorems in Section 5
Conjecture B.1 (Theorem 4.4 in Hu et al. 2024 ). If a function is an (R, Das 7, B, k, Il- ( -faithhful attention
module for ViTs then if
E - log (1 (1- (11)( P(1) P(2) +2 ( 1-a
21)))) +1(2)
we have for all xf such that where ||: x'll
arg max P( = g) = arg max P((xx) = SEg
9E9
where G the of classes, P(x) are i-th largest probabilities in {pj}, where Pj is the probobility that Õ(x) relurns the j-th class.
Conjecture B.2 (Theorem 5.1 Hu 2024 ). Consider the function ie where = ((T + 2)), with
Z being the self attention module, T denoised diffusion model, imput data and NN o² Igxn). Then it is an (R, Das 7, B, |l IfJttffffuu allention module for ViTs for any 1 if for any inpul data x we have
RR
RR
max
log (2k (Eies ) + (2ko) Eies W; - log((k:))
27
o-
where kn - and S the set of last ko components in top-k indices and the top ko components out of top-k indices.
B.1 Theorem 5.1
Proof. Let f be an (R, Da. 7. 7. k1 fIli-fauittl attention module and
y < - log
(1 (1-P))
PP(2 + (()) P(1)
(
(P11)
1 1-a + 1-a
+P(2)
(1)
By Li et al. (2099) we have
Lemma B.1 (Lemma in Li et al. 2019 ). Let P and Q be two maltinomial distributions over the same inder set I (1, (1...., k}. If the indices of the largest probabilies do not match on P and Q, that is
arg max Pa arg max 9: VEr
then
1-a 121 + 1(2)
Da > log (1- P(1) P(2) +2
{ 1-
where P(2) are the two largest probabililies in the distribution P.
Since f is an (R, Do. k, faithfull attention module, it fulfils prediction robustness, thus
(a( <
for any x' such that || - x'll & R. Therefore we have
Da(ll < < - -log (a- (1-P() P(1) P(2) +2
1 1-a + 1-a 122
(p)
P(2))
2
17

---

Published in Transactions on Machine Learning Research (06/2025)
based equation 1 and P = ((x) and Q 5((2). Therefore conclude that
arg max pj arg max 9i RE7
1E2
which is equivalent to under conditions specified in Theorem 5.1
arg max P(](x) 9) = arg max P(j((() =g) gEg
gEg
B.1.1 Counterexample
If the inequality in the equation would be non-strict as is Conjecture B.1 we would not be able reach this conclusion in the equality case would not be contradicting the conclusion of Lemma B.1 In fact we would have
(Pl()) <イ< - log (1- (1-P() P(1) P(2) +2
1-a + ((2)) 100
1-a
and if we were to have case where
1 1-a + P(2)
7 = - log (1 (1-P(L) P(1) - P(2) +2
(((P(1)
1-a
then
(a(P) < log
(1 (1-P(1) P()) - P(2) +2 (12 + +p(e)
and thus by Lemma B.1
arg max P()(x))((z)) = * arg max Pax = g). gEG
gEs
Alternatively, the proposed change to Conjecture B.1 could be avoided Definition 5.1 prediction robust- ness was specified as strict inequality.
B.2
Theorem 5.2
Proof. Let consider the Rényí divergence of DDS applied ViT for two inputs x, x'. Utilising the post-processing property of the Rényi divergence (Mironov 2017) we can conclude
(a(ū(2), w(x')) (a(Z(T(x x)), 2(T + z)) < Da(I + z, z, +
and x + N(x, of N
a:|x x'll
aR 2
(a(W(x),u(x)))
(2)
20
Having obtained bound for Rényi divergence we can now proceed to proving the conditions for faithfulness: top-k robustness and prediction robustness.
If D. (w))) ((x))) log (1 P1) P(1) P(2) + (1 1-a + P(2) 1- r'a
)
have prediction robustness by
contradiction of Lemma B.1 (see Appendix A.1). Thus if
aR 20a
I-
< log (1 (1-P() P(1) - P(2) +2 1-a +
1-a (P(1) +1(2)
or equivalently
R.
0²
(3)
log (1-P((1) P())) P(2) + +
1-1
18

---

Published in Transactions on Machine Learning Research (06/2025)
fulfil the prediction robustness criterion.
Moving onto top-k robustness criterion we follow Hu et al. (0224) in introducing the lemma below.
Lemma B.2 (Theorem Liu et al. (2021)). ) Given two probability distributions v q, the minimum change
Rényyi divergence to violale the lop-k robustness is
min Da( log V4 (1,
2ku
Σ
W
2ku
iES
Thus by Lemma B.2 if we have oft
< log 2ko
Eies
wp
T
+ E
Eigs wii and equivalently
2g
2ho
aR.
o²
(4)
2og
2hip
Eies
ui
+ +iigs Ws.
2kg
top-K robustness will be guaranteed.
Putting equation and equation
together we get
aR²
max
2 log
2kg
Eies
W
+ Eies Wis
2kg
aR²
-2
1 1-P(1) P(2) +
P())
1-a
+P(2))
+ 1-2
19

---

Published in Transactions on Machine Learning Research (06/2025)
C Discrepancies of Results
We have run the segmentation task without attack on the bascline methods to compare the results with the original results of Cheler et al. (2021). The results are presented in Table Raw Attention and TA match nearly perfectly. There is a slight difference between the scores for GradCAM, although the implementation uses the same architecture. The differences for LRP and Rollout stem from a slightly different implementation between the work of Chefer et al. (2021) and Hu al. (2024)'s 's demo notebook, where we chose to follow the implementation of the latter for all of the main experiments. They differ slightly in the implementation of relevance propagation in the linear module. After adapting the architectural choices of baseline methods to those of Chefer et al. 22021,, were able to closely match results presented in the original paper, as shown in Table 5
Pix. Ace
mAP
mloU
2021
2021
2021
2024
2024
2024
Ours - Chefer el al
Ours Chefer et al.
Ours Chefer al.
Ours Hu et al
Ours Hu et al
Ours Hu al.
Cheferr et a
Chefer et al
Chefer
Method
Raw Attention
67.84
67.87
67.87
80.24
80.24
80.24
46.37
46.37
46.37
Rollout
73.54
73.54
77.64
84.76
84.76
85.65
55.42
55.42
59.86
GradCAM
64.44
65.91
65.91
71.60
71.60
71.60
40.82
41.31
41.31
LRP
51.09
50.79
66.50
55.68
55.75
64.21
32.89
32.73
40.65
TA
79.70
79.72
79.72
86.03
86.02
86.02
61.95
61.99
61.99
Table 5: Comparison of interpretability methods on the segmentation task without an attack between the
results of Chefer ct al. (2021). implementation following Chefer al. (2021) and implementation
following Hu et al. (2024).
With no responses from Hu et al., we are left to speculate why we were not able to exactly reproduce their results. In this section, we address the discrepancies and show why our results are nonetheless valuable.
The full results for the segmentation task as found by Hu et al. (024g) are shown in Table To more easily discuss the relative values within the table, we will present TA + DDS for ViT as a baseline which the other values are compared. Such a conversion results in Table follows: DeiT metric is 0.01 higher than the corresponding metric for ViT and any Swin metric is 0.02 higher than the corresponding metric for VIT. Given metric, model, and dataset, TA is 0.03 lower than TA with DDS. Then, in the order of TA, LRP, GradCAM, Rollout, and Raw Attention, each method is 0.02 lower than the previous one, except for Cla. Acc. where they are instead 0.01 lower. This pattern applies to all but two cells, namely DeiT TA + DDS on the COCO dataset.
The general patterns observed are
The results of Hu al. (2024) draw clear image: the baseline methods in terms of performance rank in the order of: TA, LRP, GradCAM, Rollout, Raw Atlention. However, for ViT, we have achieved order of TA, Rollout, GradCAM, LRP, and Raw Attention for attacked segmentation. Both aforementioned orders are not fully consistent with the methods' performance without an attack, both in Chefer et al. 20211 and our implementations. However, in those non non-attacked scenarios as well as our DDS results, Rollout performs only slightly worse than TA, which is not consistent with values reported by Hu et al. (0044)
20

---

Published in Transactions on Machine Learning Research (06/2025)
ImageNet
Cityscape
COCO
Model
Method
Cla. Acc.
Pix. Acc.
mIoU
mAP
Pix.
Acc.
mloU
Pix.
Acc.
mloU
Raw Attention
0.78
0.65
0.54
0.82
0.72
0.62
0.8
0.7
Rollout
0.79
0.67
0.56
0.84
0.74
0.64
0.82
0.72
GradCAM
0.8
0.69
0.58
0.86
0.76
0.66
0.84
0.74
VIT
LRP
0.81
0.71
0.6
0.88
0.78
0.68
0.86
0.76
TA
0.82
0.73
0.62
0.9
0.8
0.7
0.88
0.78
TA + DDS
0.85
0.76
0.65
0.93
0.83
0.73
0.91
0.81
Raw Attention
0.79
0.66
0.55
0.83
0.73
0.63
0.81
0.71
Rollout
0.8
0.68
0.57
0.85
0.75
0.65
0.83
0.73
GradCAM
0.81
0.7
0.59
0.87
0.77
0.67
0.85
0.75
DefT
LRP
0.82
0.72
0.61
0.89
0.79
0.69
0.87
0.77
TA
0.83
0.74
0.63
0.91
0.81
0.71
0.89
0.79
TA + DDS
0.86
0.77
0.66
0.94
0.84
0.74
0.89
0.79
Raw Attention
0.8
0.67
0.56
0.84
0.74
0.64
0.82
0.72
Rollout
0.81
0.69
0.58
0.86
0.76
0.66
0.84
0.74
GradCAM
0.82
0.71
0.6
0.88
0.78
0.68
0.86
0.76
Swin
LRP
0.83
0.73
0.62
0.9
0.8
0.7
0.88
0.78
TA
0.84
0.75
0.64
0.92
0.82
0.72
0.9
0.8
TA + DDS
0.87
0.78
0.67
0.95
0.85
0.75
0.93
0.83
Table 6: Comparison of different methods on ImageNet, Cityscape, and COCO datasets as presented by Hu
et al. 2002).
ImageNet
Cityscape
COCO
Model
Method
Cla. Acc.
Pix.
Acc.
mIoU
mAP
Pix. Acc.
mIoU
Pix.
Acc.
mIoU
Raw Attention
4 0.07
B 0.11
C 0.11
D 0.11
E 0.11
F 0.11
G 0.11
И 0.11
Rollout
A 0.06
B 0.09
0.09
D 0.09
E 0.09
F 0.09
G 0.09
И 0.09
GradCAM
A 0.05
B.0.77
C-00077
000.07
0.07 E 0.07
F -0.07
G 0.07
H 0.07
VIT
LRP
A 0.04
0.05
0.05
D 0.05
E 0.05
F 0.05
G 0.05
0.05
TA
A 0.03
B 0.03
C 0.03
D 0.03
E 0.03
F 0.03 F
G 0.03
H 0.03
TA DDS
A
B
D
Raw Attention
A 0.06
B 0.10
0.10
0.10
0.10
F 0.10
0.10
0.10
Rollout
A 0.05
B 3--00 0.08
C 0.08
D 0.08
E 0.08
F 0.08
G 0.08
H 0.08
GradCAM
A 0.04
0.06
0.06
0.06
0.06
F 0.06
0.06
0.06
DefT
LRP
A 0.03
B B-0.04
C 0.04
D 0.04
E 0.04
F 0.04
G 0.04
H 0.04
A 0.02
B 0.02
0.02
0.02
0.02
F 0.02
0.02
0.02
TA DDS
A 0.01
B 0.01
C 0.01
D 0.01
E + 0.01
F 0.01
G 0.02
H 0.02
Raw Attention
A 0.05
B 0.09
C' 0.09
D 0.09
E 0.09
F 0.09
G 0.09
И 0.09
Rollout
4 0.04
0.07
0.07
0.07
0.07
GradCAM
4 0.03
B-000 0.05
C 0.05
D 0.05
E 0.05
F 0.05
G 0.05
И 0.05
Swin
LRP
4-0.02
0.0.3
0.03
0.03
0.03
TA
A 0.01
B 0.01
C-0011
D 0.01
E 0.01
F 0.01
G 0.01
И 0.01
TA DDS
A 0.02
B 0.02
0.02
0.02
0.02
G 0.02
Table 7: Comparison of different methods on ImageNet, Cityscape, and COCO dalasets presented by Hu 2024) using relative values. In bold, cells not following the general pattern.
et al.
21

---

Published in Transactions on Machine Learning Research (06/2025)
D Original Results
80
Ours VTA
CroCCAM + Rollout
Gurs
GradCAM -o- Rulbat
Raw Attention
VIA
180
Rowr attention
AUC
48
AUC
48
16
16-
Allack Radius (/255)
Allack Redius (/255)
(a) Pos. Perturbation
(b) Neg. Perturbation
Figure Taken from Hu et al. (2024). The AUC values of the interpretability methods in the image classification task per PGD attack radius under positive or negative perturbation. The AUC of the correctly classified images is calculated for all perturbation amounts: from 10% to 90% of the pixels removed in 10% increments. For positive perturbation, lower AUC is better while for negative higher AUC is better.
22

---

Published in Transactions on Machine Learning Research (06/2025)
E
Visualisations
Visualizations of all interprotability methods, with and without DDS, before and after perturbation, on three 255 was used both as the PGD attack radius and for DDS. The number of denoising
images. Noise level of & steps was calculated according to the method provided the original demo.
Vanilla
- Perturbed
With DDS
+
Perturbed
Raw
Rollout
GradCAM
LRP
TA
AR
Figure 6: Visualizations on the cat and dog image. Cat as the predicted class.
23

---

Published in Transactions on Machine Learning Research (06/2025)
Vanilla
+
Perturbed
With DDS
Perturbed
Raw
Rollout
GradCAM
LRP
TA
AR.
Figure 7: Visualizations on the cat and dog image. Dog as the predicted class.
24

---

Published in Transactions on Machine Learning Research (06/2025)
Vanilla
Perturbed
With DDS
Perturbed
Raw
Rollout
GradCAM
LRP
TA
AR.
Figure 8: Visualizations on an clophant and zebra image. Elephant as the predicted class.
25

---

Published in Transactions on Machine Learning Research (06/2025)
Vanilla
Perturbed
With DDS
Perturbed
Raw
Rollout
GradCAM
LRP
TA
AR.
Figure 9: Visualizations on an clephant and zebra image. Zebra as the predicted class.
26

---

Published in Transactions on Machine Learning Research (06/2025)
Vanilla
Perturbed
With DDS
Perturbed
Raw
OC
Rollout
llyn Coua
GradCAM
LRP
TA
AR.
Figure 10: Visualizations on an clephant and zebra image. Elephant as the predicted class.
27

---

Published in Transactions on Machine Learning Research (06/2025)
Vanilla
Perturbed
With DDS
Perturbed
Raw
Rollout
tiee Co
UHM
GradCAM
LRP
TA
AR.
Figure 11: Visnalizations on an clephant and zebra image. Zebra as the predicted class.
28

---

Published in Transactions on Machine Learning Research (06/2025)
F
Environmental Impact
Model
Method
DDS
Execution Time (s)
Energy (J)
CO2 Emitted (g)
Raw Attention
x
3554
355400
37.53
36266
6001885
616.86
3390
561333
57.69
Rollout
36316
6560805
674.30
2912
296822
30.51
GradCAM
36238
6376733
655.39
VIT
3385
533882
54.87
LRP
35236
6220494
639.33
3388
956766
98.33
TA
36494
4577928
470.51
3488
430928
44.29
AR
36341
5316731
546.44
3417
516766
53.11
Raw Attention
36744
6324599
650.02
3414
624185
64.15
Rollout
36154
6136458
630.68
2563
466887
47.98
GradCAM
35545
6101154
627.06
DeiT
3381
516766
53.11
LRP
36149
6208825
638. 138.12
3457
399064
41.01
TA
36466
4530315
465.61
3360
550719
56.60
AR
36449
6309426
648.46
Table 8: Environmental impact of one validation run per interpretability method and model in the segmen- tation task.
29


Reviews:
[{"review_id": "NxBK43YxNn", "reviewer": "Reviewer_woXt", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The authors design a broad evaluation that mirrors Hu et al.’s original experiments. By extending DDS to Attribution Rollout, they demonstrate that smoothing can enhance newer transformer‐based explanations, achieving the highest segmentation accuracy and IoU under attack. Finally, their inclusion of energy‐usage measurements and CO₂ estimates brings an often-neglected sustainability perspective to interpretability research, quantifying the roughly ten-fold increase in computational and environmental cost that practitioners should weigh.\n\nHowever, several limitations remain. Many baseline metrics diverge from Hu et al.’s reported values—GradCAM’s mIoU and mAP under attack being notable examples—suggesting unresolved discrepancies in implementation or evaluation. The paper also highlights DDS’s low compute efficiency without proposing strategies to mitigate it. Moreover, beyond combining AR with DDS, it offers little methodological innovation or theoretical insight into why smoothing benefits some attribution methods but not others.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This study undertakes a reproduction of Hu et al. (2024)’s Improving Interpretation Faithfulness for Vision Transformers and introduces two extensions. First, it applies Denoised Diffusion Smoothing (DDS) to Attribution Rollout method (Xu et al., 2022) alongside the originally tested Transformer Attribution, thereby broadening the scope of DDS’s applicability. Second, it systematically evaluates DDS as a plug‐and‐play enhancement across a suite of ViT interpretability techniques—Raw Attention, Rollout, GradCAM, LRP, TA, and AR. Additionally, this paper measures the additional computational cost and carbon footprint incurred by diffusion based smoothing.\n\nResults show that DDS improves AR’s segmentation performance and provides gains for LRP and TA, while having minimal effect on Raw Attention, Rollout, and GradCAM. The cost analysis reveals that DDS substantially increases runtime and CO₂ emissions, suggesting a clear trade‐off between robustness and efficiency.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "- A focused analysis of why DDS substantially enhances some methods (LRP, TA, AR) but has little effect on other techniques (Raw Attention, Rollout, GradCAM) would provide valuable insight into the underlying mechanisms governing its robustness.\n- Investigate and propose concrete optimizations—such as lighter-weight denoising models—to improve the computational efficiency of DDS without compromising robustness.\n- Reach out to the original authors to verify and align hyper-parameter settings and implementation details, ensuring the reproduced results closely match the published values and thus strengthen the study’s credibility.", "broader_impact_concerns": "No broader impact concerns were identified.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "4jTtx1c947", "reviewer": "Reviewer_B8ER", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n1. The authors provide a thorough explanation of their implementation and openly share their code, which significantly contributes to reproducibility efforts within the community.\n2. They replicate some of the results from Hu et al. (2024), generally confirming the original conclusion that DDS improves both performance and interpretability robustness for segmentation tasks. While some numerical results differ slightly, the overarching findings remain consistent.\n3. The paper extends the application of DDS to additional interpretability methods, offering a broader evaluation of its robustness benefits.\n4. The paper provides the environmental impacts of adding a DDS component which is very important and often neglected in publications.\n\n\n### Weaknesses\n1. The primary limitation of this work is the lack of comprehensiveness in the experimental results. The authors mentioned that is due to computational limitations or lack of openly available pretrained models or scripts/instructions for training models.That is understandable in general but for a reproducibility paper, it is crucial to have more comprehensive results. More complete replication would strengthen the contribution considerably Specifically:\n    1. The paper only evaluates the ImageNet dataset, omitting COCO and Cityscapes datasets that were included in the original study. Expanding to these would provide a more complete validation.\n     2. For classification attacks, the authors use only the positive/negative perturbation attack, while Hu et al. (2024) also included PGD attacks. The authors mention computational limitations, but this raises a question: if PGD attacks were feasible for segmentation (typically more resource-intensive), why not for classification?\n     3. The study tests DDS only on Vanilla ViT, whereas the original paper evaluated it across Vanilla ViT, DeiT, and Swin ViT. Including more models would offer stronger generalization support.\n2. Additionally, the presentation of the paper could be improved. For instance:\n     1. The Introduction could provide a more detailed description of the paper’s contributions, especially the confirmation that their findings align with Hu et al. (2024) on segmentation task but not classification.\n     2. The Background section would benefit from more thorough explanations of the interpretability methods (Attention Rollout, GradCAM, LRP, TA, AR) and DDS.\n3. It seems like for classification tasks, the results do not match Hu et. al. (2024), but are more aligned with Chefer et al. (2021). A little more explanation on why there is such a discrepancy would be helpful.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper aims to reproduce the results of Hu et al. (2024) to assess whether incorporating the Diffusion Denoised Smoothing (DDS) component into Vision Transformers (ViTs) enhances both interpretability and performance robustness of segmentation and classification tasks on the ImageNet dataset.\n\nBeyond replication, the authors apply DDS to several interpretability methods—Raw Attention, Attention Rollout, GradCAM, Layerwise Relevance Propagation (LRP), Transformer Attribution (TA), and Attribution Rollout (AR)—to evaluate the general effectiveness of DDS for segmentation tasks. Additionally, they provide an analysis of the environmental impact of FViT (ViT augmented with DDS), contributing an important perspective that is often overlooked.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "1. Please consider expanding the background section to include brief, clear explanations of DDS and each interpretability method. The current introduction offers only a sentence per method, which may not be sufficient for readers unfamiliar with them.\n2. The last paragraph of the introduction should focus more explicitly on the paper's contributions. In particular, clearly stating how your results match Hu et al. (2024)’s conclusion about DDS enhancing interpretability and robustness.\n3. Why was PGD attack feasible for segmentation tasks but not for classification tasks? This seems counter-intuitive, as segmentation models typically are more computationally expensive.\n4. Extending the experiments to include COCO, Cityscapes, and other models (e.g., Swin, DeiT) would significantly strengthen the work and more fully reproduce the original study’s scope.\n5. Is the maximum perturbation in your PGD attack based on the $\\ell_2$ or $\\ell_\\infty$ norm? It would be helpful to explicitly state this in the paper.\n6. Do you know why your GradCAM results under attack outperform Chefer et al. (2021)’s original results without an attack? A brief analysis in the paper would be appreciated.\n7. Can you elaborate on why your classification results differ from those in Hu et al. (2024)? Could the differences be due to using a small subset of images? Adding this discussion in the results section would help clarify the implications of your findings.", "broader_impact_concerns": "No concerns on broader impact as this paper clearly analysed the environmental impact of their work.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "K0PzgGGlT2", "reviewer": "Reviewer_fy7y", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n1. This paper provides a good review of previous work and tries to reproduce the results with additional novel designs.\n2. The paper is well-organized and easy to follow.\n\nWeaknesses\n1. This paper solely conducts the experimental analysis, and there is no discussion about the correctness of the original mathematical proofs in Hu et al. (2024). I suggest the authors try to check their proofs and give us feedback on whether their proof is correct or not. \n2. The discussion about the proposed extension is short. The authors should provide a detailed analysis of their extension with technical visualizations or algorithms to strengthen the contributions.\n3. The reproduced results are worse than the original work. The authors should try to give some aspects to explore the potential reasons.\n4. Visual analysis is limited. The authors should provide more interpretable visualization results to investigate the in-depth differences.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper reproduces the results of Faithful Vision Transformers (FViTs) proposed by Hu et al. (2024) alongside interpretability methods for Vision Transformers from Chefer et al. (2021) and Xu et al. (2022). Sufficient discussion and analysis are provided in this paper. Moreover, thorough experiments are conducted to show the reproduced results.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Overall, I think this paper does a good job of re-viewing a published work. I suggest the authors carefully address my following concerns:\n1. This paper solely conducts the experimental analysis, and there is no discussion about the correctness of the original mathematical proofs in Hu et al. (2024). I suggest the authors try to check their proofs and give us feedback on whether their proof is correct or not. \n2. The discussion about the proposed extension is short. The authors should provide a detailed analysis of their extension with technical visualizations or algorithms to strengthen the contributions.\n3. The reproduced results are worse than the original work. The authors should try to give some aspects to explore the potential reasons.\n4. Visual analysis is limited. The authors should provide more interpretable visualization results to investigate the in-depth differences.", "broader_impact_concerns": "n/a", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)