Interpreting Global Perturbation Robustness of Image Models using Axiomatic Spectral Importance Decomposition
Authors: Roisin Luo
James McDermott
Colm O'Riordan
Venue: Accepted by TMLR ()

Abstract: Perturbation robustness evaluates the vulnerabilities of models, arising from a variety of perturbations, such as data corruptions and adversarial attacks. Understanding the mechanisms of perturbation robustness is critical for global interpretability. We present a model-agnostic, global mechanistic interpretability method to interpret the perturbation robustness of image models. This research is motivated by two key aspects. First, previous global interpretability works, in tandem with robustness benchmarks, *eg.* mean corruption error (mCE), are not designed to directly interpret the mechanisms of perturbation robustness within image models. Second, we notice that the spectral signal-to-noise ratios (SNR) of perturbed natural images exponentially decay over the frequency. This power-law-like decay implies that: Low-frequency signals are generally more robust than high-frequency signals -- yet high classification accuracy can not be achieved by low-frequency signals alone. By applying Shapley value theory, our method axiomatically quantifies the predictive powers of robust features and non-robust features within an information theory framework. Our method, dubbed as **I-ASIDE** (**I**mage **A**xiomatic **S**pectral **I**mportance **D**ecomposition **E**xplanation), provides a unique insight into model robustness mechanisms. We conduct extensive experiments over a variety of vision models pre-trained on ImageNet, including both convolutional neural networks (*eg.* *AlexNet*, *VGG*, *GoogLeNet/Inception-v1*, *Inception-v3*, *ResNet*, *SqueezeNet*, *RegNet*, *MnasNet*, *MobileNet*, *EfficientNet*, *etc.*) and vision transformers (*eg.* *ViT*, *Swin Transformer*, and *MaxViT*), to show that **I-ASIDE** can not only **measure** the perturbation robustness but also **provide interpretations** of its mechanisms.

Published in Transactions on Machine Learning Research (224)
Interpreting Global Perturbation Robustness of Image Models using Axiomatic Spectral Importance Decomposition
Róisín Luo (Jiaolin Luo)
James McDermott
jomes. aamesmmmdddetttbunneeeeehhhooooo
Colm O'Riordan
colm. oelh..oriontan@@@uoiiieesststtpp
SPT Centre for Research Training in Artificial Intelligence School of Computer Science, University of Galway Galway, H91 TK33, Ireland
Reviewed on OpenReview: https: // openreview. net/ forum? id= uQYodooo
Abstract
Perturbation robustness evaluates the vulnerabilities of models, arising from variety of perturbations, such data corruptions and adversarial attacks. Understanding the mechanisms of perturbation robustness critical for global interpretability. We present model-agnostic, global mechanistic interpretability method to interpret the perturbation robustness of image models. This rescarch is motivated by two key aspects. First, previous global interprelability works, in landem with robustness benchmarks, e.g. mean corruplion error (mCE), are not designed to directly interpret the mechanisms of pertur robustness within image models. Second, we notice that the spectral signal-to-ne ratios (SNR) of perturbed natural images exponentially decay over the frequency. This power- lowerllawlikke decay implies that: Tow-frequency signals are generally more robust than high-frequency signals yet high classification accuracy not be achieved by low-frequency signals alone. By applying Shapley value theory, our method axiomatically quantifies the predictive powers of robust features and non-robust features within an information theory framework. Our method, dubbed as I-ASIDE (Image Axiomatic Spectral Importance Decomposition Explanation), provides a unique insight into model robustness mechanisms. We conduct extensive experiments over variety of vision models pre-trained on ImageNet, including both convolutional neural networks (e.g. AlexNet, VGG, ResNet, SqueezeNet, RegNet, MnasNet, MobileNet, EfficientNee, etc.) and vision transformers (e.g. ViT, Swin Transformer, and Max to show that I-ASIDE can not only measure the perturbation robustness but also provide interpretations of its mechanisms.
htt.eeeoe//ctttinnni,, Inception-e3,
1 Introduction
Image modeling with deep neural networks has achieved great success (Li al., 2021 Khan et al. 2022 Han et al. 2022). Yet, deep neural networks are known to be vulnerable to perturbations. For example, the perturbations may arise from corruptions and adversarial attacks (Goodfellow al. 2014 Hendrycks & Dietterich 2019 Szegody et al. 2013), etc. Perturbation robustnoss, henceforth referred to as robustness.
characterizes a crucial intrinsic property of models (Hendrycks & Dietterich 2019 Bai et al. 2021 Goodfellow
et al. 2014 Silva & Najafirad 2020).
Robustness mechanisms refer to the mochanisms which lead robustness in models. The study of robustness mechanisms aims to answer the question 'why some models are more robust than others' (Lipton 2018
Zhang et al. 2021 Bereska & Gavves 2024). The causes within this question arise from multifarious

---

Published in Transactions on Machine Learning Research /224)
Reference image
Fourier spectrum
L
ESD
Typ is a radial path with radius r mea- sured with co-norm.
To
T
IM--2 IM-
Robust features (RF) Non-robust features (NRF)
The 2D spectrum is mapped into ID radial spectrum and further divided into M bands which are denoted from To IM-1-
Figure 1: Power-law-like energy spectral density (ESD) distribution of natural images over the frequency. The signal spectrum is divided into M bands (from To to Ims-)). Each spectral band is robustness band.
aspects, including architecture designs Zhou al. 2022), data annotations, training methods (Pang et al. 2020). inferences, etc. For example, noisy labels can arise from data annotations (Frénay & Verleysen 2013 Wei et al.] 2021); adversarial atlacks often take place in inferences. This research provides a unified view regarding the mechanisms of image model robustness on spectra. We only focus on global interpretation of robustness mochanisms of image models. Our method is primarily motivated by two key aspects, as detailed below.
Despite the substantial advances in previous global interpretability works (Covert et al.) 2020 Kolek al, 2022), in tandem with the wide adoption of empirical robustness benchmarks (Hendrycks & Dietterich 2019 Zheng et al. 2016 Zhang al. 2021), these methods not designed to provide global interpretations regarding model robustness. For example, SAGE (Covert et al. 2020). a global interpretability work, can attribute the decisive pixel features in decision-makings. Yet, the importance of decisive pixel features fails to interpret the global robustness. Although the robustness of image models can be quantified by mean corruption errors (mCE) ([endryycks & Dietterich] 2019) or the distances feature spaces between clean and perturbed image pairs (Zheng al.] [0166] Zhang et al. 2021). these scalar motrics often fall short interpreting the underlying 'why" question. This gap prompts us to provide global mechanistic interpretations of perturbation robustness.
Motivation also ariscs from the robustness characterization of the spectral signals within natural images. Images can be represented as spectral signals (Körner 2022 Sherman & Butler 2007). The hignal-to-noise ratios (SNR) (Sherman Butler 2007) of spectral signals can be used to characterize the signal robustness with respect to perturbations. Our later empirical study, as illustrated in Figure 2 suggests that the spectral SNRs of perturbed natural images decay over the frequency with power-law-lin distribution. We refer the spectral SNR the ratio of the point-wise energy spectral density (FSD) (Stoica et. al. 2005) of spectral signal to noise (i.e. perturbation):
ESD,(w)
SNR(r)
(1)
(AD,(Az)
where r is a radial frequency point, x is an image, Ar is the perturbation, ESD,()) gives the point-wise energy density at r. The ESD,(.) is defined as:
(.) = [rl (u,r)eL
1
Σ (f(x))u,))
(2)
2

---

Published in Transactions on Machine Learning Research (22l)
where Ly denotes a circle illustrated in Figure 1 the 2D Discrete Fourier Transform (DFT) of x. Readers can further refer to more details in Appendix B.1
| denotes the circumference of Lr, and F(x) denotes
Why do the spectral SNRs of some corruptions and adversarial attacks exhibit a power-law-like decay over the frequency? We surmise that the ESDs of many perturbations are often not power-law-like, while the ESDs of natural images are power-law-like empirically, as shown in Figure I For example, the spatial perturbation drawn from (N, x²) (i.e. white noise) has a constant ESD: ESD,( o². In Figure 2 we characterize the spectral SNR. distributions of perturbed images. We set the energy of perturbations to 10% of the energy of the clean image for a fair comparison. The perturbation sources include corruptions (Hendrycks & Dietterich 2019) and adversarial attacks (Szegody et al.) 2013 Tsipras et al. 2018). We notice that the SNR distributions are also power-law-like over the frequency. We refer to spectral signals as spectral features or simply as features if without ambiguity. This power-law-line SNR decay suggests an empirical feature robustness prior: Low-frequency features are robust. features (R.s) while high-frequency features are non-robust features (NRFs). The experiments in Figure demonstrate that models trained with low-frequency signals exhibit. higher robustness compared to the models trained with high-frequency signals. This also echoes with our earlier claim "low-free low-frequency signals are generally more robust than high-frequency signals - yet high classification accuracy can not be achieved by low-froquency signals alone".
Contributions. By applying the Shapley value theory framework (Shapley 1997 Roth 1988 Hart 1989
we are able to assess the predictive powers (Zheng & Agresti 2000) of RFs and NREs. Further leveraging a specifically designed characteristic function of the Shapley value theory framework, the predictive powers are assessed on the basis of their information gains. I-ASIDE uses information theory within the Shapley value theory framework, for interpreting robustness mechanisms, detailed in Section 3 contributions as:
We claim our major
We propose a model-agnostic, global interpretability method, for interpreting robustness mechanisms of image models, through the lens of the prodictive powers of robust features and non-robust features;
We analyze the robustness mechanisms of image models within information theory on spectra;
We showcase a case study that I-ASIDE has the potential to interpret how supervision noise levels affect model robustness.
2 Notations
Image classifier. The primary task of an image classifier is to predict the probability distributions over discrete classes for given images. We use Q(y[=;;) 0) (z, v) [0, 1] denote a classifier in the form of conditional probability. The Q predicts the probability that an image x is of class y. The O are the parameters. For brevity, we ignore the parameter 0. For example, denote Q(yl:; 0) as Q(y(z).
Dataset and annotation. We use tuple (X,)") to denote an image classification dataset, where X' is the image set and y is the label set. We use [}] to denote the number of classes (i.e. the cardinality of set ) The annotation task of image classification datasets to assign each image with a discrete class probability distribution. We use P(y|=) denote the ground-trute probability that an image x is assigned as a class y. We use P(z) to denote the probability of in set X. We use P(y) to denote the probability of y in set V. In class-balanced datasets, P(y) [-1-
3 Method
High-level overview. We apply Shapley value theory for axiomatically assigning credits to spectral bands. Within this framework, the specially devised characteristic function measures the information gains of spectral bands. I-ASIDE interprets robustness mechanisms using this axiomatic framework with the information theory.
Problem formulation. Quantifying the predictive powers of features can be viewed a value decomposition problem. In this research, the value is the information quantities that the features contribute to decisions.
3

---

Published in Transactions on Machine Learning Research (224)
FGSM attack
PGD attack
Poisson
SparseFool attack
Gaussian-blur
Pixel attack
Salt-and--ppper
White noise
60
RFs (Higher SNR)
10 log SNR (dB)
40
Perturbatious begin to overwhelm NRFs
20
NRFs (Lower SNR)
30
90
Radial frequency (r)
Spectral SNR characterization with multiple corruptions and adversarial attacks. The corruptions include: white noise, Poisson noise, Salt-and-pepper noise, and Gaussian blur. The adversarial attacks include: FGSM (Goodfellow et al. 2014), PGD (Madry ct al., 2017), SparsoFool (Modas et al. 2019) and Pixel (Pomponi et al. 2022). We set the perturbation energy to 10% of the energy of the reference image. The results are shown decibels (dB) for better visualization. The dB below zero indicates that the perturbations overwhelm the spectral features.
Figure 2:
Specifically, the value in the form of the logllikelihood expectation of predictions (i.e. the negative cross- entropy loss). The value decomposition aims assign each robustness band predictive power such that: (1) The sums of the predictive powers equal to the value, and (2) the assigned predictive powers should reflect their imporlance in the decisions. In the coalitional game theory, this decomposil scheme is known as an ariomatic fairness division problem (Roth 1988 Hart 1989 Winter 2002 Klamler 2010 Han & Poor 2009). The fairness division must satisfy four axioms: efficiency, symmetry, lincarity and dummy player Roth 1988 We refer to the ariomatic fairness division as axiomalic decomposition. Of the scheme, the
axioms guarantee uniqueness and fairness (Aumann Maschler 1985 Yaari & Bar-Hillel] 1984 Aumann
& Dombb 2015 Hart 1989 Roth 1988). The property fairness refers to the principle 'equal treatment of
equals' Yokotte et al. 2019 Navarro 2019) Shapley value theory is the unique solution satisfying the above
axioms. However, the theory merely provides an abstract framework. To employ, we have to instantiate two
abstracts: (I) players and coalitions, and (2) characteristic function.
Abstract (1): players and coalitions. The spectral bands are dubbed as spectral players. A subset of the spectral player set. dubbed as spectral coalition. The details are as shown in Section 3.T The M spectral players can forge 2M spectral coalitions. We represent the presences and absences of the spectral players the pass-bands and stop-bands in a multi-band-passs digital signal filter (Oppenheim) 1978 Roberts & Mullis
1987 Pei & Tseng 1998) shown in Section 3.2
A Abstract (2): characteristic function. The characteristic function is designed to measure the contributions that the coalitions contribute in decisions. The contributions of the 2M coalitions are then combined to compute their marginal contributions decisions. We specially design the characteristic function, as shown in Section 3.3 and Appendix B.3, mcasure the information gains. Figure the framework of applying the Shapley value theory. Figure shows the block diagram of the spectral coalition filtering. Figure shows example of 2M spectral coalitions.
4

---

Published in Transactions on Machine Learning Research (22l)
Training on three datasets
[0, 1] full-freq
[0, 0.3] low-freq
[0.3. 1] high-frey
training Irequency range
clean
full-freq
low-freq
high-
[0.1]
[0.
[0.3, 1]
train
98.05%
97.13%
96.. 18%
Validation set
val. aoc. w/ clean
16%10%
98.80%
58.70%
generalivation gup
-1.95
+1.67
33.48 1
noc. w/ Gaussian
92.60%
98.00%
70%7
w/ Gaussian
generalization gup
-5.45
+0.87
-69.88
Figure 3: Understanding the role of spectral signals. We train a resnet18 on three datasets derived from STL10 (Coates et al., 2011): [0, 1] contains full fullffreuency signals; [0, 0.3] only contains low-frequency signals with a cut-off frequency by 0.3; and [0.3, 1] only contains the high-frequency signal with cut-off frequency by 0.3. In the derived datasets, the filtered high low frequency signals are randomly replaced by the high or low frequency signals sampled from the full-frequency train set. We visualize the embeddings in the left figure with respect to clean samples and perturbed samples with Gaussian noise (a 0.1). The samples are from the validation set. The accuracy on both the train and validation sets is provided in the right table. We also provide generalization gaps, measured by the differences between validation accuracy and train accuracy (i.e. acCeal acCtrain). We have noted that: (1) both high-frequency and low-frequency signals contain sulficient discriminative information to achieve high training accuracy; (2) high-frequency signals alone are not robust signals because they fail to generalize well from train to validation; (3) overall, lowffrequency signals are more robust signals because models trained alone with them generalize better and exhibit higher
robustness. We summarize these empirical observations into Assumption 3.8
We organize the implementation details of instantiating the aforement ioned two abstracts from three aspects: (1) formulating spectral coalitional game, (2) the implementation of spectral coalitions and (3) the design of the characteristic function.
3.1 Spectral coalitional game
Spectral player. We use I, (where i [M]] := {0, 1,... .......--- 1M1)) 13) to denote the i-th spectral player. The In contains the most robust features and the IM-1 contains the most non-robust features. The M spectral players constitute player set I = (I Figure 15 in Appendix C.1 shows two partition schemnss to partition spectral bands (f,, and l2). We empirically choose Ex.
Spectral coalition. A subset ī s I is referred to the spectral coalition. The player set I is often referred to as the grand coalition.
Characteristic function. A characteristic function v²²): 7- R measures the contribution for given coalition and satisfies v(Ø)- = 0. In this research, the contribution of Ī is measured in the form of the log-likelihood expectation of the predictions by the Q, in which the input images only contain the signals present in the Z. We show that this design of v theoretically measures how much information the Q uses from the features in the for decisions.
Shapley value. spectral coalitional game (I,z) is defined on a spectral player set equipped with a characteristic function v. The weighted marginal contribution spectral player I, over all possible coalitions is referred to as the Shapley value of the spectral player I, We use (T) to represent. the Shapley value of
5

---

Published in Transactions on Machine Learning Research (22l)
Coalitions for on image #
Predicted distributions
For each coalition, the measures information festures the coalition contribute decision.
Spectral importance dis- triburion
?
Q(alz)
Chansteneis function etz) R.
Estreating robea- res: hard
Coalition filtering
Imarge set
chassifier
predicts the class distri- butions coalitions.
lomatically assign each mhuus- band imporiance valla..
Summarizing naceory
Label set
Example
image
Figure 4: Framework of applying Shapley value theory. Spectral coalition filtering creates spectral coalitions over X. Each coalition contains a unique combination of spectral signals, in which some spectral bands are present and others are absent. The coalitions are fed into a classifier Q. For each coalition, Q outputs the predictions. The characteristic function then uses the predictions to estimate the contributions of the Teatures present in the coalitions. The results from v are combined to compute the marginal contributions of spectral bands i.e. the spectral importance distribution of Q
the player 4. The Shapley value (I, is uniquely given by:
П 1)
(I,
Σ
{o(I ((t)) - -I+))=v(( v(t)
(3)
M
IEAI
where 1 (M-1) M
(M [2]
gives the weight of the player Ij presenting in the coalition Ż.
Spectral importance distribution (SID). We use (p)) (17) E R to denote the collection of
w(r)- min w(v) (I. over all players. We min-man max normalize (((v) by taking ((() min P(oi The reason for
normalizing the SIDs is that want to scalarize the SIDs for numerical comparisons. The V(() is referred to spectral importance distribution. Figure shows examples of the spectral importance distributions of trained and un-trained models.
Spectral robustness score (SRS). We can also summarize spectral importance distributions into scalar values. We refer to the summarized scalar values as spectral robustness scores. We use S(v) : v - [0, 1] to denote the summarizing function.
3.2 Spectral coalition filtering
We represent the presences and absences the spectral players through the signal pass-bands and slop-bunds
using multi-band-pass digital signal filtering (Oppenheim) 1978 Pei & Tseng 1998 Steiglitz 2020). shown in Figure 5 For example, the example spectral coalition (In In] signifies the signals present only in Io and Iz. With the spectral coalition filtering, of various spectral features. Figure
able evaluate the contributions of the combinations T shows an example of 2M spectral coalitions.
To implement the presences and absences of spectral signals, we define a mask map T(Ō) -
- {0, M
2D spectrum, where 7 is spectral coalition and M x N denotes 2D image dimensions. The mask map is piint-wiscly defined as:
11, if the frequency point (m,n) is present in coalition I,
T (m)
(4)
0, otherwise

---

Published in Transactions on Machine Learning Research /22l)
TT()
A spectral coali- (g)
tion
Hadamard product
Fix) r()
7
DFT
(x)
Figure 5: Spectral coalition filtering. In this example, the mask map T (2) (i.e. transfer function) only allows to pass the signals present in the spectral coalition (Io.I2): The M is 4 and the absences are assigned to zeros. The images after spectral coalition filtering (xr be 7) are then fed into frozen classifiers to assess the contributions of spectral coalitions. The binary operation notation ba denotes coalition filtering given by Definition 3.1 The notation O denotes Hadamard product.
where (m.n) [M] x [M]
In the digital signal processing literature, this mask map is known as a. transfer function (Steiglitz. 2020). In the 2D mask map, the frequency points 'I' in pass-bands (presences) and '0' in stop-bands (absences). The process of spectral coalition filtering with the mask map for given spectral coalition I is shown as in Figure
We apply the transfer function T on the spect.ra of images with element-wise product (i.e. Hadamard product (Horn 1990 Horadam 2012)). ). Let f be the Discrete Fourier transform (DFT) operator and f
be the inverse DFT (IFT) operator (Tan & Jiang 2018). Readers can further refer to Appendix B.1
Definition 3.1 (Spectral coalition filtering). We define a binary operator "s to represent the signal filtering by:
I :-
f(x) Spectral presence
(1-
(5)
Spectral absemre
where O denotes Hadamard product (iee element-woise product), MxN denotes an all-ones matris and b CM represents the assignments of the absences of spectral players. In the context of attribution analysis, is oflen referved as the baseline. our implementation, we empirically set b =.
Remark 3.2 (Absence baseline). Formally, in the context of attribution analysis, the term "baseline' defines the absence assignments of players (Sundarrajaan et al. 2017: Shrikumar et al. 2017: Binder et al. 2016). For ezample, if we use 'zeros' to represent the absence of players, the 'zeros" are dubbed as the "baseline" in the attribution analysis. We have discussed multiple baselines in Appendix B.2.
Definition 3.3 (Spectral coalition filtering over set). Accordingly, we define the filtering over a set as:
X m i
( X7.
3.3 Characteristic function design
The characteristic function needed order to measure the contributions of the features in Ż. We define the characteristic function the gains of the negative cross-entropy loss values between feature presences and absences.

---

Published in Transactions on Machine Learning Research JJll/20224
0000
0001
0010
0011
0100
0101
0110
0111
1000
1001
1010
1011
1100
1101
1110
Figure 6: An example of a complete 2M spectral coalitions. This example shows 16 spectral coalitions with 4. Each coalition provides various information relevant decisions. Each image a coalition. Each coalition contains a unique spectral signal combination. We use binary code index these coalitions. The '1' in the i-th position indicates the presence of the i-th player. For example, 1001 indicates the presences of two spectral players (Io and Iz) in the coalition.
Definition 3.4 (Characteristic function). The characteristic funcciion u v( I I R. is defined
Σ yEy
P(ylx) log Q(yl xe D. P(yla) log Q(y1 DO Ø
Feature presence
Absence baseline
= E
P(ulz) log x
(7)
yEV
where the consland lerm C as the Dummy player constant.
=
E x~X
Σ
P(ylx) log Q(yl 2n Ø) used fulfil v( 0. We refer to the C
vEy
Remark 3.5. If the labels are one-hot, then Equation
is simplified into:
log Q2yln i) v(I)= (X,)
(8)
and : (X,)
E log Quv|x D Ø)
Linking information theory. The relationship between information thoory and the characteristic function in the form of negative log-likelihood of Bayes classifiers has been discussed in the literature (Coverl) show that the e in Equation 7 profoundly links to information theory in terms of spectral signals. The maximal information of features relevant to labels in ī is the mutual information I(X'' P4 Σ,)). A classifier Q can merely utilize a proportion of the information. Theorem states information quantity identity regarding the 1(X' x I, and the v. The term [xI[P]IQ] measures the point-wisc (i.e. for an image x) KI-divergence between the predictions and ground-truth truth labels. On the basis of the information quantity identity, the can be interpreted as the information gains between the presences and absences of the features, which the Q utilizes in decisions from the Ž. By enumerating all coalitions, the information gains are then combined to compute the marginal information gains of features decisions via Equation
et al. 2020 Aas al., 2021 Lundberg & Lee 2017 Following from their discussions,
Theorem 3.6 (Spectral coalition information identity). The information quantily relationship is given as:
I(X (MMi.y)
E Dkr|P(y]e)lQ((lll))) H()) +
ZEXKI
where is defined in Equation and H()) is the Shannon entropy of the label set Y. The proof is provided in Appendix B.3.

---

Published in Transactions on Machine Learning Research (July/202)
efficientne.y2.s
@ @InggeNet- (pe-trained)
Importance
0.5
0.5
Importancc
0.5
0.0
0.0
F1
74
X4
T5
74
77
F6
14
41
11
15
NAY
Spectrum (RF
NAF)
Spactrum 2 NI91
Spectuu KINE - MRF)
@ ImogeeNee (randion weights)
Impottance
Importace
0.5
0.5
0.5
0.5
0.0
52
53
Spiddrum
NRF7
Spectram
Spectrum
Figure 7: Spectral importance distributions (SIDs) of trained models and un-trained models. The experimental models are pre-trained on ImageNet. We also include the models with random weights as a control marked by the blue box. We have noticed that: (1) The spectral importance distributions of trained models exhibit non-uniformity, and (2) the spectral importance distributions of un-trained models exhibit uniformity. We summarize these empirical obsorvations as Assumption 3.7
3.4 Spectral robustness score (SRS)
Although we are firstly interested in using the spectral importance distributions (SID) for robustness interpretations, they can also be summarized into scalar scores for purposes such as numerical comparisons, and later correlation studies.
Assumption 3.7 (Spectral uniformity assumption of random decisions). The second row in Figure 7 shows the SIDs from various models with randomized weights. We randomize the model weights with Kaöming initialization [He et al., 2015). The measured SIDs exhibit spectral uniformity. This suggests: Un-traines models do not have spectral preferences. We refer to 'the models with randomized parameters as random decisions. Therefore, we assume that the SIDs of random decisions are uniform: X
Assumption 3.8 (Robustness prior). We assume: Higher utilization of robust features in decisions implies robust. models. This is further substantiated by the experiments in Figure To reflect this robustness prior, we empirically design series B == (50, "...... ..,,,-111"" where 3 (0. as the summing weights of SIDs. Empirically, we choose 3 = 0.75 because this choice achieves the best correlation with model robustness.
Summarizing with weighted sum. Let (1()) be the measured spectral importance distribution (SID). Set (vo) (()) with min-max normalization. The weighted sum of the (v() with the weights B is (1) = Tiie)-mia Ve]l
given by:
Ba (v) gr 1
(10)
M
where 8 1 is served as random decision baseline. Let S(v) : - [0, 1] be the normalized result in
Equation 10 The S(v) is given by:
13
3T B (v)
TT)
T
S(u)
M ST M
(11)
sup
where E (0, 3 deduction.
|a and = M7
18 1
Readers can refer to Appendix C.2 for the simplification
4 Experiments
We design experiments to show the dual functionality of I-ASIDE, which can not only measure robustness and but also interpret robustness. We organize the experiments in three categories:

---

Published in Transactions on Machine Learning Research (July/2024)
UapeeZenet
100
Nennet
coruption
19911
ssset11
80
efficisatret
70
0.30
Spectral robustness score (Low-robust Highrobust)
Figure 8: The spectral robustness scores (SRS), measured with I-ASIDE, correlate to the mean corruption errors (mCE) in the literature (Hendrycks & Dietterich, 2019).
Section
4.1
Correlation to a variety of robustness metrics;
Section
4.2
Studying architectural robustness;
Section
4.3
A case study interpreting how supervision noise levels affect model robustness.
Section 4.1 shows that the scores obtained with I-ASIDE correlate with the model robustness scores measured with other methods. Section 4.2 and Section 4.3 show that I-ASIDE is able to interpret robustness by examining SIDs.
and 200 samples to conduct experiments. We choose 200 samples because the experiments in Appendix C.3 The experiment shows that: A small amount of examples are sufficiently representative for spectral signals.
Reproducibility. We choose
4.1 Correlation to robustness metrics
Definition 4.1 (Mean prediction error). our experiments, we measure model perturbation robustness with mean prediction errors (mPE) besides the mean corruption errors (mCE). Let x be some clean image and x be the perturbed image. For classifier Q, define the mean prediction error (mPE)
AP
1Q())z) Q(yl=*))
(12)
(X.))
We demonstrate that I-ASIDE is able mcasure model robustness. The experiments are broken down into three aspects: (1) correlation to mCE scores, (2) correlation to adversarial robustness, and (3) correlation to corruption robustness.
Correlation to mCE scores. Figure shows the correlation between spectral robustness scores (SRS) and the mean corruption errors (mCE). The mCE scores are taken from the literature (Hendrycks & Dietterich, 2018). The mCE scores are measured on a corrupted ImageNet which known as ImogeNett-C in the literature [endryyks & Dictterich| 2019). The Image.Net-C includes 75 common visual corruptions with five levels of severity in each corruption. This correlation suggests that the results measured with I-ASIDE correlate with the results measured with robustness metric mCF.
10

---

Published in Transactions on Machine Learning Research /224)
10 1M
gegitty 29516
Jeshety. y. 400mi
22
10-92
y9316
Noai prediction ever 1809
ogglnne
10-44
oogienel
prediction
micietteer
Wclentnee
10
vitb
vit b. 1g
10.
10'
0.28
0.30
0.32
0.36
0.26
0.28
0.30
0.34
Spectral robustress score (Low robust High robust)
rooctral score (Low robust High robust)
(a) FGSM (eps 0.1)
(b) FGSM (eps 0.2)
10-19
10-33
regretyy 400m
reghetyy 400mt
10
19916
leneenet 92
10:
y0226
abilene L
enett
Moan predictio enrer (6/9
pogienet
10.10
10-22
poglenet
predicion
10-19
10:44
mocantnin y2.s
Miciantnn
10-14
10-33
vitb_
0.28
0.32 Hig-robustt
0.36
0.26
0.30
0.34
Sp Spectral (Low-robusk High-rebust)
(c) PGD (eps = 0.1)
(d) PGD (eps 0.2)
Figure The spectral robustness scores (SRS), measured with I-ASIDE, correlate with the mean prediction errors (mPE) in adversarial attacks. The circle sizes (b) are proportional to the SRS.
Correlation to adversarial robustness. Figure g shows the correlation between the correlation between spectral robustness scores (SRS) and the mcan prodiction crrors (mPE) of the adversarial attacks with FGSM and PGD. We vary the eps from 0.1 to 0.2. The results show that our scores correlate with the mean prediction errors in various eps settings. This suggests that the results measured by our method correlate with adversarial robustness.
Correlation to corruption robustness. Figure 10 shows the correlation between the correlation between spectral robustness scores (SRS) and the mean prediction errors (mPE) of the corruptions with white noise and Gaussian blurring. We vary the of white noise from 0.1 0.2. We vary the Gaussian blurring kernel sizes from 7 7. The results show that our scores correlate with the mean prediction errors in all cases. This suggests that the results measured by our method reflect the corruption robustness.
11

---

Published in Transactions on Machine Learning Research /22l)
10 14
Jegnety.
Jegrely 400ml
mobienet_y2
gesnt5o
roole
cobileeet
Meai prediction errer 169)
B3net18
10-32
resnel
oogienet
prediction
oogienet
20.71
Aiciintret__2y
micentnet v2
10-
10-45
vit, D.
vit,b1
10
10.9
0.28
0.32
0.36
0.26
0.28
0.30
0.34
Spectral robustress score (Low robust High robust)
Spectral score (Low robust High robust)
(a) White noise (a 0.1)
(b) White noise (a 0.2)
10-4
10-14
y 400mf
mo
abllenett v2
10
y92lo
10-44
resnetso
y99t6
bogienet
Moan Mosn prediction enrer (6/9
10-22
10-23
oagienet
predition
senet2
10-4
10:44
micentnet x2
10-44
10-13
vitbbugg
vit b
0.28
0.32 (Low-robust Hog-robust)
0.36
0.26
0.30
0.34 High-rebust)
Spectral rpectralrobstness
(c) Gaussian- blur (3 x 3)
(d) Gaussian-hee blur (7 x 7)
Figure 10: The spectral robustness scores (SRS), measured with I-ASIDE, correlate to the mean prediction errors (mPE) in corruptions. The circle sizes in (b) are proportional the SRS.
4.2 Studying architectural robustness
I-ASIDE is able to answer questions such as:
Does model parameter size play a role robustness?
Are vision transformers more robust than convolutional neural networks (ConvNets)?
Does model parameter size play role in robustncss? Figure 11 (a) shows parameter counts do
not correlate with model robustness. Thus, the tendency of a model use robust features is not determined by parameter counts alone. We would like to carry out further investigation in future work.
12

---

Published in Transactions on Machine Learning Research /224)
SWIRDD
squmomel13.
Robust modele
Tranefotuxtt
VI 0.0 0.26
mmme0
ConvNess-asio
efficientriet
wide_ wide_resnet101 resnet101
densenet121
mob lend 2
ISNE es
wide resnet50
resnext50
32x44
inceptor
goog
(e0 2
Now-rolust madels
Inception
pooglent
resnet50
resnet18
tensenet22
mobilenet_v2
regnet y 400mf
a comet
ofdontnne v2.5
wice restot202_2
mnasneto v9016
11
squeezenet1_ O
random-decsion
0.35 5.3 0.5
0.1 605
60
80
160
120
140
ISNE
Robusmess (8-01))
Tranatle porameters IK
(a) Spectral robustncss score (SRS) comparison
(b) Spectral importance distribution (SID) t-SNE projection
How do architectural elements affect robustness? The left figure is to answer: "Does model parameter size play a role on robustness?". The right figure, a t-SNE projection of SIDs, to answer: "Are vision transformers more robust than convolutional neural networks?". For the two questions, the answers suggested by using I-ASIDE are yes. But the story is more complicated, we have provided a brief discussion regarding this case study within Section 4.2 We also have noted that efficientnet surprisingly exhibits comparable perturbation robustness as the architectures in Transformer lamily. All experimental models are pre-trained on ImageNet. The circle sizes in (b) are proportional to SRS.
Figure 11:
Are vision transformers more robust than ConyNets? Figure 11 (b) shows a t-SNE projection of the spectral importance distributions of a variely of models. The results show that vision transformers form a cluster (swin_b. b, marvit_ and vit 6 16) and outperform ConvNets in terms of robustness. This results correlate with the recent robustness rescarch in the literature (Paul & Chen 2022 Zhou et al. 2022 Shao et al. 2021). The interpretation is that: Vision transformers tend to use more robust features than
Conv Nets.
Discussion. Vision transformers generally outperform ConvNets; nevertheless, state-of-the-art ConvNets, e.g. efficientnet TTn & Le 2019 can achieve comparable robustness performance (e.g. by error rates on benchmark datasets) (Li Xu 2023). The literature (Devaguptapu et al. 2021) affirms that efficientnet is more robust than most ConvNets. But, why efficientnet is unique? The efficientned introduces an innovative concept in that the network sizes be controlled by scaling the width, depth, and resolution with compound coefficient (Tan & Le 2019). The base architecture is then searched with neural architecture searching (NAS) (Ren et al., 2021) instcad of hand-crafted design. The NAS optimization objective is to maximize the network accuracy subject lo arbitrary image resolutions. The searching implicitly encourages that the network structure of efficientnet uses more robust features. This is because: The low-frequency signals in various resolutions are robust signals while high-frequency signals are not. The second column in Figure 7 shows the SID of efficientnet pro-trained on ImageNet. The SID shows that efficientnet v2 more robust features than alexett and resnel18.
13

---

Published in Transactions on Machine Learning Research (July/2024)
Spoct Immp portance
Spoce im furcce
Supervaion mete
Feature robustness
robustness NRF)
Feature robuctniss MRF)
(a) googlemet
(b) resnet18
(c) mobilenet_ n/2
Figure 12: How do models respond to label noise? Our results show that models trained with higher label noise levels tend to use spectral signals uniformly, í.e. without a preference for robust (low-frequency) features.
4.3 Interpreting how supervision noise levels affect model robustness
The previous robustness benchmarks with mean corruption errors (mCE) are not able to answer the long- standing question: "How and why label noise levels affect robustness?". We demonstrate that I-ASIDE is able answer this question.
Learning with noisy labels. Supervision signals refer to the prior knowledge provided by labels (Sucholutsky
ct al.
2023 Zhang et al. 2020 Shorten & Khoshgoftaar 2019 Xiao et al. 2020). There is a substantial line
of previous research on the question of "how supervision noise affects robustness (Gou et al. 2021 Frénay &
Verleysen 2013
Lukasik et al.) 2020 Rolnick et al.) 2017). This question is not completely answered yet. For
example, Flatow & Penner add uniform label noise into CIFAR-10 and study its impact on model robustness
Flatow & Penner 2017). Their results show that classification test accuracy decrcases as the training label noise level increases. However, empirical studies like this not able to answer the underlying 'why' question.
Noisy-label dataset. We derive noisy-label datasets from clean Caltech101. We randomly assign proportion of labels with a uniform distribution over label classes to create noisy-label dataset. We refer to the randomly assigned proportion as supervision noise level. We vary the noise level from 0.2 to 1.0 to derive five training datasets.
Experiment. We train three models (googlenet, resnet18 and mobilenet_ v2) over the clean and the five noisy-label datasets for 120 epochs respectively. We then measure their SIDs. The results are visualized in Figure 12 with heat maps. The results show that there is pattern across the above three models in that: The SIDs are more uniform with higher supervision noise levels. The interpretation regarding the learning dynamics with the presence of label noise is that: Models tend to use more non-robust features in the presence of higher label noise within training set.
5 Related work
We further conduct a literature investigation from three research lines: (1) global interpretability, (2) model robustness, and (3) froquency-domain rescarch. This literature study shows that I-ASIDE provides unique insights in these research lines.
Global interpretability. Global interpretability summarizes the decision behaviours of models from holistic view. In contrast, local interpretability merely provides explanations on the basis of instances
Selvaraju et. al. 2017 Arrieta el al., 2020 Zhou et al. 2016 Ribeiro et al.] 2016 Lundberg & Lee 2017 Lakkaraju et al. 2019 Guidotti et al,
Jundararaaan et al. 2017 Smilkov et al.
2017 Linardatos et. al. 2020
2018
Bach et al. 2015 Montavon ct al. 2019 Shrikumar al. 2017 There are four major research lines
image models: (1) feature visualization,
(2) network dissection, (3)
concept-based method, and (4) feature
importance.
14

---

Published in Transactions on Machine Learning Research (22l)
Feature visualization seeks the ideal inputs for specific neurons or classes by maximizing activations Olah
et al. 2017 Nguyen et al.) 2019 Zeiler et al.] 2010; Simonyya et al. 2013 Nguyen et. al. 201 6a bb. This
method provides intuitions regarding the question: "What inputs maximize the activations of specific neurons
or classos?". Network dissection aims to connect the functions of network units (e.g. channels or layers) with
specific concepts (e.g. eyes or ears) (Bau el al., 2017). Concept-
methods understand the decisions by answering the question "how do models use set of given concepts in decisions?" (Kim et al. 2018 Ghorbani
eet al. 2019 Koh et al. 2020 Chen et al.) 2020). For example, TCAV explains model decisions by evaluating the importance of a given set of concepts (c.g. the textures dotted, striped and zigzagged) for a given class (e.g. the class zebra) (Kim et al. 2018).
Global input feature importance analysis, often by using Shapley value theory framework, altempts to answer the question: "How do imput features contribute to predictions?" (Altmann et al. 2010 Greenwell et al. 2018
Lundberg & Leej 2017] Ribeiro et al., 2016 [Simonyan et al. 2013) Sundararajan et al, 2017 Covert et al, 2020). However, there are few works falling in the scope of global interpretability with feature importance analysis. A related work, SAGE, applying the Shapley value theory framework, globally assigns spatial input.
features with importance values for interpreting spatial feature contributions (Covert et al. 2020).
Although the aforementioned global interpretability methods provide insights into understanding decisions inside black-box models, they do not provide interpretations regarding robustness mechanisms. Our work fundamentally differs from them in that: We provide interpretations regarding robustness mechanisms. We attempt to answer the fundamental question: "Why some models are more robust than others?".
Model robustness. Model robustness refers to the prediction sensitivity of models perturbations. The perturbations can perturb in spaces such as the input space and the parameter space (Hendrycks & Dictterich 2019: Drenkow et al. 2021). In this research, we focus on the perturbations within the input space. The perturbations can stem from sources such as adversarial attacks (Szegedy et al. 2013 Goodfellow et al. 2014], corruptions (Hendrycks & Dietterich 2019), outliers (Hendrycks et al. 2018a Pang et al. 2021 | and supervision signal noise (Hendrycks et al. 2018b).
Model robustness is often assessed using scalar metrics (Hendrycks & Dietterich 2019 Krizhevsky et al. 2012
Laugros et al. 2019 Taori et al.) 2020). For example, robustness can be mcasured by the distances between clean and perturbed pairs in feature spaces (Zheng et al. 2016) Hendrycks & Dietterich benchmark the corruption robustness with mean corruption errors (mCF) over set of corrupted datasets like ImageNet-CC C' (Hendrycks & Dietterich 2019), using AlexNet (Hendryckk & Dietterich] 2019) as a normalization baseline.
Despite their widespread adoption in previous literature, these scalar metrics lack the ability to provide detailed insights into the robustness mechanisms. Our work not only serves as a robustness metric but also offers mechanistic interpretations, answering the "why" question behind model robustness. This dual functionality distinguishes our approach, providing deeper understanding of the mechanisms.
Frequency-domain research. Neural networks are non-linear parameterized signal processing filters. Investigating how neural networks respond to input signals in the frequency-domain can provide unique insight into understanding its functions. Xu el al.] delve into the learning dynamics of neural net in the frequency-domain (Xu et al.] 2019a b). They present their findings as 'F-Principle' Their work suggests that the learning behaviors of neural networks exhibit spectral non-uniformity: Neural networks fit low-frequency components first, then high-frequency components.
In related study, Tsuzuku & Sato show that convolutional neural networks have spectral non- uni-urifory with respect to Fourier bascs (Tuuzuk & Sato 2019 Later, Wang et al.] connect model generalization
behaviors and image spectrum (Wang et al. 2020 They argue that: (1) The supervision signals provided by
humans use more low-frequency signals in images and (2) models trained on it tend to use more low-frequency
signals. Our showcase experiment in Figure 12 provides the interpretations regarding their empirical findings.
In the interpretability research line within the frequency-domain, Kolek et al. propose 'CartoonX' based the rate-distortion explanation (RDE) framework (Macdonald et al., 2019 Heiß et al.] 2020) The RDE framework identifies decision-critical features by partially obfuscating the features. They refer to 'the prediction errors between clean imputs and the partially obfuscated inputs' as distortions. CartoonX pinpoints the decision- decision-critical critical features within wavelet domain to answer the query: "What features are crucial for
15

---

Published in Transactions on Machine Learning Research 2224)
decisions?" Kolek et al. 2022 Our work differs from CartoonX in that: (1) Our method aims interpret model robustness mechanisms while CartoonX does not, (2) our method is a global interpretability method while CartoonX is local interpretability method, (3) our method analyzes within an information theory framework while CartoonX uses RDE framework, and (4) our method uses Fourier bases while CartoonX uses wavelet bases.
6 Limitations
I-ASIDE provides unique insight into the perturbation robustness mechanisms. Yel, our method has two major limitations: (I) The spectral perspective can merely reflect one aspect of the holistic view of model robustness, and (2) the SID resolutions are low.
Limitation (1). For example, carefully crafted malicious adversarial perturbations on low-frequency components can fool neural networks (Luo et al.) 2022; Liu et al. 2023 Maiya et al., 2021). Luo et al, demonstrate that attacking cow-frquunccy signals can fool neural networks, resulting attacks which are imperceptible humans. This further implies the complexity of this research topic.
Limitation (2). The computation cost is imposed by O(2"). Fortunately, do not need high SID resolution to analyze the model robustness problem. For example, choice with M 8 is sufficient to interpret robustness mechanisms (as we have shown) while the computational cost remains reasonable.
7 Conclusions
On the solid ground provided by information theory and coalitional game theory, we present an axiomatic method to interpret model robustness mechanisms, by leveraging the power-law-like decay of SNRs over the froquency. Our method addresses the limitation that scalar metrics fail to interpret robustness mechanisms. We carry out extensive experiments over variety of architectures. The SIDs, when scalarized, can largely reproduce the results found with previous methods, but addresses their failures to answer the underlying 'why' questions. Our method goes beyond them with the dual functionality in that: I-ASIDE can not only measure the robustness but also interpret its mechanisms. Our work provides a unique insight into the robustness mechanisms of image classifiers.
Acknowledgments
This publication has emanated from research (conducted with the financial support of/supported in part by grant from] Science Foundation Ireland under Grant number //CRT/6223 For the purpose of Open Access, the author has applied CC BY public copyright licence to any Author Accepted Manuscript version arising from this submission. We also thank reviewers for their constructive comments which can significantly improve our research quality. We thank the support from the ICHEC (Irish Centre for High-End Computing). We also thank the help from Prof. Dr. Michael Madden from University of Galway, Ireland.
References
Kjersti Aas, Martin Jullum, and Anders Løland. Explaining individual predictions when features dependent: More accurate approximations to shapley values. Artificial Intelligence, 298:103502, 2021.
André Altmann, Laura Toloşi, Oliver Sander, and Thomas Lengauer. Permutation importance: corrected feature importance measure. Bioinformatics, 26(10):1340-1347, 2010.
Alejandro Barredo Arrieta, Natalia Diaz-Rodríguez, Javier Del Ser, Adrien Bennetot, Siham Tabik, Alberto Barbado, Salvador García, Sorgio Gil-López, Daniel Molina, Richard Benjamins, et al. Explainable artificial intelligence (xai): Concepts, taxonomies, opportunities and challenges toward responsible ai. Information fusion, 58:82-115 2020.
Robert Aumann and Michael Maschler. Game theoretic analysis of a bankruptcy problem from the talmud. Journal of economic theory, 36(2):195-213 1985.
16

---

Published in Transactions on Machine Learning Research (22l)
Yonatan Aumann and Yair Dombb. The efficiency of fair division with connected pieces. ACM Transactions on Economics and Compulation (TEAC), 3(4):1-16, 2015.
Sebastian Bach, Alexander Binder, Grégoire Montavon, Frederick Klauschen, Klaus-Rober Müller, and Wojeiech Samek. On pixel-wise explanations for non-lincar classifier decisions by layer-wise relevance propagation. PloS one, 10(7):a0130140, 2015.
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness. arXiv preprint arXiv:2102.0188 2021.
David Bau, Bolei Zhou, Aditya Khosla, Aude Oliva, and Autonio Torralba. Network dissection: Quantifying interpretability of deep visual representations. In Proceedings of the IEEE conference on computer vision and pottern recognition, pp. 6541 6549, 2017.
Lconard Bereska and Efstratios Gavves. Mechanistic interpretability for ai safety-a review. arXiv preprint arXiv:2444.14082, 2024.
Alexander Binder, Grégoire Montavon, Sebastian Lapuschkin, Klaus-Robert Müller, and Wojeiech Samek. Layer-wise relevance propagation for neural networks with local renormalization layers. In Artificial Newral Networks and Machine -CCAN 2016: 25th International Conference Artificial Neural Networks, Barcelona, Spain, September 6-9, 2016, Proceedings, Part II 25, pp. 63-71. Springer, 2016.
Zhi Chen, Yijie Bei, and Cynthia Rudin. Concept whitening for interpretable image recognition. Nature Machine Intelligence, 2(12):772- 78772-72,220 2020.
Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In Proccedings of the fourteenth international conference artificial intelligence and statistics, pp. 215 223. JMLR Workshop and Conference Proceedings, 2011.
Ian Covert, Scott M Lundberg, and Su-In Lec. Understanding global feature contributions with additive importance measures. Advances in Neural Information Processing Systems, 1117222-17222 2020.
Chaitanya Devaguptapu, Devansh Agarwal, Gaurav Mittal, Pulkit Gopalani, and Vineeth N Balasubramanian. On adversarial robustness: A neural architecture search perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 152-161, 2021.
Nathan Drenkow, Numair Sani, Iya Shpitser, and Mathias Unberath. A systematic review of robustness in deep learning for computer vision: Mind the gap? arXiv preprint #xXi:2112200639) 2021.
David Flatow and Daniel Penner. On the robustness of convnets to training noisy labels. Technical report, Stanford University, 2017.
Benoît Frénay and Michel Verleysen. Classification in the presence of label noise: a survey. IEEE transactions on neural networks and learning systems, 25))):845 869, 2013.
Amirata Ghorbani, James Wexler, James Y Zou, and Been Kim. Towards automatic concept-based explanations. Advances in Neural Information Processing Systems, 32, 2019.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6577, 2014.
Jianping Gou, Baosheng Yu, Stephen Maybank, and Dacheng Tao. Knowledge distillation: A survey. International Journal of Computer Vision, 1889 2021.
Brandon M Greenwell, Bradley C Boehmke, and Andrew J McCarthy. A simple and effective model-based variable importance measure. arXiv preprint arXiv:1805.0477 755, 2018.
Riccardo Guidotti, Anna Monreale, Salvatore Ruggieri, Dino Pedreschi, Franco Turini, and Fosca Giannotti.
Local rule-based explanations of black box decision systems. Xrx preprint arXiv: 10820, 2018.
17

---

Published in Transactions on Machine Learning Research (22l)
Kai Han, Yunhe Wang, Hanting Chen, Xinghao Chen, Jianyuan Guo, Zhenhua Liu, Yehui Tang, An Xiao, Chunjing Xu, Yixing Xu, et al. A survey on vision transformer. 1EEE transactions pollern analysis and machine intelligence, 45(1):87 1108871110,,111 2022.
Zhu Han and H Vincent. Poor. Coalition games with cooperative transmission: cure for the curse of boundary nodes in selfish packet-forwarding wireless networks. 1EEE transactions communications, 5T (1):203-213, 2009.
Sergiu Hart. Shapley value. In Game theory, pp. 210 216. Springer, 1989.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human- level performance on imagenet classification. In Proceedings of the IEEE international conference on computer vision, pp. 1026 1034, 2015.
Cosmas HeiB, Ron Levie, Cinjon Resnick, Gilla Kutyniok, and Joan Bruna. In-distribution interprelability for challenging modalities. arXiv preprint arXiv:2007.0075. 2020.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robust to common corruptions and perturbations. arXiv preprint w:Xiv:193.112601 2019.
Dan Hendrycks and Thomas G Dietterich. Benchmarking neural network robustness to common corruptions and surface variations. ar preprint orXiv:1807.01697, 2018.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure.
arXiv preprint Xrx:::182..0 04666, 2018a.
Dan Hendrycks, Mantas Mazeika, Duncan Wilson, and Kevin Gimpel. Using trusted data to train deep networks on labels corrupted by severe noise. Advances in neural information processing systems, 31, 2018b.
Kathy J Horadam. Hadamard matrices and their applications. Princeton university press, 2012.
Roger Horn. The hadamard product. In Proc. Symp. Appl. Math, volume 40, pp. 87 169, 1990.
Salman Khan, Muzammal Naseer, Munawar Hayat, Syed Waqas Zamir, Fahad Shahbaz Khan, and Mubarak
Shah. Transformers in vision: A survey, ACM computing surveys (CSUR), 54(105):1 41, 2022.
Been Kim, Martin Wattenberg, Justin Gilmer, Carrie Cai, James Wexler, Fernanda Viegas, et al. Interpretability beyond feature attribution: Quantitative testing with concept activation vectors (tcav). In International conference on machine learning, pp. 2668-2677 2677. PMLR, 2018
Christian Klamler. Fair division. Handbook of group decision and negotiation, pp. 183 202, 2010.
Pang Wei Koh, Thao Nguyen, Yew Siang Tang, Stephen Mussmann, Emma Picrson, Been Kim, and Percy Liang. Concept bottleneck models. In International Conference on Machine Learning, pp. 5338 5348. PMLR, 2020.
Stefan Kolek, Duc Anh Nguyen, Ron Levie, Joan Bruna, and Gitta Kutyniok. Cartoon explanations of image classifiers. In European Conference on Computer Vision, pp. 443-458. Springer, 2022.
Thomas William Körner. Fourier analysis. Cambridge university press, 2022.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012.
Himabindu Lakkaraju, Ece Kamar, Rich Caruana, and Jure Leskovee. Faithful and customizable explanations of black box models. In Proceedings of the 2019 AAAT/ACM Conference AI, Ethics, and Society, pp- 131-138, 2019.
Alfred Laugros, Alice Caplier, and Matthicu Ospici. Are adversarial robustness and common perturbation robustness independant attributes? In Proceedings of the IEEE/CVF International Conference on Computer Vision Workshops, pp. 0-0, 2019.
18

---

Published in Transactions on Machine Learning Research (22l)
Yanxi Li and Chang Xu. Trade-off between robustness and accuracy of vision transformers. In Proceedings of the IEEE/CVE Conference on Compuler Vision and Pattern Recognition, pp- 7568, 2023.
Zewen Li, Fan Liu, Wenjie Yang, Shouheng Peng, and Jun Zhou. A survey of convolutional neural networks: analysis, applications, and prospects. IEEE transactions on neural networks and learning systems, 33(12): 6999-7019, 2021.
Pantelis Linardatos, Vasilis Papastefanopoulos, and Sotiris Kotsiantis. Explainable AI: A review of machine learning interpretability methods. Emiropy, 23(1):18, 2020.
Zachary C Lipton. The mythos of model interpretability: In machine learning, the concept of interpretability is both important and slippery. Queue, 16(3):31 57, 2018.
Jiyuan Liu, Bingyi Lu, Mingkang Xiong, Tao Zhang, and Huilin Xiong, Low frequency sparse adversarial attack. Computers & Security, 132:103379, 2023.
Michal Lukasik, Srinadh Bhojanapalli, Aditya Menon, and Sanjiv Kumar. Does label smoothing mitigate label noise? In International Conference on Machine Learning, pp. 6448 6458. PMLR, 2020.
Scott. M Lundberg and Su-In Lee. A unified approach to interpreting model predictions. Advances in neural information processing systems, 30, 2017.
Cheng Luo, Qinliang Lin, Weicheng Xie, Bizhu Wu, Jinheng Xie, and Linlin Shen. Frequency-driven imperceptible adversarial attack on semantic similarity. In Proceedings of the IEEE/CVE Conference Computer Vision and Pattern Recognition, pp. 15315-15324 2022.
Jan Macdonald, Stephan Wäldchen, Sascha Hauch, and Gitta Kutyniok. A rate-distortion framework for explaining neural network decisions. arXiv preprint arXiv:1905; 11002, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attckss. ar preprint ar orxii:17066 06088, 2017.
Shishira R Maiya, Max Ehrlich, Vatsal Agarwal, Ser-Nam Lim, Tom Goldstein, and Abhinav Shrivastava. A frequency perspective of adversarial robustness. arXiv preprint arXiv:2111.0056: 2021.
Apostolos Modas, Seyed- Mohsen Moosavi-Dezfooll and Pascal Frossard. Sparsefool: few pixels make a big difference. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp- 9087 9096, 2019.
Grégoire Montavon, Alexander Binder, Sebastian Lapuschkin, Wojciech Samek, and Klaus-Robert Müller. Layer-wise relevance propagation: an overview. Explainable Al: interpreting, explaining and visualizing deep learning, pp. 193 209, 2019.
Florian Navarro. Necossary players, myerson fairness and the equal treatment of equals. Annals of Operations Research, 280:111-119, 2019.
Anh Nguyen, Alexey Dosovitskiy, Jason Yosinski, Thomas Brox, and Jeff Clune. Synthesizing the preferred inputs for neurons in neural networks via deep generator networks. Advances in neural information processing systems, 29, 2016a.
Anh Nguyen, Jason Yosinski, and Jeff Clune, Multifaceted feature visualization: Uncovering the different types of features learned by each neuron in deep neural networks. arXiv preprint arXi::600.000 03616, 2016b.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Understanding neural networks via feature visualization: A survey. Eaplainable AI: interpreling, explaining and visualizing deep learning, pp. 55 55-76, 2019.
Chris Olah, Alexander Mordvintsev, and Ludwig Schubert. Feature visualization. Diställ, 2(11):e7, 2017.
Alan V Oppenheim. Applications of digital signal processing. Englewood Cliffs, 1978.
19

---

Published in Transactions on Machine Learning Research (22l)
Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM compuling surveys (CSUR), 54(2):1-38, 2021.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. arXiv preprint Xiv:2000 0046677, 2020.
Sayak Paul and Pin-Yu Chen. Vision transformers are robust learners. In Proceedings of the AAAT conference on Artificial Intelligence, volume 36, pp. 2071 2081, 2022.
Soo-Chang Pei and Chien-Cheng Tseng. comb filter design using fractional-sample delay. IEEE Transactions on Circuils and Systems II: Analog and Digilal Signal Processing, 45(5):649 653, 1998.
Jary Pomponi, Simone Scardapane, and Aurelio Uncini. Pixle: fast and effective black-box attack based on rearranging pixels. In 2022 International Joint Conference on Neural Networks (IJCNN), pp- 1-7. TEEE, 2022.
Pengzhen Ren, Yun Xiao, Xiaojun Chang, Pa-Yao Huang, Zhihui Li, Xiaojiang Chen, and Xin Wang. A comprehensive survey of neural architecture search: Challenges and solutions. ACM Computing Surveys (CSUR), 54(4):1-34, 2021.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. ' "why should trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pp. 1135-1144, 2016.
Richard A Roberts and Clifford T Mullis. Digital signal processing. Addison-Wesley, Longman Publishing Co., Inc., 1987.
David Rolnick, Andreas Veit, Serge Belongie, and Nir Shavit. Deep learning is robust to massive label noise. arXiv preprint
2017.
Alvin E Roth. The Shapley value: essays in honor of Lloyd S. Shapley. Cambridge University Press, 1988.
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishua Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, pp. 618-626, 2017.
Rulin Shao, Zhowxing Shi, Jinfeng Yi, Pin-Yo Yu Chen, and Cho-Jui Hsieh. On the adversarial robustness of vision transformers. arXiv preprint arXiv:2108. 156700 2021.
Lloyd S Shapley. A value for n-person games. Classics in game theory, 69, 1997.
Charles H Sherman and John L Butler. Transducers and arrays for underwater sound, volume 4. Springer, 2007.
Connor Shorten and Taghi M Khoshgoftaar. A survey on image data augmentation for deep learning. Journal of big data, 6(1):1-48, 2019.
Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Tearning important features through propagating activation differences. In International conference on machine learning, pp. 3145 3153. PMLR, 2017.
Samuel Henrique Silva. and Peyman Najafirad. Opportunities and challenges in deep learning adversarial robustness: A survey. arXio preprint arXiv:2007.0075. 2020.
Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprinl arXiv:1312.6033, 2013.
Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenberg, Smoothgrad: removing noise by adding noise. arXiv preprint arxiv 706. 03825, 2017.
Kenneth Steiglitz. Digital Signal Processing Primer. Courier Dover Publications, 2020.
20

---

Published in Transactions on Machine Learning Research (22l)
Petre Stoica, Randolph L Moses, al. Spectral analysis of signals, volume 452. Pearson Prentice Hall Upper Saddle River, NJ, 2005.
Ilia Sucholutsky, Ruairidh M Battleday, Katherine M Collins, Raja Marjieh, Joshua Peterson, Pulkit Singh, Umang Bhatt, Nori Jacoby, Adrian Weller, and Thomas L Griffiths. On the informativeness of supervision signals. In Uncertainty in Artificial Intelligence, pp. 1036-2046 PMLR, 2023.
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. International conference on machine learning, pp. 2319-3322 PMLR, 2017.
Christian Szegody, Wojeiech Zaremba, Tlya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXi preprinl arXiv:1312.6199 2013.
Lizhe Tan and Jean Jiang. Digital signal processing: fundamentals and applications. Academic Press, 2018.
Mingxing Tan and Quoe Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference on machine learning, pp. 6114- PMLR, 2019.
Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Measuring robustness to natural distribution shifts in image classification. Advances in Neurul Information Processing Systems, 33:18583 1583-199915,,, 2020.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.1211 2018.
Yusuke Tsuzuku and Issei Sato. On the structural sensitivity of deep convolutional networks to the directions of fourier basis functions. In Proceedings of the TEEE/CVF Conference Computer Vision and Paltern Recognition, pp. 51-60, 2019.
Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. High-frequency component helps explain the generalization of convolutional neural net In Proceedings of the IEEE/CVE Conference on Compuler Vision and Pattern Recognition, pp. 8684 8694, 2020.
Jiaheng Wei, Zhaowei Zhu, Hao Cheng, Tongliang Liu, Gang Niu, and Yang Liu. Learning with noisy labels revisited: study using real-world human annotations. arXie preprint arXiv:2110. 100:2110.1208,, 2021.
Eyal Winter. The shapley value. Handbook of game theory with economic applications, 3:2025 2054, 2002.
Tete Xiao, Xiaolong Wang, Alexei A Efros, and Trevor Darrell. What should not be contrastive contrastive learning. arXiv preprint arxvv:2008. 20.,2000.00699,, 2020.
Zhi-Qin John Xu, Yaoyu Zhang, Tao Luo, Yanyang Xiao, and Zheng Ma. Frequency principle: Fourier analysis sheds light deep neural networks. arXiv preprint arXtv:1911.06525 2019a.
Zhi-Qin John Xu, Yaoyu Zhang, and Yanyang Xiao. Training behavior of deep neural network in frequency domain. In International Conference on Newral Information Processing, pp. 264-274. Springer, 2019b.
Menahem E Yaari and Maya Bar-Hillel. On dividing justly. Social choice and welfare, 1:1-24, 1984.
Koji Yokote, Takumi Kongo, and Yukihiko Funaki. Relationally equal treatment of equals and affine combinations of values for tu games. Social Choice and Welfare, 53:197 212, 2019.
Matthew D Zeiler, Dilip Krishnan, Graham W Taylor, and Rob Fergus. Deconvolutional networks. Tn 2010 IEEE Computer Society Conference on computer vision and pattern recognition, pp. 2528 2535. IEEE, 2010.
Yu Zhang, Peter Tiño, Aleš Leonardis, and Ke Tang. A survey on neural network interpretability. IEEE Transactions Emerging Topics in Computational Intelligence, 2021.
21

---

Published in Transactions on Machine Learning Research (22l)
Zhenyu Zhang, Xiaobo Shu, Bowen Yu, Tingwen Liu, Jiapeng Zhao, Quangang Li, and Li Guo. Distilling knowledge from well-informed soft labels for neural relation extraction. In Proceedings of the AAAT Conference on Artificial Intelligence, volume 34, pp. 9620 9627, 2020.
Beiyao Zheng and Alan Agresti. Summarizing the predictive power of generalized linear model. Statistics in medicine, 19(13):1771-1781, 2000.
Stephan Zheng, Yang Song, Thomas Leung, and lan Goodfellow. Improving the robustness of deep neural networks via stability training. In Proceedings of the iece conference on computer vision and pattern recognition, pp. 4480-4488, 2016.
Bolei Zhou, Aditya Khosla, Agala Lapedriza, Aude Oliva, and Antonio Torralba. Learning deep features for discriminative localization. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2921-2929, 2016.
Daquan Zhou, Zhiding Yu, Enze Xie, Chaowei Xiao, Animashree Anandkumar, Jiashi Feng, and Jose M Alvarez. Understanding the robustness in vision transformers. In International Conference on Machine Learning, pp. 27378-277777 27394. PMLR, 2022.
22

---

Published in Transactions on Machine Learning Research /22l)
A Appendix
B Fairness division axioms
Symmetry axiom: Lot I E 2 be some spectral player coalition. For I, e I, $ Σ, the statement v(I u (I,)) = =(I (I,}) implies (Z, = by v). This axiom restates the statement 'equal treatment of equals' principle mathematically. This axiom states that the 'names' of players should have no effect on the 'treatments' by the characteristic function in coalition games (Roth 1988
Linearity axiom: Let u and v be two characteristic functions. Let (I, u) and (I, v) be two coalition games. Let (u + (I) = u(I) + v(z) where I 2 The divisions of the new coalition game (I, u + v) should satisfy: (I, u v) (I, u) + (Z, v). This axiom also known as 'additivity axiom' and guarantees the uniqueness of the solution of dividing payoffs among players (Roth 1988).
Efficiency axiom: This axiom states that the sum of the divisions of all players must be summed to the M-1
worth of the player set (the grand coalition):
Σ ei, v) vI))
1=0
Dummy player axiom: A dummy player (mull player) I is the player who has no contribution such that: & v) and vII u (I+)) = v(I) for y I& I A I II.
Remark B.1. In the lilerature [Roth 1988), the efficiency oriom and the dummy player axiom are also combined and relabeled carrier aziom.
23

---

Published in Transactions on Machine Learning Research (22l)
B.1 Spectral signal-to-noise ratio (SNR)
Discrete Fourier Transform. The notion 'Trequency' measures how 'fast' the outputs can change with respect to imputs. High frequency implies that small variations in inputs can cause large changes in outputs. In torms of images, the 'inputs' are the pixel spatial locations while the 'outputs' are the pixel values.
Let x: (i,j) - I be some 2D image with dimension M N which sends every location (i,j) to some real pixel value where (i.j) [M] [N]. Let & : 122 + C² be some DFT functional operator. The DFT of x is given by:
(()((ut))
Σ 1=0 1=0
Σ
a(i,))e
12 - (2
(13)
Point-wise energy spectral density (ESD). The ESD measures the energy quantity a frequency. To simplify discussions, we radial frequency, which is defined the radius with respect zero frequency point (i.e. the frequency center). The energy is defined as the square of the frequency magnitude according to Parseval's 's Power Theorem.
Let Ly be a circle with radius on the spectrum of image x, as illustrated in Figure [ The r is referred to as radial frequency. The point-wisc ESD function is given by:
ES),
1 [
Σ
(z()
(14)
(u,F)EL.
where (u, v) is the spatial frequency point and [xd| is the circumference of Ly-
Spectral signal-to-noise ratio (SNR). The SNR can quantify signal robustness. We define the spectral SNR at radius frequency as:
SNR(r) = ESD,(x)
(15)
(SD,(Az)
where Ar is some perturbation. We have characterized the SNRs of some corroptions and adversarial attack in Figure 2
24

---

Published in Transactions on Machine Learning Research /22l)
B.2 Absence assignment scheme
There exist multiple choices for the assignments of the absences of spectral layers in coalition filtering design: (1) Assigning to constant zeros (Zeroing), (2) assigning to complex Gaussian noise (Complex Gaussian) and (3) assigning to the corresponding frequency components randomly sampled from other images at the same dataset (Replacement).
Zeroing. The b in Equation 5 is to zeros.
Complex Gaussian. The b in Equation 5 is sampled from i..d. complex Gaussian distribution: M(μ, f ii(,,, 5)
Replacement. The b in Equation 5 is set to: b (x") (where x" X is randomly sampled image from some set. X).
In our implementation, we simply choose 'zeroing:: = 0. Figure 13 shows the filtered image examples by using the above three strategics and also show the examples of measured spectral importance distributions. Empirically, the three strategies have rather similar performance. In this research, we do not unfold the discussions regarding the masking strategy choices.
(a) Zeroing
(b)
Complex
(c) Replacement
(d) Zeroing
(e)
Complex
Replacement
Gaussian
Gaussian
Importance
Importance
Importance
0.5
0.0
0.0
0.0
Io
12
14 I5
I6
I7
11
12
13
15
I7
To
12
13
L4
I5
16 NRF)
17
Spectrum +
NRF)
Spectrum (RF
NRF)
Spectrum
(g) resnet18 w/ Zeroing
(h) resnet18 w/ Complex Gaussian
resnel18 w/ Replacement
Importance
Importance
Importance
0.5
0.5
0.5
0.0
0.0
0.0
Io
11
12
13
14 I5
16
I7
Io
11
12
13
14
15
I6
17
Io
I1
12
13
L4 15 16
I7
Spectrum I (RF + NRF)
Spectrum I (RF
NRF)
Spectrum I (RF
- NRF)
(j) efficientnet_ v w/ Zeroing
(k)
effiieenmet vl
w/
Complex
efficientnet
_º__s w/ Replacement
Gaussian
Figure 13: Three absence assignment strategies: (1) Assigning the spectral absences with constant zeros (Zeroing), (2) assigning the speviral absences with Gaussian noise (Complex Gaussian) and (3) randomly sampling spectral components from the same image datasets (Replacement). The standard complex Gaussian distribution given by: (O0 1) + iN(0,) 1). The figures (a), (b) and (c) show the coalition filtering results with the spectral coalition: (Zo). The figures (d), (e) and (f) show the coalition filtering results with the spectral coalition: [I,, Ig. In, Io, I7}. The figures (g) to (1) show the examples of the measured spectral importance distributions of resmet18 and efficientnet x2 s (both pre-trained on ImageNet) with the three assignment strategies.
25

---

Published in Transactions on Machine Learning Research (22l)
B.3 Proof for Spectral Coalition Information Identity Theorem
Proof for Spectval Coalition Information Idenlily. Suppose the probability measures P(x), P(æ,v), P(yla), and Qyylz) are absolutely continuous with respect to on domain X I.
S
P(a, v) P(x) P(y)
I(X (MMI.D) x
Σ P(x.)) log
de
(16)
X.ot. yEy
P(ula) P(x) Q(yaa) dr P(y) P(x)
Σ p(x, log
(17)
Q(ylx)
Xbal. yEy
P(())z) Q(ylz) P(y)
Σ
P(x,)) v) log
Qu)lz) dx
(18)
XMO VEY
Σ P(ylz) log x dr (1y(x)
P(x)
(19)
XMI
Σ yey
p(a,y)do log P(y)
(20)
Σ v(r,v) log Q(yl=)dee
(21)
Nbot yEy
[L(P(TE))|Q()))) +H))) +H())+++++++
f P(x)
Σ
P(v]x) log Q(vla) dx
(22)
zeXxi
point-wise
Xui
yEy
E (L(((U)))|QQ[]l)) +H())
E
Σ
P(ylz) log Q(vlz)
(23)
zEXxr
zEX'x yEy
point-wiss
E
(L((()]))] +Q)) +C
(24)
zEtxi
point-wise
where H)) is the Shannon entropy of the label set V.
26

---

Published in Transactions on Machine Learning Research (224)
C
Information quantity relationship in spectral coalitions
E. K.L. (P( re
Dumay player
[C)
H()
Constant
Variable (KL. divergence)
Variable (churacteristic function)
Figure 14: Information quantity relationship. This shows the theoretical information quantity relationship between what the characteristic function measures and the mutual information I(X' I,)). For given coalition Σ, a dataset () and a classifier Q, the measures how much information the classifier Q utilizes in decisions. The measured results are then used to compute the marginal contributions features.
27

---

Published in Transactions on Machine Learning Research /22l)
C.1
Partitioning spectrum with &o ball over & ball
Frequency data (in color 'teal")
No frequency data
IM-1
T
In
IM-1
Frequency center
Frequeney center
Iu
Spectral players with l partition.
The pixel density Ias-1 with & ball.
The pixel density of Ia--1 with Egp ball.
Two spectral band partitioning schemes. This shows the motivation we choose Eo ball over l ball in partitioning the frequency domain into the M bands (i.c., M 'spectral playcrs') over 2D Fourier spectrum. The frequency data density of the spectral players with &o remains constant. However, the frequency data density of the spectral players with & is not constant since some frequency components do not present. This motives to empirically choose lo metric to form spectral players in implementation.
Figure 15:
28

---

Published in Transactions on Machine Learning Research (22l)
C.2 Normalizing summarized SIDs
We normalize the above result and set:
(T) 11
S(v)
(25)
sup
8 (T)
119111
M
B" V (v)
1188 1
(26)
sup
|| (1)
11,911
M
(v))
M
(27)
|118112
M
3r (v))
|1/1112 [1
(28)
M ||112
where 3
and sup 3d (T))
||l|| M
is derived by:
TB
||11|1
sup (T)) ||
sup (²
(29)
M
M
|| M
sup ||B||2 (1)(2
s.t. ||
(30)
|| |10112
since | < (,)
(31)
M
1 | Set
M 118
BT 1 (v)
S(v)
(32)
7
Q.E.D.
29

---

and Published in Transactions on Machine Learning Research (July/2024)
C.3 How much samples are sufficient?
5,100
5079
3.075
0.273
3.005
0.225
3000
0.002
310 402
450
500
300
152
250
252
320
450
320 352 4.0
450
500
(a) resnet18 &CIFAR10
(b) resnef18 @CIFAR100
(c) resnet18 @lmageNet
Convergence of relative estimation errors converge with respect to the numbers of samples K. The errors are measured by: ( - (v)li where (v)) denotes the i-th measured spectral importance distribution with respect to characteristic function v. The experiments are conducted on CIFAR10, CIFAR100 and ImageNet with resnet18.
Figure 16:
Error bound analysis. Let K be the number of the samples of some bascline datasct. Let:
Au(ī,I,) = v(I (I+)) v(t)
(33)
Av(I.) (Au(I, IEI
(34)
and
M
W =
(35)
M
7
i=I
Hence:
(I, = W Au(Z)
(36)
where ||[]] 1 since W is a probability distribution. Let v. AT(I,) and AT(ī,I, be estimations with samples using Monte Carlo sampling. The error bound with l norm is given by:
sup (I, (Z, w)1l sup I| Ao(I, WT
(37)
< <sup
|WIl | Ar(I))l
(Hölder's inequality)
(38)
=supll Σ (Ao I2) Au(I, I.)) ||
(39)
< sup
sup 2 M-
A (1, I2) - Ao 2:)
(40)
-sup
sup 2-
Ai I I2) Av(i,I)ll
(41)
M-1 Var(Ar) (
(42)
K
where Var(Ar) gives the upper bound of the variance of AT I.).
30


Reviews:
[{"review_id": "hbnH2tMjDg", "reviewer": "Reviewer_rJbZ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- Overall, the paper is well presented and easy to read.\n- Offers a formal approach to (robustness) attributions for each spectral band.\n- Sheds new light on known phenomena such as the relative robustness of high/low frequency features. (Fig. 6)\n- Sheds new light on relevant questions such as the relative robustness of ViT vs ConvNets and small/large models. (Fig. 10)\n\nWeakness:\n- There seems to be a bit of a gap in the presented study, which also leads to a bit of disconnect while reading through the paper, since the presentation (title + intro) focus more heavily on the intended application rather than the new technique and formulations presented. It would have been nice to spend more time on the new techniques and showcase its applications to a more wide range of problems, rather than just perturbation robustness. Indeed, the abstract makes a better case for the techniques developed, compared to the (intro + title), by explaining how they offer a formal tool to quantify the attributions of different spectral bands, which has a wider impact beyond robustness considerations.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors apply Shapley value theory to quantify the predictive power of different image features. A decomposition of the image into spectral bands provides a set of *players* which are then used to form *spectral coalitions*. Each of those resulting coalitions can be used as input to a (frozen) classifier, by inverting the decomposing transformation to obtain a filtered image without the excluded spectral bands. The value assigned to a coalition is then defined as the gains in terms of the negative cross-entropy obtained when the spectral bands are included compared to when they are excluded. This information gain is established more directly by expressing the mutual information as a sum of the Shannon entropy and the value function, plus additional terms including a KL-divergence between the predicted and ground-truth labels. The proposed value decomposition can be used to derive a new spectral robustness score, which the authors proceed to apply in a series of experiments establishing its correlation with previously proposed robustness metrics, as well as its application to two case studies in robustness evaluation.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Abstract:\n=======\n- \"model perturbation robustness mechanisms\" is a very complex string. Even the simpler \"perturbation robustness\" still needs to be defined, in contrast to the more familiar notion of adversarial robustness. [R1] Please clarify the scope of the paper by defining \"perturbation robustness\" first, before discussing the issue of understanding its mechanisms. In doing so, please use simpler sentence structures, e.g., the mechanisms of perturbation robustness of machine learning models.\n- Given the confusion about the scope, and the complexity of the language in the beginning of the abstract, I find it extra distracting to prematurely switch attention to the specifics of the approach, let alone its name or acronyms. [R2] Please defer naming the method till after the scope/motivation and a summary of the technical ideas have been explained clearly.\n\nSection 1:\n=======\n- The authors set out to study robustness \"mechanisms\" as the first thrust motivating this paper (i.e. existing robustness scores failing to provide further insights into the robustness mechanisms). It would help to [R3] please elaborate on what is meant by robustness mechanisms, perhaps by enumerating different considerations over different stages of the model development cycle. It should be fine to focus on those aspects actually studied in the paper, where a reference to recent surveys or concurrent work may suffice for other such considerations. This would help make it clear how much the progress is achieved along this direction through the presented contributions -- which is not very clear to me right now.\n  - I like the study of label-noise impact, presented in Section 4.3, as a more interesting example of a \"mechanism\" since it touches upon the varied scenarios encountered in the training stage. So, I wonder what other kinds of studies can be designed to probe more aspects of robustness mechanisms.\n\nSection 3\n=======\n- Although the connection to information theory was advertised as early as the abstract, I see it only appears in the last part of Section 3.3. It may be fine to defer the full proof to the appendix, but [R4] please include at least a high level narrative or a walkthrough a simple numerical example to help make the connection to information theory more clear and accessible.\n  - It would be nice to [R5] distinguish the game theory framework (coalitions and Shapley value) from the information theory connection, that arises due to the specific characteristic function used.\n  - [R6] please make sure to cite and discuss more of the works on interpretability that utilized Shapley values, rather than just SAGE which is mentioned very briefly. For example:\n    - Kumar, Indra, Carlos Scheidegger, Suresh Venkatasubramanian, and Sorelle Friedler. \"Shapley Residuals: Quantifying the limits of the Shapley value for explanations.\" Advances in Neural Information Processing Systems 34 (2021): 26598-26608.\n    - Some concurrent work also seems relevant:\n      - Herbinger, Julia, Bernd Bischl, and Giuseppe Casalicchio. \"Decomposing global feature effects based on feature interactions.\" arXiv preprint arXiv:2306.00541 (2023).\n      - Huang, Xuanxiang, and Joao Marques-Silva. \"The inadequacy of Shapley values for explainability.\" arXiv preprint arXiv:2302.08160 (2023).\n- Spectral importance distribution (SID): It would also help to [R7] please clearly define $\\Psi$ as a vector in $\\mathbb{R}^M$. I would also recommend to reserve the asterisk to optimal values, rather than normalized values which typically use a bar.\n- Spectral coalition filtering: I would recommend to [R8] please refer to $\\mathbb{T}$ consistently as a mask map or an indicator function - I would personally prefer to call it a mask map.\n- It would help to [R9] please clarify that spectral coalition images are \"fed into\" the classifier models (either trained or un-trained) for inference only, and that the proposed technique does not require training a dedicated model for each coalition.\n\nSection 4:\n=======\n- The experiment with label noise is quite intriguing. In regards to its conclusion, i.e., the last sentence in bold at the end of Section 4.3, I'm not sure if we're looking at causation or correlation. I wonder if forcing the model to give more weight to the robust features, i.e., lower frequency bands, or completely suppress non-robust features, i.e., high frequency bands, would yield a more robust model. [R9] It would be nice to include such an experiment.\n  - More generally, following the previous point, it would be nice to consider using the proposed SID as a training objective. That is, if we have a clear idea of what the SID for a robust model looks like, we can encourage the models we train to have a robust SID profile.\n\nNitpicking\n========\n- deploy -> apply", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "DW3FqHm7b7", "reviewer": "Reviewer_wwaX", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n* Developing solutions for assessing robustness of computer vision models is a timely and highly relevant topic\n* Comparing robustness of models empirically is a valuable contribution\n* The authors do a great job at embedding their work in the existing literature\n* I think it's great that the authors make an effort to explain their results. For instance the aspect that efficient net seems to be special and how that is related to the frequency distribution \n* in a way the study helps to connect the pre-ImageNetMoment research to post-ImageNetMoment research. characterizing robustness in terms of spatial frequency decompositions is interesting and helpful\n* I'm convinced that the proposed approach is a valuable contribution to a better understanding of robustness of computer vision models; \n\n## Weaknesses\n* Some of the figures could be improved w.r.t. detail and content\n* I'm wondering whether the interpretability spin is needed / helpful for the narrative - i was at times confused about the goal of the work\n* I'm not sure i understand how label noise is related to spectral perturbations of images. I mean, certaintly, both affect robustness, but i wouldn't expect the image to change. I think the finding that *\"Models tend to use more non-robust features in the presence of higher label noise within training set.\"* is very interesting, but as the perturbation on labels is independent of the spectral perturbations it would be helpful to comment on that relationship", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors present an approach for robustness quantification for computer vision models. Building on work from information theory, eXplainable Artificial Intelligence (XAI), information theory and game theory, the authors derive a model agnostic workflow for perturbing images and evaluating robustness w.r.t. to those perturbations in frequency space. Compared to other XAI approaches that investigate models in terms of single pixels, patches, concepts or entire images, adding the classical spatial frequency decomposition as semantic concepts for XAI is a great idea. And as many perturbations used in nowadays training of computer vision models as well as for XAI purposes, a better understanding of these perturbations w.r.t. their impact on predictive performance is timely and relevant. \n\nWhile the structure of the manuscript is a bit unconventional (for instance separate subsections of the experiments have mirrored the classical manuscript structure with methods/results/discussion), this actually works well in parts, in other parts I sometimes found it difficult to understand whether this work is about XAI, about robustness or about any of the (very relevant and well tested) empirical questions in the experimental sections. It feels a bit like there is a lot of work that went into this with a theoretical motivation and then the authors looked for an empirical use case. As in: we'd like to do something with information theory and spectral image decompositions, but computer vision models nowadays all work in decompositions induced by neural networks, so we need to somehow draw this connection and find an application of those pre-ImageNetMoment methods)to state-of-the-art applications.  \nOne way of reducing potential confusion would be to highlight directly in the abstract some of these (i think) great empirical findings on the relative robustness of some models w.r.t. some types of perturbations.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "For a better assessment of the pros and cons of the proposed method, it would be great if the authors could:\n\n* one could put a legend in the figures? in fig 9 it seems that the colors are not used consistently, vit is pink in the upper two panels and green in the lower two? ideally one would use the same colormap across all figures, e.g. also in fig. 10, to enable readers to quickly understand which model is which. Also, the sizes of the circles in fig 8/9 seems to be relevant but it's not explained in the figure.\n* generally i'd recommend to try and make the figures/captions as self-explanatory as possible; that will help to reduce cognitive friction when processing these central elements of the publication. More concretely, one could for instance guide the attention to the aspects that the authors deem relevant for the reader \n* maybe one could elaborate on assumption 3.7 as to where that assumption comes from. It reads a bit like this is an empirical finding that gets explained post-hoc, while it seems more intuitive that this is not a property of the model or the perturbations, but rather due to the empirical distribution of natural images in spatial frequency space. \n* in fig  10b - what's shown there on the x and y axis respectively?\n* also fig. 10b: it's great that the authors put the research question in that caption, but ideally the caption would contain the answer (or rather: the figure should contain the answer and the caption draws the attention of the reader to the relevant aspects in the figure). I know it's stated in the text clearly and in bold face, but redundancy always helps and having the relevant information at the relevant positions helps, too. \n* the manuscript could be strengthened by being more specific / detailed at times. For instance when the authors write: *\"efficientnet, can achieve comparable robustness performance\"* it would be helpful to mention how robustness was measured in that case.", "broader_impact_concerns": "No concerns, on the contrary: Testing for robustness and explaining potential shortcomings is key to reponsible usage of ML models; I'm convinced this work can make a valuable contribution towards better assessment of model robustness.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "8LVZrtkaD1", "reviewer": "Reviewer_PKrD", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I feel like this paper proposed a very interesting and principled approach to understand the robustness in the context of images. I really like the idea of incorporating the inductive bias on the image itself. Overall, I have no major concerns but some minor points to be addressed. **Please see the request changes for details**", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper considered Interpreting Global Perturbation Robustness through the understanding of spectral importance. Specifically, this paper considered the Shapley value in the context of image spectral space to analyze the importance of high-/low- frequency signals.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Page 1\n\nI would think the title/abstract should highlight the context of Image modality. This paper proposed a compelling concept for image but this does not imply it’s insightful for all the kinds of data modalities such as tabular, graph and NLP. The current title is too general and gives a wrong impression that it works for all kinds of data modality. Indeed, the whole paper only focuses on image (I believe this is great! It’s just to adjust the paper scope). \n\n- Page 1, Sec 1, Introduction\n\nI have similar concerns with the introduction section. It clearly stated that the main scope is image modelling and robustness. Therefore it should clearly revise the abstract and title. \n\nIn paragraph 3, the SNR is introduced in an unnatural manner, where I think it’s better to put it into the background section rather than intro. Besides, Appendix B3 here still seems quite awkward for new audiences.\n\nIn the introduction section, I have a feeling that this is written for the reviewers who already had reviewed your paper and checked for the second round. However, for a new reviewer like me, I still feel a bit hard to digest this section. I would recommend a smoother transition for the new audiences. \n\n- Page 5 Sec 3.1 \n\nI could not understand why we need to normalize SID?\n\n- Page 6 Sec 3.3\n\nI feel like the information theoretical interpretation could not be counted as a novel contribution. In general, such a technique has been demonstrated in the literature such as [1]. A clarification is required.  \n\n[1] Understanding Global Feature ContributionsWith Additive Importance Measures. NeurIPS 2020.\n\n- Page 8\n\nCould you explain a bit more about the role of \\beta?\n\n- Page 14\n\nI really like the discussion on the limitation sections. Is it possible to elaborate a bit more on low- high- frequency adversarial attack?", "broader_impact_concerns": "Not applicable", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: In this paper, the authors proposed a method I-ASIDE to evaluate the robustness of image models against frequency distribution.
I-ASIDE divides the input image's frequency into bins, masks them, and assesses the contribution of each frequency bin using the Shapley value.

The authors revealed through experiments that image models tend to focus on low-frequency components.
Additionally, they reported that image models with a higher bias towards frequency contribution are more vulnerable to adversarial noise and other such perturbations.
The proposal of I-ASIDE for investigating frequency contributions and the insights into the relationship between these frequency components and the robustness of image models are highly intriguing.

The authors appropriately revised the paper to clarify its message through communication with the reviewers.
As a result, all three reviewers agreed to accept this paper.
Decision: Accept (poster)