Privacy Risks and Preservation Methods in Explainable Artificial Intelligence: A Scoping Review
Authors: Sonal Allana
Mohan Kankanhalli
Rozita Dara
Venue: Accepted by TMLR ()

Abstract: Explainable Artificial Intelligence (XAI) has emerged as a pillar of Trustworthy AI and aims to bring transparency in complex models that are opaque by nature. Despite the benefits of incorporating explanations in models, an urgent need is found in addressing the privacy concerns of providing this additional information to end users. In this article, we conduct a scoping review of existing literature to elicit details on the conflict between privacy and explainability. Using the standard methodology for scoping review, we extracted 57 articles from 1,943 studies published from January 2019 to December 2024. The review addresses 3 research questions to present readers with more understanding of the topic: (1) what are the privacy risks of releasing explanations in AI systems? (2) what current methods have researchers employed to achieve privacy preservation in XAI systems? (3) what constitutes a privacy preserving explanation? Based on the knowledge synthesized from the selected studies, we categorize the privacy risks and preservation methods in XAI and propose the characteristics of privacy preserving explanations to aid researchers and practitioners in understanding the requirements of XAI that is privacy compliant. Lastly, we identify the challenges in balancing privacy with other system desiderata and provide recommendations for achieving privacy preserving XAI. We expect that this review will shed light on the complex relationship of privacy and explainability, both being the fundamental principles of Trustworthy AI.

Published in Transactions on Machine Learning Research (10/2025)
Privacy Risks and Preservation Methods in Explainable Artificial Intelligence: A Scoping Review
Sonal Allana
sallana
School of Computer Science University of Guelph
Mohan Kankanhalli
mohan@comp.russ www.://pwpp.uuuuuu.uuuu
School Computing
National University of Singapore
Rozita Dara
drezitaQuoguclph...
School of Computer Science University of Guelph
Reviewed on OpenReview: https: /ttp:r///operrvvttte net/ forum? id- qInykJff zku
Abstract
Explainable Artificial Intelligence (XAI) has emerged pillar of Trustworthy Al and aims to bring transparency in complex models that are opaque by nature. Despite the benefits of incorporating explanations in models, an urgent need is found in addressing the privacy concerns of providing this additional information to end users. this article, we conduct a scoping review existing literature to elicit details on the conflict between privacy and explainability. Using the standard methodology for scoping review, we extracted 57 articles from 1,943 studies published from January 2019 December 2024. The review addresses 3 research questions to present readers with more understanding of the topic: (1) what are the privacy risks of releasing explanations in Al systems? (2) what current methods have researchers employed to achieve privacy preservation in XAI systems?
(3) what constitutes a privacy preserving explanation? Based on the knowledge synthesized from the selected studies, we categorize the privacy risks and preservation methods in XAI and propose the characteristics of privacy preserving explanations to aid researchers and practitioners in understanding the requirements of XAI that is privacy compliant. Lastly, we identify the challenges in balancing privacy with other system desiderata and provide recommendations for achieving privacy preserving XAI. We expect that this review will shed light on the complex relationship of privacy and explainability, both being the fundamental principles of Trustworthy AI.
1 Introduction
1.1 Paradigm shift in technology and the need for explanations
Traditional software development processes have metamorphosed into stable and reliable frameworks through decades of fine tuning by software experts. These software systems are built human designed algorithms and produce trace of the logic used to generate an output. Even in complex systems, it is possible for soflware experts to analyze the logic and generale an explanation for a specific result. During the software development lifecycle, engineers focus on creating the algorithm and validating using well designed test cases that closely replicate real world scenarios. In contrast, modern AT systems do not have an underlying human-written
written algorithm and learn from data fed them. This data-driven nature creates dependence of the system data quality (Merhi 2022 and introduces problems such lack of fairness when data

---

Published in Transactions on Machine Learning Research (10/2025)
is biased, or irrelevant results when data is incomplete outdated (Trocin et al. 2021 During the AI development phase, engineers access training datasets which may contain personally identifiable or sensitive information about individuals. For neural network systems, the development process often involves a trial- and-crror approach, where high accuracy is targeted by tweaking the hyperparameters such as the learning rale, epochs, number of layers or activation functions. The lack of an algorithm prevents engineers from tracing through the AT system and interpreting the results. Thus, the basic ability to be explainable and understand input-output behaviors, which is critical to all computer systems (Sundararajan et al.) 2017); is often out of reach of AI systems. Explanations for outcomes of AI are crucial in high-risk applications MMochaouab et al. 2023) in domains such as healthcare (Dhar et al. 2023 Dwivedi et al. 2023 Yang et al. 2022), finance @wivedi et al.) 2023 Zhang et al. 2022), defense (Dwivedi et al. 2023), justice (Deeks 2019))
energy and power (Machlev et. al. 2022) where the impacl on human life and well- is significant (Karimi
et al. 2023 McDermid et al.,
2021
Nassar et al.) 2020 and the inability to do so deters their successful
implementation Nassar ct al.
2020
Shrikumar ct al. 2017a Yang et al. 2022).
Trustworthy AT strives to mitigale risks due to possible harms from the data-driven nature of AT systems. Trustworthiness is based on foundation principles of reliability, validity, robustness, privacy, explainability 2023) to boost user confidence in the system outputs. Among these principles, explainability aims to bring the much-needed transparency in opaque models and can be considered as a non-functional requirement of a software system to mitigate opacity (Chazette et al., 2021
and fairness (Alzubaidi et al. 2023 Tabassi
There are numerous benefits of including explanations in Al models. Besides aiding data scientists in getting a better understanding of the data (Hohman et al.) 2019) and performing required data cleansing (Chen et al. 2022b explanations can help developers in detecting errors in input and determining features that can be modified to change the outcome (Datta et al.) 2016 When multiple models are available with similar accuracy, an explanation method can help to choose between models (Dhurandhar et al., 2018). Interpretable models can enable knowledge discovery by detecting knowledge or patterns that were missed by uninterpretable ones (Kim et al. 2016). Since humans remain an important component in the decision- making process as end-users and consuners of automated decisions (Terziyan & Vitko 2022), explanations can give them an understanding of the model outcome, especially when they are adversely affected by the decisions (Ali et al. (023). Explainability can also facilitate privacy awareness in end-users (Brunotte et al., 2021), enabling them to make right choices for their personal data and aid regulators and compliance officers to understand the compliance of models (McDermid et al. 2021 with applicable regulations. With generative AI (Gen-Al) and large language models (LLMs) entering mainstream, explanations constitute an important design principle (Weisz et al. 2023) in enabling a better mental model for users (Sun et al.] 2022) and in communicating its capabilities and limitations to them (Weisz et al., 2023). It can also support users in effective prompt engineering to determine the words that impact the output of a model (Mishra et al. 2023
and in verification of generated content to mitigate the problem of hallucinations (Schneider 2024b
1.2 Challenges for privacy in explainability
In many high risk application domains of AI, training models sensitive personal information is inevitable for usefulness of these systems (Veugen et al., 2022). For instance, lung cancer detection model necessi- tates training on chest X-ray images, which constitutes personal information of patients. Similarly, a loan evaluation model of a bank, requires access to the financial profiles of customers, which is also personal information of individuals. Usage of personal data impacts the privacy of individuals when they are subject to intentional or unintentional identification and exposure through these systems. Some models are found to memorize data contained in the input (Song et al., (2017) which can be exploited by adversarics for extraction of personal information. Gen-Al models create new content from large multi-modal datasets (Sun et al., 2022) which could potentially contain sensitive personal information (Meskó & Topol 2023). Due to such privacy risks involved, when personal data is used in training, testing, or inferencing of AI models, they become subject to data regulation and privacy acts (ICO 2020).
Explainability is a foundational principle of Trustworthy AI, however, recent research has determined that introducing explanations in AI systems is found to conflict with the privacy requirements of the system. Explanation interfaces are found to give adversaries an additional attack surface (Duddu & Boutet 2022; Liu et al. ) to mine the information contained in the model. Privacy attacks can target explanations
2

---

Published in Transactions on Machine Learning Research (10/2025)
to retrieve information about membership in the training set (Liu et al. 2024
Naretto et al
2022 Shokri
et al. 2021), build surrogates of the underlying model (Aīvodji et al. 2020; Wang et al. 2022 Yan et al.
2023b), infer sensitive attributes of individuals (Duddu & Boutet 2022 Luo et al. 2022) and reconstruct the training set (Shokri et al. 2021). This leakage is demonstrated across different types of XAI methods including those that are currenlly used in commercial production systems. In addition to privacy allacks, the content of explanations may also inadvertently expose information that is proprictary (Milli et al. 2019) and hence valuable and confidential organizations (Winikolf & Sardelic 2021) or sensitive individuals, thus causing breach of data and privacy regulations. Hence rescarchers have highlighted the urgent need of mitigating privacy leakage through explanation interfaces (Luo et al.) 2022: Patel et al. 2022 Yan et al. 2023b). Due to these concerns of the privacy vulnerabilities of explanations, necessary privacy preservation
measures are required in XAI systems (Aivodji el al. 2020 Shokri et al. 2021
Zhao et al. 2021
1.3
Main contributions
Previous research has identified that the privacy issues in explainability are insufficiently studied (Liu et al. Luo et al., 2022 Naretto et al. 2022) despite its criticality in achieving safety in AT transparency. To the best of our knowledge, there is currently no work that provides an in-depth understanding of the conflict between privacy and explainability in AI. Hence, we focus this article on these two fundamental desiderata of Trustworthy Al and explore the landscape of privacy risks and preservation methods proposed in literature in the context of XAI. The key questions that have designed to define the scope of this article arc:
2024
RQI: What are the privacy risks of releasing explanations in AI systems?
RQ2: What current methods have researchers employed to achieve privacy preservation in XAI systems?
RQ3: What constitutes a privacy preserving explanation?
We conducted scoping review guided by RQI and RQ2. Based on the knowledge gathered from the extracted studies, we propose characteristics of privacy preserving XAI and outline them with the help of practical use cases to answer RQ3. Our main contributions in this article are as follows:
Cutegorization of reported privacy risks XAI: We review the conflict between privacy and explain- ability in current literature and categorize the risks.
Identification of applicable privacy preservation methods in XAI: We determine the privacy preser- vation methods that are applicable to XAI and report the progress achieved by rescarchers in inte- grating them in XAI systems.
Privacy preserving XAI characteristics: We propose the desirable characteristics of privacy preserv- ing XAI to provide researchers and practitioners the guidelines for achieving the trade-off between privacy, utility and explainability.
The rest of this article is organized follows. Section 2 presents brief background XAI including its definition, cvolution, categorization of explanation approaches and related reviews. In Section B we present the details of the scoping review methodology for extracting studies relevant to our research questions. Sections | and synthhesss the results from the scoping review. In Section 4 we consolidate both intentional and unintentional privacy risks of explanations to answer RQI. In Section 5 we claborate the use of privacy preserving methods on explanations and the existing works that utilize them in response to RQ2, Section 0 proposes the characteristies of privacy preserving XAT and answers RQ3. We conclude the article by discussing the results, and highlight the open issues, challenges, and recommendations for future work in Section 7 and conclusions in Section g
3

---

Published in Transactions on Machine Learning Research (10/2025)
2 Background
2.1 Definition of XAI
In 2017, DARPA kickstarted its 4-year XAI program to accelerate rescarch in the development of explanation methods and interfaces to enhance understanding and trust of end-users (Gunning & Aha 2019). The program defined XAT as "AT systems that can explain their rationale to human user, characterize their strengths and weaknesses, and convey an understanding of how they will behave in the future" (Gunning) & Ahaa 2019). The study established users' preference for systems with explanations over systems that provided only decisions. Ribeiro et al. (2016) refer to explanations of predictions qualitative artifacts that provide the relationship between an input instance and the output prediction.
2.2 Evolution of XAI and emergence of privacy concerns
The field of explainability can be traced to the early 1990s, driven by the lack of transparency in black-box models. Early contributions (Benitez et al. [197] Craven & Shavlik 1995 LiMin Fu 1994 Milaré et al. 2002 Torres & Rocco 2005) proposed different techniques for extracting interpretable representations from these systems. The rise of deep learning and the improvement the predictive performance of black-box systems, propelled complex uninterpretable systems into mainstream usage. However, their use in critical domains remains problematic due to their lack of transparency. Regulatory frameworks such the General Data Protection Regulation (GDPR 2016), specifically the provisions individuals' rights related to automated decision-making including profiling, intensified the demand for transparent, explainable models thus resulting in rapid growth in the field of explainability.
However, the introduction of transparency through XAT methods has also exposed new vectors for privacy leakage through explanation interfaces. Early studies (Milli et al. 2019 Shokri et al. 2020 2021 described privacy attacks on the training data and the underlying model. In response, rescarchers have begun explore defense mechanisms and pioneering works in this field (Harder et al., 2020 Patel et. al. 2022 have proposed various strategies for generating privacy preserved explanations. Despite those efforts, privacy risks in XAI remain open research problem, with novel attacks being identified and defense strategies being actively investigated. Figure [ outlines the key milestones in the evolution of XAI and highlights the emergence of privacy issues and proposed defenses.
GDPR's related to automaled decision making including profllng
DARPA launches XAI program
Deep networks become popular
1990
2000
2010
2020
Early XAI
Exponential growth in XAI methods
Early works privacy risks XAI
works privacy defenses in XAI
Figure 1: Key milestones and emergence of privacy attacks/defenses in XAI.
2.3 Categorization of XAI
In recent years, several different XAI methods have been proposed. Broadly, explainability can be achieved using inherently interpretable models applying post-hoe methods trained models (Harder et al. 2020)
4

---

Published in Transactions on Machine Learning Research (10/2025)
Methods specific to certain model types and capabilities, are referred to model-specifie while those in- dependent of the model are referred to as model-agnostic (Dwivedi et al. 2023). In this subsection, we discuss the main categories into which XAI methods are grouped in existing literature (TTblle D), based on
the underlying mechanism used to derive explanations. We also include categories suitable for Gen-AI (Sec-
tions 2.3.5 to 2.3.8 that explore new explanation paradigıns for large models (Sarkar et al. 2024.. Since
there is a broad spectrum of available explainability methods, we limit ourselves to a selection of methods give readers sufficient understanding of the terminologies used in subsequent sections. For comprehensive review of XAII categories and methods, refer the reader to other related reviews listed in Section 2.4
2.3.1 Interpretable methods
These AI models are understandable by design (Arrieta et al. 2020). They have embedded rules or trans- parent architecture that facilitates the understanding of the input-output logic of the system. They are also referred to as white-box or transparent models. Decision trees, Bayesian networks, lincar /logistic regression, k-nearest. neighbours, rule based systems and general additive models (Arrieta al. 2020 Moonar 2023;
Rawal et al. 2022 are some examples of interpretable models. Though these models are promising in aiding the understandability of a system, they have limitations. The primary deterrent to their successful adoption
as explainablee-y--eesinn methods, is their lower accuracy (Blanco-Justicia et al.) 2020 El Zein el. al. 2024
Gunning & Aha 2019) compared to better performing black-box models such as deep learning systems. They also lack natural language explanations, making them unsuitable for use by non-technical users (Biran & McKKownn 2017). Nonetheless, due their intrinsically transparent architecture, interpretable models are often used surrogates for black-box models (MeDermid et al.) 2021). The use of multiple surrogate models is found to facilitate the availability of different types of explanations (Dwivedi et al. 2023 improving the overall interpretability of the system.
2.3.2 Example-based methods
These methods use examples, i.e,, data instances as samples to explain the model (McDermid el al. 2021 The instances may be from the training set or generated by the method (Jiménez-Lunn, al. 2020 Li al. 2020b). These methods are also referred to as record-based (Shokri et al. 2020), instance- based (Jiménez- Luna et al. 2 case-based (Montenegro et al. 2021 methods in literature. They can complement feature- ceature-based methods to aid understandability of the end users (Jia et al. 2021 and also improve the interpretability of complex distributions (Kim et al. 2016). They are intuitive and natural in their ability to provide explanations to humans (Jiméncz-Luna et al. 2020). Some methods in this category are anchors [Ribeiro et. al. 2018), costrastive explanations (Dhurandhar et al. 2018), counterfactuals (Wachter el al. 2017), influence functions (Koh & Liang 2017) and prototypes and criticisms (Kim et al. 2016
2.3.3 showledge-based methods
These methods utilize knowledge representation techniques in machine learning (ML) models to enhance interpretabilityy (Tiddi & Schlobach, 2022). The integration of background knowledge Hiitzer et al., 2022)
facilitates the incorporation of contextual information (Lecue 2020 Páez 2019). thus increasing the trust- worthiness of explanations. The emerging field of neuro-symbolic (Hitzler et al. 2022 or in-between methods
[Ilkou& & Koutraki 2020) explores the integration of symbolic Al approaches rooted in knowledge represen-
tation and reasoning with subsymbolic or connectionist based approaches (Hitzler et al. 2020).
Another knowledge-bert based approach is the use of semantic web technologies for semantic interpretation and automated reasoning from structured knowledge bases (Seeliger et al.) 2019). Knowledge graphs and on- tologies are the common lools that can be deployed to support explainability Knowledge graphs have ap- plicability in pre-model and post- model explainabilty contexts for feature extraction, relation identification, inferencing and reasoning (Rajabi & Etminani] 2022). The field of semantic web technologics in explainabil- ity is attractive because of its potential in creating knowledgo-rich explanations without compromising the model performance (Seeliger et. al. 2019
5

---

Published in Transactions on Machine Learning Research (10/2025)
2.3.4 Feature- based methods
These explanation methods score or measure the effect of individual input features on the output of the model
(Arrieta et al. 2020 Bhatt et al., 2020 Dwivedì et al.] 2023 Strobel & Shokri 2022). They are also referred as feature importance (McDermid al. 2021), feature relevance (Arrieta et al. 2020 or attribution-
[Liu ct al. of a model lor specific input to its base features (Sundararajan & Najmi 2020). Two important calegories of
2024) methods. They are based on the attribution problem which is the distribution of the output
feature- based methods identified in literature are perturbation and backpropagation-baee based methods (Ancona
et al.
2018 McDermid et al. 2021)
Perturbation--baee methods remove, alter, or mask an input feature or set of features and observe the difference with the original output (McDermid ct al. 2021). Some perturbation- basod methods
are LIME (Ribeiro al. 2016); permutation feature importance (Breiman 2001 SHAP (Lundberg & Lee 2017) and MASK (Fong& & Vedaldi 2017).
Backkpooaggalion-buseedd methods compute input attributions in forward and backward passes of the network (Ancona. et al.; 2018)- The of the gradient of the output with the respective input features MMDDermid et al. 2021 Strobel & Shokri 2022) is a common approach in these methods and is referred to as gradient-baseee based approach. Methods used on images that determine the global importance of pixels, generate saliency maps, and are referred to as pixel-level attribution ion methods Kapishnikov et al.) 2019 Molnar 2023). Some examples of backpropagation- based methods are gradient (Simonyan et al. 2014), 4), gradient x input (Shrikumar et al. (017b)) guided backpropagation
(Springenberg al. 2015) and integrated gradients (Sundararajan et al. 2017).
2.3.5 Concept-based methods
Concept-base based methods aim to uncover high-lovel concopts above features, pixels and characters [Ghorbani jet al.] 2019), that influence the behaviour of a model (Bereska & Gavves 2024).. The use of human un- derstandable concepts result in naturally interpretable explanations. Desiderata such as meaningfulness, coherence and importance are proposed for this category of explanations (Ghorbani et al., 2019). Concept activation vectors (CAVs) (Kim et al. 2018 is concept-based method that leverages linear classifiers to determine the presence absence of concepts corresponding to set of input examples. The use of concept activation regions (Crabbé & van der Schaar 2022) enhances CAVs and allows the underlying examples to be distributed across the latent space of the model, resulting in the discovery of global explanations. In another approach, concept bottleneck models (Koh al., 2020 predict intermediate human-specified concepts the model and utilise these for making predictions. The models also support human interventions on these concepts and facilitate the generation of counterfactuals, thus enabling human-model collaboration (Koh)
et al. 2020
2.3.6
Probing-based methods
Probing- based methods use classifiers or probes determine the knowledge captured by a model (Sajjad el al. 2022; Schneider 2024a). The technique involves using the internal activations of networks to train probing classifiers for prediction of embedded properties (Alain & Bengio 2017 Belinkov 2022 However, such probing experiments require the properties to be known apriori along with clear specifications of the triginal/probing tasks, the models and datasets used. The outcomes of these experiments can be applied for tuning the model on certain tasks or determining the encoded information for downstream tasks.
2.3.7 Neuron activation methods
These methods focus on the behaviour of neurons that are responsible for specific outcomes or represent learned linguistic properties (Zhao el al. 2024). Proposed methods in this calegory, such as linguistic correlation analysis and cross-model correlation analysis, identify and analyse such neurons for post-hoc explainability (Dalvi et al., 2019).. Individual or groups of neurons may be discovered as salient for a property and ranked based their importance the model's task (Dalvi et al. 2019). These methods may also experience trade-offs between accuracy and selectivity (Antverg & Belinkov 2022

---

Published in Transactions on Machine Learning Research (10/2025)
2.3.8 Mechanistic interpretability
Mechanistic interpretability (Bereska & Gavves 2024] seeks to understand the model outputs by reverse engineering (Olah 2022) the system. Analogous understanding complex computer programs, this approach aims dissecting network activations into independently understandable units. It considers the analysis of individual components of the system, such features, connections and ncurons, to determine the causes of outpuls. This approach to interpretability includes techniques that could be applied before, during after the training process. Techniques, such as feature visualisation (Zimeerman et al. 2021 and sparse autoencoders (Cnnningha et al. 2024), are some of the methods from this category.
Table Broad XAT categories and selection of early works.
Model- apecific/agnostie
XAI Method
Study
XAI Category
Interpretable
Decision trees, Bayesian networks, finar/logistic regression, k-nearest neighbours, rule-based systems, general additive models
Model-specific
Example- based
Anchors
Model-agnostic
Ribeiro et al. (2018)
Contrastive explanations
Model-agnostic
Dhurandhar et al.
2018
Counterfactuals
Model-agnostic
Wachter et al.
20117
Influence functions
Model-agnostic
Koh & Liang
(017))
Prototypes and criticisms
Model-agnostic
Kim et al. (2016)
Knowledge-
Semantic web technologies
Model-agnostic
Seeliger al.
(2019
based
Neuro-symbolic approaches
Model-specific
Hitzler et al.
(2022
Feature-based
Perturbation-bassed
LIME
Model-agnostic
Ribeiro al.
2016
Permutation Feature
Model-agnostic
Breiman 2001
Importance
SHAP
Model-agnostic
Lundberg Lee
2017
MASK
Model-agnostic
Fong & Vedaldi
2017
Backpropagation-
Gradient
Model-spocific
Simonyan et al.
2014
based
Gradient x Input
Model-specific
Shrikumar et al. (201bb)
Guided
Model-specific
Springenberg et al. (0055
Backpropagation
Integrated Gradients
Model-specific
Sundararajan et al. (2017)
Concept-
Concept activation vectors
Model-specific
Kim et al. (2018)
based
Concept bottleneck models
Model-specific
Koh et al. 2020
Concept activation regions
Model-specific
Crabbé & van der
Schaar 2022
Probing- based
Probing experiments
Model-spocific
Alain & Bengio
2017
Neuron
Linguistic correlation analysis
Model-spocific
Dalvi al.
2019
activation
Cross-model corrolation analysis
Model-spocific
Dalvi et al.
2019

---

Published in Transactions on Machine Learning Research (10/2025)
Model- specific/aguostic
XAI Method
Study
XAI Category
Mechanistic interpretabil- ity
Feature visualisation
Modcl-spocific
Zimmermann ct al.
2021
Sparse autoencoders
Model-specific
Cunningham et al.
(2024
2.4 Related reviews
XAI is currently an active research area and detailed reviews have captured the state of the art in the field. Though current literature has reviews covering different aspects of XAI, to the best of our knowledge there is a lack of comprehensive review that considers the tension of privacy with explainability. Our work addresses this gap and offers unique contribution compared to other existing reviews. In this subsection, we identify related reviews XAI and summarize their focus areas.
An in-depth overview of the core concepts and taxonomies in XAI was provided by Arricta et al. (220)) Mohseni et al. (2021) conducted an interdisciplinary survey and proposed a comprehensive framework for design and evaluation of XAT methods. Dwivedi et al. (2023) covered a wide breadth of explanation algo- rithms, programming frameworks and software toolkits for XAI development. Ali et al. (2023) examined explainability through the lens of trustworthiness detailing evaluation motrics, available software packages and XAT datasets. Bodria el. al. (2023) systematically categorized explanation methods and benchmarked prominent methods using quantitative metries. Muralidhar et al. (2023) reviewed transparency elements from
human computer interaction (HCI) in the context of explanations while Cambria et al. (0223 investigated presentation methods and usage of natural language with XAI.
Beyond these broad surveys, domain specific reviews have also emerged. For example, XAT in healthcare has been surveyed by Payrovnaziri et al. (2020) and Yang et al. (2022); ; in cybersecurity by Capuano et al. (2022) and in energy and power systems by Machlev al. (2022). Methodology focussed reviews also exist, covering counterfactuals (Guidotti 2022), data-driven knowledge-aware XAT systems (Li et al. 2020b), knowledge- graph based XAI (Rajabi & Etminani 2022: Tiddi & Schlobach, 2022 and scmantic web technologies for
explanations (Seeliger el al. 2019). Recent advances include the intersection of explainability and federated learning (FL.,, termed as Federated XAI (Fed-XAL), reviewed LyLóópzz-Baand et al. (2023) and categorisation of explanation techniques for transformer-based language models based on training paradigms as surveyed by Zhhoo et al. (2024). A comprehensive review of mechanistic interpretabililty in LLMs for achieving AI safety was conducted by Bereska & Gavves (2024).
Recent literature has increasingly highlighted the potential of malicious exploitation of XAI interfaces. Ban- jecki & Biecek (2024) present survey of adversarial attacks in XAI and discuss corresponding defenses. While their study addresses specific type of XAI privacy attack, its primary emphasis is on non-privacy attacks including data poisoning, backdoor attacks, model manipulation and attacks on fairness metrics through explanations. A categorisation of XAI-aware attacks was proposed in another recent work (Noppel & Wressnegger 2024b a) based on the outputs that are preserved in the attack. The work also categorised attacks based on the scope of explanation alteration and adversary capabilities. However, this work targets the robustness of post-hoc XAI and though the proposed categorisation is relevant to privacy attacks, it does not directly focus on the privacy aspect of XAI safety.
The focus of this review diverges from prior reviews by specifically examining the privacy risks that target the identification and exposure of personal or sensitive information through the misuse of XAI interfaces in AI systems. Further, we review strategies used by researchers in mitigating the privacy leakage in XAL. An carly work by [Spartalis et al. (2023), provides a short review on XAI privacy risks and applicable defense mechanisms. The review also identifies security risks such as evasion and poisoning through XAI interfaces. Though this work raises awareness for further research in this area, it mainly focuses on early
8

---

Published in Transactions on Machine Learning Research (10/2025)
privacy attacks and discusses limited defense mechanisms. A recent review Nguyen al. 2025 explores the intersection of privacy and explainability through attacks and countermeasures, but differs from our review in its methodology and lacks a detailed examination of the core requirements underpinning the design of privacy preserving XAI. Our review employs an established scoping review methodology guided by clearly defined research questions. The resulting laxonomy of XAI privacy risks and corresponding mitigation methods are distilled from the understanding of existing literature across the privacy and XAI communities. This methodology enables a structured and rigorous approach to addressing the research questions through the analysis of the selected studies.
3 Method
We conducted scoping review based on the Preferred Reporting Ttems for Systematic reviews and Meta- Analyses extension for Scoping Reviews (PRISMA-ScR) (Tricco et al. 2018). This section elaborates the process followed, the proposed taxonomy of XAI privacy risks and the identified research trends.
3.1 Literature selection and extraction
A 4-step process employed comprising of identification, screening, eligibility, and extraction, illustrated in Figure 2 In the initial step of identification, Flsevier Engineering Village (Engineering Village) search platform was used and the search was conducted on Compendex and Inspec databases. These databases index publications from leading computer science publishers, inchuding IEEE, ACM, Springer and Elsevier. A researcher formulated the search string, using the two main concepts of privacy and explainability, with the help of librarian. This was applied on the title, subject, and abstract fields. The reseacher workod with the librarian to set the search, inclusion and exclusion criteria as detailed below for reprodueibility:
Search string: (privacy OR confidential* OR "membership inference" " OR "model inversion" " OR "model extract*" # OR "model reconstruct** * OR "property inference") AND (explainab* OR ex- planat* OR interpretab* OR XAI OR recourse OR "transparency report").
Period of publication: January 1, 2019, to December 31, 2024.
The start year chosen based 2021 published on this topic.
the seminal works (Milli et al. 2019 Shokri et al. 2020
Date of most recent search: Jan 6, 2025
Type of publications included: journal articles, conference articles, book chapters, articles in press.
Type of publications excluded: preprints, unpublished papers, dissertations, books, standards, report chapters, notes, report reviews, editorials, erratum, retracted documents. This criteria was required to ensure the extraction of high quality and rigorously peer reviewed articles.
Language: English
Inclusion criteria: Study should describe at least one privacy risk or privacy preservation method in XAI.
The search results comprising of 3,766 studies were exported from Engineering Village and imported into Covidence (Covidence) review management software by one researcher. During the import process, the software merged duplicate studies from the databases, retaining only unique records. After deduplication, 1,943 studies were forwarded for screening wherein the title and abstract were examined by the researcher to determine relevance to RQ1 or RQ2 while considering the inclusion criteria. Out of 1,943 studies, 69 studies were moved to the next. step to determine eligibility wherein the full text of the identified articles were examined with respect to RQ1 and RQ2. This step was conducted by one researcher and independently verified by a second rescarcher. Since the focus of this article privacy leakage through XAI interfaces, studies that addressed adversarial XAI (such backdoor, poisoning, etc.) without overlap on privacy were eliminated. Studies that discussed general privacy issues in ML without XAI context were also eliminated.
9

---

Published in Transactions on Machine Learning Research (10/2025)
Identification
Compendeex dalabase search (2,285 studies identifie)
Inapec database search
(1 ,811 studies ideniiled)
Dedupiication
1,823 duplicate studies removed
Screening
1,943 unique studies identifie)
Title and Abstract (69 relevent studies identifee)
1,874 insievant studies
17 ineiliible studies
Eligibility
Tuxi-Text Screening for relevance to (74 studies ecreened)
referenced studies added
Extraction
57 studies extracted
Figure 2: Scoping review process per PRISMA-ScR.
Related survey papers that appeared in the search results not extracted but used to determine any additional studics relevant to the rescarch questions. These steps resulted in removal of 17 studies and addition of 5 studies identified through forward and backward searches. The removal and addition of studies were discussed and verified by two researchers. Thus, overall the 4-step scoping review process resulted in extraction 57 studics.
3.2 Proposed taxonomy of privacy risks XAI
Each extracted study was categorized under the appropriate research question. The categorisation of studies under RQL, led to the identification of 3 main types of privacy attacks reported in XAI. These attacks are due to the malicious intent adversaries and we propose to term this leakage as intentional. This leakage can target data (training or query) or models (Figure 3) fourth type of privacy attack in literature was added to the taxonomy due its applicability intentional leakage through explanations, even though it is not currently reported in XAI.
Though all studies extracted under RQ1 belonged to intentional leakage, note that not all privacy leakage in XAI is due to malicious intent. Hence we propose another category of Icakage termed as unintentional. This type of inadvertent leakage can be caused due to training problems, such as overfitting, or design flaws, such as lack of appropriate role-based release of explanations. These problems can be unintentionally introduced in XAI systems and further exploited for intentional leakage by adversarics. Sections 4.2 and we elaborate further on intentional and unintentional leakages respectively.
1.3
3.3
Research trends
The distribution of the extracted studies for RQ1 (i.c., XAI privacy risks) and RQ2 (i.c., XAI privacy preservation) by year, can be seen in Figure [[a] An upward trend in the reported privacy risks associated with XAT methods is evident over the period under review. Correspondingly, there has been noticeable
10

---

Published in Transactions on Machine Learning Research (10/2025)
Membership Inference
Modell Invorsion
Privacy attack data
Property Inference
Intentionall Leekage
Privacy ettack on model
Model Extraction
Training issuee
Unintentional Laakage
Explenation
Content
Figure 3: Proposed taxonomy of privacy risks in XAI.
Mumber studies
Denmki Newy
Folerial Lear
Pedeated
Year
S0A Witpphh cowennttie methods
10
Memtership
Model
Inference
35%
Numbar
NNN
Eanple bood mam
Eargle sood I
Pesurre bood
Earple bood
Fotur bood
Model Intrsion
33%
Momberth refrence
Mode Invertion
Model csrrction
Demmmbnshhpp p rnfernne MaMode Invension Moodet edtruction Property interence
(d)
Figure 4: Research trends identified from extracted studies (a) Studies on XAI privacy risks and preservation methods (b) Privacy preservation methods in XAT (c) Privacy attacks in XAT (d) Privacy attacks by XAT categorics.
increase in the number of studies exploring the use of various privacy preservation methods in XAI observed from Figure 4(b) Among these techniques, differential privacy and anonymization emerge as the most commonly employed approaches. With respect to the identified privacy risks, three types of attacks, namely, membership inference, model inversion and model extraction, appear with comparable frequency across literature (Figure 4(c)). Notably, property inference attacks have not been examined the context
of XAI systems. Figure ((d) presents the categories of XAT targeted by different privacy attacks. Feature- based and example-based XAI are more frequently targeted to such attacks in comparison interpretable methods.
11

---

Published in Transactions on Machine Learning Research (10/2025)
4 Privacy Risks in XAI
Traditionally privacy is referred to the "right to be left alone" (Warren & Brandeis 1890) and the "claim of individuals, groups, institutions to determine for themsclves when, how, and to what extent information about them is communicated to others" (Westin 1967p. In the modern context, with availability, collection, and collation of copious information about individuals through online and offline sources, the concept of information privacy is more applicable and refers to the ability of individuals to exert control on their own data (Curzon et al. 2021). Clarke (1999) has defined information privacy as the "claims individuals that data about themselves should generally not be available to other individuals and organizations, and that, where data is possessed by another party, the individual must be able to excrcise substantial degree of control over that data and its use". In this article, we refer to this latter definition of privacy.
Trustworthy Al is built on the foundational principle of explainability, which supports the gaining of insights into the decision making processes of black-box AI systems (Tabassi 2023).
However, the relationship explainability aids privacy
between privacy and explainability has contrasting aspects. On the one hand, in several ways such as in creating privacy awareness in users (Brunotte et al.
2021), in ascertaining that privacy of system is achieved (Doshi-Velez & Kim 20177] Mūfttüglu et al. correlations with identifiable data for removal (Hohman
2022], and in determining
al., 2019). On the other hand, explanations can reveal sensitive information contained in models and training data (Harder et al. 2020 Rawal et al. 2022 Zhao et al. 2021) thus leading to privacy risks (Kuppa & Le-Khac
2021 Thus, there conflicting
outcomes Aiterra-anzzanare, et al. 2023 Nguyen et al.] 2023 Sanderson et al. 2023 Spartalis et al. 2023 of including explainability as non-functional requirement in Al systems.
4.1 Threat model
To discuss the threat model of XAI, we consider target AT model, J, with corresponding explanation function, ø. For an imput query, x, the system generates an output, f(x), such as prediction, classification an artifact of a Gen-Al system, and corresponding explanation, 6(x) (Figure 5 Though the explanation interface is made available for the end-users of the system, adversaries can also secure different levels of access to the XAI system during the stages of the AT lifecycle (Shahriar et al.) 2023). In white-box access, adversaries possess information about the model internals such as architecture and hyperparameters (Liu et al. 2022a Zhang et al., 2023). In black-box access, adversaries access the input/output of the system [Luu et al. (022a.) without any knowledge of the training process or model internals (Rigaki & Garcia Any intermediate access between whito-box and black-box is referred to gray-box (Jegorova et al. 2022
2023
The adversaries may act as passive observers (Jegorova et al., 2022) and use the model pulp for launching privacy attacks, or they may actively interfere in the training process of the model (Nast et al. 2019).
model
model
output
f(x)
query
Intentional privacy leakage
sie adversary
explanation di [z)
training data
unintentional privacy leakage
legitimate user
Figure 5: Threat model of XAL.
12

---

Published in Transactions on Machine Learning Research (10/2025)
4.2 Intentional privacy leakage
This subsection reviews intentional risks in the form of privacy atlacks launched by adversaries. As XAI systems are fundamentally Al models augmented with explainability features, they remain susceptible to malicious threats that affect conventional AI models. Prior research has identified security attacks, such as evasion and poisoning (Pitropakis et al. 2019), that compromise the integrity of AI. Adversarial attacks on XAT such as input manipulations (Dombrowski et al. 22019) Zhang et al. 2020), model manipulations (Heo al., 2019) and explanation-awan backdoors (Noppel et al.) 2023] are also discussed in current literature. However, the present article focusses privacy attacks that aim to compromise the personal data of individuals or the confidentiality of the underlying model. In the XAI context, model explanations further aid (Zhao et al.) 2021) the identification or exposure of personal information of individuals or the intellectual property of the model owner. Table 2 provides an overview of these intentional privacy risks through XAI and the studies addressing them.
4.2.1 Membership inference
This is privacy risk of identification of individual in the training set of model (Shokri et al. 2017 Zarifzadeh et al.) 2024) (Figure 6). An adversary can execute this attack with black-box or white-box access to the model (Veale et al. 2018) after it has been deployed. A membership inference model can be expressed
as the following binary classifier (Kppa & Lo-Khac 2021 | when the model output, f(x), is available:
A x, [xx + {member, non-member]
(1)
When explanations, o(z), are available, they can be alternatively used to differentiate members from non- members using the following inference model:
M Exp a, 0(x) + memberr, non-member)
(2)
model
model nutput
query
member?
f(x)
explanation ((x)
adversary
membership inference
Figure 6: Membership inference exploiting explanations.
The semnnall work on membership inference in feature-based and example- based XAI systems was presented by Shokri et al. [2020 2021 The study used various backpropagation and perturbation methods to show the vulnerability of feature-based systems. The proposed attack used variances in the prediction and explanation vectors differentiate between members and non-members. Liu al. (2024) introduced membership inference on feature-based XAI using model performance and robustness metrics. The study observed higher loss in confidence perturbation of important features for members and utilized this observation in training attack model, in addition to using the performance loss from the model. Ma et al. (0024) extended membership inference to label-only settings on Shapley value explanations. This method, w which builds on
earlier work on label-only allacks using hard prediction labels CChoquette-Cooo et. al. 2021 improved neighbourhood sampling using explanations thus reducing the number of queries.
In the example-basee based category, Shokri al. (2020 2021) investigated inffuence functions on logistic regression models. Since influence functions generate explanations in the form of actual datapoints, the study observed
13

---

Published in Transactions on Machine Learning Research (10/2025)
that attackers could obtain certainty about membership, thus leading to stronger attacks. More recently, Cohen & Giryes (024)) considered self-influence functions instead, that show the influence of datapoint on its own prediction. The proposed attack required white-box access to the target model parameters, activations, and gradients. The selection of an appropriate threshold range for self-inftuence scores associated with members was critical for this attack and was achieved by maximizing the balanced accuracy on the training set.
Kuppa & Le-Khac 2021 used different type of example-based explanation, namely, counterfactuals, for membership inference. The authors trained shadow models using counterfactual samples and auxiliary datasets. A threshold on the difference in predictions of the attack and target models was used to determine membership. Pawelczyk et al. (2023) also targeted counterfactuals and proposed two types of attacks. The first relied on the distances between datapoints and their counterfactuals to differentiate between members and non-members. The second used a based approach using a likelihood-ratio test (Carlini et al. 2022 that improved the attack.
Interpretable models using decision trees, and surrogate models created using Trepan algorithm (Craven & Shavlik 1995), were evaluated for membership inference by Naretto et al. (2022). The study also examined the effect of overfitting on the attack. The success of membership inference was determined to be higher on both interpretable and surrogate models compared to black-box models. Further, surrogates of overfitted models exhibited higher susceptibiliy to the attack than those derived from well-regularized models.
Membership inference attacks in machine learning models have been explored extensively in existing literature (Hu et al., )022) and attack strategies have exploited confidence scores and predictions (Shokri et al. 2017) However, the recent attacks that exploit explanations suggest that XAI interfacos provide new avenue for adversaries to launch this attack. Such attacks have targeted beasure- example-based,, and interpretable (including surogates) XAI methods. The effectiveness of the attack is influenced by factors such as dataset type (Shokri et al. 2021). dimension (Pawelezyk et al. 2023 Shokri et al. 2021), model architecture (Shokri let al. 2021) and overfitting (Pawelczyk et al.) 2023). Some attacks have proven effective in the absence of knowledge of the training dataset or target archilectures (Liu et al. 2024), underscoring their practical
threat potential.
While interpretable models are often recommended as surrogates for explaining black- models (McDermid et al. 2021), as demonstrated by these attacks, the layer of interpretability can introduce a backdoor to the target system and lead to privacy leaks (Naretto et al. 2022). In the example-based category, influence functions expose data instances, particularly outliers, due to their distinct characteristics and higher inffuence on the training process (Shokri el al.] 2021 Among feature-based methods, those using perturbations exhibit higher resilience to membership inference due use of out-of-distribution points, however, this can also result in reduced explanation fidelity ((Shokri et al., (202)). Conversely, Reature-based methods with better explanation quality are also found to be susceptible to higher leakage (Liu et al. 2024 suggesting conflict between privacy and utility.
4.2.2 Model inversion
This category of privacy risk can result in reconstruction of datapoints partly completely from outputs (Zhang et al. 2023) (Figure 7). These attacks can be conducted with black-box white-box access to the model (Fredrikson et al. 2015 Veale et al.] 2018) after it has been deployed in production systems. Attribute inference is a type of data reconstruction that can determine the values of certain attributes, generally those sensitive to individuals (Yeom et al. 2018) from outputs. When the model output, [(x), is used for inversion, the inference model can be expressed as follows:
A : ff(x) +
(3)
When explanations are available, they can be alternatively exploited to reconstruct datapoints using the following inference model:
A 0(x) + x
(4)
Model inversion attacks have been documented in XAI on example- feature-based, and interpretable systems. Shokri et al. (2020: 2021) demonstrated a data reconstruction attack on influence functions in
14

---

Published in Transactions on Machine Learning Research (10/2025)
publicy avaiable data
model
model outout f(*)
query
model explanation
deta reconstructin
((x)
+
adversary
mocel invorsion
Figure 7: Model inversion exploiting explanations.
logistic regression models and found the attack dependent on data dimensionality. The authors designed different heuristics for low and high dimension data improve coverage and efficiently recover more training points. Goethals et al. (0023) showed explanation linkage attack using native counterfactuals generated from actual instances of the training data. The attack demonstrated the vulnerability of counterfactuals in
leaking private attributes.
Private images were found to be susceptible to recovery through saliency maps by Zhao et al. 2021 leading to inadvertent exposure. The study found XAI systems that provided class-specific multiple explanations particularly prone to Icakage. The authors also used attention transfer to highlight similar risks for non- explanation models. Other studies (Duddu & Boutet 2022 Luo al. 2022 have focused on attribute inference of tabular data using reature-based XAI. The former trained attack models using predictions and explanations to infer sensitive features. The latter used Shapley values and effectively executed the attack with limited number of queries on cloud ML services. Toma & Kikuchi (2024) further showed that the efficacy of the proposed attack was dependent on the combination of black-box architecture and XAT method. Their findings indicate that linear models using Shapley values were particularly vulnerable to attribute inference.
Ferry et al. (024) designed a proba brlisti white-box attack applicable to transparent models, such as decision trees and rule lists, and quantified the information about the training data contained in the model. The work found that models built using greedy algorithms leak more information compared to those built using optimal strategies. The authors also observed the allack's capacity for misuse in launching other inference attacks such as membership and property inference.
The above attacks from current literature demonstrate the potential of misuse of explanations APIs, resulting in Iwo-way flow (Veale al. 2018) where inputs can be determined from outputs. Model explanations provide an effective attack surface compared predictions (Duddu & Boutet [022 Zhao et al., (021).,
indicating the contradiction between the need for explanations in Trustworthy AI and protecting privacy (Zhao et al. 2021 Data reconstruction attacks impact active users of AI systems, thus putting end-users risk (Zhao et al. 2021 and having a higher impact. In certain proposed model inversion attacks, sensitive attributes can be retrieved from models trained on non-sensitive attributes (Duddu & Boutet (022)) while
other proposed attacks demonstrate higher lcakage from more important attributes (Luo et al.) 2022) and recovery of entire training datasets (Shokri et al. 2021). ). In addition, the above works highlight the misuse of XAI techniques even for models that do not provide explanations (Zhao et al. 2021).
A tension is also found between preserving privacy and maintaining utility of the XAI system. For instance, synthetic counterfactuals created by perturbing actual samples are shown to provide resilience to inversion in comparison to native counterfactuals However, their usage is found to affect the plausibility and runtime of explanations (Goethals et al. 2023), suggesting degrading utility. Similarly, the use of multiple diverse explanations are usually recommended (Vo et al. 2023) for improving understandibility of explanations, however they are also found to contribute to Icakage of privacy. Consoquently restricting the access explanation APIs has been suggested as a countermeasure (Zhao et al. 2021), however such restrictions may reduce the utility to end-users.
15

---

Published in Transactions on Machine Learning Research (10/2025)
4.2.3 Model extraction
In this attack, the target model is replicated to a significant degree of accuracy and fidelity Jegorova ct al. 2022), thus breaching the confidentiality and the intellectual properly of the model owner (Figure 8). In a typical model extraction attack, the adversary has black-box access a. deployed victim model and uses an unlabeled dataset to query it, thus building an attack dataset (Yan al. 2023b) for cloning the model. In contrast, data-free model extraction leverages generative models to synthesize the datasets, which is advantageous when the input data is difficult to obtain (Miura et al. 2024 When the model output, f(x); is utilized for this attack, the extraction of the target model function, f', can be expressed as follows:
ModEst I, fx) I"
(5)
When explanations are utilised for the purpose of extraction, the attack model can be expressed as follows:
AmodEztEap 2, (xx) +
(6)
Since the extracted models can further leak personal data through membership inference and model inversion (Song et al. 2017), this attack is usually used as a starting point for initiating other types of attacks (Aivodji
ct al.
2020
Miura et al., 2024b.
model
substiute
model
querry
model
oulput
[(x)
model
explenation
model extraction
(xx)
adversary
Figure 8: Model extraction exploiting explanations.
Model extraction attacks using explanations have been proposed across feature-based and example-based XAI methods. In the seminal work the topic, gradient explanations, in the form of saliency maps, were found to be vulnerable by Milli al. (2019). The use of explanations improved the attack by reducing the nunber of queries compared to allacks relying solely on model predictions. MMura et al. (2024) also leveraged gradient-based explanations but used data-free approach to train generative models for creating the attack datasot. The inclusion of explanations improved the quality of the generative model, and the accuracy of the cloned model improved with the diversity of the generated samples. Similarly, Yan et al. (2023a) employed data-free exctactoon wherein explanation loss was used to guide the generative model. Accuracy of the cloned model was improved by matching the victim model's predictions and explanations.
A different approach of extraction on feature-based XAI, used multitask learning to learn both classification and explanation tasks of the victim model Yan et al. 2022.. Further, model agnostic technique on gradient and pertubatioon-al enabled more efficient attacks, reducing the query budget compared to prediction-only strategics. The attack could also be applied to non-explanation models and achieved accuracy equivalent to those of explanation models.
XAI (Yan et al. (023b),, showed that explanations provided auxiliary information that
Besides the above extraction attacks targeting various feature-based XAI, from the sxample-based category, counterfactuals have been mainly targeted for this attack. In extraction attack proposed by Aïvodji et al. (2020), they were used to approximate the decision boundary of the victim model with high accuracy and lidelity under low query budgets. Multiple and diverse counterfactuals were found to aid the extraction process by divulging additional information to adversaries. An improvisation of the attack, to reduce the number of queries further, mitigate decision boundary shift and achieve higher agroement with the victim model, was proposed by Wang et al. (2022). The method used the original counterfactual explanation with its own counterfactual as training pairs, to extract additional datapoints to train the cloned model. Tn
16

---

Published in Transactions on Machine Learning Research (10/2025)
another approach, Kuppa & Le-Khac (2021) proposed iterative querying of the victim model to capture the training data distribution. The method utilized distillation loss to transfer knowledge from the victim to the cloned model and was found to be successful due to the optimization of various properties such as diversity, proximity, fcasibility, and sparsity.
As demonstrated by the aforementioned attacks, explanation-hased extraction attacks offer substantial ad- vantages over traditional prediction-only approaches by facilitating model replication with reduced number of queries (Milli et al. 2019 Miura al. 2024). The reduction in the number of queries benefits the ad- versary, especially in pay-by-ques qu-rr models. Certain attacks also possible with partial knowledge of the data distribution (Aīvodji et al.] 2020) or in absence of overlap between the attack and training datasets (Yan et al.] 2022). In addition, in scenarios where attackers do not possess the input datasets, data-free extraction attacks are possible and the use explanations shown to improve the attack accuracy (Miura) et al. 2024 Moreover, the diversity of the generated input datascts in such attacks found to improve the accuracy the cloned models (Miura al. 2024].
In addition to the direct threat to explanation models, XAI techniques be misused for extraction of non-explanation models (Yan et al., (022b)). The use of diverse explanations, intended to build user trust in explanations, can lead to further leakage of privacy (Aivodji et al. 2020). Similarly, the optimization of counterfactuals to satisfy various properties to improve explanation quality, can reveal information to adversaries about class-specific decision boundaries thus aiding the attack (Kuppa & Le-Khac 2021 and leading to the conflict of explainability and privacy with utility.
4.2.4 Property inference
This type of risk pertains to inference of properties from the training data such as global statistics or aggregates MMahloujifar et al. 2022), which model owners did not intend on sharing (Ganju et al. 2018) (Figure 9). The inferred property may not correspond to features in the training data or be correlated any feature. property inference model that uses the model outputs, f(x), to infer such property, p, can be expressed as the following:
Apropinf f(x) + p
When explanations, d(x), are available, the inference model can be expressed as follows:
Apropin Eap ((x) + p
(8)
model
query
model ausput
f(x)
model explanation
eggregate Information
+
property inference
d(x)
adversary
Figure 9: Property inference exploiting explanations.
Although property inference is known issue in AI models, to the best of our knowledge, attacks have yet. been documented that exploit explanations for this purpose.
17

---

Published in Transactions on Machine Learning Research (10/2025)
Table 2 Studies on intentional privacy leakage in XAI systems.
XAI Category
XAI Method
Study
Privacy Risk
Membership
Interpretable
Decision tree
Naretto et al. 2022
inference
Interpretable
Trepan
Narelto et al.
2022
(surrogate)
Example-based
Influence fuuctions
Shokri al 2020
2021
Counterfactuals
Kuppa & Le Khac
20021
Pawelozyk et al.
(0023)
Self-influence functions
Cohen & Giryes
2024
Gradient, integrated gradients, guided backpropagation, LRP, LIME, SmoothGrad
Shokri et al.
2020
2021
Feature-based
Integrated gradients, SmoothGrad, VarGrad, Grad-CAM++, SHAP,
Liu al.
(0024
LIME
Shapley values
Ma et al. (2024)
Model inversion
Interpretable
Decision tree, rule list
Ferry et al. (2024
Example-based
Influence functions
Shokri et al 2020
2021 )
Counterfactuals (native)
Goethals et al. 2023
Feature-basd based
Gradient, gradient input, class activation maps (CAM), Grad-CAM, LRP
Zhao et al.
2021
Integrated gradients, DeepLIFT, GradientSHAP, SmoothGrad
Duddu & Boutet
(022
Shapley values
Luo et al.
2022
Toma &
Kikuchi (0244)
Model extraction
Example-bard based
Counterfactuals
Aivodji et al.
2020
Kuppa & Le- Khac
20221
Wang all
20022
Featuro-based
Gradient
Milli ct al.
2019
Gradient, Grad- CAM, MASK
Yan et al.
2022
Gradient, Grad-CAM, MASK, LIME
Yan et al.
(023b))
Grad-CAM, LIME
Yan et al. 2023a
Gradient, integrated gradients, SmoothGrad
Miura et al.
2024
Property inference
Not reported
Not reported
4.3 Unintentional privacy leakage
This subsection discusses unintentional privacy leakage XAI that occur without malicious intent (Jegorova ct al. ) Certain leakages can occur due to the natural mechanisms the training process or through the content of explanations. These may occur during the different AI lifecycle phases or during the course of an explanation (Rawal al. 2022
18

---

Published in Transactions on Machine Learning Research (10/2025)
4.3.1 Training issues
Training issues such as, overfitting and memorization, identified in AI models can lead to privacy leakage. Overfitting found to aid membership and altribute inference attacks (Yeom et al. 2018). Memorization leads to the model remembering subsets of training data (Song et al., 2017] and occurs during training before overfitting begins [Jegorova al. 2022). It can cause leakage when data owners deploy modcls with codebases and training pipelines developed by third parties, such as in MLaaS, allowing sensitive information to be leaked from training data (Song et al. 2017
4.3.2 Explanation content
The content of explanations may contain values of sensitive fields. For instance, in example-based expla- nations such as influence functions, training datapoints potentially containing sensitive fields, are directly revealed to end-users. Karimi et al. (2023) provide another example of unintentional leakage through con- trastive explanations, which can lead to inference of sensitive details of individuals whose partial attributes are known. Additionally, interpretable models used as surrogates, can reveal properties of the training data or additional information about the black-box beyond what the model owner intended to share [Blanco-Justicia ct al. 2020). In addition to direct content-basee leakage, risks may also arise from the inadvertent exposure of explanations to unauthorised users (Kuppa & Le-Khae (021]. For example, during troubleshooting of error cases, developers or quality engineers may unintentionally access sensitive personal information in the explanation. Moreover, even when direct identifiers are absent, explanations that contain proxy correlated features can still enable indirect inference.
5 Privacy Preservation Methods in XAI
To address the privacy risks outlined in Section 4 growing body of research has emphasized the need for privacy preserving XAI techniques {Aivodji et al. 2020 Shokri et al. 2021 Zhao et al., 2021). ). In response to these concerns, several studies have proposed met to generale explanations while miligaling privacy concerns. Many of these approaches draw upon established principles and methods from the broader domain of privacy preserving ML (PPML), adapting them to specific challenges posed by explanation techniques. This section synthesizes the key contributions in literature to enhance the privacy guarantees of XAI systems in alignment with the objectives of RQ2. We categorize the proposed solutions under the main approaches PPML. Table 3 summarizes these approaches and methods, and Figure I0] presents a consolidated mapping of privacy preserving strategies to specific types of privacy attacks discussed carlier.
5.1 Differential privacy
Differential privacy (DP) (Doork et al. 2006) is widely recognised method that provides a quantifiable definition of privacy and the incremental privacy loss from publishing confidential data (MeKay Bowen & Garfinkel 2021 A mechanism is differentially private if it can hide the participation of any single individual in dataset Harder et al. 2020). This can be achieved by using noise and is typically associated with an adverse effect on the accuracy of the system (Harder et al. 2020). By adjusting the privacy budget, from 0 to 0o, practitioners can manage this trade-off between privacy and accuracy (McKay Bowen & Garfinkel 2021). Given its robust privacy guarantees, early research in privacy preserving explanations has adopted DP using various strategies to safeguard the training data in interpretable, feature-based, and example- XAL. In the context of XAI, an explanation is differentially private if it can obscure any single individual in the training dataset (Patel et al. 2022). The technique can be applied at various stages, including the explanation generation algorithm (Patel et al. 2022), the training process of the target model (Cohen &
Giryes 2024 Liu et al. 2024) or directly on the training data (Bozorgpanah & Torra 2024 Ezzeddine et al.
2024).
Decision trees are popular due to their simplicity and inherent interpretable qualities, however they are prone to privacy leakage (Ferry et al. 2024 Narctto et al. 2022). A number of algorithms have been developed for building decision trees based on DP guarantees (Fletcher & Islam| 2020) offering different trade-offs in privacy and utility. The interpretability of private trees and their subsequent. usefulness to XAI users.
19

---

Published in Transactions on Machine Learning Research (10/2025)
Model Extraction
An & Cao (2024)
Other techniques
Jeong et al (2022)
Chen (2022a)
Perturbation
al. (2020)
Federated
Learning +
Model Inversion
Molhoek & Laanen
(2024)
Cryptography
Anonymization
Attribute Inference
Goethals et al. (2023)
k-anonymity
Montenegro et (2021)
Identity separation
Montenegro Cardoso (2024)
Campos (2024)
Data Reconstruction
et al. (2023)
diacretization
Johnson (2022)
Gaudio et (2023)
Lossy compression
Li (2020a)
Membership Inference
Patel al. (2022)
Differential Privacy
Cohen Giryes (2024) et al. (2024)
PRIVACY ATTACKS IN XAI
PRIVACY PRESERVATION METHODS IN XAI
Figure 10: Proposed privacy preservation methods for specific privacy attacks in XAI.
depend on factors such as the privacy budget per query, tree depth, pruning strategies and termination criteria (Fletcher Islam 2020). Nori et al. (2021) applied DP to another type of interpretable model, namely, Explainable Boosting Machines (EBM),
prevent privacy leakage of training data. The resulting privatized system demonstrated good accuracy at low privacy budgets while facilitating correction of errors introduced by noise, the removal of bias and the enforcement of constraints such as monotonicity. Building on this, Baek & Chung (2024) further optimized the utilization of privacy budget in these models to improve accuracy, incorporating techniques such as gradicnt error optimization and pruning of non-cssontial features.
Harder et al. (2020) proposed an interpretable model using differentially private locally linear maps with Gaussian mechanism per output class, The filters learned by the model from input images were observed have higher interpretability compared to featuro-based methods, such as integrated gradients and Smooth- Grad. However, increasing the number of such maps per class dropped accuracy due to the distribution of privacy budget over additional parameters. Tn different approach, Li et al. (2020a) proposed inter- pretable model in the form of feedforward-dessineel convolutional neural network (FF-CNN) made privacy preserving by using DP guarantecs on subspace approximation with adjusted bias (Saab). Their findings indicated the the integration of DP was effective mitigating the risk of reconstruction of input images while maintaining classification accuracy.
For feature-based explanations generated by local linear approximations around the point of interest, Patel et al. (0022) introduced differentially private approach for loss caleulation in the explanation algorithm. The study also proposed an adaptive method of reusing previous explanations for prudent usage of the privacy budget. Nguyen et al. (2023) employed local DP to restrict adversaries from learning the top influential features through aggregated scores in feature-based XAI. While originally proposed to defend against backdoor sccurity attack exploiting explanations (Severi et al. (001),, the random perturbation of influentia features under local DP guarantees was observed to preserve the privacy of those features while maintaining explanation fidelity. Bozorgpanah & Torra 2024) also applied local DP to mask the training
20

---

Published in Transactions on Machine Learning Research (10/2025)
dataset and investigated its impact on privacy and utility of feature-based explanations. They introduced irregularity metric to measure the feature distortion due to privatization of the original dataset and the change in explanation values. Their findings indicate that the use of additive noise on the training dataset cansed irregularitios, thereby reducing the utility of the explanations. In a related study, Ezzeddine et al. (2024) added calibrated noise to training datasels and evaluated the impact on SHAP explanations using various distance metrics. They observed the change in SHAP values in the privatized systems correlated with the privacy budget and data dependent. Abbasi et al. (2024) used a different approach on the data and employed DP for synthetic data generation for training of different model architectures. They used similarity scores to track the change in explanations while utility loss evaluated the drop in accuracy, thus quantifying the triad of privacy, utility and explainability.
In addition to the aforementioned studies, researchers have also examined the use of DP in the training process of the target model in feature-based (Liu et al.] 2024) and example-based (Cohen & Giryes 2024; Mochaourab et al., 2023) XAI. These investigations have determined mitigation against membership inference atlacks for high privacy budgets (Cohen & Giryes 2024 Liu el. al.] 2024 The introduction of DP noise serves regularization mechanism for target models Nori et al. 2021 and its mathematical guarantee enables quantification of privacy, making it a compelling choice as a privacy enhancing technology. In the context of XAI, in addition to its application in mitigating membership inference from explanations (Cohen & Giryes 2024 Liu et al. 2024 Patel et al. 2022), it is also found to mitigate reconstruction of sensitive inputs (Li et al. 2020a). However, the improvement in mitigation of attacks at high privacy budgets and hence degrading accuracy (Cohen & Giryes 2024 Liu et al.. 2024) can be a setback to the use of this technique. In addition to adversely affecting accuracy, its introduction can also deteriorate explanation quality in terms of fidelity (Liu et al. 2024 Patel et al. 2022 with pronounced effects minority groups (Patel et al., 2022). The technique is also ineffective against attribute inference atlacks when there are existing strong correlations between different attributes (Chen et al. 2022a). In such cases, the privacy enhancing benefits of DP may be insufficient to prevent adversarics from inferring sensitive attributes.
Algorithuns such as DPSaab (Li el al. 2020a), have been observed to ofler a more favourable trade-off between accuracy and privacy. Practitioners can employ strategies such as reusing previously generated differentially private explanations to utilize the privacy budget effectively (Patel et al. (022). Methods that use local DP, are observed to achieve high faithfulness of explanations with privacy (Nguyen et al., 2023), thus demonstrating that it is possible to balance multiple desirable properties. Hence judicious use of this technique can ensure that privacy is achieved while maintaining reasonable utility of the model and explanations.
5.2 Cryptography
Cryptographic protocols for privacy preservation in ML use secure algorithms to protect the larget model and data. Prominent methods in this category include homomorphic encryption, secret sharing, and secure multi-party computation (Yin et al.) 2022). In XAI, these techniques have seen limited application in interpretable and baamdle-basodd systems. They have also been used in conjunction with other privacy preserving techniques such as federated learning 2020 2023
El Zein et al. 2024 Molhoek & Laanen 2024
Wu et al.
For interpretable tree-based models, Zhao et al. 2023 proposed an additive homomorphic scheme for model owners and query users, for pushing the encrypted model and query data to cloud service providers for inferencing. Adding perturbations to the inference results and query data ensured privacy protection of these assets while maintaining accuracy comparable to non-private inference. In the example-based cate- gory, Veugen et al. (2022) proposed cryptographic method with secure multi- party computation to generate contrastive explanations, while protecting private training data and confidentiality of the model. The algo- rithm securely trained a binary decision tree to generate fact and foil leaves, which were used as explanations for a query datapoint. Additionally, a synthetic datapoint from the foil leaf was provided to the end-user to enhance explainability.
Cryptographic methods, such as homomorphic eneryption, introduce significant computational complexity in the system [Liu et al. 2022a). The of encryption can deteriorate model transparency, limiting the
21

---

Published in Transactions on Machine Learning Research (10/2025)
ability of data scientists to correct errors, inspect data, add features or fine tune the model (Dowlin et al, 2016). Therefore it is essent ial to implement cryptographic protocols in XAT system components in the right use cases to complement other privacy preservation techniques or when other techniques are infeasible or costly.
5.3 Anonymization
Anonymization refers to the process of transformation of data (Majeed & Lee 2021 to obscure the distinctive features of individuals, thus safeguarding their privacy. The process is associated with the removal or modification of direct and quasi-identifier (Majeed & Lee] 2021), that can uniquely identify individuals. Various methods of anonymization are used in practice, such as k-anonymity, 1-diversity, and t-closeness (Yin et. al. 2022). In XAI, different anonymization techniques have been demonstrated in example-based, feature- and interpretable methods. Techniques such as disentangled representation learning and lossy compression have been applied on sensitive visual data, such as medical images, to generate privatized explainable-by-deeiin representations.
A datasct is considered k-anonymous if every record is indistinguishable from k-1 other records (Swoeney 2002b), thus providing measure of the risk of re-identification of records. K-anonymity can be achieved using methods such as suppression and generalization (Sweeney 2002a), which obscure the data to remove identifi- able features. Though traditionally this technique is applied to target datascts for protection, Gocthals et al. (2033) proposed its usage on native counterfactuals, that are actual datapoints from the training dataset, for protection against model inversion attack through explanations. This strategy of generating k-anonymous counterfactuals was shown to result in lower information loss and higher validity, outperforming counterfac- tuals derived from k-anonymized datasots. Further analysis by [erningg ct al. (2024) determined that the effectiveness of k-anonymout counterfactuals is confined to dense areas of the dataset. Its offered privacy protection was also found disproportionate to the value of k. Vt al. (2023) highlighted another limitation, namely, the computational overhead of generating these counterfactuals requiring querying the explainer for a large number of counterfactuals. The authors proposed an alternative strategy of privatizing diverse counterfactuals by discretization of continuous features. This technique is closely related to generalization in privacy preserving data mining and is particularly effective against linkage attacks.
K-anonymity using microaggregation has been applied on the training dataset in feature-based XAI by Bozorgpanah & Torra (2024). The study found explanations from non-private and private datasets largely aligned, with minor irregularities observed. The alignment indicated that utility was effectively preserved after privatization. Similarly, BBlanco-Justicia et al. (2020) applied microaggregation to build local bree-based surrogate explanations from clusters around an instance to be explained. The method enforced k-anonymity by restricting the cluster size and incorporated shallow trees to enable comprehonsibility.
An emerging area of study focusses on providing explanations while protecting privacy in the medical domain, where privacy of patients' visual data is crucial. The primary aim of such techniques is transformation of private data through removal of identifying features while retaining explanatory cvidence. Strategics such as the use of autoencoders for disentanglement of identifiable characteristics (Montenegro & Cardoso 2024 Siamese network for increasing identity distance between original and privatized images (Montenegro et al. 2021) and latent diffussio models for generating synthetic images Campos et al. (2024) are proposed. The use of lossy compression by pixel sampling is also observed to remove identification information while being post-hoc explainable (Gaudio et al. 2023 Johnson et al., 2022). This approach also has an added advantage of reducing the image size significantly, thus making modical training datascts smaller (Gaudio et al., 2023)
In critical domains, such healthcare, anonymizing training and query data can assist in protecting identi- fiable information. However, the applied techniques should preserve the output quality for utility to diverse end-users (Campos et al. 2024). Unlike DP, anonymization techniques lack proven guaranteos, however despite DP's theoretical guarantees, it is unable to scale beyond low resolution image data (Campos et al., 2024). Lossy compression alternatively provides an effective way of privatizing image data, with the bene- fits of achicving both privacy and explainability while reducing training dataset sizes. It thus enables data sharing with multiple parties in non-private settings (Gaudio et al. 2023) and can serve as an explanation generation method for sensitive image data.
22

---

Published in Transactions on Machine Learning Research (10/2025)
Anonymization techniques, such as k-anonymity, protect privacy of individuals by mitigating re-identification and linkage attacks (Vo et al. 2023). When applying k-anonymity, selecting an appropriate value of k is critical in striking the right balance between accuracy and privacy risk level (Bozorgpanah & Torra 2024).
While higher values of k enhance privacy, explainability may be adversely affected (Berning et al. 2024 Blanco-Justicia et al.] 2020). Moreover, the actual level of privacy may also not scale with increasing values of k (Berning et al. 2024). Hence the selection of k that achieves the right trade-off in privacy, explainability and utility is important. Additionally, k-anonymity has limitations such as its dependence data characteristics, susceptibility to homogeneity attack (Berning et al., 2024), and its vulnerability to privacy leakage when background knowledge is available or diversity is lacking in the private attributes Goothaal et al.) 2023). Other techniques such as I-diversity and t-closeness may address some of these challenges, though their applicabilily to explanations remain unexplored.
The generation of synthetic data for privacy preserving data analysis explored in previous non-XAT works (Bocdihardjo et al. 2023 Liu al., 2022b). Generating synthetic data that is private, accurate and preserves properties of the true data is known challenge and NP-hard in the worst case (Ullman & Vadhan 2011). When models are trained on such data, the explanations through XAI tools are expected to be inherently privacy preserving, hence this approach can be a promising direction in preserving privacy in explainable systems.
5.4 Perturbation
Perturbation of sensitive data is widely recognized technique in the field of privacy preserving data pub- lishing (Tran et al. 2024 Yin et al. 2022). When explanations contain sensitive information, obfuscating the contents through perturbations can prevent direct exposure. This technique can also be applied to stem indirect leakage of inferencing sensitive attributes through explanations.
Chen et al. (2022a) proposed a generic privacy preserving mechanism applicable to different XAI types such as feature- and interpretable surrogates. The proposed method perturbed the decision mapping of an algorithm prior to public release of transparency reports. To mitigate privacy leakage while upholding utility, the authors defined a maximum confidence measure in the inference of sensitive attributes of data subjects and a utility measure in terms of faithfulness. [Jeong et al. (0022) applied perturbations on saliency map explanations as a defense mechanism for model inversion in image models. The proposed framework com- prised of a two-player minimax game between inversion and noise injector networks, in which the inversion network attempted to reconstruct images from saliency maps and the noise injector perturbed explana- tions to counter the inversion. The use of multiple evaluation metrics to differentiate between original and reconstructed images facilitated the quantification of the privacy of the defense mechanism.
For the prevention of privacy leakage in XAI, rescarchers have attempted perturbation of two types of model outputs, namely, predictions and explanations. Adding perturbations to model predictions, such as the strategy of adding noise to output confidence scores used by MemGuard (Jia et al., 2019), is found ineffective in mitigating membership inference through explanations (Liu et al., 2024). Perturbation of explanations is also insufficient in defending against data-free model extraction based on explanations (Yan) et al. 2023a However, the strategy has shown promising results in countering model inversion. The use of perturbation techniques at the explanation interface is also attractive due to its case of implementation that requires no retraining of the model (Jeong el al. 2022). Nevertheless, large magnitude noise can degrade the usefulness of explanations (Jeong et al. 2022), hence perturbations should be carefully calibrated to minimize any adverse impact on explanation quality.
5.5 Federated learning
Among the distributed privacy enhancing techniques available in PPML, Federated Icarning (FL) is an architectural solution (El Mestari et al. 2024) that enables training of local models on user devices and exchange of model parameters with a centralized server that co-ordinates the training of a shared global model (Konečný et al. 2016). It thus enables collaborative learning while koeping users' private data at the source (Guerra-Manzanaai sensitive data with other parties (El Zein et al. 2024) or centralized server (7hu et al. 2022). In horizontal
al.] (2023) and mitigates the privacy risk of multiple parties sharing their
23

---

Published in Transactions on Machine Learning Research (10/2025)
federated learning (HFL), local datasets have the same feature space but contain different samples while vertical federated learning (VFT.), involves datasets with different feature spaces but overlaps in samples [Fiosina 2022).
To address both privacy and explainability in Trustworthy AI, the combination of FL and XAI, ie.. Fed- XAT suggested (Bárcena et al., 2022 Corcuera Bárcena et al., 2023; López-Blanco et al. 2023) and refers to the federated learning of XAI models. Many approaches of Fed-XAI using HFL and VFL are proposed in literature. Fiosinaa (2022) used a HFL approach for forecasting taxi trip duration and applied feature-based explainability methods post-hoc. Chen et al. (2022b) used an explainable VFL framework to optimize counterfactual explanations using a representative query distributed on multiple parties. Both setups demonstrate the use of post-hoc explainability tools in a distributed environment, with FL serving as a privacy preserving setup for collaborative learning of sensitive data owned by multiple parties. FAI architectures have also leveraged interpretable models locally, such as fuzzy rule-basod classifiers (Doole (Coreucra Bárcena et al.) 2023) Juzzy rule- based models. In these setups, interpretability is achieved using underlying explainable-by-deste
ct al.) 2024), Takagi-Sugeno (Zhu et al., (022) and TakkagiSSgeen-Kaaa
(Coccuera Bárcena et al. 2023) models.
Though FL aids privacy by default, it is prone to reconstruction and inferencing attacks (Mothukuri et al. 2021 Zhang et al.] 2024). The sharing of gradients and model parameters, communication mechanism and aggregation process can lead to leakage of privacy of the participating clients (Zhang et al. 2024). Hence researchers have proposed integration of other privacy preserving techniques, such as cryptography, with FL methods. In one such work, Molhoek & Laanen (2024) generated synthetic data on vertically partitioned data in a FL two-party setup. Counterfactuals built from this synthetic data using secure multi-party computation, were ranked and shared with both parties and were found to be resilient to attribute inference. El Zein et al. (2024) proposed a HFL structure using decision tree models, wherein a global decision tree was collaboratively trained by participants and additive secret-sharing was used in aggregation of intermediate results. A VFL technique, Falcon (Wu et al.) 2023), utilized a hybrid approach consisting of partially homomorphic encryption (PHE) and additive secret sharing for exchange of intermediate computations. Another setup, Pivot (Wu et al. 2020), proposed as part of Falcon, used threshold partially homomorphic encryption (TPHE) and additive secret sharing to protect privacy of intermediate exchanges. Though these works successfully integrate cryptographic techniques with FL, research has also determined that the use of cryptographic methods in FT. reduces the centralized server's ability to different iate true model parameters leading to backdoor attacks (Guo et al., 2022). Hence appropriate defense frameworks, such as trust evaluation schemes Guuo et al. 2023). should be incorporated for protection of the FL system from malicions users.
FL enables the training of AT models from diverse, private, and high-quality data (Zhu et al. 2022 located at client systems. It reduces the footprint of user data in the network (Mothukuri et al. 2022) ) by keeping data at the source and avoids transmission and storage of sensitive information in centralized location when multiple parties are involved (Wang et al., 2019). Despite its benefits, in its current form FL faces challenges for its risk-frec adoption (Mothukuri et al. (021) including ensuring privacy constraints, merging of local XAI models and dealing with large data streaming that can lead to concept drifts (Bárcena et al., 2022). The introduction of XAI methods in the FL architecture, can also further increase the vulnerability of the system to privacy attacks through explanations. Thus Fed-XAI presently cannot guarantee privacy preservation through XAI components and further research to develop strategics to stem inadvertent privacy leakage through explanations is essential.
5.6 Other techniques
In addition to the main privacy preservation methods commonly employed in PPML, certain non-standard techniques have also been explored to miligate privacy leakage in certain lypes of XAI. These approaches aim to enhance privacy preservation by adopting alternative strategies including limiting access to training data, obscuring fcatures, or providing an abstraction of the target models. While not traditionally classified under formal privacy methods, these approaches contribute to reducing privacy leakage and complement other methods.
24

---

Published in Transactions on Machine Learning Research (10/2025)
A client-centric, data-driven approach of generating counterfactuals proposed by An & Cao (2024) by leveraging previous inferences retrieved by the model user. Due to the generation of counterfactuals locally at the client, the method was shown to be resilient to model extraction while achieving desirable properties such as diversity and succinctness. In another approach to create an interpretable model from a neural network, Marton al. (2024) described data-free stralegy of distilling the function represented by the model. The method used synthotic data train a set of neural networks and extracted the parameters train an Interpretation-Net with an output representation in the form of surrogate decision trees.
Using knowledge- based approach, Rožanec et al. (2022) applied semantic technologies in the form of domain specific ontology and knowledge graphs, to enhance explanations and describe features higher conceptual level. This enabled delinking explanations from features, thus preserving the confidentiality of the underlying model. Further, the integration of feature- based XAI such as LIME, enabled the system to determine features important for predictions. (Tezzyaan Vitko (2022) also applied semantic techniques build XAI consisting of decision trees and rules generated from targeted points around the decision boundary of black-box models, without accessing the original training data. Due to the interoperability of semantic rules, the method enabled usage in decentralized setup for collaborative decision making, without individual parties sharing private local data.
These works demonstrate the application of data-free and knowledge-driven techniques in XAI to build privacy-by-desie systems for protection of training data and the confidentiality of the model. By discon- necting features from the model and creating abstraction layers for generation explanations (Rožaned et al. 2022): these strategies are helpful protecting the underlying assets.
Table 3 Privacy preserving methods applicd to XAI systems.
Privacy Preserving A Algorihhm
Protected Asset
XAI Category (Method)
Study
Privacy Preservation
Category
Differential
Training data Various DP training
Training data
Interpretable (decision trees)
Fletcher & Islam
privacy
algorithms
2020
DP locally linear
Interpretable (locally linear maps)
Harder et al.
2020
maps
DPSaab
Training data Training data
Interpretable (FF-CNN)
Li et al.
2020aa
DP-EBM
Interpretable (EBM)
Back &
Chung
2024
Nori et al.
2021
DP explanation
Training and query data
Feature-based methods using local linear approxinations (LIME, etc.)
Patel al. (2022
generation
Local DP
Training data
basedd met that aggregate scores (SHAP, etc.)
Nguyen et al. (0023)
DP trained SVM
Training data
Example-based (counterfactuals)
Mochaourab et al.
20023
DP-SGD
Training data
Feature-based
Liu al. 2024
(Grad-CAM)
DP-RMSProp
Training data
Example-based (self-influence functions)
Cohen & Giryes 22044
Local DP
Training data
Feature- baaed
Bozorgpanah &
(TreeSHAP)
Torra 2024
25

---

Published in Transactions on Machine Learning Research (10/2025)
Privacy Preserving Algorithm
Protected Asset
XAI Category (Method)
Study
Privacy Preservation
Category
Local DP
Training data
Feature-based (SHAP)
Ezzeddine et al.
2024
DP-WGAN (Wasserstein GAN)
Training data
Various XAI methods
A Abbasi et al.
2024
from DALEX framework
Cryplography
Privacy preserving foil trees
Training data, model
Example-based (contrastive
Veugen el al. (022
explanations)
Additive
Query data, inference
Interpretable (tree-based models)
Zhao et al. 2023
homomorphic encryption
results, model
Anonymization
Microaggregation (MDAV)
Training data, model
Interpretable (decision
Blanco-Justicia
trees)
(020)
Privacy preserving
Training data
Example-based
Montenegro et al.
generative model
(case-based)
2021
HeartSpot
Training data
Feature-basee (saliency maps)
Johnson al. 2022
(lossy compression)
Discretization of
Training data
Example-based (counterfactuals)
Vo et al.
2023
features
(generalization)
CF-K
Training data
Example-based (native
Berning et al.
2024
(k-anonymity of counterfactuals)
coumterfactual)
Goethals al
20233
DeepFixCX
Training data
Feature-based (saliency maps)
Gaudio et al. 2023
(lossy compression)
Microaggregatton (MDAV)
Training data
Feature-basel (TreeSHAP)
Bozorgpanah &
Torra 2024
Disentangled
Training data
Example- based (case-based)
Montenegro
representation
Cardoso (2044
learning
Latent diffusion
Training data
Example-based
Campos et al.
(0024)
models
(case-based)
Perturbation
GNIME
Training and query data
Feature-based (saliency maps)
Jeong et al.
2022
Linear-Tine Optimal Privacy
Training and query data
Various XAI methods (interpretable surrogates, feature-based, etc.)
Chen et al.
2022al
Scheme
Federated learning
Pivot (VFL, additive secret. sharing, TPHE)
Training data
Treo-based models (Iransparent)
Wu et al.
2020
DALEX framework available on httppe///sittu..ccco/oeeeoeeeees
26

---

Published in Transactions on Machine Learning Research (10/2025)
Privacy Preserving Algorithm
Protected Asset
XAI Category (Method)
Study
Privacy
Preservation
Category
HFL
Training data
Feature-basod methods (DeepLIFT, integrated gradients, LIME, etc.)
Fiosina (0022)
HFL
Training data
Interpretable
Corcuera Bárcena
(lakagi-Sugenoo T Takagi-
et al. 2023
Daole
Sugeno Kang, fuzzy
ct al.
20024
Zhu
rule- classifier)
ct al.
(2022)
VFL
Training data
Counteraactuals
Chen et al.
(2022b)
Falcon (VFL,
Explanations
Feature- based (LIME)
Wu et al.
(023)
additive secret sharing, PHE)
and training data
PrivaTree
Training data
Decision trees
El Zein et al.
2024
(HFL, additive
(transparent)
secret sharing)
VFL, SMC, Synthetic data
Query data
Example-basse based (counterfactuals)
Molhoek & Laanen
(0024)
Other techniques
Semantic XAT
Training data
Interpretable (decision trees, semantic rules)
Terziyan & Vitko
2022
Semantic
Model
Feature-based (LIME, etc.)
Rožanec al, (0022
technologies
(knowledge graphs,
ontologies)
Guarded
Training data, model
Example-based (counterfactuals)
An & Cao (2024)
counterfactuals
Tnterpretation-Nets
Training data
Interpretable (decision trees)
Marton al. 2024
6 Privacy Preserving XAI Characteristics
In the preceding sections, have examined the privacy risks in XAI arising from both intentional and unintentional causes. We have also reviewed applicable privacy preserving methods to safeguard the addi- tional attack surface exposed by explanations. In this section, drawing on the insights from investigation into RQ1 and RQ2, we aim to address RQ3 by identifying key characteristics that XAI should possess to mitigate the identified risks. These characteristics provide framework for understanding the essential prop- ertics of privacy preserving XAI, taking into account the vulnerable assets that require protection and the various stakeholders involved during the AI lifecycle. The proposed characteristics offer guidelines to both researchers and practitioners to assess the effectiveness of existing privacy preserving XAI methods and guide the development of new approaches that prioritize privacy by design. By incorporating those qualities, XAI can strive to achieve the optimal balance between the triad of privacy, explainability and utility.
We present the characteristics (Figure IT] by considering three use cases outlined in Table 4 To facilitate understanding, simplified example of an online loan application system that leverages an AI model with XAI capabilities is considered. The system uses seven input features where salary, net worth, and age, are protected features that require privacy preservation. The cases describe the following scenarios:
27

---

Published in Transactions on Machine Learning Research (10/2025)
Use Case 1 considers intentional privacy leakage through adversary.
Use Case 2 involves interaction layman end-user, i.e, a bank's customer, with the XAI system. The end-user is provided an explanation of an automated decision directly through the system and indirectly through human. Let's assume that in this use case, the loan was denied because the applicant salary
40K and age was 50 years.
Use Case considers the interaction of technical support, iee, Al developer and quality engineer, with the XAI system.
Table 4 Use cases for privacy preserving XAI in online loan application system.
Details
Property
System
Online loan application system Bank
Model owner
Model input features
salary, net worth, age, length of credit history, occupation, working hours per week, education
Sensitive features
salary, net worth, age
Use Case
Adversary with black- box access to the system.
Actors
Adversary
Overview
An adversary secures black-box access to the bank's model through the online application system. The adversary attempts different queries and observes the outputs generated by the system.
Query data
(i) randomly generated queries.
(ii) targeted queries using prior information.
Use Case
Customer accessing explanation of the application outcome.
Actors
Customer, bank executive
Overview
A customer submits online application for loan and is given denied result. The customer is provided with:
(i) an automated explanation.
(ii) consultation with a bank executive to discuss the result.
Query data
salary $35K, net worth $75K, age 55 years, length of credit history 30 years, occupation office executive, working hours per week 25, education diploma.
Use Case
AI developer accessing explanation for troubleshooting reported error case and quality engineer subsequently validating the system updates.
Actors
AI developer, quality engineer
Overview
An error is reported during debugging. The developer accesses the explanation of the error case to verify the results. Finally, a quality engineer validates the system updates with another round of testing.
specific query and developer updates the model
Query data
Synthetic query similar to the error requiring troubleshooting.
We propose ten characteristics of privacy preserving XAI that aim to balance privacy, explainability and utility. The first six characteristics are derived from privacy attacks and unintentional leakage discussed Section 4. The remaining four characteristics are focussed on addressing performance issues and ensuring regulatory compliance. The proposed characteristies follows:
28

---

Published in Transactions on Machine Learning Research (10/2025)
6.1 Prevent training data identification
XAI tools should be designed such that the identification of individuals used in training the model is not facilitated through them. In Use Case 1, if the adversary has access to specific individual's imput details and retrieves the corresponding outputs including the outcome and explanations, no additional advantage should be provided through explanations in determining if the individual was used in training the bank's model. Thus, the explanations should be resilient to membership inference (Section 4.2.1
6.2 Prevent sensitive data inference
XAI tools should designed to prevent reconstruction or inference of sensitive attributes of individuals. Use Case 1, if the adversary has access to the non-sensitive features an individual and the outcome of the loan application but is unaware of any sensitive feature such salary or age, the explanations provided should not. aid in inferring these sensitive features of the individual. Thus, the explanations should be resilient to model inversion (Section 4.2.2
6.3 Prevent reverse engineering of model
XAI tools should be designed to prevent reverse engineering of the model functionalities. In Use Case 1, the adversary, by querying the bank's model and by inspecting the explanations, should be unable to build surrogate of the original model. Thus, the explanations should be resilient to model extraction (Section 4.2.3
6.4 Prevent property inference
XAI tools should be designed to prevent the inferencing of aggregate properties of the training data. In Use Case 1, by using targeted queries on the bank's model, the adversary should be unable to exploit explanations in determining group properties such as the ratio of old and young customers in the training data or the distribution of wealthy and average income training participants. Thus, the explanations should resilient to property inference (Section 4.2.4).
6.5 Prevent direct exposure
Explanations generated by XAI tools should not disclose personally identifiable and/or sensitive information unauthorized individuals (Chen et al., 2022a). Tn Use Case 2, when the customer seeks an explanation on his/her application outcome, the explanation might indicate the failure meet respective thresholds of $40K for salary and 50 years for age. Revealing actual values of protected features would breach the customer's 'ss privacy when accessed by other actors, such as the bank executive during the customer's 's consultation. The customer may, however, subsequently provide consent to the executive to retrieve their personal and financial details from the bank's records for consultation.
6.6 Prevent indirect exposure
The content of the provided explanations should not indirectly expose personally identifiable and/or /or sensitive information through correlated or proxy features to unauthoiized individuals. In Use Case 2, if the explana- tion discloses a non-sensitive attribute such as the length of credit history, to actors other than the customer, it could indirectly lead to exposure of a sensitive attribute, such as age, due to the strong correlation between the two attributes.
6.7 Access control of explanations
The content of explanations should be accessible only to authorized users Blanco-Justicia et al. 2020 Kuppa & Le-Khac 2021) with details provided on need-to-know basis. In Use Case 2, the customer is authorized access his/her own explanation it pertains their specific application outcome. The bank executive should be authorized to access the explanation only if human intermediary is required to enhance the
29

---

Published in Transactions on Machine Learning Research (10/2025)
process of explanation for the customer. In Use Case 3, the AI developer and quality engineer should be permitted to access explanations and outcomes only for synthetic queries generated to simulate specific error cases rather than for real production data.
6.8 Upholding of explanation quality
The quality of explanations should not be compromised by the introduction of privacy preservation measures. Explanations must remain useful and meaningful (Shokri et al. 2021) to target stakeholders. In Use Cases 2 and 3, the details contained in the explanations to respective users should assist them in completing their lasks effectively and/or help them interpret the outcome of the Al system.
6.9 Acceptable run time
The time of XAI methods, being important evaluation metric (Bodria et al. 2023 should not deteriorate by introduction of privacy preservation measures. In Use Cases and 3, the explanation recipients should see the outputs within an acceptable timeframe. A long turnaround time may lead to the explanations becoming ineffective for the task at hand.
6.10 Compliance with applicable Al/privacy regulations
XAI being AI system, should comply with applicable AI and privacy regulations specfic the jurisdiction in which it operates. For instance, if the XAT is deployed in Canada with Canadian residents the target
users, it must adhere to the provisions of the Artificial Intelligence and Data Act (AIDA 2022). Users should
clearly informed of the XAI capabilities of the system including the types and content of explanations and the third parties with whom the explanations may be shared. Furthermore, appropriate consent must be obtained from users, required by applicable laws and rogulations.
trainin ileniiruation
Complienae with cplicalle A/Privacy regulations
Prevent samstive data Inference
Prevent
Accestable
Privacy Preserving XAI
Upholding of
Prevent property
control esplanations
direct ecczure
Prevent indirct ecpossre
Figure 11: Proposed privacy preserving XAI characteristics.
30

---

Published in Transactions on Machine Learning Research (10/2025)
7
Discussion
In this section, we summarize the results of our work, open issues, and challenges in the field. Additionally, we offer recommendations for future research directions to advance the development and deployment of privacy preserving XAT systems.
7.1 Summary and implications
The comprehensive review of existing literature facilitated a synthesis of current knowledge on the conflict between privacy and explainability, both being important pillars of Trustworthy Al. The analyzed studies demonstrate that the additional information provided in the form of explanations can benefit. adversarics in launching privacy attacks in XAI. We identified and categorized certain lypes of privacy leakage due to ma- licious intent of adversaries as intentional causes. These include membership inference, model inversion and model extraction, all of which attacks pose threat to the privacy of individuals whose data is contained in the training set, thus increasing the risk of identification of individuals or exposure of their sensitive information. Moreover, reconstruction of data from inferrnncetimee queries renders active XAI users vulnerable to similar privacy breaches (Zhao et al. 2023 2021 The threat of model extraction through explanations, targets the confidentiality and intellectual property of model owners. While property inference can expose sensitive aggregales or group properties of the training data, our review found no evidence of such attacks targeting XAI systems specifically. Beyond privacy attacks, ML models exhibit inherent privacy vulnerabilities, such as memorization of training data overfitting, which can lead to various inferencing attacks. These privacy problems are inherited in XAI systems, and we have categorized them as unintentional causes. Additionally, the explanation content can be at direct threat of privacy breaches by unauthorized users due to lack of access control, or through prox- ies and correlated fields. Such vectors further compound the privacy risks associated with deploying XAI technologies in sensitive domains.
demonstrated explanations generated using different methods. These
Due to the growing concerns surrounding privacy risks of explainability, rescarchers have proposed defense mechanisms for privacy preservation with explanations. This review identifies that techniques, such as DP and anonymization, extensively explored in this context, evidenced by the number of studies that have employed these methods. However, there remains limited exploration of alternative approaches, including knowledge integration, cryptography, and perturbation, all of which present promising avenues for enhancing privacy preservation. Hence there is scope to utilize these underexplored techniques to achieve privacy in XAI systems. In distributed environments, Fed-XAI attempts to achieve explainability while preserving privacy of local data, yet its current implementations are insufficient guarantee privacy in the generated explanations.
The investigation of privacy risks and preservation methods in XAI has led to the identification of key characteristics that privacy preserving explanations must exhibit. In addition to being resilient to privacy attacks and preventing both direct and indirect exposure of sensitive information, explanations should satisfy performance and utility constraints. Given that explanations may contain potentially identifiable data and may be subject to legal and regulatory frameworks, they are required to comply with the applicable Al and privacy laws within the jurisdiction. This article identifies and highlights gap in the research of methods within the field of XAI, i.e., explainability methods should be designed considering privacy requirement. The findings of this paper be utilized by researchers to understand statc-of-the-art privacy allacks and corresponding preservation methods. Practitioners can leverage these insights to enhance their understanding of the privacy risks associated with XAI and identify potential solutions to mitigate those risks across various XAI mothods.
system
7.2 Design considerations for privacy preserving XAI
Many unintentional leaks identified in this review can be avoided through responsible design practices. Safeguards in data handling such as data minimisation, deidentification and anonymisation of training data, or the use of synthetic data for training models when sensitive or personally identifiable information is involved, can help minimize the risks. During training, regularisation techniques can prevent overfitting and
31

---

Published in Transactions on Machine Learning Research (10/2025)
memorisation. The use of private training algorithms, such differentially private training, can provide privacy guarantee against leakages. At the output interface, the explanation APT can include role-based access of explanation content to restrict the availability of sensitive information to end-users on a need-to- know basis. The use of logging at output for monitoring, tracing and privacy audits can further aid the accountability of the system.
Steps can also be taken to prevent intentional leaks by restricting explanation APIs to authorised users. Restraining unlimited query access and setting the number of queries depending users' roles can prevent misuse of explanation APIs by adversaries. Query monitoring can further help detection of anomalies. In addition to securing the interfaces, model owners should give due consideration to the type of access provided to users. When the model is available through an API, black-box privacy attacks are possible. However, when the model as a whole is released to users, model owners have no control on its usage and white-bos box privacy attacks become possible, thus giving additional avenues to adversaries to penetrate the system. Developers can use documented XAI privacy attacks for testing of systems during development for evaluation of the risk of privacy breaches. These evaluations can assist in making decisions about integration of appropriate privacy preservation methods needed.
7.3 Open issues and challenges
Based on the privacy risks and mitigation methods surveyed, key open issues and challenges have been identified that require further attention. These challenges underscore the complexity of balancing privacy with the need for explainability in Al systems. In particular, the following issues remain critical:
Lack of user-centricity in development of privacy preserving XAI: End-users are an integral and inseparable component of XAI as they directly engage and draw insights from the content generated by these systems. While current XAI methods are predominantly model-centric, focussing on model development, evaluation and audit processes (Kaplan et al. 2024), there is an increasing need for a shift towards a user-centric approach. When considering privacy as a system requirement or using existing privacy preserving solutions with explainability methods, human users are absent from the design and development of these approaches.
Lack of standardised approach for privacy evaluation of XAI: Existing XAI literature pro- vides evaluation metrics to assess aspects such as faithfulness, complexity, localisation, randomisation and robustness (Hedström AI, currently there is a lack of standardised approach to evaluate the privacy of explanations. The lack of suitable quantitative metrics in this area prevents evaluaton of safety with respect to privacy or comparison between methods for selection of those that satisfy the safety requirements of an application domain.
al.] (003).. However, though privacy fundamental in Trustworthy
Trade-off's in privacy, explainability and utility: The introduction of privacy enhancing tech- nologies often result in adverse effects on model utility (Ezzeddine et al. 2024 Harder et al., 2020) and the quality of explanations. For instance, the perturbation of classifier weights of support vector machines for privacy preservation observed to doteriorate the classification accuracy and credibil- ity of counterfactuals (Mochaourab al. 2023). Similarly, the use of differential privacy in neural network models is found to lower its accuracy (Blanco-Justicaa et al. 2023) and explanation quality (Liu et al. 2024). Thus when targeting these 3 properties simultancously in an XAI system, there are often tradc-offs involved.
Lack of XAI methods that are privacy preserving by design: As emphasized by Hoepman (2014), privacy is core property of computer systems that requires addressing from system design phase, rather than treated as an add-on. However, current explainability approaches do not consider privacy as a system requirement. Due the overlook of this safety aspect, design flaws may be introduced which can lead to unintentional privacy leakage. Adversaries may exploit these flaws cause intentional leakage.
32

---

Published in Transactions on Machine Learning Research (10/2025)
XAI research has mainly focused discriminative models that produce decision boundaries, and there has been limited work on devel- oping explainability methods for Gen-Al and LLMs (Schneider 2024b Sun et al., 2022 Weisz et al. 2023). Due to the complex structure and vast number of parameters in these models, traditional explainability methods become impractical to them (Zhao et al.) 2024p. These models have privacy issues, such as memorization of training data that escalates as the models become larger (Carlini et al. 2021). ) In addition, downstream private datasets used for in-context learning in LLMs, are found to be susceptible to membership inference (Dann et al., 2023 When creating explainability approaches for these systems, privacy should be considered as an integral requirement.
Lack of privacy preserving XAI for Gen-AI and LLMs:
7.4 Recommendations for future work
Based on the open issues and challenges outlined in the previous subsection, we have the following recom- mendations for future rescarch in this area:
Improving usability of privacy preserving XAI: Explanations should be designed to meet the diverse information needs of users and integrate user-centric design principles (Ali et al. 2023 Kaplan el al. 2024p. The delivery of explanations is required to be format that is accessible and meaningful, taking into consideration the varying levels of expertise and requirements of different user groups. This transition would prioritize providing need-to-know information to end-users based on their specific roles within the system. Furthermore, to enhance the effectiveness of explanations, appropriate tools such as interactivity and visualization should be used to enhance the process of explanation and deepen users' understanding (Bo et al. 2024 In addition, application of the 3C- principle of context, content, and consent (Brunolle el al. 2023 can improve the usability of XAI tools by satisfying their requirements and expectations.
Development of a standardised approach of privacy evaluation of XAI methods: The development of a standardised approach to measure the leakage of privacy through explanations, will benefit developers in gauging the privacy of specific explanations so that appropriate preserva- tion techniques can be integrated as needed. The development of quantitative privacy metrics can facilitate comparison between methods for adoption of those that are privacy safe and suitable for use in specific domains depending on the regulation requirement the risk involved.
Balancing trade-off in privacy, explainability and utility: Determining the appropriate trade- off between the triad of privacy, explainability and utility, can help to achieve the right mcasure of balance between these properties. This could be achieved with the help of tools or tuning mech- anisms. For instance, the use of compatibility matrix (Abbasi et al. 2024) or hyperparameters, such as the privacy budget 6 in differential privacy or the parameter in k-anonymity, is useful in tuning the desired level of these required propertics. Similar tuning mechanisms can be integrated in other privacy preserving approaches to achieve the required trade-off. Metrics, such as trade-off score dAbbasi et al., 2024), could be useful to quantify and monitor the balance of these properties enabling rescarchers and practitioners to adjust the parameters based on the tradc-offs involved.
Examining and improving trade-off in different privacy preserving methods for XAI: Different privacy preservation methods applicable to XAI are discussed in Section 5 Analysing the privacy-expllainaalllt---tt
trade-off of these methods will identify effective solutions and their limitations. While techniques, such differential privacy and anonymization, have been mainly explored in XAI systems, other underutilized techniques such as use of knowledge integration and cryplographic protocols, could provide alternative approaches. Distributed privacy enhancing solu- tions, such as Fed-XAI, warrant further investigations to determine strategies to mitigate possible privacy Ieakages from XAI components. By systematically examining and comparing these various privacy preserving techniques, researchers can identify best practices and design hybrid approaches to effectively balance different properties.
Development of XAI methods that are privacy preserving by design: The characteristics of privacy preserving XAI outlined in this review, can aid researchers and developers in building
33

---

Published in Transactions on Machine Learning Research (10/2025)
explainability methods that are privacy-enhaneed by design [Bozorgpanah & Torra 2024). Further-
more, there is growing interest in neuro-symbolic approaches (Hitzler et al.) 2022 and semantic tech-
nologies (Seeliger et al. 2019) as potential solutions as explainable-by-desiee strategies. Researchers can investigate the privacy safety of these techniques and integrate approaches to prioritize privacy.
Privacy preserving XAI for Gen-AI and LLMs: XAI plays a vital role in fostering trust- worthiness (Wang & Ding 2024 and ensuring ethical applications of Gen-AI and LLMs (Luo & Specia, 2024). However, as explainability is introduced in these models, it is important to ensure that it does not exacerbate the inherent privacy issues of these models or create new vulnerabili- ties. A privacy analysis of explainability methods in the early stages of development and the use of privacy attacks for auditing (Carlini et al. (021), can boost the development of privacy-enhaneed systems. Recently Chain-of-Thought (CoT) Wei el. al. 2022) prompting has gained traction in eliciting the step-by-step reasoning of models and providing sell-explanations in the process. How- ever, the interaction with untrusted LLMs can be threat to users' privacy, hence future work can be directed towards privacy preserved mechanisms (Bae et al., 2025) in these models. Methods such as retrieval-angmented generation (RAG) for fine tuning of outputs by augmenting external data sources (Zeng et al. 2024) and mechanistic interpretability (Section 2.3.8) can also be investigated as possible solutions lowards achieving privacy preservation XAL Thus, with the growing accessibility and widespread use of Gen-Al and LLMs, developing appropriate user-centric privacy preserving explainability techniques is an important avenue for further rescarch.
Evaluation of privacy preserving XAI characteristics: The characteristics of privacy preserv- ing XAT that we propose, aims to highlight the desirable qualities that XAT should exhibit to protect privacy while producing useful explanations current XAI methods in light of these proposed characteristics to determine gaps in the met and inform strategies for improvement. We will also enhance current methods so that the generated explanations better align with the proposed characteristics. We aim to improve the applicability of the characteristies through the evaluation of XAI methods.
the target users. In further work, we will evaluate
8 Conclusion
XAI is an active field of research and a crucial pillar of Trustworthy AI. It aims to bring logical explanations, a fundamental property of all computer systemss, to black-box AI models. Explainability of models is essential to secure user trust in automated outcomes, especially in critical domains where such outcomes have high impact on the lives of individuals. Though explainability has emerged as a gold standard for Trustworthy A1, previous works have highlighted potential privacy risks of introducing transparency to black boxes. To the best of our knowledge, there is lack of detailed review on the tension between privacy and explainability. In this article, we have focused on this gap and conducted a scoping review to elicit details on the privacy risks posed by XAI and the corresponding solutions for privacy preservation in XAI. Our review draws attention to the intentional and unintentional misuse of explanation interfaces and the pressing need for developing XAI that is privacy preserving. In addition to reviewing the privacy risks and the progress achieved by researchers in achieving privacy improvement in XAI systems, we propose the characteristics of privacy preserving XAI, to assist AI engineers and researchers in understanding the requirements of XAI that achieves privacy with utility. We base these characteristics expected regulatory compliance. The characteristics can be utilized for designing new explainability methods and for evaluation of existing methods. Finally, we conclude the article by identifying the open issues and challenges in the field and provide recommendations for future work. Among the directions identified, developing privacy metrics, creating privacy preserving explanations for generative models and balancing the trade-off of privacy, utility and explainability in existing and new XAI methods, will determine its success as foundation pillar of Trustworthy AI.
the identified risks, the encountered performance issues, and the
34

---

Published in Transactions on Machine Learning Research (10/2025)
Broader Impact Statement
This research was conducted to determine two pillars of Trustwothhy AI, namely, privacy and explainability, can co-exist. The privacy risks highlighted here have been consolidated from current literature to create awareness when using explainable methods in bringing transparency black-boxes.
References
Wisam Abbasi, Paolo Mori, and Andrea Saracino. Further Insights: Balancing Privacy, Explainability, and Utility in Machine Learning- baanin Tabular Data Analysis. In Proceedings of the 19th International Conference on Availability, Reliability and Security, pp. 1-10, Vienna Austria, July 2024. ACM. ISBN 979-8-4007-1718-.. doi: 10.1145/3660 /6614466666679900111 URL https://dil acm. org/doi/10 1145/3664476. 3670901
AIDA. An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Pro- tection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and re- lated amendments to other Acts, November 2022. URL charter- charter-charte/ charte/
gc. ca/ wal.ca//egg.. wwwo///s//ss//////
c27 html
Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes. Toulon, France, 2017. Black boxes;Hidden units/Intermediate Layers:Lincar classifiors layer;Neural network Potenttll problems; Training phasis:.
Sajid Ali, Tamer Abuhmed, Shaker El-Sappagh, Khan Muhammad, Jose M. Alonso-Moral, Roberto Con- falonieri, Riccardo Guidotti, Javier Del Ser, Natalia Díaz-Rodríguez, and Francisco Herrera. Explainable Artificial Intelligence (XAI): What we know and what is left to attain Trustworthy Artificial Intelligence. Information Fusion, 99:101805, November 2023. ISSN 15662535. doi: 1..166/j..nffuu... https://linkingin elsevier... http://eeeeeeee//11/111655522000
URL
Laith Alzubaidi, Aiman Al-Sabaawi, Jinshuai Bai, Ammar Dukhan, Ahmed H. Alkenani, Ahmed Al-Asadi, Haider A. Alwzwazy, Mohamed Manoufali, Mohammed A. Fadhel, A. S. Albahri, Catarina Moreira, Chun Ouyang, Jinglan Zhang, Jose Santamaría, Asma Salhi, Freek Hollman, Ashish Gupta, Ye Duan, Timon Rabczuk, Amin Abbosh, and Yuantong Gu. Towards Risk-Free Trustworthy Artificial Intelligence: Significance and Requirements. International Journal of Intelligent Systems, 2023:1-41, October 2023. ISSN 1098-111X, 0884-8173. doi: 001155/0023/4550000 1jis/2023/44591988/
URL. https://ww.. http///www..naai..ooo///ra/aaaaa com/joornal//////////ooo
Shuai An and Yang Cao. Counterfactual Explanation at Will, with Zero Privacy Leakage. Proceedings of the ACM on Management of Data, 2(3):1 29, May 2024. ISSN 2836-6573. doi: 10.1145/3654933. URL
https://dl.
http://l.aacc.or///oo/////////// wttp/o//////oo//////// /tt////////1.111/55555/5530 1145//654333
Marco Ancona, Enea Ceolini, Cengiz Öztireli, and Markus Gross. Towards better understanding of gradient-based attribution methods for Deep Neural Networks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 2018. OpenReview.net. doi:
10.3929//cth2-b-00004499 URL http::::/ggaaaaooes.sserrrrrrrrs stal].
arXiv:1711.06104 [cs,
Omer Antverg and Yonatan Belinkov. On the pitfalls of analyzing individual neurons in language models. In International Conference on Learning Represenlations, 2022.
Alejandro Barredo Arrieta, Natalia Diaz-Rodr,,uez Javier Del Ser, Adrien Bennetot, Siham Tabik, Al- berto Barbado, Salvador García, Sergio Gil-López, Daniel Molina, Richard Benjamins, Raja Chatila, and Francisco Herrera. Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI. Information Fusion, 58:82-115, 2020. ISSN 1566-2535. doi:
UIrich Aivodji, Alexandre Bolot, and Sébastien Gambs. Model extraction from counterfactual explanations, September 2020. URL h.l.:ttt::1. httt::/ttaaae /tarxivv//xi....///// http:://aa.....oo/////////0000.0
0188944//0099 arXivv2009.01884 [cs, stat).
35

---

Published in Transactions on Machine Learning Research (10/2025)
Yubeen Bac, Minchan Kim, Jaejin Lee, Sangbum Kim, Jachyung Kim, Yejin Choi, and Niloofar Mireshghal- lah. Privacy-presernee preservin I1m interaction with socratic chain-ol-thought reasoning and homomorphically encrypted vector databases. arXiv preprint arXio:2506.1133 2025.
Incheol Baek and Yon Dohn Chung. Differentially private and explainable boosting machine with enhanced utility. Neurocompplingg 607:12842,, November 2024. ISSN 09252312. doi:
128444..
URL https:://iinkinghuub. elsevier htt.a///aaaaaaoorrrreeo//////020
Hubert Baniecki and Przemyslaw Biecek. Adversarial attacks and defenses in explainable artificial
intelligence: A survey, Information Pusion, 107:102303, 2024. ISSN 1566-2535 doi: https://
doi.org/ 1016/ infiiiiiff2222222.2 2024.102303.
URL http://www.ccieoododrrtc.cco.o//
$1566253524000812
Yonatan Belinkov. Probing classifiers: Promises, shortcomings, and advances. Computational Länguisties, 48(1)200-2199 04 2022. ISSN 0891-2017. doi: 10.1162/coli a 00422. URL luttps://ao..rr/// 1162/
coli 00422
J.M. Benitez, J.L. Castro, and I. Requena. Are artificial neural networks black boxes? IEEE Transactions Newral Networks, 8(5):1156-1166 September 1997. ISSN 1045-9227, 1941-0093. doi: (0.1109/72.6232))
URL https::/ieeexplore.. ieee. org./bccmeett/222216
Leonard Bereska and Stratis Gavves. Mechanistic interpretability for Al safety - a review. Transac- tions on Machine Learning Research, 2024. ISSN 2835-8856. URL https://openrevieet net/forumm
id=ePUVetPKu6 Survey Certification, Expert Certification.
Sjoerd Berning, Vincent Dunning, Dayana Spagmuelo, Thijs Veugen, and Jasper Van Der Waa. The Trade- off Between Privacy & Quality for Counterfactual Explanations. In Proceedings of the 19th International Conference on Availability, Reliability and Security, pp. 1-9, Vienna Austria, July 2024. ACM. ISBN acm. wwwp:/ooogo...o..///oe 1145/366647777 979-8-4007-1718-5. doi: 10.1145 10.1145/3664476.. /66444666766777777 URL atttps:/dds acm.
3670897
Umang Bhatt, Adrian Weller, and José M. F. Moura. Evaluating and Aggregating Feature-based Model Explanations. In Proceedings of the Twenly-Ninde International Joinl Conference on Artificial Intelligence, pp. 3016-3022, Yokohama, Japan, July 2020. International Joint Conferences on Artificial Intelligence Organization. ISBN 978-0-9992411-6-5. doi: 10.24963 10.24963/ijcai.200 /0/c/a.....0//17. proceedingss/20224177
URI.
org/
Or Biran and Kathleen McKeown. Human-Centric Justification of Machine Learning Predictions. In Pro- ceedings of the Twenty-Sirth International Joint Conference on Artificial Intelligence, pp. 1461-1467, Mel- bourne, Australia, August 2017. International Joint Conferences on Artificial Intelligence Organization. ISBN 978-0-9999411---- doi: 10.24963/ijcai..22 2017/222 2017/202
URL https://www http//www.jja.i. org/proceedings/
Alberto Blanco-Justicia, Josep Comingo-Ferree Sergio Martínez, and David Sánchez. Machine learning explainability via microaggrogation and shallow decision trees. Knowledge-Based Systems, 194:105532, April 2020. ISSN 09507051. doi: http://koosss2220...1.. cmm//reetteeeee/11//999006600000
URL
Alberto Blanco-Justicia, David Sánchez, Josep Domingo-Ferrer, and Krishnamurty Muralidhar. A Critical Review on the Use (and Misuse) of Differential Privacy in Machine Learning. ACM Computing Surveys, 55(8):1 16, August 2023. ISSN 0360-0300, 1557-7341. doi/10.
doi: 10.1145/3544713. URL /tttp::/dd.aac acm. org/
10. 1145/354713
Jessica Y Bo, Pan Hao, and Brian Y Lim. Incremental XAI: Memorable Understanding of AI with Incre- mental Explanations. In Proceedings of the CHT Conference on Human Factors in Computing Systems, pp. 1-17, Honolulu HI USA, May 2024. ACM. ISBN 4007--00000 doi: 10.1145/3613304.366222 URL h/ttps://dl....... acm. http////./.0.1115//2220....00.
36

---

Published in Transactions on Machine Learning Research (10/2025)
Francesco Bodria, Fosca. Giannotti, Riccardo Guidotti, Francesca Naretto, Dino Pedreschi, and Salvatore Rinzivillo. Benchmarking and survey of explanation methods for black box models. Data Mining and Knowledge Discovery, 37(5):1719 1778, September 2023. ISSN 1384-5810, 1573-756X. doi: 10.1007/
$10618-023-00993-9 URL https://link.. https::/1iax.ppiingrr.ooo wwp.inner.com/11//. com 10. 10tmm/10....00/111111-0000000000
March Boedihardjo, Thomas Strohmer, and Roman Vershynin. Privacy of Synthetic Data: A Statistical Framework. IEEE Transactions on Information Theory, 69(1):520055)) 527, January 2023. ISSN 0018-9448, 1557-9654.
doi: 10.1109/TII 20T..322.3216799. URL
Aso Bozorgpanah and Vicenç Torra Explainable machine learning models with privacy. Progress in Arlificial Intelligence, 13(1):31550 March 2024. ISSN 2192-6352, 2192-6360 doi: 10.1007/1137448824440033133 URL
https://innk.springer...
springer. c0m/10.../0 1007 00000000//3388-00--00001----
Leo Breiman. Random forests. Machine learning, 45:5 32, 2001.
Wasja Brunotte, Larissa Chazette, and Kai Korte. Can Explanations Support Privacy Awareness? A
Research Roadmap. In 2021 IEEE 29th International Requirements Engineering Conference Workshops
(REW), pp. 176-180, Notre Dame, IN, USA, September 2021. IEEE. ISBN 978-1-6654-1898-1 doi:
10.1109/RF (0000//RR6665552022222 00032. URL httts:://eeexpllort ieee. org /tg//dbcumentt/582e3))
Wasja Brunotte, Jakob Droste, and Kurt Schneider. Context, Content, Consent How to Design User- Centered Privacy Explanations (S). pp. 86 89, July 2023. doi: 10.18288/SEKKE:223--003 URL http:
//ksiresearccorgg ipage. com http://eeeeeeesspppppppaapp222/
José Luis Corcuera Bárcena, Mattia Daole, Pictro Ducange, Francesco Marcelloni, Alessandro Renda, Fab- rizio Ruffini, and Alessio Schiavo. Fed-XAI: Federated Learning of Explainable Artificial Intelligence Models. In CEUR Workshop Proceedings (CEUR- WS. WS.org), pp. 104-117, Italy, November 2022.
Erik Cambria, Lorenzo Malandri, Fabio Mercorio, Mario Mezzanzanica, and Navid Nobani. A survey on XAI and natural language explanations. Information Processing & Management, 60(1):10311, Jamuary 2023. ISSN 03064573. doi: 10. (0.1016/j.ipm.2000 2tt...20222210.3. URL http:://iaaiiighb...lleeerrrrr.o cwtp://reeeeemoeeeeeeeee///eee// pi1/80306457322222126
Filipe Campos, Liliana Petrychenko, Luis Teixeira, and Wilson Silva. Latent Diffusion Models for Privacy- preserving Medical Case-based Explanations. In 1st Workshop on Explainable Artificial Intelligence for the Medical Domain, EXPLIMED 2024, volume 3831, Santiago de Compostela; Spain, 2024. CEUR-WS.
Nicola Capuano, Giuseppe Fenza, Vincenzo Loia, and Claudio Stanzione. Explainable Artificial Intelligence in CyberSecurity: A Survey. JEEE Access, 10:93575 04935755-33600, 2022. ISSN 2169-3536. doi: 10.1109/ACCESS. 2022.3204171. URL htttp:://ieeeppllelee
ieee. www...e.eeeee.....e. arg//bccument/98779999))
Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting Training Data from Large Language Models. In 30th USENIX Security Symposium (USENIX Security 21), pp. 2633 2650. USENIX Association, August 2021. ISBN 793-1-993333-24-33 URL https: htopp::/wwww..o www.coooenceeuseeeeeeee oow.e//wwweeeaaaaaaaaaaettttepee www.aeeectaa...i.ieeeertttinnnnn
http://wwww...xx..///// usenix.
Nicholas Carlini, Steve Chien, Milad NasI, Shuang Song, Andreas Terzis, and Florian Tramèr. Membership Inference Attacks From First Principles. In 2022 TEFE Symposium on Security and Privacy (SP), pp. 1897 1914, San Francisco, CA, USA, May 2022. IEEE. ISBN 978-1-6654-1316-9, doi: 10.1109/SP46114. URL https://ieeexplore.rrr ieee. wtg/document/8836440
Larissa Chazette, Wasja Brunotte, and Timo Speith. Exploring Explainability: Definition, a Model, and a Knowlodge Catalogue. In 2021 JEEE 29th International Requirements Engineering Conference (RE), pp. 107-208, Notre Dame, IN, USA, September 2021. IEEE. ISBN 978 178-1-6654-2856-9 doi: 2021. 00005. URL httpp:://eeeeeplorreee leee. httpae/e.....ee/bccoe//////////
37

---

Published in Transactions on Machine Learning Research (10/2025)
Chien-Lun Chen, Leana Golubchik, and Ranjan Pal. Achieving Transparency Report Privacy in Linear Time. Journal of Dala and Information Quality, 14(2):1-56, June 2022a. ISSN 1936-1955, 1936-1963. doi: 10.1145/3460001. URL https:/ //dps://dl... acm. /tt.:////.//...11///66000000 11145/44600001
Peng Chen, Xin Du, Zhihui Lu, Jie Wu, and Patrick C.K. Hung. EVFL: An explainable vertical federated learning for dala-oriented Artificial Intelligence systems. Journal of Systems Architecture, 126: 122:14,,74, May 2022b. ISSN 13837621 doi:
102474 URI. https:://hnkktgghub.eeee elsevier.
Christopher A Choquctte-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-Only Mem- bership Inference Atlacks. In Proceedings of the 38th International Conference Machine Leurning, volume 139 of Proceedings of Machine Learning Research, pp.
PMLR, July 2021. URL
https://proceeddigg" mlr http:p/eeee/////chhouuueerrooooo html
Roger Clarke. Internet privacy concerns confirm the case for intervention. Communications of the ACM, 42(2))60 67, February 1999. ISSN 0001-0782, 1557-7317. doi: 10.1145/293411.293777 URL https:
//dl //dl.acm.. acm.
www. org/ htg/doi/110/ 11w....111////1111112 293447
Gilad Cohen and Raja Giryes. Membership Inference Attack Using Self Influence Functions. In 2024 IEEE/CVF Winter Conference Applications of Computer Vision (WACV), pp. 4880 4889, Waikoloa, HI, USA, January 2024. IEEE. ISBN 109------0----.--0 doi: 10. B0000//AACV7771.2222000000
URL
https://ieeexplorre. ieee. org/ htt////cummen//4443366666
José Luis Corcuera Bárcena, Pietro Ducange, Francesco Marcelloni, Giovanni Nardini, Alessandro Noferi, Alessandro Renda, Fabrizio Ruffini, Alessio Schiavo, Giovanni Stea, and Antonio Virdis. Enabling federated learning of explainable AI models within beyond-5G/oe networks. Computer Communica- tions, 210:356 375, October 2023. ISSN 01403664. doi: wtw.://..oomoo.20000000
URL https:
//linkinghub. h www.eeer.....eeee.e..e..ee.ww..w htt.a//www.....eoc..e//////////a
Covidence. Covidence systematic review software. URL https://www.coviiii .org
Jonathan Crabbé and Mihaela van der Schaar. Concept activation regions: A generalized framework for concept-based explanations. Advances in Newral Information Processing Systems, 35:2590 22000 2022.
Mark Craven and Jude W Shavlik. Extracting Tree-Structured Representations of Trained Networks. In In Proceedings of the 8th International Conference on Neural Information Processing Systems (NIPS195), pp. 24 30, Cambridge, MA, USA, November 1995. MIT Press.
Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert. Huben, and Lee Sharkey. Sparse autoen- coders find highly interpretable features in language models. pp. et al; Google Deepmind; Google Rescarch; Meta; Microsoft Hybrid, Viemna, Austria, 2024. Auto encoders,Autonateed meth- bobuuuerraccuasssttperrrllllllie complete;Sets of features:
identificationnOverr
James Curzon, Tracy Ann Kosa, Rajen Akalu, and Khalil El-Khatib. Privacy and Artificial Intelligence. IEEE Transactions on Artificial Intelligence, 2(2):96- 108, April 2021. ISSN 2691-4581, doi: 10.1109 /TII 2021.3088084 URL htttps://ieeexploree ieee. wtt.e./r//occuee//5500....
Fahim Dalvi, Nadir Durrani, Hassan Sajjad, Yonatan Belinkov, Anthony Bau, and James Glass. What is grain of sand in the desert? analyzing individual neurons in deep nlp models. Proceedings of the AAAI Conference on Artificial Intelligence, 33(00))6309 07 2019. doi: 10. /a.09/aaai... http///3aaa.3..01....
URL
https://ojs. aaai. www.aaii...aaaaaaaaaaaaaaaa wwwp/oneg....oooooooooooooo.ee.e http://pp//.t/aatttte/e/////////
Mattia Daole, Pietro Ducange, Francesco Marcelloni, and Alessandro Renda. Trustworthy Al in Heteroge- neous Settings: Federated Learning of Explainable Classificrs. 2024 IEEF International Conference on
Fuzzy Systems (FUZZ-IEEE), pp. 1-9, Yokohama, Japan, June 2024. IEEE. ISBN 979-8-3503- 1954-5. doi: N0.100//7777-17777000000000 www.://22111111100000 URL htttps:/ieeexxplrres ieee. http://eeee..eeeaaooeoo///////0.
38

---

Published in Transactions on Machine Learning Research (10/2025)
Amupam Datta, Shayak Sen, and Yair Zick. Algorithmic Transparency via Quantitative Imput Influence: Theory and Experiments with Learning Systems. In 2016 TEFE Symposium on Security and Prinacy (SP), pp. 598 617, San Jose, CA, May 2016. LEEE. ISBN 978-1-5090-0824-7. URL httt::/
doi: 10.1109/SP.2016.42
ieee. www.eeeeeeeeeeeeeeeeeeeeeeeeeeee otg//occummt//7566222..
Ashley Deeks. The Judicial Demand For Explainable Artificial Intelligence. Columbia Law Review, 119(7):
1829-1850, 2019. URL htttps://wwtt http://ww.ssoorrrrrrssaaaaaa//// |
Tribikram Dhar, Nilanjan Dey, Surekha Borra, and R. Simon Sherratt. Challenges of Deep Learning in Medical Image Analysis Imppovvig Explainability and Trust. IEEE Transactions on Technology and Sociely, 4(1):68 75, March 2023. ISSN 2637-6415.
doi: 10.1109/TTS.200 200.0TTTSSS222333220000 URL https://
ieeexplore. ieee..rreeeee...............e... org/ document//000556000
Amit Dhurandhar, Pin-Yu Chen, Ronny Luss, Chun-Chen Tu, Paishun Ting, Karthikeyan Shanmugam, and Payel Das. Explanations based on the Missing: Towards Contrastive Explanations with Pertinent Negatives. NIPS'18, pp. 590 590-601, Montreal, QC, Canada, 2018. Curran Associates Inc. doi: 10.5555/ 3326943.3326998.
Ann-Kathrin Dombrowski, Maximillian Alber, Christopher Anders, Marcel Ackermann, Klaus- Robert Müller, and Pan Kessel. Explanations can be manipulated and geometry is to blame. Advances in neural information processing systems, 32, 2019.
Finale Doshi Velez and Been Kim. Towards A Rigorous Science of Interpretable Machine Learning, March 2017. URL httt:://axxxi http://axxvvv..r/bbbba///
arXiv:1702.08600 [os, stat].
Nathan Dowlin, Ran BachraBachrach, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing, CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy. pp. 201 201-210, New York City, NY, USA, 2016. PMLR.
Haonan Duan, Adam Dziedzic, Mohammad Yaghini, Nicolas Papernot, and Franziska Boenisch. On the Privacy Risk of In-context Learning. In 61st Annual Meeting Of The Association For Computational Linguistics, July 2023.
Vasisht Duddu and Antoine Boutet. Inferring Sensitive Altributes from Model Explanations. In Proceedings of the 31st ACM International Conference on Information & Knowledge Management (CIKM '22), pp. 416 425, New York, NY, USA, October 2022, Association for Computing Machinery. doi: 10.1145/3511900 3557362. URL sttps://al acm. org/ doi /atoo//aa///00 /1tp:///..111//111888338777
Rudresh Dwivedi, Devam Dave, Het Naik, Smiti Singhal, Rana Omer, Pankesh Patel, Bin Qian, Zhenyu Wen, Tejal Shah, Graham Morgan, and Rajiv Ranjan. Explainable Al (XAI): Core Ideas, Techniques, and Solutions. ACM Computing Surveys, 55(9):1-33, September 2023. ISSN 0360-0300, 1557-7341. doi: 10.1145/3561048. URL h/ttps://dl. acm. owto/oo//////oooooooo dt1/10.0111011////
1145/3561048 0t/g/////10.14/361004
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Tlya Mironov, and Moni Naor. Our Data, Ourselves: Privacy Via Distributed Noise Generation. In Serge Vaudenay (ed.), Advances in Cryp- tology EUROCRYPT 2006, volume 4004, pp. 486-503. Springer Berlin Heidelberg, Berlin, Heidel- doi: 10.1007/1176111
berg, 2006. ISBN 978-3-540-34546-6 978-3-540-34547--.
29. URL. http: Series Title: Lecture Notes in Computer Science.
htt.a//rr...e...1100011111111110 29
Soumia. Zohra El Mestari, Gabriele Lenzini, and Huseyin Demirci. Preserving data privacy in machine learning systems. Computers & Security, 137:103605, February 2024. ISSN 01674048. doi: 10.1016/j.cose. 2023.103605. URL
elsevier http:///ww...eeeee/////////////a
Yamane El Zein, Mathieu Lemay, and Kévin Huguenin. PrivaTree: Collaborative Privacy-Preserving Training of Decision Trees on Biomedical Data. IEEE/ACE Transactions on Computational Bi-
ology and Bioinformaties, 21(1):1-13, January 2024. ISSN 1545-5963, 1557-9964, 2374-0043. doi:
10. 10.1109/TCBB..20 2023...022.32822777 URL htt.ttts::/
ieee.
39

---

Published in Transactions on Machine Learning Research (10/2025)
Engincering Village. Engineering village:
Search & discovery platform.
URL https://wwit
engineeringvi wwwerinniiillggg..omm com/
Fatima Ezzeddine, Mirna Saad, Omran Ayoub, Davide Andreoletti, Martin Gjoreski, Ihab Sbeity, Marc Langheinrich, and Silvia Giordano. Differential Privacy for Anomaly Detection: Analyzing the Trade- Off Between Privacy and Explainability. In Luca Longo, Scbastian Lapuschkin, and Christin Seifert (eds.), Erplainable Arlificial Inlellgence, volume 2155, pp. 294-318 Springer Nature Switzerland, Cham, 2024. ISBN 177-3-031--377993 978-3-031-63800-., doi: 10.1007/9900 077779988--001-630000 15. URL https:
//1ink.spring springer....... wtw.ar..oomm/// www.co........ccttc..
63800-88 10100000-115550 15
Scries Title: Communications in Computer
and Information Science.
Julien Ferry, Ulrich Aīvodji, Sébastien Gambs, Marie-José Huguet, and Mohamed Siala. Probabilistic Dataset Reconstruction from Interpretable Models. In 2024 IEEE Conference on Secure and Trustworthy Machine
Learning (Sa TML), pp- 1-17, Toronto, ON, Canada, April 2024. IEFE. ISBN 979-8-350334950-4. doi: URL https://iesoxpporre ieee. org/document/1055664
10.1109 D0.1109/SaTMM... NTTTMMLL998700002240000
Jelena Fiosina. Interpretable Privacy-Preserving Collaborative Deep Learning for Taxi Trip Duration Forecasting. In Cornel Klein, Matthias Jarke, Markus Helfert, Karsten Berns, and Oleg Gusikhin (eds.), Smarl Cilies, Green Technologies, and Intelligent. Transport Systems, volume 1612, pp. 392- 411. Springer International Publishing, Cham, 2022. ISBN 978-3-031-1709744 978-3-031-17098-0. doi: 10.1007 10.1007/978-3-11 1978-3-031-17098-11 20. URL htttps://ling http:/iiiink..iieerr..... com/ 10. 100111000000---------000---00000 Series Title: Communications in Computer and Information Science.
Sam Fletcher and Md. Zahidul Islam. Decision Tree Classification with Differential Privacy: A Survey, ACM Computing Surveys, (2(4):1 33, July 2020. ISSN 0360-0300, 1557-7341. doi:
URL
https://dd http://dlllccc.ooomm
acm. wwwpg//////////ooooooooooooo 100 1145/3387064
Ruth C. Fong and Andrea Vedaldi. Interpretable Explanations of Black Boxes by Mcaningful Perturbation. In 2017 IEEE International Conference on Computer Vision (ICCV), pp. 3449-3457, Venice, October 2017. IEEE. ISBN 978---5386-1032-99 doi: 10.1109/1CCV 200177.3 URL http://ieeeeplorr. ieee. org/document/ 8237633/
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model Inversion Attacks that Exploit Confidence Information and Basic Counterncasures In Proceedings of the 22nd ACM SIGSAC Conference on Com- puler and Communications Security, pp. 1322 1333, Denver Colorado USA, October 2015. ACM. ISBN 188-1-5503-3822 doi: 10.1145/281010332818688 281367777 URL https://dl acm wwtp://////o////oo/o 1145//81011.. 2813677
Karan Ganju, Qi Wang, Wei Yang, Carl A. Gunter, and Nikita Borisov. Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 619-633, Toronto Canada, October 2018. ACM. ISBN 978- 778-1-4503-5693-0 doi: 10.1145//32433343324333 URL https: //al acm.
hrg//o1//0..145/330 0E004////224344444 3243834
Alex Gaudio, Asim Smailagic, Christos Faloutsos, Shreshta Mohan, Elvin Johnson, Yuhao Liu, Pedro Costa, and Aurélio Campilho. DecpFixCX: Explainable privacy-preserving image compression for medical image analysis. WIREs Dala Mining and Knowledge Discovery, March 2023. ISSN 1942-4787, 1942-4795. doi:
10.1002/widm. 1495. URL
1002/ 1495
GDPR. Art. 22 GDPR, April 2016. URL sttps:///dpr-info.o. waw.fff..earrtt22-1920 22-gpr//
Amirata Ghorbani, James Wexler, James Y Zou, and Been Kim. Towards automatic sancept-based expla- nations. Advances in neural information processing systems, 32, 2019.
Sofie Goethals, Kenneth Sörensen, and David Martens. The Privacy Issue of Counterfactual Explanations: Explanation Linkage Attacks. ACM Transactions on Intelligent Systems and Technology. 14(5):1-24, October 2023. ISSN 2157-6904, 2157-6912, doi: 10.1145/360844 URL https: //d1. acm. wat.oorg//oo/l// 1145/3608482
40

---

Published in Transactions on Machine Learning Research (10/2025)
Alejandro Cuerra-aanzanress L. Julian Lechuga Lopez, Michail Maniatakos, and Farah E. Shamout. Privacy-Preserving Machine Learning for Healthcare: Open Challenges and Future Perspectives. Tn Hao Chen and Luyang Luo (eds.), Trustworthy Machine Learning for Healtheare, volume 13932, pp.
25-40. Springer Nature Switzcrland, Cham, 2023. ISBN 978-8-031-335538- 978-8-031-395394 doi: 10.1007/976-33-011-99553
URL/https::/// : wtt.iiin.sssinngge... wtp.iiner..com1111100////10111/ 1tt.://10...000/9013311111191999 ries Title: Lecture Notes in Computer Science.
Se-
Riccardo Guidotti. Counterfactual explanations and how to find them: literature review and bench-
marking. Data Mining and Knowledge Discovery, April 2022. ISSN 1384-5810, 1573-756X. 10.1007/s1061$$ 0000000000061-0022000---66666
doi:
00831-6. URL httpps://iink.spprinnet www.wo..co.oooooo.oee 00000000000000100022---11
David Gunning and David W Aha. DARPA's Explainable Artificial Intelligence Program. Al Magazine, 40 (2):44-58, June 2019. doi: (011609/ammagee vat.aamaa...0002255000000 40022.2850.
Jingjing Guo, Haiyang Li, Feiran Huang, Zhiquan Liu, Yanguo Peng, Xinghua Li, Jianfeng Ma, Varun G. Menon, and Konstantin Kostromitin Igorevich. ADFL: A Poisoning Attack Defense Framework for Hor- isontal Federated Learning. IEEE Transactions on Industrial Informaties, 18(10):6526 6536, October 2022. ISSN 1551-3203, 1941-0050. doi: org/ document/9735274/
URL https//iieexplore.Bt ieee.
Jingjing Guo, Zhiquan Liu, Siyi Tian, Feiran Huang, Jiaxing Li, Xinghua Li, Kostromitin Konstantin Igorevich, and Jianfeng Ma. TFI-DT: A Trust Evaluation Scheme for Federated Learning in Dig- ital Twin for Mobile Networks. IEEE Journal on Selected Areas in Communiccatinns,, 41(11):3548 3560, November 2023. ISSN 0733-8716, 1558-0008. doi: 10.1009/JSAC::2233331000 hwt.:///rr...ee...ro////oooeeeee
URL https:
Frederik Harder, Matthias Bauer, and Mijung Park. Interpretable and Differentially Private Predictions. Pro- ceedings of the AAAI Conference on Artificial Intelligence, 34(04):4083-4000 4090, April 2020. ISSN 2374-3468, 2159-5399.
doi: 1000099/aai.334000..0 view/5827
URL https://ojs. http://jjs..aaa..gr///////a//aaa httpa//a..ppp//.tttrtticlll////
Anna Hedström, Leander Weber, Dilyara Bareeva, Daniel Krakowezyk, Franz Motzkus, Wojeiech Samek, and Sebastian Lapuschkin. Quantus: An Explainable AI Toolkit for Responsible Evaluation of Neural Network Explanations and Beyond. Journal of Machine Learning Research, 24(34):1-11, 11, 2023.
Juyeon Heo, Sunghwan Joo, and Taesup Moon. Fooling neural network interpretations via adversarial model manipulation. Advances in neural information processing systems, 32, 2019.
Pascal Hitzler, Federico Bianchi, Monirch Ebrahimi, and Md Kamruzzaman Sarker. Neural-symbolic inte- gration and the Semantic Web. Semantic Web, 11 11, Jamuary 2020. ISSN 22104968, 15700844. doi: 10.3233/SSW-100 foi=10.3233, 190366
URL hattps://wwe https://www.medrre http://www..................aaaa
Pascal Hitzler, Aaron Eberhart, Monireh Ebrahimi, Md Kamruzzaman Sarker, and Lu Zhou. Neuro-symbolic approaches in artificial intelligence. National Science Review, 96)) June 2022. ISSN 2095-5138, 2053-714X. doi: 10. wt..109/////waacce htt/nwac0035/5542220
URL. http:://aaaaaaaelccoooooccc///ss
Jaap-Henk Hoepman. Privacy Design Strategies. In Nora Huppens--oulahii Frédéric Cuppens, Sushil Jajodia, Anas Abou El Kalam, and Thierry Sans (eds.), ICT Systems Security and Privacy Protection, volume 428, pp. 446-459. Springer Berlin Heidelberg, Berlin, Heidelberg, 2014. ISBN 978-3-642-55414 8 978-3-642-5541555, doi:
38. URL http://link http:://iinks.srngee..... wwwpiiingrrr.mm///////ee/ com/10. 178-3-642-55444 5 38 Series Title: IFIP Advances in Information and Communication Technology.
Fred Hohman, Andrew Head, Rich Caruana, Robert DeLine, and Steven M. Drucker. Gamut: A Design Probe to Understand How Data Scientists Understand Machine Learning Models. In Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, pp. 1-13, Glasgow Scotland Uk, May 2019. ACM. ISBN 978-1-4508-5970-2. doi: 10. 111155/3290005.388
URL https::/ //dll acm. org/doi/
10. 1 /145/3290/05 3300809
41

---

Published in Transactions on Machine Learning Research (10/2025)
Hongsheng Hu, Zoran Salcie, Lichao Sun, Gillian Dobbie, Philip S. Yu, and Xuyun Zhang. Membership
Inference Attacks on Machine Tearning: A Survey. ACM Computing Surveys 54(11s): 37, January 2022. ISSN 0360-0300, 1557-7341.
doi: 10.1145/3523273. URL
ICO. Explaining decisions made with AI, 2020. URL
guide-to-data htg.a:/rrppppteooooooooooeeeaear
Eleni Ilkou and Maria Koutraki. Symbolic Vs Sub-symbolic AI Methods: Friends or Enemies? In Proceedings of the CIKM 2020 Workshops, volume 2699, October 2020.
Marija Jegorova, Chaitanya Kaul, Charlie Mayor, Alison Q. O'Neil, Alexander Weir, Roderick Murray- Smith, and Sotirios A. Tsaftaris. Survey: Leakage and Privacy at Inference Time. IEEE Transactions Pattern Analysis and Machine Intelligence, pp. 1-20, 2022. ISSN 0162-8828, 2160-9292, 1939-3530 doi: TTAp://PAAMM.2222.22
URL https:://eeexppooes ieee. www.:ieeeeeeeeeee.ee orgg/occumett/9986655
Hoyong Jeong, Suyoung Loe, Sung Ju Hwang, and Sooel Son. Learning to Generate Ivvrsion-Resistaan
Model Explanations. New Orleans, 2022.
Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong.
De- fending against Black-Box Membership Inference Attacks via Adversarial Examples. Tn Proceedings of the 2019 ACM SIGSAC Conference Computer and Communiications Security, pp. 259 274, London United Kingdom, November 2019. ACM. ISBN 978-1-4508-6647-9, doi: 00.1145/31193333366201. URL
https://dl. http://ddllaac....om wwwpooog/////ooooooo/oo/ootooott 114533319951 pttpa..gg//oo/0.0111111155531550 11155/33339633333322111 3363201
Yan Jia, Chaitanya Kaul, Tom Lawton, Roderick Murray-Smith, and Tbrahim Habli. Prediction of weaning from mechanical ventilation using Convolutional Neural Networks. Artificial Intelligence in Medicine, 117:102087, July 2021. ISSN 09333657. doi: http:/..aatmmd.222..2..
URL https://Linkinghhus
elsevier. /ttg:///..oo/eereeee///////23220
José Jiménez-Tana, Francesca Grisoni, and Gisbert Schneider. Drug discovery with explainable artificial intelligence. Nature Machine Intelligence, 2(10):573 584, October 2020. ISSN 2522-5839. doi: 10.1038/
099256-020-00236-1 URL https://wwx: http::::///wwwauuu.ueeee nwwura...ee... com/arrtcccels//2256 020-00236-4
Elvin Johnson, Shreshta Mohan, Alex Gaudio, Asim Smailagic, Christos Faloutsos, and Aurelio Campilho. HeartSpot: Privatized and Explainable Data Compression for Cardiomegaly Detection. In 2022 IEEE- EMBS International Conference on Biomedical and Healthh Informatics (BHI), pp. 01 04, loannina, Greece, September 2022. IEEE. ISBN 879-177654-8791-7 doi: 10.1109//HHHH151155 20H166158.2022.992222
URL https
7/ieeexplore leee. orgg/accmmett//927777/
Andrei Kapishnikov, Tolga Bolukbasi, Fernanda Viegas, and Michael Terry. XRAI: Better Attributions Through Regions. In 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 4947- 4956, Scoul, Korea (South), October 2019. IEEE. ISBN 17881-7281--808888 doi: 10.1109/ICCV 2019..0000005 URL https::/ feee. org/document/9008577.
Sinan Kaplan, Hanmu Uusitalo, and Lasse Lensu. unified and practical user-centric framework for explainable artificial intelligence. Knowledge-Bort Based Systems, 283:111107, January 2024. ISSN 09507051. doi: 1..101/...nosss.02233.11.1 111.11 URL https::/linkinghuub elsevier wttpr/ierr../eeeeeee//ipppiiipie com/retrriveeppis/ 50950705123008572
Amir-Hossein Karimi, Gilles Barthe, Bernhard Schölkopf, and Isabel Valera. A Survey of Algorithmic Recourse: Contrastive Explanations and Consequential Recommendations. ACM Computing Surveys, 55 (5):1 29, May 2023. ISSN 0360-0300, 1557-7341. 10. 1144//3222784
doi: (0.1145/3527845 URL https://ddd acm. org/doi/
Boen Kim, Rajiv Khanna, and Oluwasanmi Koyejo. Examples are not enough, learn to criticize! Criticism for Interpretability. In Advances in Neural Information Processing Systems, volume 29 of NIPS 2016, 2016. ISBN 978-1-5108-3881-9
42

---

Published in Transactions on Machine Learning Research (10/2025)
Been Kim, Martin Wattenberg, Justin Gilmer, Carrie Cai, James Wexler, Fernanda Viegas, et al. Inter- pretability beyond feature attribution: Quantitative testing with concept activation vectors (tcav). Tn International conference on machine learning, pp. 2668 2677. PMLR, 2018.
Pang Wei Koh and Percy Liang. Understanding Black-box Predictions via Influence Functions. In Proceedings of Machine Learning Research, volume 70, pp. 1885 1894, July 2017. URL https://prroeeedings mlr
press/v70/koh17a
Pang Wei Koh, Thao Nguyen, Yew Siang Tang, Stephen Mussmann, Emma Pierson, Been Kim, and Percy Liang. Concept bottleneck models. In International conference machine learning, pp. 5338-5348. PMLR, 2020.
Jakub Konečný, H. Brendan McMahan, Felix X. Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated Learning: Strategies for Improving Communication Efficiency. Barcelona, Spain, 2016.
URL http:pp://axxiv.rrr///////0...00 05492 arXiv:1610.05492 [es].
Aditya Kuppa and Nhien-An Le-Khac. Adversarial XAT Methods in Cybersccurity. IEEE Transactions on Information Forensics and Securily, 16:4924 4938, 2021. ISSN 1556-6013, 1556-6021. doi: 10.1109/TIFS. 2021.3117011 URL https://iseeexplorrg ieee http://.......eeooooooooo//////.
Freddy Lecue. On the role of knowledge graphs in explainable AI. Semantic Web, 11(1):41 51, 2020. doi: 10.3238/SW-190374
De Li, Jinyan Wang, Zhou Tan, Xianxian Li, and Yuhang Hu. Differential Privacy Preservation Inter- pretable Benttoowwrr-Dessggnae Convolutional Neural Networks. In 2020 IEEE 19th International Con- ference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 631-638, Guangzhou, China, December 2020a. IEEE. ISBN 978-1-665440392-4, doi: T.1100//TusCCoom56755220000 00089. URL htteps://eeeepploree ieee. org/ doccument/93431157
Xiao-Hui Li, Caleb Chen Cao, Yuhan Shi, Wei Bai, Han Gao, Layu Qiu, Cong Wang, Yuanyuan Gao, Shenjia Zhang, Xun Xue, and Lei Chen. A Survey of Data-driven and Knowledge-aware eXplainable AL. IEEE Transactions on Knowledge and Data Engineering, pp. 1-1, 2020b. ISSN 1041-4347, 1558 2326-3865. iewe.
doi:
URL
LiMin Fu. Rule generation from neural networks. IEEE Transactions on Systems, Man, and Cybernetics, 24 (8):1114-1124, August 1994. ISSN 00189472. doi: 011109/212299999 URL http:://eeeepplore.ee. ieee.
org/ Dtg//occuent//98699//
Bo Liu, Ming Ding, Sina Shaham, Wenny Rahayu, Farhad Farokhi, and Zihuai Lin. When Machine Learning Meets Privacy: A Survey and Outlook. ACM Computing Surveys, 54(2):1 36, March 2022a. ISSN 0360- 0300, 1557-7341.
doi: 10.1145/ 001145/3436655, URL https: acm org/ 1111:///1..1/4/337775531
Fan Liu, Zhiyong Cheng, Huilin Chen, Yinwei Wei, Liqiang Nie, and Mohan Kankanhalli. Privacy-Preserving Synthetic Data Generation for Recommendation Systems. In Proceedings of the 45th International ACM SIGIR Conference Research and Development in Information Retrieval, pp. 1379-1389) Madrid Spain, July 2022b. ACM. ISBN 978- 175---450-- doi: 10.1145/3477495.53328 doi/10.1145/34 100.11115344749555 3532044
URL https://dl. acm. org/
Han Liu, Yuhao Wu, Zhiyuan Yu, and Ning Zhang. Please Tell Me More: Privacy Impact of Explainability through the Lens of Membership Inference Attack. pp. 119-119 San Francisco, CA, USA, 2024. doi: 10. http:////52....22.....
Scott M Lundberg and Su-In Lee. Unified Approach Interpreting Model Predictions. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS'17, pp. 4768 4777, Long Beach, California, USA, December 2017. Curran Associates Inc. ISBN 978-1-5108-609644, doi: 00.5555/32952222325555
Haoyan Luo and Lucia Specia. From Understanding Utilization: A Survey on Explainability for Large Language Models, February 2024. URL httt:://axxiv.or/aaaatee.e 12874. arX1v:2401.12874 [es].
43

---

Published in Transactions on Machine Learning Research (10/2025)
Xinjian Luo, Yangfan Jiang, and Xiaokui Xiao. Feature Inference Attack on Shapley Values. In Proceedings of the 2022 ACM SIGSAC Conference on Compuler and Commanicntionss Securily, pp. 2233-2247 Los
Angeles CA USA, November 2022. ACM. ISBN 778-1-4503-9450-4 doi:
URL
https://dl acm. org//oi/10 1et.:/....111//11 1145/3548606 3560573
Raúl López-Blance Ricardo S. Alonso, Angélica González-Arrinn Pablo Chamoso, and Javier Pricto. Fed- erated Learning of Explainable Artificial Intelligence (FED-XAI): A Review. In Sascha Ossowski, Pawel Sitek, Cesar Analide, Goreti Marreiros, Pablo Chamoso, and Sara Rodríguez (eds.), Distributed Comput- ing and Artificial Intelligence, 20th International Conference, volume 740, pp. 318-326. Springer Nature Switzerland, Cham, 2023. ISBN 978-3-031-38332-- 978-3-031-33333-55 doi: 11110079978--031-33
32. URL https:://ii //linkk. http/iinn.spiingr......... 1ttm//10.1007/77----0-------1--0 in Networks and Systems.
32
Series Title: Lecture Notes
Yao Ma, Xurong Zhai, Dan Yu, Yuli Yang. Xingyu Wei, and Yongle Chen. Label-Only Member- ship Inference Attack Based on Model Explanation. Neural Processing Letters, 56(5):236, September 2024. ISSN 1573-773X. doi: 10. 10.1007/s11033-004--110 611063-024-11622
URL htttps://link.satt http:/a..ppiingrr..mm...00000000 com/10.1007/
R. Machlev, L.. Heistrene, M. Perl, K.Y. Levy, J. Belikov, S. Mannor, and Y. Levron. Explainable Ar- tificial Intelligence (XAT) techniques for energy and power systems: Review, challenges and opportuni- ties. Energy and AI, 9:100169, August 2022. ISSN 26665468. doi: 1..00///.eyyai.222..00111 100169. URL
https://linkinghub. elsevier http:////wc/.ccceoo/////////////
Saeed Mahloujifar, Esha Ghosh, and Melissa Chase. Property Inference from Poisoning. In 2022 IEEE Symposium on Security and Privacy (SP), pp- 1120-1137, San Francisco, CA, USA, May 2022. IEFE.
ISBN 978-1-6654-1316-9,
doi: 10.1109/SP 1L..09//PP42214.22222.. 98336633
URL https://ieeexpporee ieee irgg
document/9833623/
Abdul Majeed and Sungchang Lee, Anonymization Techniques for Privacy Preserving Data Publishing: A Comprehensive Survey. IEEE Access, 9:8512 8545, 2021. TSSN 2169-3536. doi:
3045700. URL htttps:/ ienereiieeeoooo htt.:///r........ooooooooooo///a
Sascha Marton, Stefan Lüdtke, Christian Bartelt, Andrej Tschalzev, and Heiner Stuckenschmidt. Fx- plaining neural networks without access to training data. Machine Learning, Jamuary 2024. ISSN 0885-6125, 1573-0565.
doi: 10.1007/1109944022--62222 610994-023-06228--
URL http:://iiikkpppinge.....o...... cot./o..1mm00..7..7
John A. McDermid, Yan Jia, Zoe Porter, and Ibrahim Habli. Artificial intelligence explainability: the technical and ethical dimensions. Philosophical Transactions of the Royal Society A: Mathematical, Phys- ical and Engineering Sciences, 379/22007)200200333,, October 2021. ISSN 1364-503X, 1471-2962. doi: 10.1098 (0.1098/rsst..0D1 wttp:/sttaa.......m 0363. URL
http:///ww..cceeppoooeeeeihorrrr 1098/rsta 2020. 0363
Claire McKay Bowen and Simson Garfinkel. The Philosophy of Differential Privacy. Notices of the American Mathemalical Sociely, 68(10):1, November 2021. TSSN 0002-9920, 1088-9477. doi: 10.1090/ noti2363. URL
httpp://wwez ams http://wwww....oo.a////////////a
pdf
Mohammad Merhi. An Assessment of the Barriers Impacting Responsible Artificial Intelligence. Informa- tion Systems Frontiers, April 2022. ISSN 1387-3326, 1572-9419. doi: 111007//117996-02--002777 URL
http::://iinssspringee. cwm/c0..cc.//c /1/.:/00000//111000000---0000000
Bortalan Meskó and Eric J. Topol. The imperative for regulatory oversight of large language models (or generative Al) in healtheare. npj Digital Medicine, 6(1):120, July 2023. ISSN 2398-6352. doi: 10.1038/
5417466023-00873-- htt.tttt:::///// hhttps://wwx http://wwww.tttueecoomm watture.ccm/artiilleel.. hatpa/////-4441-----00070------3 023-00873-0
Claudia R. Milaré, André C. P. De L. F. De Carvalho, and Maria C. Monard. An Approach To Explain
Neural Networks Using Symbolic Algorithms. International Journal of Computational Intelligence and Ap-
plications, 02(04):363-331 376, December 2002. ISSN 1469-02668 1757-5887 10.1142 101122/514906666220000
URL http:::/tww.....tt.....t http::/ww...oooaaacc.co.ooooooos
44

---

Helena Montenegro, Wilson Silva, and Jaime S. Cardoso. Privacy-Preserving Generative Adversarial Network for Case-Based Explainability in Medical Image Analysis. IEEE Access, 9:148037 148047, 2021. ISSN 2169- wwW.CCESSS.......1111 Published in Transactions on Machine Learning Research (10/2025)
Smitha Milli, Ludwig Schmidt,, Anca D. Dragan, and Moritz Hardt. Model Reconstruction from Model Explanations. In Proceedings of the Conference Fairness, Accounlabillty, and Transparrnccy, pp. 1 1-9, Atlanta GA USA, January 2019. ACM. ISBN 978-1-4503-6125-- https://d1. acm. org/doi/10 10..////...00 1144/3287760 /t1.7/228866888872222222 3287562
doi: (0.11455/2277550.32375522 URL
Aditi Mishra, Utkarsh Soni, Anjana Arunkumar Jinbin Huang, Bum Chul Kwon, and Chris Bryan. Promp- (Aid: Prompl Exploration, Perturbation, Testing and Iteration using Visual Analytics for Large Language arXiv:2304.0190 [cs].
Models, April 2023. URL http::/arxiv..o/ org/ wttgg///////////////ee /204. 2204/01944.40
Takayuki Miura, Toshiki Shibahara, and Naoto Yanai. MEGEX: Data-Free Model Extraction Attack Against Gradient-Bass Based Explainable AI. In Proceedings of the 2nd ACM Workshop Secure and Trustworthy
Deep Learning Systems, pp. 56 66, Singapore Singapore, July 2024. ACM. ISBN 979-8-4407-0091-2, doi: URL https://dl.ac... acm. acm. org/doi/10. 1tt.:///....11156656444940 1145/3665451 3665533
Rami Mochaourab, Sugandh Sinha, Stanley Greenstein, and Panagiotis Papapetrou. Demonstrator on Counterfactual Explanations for Differentially Private Support Vector Machines. In Massih-Reza Amini, Stéphane Canu, Asja Fischer, Tias Guns, Petra Kralj Novak, and Grigorios Tsoumakas (eds.), Machine Learning and Knowledge Discovery in Databases, volume 13718, pp. 662-666. Springer Nature Switzer- land, Cham, 2023. ISBN 978-3-031-26421111111 978----11111-11--22--1-1111 doi: 10.1007 000007977-3-011264400000 52. URL https: petps://link..o https///in..prrggger.cmmm wareerr.comm/e 1007 20tp://00.0000/9913-000111222220 52
Scries Title: Lecture Notes in Com-
puter Science.
Sina Mohseni, Niloofar Zarei, and Eric D. Ragan. A Multidisciplinary Survey and Framcwork for Design and Evaluation of Explainable AI Systems. ACM Transactions on Interactive Intelligent Systems, 11(3-4): 1-45, December 2021. ISSN 2160-6455, 2160-6463. doi: 10.1145/33877 33887166
URL. https:://dd acm. org/
do1/10.1145/338741
M. Molhoek and J. Van Laanen. Secure Counterfactual Explanations in Two-party Setting. In 2024 27th International Conference on Information Fusion (FUSION), pp. 1-10, Venice, Italy, July 2024. IEEE
ISBN 978-1-7777497-669. doi: 10.239 10.2911//USSONNS988..000 202...00441......... URL http::ttt/sssepppppp ieee.
org//bcumeat//070641///
Christoph Molnar. Interpretable Machine Learning. March 2023. ISBN 979-8-41 111--33-1.--333-00
Helena Montenegro and Jaime S. Cardoso. Anonymizing medical case-based explanations through disentan- glement. Medicol Image Analysis, 95:103209, July 2024. ISSN 13618415. doi: 10. (00.:/...mdia.2022....
URL https:://innkinghub elsevier httpa///e...ceeeeccc.eeee//////.
3536. doi:
URL https://ieeexploreeeeet wtw.aeergg//ccoeett//eeeeeeee/e
Viraaji Mothukuri, Reza M. Parizi, Seyedamin Pouriyeh, Yan Huang, Ali Dehghantanba, and Gau- tam Srivastava. A survey on security and privacy of federated learning. Future Generation Com- puter Systems, 115:619 640, February 2021. ISSN 0167739X. doi: f..101//..uuuure2220.... https://1inkinghubb elsevierseeeeeeeee www.evirr.om/reeeeeeeeeeeeeeeeee wtt.sv/ww...ooooocccc/op//////a2
URL
Deepa Muralidhar, Rafik Belloum, Kathia Marçal De Oliveira, and Ashwin Ashok. Elements that In- fluence Transparency in Artificial Intelligent Systems - Survey. In José Abdelnour Nocera, Marta Kristín Lárusdóttir, Helen Petrie, Autonio Piccinno, and Marco Winckler (eds.), Vuman-Compiln In- teraction INTERACT 2023, volume 14142, pp. 349-358. Springer Nature Switzcrland, Cham, 2023. ISBN 978-3-031-422794 978-3-081-42280-5, doi: 10.1007 (00077977-344 3-03--22200--5 21. URL https://lint: periinger.com/111 10071000777330 0-00--3-003--------------------- 21
Series Title: Lecture Notes in Computer Science.
Z. Müftüoğlu, M. A. Kızrak, and T. Yildrım. Prevcc-Preeerving Mechanisms with Explainability in As- sistive AI Technologies. George A. Tsihrintzis, Maria Virvou, Anna Esposito, and Lakhmi C. Jain (ods.). Advances in Assistive Technologies, volume 28, pp. 287-309. Springer International Publishing, Cham, 2022. ISBN 978-3-030-87131-4 978-3-030-88132-11
doi:
13. URL
45

---

Published in Transactions on Machine Learning Research (10/2025)
httpes///iinnk.sriingerr in Intelligent Systems.
Series Title:
Learning and Analytics
Francesca Naretto, Anna Monreale, and Fosca Giannotti. Evaluating the Privacy Exposure of Inter- pretable Global Explainers. pp. 13-19, Atlanta, GA, USA, 2022. IEEE Computer Socicty. doi: 10. 11109//oMM56440...ooo 202.44400222200012...
Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. In 2019 IEEE Symposium Security and Privacy (SP), pp. 739-753, San Francisco, CA, USA, May 2019. IEEE. ISBN 978-1-53866 1-5386-66600- doi: 00000//SP.009.000000 URL https::/ ieee org/document/ 8835245/
Mohamed Nassar, Khaled Salah, Muhammad Habib ur Rehman, and Davor Svetinovic. Blockehain for explainable and trustworthy artificial intelligence. WIREs Data Mining and Knowledge Discovery, 10(1),
January 2020. ISSN 1942-4787, 1942-4795. doi: 10.1002/widhs 1340. URL httpp:://omminelibrraay
wiley.comm cww//oim10..ac...c 1000///...000/.dmmm 1340
Thanh Tam Nguyen, Thanh Trung Huynh, Zhao Ren, Thanh Toan Nguyen, Phi Le Nguyen, Hongzhi Yin, and Quoe Viet Hung Nguyen. Privacy-preservigg explainable ai: survey. Science China Information Sciences, 68(1):111101 2025.
Truc Nguyen, Phung Lai, Hai Phan, and My T. Thai. XRand: Differentially Private Defense against Explanation-GGuided Attacks. Proceedings of the AAAI Conference on Artificial Intelligence, 37(10):11873 11881, June 2023. ISSN 2374-3468, 2159-5399. doi: 10.1609/ att.aaa.ii........... URL https://ojs.aast org/index, http://////aatatttt/////////////
Maximilian Noppel and Christian Wressnegger, Sok: Explainable machine learning in adversarial en- vironments. In 2024 IEEE Symposium on Security and Privacy (SP), pp. 2441-2459, 2024a. doi:
10.1109/SP54263.202222 220.54442...22.000222 2024.00021111
Maximilian Noppel and Christian Wressnegger. A brief systematization of explanation-awar attacks. In Andreas Hotho and Sebastian Rudolph (eds.), KT 2024: Advances in Artificial Intelligence, pp. 350-354, Cham, 2024b. Springer Nature Switzerland. ISBN 978-3-031-70893-0.
Maximilian Noppel, Lukas Peter, and Christian Wressnegger. Disguising attacks with explanation-aware backdoors. In 2023 IEEE Symposium on Security and Privacy (SP), pp. 664 664-681, 2023. doi: 10.1109/ SP46215.2023 101 103398
Harsha Nori, Rich Caruana, Zhiqi Bu, Judy Hanwen Shen, and Janardhan Kulkarni. Accuracy Interpretabil- ity, and Differential Privacy via Explainable Boosting. In Proceedings of the 38th International Conference on Machine Learning, volume 139, pp. 8227-8237, 2021. URL htttps:/pproceedingg: mlr pross//13////////////
nori htm.
Chris Olah, Mechanistic interpretability, variables, and the importance interpretable bases. Transformer Circuits Thread, 2022. URL ittps://transformmer www.effrrrme--rruuttssss pwb.2022/mech-inteet essay/indes index.
html
Neel Patel, Reza Shokri, and Yair Zick. Model Explanations with Differential Privacy. In 2022 ACM Conference Fairness, Accountability, and Transporency, pp. 1895 1904, Seoul Republic of Korea, June 2022. ACM. ISBN 978- 1-4503--9352-2 doi: 10. 00.145/9533114.333322,, URL httpps:/dd] acm. acm. org/ doi/
10. 146833333116333332235
3533235
Martin Pawelczyk, Himabindu Lakkaraju, and Seth Neel. On the Privacy Risks of Algorithmic Recourse. In Proceedings of The 26th International Conference on Artificial Intelligence and Statistics, volume 206 of Proceedings of Machine Learning Research, pp. 0680-9696, Valencia, Spain, 2023. PMLR. URL https: 7/proceedings. mlr wwwpp//20///eeee//pt 2tte://///20///aaalccyy22.....
46

---

Published in Transactions on Machine Learning Research (10/2025)
Seyedeh Neclufar Payrovnaziri, Zhaoyi Chen, Pablo Rengifo- Moreno, Tim Miller, Jiang Bian, Jonathan H Chen, Xiuwen Liu, and Zhe He. Explainable artificial intelligence models using real-world electronic health record data: a systematic scoping review. Journal of the American Medical Informatics Association, 27
(7):1178-1185, July 2020. ISSN 1527-974X. doi: 10.1093/jamia/ocaa// /caam555. URL
com/ http://aaa/arrtcca//////////////
Nikolaos Pitropakis, Emmanouil Panaousis, Thanassis Giannetsos, Eleftherios Anastasiadis, and George Toukas. faxonomy and survey of attacks against machine learning. Computer Science Review, 34:
100199, November 2019. ISSN 15740137. doi: http:/..coore...1..100..00 URL elsevier. http://www.oaoeeeeeeee//////////
Andrés Páez. The Pragmatic Turn in Explainable Artificial Intelligence (XAI). Minds and Machines,
29(3):441-459, September 2019. ISSN 0924-6495, 1572-8641.
doi:
URL
http://iinkk.riiier.....e http://....///11100011111111----
Enayat Rajabi and Kobra Etminani. Showledge-graph--assee explainable AI: A systematic review. Journal of Information Science, pp. 016555152211222 September 2022. ISSN 0165-5515, 1741-6485. doi: 10.1177/
01655515221112841 URL
Atul Rawal, James McCoy, Danda B. Rawat, Brian M. Sadler, and Robert St. Amant. Recent Advances in Trustworthy Explainable Artificial Intelligence: Status, Challenges, and Perspectives. IEEE Transactions on Artificial Indelligence, 3(6):852 866, December 2022. ISSN 2691-4581. doi: 10.1109/TMM TT009//AA.22222 2.2.1.13333384
URL https://ieeeepplors ieee. org./document/96455555
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 'Why Should Trust You?": Explaining the Predictions of Any Classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1135-1144, San Francisco California USA, August 2016. ACM.
doi: 10.1 00.1145/299667..20 //////99992222229 2939778. URL https: //dl. acm 10tp.:a...r/////..1111///9922220 29922999996722299778 2939778
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Anchors: High Precisinn Model-Agnostic Ex- planations. Proceedings of the AAAT Conference on Artificial Intelligence, 32(1), April 2018. ISSN
2374-3468, 2159-5399.
doi: 10.1609 10.1609/aaai. v3211.11491. URL https://ojs. aaaii org/index. wwwpiinwee..pp.aA.eme php/AAAI/
article/vie//11491
Maria Rigaki and Sebastian Garcia. A Survey of Privacy Attacks in Machine Learning. ACM Computing Surveys,
November 2023. doi:
Jože M. Rožanec, Blaž Fortuna, and Dunja Mladenić. Knowledge graph-based rich and confidentiality
preserving Explainable Artificial Intelligence (XAI). Information Fusion, 81:91-102, May 2022. ISSN 15662535. doi: 10.1016/j.infiit 2021. 11.015. URL https::/linkkighubb wwwee//rr.co///erreeeeeeeee
$1566253521002414
Hassan Sajjad, Nadir Durrani, and Fahim Dalvi. Neuron-level interpretation of deep nlp models: A survey. Transactions of the Association for Computational Linguistics, 10:1285 1303, 2022.
Conrad Sanderson, David Douglas, and Qinghua Lu. Implementing Responsible AI: Tensions and Trade- Offs Between Ethics Aspects. In 2023 International Joinl Conference Neural Networks (IJCNN), pp. 1-7, Gold Coast, Australia, June 2023. IEEE. ISBN 978-1-6654-8867-9 10191274. URL htttps://seeexplorss leee. http://dooceee///1111177777
doi: 10.100//JCCNN44540.2000
Pramir Sarkar, Ashish V Prakash, and Jang Bahadur Singh. Explaining Ilm decisions: Counterfactual chain- of-thought approach. In Advanced Computing and Communications Conference, pp. 254-266. Springer, 2024.
Johannes Schneider. Explainable generative ai (genxai): survey, conceptualization, and research agenda. Arlificial Intelligence Review, 57(11):288) 2024a.
Johannes Schneider. Explainable Generative AI (GenXAI): A Survey, Concoptualization, and Research 09554 arXiv:2404.09554 [cs).
Agenda, April 2024b. URT
47

---

Published in Transactions on Machine Learning Research (10/2025)
Arne Seeliger, Matthias Pfaff, and Helmut Kremar. Semantic Web Technologies for Explainable Machine
Learning Models: A Literature Review. PROFILES//EMEXO ISWC, 2465:1-16, 2019. URL https:
//api.semanticschol... org//orrpsID::24482222
Giorgio Severi, Jim Meyer, Alina Oprea, and Scott Coull. Explanation-Chuided Backdoor Poisoning Attacks Against Malware Classifiers. In 30th USENIX Security Symposium (USENIX Security 21), 2021.
Sakib Shahriar, Sonal Allana, Mehdi Hazrati Fard, and Rozita Dara. A Survey of Privacy Risks and Mitigation Strategies in the Artificial Intelligence Life Cycle. IEEE Access, pp. 1 1, 2023. ISSN 2169-3536. 201.:388...223..8788999 3287195. URL ltttps://ieeexploree ieee. org/doccment//0151477
doi:
Reza Shokri, Marco Stronati, Congzhong Song, and Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 3- 18, San Jose, CA, USA, May 2017. TEEE. ISBN 978-1-5000-5533-3. doi: 10.1109/SP:0017.11. URL http: http://jeeexploree www..rreeeeeeee..e. wttp///oommet///55555555
Reza Shokri, Martin Strobel, and Yair Zick. Exploiting Transparency Mcasures for Membership Inference: a Cautionary Tale. In The AAAI Workshop on Privacy-Preservin Artificial Intelligence (PPAI), volume 13, New York, USA, 2020. AAAL
Reza Shokri, Martin Strobel, and Yair Zick. On the Privacy Risks of Model Explanations. In Proceedings of the 2021 AAAI/ACM Conference on AI, Ethics, and Society, pp. 231 231-241, Virtual Event USA, July 2021. ACM. ISBN 847--------- doi: 10. N0.1145/4461002.446255 10. 1145/34617702 346223222446233
URL https: //dl. acm. org/do1/
Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Learning Important Features Through Propagating Activation Differences. In Proceedings of the 34th International Conference on Machine Learning Volume 70, ICML'17, pp. 3145 3153, Sydney, NSW, Australia, 2017a. JMLR.org. doi:
10.5555/3305588 330589003300006
Avanti Shrikumar, Peyton Greenside, Anna Shcherbina, and Anshul Kundaje. Not Just a Black Box: Learning Important Features Through Propagating Activation Differences, April 2017b. URL http:
Saaxiv..rrg/bs//1655 01770 ar arXiv:1605.01713 [es].
Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep Inside Convolutional Networks: Visualising Tmage Classification Models and Saliency Maps. In Workshop al. International Conference on Learning Representations, April 2014. arXiv:1312.6034 [es].
Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. Machine Learning Models that Remember Too Much. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 587-601, Dallas Texas USA, October 2017. ACM. ISBN 978-144003-4946-5 doi: 10.1145/3133966 3134077. URL https: acm. /ttp://////...11//13333..3131110 3134077
Christoforos N. Spartalis, Theodoros Semertzidis, and Petros Daras. Balancing xai with privacy and security considerations. In Computer Security. ESORICS 2023 International Workshops: CPS4CIP, ADIoT, Se- cAssure, WASP, TAURIN, PriST-AI, and SECAI, The Hague, The Netherlands, September 25-29, 2023, Revised Selecied Papers, Part II, pp. 111 124, Berlin, Heidelberg, 2023. Springer Verlag. ISBN 978-3-031- 54128-5. doi:
7. URL 031-54129-9 ___
Jost. Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin Riedmiller. Striving for Simplicity: The All Convolutional Net. San Diego, CA, USA, 2015. ICLR. arXiv:1412.681 [cs].
Martin Strobel and Reza Shokri. Data Privacy and Trustworthy Machine Learning. IEEE Security & Privacy, 20(5):44 49, September 2022. ISSN 1540-7993, 1558-4046. doi: 10.1089/MSEC.:20233133..
URL https://ieeexpporee leee. or.. httg//dccmmem//80776////
Jiao Sun, Q. Vera. Liao, Michael Muller, Mayank Agarwal, Stephanic Houde, Kartik Talamadupula, and Justin D. Weisz. Investigating Explainability of Generative AI for Code through Crenario-basedd Design, Tn 27th International Conference on Intelligent User Interfaces, pp. 212-228, 228, Helsinki Finland, March
48

---

Published in Transactions on Machine Learning Research (10/2025)
2022. ACM ISBN 978-1-4503-9144-3. doi: 10. 10.1455/440099.31111. URL https://dl.ae acm org/doi/ 10. 1144/34909999 3511119
Mukund Sundararajan and Amir Najmi. The Many Shapley Values for Model Explanation. In Proceedings of the 37th International Conference on Machine Learning, pp. 9269 9278, Virtual, September 2020. PMLR.
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic Attribution for Deep Networks. In Proceedings of the 34th International Conference Machine Learning Volume 70, 1CML'17, pp. 3319 3328, Sydney, NSW, Australia, 2017. JMLR.org. doi:
Latanya Sweeney. Achieving k-anonymity privacy protection using generalization and suppression. Inter- national Journal of Uncertainly, Fuzziness and Knowledge-Basce Based Systems, 10(05):551-5888 2002a. ISSN 0218-4885. Publisher: World Scientific.
Lalanya Sweeney. k-anonymity; A model for protecting privacy. International journal of uncerlainly, fuzzi- ness and knowledgee-bsed systems, 10(05):557- 570, 2002b. ISSN 0218-4885. Publisher: World Scientific.
Elham Tabassi. AI Risk Management Framcwork: AT RMF (1.0). Technical Report NIST AI 100-1, National Institute of Standards and Technology, Gaithersburg, MD, 2023. URL https://nvlpubs nist. gov/
nistpubs/ witphbbbaa///IITT.TT AI. 100-1 pdf
Vagan Terziyan and Oleksandra Vitko. Explainable AI for Industry 4.0: Semantic Representation of Deep Learning Models. Procedia Computer Science, 200:216-226, 2022. ISSN 18770509. doi: 10.1016/j.pre 2022.01.220 URL
wwsevier. http///ww.aaaaaaecee//////oeee/a
Ilaria Tiddi and Stefan Schlobach. Knowledge graphs as tools for explainable machine learning: A survey. Artificial Intelligence, 302:103627, January 2022. ISSN 00043702. doi:
URL
https: https://Linkinghubb wetebbeesseee elsevier.......
Ryotaro Toma and Hiroaki Kikuchi. Combinations of AT Models and XAI Metries Vulnerable to Record Reconstruction Risk. In Lecture Notes in Computer Science, pp. 329 343. Springer Nature Switzerland, ___. URL
Cham, 2024. ISBN 978-3-031-69650-2 978-3-031-69651-0, doi: ISSN: 0302-9743, 1611-3349.
https://link: spppss//.inksssriggger.... /wt.://0..100//777-------6666611
22
D.E.D. Torres and C.M.S. Rocco. Extracting trees from trained SVM models using a TREPAN basod approach. In Fifth International Conference on Hybrid Intelligend Systems (HIS'05), pp. pp., Rio de Janeiro, Brazil, 2005. IEEE. ISBN 978-0-7695-2457-3, doi: 10.1109/ICH1IS.0000 2005..11. URL http:
//ieeexplore. ieee. htt.://oor....e....ooo//ooemeeta org//occuent/158777///
Anh-Tu Tran, The-Dung Luong, and Van-Nam Huynh. A comprehensive survey and laxonomy on privacy- preserving deep learning. Newrocomputing, 576:127345, April 2024. ISSN 09252312. doi: 10.1016/j 2024.127345. URL https://1inkinghut hww.hhnnguubeeeeeee.....ee elsevier httpa///ww..cooooooo////////////
Andrea C. Tricco, Erin Lillic, Wasifa Zarin, Kelly K. O'Brien, Heather Colquhoun, Danielle Levac, David Moher, Micah D.J. Peters, Tanya Horsley, Laura Weeks, Susanne Hempel, Elie A. Akl, Christine Chang, Jessie McGowan, Lesley Stewart, Lisa Hartling, Adrian Aldcroft, Michael G. Wilson, Chantelle Garritty, Simon Lewin, Christina M. Godfrey, Marilyn T. Macdonald, Etienne V. Langlois, Karla Soares- Weiser, Jo Moriarty, Tammy Clifford, Özge Tunçalp, and Sharon E. Straus. PRISMA Extension for Scoping Re- views (PRISMA-ScR): Checklist and Explanation. Annals of Internal Medicine, 169(():467-473) October 2018. ISSN 0003-4819, 1539-3704. doi: 10.7326/ 7326/M18-0850. M18-0850. URL https://ww..cpjoounnal.... wttp://rrnnnssoooooooooooo 10. 20.77266M18-21 0850
Cristina Trocin, Patrick Mikalef, Zacharoula Papamitsiou, and Kieran Conboy. Responsible AI for Dig- ital Hcalth: a Synthesis and Research Agenda. Information Systems Frontiers, June 2021. ISSN
1387-3326, 1572-9419. doi: 10.1007/s10796-0211
021-9906--2-1111---- URL htttps://iin http//iink.siiine...... springer. com 1007/
810796-021110146-4
49

---

Published in Transactions on Machine Learning Research (10/2025)
Jonathan Ullman and Salil Vadhan. PCPs and the Hardness of Generating Private Synthetic Data. In David Hutchison, Takeo Kanade, Josef Kittler, Jon M. Kleinberg, Friedemann Mattern, John C. Mitchell, Moni Naor, Oscar Nierstrasz, C. Pandu Rangan, Bernhard Steffen, Madhu Sudan, Demetri Terzopou- los, Doug Tygar, Moshe Y. Vardi, Gerhard Weikum, and Yuval Ishai (eds.), Theory of Cryptography, volume 6597, pp. 400-416, Springer Berlin Heidelberg, Berlin, Heidelberg, 2011. ISBN 178-3-642-19570- 978-3-641--1571--6 doi: 11.1007/978-3-000 145--197--66 24. URL http://link wannk..prnggrrr... comm10.10077 978 978-3-642-19571-8 24 Series Title: Lecture Notes in Computer Science.
Michael Veale, Reuben Binns, and Lilian Edwards. Algorithms that remember: model inversion attacks and data protection law. Philosophical Transoctions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 376(2133):20180N))))) 80088, November 2018. ISSN 1364-503X, 1471-2962. doi: http:// dx. dx.doi.org/10..
URL http:://wopaaaaccaeppppaaaaiaaap
2018.0080
Thijs Veugen, Bart Kamphorst, and Michiel Marcus. Privacy-Preserving Contrastive Explanations with Local Foil Trees. In Shlomi Dolev, Jonathan Katz, and Amnon Mcisels (eds.), Cyber Security, Cryptology, and Machine Learning, volume 13301, pp. 88 98-998.2 Springer International Publishing, Cham, 2022. ISBN
978-3-031-00688-66 978-0030--------------------333 doi: 010077997833001-07699-9- 7. URL htttp:://inkk..tt springer. 2omm100.0007/77---03333
Scries Title: Lecture Notes in Computer Science.
Vy Vo, Trung Le, Van Nguyen, He Zhao, Edwin V. Bonilla, Gholamreza Haffari, and Dinh Phung. Feature- based Learning for Diverse and Privacy-Preserving Counterfactual Explanations. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2211 2222, Long Beach
CA USA, August 2023. ACM. ISBN 979-8-4007-0103-0. doi: 10.1155/555000535598444
URL https:
//dl. acm. wrg//oo/////..oooooooooooooooo.t ottg/ooo/10.1115/358000000 35993433
Sandra Wachter, Brent Mittclstadt, and Chris Russell. Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR. SSRN Electronic Journal, 2017. ISSN 1556-5068. doi:
01.2139/ssrn.30332 URT. htttps://wwi sarn. wtt.ccom//a//e.ec http//absractt3032899
Guan Wang, Charlie Xiaoqian Dang, and Ziye Zhou. Measure Contribution of Participants in Federated Learning. In 2019 IEEE International Conference on Big Data (Big Data), pp. 2597-2604, Los Angeles, CA. USA, December 2019. IEEE. ISBN 978-1-7281-0858-2, doi: 1LLL00//BgDDaa//70000099990 URL https:// 1eee. org org//dccument/800617/)
Ping Wang and Heng Ding. The rationality of explanation or human capacity? Understanding the impact of explainable artificial intelligence on human-Al trust and decision performance. Informalion Processing Management, 6134))10373,, July 2024. ISSN 03064573, doi:
URL https:
//1inkinghub elsevier. http:///errreeeee/////////////2.
Yongjie Wang, Hangwei Qian, and Chunyan Miao. DualCF: Efficient Model Extraction Attack from Counter- factual Explanations. 2022 ACM Conference on Fairness, Accountabiltyy, and Transparency, pp. 1318- 1329, Seoul Republic of Korea, June 2022. ACM. ISBN 978-1-4503-9352-2. doi: 10.145//831146:333188.. URL https://dl acm. oowo//o///oo//oooooo 1145/3531146 3533188
Samuel D. Warren and Louis D. Brandeis. The Right to Privacy. Harvard Law Review, IV(5), December 1890.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoe V Le, Denny Zhou, al. Chain-of-though prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824 24837, 2022.
Justin D Weisz, Michael Muller, Jessica He, and Stephanic Honde. Toward General Design Principles for Generative AI Applications. 2023.
Alan F. Westin. Privacy and Freedom. Atheneum, New York, 1967.
50

---

Published in Transactions on Machine Learning Research (10/2025)
Michael Winikoff and Julija Sardelic. Artificial Intelligence and the Right to Explanation Human Right. IEFE Internet. Compuling, 25(2):116-120, March 2021. ISSN 1089-7801, 1941-0131. doi: 10.1109/MIC. 2020.3045821. URL https://jeeeepplore leee. org//oocumett//92000/
Yuncheng Wu, Shaofeng Cai, Xiaokui Xiao, Gang Chen, and Beng Chin Ooi. Privacy preserving vertical federated learning for tree-based models. Proceedings of the VLDB Endowment, 13(12):209) 2103, August 2020. ISSN 2150-8097.
doi: 10.14778/3407790..64
URL https://dl aac.///llccmmmm.... acm. ott//o///1..1/7700
Yuncheng Wu, Naili Xing, Gang Chen, Tien Tuan Anh Dinh, Zhaojing Luo, Beng Chin Ooi, Xiaokui Xiao, and Meihui Zhang. Falcon: A Privacy-Preserving and Interpretable Vertical Federated Learning System. Proceedings of the VLDB Endowment, 16(10):2471-244 2484, June 2023. ISSN 2150-8097. doi: 00.14778/600351136000
URL https: acm. /tt..//////0...1777////000003300 3603588
Anli Yan, Ruitao Hou, Xiaozhang Liu, Hongyang Yan, Teng Huang, and Xianmin Wang. Towards explainable
model extraction attacks. International Journal of Intelligent Systems, 37(1))99936 9956, November 2022.
ISSN 0884-8173, 1098-111X, doi: 11.000//nt.2000 URL httpps:/ wilp::ibbbbbwwwywy..........eeee wiley. www.://wwwwwc.cc.....ooommoo...e cow/doi/1o/
1002/int. 23022
Anli Yan, Ruitao Hou, Hongyang Yan, and Xiaozhang Liu. Explanation-bassed data-free model extraction allacks. World Wide Web, 26(5):3081 3092, September 2023a. ISSN 1386-145X, 1573-1413. doi: 10.1007/
s11280-023-01150-6 URL https::/iink.ppriggrr.oo httpppp...oo///...//////11100000
Anli Yan, Teng Huang, Lishan Ke, Xiaozhang Liu, Qi Chen, and Changyu Dong. Explanation leaks:
Explanation-guideed model extraction attacks. Information Sciences, 632:269 284, June 2023b. ISSN 00200255. doi: .0..:/...n..22.......... 5002002552300316X
URL http://wwwnnnguuu...eeeeeeee.eoa
Guang Yang, Qinghao Ye, and Jun Xia. Unbox the black-box for the medical explainable AI via multi-modal and multi-centre data fusion: A mini-review, two showcases and beyond. Information Fusion, 77:29 52 January 2022. ISSN 15662535. doi: 10.1016/j.inffie 00000//.nfffs.2222000.0.00 0021.07.016. URL https://linkinghub htw.aankiinnuub.eeeeieeee. elsevier.
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting. In 2018 IEEE 31st Computer Securily Foundations Symposium (CSF), pp. 268 282, Oxford, July 2018. IEEE. ISBN 978-1-5386-6680-7 doi: 10.1109/CSB Wt019//SF.0018.0000 2018.00027.
URL https::/teeexplore.rr ieee. org/ dww.meett/829911111...
Xuefei Yin, Yanming Zhu, and Jiankun Hu. A Comprehensive Survey of Privacy-preserring Federated Learning: A Taxonomy, Review, and Future Directions. ACM Computing Surveys, 54(6):1-36, July 2022.
ISSN 0360-0300, 1557-7341. doi: 0..145/34464221 URL https://dl. http://dllcc...c/////c wttp://gg////..oooo 11t55//1...15//4444277
Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-Cost High-Power Membership Inference Attacks. 2024. URL httpss:/ http:://pgeeereeeeeeeee/ooooorre
Shenglai Zeng, Jiankun Zhang, Pengfei He, Yue Xing, Yiding Liu, Han Xu, Jic Ren, Shuaiqiang Wang, Dawei Yin, Yi Chang, and Jiliang Tang. The Good and The Bad: Exploring Privacy Issues in Retrieval-Angmennee Generation (RAG), February 2024. URL http:://axti: orw.orgg///.......ooooooo..... hta.bb//22222 16893 arXiv:2402.16893 [cs].
Xiaoyu Zhang, Chao Chen, Yi Xie, Xiaofeng Chen, Jun Zhang, and Yang Xiang. A survey on privacy inference attacks and defenses in cloud-based Deep Neural Network. Computer Slandords & Interfaces, 83:103672, January 2023. ISSN 09205489. doi: 10.1006/...si.2222.1mo0 elsevier. /laevveeccoooeerrrreeeee//////00
URL https://linkkighub.
Xinyang Zhang, Ningfei Wang, Hua Shen, Shouling Ji, Xiapu Luo, and Ting Wang. Interpretable deep learning under fire. In 29th (USENIX) securily symposium ((USENIX) securily 20), 2020.
51

---

Published in Transactions on Machine Learning Research (10/2025)
Yifei Zhang, Dun Zeng, Jinglong Luo, Xinyu Fu, Guanzhong Chen, Zenglin Xu, and Irwin King. A Survey of Trustworthy Federated Learning: Issues, Solutions, and Challenges. ACM Transactions on Intelligent Systems and Technology, 15(6):1 47, December 2024. ISSN 2137-6904, 2157-6912. doi: 10. URL https://dl acm.
Zijiao Zhang, Chong Wu, Shiyou Qu, and Xiaofang Chen. An explainable artificial intelligence approach for financial distress prediction. Information Processing & Management, 59(4):102988, July 2022. ISSN 03064573. doi: 10. 10.1016/j..pm.220 102988. URL https://Linkinghubbee elsevier http://rr./oreereee//pis//////// $0306457322001030
Haiyan Zhao, Hanjie Chen, Fan Yang, Ninghao Liu, Huiqi Deng, Hengyi Cai, Shuaiqiang Wang, Dawei Yin, and Mengnan Du. Explainability for Large Language Models: A Survey, ACM Transactions on Intelligent Systems and Technology, pp. 3639372, January 2024. ISSN 2157-6904, 2157-6912. doi: 10.1145/363937
URL https://dl acm. wwwmmoorg//oo////o 1145/3639372
Jiaqi Zhao, Hui Zhu, Fengwei Wang, Rongxing Lu, and Hui Li. Efficient and privacy-preserving based inference via additive homomorphic encryption. Information Sciences, 650:119480. December 2023. ISSN 00200255. doi: 10.1016/j.nns:222.11100 119.480 URL https://iinkigghuu.olh// elsevier wttp://rr...arerree///////////// 50020025523010655
Xuejun Zhao, Wencan Zhang, Xiaokui Xiao, and Brian Lim. Exploiting Explanations for Model Inversion Attacks. In 2021 IEEE/CVE International Conference Computer Vision (ICCV), pp. 662 672, Mon- trcal, QC, Canada, October 2021. IEEE. ISBN 978-1-6654-2812-5, doi: 14110//TCCV4892222200.00000
URL https://ieeexpporee ieee. h
Xiubin Zhu, Dan Wang, Witold Pedrycz, and Zhiwu Li. Horizontal Federated Learning of -uggno Fuzzy Rule-Based Models. IEEE Transactions Fuzzy Systems, 30(9):3537-335 -5477 September 2022, ISSN 1063-6706, 1941-0034. doi: N0.100//TUU7Z.2211311111 URL htttt:://eeeeepprrrrr ieee..reeeeeee org/
document/9565342/
Roland $ Zimmermann, Judy Borowski, Robert Geirhos, Matthias Bethge, Thomas Wallis, and Wieland Brendel. How well do feature visualizations support causal understanding of emn activations? Advances in Neural Information Processing Systems, 34:1 17700-17444 2021.
52


Reviews:
[{"review_id": "ruFTBEhtTB", "reviewer": "Reviewer_ULTM", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The work looks at the direct impact of enhancing model utility using eXplainable AI (XAI) on the privacy leakage of the model. In particular, the authors note interesting progressions in XAI and the upward trend of related privacy discussions in this space. Furthermore, they go over exact references for where XAI methods have now been developed so as to be resilient to privacy concerns. Overall, it seems that the paper aims to address the gap of explaining the correlation between XAI, privacy and ways to mitigate any possible privacy sensitive outputs.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Given the original premise of the paper, about directly connecting XAI and its impact on privacy, the authors successfully show that, especially in Section 4. Furthermore, in Section 5, the authors discuss remedial techniques for lowering the impact of XAI-related privacy impact.", "audience_yn": "Yes", "audience_explanation": "The author's work, as currently presented, has the following direct benefits,\n- Provides a comprehensive list of references for understanding tangible and exact privacy risks attached to XAI methods (Section 4).\n- Enables a better understanding of ways to limit such risks (Section 5).", "requested_changes": "Although the risks discussed in the work are valid and warrant discussion, it seems that the survey paper might be too broad rather than a targeted delivery of the most important items. I would recommend the following changes, \n\n- Focus specifically on a risk-based segregation, such as the biggest difference in models that include XAI and ones that do not.\n- Presently, it's unclear without reading a lot of content what the next biggest challenges are in this space. I would encourage the authors to add the same.\n- Have more regular summaries or concluding remarks that can help readers understand items of interest more clearly, regularly, and possibly exclude or limit the discussion of low-risk XAI-privacy items altogether for brevity.\n- Focus more on the design approach of XAI systems, which may be the crux of reducing the privacy leakage. Would love more thorough discussions about the same.\n\nOverall, it seems that a detailed discussion about the highest risks posed by XAI might benefit a reader much more than a broad general XAI-privacy connection.", "broader_impact_concerns": "N/A", "additional_comments": "N/A", "extra_scores": {}, "extra_text": {}}, {"review_id": "fEa5eBym0x", "reviewer": "Reviewer_4h3R", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a scoping review of the current landscape of privacy risks and defenses in explainable AI (XAI). The authors introduce a taxonomy of privacy risks in XAI, provide an overview of existing defenses, and propose desiderata for effective defenses to achieve better privacy-utility trade-offs. \n\nThe topic is timely and addresses a key challenge in enabling the real-world deployment of XAI systems. The paper is well-motivated and generally well-written. The main weakness lies in the limited depth of the scoping review and the proposed taxonomy, as well as the insufficient engagement with existing surveys on the topic (see detailed comments below).", "claims_and_evidence_yn": "Yes", "claims_explanation": "Yes (with some reserve).\n\nMy primary concern relates to the paper’s methodological claim of conducting a scoping review. Specifically, the description of the data charting process is unclear (cf. item 10 of the PRISMA-ScR checklist). Without this clarification, it is difficult to assess the rigor of the review.\n\nIn addition, the link between the scoping review methodology and the proposed taxonomy is not well articulated. For instance, the basis for the intentional/unintentional dichotomy is not sufficiently justified. This distinction also appears somewhat misleading, since several phenomena categorized as “unintentional” (e.g., overfitting, memorization) are frequently described in the literature as enabling factors for the attacks classified under the “intentional” category (e.g., membership inference, data extraction).", "audience_yn": "Yes", "audience_explanation": "Yes, the paper could be a good reference for anyone interested in learning more about adversarial XAI.", "requested_changes": "- Clarify the exclusion criteria in section 3.1\n- Update Section 2.4 to include recent/similar contributions such asref listed below. Include how this work differs overlaps.\n\n\t- Noppel, M., & Wressnegger, C. (2024, August). A Brief Systematization of Explanation-Aware Attacks. In German Conference on Artificial Intelligence (Künstliche Intelligenz) (pp. 350-354). Cham: Springer Nature Switzerland.\n\n\t- Nguyen, T. T., Huynh, T. T., Ren, Z., Nguyen, T. T., Nguyen, P. L., Yin, H., & Nguyen, Q. V. H. (2024). A survey of privacy-preserving model explanations: Privacy risks, attacks, and countermeasures. arXiv preprint arXiv:2404.00673.\n\n\t- Baniecki, H., & Biecek, P. (2024). Adversarial attacks and defenses in explainable artificial intelligence: A survey. Information Fusion, 107, 102303.\n\n- For a reader not familiar with adversarial ML, the paper can be hard to parse. The adversary model (e.g., white-box/black-box access) is not clearly explain. I suggest to have a section where the different aspects of the adversary model are explained. \n- Consistently present the attacks through the adversary model, and (minimally) the gain obtained with the explanation to highlight how explanation introduce new risk.", "broader_impact_concerns": "Not really applicable. However, the authors could add a section after the conclusion to reiterate the objective of the paper, namely to raise awareness about the privacy risks of XAI.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "teiWmplX8h", "reviewer": "Reviewer_dAeN", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a scoping review on privacy risks and preservation methods in Explainable AI (XAI), driven by the growing regulatory and practical demand for transparent, high-stakes AI systems. It categorizes privacy risks, surveys existing privacy-preserving techniques, and proposes key characteristics for trustworthy, privacy-aware explanations. By synthesizing current knowledge on explainability and privacy, the work outlines major attack and defense strategies and provides practical recommendations for developing secure and reliable XAI systems.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Yes, the claims made in the submission are supported by accurate, convincing, and clear evidence.", "audience_yn": "Yes", "audience_explanation": "Yes, this work made a comprehensive survey that synthesizes current knowledge on privacy risks and preservation in Explainable AI.", "requested_changes": "### Strengths\n- The survey is well-structured and comprehensive, using a systematic search strategy to provide an overview of privacy risks and preservation methods in XAI.\n- The paper clearly recognizes the trade-off between explainability and privacy, highlighting key challenges in responsible XAI deployment.\n- Visuals and tables clearly summarize research trends, attacks, and defenses for quick understanding.\n\n### Weaknesses\n- While figures show numerical distributions of attacks and methods, they lack summary of their empirical effectiveness or real-world impact, making it hard to assess which approaches are most promising.\n- Many figures are too simple and lack visual appeal.\n- The survey may omit several relevant survey or benchmark studies on privacy risks and preservation in XAI: [1-3]\n\n### Requested Changes\n- Include serval key surveys to strengthen literature coverage.\n- Update XAI categorization to include recent developments of LLMs.\n- Add discussion of open research directions for underexplored risks to guide future work.\n\nOverall, this paper provides a timely and well-structured survey on privacy in XAI, with clear taxonomy and visuals. However, it misses serval relevant works, lacks depth in comparing defenses and privacy-utility tradeoffs, and has limited visual appeal, reducing its engagement for readers. The contribution is solid but incremental, and would benefit from better coverage, analysis, and more compelling presentation.\n\n[1] A Survey of Privacy-Preserving Model Explanations: Privacy Risks, Attacks, and Countermeasures\n\n[2] Privacy-Preserving Explainable AI: A Survey\n\n[3] Privacy Meets Explainability: A Comprehensive Impact Benchmark.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)