Reproducibility Study of "Improving Interpretation Faithfulness For Vision Transformers"
Authors: Meher Changlani
Benjamin Hucko
Ioannis Kechagias
Aswin Krishna Mahadevan
Venue: Accepted by TMLR ()

Abstract: This paper attempts to reproduce the findings of the study "Improving Interpretation Faith-fulness For Vision Transformers" Hu et al. (2024). The authors focus on making visual transformers (ViTs) more robust to adversarial attacks, and calling these robust ViTs faithful ViTs (FViTs). In their paper they propose a universal method to transform ViTs to FViTs called denoised diffusion smoothing (DDS). The reproduction of the authors study suffers from certain challenges, but the main claims still hold. Furthermore, this study extends the original paper by trying different diffusion models for DDS and tries to generalize the increased robustness of FViTs.

Published in Transactions on Machine Learning Research (06/2025)
Reproducibility Study of "Improving Interpretation Faithful- ness For Vision Transformers"
Meher Changlani University of Amsterdam
meher. saaherr.hhangllesssstdeeee......
Aswin Krishna Mahadevan University of Amsteriam
Benjamin Hucko University of Amstendam
bennjemiin.hucko@@tttdeeett
Ioannis Kechagias
Conmiss.echaagiasssttttddeee
University of Amsterdam
Reviewed on OpenReview: /ttps://opentss
// openreveew...e...m net/ forum? id- aDrytDAGUD
Abstract
This paper attempts to reproduce the findings of the study 'Improving Interpretation Faith- fulness For Vision Transformers' Hu et al. (2024). The authors focus on making visual transformers (ViTs) more robust to adversarial attacks, and calling these robust ViTs as faithful ViTs (FViTs). In their paper they propose a universal method to transform ViTs to FVITs called denoisod diffusion smoothing (DDS). The reproduction of the authors study suffers from certain challenges, but the main claims still hold. Furthermore, this study ex- tends the original paper by trying different diffusion models for DDS and tries to generalize the increased robustness of FVIls.
1 Introduction
Vision Transformers (ViTs) (Ramachandran et al., 2019) have shown remarkable promise in recent years, achieving statc-of-the-art performance in computer vision tasks such as image classification (Dosovitskiy et al. 2021), semantic segmentation (Zheng et al. 2021), and object detection (Zhu el al. 2021]. Beyond their efficacy, the attention mechanisms in ViTs offer a way to visualize which parts the input the model focuses on during predictions, which aids with interpretability. However, these very attention mechanisms
also make the model particularly susceptible to adversarial attacks (Mahmood et al. 2021 Zheng et al.,
2022 W Wiegrelfe& & Pinter 2019 Hu et al. 2022 as such attacks exploit the model's ''ss attention mechanisms and global feature dependencies, leading to incorrect predictions with only minor perturbations to the input.
To address this issue, Hu et al. (2024) introduces a new category of ViTs, called Faithful Vision Transformers (FVTTs), that are designed to resilient to minor input perturbations. Jacovi Goldberg (2020) defined faithful models as those providing interpretations that reflect the true rcasoning process of the model when making a decision. To this end, the authors propose method, called Denoised Diffusion Smoothing (DDS), for converting standard VIT into FVIT. In brief, DDS applies randomized smoothing to the input of standard ViT and then uses a denoised diffusion probabilistic model Ho et al. (2020) to process the perturbed input. By repeating this process multiple times and averaging the attention activations, the authors claim that the VIT can be transformed into an FVIT.
The authors Hu et al. (2024) first establish the theoretical effectiveness of DDS and FVITs and then validato it through a series experiments. These experiments evaluate the performance of various ViTs and their FVIT counterparts classification and segmentation tasks under adversarial attacks and under normal

---

Published in Transactions on Machine Learning Research (06/2025)
conditions. In this study, we aim to verify their findings by reproducing their experiments, enhance the robustness of FVTTs by improving the DDS algorithm using alternative diffusion models, and extend the experimentation to demonstrate that models produced through DDS are robust, not only to adversarial attacks, but also to various types of perturbations.
2 Scope Of Reproducibility
In all their experiments, the authors compared their proposed method, which employs faithful versions of ViI's, with five other baselines | that use ViIs without modifications. The comparisons are based on classification accuracy and segmentation metrics (pixel accuracy, mIoU and mAP), as well as the consistency of the generated allention maps under adversarial attack compared to normal conditions. The proposed method transforms a ViT into an FViT using DDS and then applies Visual Transformers Attribution (VTA) (Chefer al.) 2021 a post-hoc method to generate attention maps. In contrast, the other five baselines are standard ViIs (not converted to FViTs) paired with either raw attention (directly computed during the forward pass) Vaswani et al. (2117) or post-hoc methods such as Rollout (Abnar & Zuidema 2020
GradCAM Selvaraju et al. 2017
LRP Binder et al. 2016), and VTA to generate attention maps.
Baseline
DDS Used
Method For Generating Attention Maps
Proposed Method
Yes
VTA
Bascline
No
Raw Attention
Baseline 2
No
Rollout
Baseline 3
No
GradCAM
Baseline 4
No
LRP
Bascline
No
VTA
Table 1: Comparison of baselines used for evaluation, specifying the use of DDS and the method for gener- ating attention maps.
This study will verify the following claims the original paper:
Claim 1: The DDS algorithm is architecture-agnossii for visual transformers.
The proposed method outperforms all other considered baselines under adversarial attacks for all metrics across all datasets and models, for both classification and segmentation tasks.
Claim 2:
Claim 3: The heatmap visualizations generated by the proposed method exhibit greater consistency compared to all other baselines under adversarial attacks, across all datasets and models, for both classification and segmentation tasks.
Claim 4: The proposed method outperforms all other considered baselines for both negative and positive perturbation tests.
and the following claims that extend the original paper:
Claim 5: The DDS algorithm performs comparably when combined with diffusion models working on the latent space.
Claim 6: Faithful models exhibit comparable inferior performance to their fon-ffl counter-
parts when classifying corrupted images that do not result from adversarial attacks.
3 Methodology
To replicate the study, we utilized the public irepository] provided by the authors, which includes code for the baselines, post-hoc methods, models, and helper functions for loading datasets. Our adapted code can be found on GitHuu
2

---

Published in Transactions on Machine Learning Research (06/2025)
3.1
Model descriptions
3.1.1
VIT Models
Vanilla VIT. The original Vision Transformer model (Dosovitskiy et al. 2021 treats images as a series of smaller patches and uses the transformer architecture to process them for vision tasks. The attention values are used to generate attention maps using relevancy propagation CCeffer et al. 2021).
Vision Trausformer (VII)
Bird
Bell
Transfemer Eneakrr
Poetionn
Einbedding
[cimn] coloddng
Linear Projection Flansened Pasches
Figure 1: Visualization of the Vanilla VIT architecture taken from Dosovitskiy al. 2021
DeiT. A more efficient version of ViT Touvron et al. 2021 which performs well with less training data by using a method called knowledge distillation, where a smaller model learns from a larger pre-traines model.
Swin VIT. A variant of VIT (Liu et al. 2021) that uses hierarchical structure and "shifted windows" process images more effectivcly, capturing both detailed and broader image features.
3.1.2 Diffusion Models For DDS
Diffusion models are able to generate images by repeated sampling of po(2 | xx) (see figure 2 from
noise ZT to generated image zp (o et al. 2020 The probability distribution is a Gaussian Distribution parametrized by
N (a t), Eg(xe,
where (ax, 1), Eg( t) are approximated by U-NET network (Ronneberger et al., 2015 The full algorithm behind denoising is in the Appendix To decrease computational requirements, Ho et al. (0200) provide formula to approximate æo analytically from and æt-1-
Use variational lower bound
Po (x (xx)
XT
Xt
Xt-1
X0
(xx 11
(x4-1x,)) is unknown
Figure 2: Markov chain schematic of diffusion model taken from Ho et al. (2020)- Te is the noisy sample
generated with the randomized smoothing, zo is the denoised sample. g(z; x;-1) is the noisy sample distribution and p 1 xx) is the parametrized approximation of the denoised sample distribution.
3

---

Published in Transactions on Machine Learning Research (06/2025)
Guided-Diffusion Guided diffusion models (Ho et al. 2020 integrate diffusion models with guidance mechanisms, such as labels or gradients, to steer the generation process and enhance output control. For the ImageNet dataset, we utilized the pre-trained diffusion model provided by guided-diffusion as the denoiser.
Latent-Diffusion (Extension). Latent diffusion models (LDMs) (Rombach et al., 2022 combine diffusion models with an autoencoder. The model encodes the image, and then performs the diffusion steps on the latent space. After diffusion, the latent space is decoded back into the image space. LDMs inherently require less memory and compute compared to pixel-space models, while also maintaining high quality and flexibility of applications.
Stable-Diffusion (Extension) Stable diffiusion models (SD) are a subset of LDMs and guided diffusion models know for their accessibility and state-of-the-al performance. They perform difTusion in the latent space using text prompts to guide the diffusion process.
3.1.3 Classification Datasets
ILSVRC-2012 ImageNet.. A large-scale dataset widely used for image classification and object recognition tasks. It consists of 1.28 million training images, 50,000 validation images, and 100,000 test images, spanning 1,000 object categories. Each image is annotated with single label corresponding to one of these categories.
ImageNet-CC (Extension). Hendrycks & Dietterich (2019). This dataset consists of 15 diverse corruption types applied to the validation images of the ImageNet dataset. The corruptions are mainly drawn from four categories noise, blur, weather and digital. Each of these categories has further divisions into subcategories. We used 10,000 images each from the defocus blur subcategory within blur and the elastic transformation subcategory within digital. Defocus blur occurs when an image is out of focus and elastic transformation stretches contracts images.
3.1.4 Segmentation Datasets
Imagettee-Seggnentttioonn Subset. A subset of the ImageNet dataset (Guillaumin et al. 2014) that provides pixel-level object-background segmentations for 500,000 images spanning 577 object categories.
COCO. Also known as 'Common Objects in Context" dataset (Lin et al. 2015) is large-scale image rocognition, sogmentation, and captioning dataset. It contains over 330,000 images, with more than 200,000 labelled, spanning 80 object categories. The dataset includes annotations for object detection, segmentation, keypoint detection, and image captions.
Cityscapes. The Cityscapes dataset (Cordts et al. 2016 focuses on semantic understanding of urban street scenes and includes 5,000 annotated images with fine annotations and 20,000 annolated images with coarse annotations, spanning 30 classes.
3.2
Implementation
3.2.1
Denoised Diffusion Smoothing (DDS)
The DDS algorithm comprises two key steps: smoothing and denoising. Initially, noise is introduced and scaled in proportion the number of diffusion steps. Subscquently, the image undergoes denoising using a diffusion model for an optimal number of iterations, denoted as By incorporating DDS before the forward pass, standard ViT is transformed into FVIT.
4

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm Denoised Diffusion Smoothing (DDS)
Input: Image æ, noise level 6, diffusion steps N, schedule bounds B1, $2. Flags: Denoising (default: True), Smoothing (default: True).
Output: denoised and smoothed image æ.
t' get_ get_optimal wtt_ooptma__ubebr_r_o____
number_ot of _aanberro__see((___ (2,
Optimal step selection.
3.. - B1
(B2 B1)
P. Noise Schedule.
Fx- vI 3.- (xc e) where e~ (0,
Noise injection. Denoising via diffusion model.
④ - diffusion demoise(a
④ - d e'' where e' ~ N7)
return
Note that the final smoothing step (post-denoising) was present in the original implementation but not explicitly mentioned in the paper. Additionally, assume that Hu et al. (2024) used this analytical approximation, as they report computation time independent of T. This significantly improves runtime without substantial drop in performance.
3.2.2 FVIT
The FVIT offers two koy improvements over the standard ViT: enhancod interpretability of attention activa- tion maps and increased robustness under adversarial attacks. These improvements are achieved by evaluat- ing the ViT model on multiple -oooppocese input samples and subsequently aggregating the corresponding predictions. This ensures more stable and reliable decision-making and improves model transparency.
Algorithm FVIT
Input: image num trials m, VIT model y, dds hyperparameterss 0.
Output: FVIT output as probability distribution Coggregate: FViT attention map Woggregate- for m do
a r dds((a, 0)
C, wi + y( end for Waggregate
1 -m wi Caggregate f- aggregate(() C))
return Coggregate; Waggregate
Hu et al. (0044) performed the aggregate for the model output e by taking the top prediction for each of the timesteps and transforming these prediction into probability distribution,
argmaxx C; =j
Caggregate
m
Caggregate corresponds to the index j of aggregated probability distribution. We suggest a new aggre- gation method, where we keep the output as the probability distribution over the classes and aggregate them into c by taking the average,
where (3)
Σ C₁ 771
1
m
Caggregate f
We hypothesize that our method will have more descriptive lop-k accuracy for k: + 1, because the aggregation method suggested by Hu et al. (2024) should struggle with saturated probability distribution. This is because at most m classes will have p O, and on average even less classes will have p > Therefore the top-k accuracies will not be relevant l: count;(p: > 0). We show experimentally in Appendix table that our mean aggregation drastically improves Top-5 accuracy.
5

---

Published in Transactions on Machine Learning Research (06/2025)
3.3 Experiments
Experiment (Claims 1, 2): Evaluate all the ViTs on the classification task using the ILSVRC-2012 Ima- geNet dataset and compare their performance. For each baseline, compute the following metric: classification accuracy.
Experiment 2 (Claims 1, 2): Evaluate the performance of all ViTs across all baselines on the segmentation task using the ImageNet segmentation dataset. To assess interpretability, compare each model's explanation maps against the actual object regions, using segmentation labels as the ground truth, following the approach outlined by Chefer et al. (2021). Interpretability measured using pixel accuracy, mean intersection over union (mloU) (Varghese
al. 2020), and mean average precision (mAP) (Henderson & Ferrari, (017). Specifically, pixel accuracy is calculated by thresholding the visualization using the mean value, while mAP utilizes semeentgmnnntionn to generate hhrreholddindepeene
score.
Experiment 3 (Claims 3, 4): Conduct positive and negative perturbation tests for all ViTs across all baselines under default attack positions while varying the attack radius from 0 to 32/255. In detail, first generate visualizations for each attribution method and save them to corresponding hdfö files, which are used to calculate the highly relevant and irrelevant pixels for each image. In positive perturbation, pixels are masked from the highest relevance the lowest, while in the negative version, from lowest to highest. A lower score in positive perturbations indicate that the model relies on important pixels and a high score in negative perturbations indicates that it does not rely on unimportant pixels. For each baseline attribution method, compare the AUC (Area-uneer-curve) of the accuracy vs pixel perturbation percentage (ranging from 0-90%) plot for every attack radius. This experiment is used to highlight whether DDS makes the models consistently rely more on important pixels and less on irrelevant pixels. This acts as a quantitative analysis proving that FVITs have consistent and accurate reasons backing their decisions.
Experiment (Claims 3, 4): Visualize the model heatmaps for the original and perturbed images. Observe how these attention heatmap changes when focusing
class present in the image compared to the other class present in the image. Determine that the model is not class agnostie, Lee. has a heatmap independent of the class label. These findings act as qualitative analysis proving that FVITs have consistent and accurale reasons backing their decisions.
3.4 Extension
Extension 1 (Claim 5)
We extend the original work by performing DDS with diffusion models working in the latent space to explore the versatility of the DDS algorithm. These models achieve comparable, and in some cases better, perfor- mance in image generation benchmarks with lower computational cost. (Rombach et al., 2022). However, the effect of the PGD attack on the original image has unpredictable consequences when the encoder transforms the image into the latent space. Therefore, the claims about DDS need to be reevaluated for diffusion mod- els applied to the latent space. For this purpose, we test DDS with latent diffusson models (LDMs), stable diffusion (SD) Rombach et al. (2022), and larger models like XLSD (Podell et al., 2023) and Kandinsky [azzhigaev et al. 2023). We use the class-conddtioned LDM pre-trained on ImageNet and a zero vector as the label embedding. We choose the text-conditioned SD pre-trained on Laion aesthetics dataset and used the prompt "clean and detailed imagenet image'.
Extension 2 (Claim 6)
Lastly, we believe that PGD attacks are limited metric when it comes to proving that DDS improves the robustness of ViTs. The PGD uses the gradients of the model with respect to the input image to move it in the direction of the decision boundary of the VIT. In the case of DDS, the input is then fed into the diffusion model. If the diffusion model has a region of inputs for which it generates an image of a certain class, the PGD attacked image as likely to still be in that region as image with random noise. Therefore, this method is biased against the bascline. This leads us to performing classification on other benchmarks with independent deviations. For this purpose we chose the ImageNet-C: dataset, which consists of naturally
6

---

Published in Transactions on Machine Learning Research (06/2025)
Model
With DDS
Without DDS
ViT-B
72.44
8.33
DeiT-B
72.25
4.77
Swin-T
72.50
3.17
Table 2: Top-1 classification accuracy on the ILSVRC-2012 validation dataset with default attack.
corrupted images. The corruption in ImageNet-C are not biased towards DDS, because the corruption also affects the generation of diffusion modols.
4 Results
4.1 Reproducibility
First, evaluated the proposed method classification task under PGD attack. The results in table show that when the models do not use DDS they achieve very low accuracy (below 10%), whereas when the models use DDS they achieve accuracy exceeding 72%.
Next, we evaluated the DDS method and baseline models on a segmentation task under adversarial at- tacks. Table shows the DDS method outperformed all baselines across all metrics and for all models. This demonstrates that the DDS algorithm successfully transforms ViTs into FVITs under the definition of faithfulness provided by Hu et al. (2024). Since this trend holds for two out of the three Vision Transformer architectures explored by the authors (VIT and DeiT) can conclude that DDS architect ure-annosii for attention-base based models. Based these findings, confirm that Claims and hold true.
Model
Method
Pix. Acc.
mIoU
mAP
Raw Attention
0.63
0.42
0.77
Rollout
0.73
0.55
0.84
GradCAM
0.68
0.42
0.68
VIT-B
LRP
0.51
0.33
0.55
VTA
0.73
0.52
0.82
VTA (with DDS)
0.76
0.65
0.85
Raw Attention
0.68
0.47
0.80
Rollout
0.59
0.39
0.73
GradCAM
0.66
0.41
0.69
DciT-B
LRP
0.51
0.32
0.55
VTA
0.79
0.61
0.85
VTA (with DDS)
0.79
0.62
0.86
Table 3: Performance comparison of different methods on the Imagenet Segmentation dataset under the default attack.
Furthermore, we conducted the positive and negative perturbation tests, as shown in Figure indicate that their results are only partially reproducible.
Our findings

---

Published in Transactions on Machine Learning Research (06/2025)
Method
Method
Rollout
Rollout
Tansformar Actribution
Transfomar Attributionn
Row Attn
Raw Attn
DOS
INUUIC
ubock Rackas255
Alback Rodike255
Figure 3: Positive Perturbation.
Figure 4: Negalive Perturbation.
The positive perturbation test shows that DDS achieves the lowest P-AUC for most attack radii. This supports the claim that the model focuses important pixcls. However, results reveal that P-AUC decreases as the altack radius increases, which seems more intuit and contradicts the findings in the original paper, where P-AUC increases with attack radius. A higher attack radius implies a stronger attack, causing a higher deviation. A stronger attack can never have better classification performance for any method. Based on our implementation, we find the outcome of the original paper highly counterintuitive and find our results more realistic.
On the other hand, our negative perturbation test fully aligns with the original paper. The DDS consistently outperforms other methods across most attack radii This confirms that DDS relies the least unimportant pixels. This successfully validates Claims 3 and 4, demonstrating that DDS consistently generates accurate importance maps and prioritizes important pixels in its decisions.
We also conducted qualitative analysis attention maps on several samples containing at least two objects, where some objects were more dominant than others. We ran two experiments: first, focusing on the dominant objects, and then on the less dominant ones.
Figure 5: Baseline methods used to interpret the probability behind class the monkey.
8

---

Published in Transactions on Machine Learning Research (06/2025)
Tae Azerter
ESP
L
Figure 6: Baseline methods used to interpret the probability behind the class lynx.
In the first case, the DDS algorithm performed significantly better than the basclines when the image was attacked (Figure 5). However, when the focus shifted to the less dominant objects, DDS performed significantly worse than the VTA baseline. For example, in Figure G where the focus is on the lynx instead of the monkey, only VTA produced a reasonable heatmap for the non-attacked image, while none of the other methods generated a consistent and logical heatmap. This suggests a potential limitation of DDS in explaining classifications for non-dominant, classes within image.
4.2 Extensions
4.2.1 Using Different Diffusion Models With DDS (Extension)
When rumning DDS with different diffusions, we observed that the performance of the DDS algorithm degraded, as shown in Table g Despite the reduced performance, LDM and SD still siguificantly outperform the baseline of not using DDS. Therefore, we conclude that diffusion models working on the latent space still help the model achieve robustness against adversarial attacks similarly when using diffusion model working in the image space. This shows us that LDMs can be used with DDS and confirms Claim 5. On top of that, both LDM and SD had shorter computation time per sample. We view the choice between using the original diffusion model, SD and LDM for DDS as a trade-off between performance and computation time. Finally, we do not see the benefit of using larger diffusion models, such as SDXL and Kandinsky, because these have too long computation time.
Model
Accuracy [%]
Per-sample computation time [ms]
Hu et al. 2024
72.44
359
Stable Diffusion XL
70.56
819
Stable Diffusion 1.4
65.66
313
Latent Diffusion
56.09
283
Kandinsky 2.2
52.38
7401
No DDS
7.3
60
Table 4: Top-1 Accuracy on the ILSVRR-2012 validation dataset with attack.
4.2.2 Evaluating on ImageNet-C (Extension)
For our second extension, we investigate the performance of the ViT on a new benchmark, the ImageNet-C dataset. The results displayed in show that using DDS reduces accuracy on the ImageNet-C dataset, indicating that DDS does not enhance robustness for blurred images and those subjected to clastic trans- formations. This proves Claim 6 that DDS, while architecture agnostic, heavily depends on the attack parameters being well defined and known.
9

---

Published in Transactions on Machine Learning Research (06/2025)
Corruption Category
With DDS
Without DDS
Defocus Blur
62.75
74.22
Elastic Translormation
3.76
3.90
Table 5: Top-1 Accuracy on the ImageNet--C C dataset.
5 Discussion
5.1
Reproduction challenges
5.1.1
Implementation
We observe that there were discrepancies in the implementation that hindered our reproduction of the results. Despite these challenges, we were able to address several shortcomings wherever possible.
For the ImageNet dataset, the authors used diffusion model weights provided by Ho et al. 2020 whereas for the COCO and Cityscapes datasets, the authors trained their own diffusion models but did not make these models publicly available. As a result, we were unable reproduce their results for the COCO and Cityscapes datasets. Even the provided environment was missing several packages or had compatibility issues between the versions of dependencies, making the initial setup for the reproducibility tedious task.
Additionally, the scripts they inherited from Chefer et al. (021)) were not available in the author's repository or even mentioned in the README, so we had to manually copy and integrate them into our source code. We also had to implement the ImageNet classification script, as was missing from the original repository. Additionally, we improved both the DDS and baseline models to run batch-wise, reducing computation time by approximately 66%.
Lastly, neither the API nor the architecture of the Swin Transformer that was compatible with their imple- mentation provided, preventing from replicating the segmentation experiments with Swin. Crucially, the DDS implementation in the original repository provided by the authors performed an additional ran- domized Gaussian smoothing step after the diffusion denoising step, which did not align with the approach described in the original paper.
5.1.2 Methodology
The authors get different classification results for different interpretation baselines. However, the algorithm in the paper suggests that the classification is independent of interpretation method. Therefore, in our reproduction the classification has the same accuracy for all interpretability baselines.
Hu ot al. (024)) do not clearly describe how they caleulated the P-AUC and how they performed the perturbation attack. For the P-AUC they write that it is the area under curve accuracy based on percentage of removed pixels. The authors specify that the removed pixels range from 10% to 90%, but do not give how many samples they gathered. They also fail specify in what context attack radius defined for this experiment, as perturbation tests in general are done without any adversarial attack.
5.1.3 Communication with original authors
We tried contacting the authors using (wo different means. Firstly, we created a GitHub issue which contained our questions regarding their implementation, with no response from their side. Secondly, we emailed our questions to the authors, who responded that the code they shared on GitHub an old version and outdated. Unfortunately, they have not provided the up-to-date code or responded our technical questions yet despite multiple follow-ups.
10

---

Published in Transactions on Machine Learning Research (06/2025)
5.2 Limitations
Our reproducibility study was constrained by limited computational resources. As result, were unable to perform as many experiments as we would have liked, which weakens the robustness of our findings.
5.2.1 Reproduction study
We did not evaluate whether adding additional noise after denoising enhances the performance of the DDS algorithm due to lack of clarity. Thus, we evaluated the implementation of the DDS algorithm in the official code base but not the algorithm described in the paper. This introduces potential discrepancy in our reproduction, which must be addressed for fair evaluation of DDS.
Furthermore, we did not compare the two aggregations for model predictions under DDS and just used Caggregate -- 1 Di Ci. We believe that the theoretical and intuitive foundation behind our aggregation is enough to justify using it.
5.2.2 Our Extension
Owing to resource constraints, we were unable to train an LDM that performs unconditional denoising. Con- sequently, the LDM we used was not trained for the exact task we applied it to, which limits the reported performance LDM. However, this does not affect the conclusion this extension. Additionally, we only tested DDS on a subset of the ImageNet-C dataset. Due to the significant com- putational demands of the reproduction study, we lacked the resources to evaluate DDS across the entire ImageNet-C dataset.
5.3 Future research
As part of further research, we can experiment with more state-of-the-art interpretability metrics like the Salienco-guided Faithfulness Coefficient (SaCo) (Wu et al. 2024), which claims that significantly enhances altention-based explanation. Combining SaCo with DDS should improve the state-of-the-ard performance.
References
Samira Abnar and Willem Zuidema. Quantilying attention flow in transformers, 2020. URL https://
arxiv. wtt.v.org/aa///255000222
Alexander Binder, Grégoire Montavon, Sebastian Bach, Robert Müller, and Wojeiech Samek. Layer- wise relevance propagation for neural networks with local renormalization layers. CoRR, abs/ 1604.00855 2016. URL
00825
Hila Chefer, Shir Gur, and Lior Wolf. Transformer interpretability beyond attention visualization, 2021.
URL httpss//aaxxv...og/aa//////////a 09838
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understand- ing, 2016. URL
org/ wttp://wwwwrg//////.....
Alexcy Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image worth 16x16 words: Transformers for image recognition at scale, 2021. URL
www.orgg/////eooooooooooeee/eeee /2010. 11929
Matthieu Guillaumin, Daniel Küttel, and Vittorio Ferrari. Imagenet auto-annotation with segmenta- tion propagation. Int. J. Comput. Vision, (10(3)3388-3488 2014. ISSN 0920-5691. doi: 10.1007/ s11263--14-001139. URL http:::/bbb..org/..00/////111112
Paul Henderson and Vittorio Ferrari. End-to-end training of object class detectors for mean average precision, 2017. URL httts:://trrtt https:://///// /tt/////ww..r///////////////////
11

---

Published in Transactions on Machine Learning Research (06/2025)
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness common corruptions
and perturbations. Proceedings of the International Conference on Learning Represenlations, 2019.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models, 2020. URL https:
7/arxiv. org/ 200/ 11239
Lijie Hu, Yixin Liu, Ninghao Liu, Mengdi Huai, Lichao Sun, and Di Wang. Seat: Stable and explainable attention, 2022. URL htttps///axxiv wwwpg/abs/2211111 13290
Lijie Hu, Yixin Liu, Ninghao Liu, Mengdi Huai, Lichao Sun, and Di Wang. Improving interpretation faithfulness for vision transformers, 2024. URL https:://axxi..rrgggg org/ httpa/b///111119//
Alon Jacovi and Yoav Goldberg. Towards laithfully interpretable NLP systems: How should we define and evaluate faithfulness? In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault (eds.), Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. $198-4205. Online, July 2020. Association for Computational Linguistics. doi:
URL
btaps://aclanthologg. wwg/oog///// acl wwl.mmain..... 3367
Tsung Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pictro Perona, Deva Ramanan, C. Lawrence Zitmick, and Piotr Dollár. Microsoft coco: Common objects in context, 2015.
URL https://arxiv, http:///aaiivoorr/b/////000 wwwggab//g//...../////// 0312
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows, 2021. URL 2103.
Kaleel Mahmood, Rigel Mahmood, and Marten van Dijk. On the robustness of vision transformers to adversarial examples. CoRR, abs/2104.02610, 2021. URL batpss//arxiv..or//ba//// 02610
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXie:230..0 01952, 2023.
Prajit Ramachandran, Niki Parmar, Ashish Vaswani, Irwan Bello, Anselm Levskaya, and Jon Shlens. Stand- alone self-attention in vision models. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d' d'Alché E. Fox, and R. Garnett (eds.), Advances in Neurol Information Processing Systems, volume 32, Cur- ran Associates, Inc., 2019. URL https://proceediigg www.sse.rrrppspppppeee wttprppp..c/pppppro...e/ap/p/ppp f.l.ee//ppppp///1////feeee
pdf..
Anton Razzhigacv, Arseniy Shakhmatov, Anastasia Maltseva, Vladimir Arkhipkin, Igor Pavlov, Ilya Ryabov, Angelina Kuls, Alexander Panchenko, Andrey Kuznetsov, and Denis Dimitrov. Kandinsky: an improved
text-to-image synthesis with image prior and latent diffusion. arXiv preprint ar Xiv:23310 0222310.03500. 2023.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolttion image synthesis with latent diffusion models. In Proceedings of the IEFE/CVF conference on computer vision and pattern recognition, pp. 10684 10695, 2022.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-assiste intervention. MICCAI 2015: 18th inter- national conference, Munich, Germany, Oclober 5-9, 2015, proceedings, part III 18, pp. 234 241. Springer, 2015.
Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedanlam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient- based localization. In 2017 IEEE International Conference on Computer Vision (ICCV), pp. 618 618-626, 2017. doi: 10. 10.1109/ICCV.
2017.74.
Hugo Touvron, Matthicu Cord, Matthijs Douzo, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-cfiicient image transformers & distillation through attention, 2021. URL org/ abs///b//2112 12877
12

---

Published in Transactions on Machine Learning Research (06/2025)
Serin Varghese, Yasin Bayzidi, Andreas Bär, Nikhil Kapoor, Sounak Lahiri, Jan David Schneider, Nico Schmidt, Peter Schlicht, Fabian Hüger, and Tim Fingscheidt. Unsupervised temporal consistency metric for video segmentation in highly-automated driving. In 2020 JEEE/CV Conference on Computer Vision and 202000001..
Pattern Recognation Workshops (CVPRW), pp. 1369-1378, 2020. doi:
Ashish Vaswani, Noam Shazecr, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, L ukasz Kaiser, and Illia Polosukhin. At is all you need. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017. URL 2a2//fli//Sbe22357776111133333.2 Paaeeeaaaa--pprrr.... .df
newripu wwt.ippp.ccppppprpppppppp httppppprrrlls/appppppaeee
Sarah Wiegreffe and Yuval Pinter. Attention is not not explanation, 2019. URL https://arxiv..or abs//
Junyi Wu, Weitai Kang, Hao Tang, Yuan Hong, and Yan Yan. On the faithfulness of vision transformer explanations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10936-10945, 2024.
Sixiao Zheng, Jiachen Lu, Hengshuang Zhao, Xiatian Zhu, Zekun Luo, Yabiao Wang, Yanwei Fu, Jianfeng Feng, Tao Xiang, Philip H. S. Torr, and Li Zhang. Rethinking semantic segmentation from a sequence-to- sequence perspective with transformers, 2021. URL sttpss//arxivv.og//bb////0/ 15840
Wenjuan Zheng, Hanxu Luo, YuXin Ji, Haipeng Li, and Longjian Cong. Research on black-bor adversarial attack based on transformer. In 2022 4th International Conference on Frontiers Technology of Information and Computer (ICFTIC), pp. 815 822, 2022. doi: 00.109//CFF1115568822222.2 201.
Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable detr: Deformable transformers for end-to-end object detection, 2021. URL http::::/axxiv.ogg/aa////// wttp://///bbb...oo///.o 04159
A Appendix
A.1 Algorithms
Algorithm 3 Diffusion Denoising
Input: Image ær, timestep
Output: A denoised image zog
for all t E {L,...,T) do
# ()( ()
Σ + Ez t)
if (t - 1) + 0 then
- ~ N(u ))
else
xt-1 + u
end if
end for return Zo
Algorithm 4 Optimal Step Selection gret__optiml_mumnee number _eterr_offffee of steps)
Input: Noise level 6, schedule bounds 31, 32, total steps N. Output: Optimal number of steps t*.
N-1 (1 -1-145= 145= 31) t' + 1+ 0,-3,
return clip((",,,,) N)
b Ensure 1' E N1.
13

---

Published in Transactions on Machine Learning Research (06/2025)
A.2 Environmental Impacts
We estimated the carbon footprint of our research using
CO2e PUE. Pt
where CO2e are the Carbon emissions; CT corresponds to the Carbon intensity measured in grams of carbon dioxide-equivalents emitted per kilowatt-hour of electricity generated; PUE is the Power Usage Effectiveness of the used cluster; P is the power usage of the CPU, GPU and memory; and t is the computation time.
For all our experiments we used using a single GPU, an Nvidia A100 80GB. We ran 212 experiments for a total 316 hours or roughly 2 weeks continuous, and spent 81.58 kW equaling total of 110. 72kWh of energy /KWW spent. We use the C'I value of 370gCO2eq/ kkWh for the Netherlands in 2024 obtained from Nowtricity and PUE value of 1.3 according State of the Dutch Data Centers Report 2024 This brings the total carbon emissions to 53.26kg.
However this value would have been much higher using the implementation provided by the authors due to the inefficiencies of the official code base. We extrapolated the runtime and energy spent and estimated that the CO2 emissions in case we had ran all the experiments using the original code would be 97.82kg. This translates to 45.6% reduction in CO2 emissions stemming from our code optimization.
A.3 Reduction Methodology Comparison
Aggregation Method
Top-1
Top-5
Mean (Ours)
56.09
79.81
Max
55.14
55.26
Table 6: Performance comparison of different methods on classification accuracy on the ILSVRC-2012 vali- dation dataset using Latent diffusion with default attack.
14


Reviews:
[{"review_id": "rda5FswEpe", "reviewer": "Reviewer_wFDK", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths:\n1. The authors clearly explain the background knowledge and provide a relatively clear description of the reproduction methodology and process.\n2. The paper is well-written and easy to follow.\n3. A new average aggregation method is proposed in order to obtain more descriptive top-k accuracy results.\n\n## Weaknesses\n\nThe main goal of reproducibility studies is to provide reliable methods, code, and results for works that are difficult to reproduce, and to derive additional valuable insights based on the original study. However:\n\n1. **The original paper \"Improving Interpretation Faithfulness for Vision Transformers\" is already open-sourced**. Although some scripts are missing, the methods described in the original paper are clear, making reproduction neither particularly difficult nor labor-intensive. As such, the contribution of this paper as a reproducibility study is limited. Furthermore, the algorithms reproduced here—including DeiT, Swin, and Stable Diffusion—are all accompanied by officially released models and code, reducing the complexity and effort required for adaptation.\n\n2. While this paper does present some additional findings beyond those in the original work, **these findings are rather trivial and do not offer any surprising insights for researchers in the field**. For example, it is expected that the FViT perturbation algorithm would perform similarly across ViT, DeiT, and Swin models.\n\n3. Regarding the experimental results, **the authors did not provide more insightful hypotheses or validations compared to the original paper**. For instance, there is no deeper exploration of why FViT performs poorly on ImageNet-C or why the Diffusion model used in the original work outperforms Stable Diffusion.\n\n4. On page 6, section 3.4 (Extensions), sub-section 1, second line, there is a redundant phrase \"computational cost,\" which appears to be a typographical error.\n\nIn conclusion, while this paper reproduces Improving Interpretation Faithfulness for Vision Transformers and offers some extended findings, **these conclusions are relatively trivial, and the reproduction effort is not particularly challenging**. Therefore, the work reads more like an extension or supplementary experiment section of the original paper rather than a standalone, publishable research contribution.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper aims to reproduce the main findings of \"Improving Interpretation Faithfulness for Vision Transformers\" by Hu et al. (2024) (hereafter referred to as the original paper), and further extend and improve upon their methods. The core content of the work includes an analysis of the robustness and interpretability of Vision Transformer (ViT) models under adversarial attacks. The main contributions are as follows:\n\n1. Compared with the original paper, this study not only reproduces the experiments on ViT but also includes DeiT and Swin ViT. The results demonstrate that the conclusions of the original work are generally applicable across different types of ViTs.\n\n2. In addition to the original methods, this paper tests other approaches such as Stable Diffusion, showing that while different diffusion-based models yield consistent conclusions, their performance is not as strong as the Diffusion method used in the original paper.\n\n3. It is observed that the method proposed in the original paper performs poorly on corrupted images such as those in ImageNet-C.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Please see the weakness for further improvement\n\n2. Could you please further explain why the proposed new aggregation method is better than the original one. For example, what is the meaning of saturated probability distribution and is there any evidence to show that the original aggregation does struggle with saturated probability distribution. Moreover, why the new aggregation method has more descriptive top-k accuracy?", "broader_impact_concerns": "Not applicable", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "PM2o3QLOGR", "reviewer": "Reviewer_xjQS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\nThorough Reproduction: The authors meticulously reproduce the core experiments of Hu et al. (2024) and provide credible validation for most claims.\n\nTechnical Rigor: Extensions and deviations are backed by well-reasoned justifications (e.g., in aggregation methods and metric definitions).\n\nNovel Insights: The observation that DDS may overfit to adversarial attack styles while underperforming on non-adversarial corruptions is important and novel.\n\nWeakness \n\nSome figures in the paper (e.g., Figure 1) appear to be identical to those from the original ViT paper,  is this comply with TMLR’s publication policy?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a reproducibility study of Hu et al. (2024), which proposed a method called Denoised Diffusion Smoothing (DDS) to enhance the interpretability and robustness of Vision Transformers (ViTs) under adversarial attacks. The original work transforms standard ViTs into Faithful ViTs (FViTs), and the reproduced study verifies and extends several of their key claims. The key contributions of the reproducibility study include:\n1.Verification of Original Claims.\n2.Methodological Enhancements:Evaluation of DDS using alternative diffusion models, such as Stable Diffusion and Latent Diffusion Models (LDMs). Testing on ImageNet-C, to assess generalization of robustness beyond adversarial settings.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Incorporate Stronger Diffusion Models in DDS Experiments: recent advancements in diffusion modeling introduce architectures that may significantly improve DDS performance, maybe the author can test those methods in their experiments. For example, DIT, SD3, SANA.", "broader_impact_concerns": "NO", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "QIBIq0sRfk", "reviewer": "Reviewer_Q43y", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "weakness:\n\n1. getOptimalNumberOfIterations not clear; did not present details of how to compute\n\n2. latent space PGD experiment not clear; whether the perturbation launch on latent embedding or on the pixel is not clear; \n\n3. The appendix presentation needs to be polished; some format error \n\n4. The figure1 is from vit, please add a reference in the caption. \n\nstrength\n\n1. On the model output aggregation of FViT, a new average aggregation method is proposed in order to obtain more descriptive top-k accuracy results. This optimization exploration of method details helps to further improve the model performance and the rationality of result interpretation. However, the reasoning in the text should be more clear; \n\n2. This work extends the robustness study of FViT on the latent space diffusion model and natural perturbation. Although the results indicate limitations in its robustness in FViT, this exploration helps to comprehensively understand the applicability and potential issues of DDS, pointing the way for subsequent research.\n\n3. Based on the DDS method and FViT proposed by Hu and others, through systematic reproduction and extensional research, its effectiveness, versatility, and limitations have been verified with 6 proposed claims, providing clear directions and references for research in this field.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper attempts to reproduce the findings of the study \"Improving Interpretation Faith-fulness For Vision Transformers\" Hu et al. (2024). The authors focus on making visual transformers (ViTs) more robust to adversarial attacks, and calling these robust ViTs faithful ViTs (FViTs). In their paper they propose a universal method to transform ViTs to FViTs called denoised diffusion smoothing (DDS). The reproduction of the authors study suffers from certain challenges, but the main claims still hold. Furthermore, this study extends the original paper by trying different diffusion models for DDS and tries to generalize the increased robustness of FViTs.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. getOptimalNumberOfIterations not clear; did not present details of how to compute\n\n2. latent space PGD experiment not clear; whether the perturbation launch on latent embedding or on the pixel is not clear; \n\n3. The appendix presentation needs to be polished; some format error \n\n4. The figure1 is from vit, please add a reference in the caption.", "broader_impact_concerns": "No", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)