Title: Auditing Local Explanations is Hard
Venue: NeurIPS 2024
Accepted: yes
Keywords: explanation

auditing

trust

regulation
Abstract: In sensitive contexts, providers of machine learning algorithms are increasingly required to give explanations for their algorithms' decisions. However, explanation receivers might not trust the provider, who potentially could output misleading or manipulated explanations. In this work, we investigate an auditing framework in which a third-party auditor or a collective of users attempts to sanity-check explanations: they can query model decisions and the corresponding local explanations, pool all the information received, and then check for basic consistency properties. We prove upper and lower bounds on the amount of queries that are needed for an auditor to succeed within this framework. Our results show that successful auditing requires a potentially exorbitant number of queries -- particularly in high dimensional cases. Our analysis also reveals that a key property is the ``locality'' of the provided explanations --- a quantity that so far has not been paid much attention to in the explainability literature. Looking forward, our results suggest that for complex high-dimensional settings, merely providing a pointwise prediction and explanation could be insufficient, as there is no way for the users to verify that the provided explanations are not completely made-up.

Auditing Local Explanations is Hard

Abstract

In sensitive contexts, providers of machine learning algorithms are increasingly required to give explanations for their algorithms' decisions. However, explanation receivers might not trust the provider, who potentially could output misleading or manipulated explanations. In this work, we investigate an auditing framework in which a third-party auditor or a collective of users attempts to sanity-check explanations: they can query model decisions and the corresponding local explanations, pool all the information received, and then check for basic consistency properties. We prove upper and lower bounds on the amount of queries that are needed for an auditor to succeed within this framework. Our results show that successful auditing requires a potentially exorbitant number of queries - particularly in high dimensional cases. Our analysis also reveals that a key property is the 'locality' of the provided explanations - a quantity that so far has not been paid much attention to in the explainability literature. Looking forward, our results suggest that for complex high-dimensional settings, merely providing a pointwise prediction and explanation could be insufficient, as there is no way for the users to verify that the provided explanations are not completely made-up.

1 Introduction

Machine learning models are increasingly used to support decision making in sensitive contexts such as credit lending, hiring decisions, admittance to social benefits, crime prevention, and so on. In all these cases, it would be highly desirable for the customers/applicants/suspects to be able to judge whether the model's predictions or decisions are 'trustworthy'. New AI regulation such as the European Union's AI Act can even legally require this. One approach that is often held up as a potential way to achieve transparency and trust is to provide local explanations , where every prediction/decision comes with a human-understandable explanation for this particular outcome (e.g., LIME (Ribeiro et al., 2016), SHAP (Lundberg and Lee, 2017), or Anchors (Ribeiro et al., 2018)).

However, in many real-world scenarios, the explanation receivers may not necessarily trust the explanation providers (Bordt et al., 2022). Imagine a company that uses machine learning tools to assist in screening job applications. Because the company is well-advised to demonstrate fair and equitable hiring, it is plausible that it might bias its explanations towards depicting these properties. And this is easy to achieve: the company is under full control of the machine learning model and the setup of the explanation algorithm, and prior literature (Ghorbani et al., 2019; Dombrowski et al., 2019) has shown that current explainability tools can be manipulated to output desirable explanations.

This motivates the question: what restrictions or procedures could be applied to prevent such explanation cheating, and more specifically, what are ways to verify that the provided explanations

(a) Insufficient data for auditing

(b) Sufficient data for auditing

.

are actually trustworthy? One approach is to require that the explanation providers completely publicize their models, thus allowing users or third-party regulators to verify that the provided explanations are faithful to the actual model being used. However, such a requirement would likely face stiff resistance in settings where machine learning models are valuable intellectual property.

In this work, we investigate an alternative approach, where a third-party regulator or a collective of users attempt to verify the trustworthiness of local explanations, simply based on the predictions and explanations over a set of examples. The main idea is that by comparing the local explanations with the actual predictions across enough data one could, in principle, give an assessment on whether the provided explanations actually adhere to the explained model. The goal of our work is to precisely understand when this is possible.

1.1 Our contributions: data requirements for auditing.

We begin by providing a general definition for local explainability that encompasses many popular explainability methods such as Anchors (Ribeiro et al., 2018), Smooth-grad (Smilkov et al., 2017), and LIME (Ribeiro et al., 2016). We define a local explanation for a classifier f at a point x as a pair ( R x , g x ) , where R x is a local region surrounding x , and g x is a simple local classifier designed to approximate f over R x . For example, on continuous data, Anchors always output ( R x , g x ) where R x is a hyper-rectangle around x and g x is a constant classifier; gradient-based explanations such as Smooth-grad or LIME implicitly approximate the decision function f by a linear function in a local region around x .

Obviously, any human-accessible explanation that is being derived from such a local approximation can only be trustworthy if the local function g x indeed approximates the underlying function f on the local region R x . Hence, a necessary condition for a local explanation to be trustworthy is that the function g x is close to f on the region R x , and this should be the case for most data points x sampled from the underlying distribution.

To measure how closely a set of local explanations adheres to the original classifier f , we propose an explainability loss function L γ ( E,f ) , which quantifies the frequency with which f differs by more

than γ from the local classifier g x over the local region R x (see Sec. 2.2 for precise definitions). We then introduce a formalism for auditing local explanations where an auditor attempts to estimate the explainability loss L γ ( E,f ) . In our formalism, the auditor does so with access to the following objects:

A set of data points X = { x 1 , . . . , x n } drawn i.i.d from the underlying data distribution.

The outputs of a classifier on these points, f ( X ) = { f ( x 1 ) , . . . , f ( x n ) } .

The provided local explanations for these points E ( f, X ) = { E ( f, x 1 ) , . . . , E ( f, x n ) }

Observe that in our formalism, the auditor has only restricted access to the machine learning model and the explanations: they can only interact with them through their evaluations at specific data-points. We have chosen this scenario because we believe it to be the most realistic one in many practical situations, where explanation providers try to disclose as little information on their underlying machine learning framework as possible.

In our main result, Theorem 4.1, we provide a lower bound for the amount of data needed for an auditor to accurately estimate L γ ( E,f ) . A key quantity in our analysis is the locality of the provided explanations. We show that the smaller the provided local regions R x are, the more difficult it becomes to audit the explainer. Intuitively, this holds because estimating the explainability loss relies on observing multiple points within these regions, as illustrated in Panel (b) of Figure 1. By contrast, if this fails to hold (Panel (a)), then there is no way to validate how accurate the local explanations are. We also complement our lower bound with an upper bound (Theorem 4.2) that demonstrates that reasonably large local regions enable auditing within our framework.

Our results imply that the main obstacle to auditing local explanations in this framework is the locality of the provided explanations. As it turns out, this quantity is often prohibitively small in practice , making auditing practically impossible . In particular, for high-dimensional applications, the local regions R x given by the explainer are often exponentially small in the data-dimension. Thus the explanations cannot be verified in cases where there does not exist any prior trust between the explanation provider and the explanation receivers.

We stress that estimating the local loss L γ ( E,f ) serves as a first baseline on the path towards establishing trustworthy explanations. It is very well possible that an explanation provider achieves a small local loss (meaning that the local classifiers closely match the global classifier f ) but nevertheless provides explanations that are misleading in some other targeted manner. Thus, we view successful auditing in this setting as a necessary but not sufficient condition for trusting an explanation provider.

Our results might have far-reaching practical consequences. In cases where explanations are considered important or might even be required by law, for example by the AI Act, it is a necessary requirement that explanations can be verified or audited (otherwise, they would be completely useless). Our results suggest that in the typical high dimensional setting of modern machine learning, auditing pointwise explanations is impossible if the auditor only has access to pointwise decisions and corresponding explanations. In particular, collectives of users, for example coordinated by non-governmental organizations (NGOs), are never in the position to audit explanations. The only way forward in auditing explanations would be to appoint a third-party auditor who has more power and more access to the machine learning model , be it access to the full specification of the model function and its parameters, or even to the training data. Such access could potentially break the fundamental issues posed by small local explainability regions in our restricted framework, and could potentially enable the third party auditor to act as a moderator to establish trust between explanation receivers and explanation providers.

1.2 Related Work

Prior work (Yadav et al., 2022; Bhatt et al., 2020; Oala et al., 2020; Poland, 2022) on auditing machine learning models is often focused on applying explainability methods to audit the models, rather than the explanations themselves. However, there has also been recent work (Leavitt and Morcos, 2020; Zhou et al., 2021) arguing for more rigorous ways to evaluate the performance of various explanation methods. There are numerous approaches for doing so: including performance based on human-evaluation (Jesus et al., 2021; Poursabzi-Sangdeh et al., 2021), and robustness (Alvarez-Melis and Jaakkola, 2018).

There has also been a body of work that evaluates explanations based on the general notion of faithfulness between explanations and the explained predictor. Many approaches (Wolf et al., 2019; Poppi et al., 2021; Tomsett et al., 2020) examine neural-network specific measures, and typically rely on access to the neural network that would not be present in our setting. Others are often specialized to a specific explainability tool - with LIME (Visani et al., 2022; Botari et al., 2020) and Shap (Huang and Marques-Silva, 2023) being especially popular choices.

By contrast, our work considers a general form of local explanation, and studies the problem of auditing such explanations in a restricted access setting, where the auditor only interacts with explanations through queries. To our knowledge, the only previous work in a similar setting is (Dasgupta et al., 2022), in which local explanations are similarly audited based on collecting them on a set of data sampled from a data distribution. They consider a quantity called the local sufficiency , which directly corresponds to our notion of local loss (Definition 2.3). However, their work is restricted to a discrete setting where local fidelity is evaluated based on instances that receive identical explanations. In particular, they attempt to verify that points receiving identical explanations also receive identical predictions. By contrast, our work lies within a continuous setting, where a local explanation is said to be faithful if it matches the underlying model over a local region .

A central quantity to our analysis is the locality of an explanation, which is a measure of how large the local regions are. Prior work has rarely measured or considered this quantity, with a notable exception being Anchors method (Ribeiro et al., 2018) which utilizes it to assist in optimizing their constructed explanations. However, that work did not explore this quantity beyond treating it as a fixed parameter.

Finally, we note that other recent work, such as (Bassan and Katz, 2023), provides avenues for providing explanations with certifiable correctness , meaning that they provide proof that their accurate reflect the underlying model. We view our work as complementary to such methods as our work demonstrates the necessity of such ideas by demonstrating difficulties with using generic local explanation methods .

2 Local Explanations

2.1 Preliminaries

In this work, we restrict our focus to binary classification - we let µ denote a data distribution over R d , and f : R d →{± 1 } be a so-called black-box binary classifier that needs to be explained. We note that lower bounds shown for binary classification directly imply lower bounds in more complex settings such as multi-class classification or regression.

For any measurable set, M ⊆ R d , we let µ ( M ) denote the probability mass µ assigns M . We will also let supp ( µ ) denote the support of µ , which is the set of all points x such that µ ( { x ′ : || x -x ′ || ≤ r } ) > 0 for all r > 0 .

We define a hyper-rectangle in R d as a product of intervals, ( a 1 , b 1 ] ×··· × ( a d , b d ] , and let H d denote the set of all hyper-rectangles in R d . We let B d denote the set of all L 2 -balls in R d , with the ball of radius r centered at point x being defined as B ( x, r ) = { x ′ : || x -x ′ || ≤ r } .

We will utilize the following two simple hypothesis classes: C d , which is the set of the two constant classifiers over R d , and L d , which is the set of all linear classifiers over R d . These classes serve as important examples of simple and interpretable classifiers for constructing local explanations.

2.2 Defining local explanations and explainers

One of the most basic and fundamental concepts in Explainable Machine Learning is the notion of a local explanation , which, broadly speaking, is an attempt to explain a complex function's behavior at a specific point. In this section, we describe a general form that such explanations can take, and subsequently demonstrate that two widely used explainability methods, LIME and Anchors, adhere to it.

We begin by defining a local explanation for a classifier at a given point.

Definition 2.1. For x ∈ R d , and f : R d →{± 1 } , a local explanation for f at x is a pair ( R x , g x ) where R x ⊆ R d is a region containing x , and g x : R x →{± 1 } is a classifier.

Here, g x is typically a simple function intended to approximate the behavior of a complex function, f , over the region R x . The idea is that the local nature of R x simplifies the behavior of f enough to provide intuitive explanations of the classifier's local behavior.

Next, we define a local explainer as a map that outputs local explanations.

Definition 2.2. E is a local explainer if for any f : R d →{± 1 } and any x ∈ R d , E ( f, x ) is a local explanation for f at x . We denote this as E ( f, x ) = ( R x , g x ) .

We categorize local explainers based on the types of explanations they output - if R denotes a set of regions in R d , and G denotes a class of classifiers, R d →{± 1 } , then we say E ∈ E ( R , G ) if for all f, x , E ( f, x ) outputs ( R x , g x ) with R x ∈ R and g x ∈ G .

Local explainers are typically constructed for a given classifier f over a given data distribution µ . In practice, different algorithms employ varying amounts of access to both f and µ - for example, SHAP crucially relies on data sampled from µ whereas gradient based methods often rely on knowing the actual parameters of the model, f . To address all of these situations, our work takes a black-box approach in which we make no assumptions about how a local explainer is constructed from f and µ . Instead we focus on understanding how to evaluate how effective a given explainer is with respect to a classifier f and a data distribution µ .

2.3 Examples of Explainers

We now briefly discuss how various explainability tools in practice fit into our framework of local explanations.

Anchors: The main idea of Anchors (Ribeiro et al., 2018) is to construct a region the input point in which the desired classifier to explain remains (mostly) constant. Over continuous data, it outputs a local explainer, E , such that E ( x ) = ( R x , g x ) , where g x is a constant classifier with g x ( x ′ ) = f ( x ) for all x ′ ∈ R d , and R x is a hyper-rectangle containing x . It follows say that the Anchors method outputs an explainer in the class, E ( H d , C d ) .

Gradient-Based Explanations: Many popular explainability tools (Smilkov et al., 2017; Agarwal et al., 2021; Ancona et al., 2018) explain a model's local behavior by using its gradient. By definition, gradients have a natural interpretation as a locally linear model. Because of this, we argue that gradient-based explanations are implicitly giving local explanations of the form ( R x , g x ) , where R x = B ( x, r ) is a small L 2 ball centered at x , and g x is a linear classifier with coefficients based on the gradient. Therefore, while the radius r and the gradient g x being used will vary across explanation methods, the output can be nevertheless interpreted as an explainer in E ( B d , L d ) , where B d denotes the set of all L 2 -balls in R d , and L d denotes the set of all linear classifiers over R d .

LIME: At a high level, LIME (Ribeiro et al., 2016) also attempts to give local linear approximations to a complex model. However, unlike gradient-based methods, LIME includes an additional featurewise discretization step where points nearby the input point, x , are mapped into a binary representation in { 0 , 1 } d based on how similar a point is to x . As a consequence, LIME can be construed as outputting local explanations of a similar form to those outputted by gradient-based methods.

Finally, as an important limitation of our work, although many well-known local explanations fall within our definitions, this does not hold in all cases. Notably, Shapley-value (Lundberg and Lee, 2017) based techniques do not conform to the format given in Definition 2.1, as it is neither clear how to construct local regions that they correspond to, nor the precise local classifier being used.

2.4 A measure of how accurate an explainer is

We now formalize what it means for a local classifier, g x , to 'approximate" the behavior of f in R x .

Definition 2.3. For explainer E and point x , we let the local loss , L ( E,f,x ) be defined as the fraction of examples drawn from the region R x such that g x and f have different outputs. More precisely, we set

̸

µ is implicitly used to evaluate E , and is omitted from the notation for brevity. We emphasize that this definition is specific to classification , which is the setting of this work. A similar kind of loss can be constructed for regression tasks based on the mean-squared difference between g x and f .

We contend that maintaining a low local loss across most data points is essential for any reasonable local explainer. Otherwise, the explanations provided by the tool can be made to support any sort of explanation as they no longer have any adherence to the original function f .

To measure the overall performance of an explainer over an entire data distribution, it becomes necessary to aggregate L ( E,f,x ) over all x ∼ µ . One plausible way to accomplish this would be to average L ( E,f,x ) over the entire distribution. However, this would leave us unable to distinguish between cases where E gives extremely poor explanations at a small fraction of points as opposed to giving mediocre explanations over a much larger fraction. To remedy this, we opt for a more precise approach in which a user first chooses a local error threshold , 0 < γ < 1 , such that local explanations that incur an explainabiliy loss under γ are considered acceptable. They then measure the global loss for E by determining the fraction of examples, x , drawn from µ that incur explainability loss above γ .

Definition 2.4. Let γ > 0 be a user-specified local error threshold. For local explainer E , we define the explainability loss L γ ( E,f ) as the fraction of examples drawn from µ that incur a local loss larger than γ . That is,

Weposit that the quantity L γ ( E,f ) serves as an overall measure of how faithfully explainer E adheres to classifier f , with lower values of L γ ( E,f ) corresponding to greater degrees of faithfulness.

2.5 A measure of how large local regions are

The outputted local region R x plays a crucial role in defining the local loss. On one extreme, setting R x to consist of a single point, { x } , can lead to a perfect loss of 0 , as the explainer only needs to output a constant classifier that matches f at x . But these explanations would be obviously worthless as they provide no insight into f beyond its output f ( x ) . On the other extreme, setting R x = R d would require the explainer to essentially replace f in its entirety with g x , which would defeat the purpose of explaining f (as we could simply use g x instead). Motivated by this observation, we define the local mass of an explainer at a point x as follows:

Definition 2.5. The local mass of explainer E with respect to point x and function f , denoted Λ( E,f,x ) , is the probability mass of the local region outputted at x . That is, if E ( f, x ) = ( R x , g x ) , then

Based on our discussion above, it is unclear what an ideal local mass is. Thus, we treat this quantity as a property of local explanations rather than a metric for evaluating their validity. As we will later see, this property is quite useful for characterizing how difficult it is to estimate the explainability loss of an explainer. We also give a global characterization of the local mass called locality .

Definition 2.6. The locality of explainer E with respect to function f , denoted Λ( E,f ) , is the minimum local mass it incurs. That is, Λ( E,f ) = inf x ∈ supp ( µ ) Λ( E,f,x ) .

3 The Auditing Framework

Recall that our goal is to determine how explanation receivers can verify provided explanations in situations where there isn't mutual trust. To this end, we provide a framework for auditing local explanations , where an auditor attempts to perform this verification with as little access to the underlying model and explanations as possible. Our framework proceeds in with the following steps.

The auditor fixes a local error threshold γ .

A set of points X = { x 1 , . . . , x n } are sampled i.i.d from data distribution µ .

A black-box classifier f is applied to these points. We denote these values with f ( X ) = { f ( x 1 ) , . . . , f ( x n ) } .

A local explainer E outputs explanations for f at each point. We denote these explanations with E ( f, X ) = { E ( f, x 1 ) , . . . , E ( f, x n ) } .

The Auditor outputs an estimate A ( X,f ( X ) , E ( f, X )) for the explainability loss.

Observe that the auditor can only have access to the the model f and its corresponding explanations through the set of sampled points. Its only inputs are X , f ( X ) , and E ( f, X ) . In the context of the job application example discussed in Section 1, this would amount to auditing a company based on the decisions and explanations they provided over a set of applicants.

In this framework, we can define the sample complexity of an auditor as the amount of data it needs to guarantee an accurate estimate for L γ ( E,f ) . More precisely, fix a data distribution, µ , a classifier, f , and an explainer E . Then we have the following:

Definition 3.1. For tolerance parameters, ϵ 1 , ϵ 2 , δ > 0 , and local error threshold, γ > 0 , we say that an auditor, A , has sample complexity N ( ϵ 1 , ϵ 2 , δ, γ ) with respect to µ, E, f , if for any n ≥ N ( ϵ 1 , ϵ 2 , δ, γ ) , with probability at least 1 -δ over X = { x 1 , . . . , x n } ∼ µ n , A outputs an accurate estimate of the explainability loss, L γ ( E,f ) . That is,

Next, observe that our sample complexity is specific to the distribution, µ , the classifier, f , and the explainer, E . We made this choice to understand the challenges that different choices of µ , f , and E pose to an auditor. As we will later see, we will bound the auditing sample complexity using the locality (Definition 2.5), which is a quantity that depends on µ , f , and E .

4 How much data is needed to audit an explainer?

4.1 A lower bound on the sample complexity of auditing

We now give a lower bound on the amount of data needed to successfully audit an explainer. That is, we show that for any auditor A and any data distribution µ we can find some explainer E and some classifier f such that A is highly likely to give an inaccurate estimate of the explainability loss. To state our theorem we use the following notation and assumptions. Recall that H d denotes the set of hyper-rectangles in R d , and that C d denotes the set of the two constant binary classifiers over R d . Additionally, we will include a couple of mild technical assumptions about the data distribution µ . We defer a detailed discussion of them to Appendices A.3 and A.1. We now state our lower bound.

Theorem 4.1 ( lower bound on the sample complexity of auditing ) . Let ϵ 1 , ϵ 2 < 1 48 be tolerance parameters, and let γ < 1 3 be any local error threshold. Let µ be any non-degenerate distribution, and λ > 0 be any desired level of locality. Then for any auditor A there exists a classifier f : R d →{± 1 } and an explainer E ∈ E ( H d , C d ) such that the following conditions hold.

E has locality Λ( E,f ) = λ .

There exist absolute constants c 0 , c 1 > 0 such that if the auditor receives

many points, then with probability at least 1 3 over X = { x 1 , . . . , x n } ∼ µ n , A gives an inaccurate estimate of L γ ( E,f ) . That is,

In summary, Theorem 4.1 says that auditing an explainer requires an amount of data that is inversely proportional to its locality. Notably, this result does not require the data-distribution to be adversarially chosen, and furthermore applies when the explainer E can be guaranteed to have a remarkably simple form being in E ( H d , C d ) .

Proof intuition of Theorem 4.1: The main intuition behind Theorem 4.1 is that estimating the local explainability loss, L ( E,f,x ) , requires us to observe samples from the regions R x . This would allow us to obtain an empirical estimate of L ( E,f,x ) by simply evaluating the fraction of points

from R x that the local classifier, g x , misclassifies. This implies that the locality λ is a limiting factor as it controls how likely we are to observe data within a region R x .

However, this idea enough isn't sufficient to obtain our lower bound. Although the quantity Ω ( 1 λ 1 -O ( ϵ ) ) does indeed serve as a lower bound on the amount of data needed to guarantee seeing a large number of points within a region, R x , it is unclear what a sufficient number of observations within R x is. Even if we don't have enough points in any single region, R x , to accurately estimate L ( E,f,x ) , it is entirely plausible that aggregating loose estimates of L ( E,f,x ) over a sufficient number of points x might allow us to perform some type of estimation of L γ ( E,f ) .

To circumvent this issue, the key technical challenge is constructing a distribution of functions f and fixing m = O ( 1 ϵ ) such that observing fewer than m points from a given region, R x , actually provides zero information about which function was chosen. We include a full proof in Appendix A.

4.2 An upper bound on the sample complexity of auditing.

We now show that if λ is reasonably large, then auditing the explainability loss L γ ( E,f ) can be accomplished. As mentioned earlier, we stress that succeeding in our setting is not a sufficient condition for trusting an explainer - verifying that the local explanations g x match the overall function f is just one property that a good explainer would be expected to have. Thus the purpose of our upper bound in this section is to complement our lower bound, and further support that the locality parameter λ is the main factor controlling the sample complexity of an auditor.

Our auditing algorithm proceeds by splitting the data into two parts, X 1 and X 2 . The main idea is to audit the explanations given for points in X 1 by utilizing the data from X 2 . If we have enough data, then it is highly likely for us to see enough points in each local region to do this. We defer full details for this procedure to Appendix B.1. We now give the an upper bound on its sample complexity.

Theorem 4.2 ( Upper Bound on Sample Complexity of Algorithm 1 ) . There exists an auditor, A , for which the following holds. Let µ be a data distribution, f be a classifier, and E be an explainer. Suppose that E has locality λ with respect to µ and f . Let ϵ 1 , ϵ 2 , δ be tolerance parameters and let γ > 0 be a local error threshold. Then A has sample complexity at most

This bound shows that the locality is sufficient for bounding the sample complexity for auditing local explanations. We defer a full proof to Appendix B. Observe that the dependency on λ is O ( 1 λ ) which matches the dependency in our lower bound provided that ϵ 1 , ϵ 2 → 0 .

5 The locality of practical explainability methods can be extremely small

Theorems 4.1 and 4.2 demonstrate that the locality λ characterizes the amount of data needed for an Auditor to guarantee an accurate estimate of the explainability loss L λ ( E,f ) . It follows that if λ is extremely small, then auditing could require a prohibitive amount of data. This leads to the following question: how small is λ for practical explainability algorithms? To answer this, we will examine examine several commonly used algorithms that adhere to our framework.

We begin with gradient-based methods , which can be construed as providing an explainer in the class E ( B d , L d ) , where B d denotes the set of L 2 balls in R d , and L d denotes the set of linear classifiers. To understand the impact of dimension on the locality of such explainers, we begin with a simple theoretical example.

Let µ be the data distribution over R d that is a union of three concentric spheres. Specifically, x ∼ µ is equally likely to be chosen at uniform from the sets S 1 = { x : || x || = 1 -α } , S 2 = { x : || x || = 1 } , and S 3 = { x : || x || = 1 + β } , where α, β are small d -dependent constants (Defined in Appendix C). Let f : R d →{± 1 } be any classifier such that f ( x ) = 1 if x ∈ S 1 ∪ S 3 and f ( x ) = -1 if x ∈ S 2 . Observe that µ is a particularly simple data distribution over three spherical manifolds, and f is a simple classifier that distinguishes its two parts. We illustrate this distribution in panel (a) of Figure 2.

Despite its simplicity, locally explaining f with linear classifiers faces fundamental challenges. We illustrate this in Figure 2. Choosing a large local neighborhood, as done at point A, leads to issues

B

posed by the curvature of the data distribution, meaning that it is impossible to create an accurate local linear classifier. On the other hand, choosing a neighborhood small enough for local linearity, as done in point B, leads to local regions that are exponentially small with respect to the data dimension . We formalize this in the following theorem.

Theorem 5.1 ( A high dimensional example ) . Let µ, f , be as described above, and let E be any explainer in E ( B d , L d ) . Let x ∗ be any point chosen on the outer sphere, S 3 . Then E outputs an explanation at x ∗ that either has a large local loss, or that has a small local mass. That is, either L ( E,f,x ∗ ) ≥ 1 6 , or Λ( E,f,x ) ≤ 3 1 -d .

Theorem 5.1 demonstrates that if a locally linear explanation achieves even a remotely reasonable local loss, then it necessarily must have an extremely small local explanation. This suggests that, gradient based explanations will be exponentially local with respect to the data dimension, d .

We believe that this is also exhibited in practice particularly over image data , where explanations are often verified based on perceptual validity, rather than relevance to practical training points beyond the point being explained. For example, the explanations given by SmoothGrad (Smilkov et al., 2017) are visualized as pixel by pixel saliency maps. These maps often directly correspond to the image being explained, and are clearly highly specific to the it (see e.g. Figure 3 of (Smilkov et al., 2017)). As a result, we would hardly expect the implied linear classifier to have much success over almost any other natural image. This in turn suggest that the locality would be extremely small. We also remark that a similar argument can be made for Lime , which also tends to validate its explanations over images perceptually (for example, see Figure 4 of Ribeiro et al. (2016)).

Unlike the previous methods, Anchors (Ribeiro et al., 2018) explicitly seeks to maximize the local mass of its explanations. However, it abandons this approach for image classifiers, where it instead maximizes a modified form of locality based on super-imposing pixels from the desired image with other images. While this gives perceptually valid anchors, the types of other images that fall within the local region are completely unrealistic (as illustrated in Figure 3 of (Ribeiro et al., 2018)), and the true locality parameter is consequently extremely small. Thus, although Anchors can provide useful and auditable explanations in low-dimensional, tabular data setting, we believe that they too suffer from issues with locality for high-dimensional data. In particular, we note that it is possible to construct similar examples to Theorem 5.1 that are designed to force highly local Anchors-based explanations.

6 Conclusion

Our results in Section 4 demonstrate that the locality of a local explainer characterizes how much data is needed to audit it; smaller local regions lead to larger amounts of data. Meanwhile, our

discussion in Section 5 shows that typical local explanations are extremely local in high-dimensional space. It follows that in many cases, auditing solely based on point-wise decisions and explanations is impossible. Thus, any entity without model access, such as a collective of users, are never in a position to guarantee trust for a machine learning model.

We believe that the only way forward is through a more powerful third-party auditor that crucially as more access to the machine learning model, as this could potentially break the fundamental challenges posed by small explainability regions. We believe that investigating the precise types of access this would entail as an important direction for future work that might have broad practical consequences.

Finally, although our definition of local explainers encompasses several widely used explanation methods, we do note that there are notable exceptions such as Shap (Lundberg and Lee, 2017), which does not fit into our paradigm. As a consequence, one important direction for future work is expanding our framework to encompass other local explanation methods and examine to what degree they can be audited.

References

Agarwal, S., Jabbari, S., Agarwal, C., Upadhyay, S., Wu, S., and Lakkaraju, H. (2021). Towards the unification and robustness of perturbation and gradient based explanations. In International Conference on Machine Learning (ICML) .

Alvarez-Melis, D. and Jaakkola, T. S. (2018). On the robustness of interpretability methods. arxiv preprint 1806.08049 .

Ancona, M., Ceolini, E., Öztireli, C., and Gross, M. (2018). Towards better understanding of gradientbased attribution methods for deep neural networks. In International Conference on Learning Representations (ICLR) .

Bassan, S. and Katz, G. (2023). Towards formal XAI: formally approximate minimal explanations of neural networks. In Sankaranarayanan, S. and Sharygina, N., editors, Tools and Algorithms for the Construction and Analysis of Systems - 29th International Conference, TACAS 2023, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2022, Paris, France, April 22-27, 2023, Proceedings, Part I , volume 13993 of Lecture Notes in Computer Science , pages 187-207. Springer.

Bhatt, U., Xiang, A., Sharma, S., Weller, A., Taly, A., Jia, Y ., Ghosh, J., Puri, R., Moura, J. M. F., and Eckersley, P. (2020). Explainable machine learning in deployment. In Conference on Fairness, Accountability, and Transparency (FAccT) .

Bordt, S., Finck, M., Raidl, E., and von Luxburg, U. (2022). Post-hoc explanations fail to achieve their purpose in adversarial contexts. In Conference on Fairness, Accountability, and Transparency (FAccT) .

Botari, T., Hvilshøj, F., Izbicki, R., and de Carvalho, A. C. P. L. F. (2020). Melime: Meaningful local explanation for machine learning models. arxiv preprint 2009.05818 .

Dasgupta, S., Frost, N., and Moshkovitz, M. (2022). Framework for evaluating faithfulness of local explanations. In International Conference on Machine Learning (ICML) .

Dombrowski, A., Alber, M., Anders, C. J., Ackermann, M., Müller, K., and Kessel, P. (2019). Explanations can be manipulated and geometry is to blame. In Advances in Neural Information Processing Systems (NeurIPS) .

Ghorbani, A., Abid, A., and Zou, J. Y. (2019). Interpretation of neural networks is fragile. In AAAI Conference on Artificial Intelligence .

Huang, X. and Marques-Silva, J. (2023). The inadequacy of shapley values for explainability. arxiv preprint 2302.08160 .

Jesus, S. M., Belém, C., Balayan, V., Bento, J., Saleiro, P., Bizarro, P., and Gama, J. (2021). How can I choose an explainer?: An application-grounded evaluation of post-hoc explanations. In '21: 2021 ACM Conference on Fairness, Accountability (FAccT) .

Leavitt, M. L. and Morcos, A. S. (2020). Towards falsifiable interpretability research. arxiv preprint 2010.12016 .

Lundberg, S. M. and Lee, S. (2017). A unified approach to interpreting model predictions. In Advances in Neural Information Processing Systems (NeurIPS) .

Oala, L., Fehr, J., Gilli, L., Balachandran, P., Leite, A. W., Ramírez, S. C., Li, D. X., Nobis, G., Alvarado, E. A. M., Jaramillo-Gutierrez, G., Matek, C., Shroff, A., Kherif, F., Sanguinetti, B., and Wiegand, T. (2020). ML4H auditing: From paper to practice. In Machine Learning for Health Workshop, (ML4H@NeurIPS) .

Poland, C. M. (2022). The right tool for the job: Open-source auditing tools in machine learning. arxiv preprint 2206.10613 .

Poppi, S., Cornia, M., Baraldi, L., and Cucchiara, R. (2021). Revisiting the evaluation of class activation mapping for explainability: A novel metric and experimental analysis. In Workshops of the Conference on Computer Vision and Pattern Recognition Workshops (CVPR) .

Poursabzi-Sangdeh, F., Goldstein, D. G., Hofman, J. M., Vaughan, J. W., and Wallach, H. M. (2021). Manipulating and measuring model interpretability. In Conference on Human Factors in Computing Systems (CHI) .

Ribeiro, M. T., Singh, S., and Guestrin, C. (2016). "why should I trust you?": Explaining the predictions of any classifier. In Demonstrations Session, Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies .

Ribeiro, M. T., Singh, S., and Guestrin, C. (2018). Anchors: High-precision model-agnostic explanations. In McIlraith, S. A. and Weinberger, K. Q., editors, AAAI Conference on Artificial Intelligence .

Smilkov, D., Thorat, N., Kim, B., Viégas, F. B., and Wattenberg, M. (2017). Smoothgrad: removing noise by adding noise. arxiv preprint 1706.03825 .

Tomsett, R., Harborne, D., Chakraborty, S., Gurram, P., and Preece, A. D. (2020). Sanity checks for saliency metrics. In (AAAI) Conference on Artificial Intelligence .

Visani, G., Bagli, E., Chesani, F., Poluzzi, A., and Capuzzo, D. (2022). Statistical stability indices for LIME: obtaining reliable explanations for machine learning models. J. Oper. Res. Soc. , 73(1):91-101.

Wolf, L., Galanti, T., and Hazan, T. (2019). A formal approach to explainability. In AAAI/ACM Conference on AI, Ethics, and Society (AIES) .

Yadav, C., Moshkovitz, M., and Chaudhuri, K. (2022). A learning-theoretic framework for certified auditing of machine learning models. arxiv preprint 2206.04740 .

Zhou, J., Gandomi, A. H., Chen, F., and Holzinger, A. (2021). Evaluating the quality of machine learning explanations: A survey on methods and metrics. Electronics , 10(5):593.

A Proof of Theorem 4.1

A.1 An additional assumption

We also include the assumption that the locality parameter be small compared to the tolerance parameters. More precisely, we assume that λ < ϵ 2 2 .

We believe this to be an extremely mild assumption considering that we typically operate in the regime where λ is exponentially small with the dimension, d , whereas the tolerance parameters are typically between 10 -2 and 10 -3 .

A.2 Main Proof

Proof. Fix ϵ 1 , ϵ 2 , γ, λ , and µ , as given in the theorem statement. Our goal is to show the existence of classifier f and explainer E so that the auditor, A , is likely to incorrectly estimate the parameter, L γ ( E,f ) . To do so, our strategy will be instead to consider a distribution over choices of ( E,f ) , and show that in expectation over this distribution, A estimates L γ ( E,f ) poorly.

To this end, we define the following quantities:

Let E be the explainer given in Section A.4.

Let f ∗ be the random classifier defined in Section A.4.

Let n be any integer with

To do so, let T 1 denote the event and T 2 denote the event

The key observation is that any estimate, A ( X,Y,E ) , can be inside at most one of the intervals, [ 1 2 -ϵ 2 , 1 2 + ϵ 2 ] and [ 1 2 +3 ϵ 2 , 1 2 +5 ϵ 2 ] . Using this, we can re-write our desired probability through the following integration.

Let X be a random variable for a set of points { x 1 , . . . , x n } drawn i.i.d from µ .

Let Y = f ∗ ( X ) be a random variable for { f ∗ ( x 1 ) , f ∗ ( x 2 ) , . . . , f ∗ ( x n ) } . Y has randomness over both f ∗ and X ∗ .

Let ∆ n = ( R d ) n ×{± 1 } n , and σ denote the measure over ∆ n induced by ( X,Y ) .

By definition E 's output is independent of function, f ∗ . Thus, we will abbreviate A 's output by writing

This emphasizes that both X and the output of E are independent of f ∗ .

We let I ∗ denote the interval that the auditor seeks to output an estimate it. That is,

Using this notation, we seek to lower bound that the auditor fails meaning we seek to lower bound,

Let ( x, y ) denote specific choices of ( X,Y ) . Note that in this context, x represents a set of points in ( R d ) n , and y represents a set of labels in {± 1 } n . We then have the following:

where the last equation holds because at least one of the events, A ( x, y, E ) / ∈ I 1 and A ( x, y, E ) / ∈ I 2 , must hold. To bound this last quantity, we utilize Lemma A.9.

Let

By Lemma A.9, we have that σ ( S ∗ ) ≥ 5 6 . It follows that

which completes the proof as this implies with probability at least 1 3 , the Auditors estimate is not sufficiently accurate.

A.3 Non-degenerate Distributions

Theorem 4.1 includes the assumption that µ is non-degenerate , which is defined as follows.

Definition A.1. We say that data distribution µ over R d is non-degenerate if for all x ∈ R d , there exists 1 ≤ i ≤ d such that

Being non-degenerate essentially means that at any point, x , the data distribution µ has a finite probability density with respect to some feature.

This condition any distribution with a well-defined density over R d (i.e. such as a Gaussian) and is also met for most practical data-sets in which any of the features is globally continuously distributed (i.e. mass in kg over a distribution of patients).

We exclude data distributions with point masses because they can pose particularly simple cases in which there is a strict lower bound on how small the local region assigned to a given point can be. For example, in the extreme case where µ is concentrated on a single point, auditing any model or explanation over µ is trivial.

We now show a useful property of non-degenerate distributions.

Lemma A.2. Let µ be a non-degenerate distribution and R be a hyper-rectangle. Then R can be partitioned into two hyper-rectangles, R 1 , R 2 such that µ ( R 1 ) , µ ( R 2 ) ≥ µ ( R ) 4 .

Proof. Let R = ( a 1 , b 1 ] × ( a 2 , b 2 ] ×··· × ( a d , b d ] . First, suppose that there exists 1 ≤ i ≤ d such that for all r ∈ ( a i , b i ] ,

Let

It follows that setting R 1 = R ∩ { x : x i ≤ r ∗ } and R 2 = R \ R 1 will suffice as R 1 will have probability mass at least µ ( R ) 4 and probability mass at most µ ( R ) 2 .

Otherwise, suppose that no such i exists. Then, thus, there exists r 1 , r 2 , . . . , r d } such that µ ( R ∩{ x : x i = r i } ) > 0 . It follows that the point ( r 1 , . . . , r d ) violates Definition A.1, which is a contradiction. Thus some i exists, which allows us to apply the above argument, finishing the proof.

A.4 Constructing f ∗ and E

Webegin by partitioning the support of µ into hyper-rectangles such that each rectangle has probability mass in the interval [ α 4 , α ] . We then further partition these rectangles into a large number of equal parts. Formally, we have the following:

Lemma A.3. Let α > 0 be fixed, and K > 0 be any integer. Then for some integer L > 0 , there exists a set of hyper-rectangles, { R j i : 1 ≤ i ≤ L, 1 ≤ j ≤ K } such that the following hold:

R 1 i , . . . R K i partition rectangle R i .

For all 1 ≤ i ≤ L , α ≤ µ ( R i ) ≤ 4 α .

For all 1 ≤ i ≤ L and 1 ≤ j ≤ K , µ ( R i ) 4 K ≤ µ ( R j i ) ≤ µ ( R i ) K .

Proof. First construct R 1 , . . . , R L by using the following procedure:

Begin with the set A = { R ∗ } where R ∗ is a large rectangle containing the support of µ .

If A contains a rectangle, R , such that µ ( R ) > 4 α , then apply Lemma A.2 to split R into two rectangles with mass at least µ ( R ) 4 and mass at most 3 µ ( R ) 4 .

Repeat step 2 until no such rectangles, R , exist.

This process clearly must terminate in a set of rectangles each of which has mass in the desired range, and also must terminate as a single rectangle can only be cut at most log 1 α log 3 4 times.

Next, to construct R 1 i , R 2 i , R K i , we simply utilize an analogous procedure, this time starting with { R i } and replacing α with µ ( R i ) 4 K .

We now construct a fixed explainer, E .

Definition A.4. Let E denote the explainer so that for all x ∈ supp ( µ ) , we have E ( x ) = ( R x , g +1 ) where R x is the unique hyper-rectangle, R i that contains x , and g +1 is the constant classifier that always outputs +1 .

We now construct a distribution over functions f , and let f ∗ be a random function that follows this distribution. We have the following:

Definition A.5. Let f ∗ be a random classifier mapping R d to {± 1 } constructed as follows. Let m be an integer and 0 ≤ p 1 , . . . , p 2 m , q 1 , . . . , q 2 m ≤ 1 be real numbers that satisfy the conditions set forth in Lemma A.10. Then f ∗ is constructed with the following steps:

Let P be a binary event that occurs with probability 1 2 .

If P occurs, then set r i = p i for 1 ≤ i ≤ p 2 m . Otherwise set r i = q i .

If x / ∈ ∪ L i =1 R i , then f ∗ ( x ) = +1 .

For each rectangle R i , randomly select 1 ≤ k ≤ 2 m at uniform.

For each sub-rectangle R j i , with probability r k , set f ( x ) = -1 for all x ∈ R j i , and with probability 1 -r k , set f ∗ ( x ) = +1 for all x ∈ R j i .

Note that m is constructed based on ϵ 1 , ϵ 2 , and γ which we assume to be provided as in the statement of Theorem 4.1.

A.5 Properties of f ∗ and E

We now prove several useful properties of this construction. To do so, we use the following notation:

We let f ∗ denote the random variable representing the way f is generated. We use f ∗ = f to denote the event that f ∗ equals a specific function f : R d →{± 1 } .

We let P denote the indicator variable for the binary event used in Section A.4 to construct f .

We let m denote the integer from Lemma A.10 that is used to construction f ∗ .

We let X = ( x 1 , . . . , x n ) ∼ µ n denote a random variable of n i.i.d selected points from µ . We use x to denote a specific instance of X .

We let Y = ( y 1 , . . . , y n ) be a random variable over labels constructed by setting y i = f ∗ ( x i ) . We similarly use y to denote a specific instance of Y .

We let σ denote the measure over ( R d ×{± 1 } ) n associated with ( X,Y ) .

We let ∆ n denote the domain of the pair of random vectors ( X,Y ) (as done in Section A.2)

We begin with a bounds on the probability that we see any rectangle that has a large number of points selected from it.

Lemma A.6. Let R 1 , . . . , R L be as defined in section A.4, and m as given. Let U denote the subset of ∆ n such that

Then σ ( U ) ≤ 1 180 .

Proof. We bound the probability that a single rectangle, R i , contains at least 2 m points from X , and then apply a union bound over all L rectangles. By construction, µ ( R i ) ≤ 4 λ , which implies that for each point x j ∈ X the probability that X j falls within rectangle R i is at most 4 λ . Thus, for any set of 2 m distinct points from X , the probability that they all fall within R i is at most (4 λ ) 2 m . By taking a union bound over all ( n 2 m ) subsets of 2 m point from X , and substituting our assumed upper bound for n (point 3. of Section A.2), we have the following

By definition (see Lemma A.10), m ≥ 1 16 max( ϵ 1 ,ϵ 2 ) . Substituting this, and noting that λ 1 -1 2 m is increasing with respect to m (since λ < 1 ), we have

Finally, we apply a union bound over all rectangles. Observe that there are at most 1 λ such rectangles because by construction each rectangle has mass at most λ . Thus, our total probability is at most 1 λ λ 180 which is at most 1 180 as desired.

Next, we leverage the properties from the construction of f to bound the conditional probability of P = 1 when ( x, y ) / ∈ U .

Lemma A.7. Let ( x, y ) be in the support of σ so that ( x, y ) / ∈ U . Then

Proof. Our main idea will be to use Bayes-rule, and show that Pr[( X,Y ) = ( x, y ) | P = 1] = Pr[( X,Y ) = ( x, y ) | P = 0 . This will suffice due to the fact that the prior distribution for P is uniform over { 0 , 1 } . To do so, we first note that X is independent from P . For this reason, it suffices to show that

To do so, we will express these probabilities in terms of the real numbers, p 1 , . . . , p 2 m and q 1 , . . . , q 2 m from which they were constructed (see Definition A.5).

For each rectangle, R i (see Lemma A.3), let Y ∩ R i denote the function values of all points in the set X ∩ R i . It follows from step 4 of Definition A.5 that the values in Y ∩ R i and Y ∩ R j are independent from each other. Thus, we can re-write our desired probability as

We now analyze the latter quantity for a rectangle, R i . For convenience, let us relabel indices so that x ∩ R i = { x 1 , x 2 , . . . , x l } and y ∩ R i = { y 1 , . . . , y l } for some integer l ≥ 0 . We also let X 1 , . . . , X l and Y 1 , . . . , Y l denote the corresponding values for X ∩ R i and Y ∩ R i .

We now further assume that that for all x a , x b ∈ { x 1 , . . . , x l } , that x a and x b are contained within different sub-rectangles, R a i , R b i (see Definition A.5). If this isn't the case, observe that we can simply remove the pair ( x b , y b ) , as by the construction of f ∗ , this will be forced to be identical to ( x a , y a ) .

By applying this assumption, we now have that for a given choice of the parameter r k (step 4 of Definition A.5), the values of y 1 , . . . , y l are mutually independent . Utilizing this, we have

Where F is a polynomial of degree l . Here, the expression, y k 2 -y k p j + 1 2 simply evaluates to p j if y k = -1 (as p j is the probability of observing a -1 ) and 1 -p j otherwise.

Next, observe that the only difference when performing this computation for P = 0 is that we use the real numbers, q 1 , . . . q 2 m instead. Thus, we have,

To show these two expression are equal, by assumption ( x, y ) / ∈ U which implies that l < 2 m . Furthermore, by Lemma A.10, ∑ 2 m k =1 p t k = ∑ 2 m k =1 q t k ,for all 0 ≤ t ≤ l . It follows that ∑ 2 m k =1 F ( p k ) = ∑ 2 m k =1 F ( q k ) , which implies our desired result.

Next, we bound the probability of events related to the value of L γ , the parameter that the Auditor seeks to estimate.

Lemma A.8. Let T 1 denote the event that

Let T 0 denote the event that

Then taken over the randomness of the entire construction, Pr[ T 1 , P = 1] , Pr[ T 0 , P = 0] ≥ 89 180 , where P is the binary event defined above.

Proof. By definition, Pr[ P = 1] = Pr[ P = 0] = 1 2 . Thus, it suffices to show that Pr[ T 1 | P = 1] , Pr[ T 0 | P = 0] ≥ 89 90 .

We begin with the case that P = 1 (the case for P = 0 will be similar). For each rectangle, R i , let r ( R i ) denote the choice of r k made for R i in step 5 of Definition A.5. The crucial observation is that the value of r ( R i ) nearly determines the local loss that E pays for points in R i with respect to f ∗ . In particular, if the number of sub-rectangles, K , is sufficiently large, then by the law of large numbers, we have that with high probability over the choice of f ∗ , for all rectangles R i and for all x ∈ R i ,

Let us fix K to be any number for which this holds, and assume that this value of K is set throughout our construction.

Recall that r ( R i ) is chosen at uniform among { p 1 . . . p 2 m } (step 5 of Definition A.5). It follows from Equation 1 that for any x ∈ R i , and for any α ∈ { γ (1 -ϵ 1 ) , γ (1 + ϵ 1 ) } that

Furthermore, because we are conditioning on P = 1 , the value of f ∗ within each rectangle, R i , is independent. This implies that we can bound the behavior of L α ( E,f ∗ ) by expressing as a sum of independent variables.

Let α ∈ { γ (1 -ϵ 1 ) , γ (1 + ϵ 1 ) } , we have by Hoeffding's inequality that

The penultimate inequality holds since µ ( R i ) ≤ 4 λ for each R i , and because there are at most 1 λ such rectangles. The last inequality holds because λ < ϵ 2 2 by the assumption in Section A.1.

Thus by taking a union bound over both values of α , we have that L α ( E,f ∗ ) ∈ [ 1 2 -ϵ 2 , 1 2 + ϵ 2 ] with probability at least 89 90 . This completes our proof for the case P = 1 .

For P = 0 , we can follow a nearly identical argument. The only difference is that the values of q (see Lemma A.10) are selected so that

This results in the expected loss falling within a different interval, and an identical analysis using Hoeffding's inequality gives the desired result.

The main idea of proving Theorem 4.1 is to show that for many values of X,Y , the conditional probabilities of T 1 and T 0 occurring are both fairly large. This, in turn, will cause the Auditor to have difficulty as its estimate will necessarily fail for at least one of these events.

To further assist with proving this, we have the following additional lemma.

Lemma A.9. Let S ∗ denote the subset of ( R d ×{± 1 } ) n such that

Then σ ( S ∗ ) ≥ 5 6 .

Proof. Let S ′ 1 = { ( x, y ) : Pr[ T 1 | ( X,Y ) = ( x, y )] < 2 5 } , and similarly S ′ 2 = { ( x, y ) : Pr[ T 2 | ( X,Y ) = ( x, y )] < 2 5 } . Then S ∗ = ( R d ×{± 1 } ) n \ ( S ′ 1 ∪ S ′ 2 ) . Thus it suffices to upper bound the mass of S ′ 1 and S ′ 2 . To do so, let U be the set defined in Lemma A.6. Then we have

Here we are simply leveraging the fact that Pr[ P = 1 | X,Y = x, y ] is precisely 1 2 when x, y are not in U , and consequently that the probability of T 1 and P = 1 is at most 2 5 , 1 , and 1 2 when ( x, y ) is in the sets S ′ 1 , U \ S ′ 1 and (∆ n \ U ) \ S ′ 1 respectively. Finally, simplifying this inequality gives us σ ( S ′ 1 ) ≤ 1 12 .

A completely symmetric argument will similarly give us that σ ( S ′ 2 ) ≤ 1 12 . Combining these with a union bound, it follows that σ ( S ∗ ) ≥ 5 6 , as desired.

A.6 Technical Lemmas

Lemma A.10. For all 0 < γ,ϵ 1 , ϵ 2 < 1 48 , there exists m > 0 , and real numbers 0 ≤ p 1 , p 2 , . . . , p 2 m , q 1 , . . . , q 2 m ≤ 1 such that the following four conditions hold:

For all 0 ≤ t ≤ 2 m -1 , ∑ 2 m i =1 p t i = ∑ 2 m i =1 q t i .

1 4 ϵ 2 ≥ m ≥ 1 8 max(2 ϵ 1 ,ϵ 2 ) +1 .

Proof. Let l denote the largest integer that is strictly smaller than 1 8 max(2 ϵ 1 ,ϵ 2 ) , and let ϵ = 1 8 l . It follows that ϵ ≥ max(2 ϵ 1 , ϵ 2 ) . Let P l and Q l be as defined in Lemma A.11. Let m = 2 l . Then it follows from the definitions of m,l that

which proves the first part of property 4 in Lemma A.10. For the second part, by the definition of l , we have l ≥ 1 8 max(2 ϵ 1 ,ϵ 2 ) -1 . Since ϵ 1 , ϵ 2 ≤ 1 48 , it follows that l ≥ 2 which implies

Next, let p 1 , . . . , p 4 l denote the (sorted in increasing order) roots of the polynomial

Since the roots of P l are explicitly given in Lemma A.11, it follows that the middle two roots of P ′ l ( x ) (which are the values of p m and p m +1 ) satisfy

Because ϵ ′ > ϵ , these values clearly satisfy the inequalities given by point 2 in the Lemma statement.

Next, define q 1 , . . . , q 4 l as the (sorted in increasing order) roots of the polynomial,

Again using Lemma A.11, we see that

which satisfies point 3.

To see that p i and q i are indeed in the desired range, we simply note that by substitution, both p 1 and p 2 must be larger than γ (1 + 2 ϵ 1 ) -4 l (2 γϵ ) . However, by definition, 4 l (2 γϵ ) = γ . Thus, this quantity is larger than 0 which implies that p 1 and q 1 are both positive. Because γ < 1 10 , a similar argument implies that p 2 m and q 2 m are at most 1 .

Finally, point 1 follows from the fact that p 1 , . . . , p 2 m and q 1 , . . . , q 2 m are the complete sets of roots of two polynomials that have matching coefficients for the first 2 m coefficients. it follows by basic properties of Newton sums that ∑ p t i = ∑ q t i for 0 ≤ i ≤ 2 m -1 , and this proves point 1.

Let Q l ( x ) = P l ( x ) -P l (0) . Then Q l has 2 l -1 distinct real roots over the interval ( -4 l, -1) , 2 l -1 distinct real roots over the interval (1 , 4 l ) , and a double root at x = 0 .

Proof. By symmetry, P ′ l (0) = Q ′ l (0) = 0 , and by definition Q l (0) = 0 . It follows that x = 0 is a double root. Next, fix 1 ≤ i ≤ l -1 . By definition, we have that P l (4 i -1) = P l (4 i +1) = 0 . We also have that

Meanwhile, we also have that P l (0) = ( ∏ 2 j =1 l (2 j -1) ) 2 . By directly comparing terms, it follows that P l ( i ) is strictly larger than P l (0) . Thus, by the intermediate value theorem, Q l must have at least one root in both (4 i -1 , 4 i ) and (4 i, 4 i +1) . Using a similar argument, we can also show that Q l has at least one root in (4 l -1 , 4 l ) .

Since P l is an even function, it follows that Q l is as well which means it symmetrically has roots in the intervals ( -4 i, -4 i + 1) for 1 ≤ i ≤ l and ( -4 i -1 , 4 i ) for 1 ≤ i ≤ l -1 . Taken all together, we have constructed 2( l + l -1) = 4 l -2 distinct intervals that each contain a root. Since Q l also has a double root at x = 0 , it follows that this must account for all of its roots as deg ( Q l ) = deg ( P l ) = 4 l .

B Proof of Theorem 4.2

B.1 Algorithm description

The main idea of our auditor, simple_audit , is to essentially performs a brute-force auditing where we choose a set of points, X 1 , and attempt to assess the accuracy of their local explanations by using a a wealth of labeled data, X 2 , to validate it. Our algorithm uses the following steps (pseudocode given in Algorithm 1).

(lines 1 -3) We first partition X based on the tolerance parameters, ϵ 1 , ϵ 2 , δ . X 1 will be the set of points that we validate, and X 2 will be the set of points we use for validation.

(lines 8), For each point x in X 1 , we check whether there are enough points from X 2 that fall within its local region, R x , to accurate estimate its local loss.

(line 9-13) For each point satisfying the criteria in line 8, we evaluate its empirical local loss and then tally up how many points have a loss that is larger than γ .

(line 17) We output the proportion of points with loss larger than γ among all points whose loss we measured.

At a high level, we expect this algorithm to succeed as long as we have enough data in each of the local regions induced from points in X 1 .

B.2 Notation

We use the following:

Let δ, ϵ 1 , ϵ 2 , γ be the tolerance parameters defined in Definition 3.1.

Let λ = Λ( E,f ) denote the locality of E,f w.r.t. data distribution µ .

Let X 1 be the set of points that are specifically being audited.

Let X 2 be the set of points being used to audit.

Let | X 1 | = m . By definition, m> log 1 δ ϵ 2 2 .

We set | X 2 | = n ′ = n -m . By definition, n ′ > stuff .

̸

̸

For any x ∈ R d , we let E ( x ) = ( R x , g x ) be the local explanation outputted for x by explainer E .

We also define the following quantities related to estimating how frequently the local loss outputted by the explainer E is above the desired threshold, γ .

Let r ∗ = Pr x ∼ µ [ L ( E,f,x ) ≥ γ (1 + ϵ 1 )] .

Let g ∗ = Pr x ∼ µ [ γ (1 -ϵ 1 ) ≤ L ( E,f,x ) ≤ γ (1 + ϵ 1 )] .

Here, r ∗ denotes the probability that a point has a large local error, b ∗ , the probability a point has a low local error, and g ∗ , the probability of an "in-between" case that is nearby the desired threshold, γ . By the definition of sample complexity (Definition 3.1), the goal of Algorithm 1 is to output an estimate that is inside the interval, [ r ∗ -ϵ 2 , r ∗ + g ∗ + ϵ 2 ] .

Next, we define r, g, b as versions of these quantities that are based on the sample, X 1 .

Let r = Pr x ∼ X 1 [ L ( E,f,x ) ≥ γ (1 + ϵ 1 )] . 2. Let g = Pr x ∼ X 1 [ γ (1 -ϵ 1 ) ≤ L ( E,f,x ) ≤ γ (1 + ϵ 1 )] . 3. Let b = Pr x ∼ X 1 [ L ( E,f,x ) ≤ γ (1 -ϵ 1 )] .

Observe that while x is drawn at uniform from X 1 in these quantities, we still use the true loss with respect toe µ , L ( E,f,x ) , to determine whether it falls into r, g or b . Because of this, it becomes necessary to define two more fully empirical quantities that serve as estimates of r and b (we ignore g as it will merely contribute to a "margin" in our estimation terms).

̸

The final estimate outputted by Algorithm 1 is precisely r ′ r ′ + b ′ . Thus, our proof strategy will be to show that for sufficiently large samples, r, g, b are relatively accurate estimates of r ∗ , g ∗ , b ∗ , and in turn r ′ and b ′ are relatively accurate estimates of r and b . Together, these will imply that our estimate is within the desired interval, [ r ∗ , b ∗ ] .

B.3 The main proof

Proof. (Theorem 4.2) Let

By ignoring log factors, we see that n = ˜ O ( 1 ϵ 2 2 + 1 λγ 2 ϵ 2 1 ) , thus satisfying the desired requirement in Theorem 4.2.

Let X 1 and X 2 be as in Algorithm 1, and let m,n ′ denote | X 1 | and | X 2 respectively. Directly from Algorithm 1, it follows that ,

By letting ϵ = ϵ 2 7 , and k = log 16 ϵδ 2( γϵ 1 ) 2 , we have that m ≥ 1 2 ϵ 2 log 12 δ , and that

Our bounds on m,k and n ′ allow us to apply Lemmas B.1 and B.4 along with a union bound to get that the following equations hold simultaneously with probability at least 1 -δ over X ∼ µ n :

Recall that our goal is to show that r ′ r ′ + b ′ ∈ [ r ∗ -ϵ 2 , r ∗ + g ∗ + ϵ 2 ] holds with probability at least 1 -δ . Thus, it suffices to show that this a simple algebraic consequence of equations 2, 3, and 4. To this end, we have

Here step (a) follows from Equations 3 and 4, (b) from Equation 2, and (c) from the fact that ϵ = ϵ 2 11 .

For the other side of the inequality, we have

Here step (a) follows from Equations 3 and 4, (b) from Equation 2, (c) from the fact that 1 1 -3 ϵ ≤ 1+4 ϵ , (d) from ϵ = ϵ 2 11 ≤ 1 8 , 1 2 , and (e) from the ϵ = ϵ 2 11 .

B.4 Concentration lemmas

In this section, we show several lemmas that allow us to bound the behavior of the random variables r, g, b, r ′ and b ′ (defined in section B.2). We also use m and n ′ as they are defined in Section B.2 to be the sizes of | X 1 | and | X 2 | respectively. Finally, we also let ϵ = ϵ 2 11 .

We begin by bounding the differences between r, g, b and r ∗ , g ∗ , b ∗ .

Lemma B.1. Suppose that m ≥ 1 2 ϵ 2 log 12 δ . Then with probability at least 1 -δ 2 over X 1 ∼ µ m , the

Proof. Observe that r is the average of m i.i.d binary variables each of which have expected value r ∗ . It follows by Hoeffding's inequality that

By an identical argument, we see that the same holds for Pr[ | g -g ∗ | > ϵ ] and Pr[ | b -b ∗ | > ϵ ] . Applying a union bound over all three gives us the desired result.

Next, we show that if n ′ is sufficiently large, then it is highly likely that for any given point x , we observe a large number of points from X 2 within the explanation region, R x .

Lemma B.2. Let x ∈ supp ( µ ) , and let k > 0 be an integer. Suppose that n ′ ≥ k log 8 k δϵ λ . Then with probability at least 1 -δϵ 8 over X 2 ∼ µ m , | R x ∩ X 2 | ≥ k .

Proof. Partition X 2 into k sets, X 1 2 , X 2 2 , . . . , X k 2 each of which contain at least log 8 k δϵ λ i.i.d points from µ . Because each point is drawn independently, we have that for any 1 ≤ i ≤ k ,

Here we are using the definition of λ as a lower bound on the probability mass of R x .

Next, we show that if R x has a sufficient number of points, then it is quite likely for the empirical estimate of the local loss at x to be accurate.

Lemma B.3. Let x ∈ supp ( µ ) , and let k ≥ log 16 ϵδ 2( γϵ 1 ) 2 . Then conditioning on there being at least k elements from X 2 in R x , the empirical local loss at x differs from the true local loss by at most γϵ 1 with probability at least 1 -δϵ 8 . That is,

̸

Proof. The key idea of this lemma is that the distribution of k points drawn from µ conditioned on being in R x is precisely the marginal distribution over which L ( E,f,x ) is defined. In particular, this means that the points in X 2 ∩ R x can be construed as i.i.d drawn from the marginal distribution of µ over R x . Given this observation, the rest of the proof is a straightforward application of Hoeffding's inequality. Letting ˆ L ( E,f,x ) = 1 | X 2 ∩ R x | ∑ x ′ ∈ X 2 ∩ R x ✶ ( g x ( x ′ ) = f ( x ′ )) and K = | X 2 ∩ R x | , we have as desired.

It follows by a union bound that the probability that least one of the sets in { X i 2 ∩ R x : 1 ≤ i ≤ k } is empty is at most δϵ 8 . Thus with probability at least 1 -δϵ 8 , all the sets are non-empty which implies that | R x ∩ X 2 | ≥ k , completing the proof.

Finally, we use the previous two lemmas to show that r ′ and b ′ closely approximate r and b .

Lemma B.4. Let k ≥ log 16 ϵδ 2( γϵ 1 ) 2 , and suppose that n ′ ≥ k log 8 k δϵ λ . Then with probability at least 1 -δ 2 over X 2 ∼ µ n ′ , the following equations holds:

Proof. We begin by defining subsets of X 1 that correspond to r, g, b, r ′ and b ′ . We have

Let R = { x ∈ X 1 : L ( E,f,x ) ≥ γ (1 + ϵ 1 ) } .

Let G = { x ∈ X 1 : γ (1 -ϵ 1 ) ≤ L ( E,f,x ) ≤ γ (1 + ϵ 1 ) } .

̸

̸

̸

Observe that r, g, b, r ′ , and b ′ are the probabilities that x ∼ X 1 is in the sets R,G,B,R ′ , and B ′ respectively.

Our strategy will be to use the previous lemmas to bound the sizes of the intersections, R ′ ∩ R,R ′ ∩ B,B ′ ∩ R,B ′ ∩ B ′ . To this end, let x ∈ R be an arbitrary point. By Lemma B.2, with probability at least 1 -δϵ 8 over X 2 ∼ µ n ′ , x ∈ R ′ ∪ B ′ . Furthermore, by Lemma B.3 (along with the definition of R ), with probability at most δϵ 8 , x ∈ B ′ . Applying linearity of expectation along with Markov's inequality, we get the following two bounds:

Applying an analogous line of reasoning stating with x ∈ B , we also have

Applying a union bound, none of these events occur with probability at least 1 -δ 2 over X 2 ∼ µ n ′ . Thus, it suffices to show that they algebraically imply the desired inequalities. To this end, suppose none of them hold. Then we have,

The upper and lower bounds on b ′ are analogous.

C Proof of Theorem 5.1

C.1 Definitions and Notation

Definition C.1. Let α = 1 3670016 d 4 and β = 1 3584 d 2 .

Definition C.2. Let S 1 , S 2 , S 3 be three ( d -1) -spheres centered at the origin with radii (1 -α ) , 1 , and 1 + β respectively for 0 < α, β .

Definition C.3. Let µ denote the data distribution so that x ∼ µ is selected by first selecting i ∈ { 1 , 2 , 3 } at uniform, and then selecting x from S i at uniform.

Definition C.4. Let f denote the classifier R d →{± 1 } such that

Definition C.5. Let x ∗ be an arbitrary point chosen on S 3 , and let g be any linear classifier, and B ( a, r ) be any L 2 -ball that contains x ∗ .

Lemma C.6. There exists x ∈ S 2 and 0 ≤ θ 1 , θ 2 , θ 3 ≤ π such that

where C ( S, x, θ ) denotes the spherical cap of angle θ centered at x on ( d -1) -sphere S (see Definition C.18).

C.2 Main Proof

We begin by showing that the structure of the data distribution µ provides significant difficulty for linear classifiers. At a high level, the curvature of the spheres, S 1 , S 2 , S 3 , make separating them linearly only possible for small portions of the sphere. We formalize this with the following lemma.

Lemma C.7. Let θ ≥ π 4 . Let x be an arbitrary point on S 2 , and let T 1 ( x, θ ) , T 3 ( x, θ ) denote the sets

Let g : R d → {± 1 } denote any linear classifier. Then g exhibits a loss of at least 1 3 over the conditional distribution of µ restricted to either T 1 or T 3 . That is,

̸

̸

Next, we show that if the local explanation region B ( a, r ) ,contains a sufficiently large probability mass, then it also must include a region that takes the form given by T 1 or T 3 from Lemma C.7.

Lemma C.8. Suppose that µ ( B ( a, r )) ≥ 3 1 -d . Let T 1 and T 3 be as defined in Lemma C.7. Then there exist x ∈ S 2 and θ ≥ π 4 such that at least one of the following hold:

We are now prepared to prove Theorem 5.1.

Proof. (Theorem 5.1) Suppose B ( a, r ) ≥ 3 1 -d . Then by Lemma C.8, there exists θ ≥ π 4 such that either T 1 ( x, θ ) or T 3 ( x, θ ) is a subset of B ( a, r ) and satisfies the conditions outlined above. Suppose that T 1 ( x, θ ) ⊆ B ( a, r ) (the other case is analogous).

Let g be any linear classifier. Then it follows from Lemmas C.7 and C.8 that the loss g incurs over the conditional distribution of µ over B ( a, r ) can be bounded as follows:

̸

̸

which concludes the proof.

C.3 Proof of Lemma C.7

We will show that the claim holds for T 3 ( x, θ ) as the proof for T 1 ( x, θ ) is nearly identical (as α < β ). Let w ∈ R d be a unit vector and b ∈ R be a scalar such that

Our main strategy will be to find a large set of points within T 3 ( x, θ ) such that g ( z ) = g ( z (1 + β )) for all z within this set. This will force g to misclassify either z or z (1 + β ) which will lead to our desired error bound. To this end, define

Lemma C.9. µ ( T ∗ ) µ ( C ( S 2 ,x,θ )) ≤ 1 10 .

Proof. Let z be selected at uniform from

Note that z definitionally satisfies that |⟨ x, z ⟩| ≤ cos π 8 . It suffices to upper bound the probability that g ( z ) = g ( z (1 + β )) . Let C ϕ = { z : ⟨ z, x ⟩ = cos ϕ } . Our main idea is to condition on z ∈ C ϕ , and then integrate over all choices of ϕ . That is, if we let ϕ denote the random variable representing the angle between x and z , then

̸

We will now bound the latter quantity. Fix any ϕ , and observe that the conditional distribution, z | ϕ can be written as

where u is a random vector in R d -1 that is uniformly distributed over the unit sphere, S d -2 ⊆ R d -1 . Rewriting the condition that g ( z ) = g ( z (1 + β )) in terms of u , observe that

̸

where s is a constant that depends solely on b, w, x, and ϕ . Note that we are using the fact that | b | ≤ (1 + β ) as otherwise g would trivially output the same label over all z ∼ µ ).

By applying Lemma C.17 along with the fact that (by definition of ϕ )

we have that which implies the desired result.

Proof. By symmetry, µ ( C ( S 2 , x, π 8 )) = µ ( C ( S 2 , -x, π 8 )) so it suffices to bound one of them. Since θ ≥ π 4 by assumption, applying Lemma C.20, we have

as d ≥ 5 in the assumption of Theorem 5.1.

We are now prepared to prove the main lemma.

Proof. (Lemma C.7) Let A ∗ ⊆ C ( S 2 , x, θ ) be defined as the set of all points for which g classifies both the point and its image in (1 + β ) S 3 correctly. That is,

By the previous two lemmas, we have

Each z ∈ A ∗ is a point for which both z and (1 + β ) z are correctly classified, and each z ∈ C ( S 2 , x, θ ) \ A ∗ corresponds to either z being misclassified, or (1 + β ) z being misclassified. It follows that the overall accuracy of g over T 3 ( x, θ ) is at most

Thus g must incur loss at least 1 3 over T 3 ( x, θ ) , as desired.

C.4 Proof of Lemma C.8

Throughout this section, we assume that µ ( B ( a, r )) ≥ 3 1 -d .

Lemma C.11. max( θ 1 , θ 2 , θ 3 ) ≥ π 3 .

Proof. Assume towards a contradiction that this does not hold. Let x be as in Lemma C.6. Then by the Definition of µ (Definition C.3) and Lemma C.6, it follows that

where Ψ is as defined in Section C.6. However, Lemma C.19 implies that Ψ ( pi 3 ) ≤ 3 1 -d Ψ( π ) = 3 1 -d . This contradicts our assumption on µ ( B ( a, r )) and implies the desired result.

Proof. Lemma C.11 implies that B ( a, r ) must intersect some sphere among S 1 , S 2 , S 3 in a spherical cap of an angle at least π 3 . Basic geometry implies that r ≥ min( rad ( S 1 ) , rad ( S 2 ) , rad ( S 3 )) where rad ( S i ) denotes the radius of S i . The desired result follows from the fact that 1 -α -rad ( S 1 ) ≤ rad ( S 2 ) , rad ( S 3 ) .

Lemma C.13. | θ 2 -max( θ 1 , θ 3 ) | ≤ 1 4 d .

Proof. We first compute θ 1 , θ 2 , θ 3 in terms of a, r, α, and β . We begin with θ 2 , and note that the expressions for θ 1 and θ 3 can be similarly derived. To this end, we have

where we use a to denote || a || in a slight abuse of notation.

It follows from Lemma C.6 that

We can similarly show that

Let h : R → R be the function defined as h ( s ) = s 2 + a 2 -r 2 2 sa . Thus,

Note that in cases where h is outside of the interval [ -1 , 1] (meaning θ i would not be defined), we simply set θ i equal to π and 0 respectively, as these quantities still accurately describe the intersection between B ( a, r ) and the corresponding sphere, S i .

Case 1: 0 ≤ a ≤ β 2

By definition, B ( a, r ) contains x ∗ and therefore intersects S 3 . It follows from the triangle inequality that r ≥ 1 + β 2 . However, this implies that B ( a, r ) must contain the entirety of S 2 and S 1 , which implies that θ 1 = θ 2 = max( θ 1 , θ 3 ) = π , thus implying the lemma statement.

Case 2: β 2 < a ≤ 1 -α

If r > 1 + 2 β , then B ( a, r ) will contain S 1 , S 2 and S 3 , which implies θ 1 = θ 2 = θ 3 = π (implying the lemma statement). Thus, assume r ≤ 1 + 2 β .

Differentiating h w.r.t. s gives

By Lemma C.12, r 2 ≥ a 2 , which implies that h ′ ( s ) is nonnegative for s ∈ [1 -α, 1+ β ] . Furthermore, we have that over the interval, [1 -α, 1 + β ] ,

This is obtained by substituting appropriate upper and lower bounds for r, a, s, α, and β . Because h ′ ( s ) is nonnegative over the interval, we must have that h (1 -α ) ≤ h (1) ≤ h (1 + β ) which implies θ 1 ≥ θ 2 ≥ θ 3 (as cos is a decreasing function). It follows from our upper bound on h ′ ( s ) that

Applying Lemma C.14 implies that | θ 2 -max( θ 1 , θ 3 ) | ≤ 8 √ α β = 1 4 d , which implies the lemma statement.

Case 3: a > 1 -α

First suppose that | a -r | > 3 . If r > a +3 , then the triangle inequality implies that S 1 , S 2 , S 3 ⊆ B ( a, r ) which implies the desired result. On the other hand, if r < a -3 , then we must have a > 3 , and that B ( a, r ) is disjoint from S 1 , S 2 , S 3 which again implies the desired result. Thus, we assume that | a -r | ≤ 3 .

We now use a similar strategy to the previous case, and bound the derivative, h ′ ( s ) . By substituting that | a -r | ≤ 3 , we have, for s ∈ [1 -α, 1 + β ] ,

Here we are exploiting the fact that 1 -α ≥ √ 3 2 , 0 . 65 . It follows by the same argument given in Case 2 that | cos θ 2 -cos(max( θ 1 , θ 3 )) | ≤ 14 β . Applying Lemma C.14 implies | θ 2 -max( θ 1 , θ 3 ) | ≤ 4 √ 14 β = 1 4 d , as desired.

Now we are ready to prove the lemma.

Proof. (Lemma C.8) Let x be as in Lemma C.6, and let θ ∗ = max( θ 1 , θ 2 , θ 3 ) . Then by applying Lemma C.6 to the Definition of µ (Definition C.3) gives us

Here Ψ denotes the function defined in Section C.6.

Next, let θ = min(max( θ 1 , θ 3 ) , θ 2 ) . Let T 1 ( x, θ ) and T 3 ( x, θ ) be as defined in Lemma C.7. Observe that if θ 1 ≥ θ 3 , then

and otherwise,

Thus, at least one of these sets is part of B ( a, r ) . We now show that these sets have the desired mass. By the definition of θ ∗ , we have

Next, Lemma C.11 implies that θ ∗ ≥ π 3 , and Lemma C.13 implies that θ ∗ -θ ≤ 1 4 d . It follows that

where the last steps follow from Lemmas C.19 and C.16. This completes the proof.

C.5 Technical Lemmas

Lemma C.14. Suppose ϕ 1 , ϕ 2 ∈ [0 , π ] such that | cos( ϕ 1 ) -cos( ϕ 2 ) | ≤ c . Then | ϕ 1 -ϕ 2 | ≤ 4 √ c .

Proof. WLOG, suppose ϕ 1 ≤ ϕ 2 . Let x = ϕ 2 -ϕ 1 .

Substituting this, we find that

Using the sum to product rules, it follows that

However, observe that π -ϕ 1 + ϕ 2 2 ≥ ϕ 2 -ϕ 1 + ϕ 2 2 = x 2 and that ϕ 1 + ϕ 2 2 ≥ 0+0+ x 2 = x 2 . It follows that ϕ 1 + ϕ 2 2 ∈ [ x 2 , π -x 2 ] , which implies that sin ϕ 1 + ϕ 2 2 ≥ sin x 2 . Substituting this, we have

We now do casework based on x . First suppose that x ≥ π 2 . Then c ≥ 2 sin 2 π 4 = 1 . By definition, x ≤ π , so it follows that x ≤ 4 √ α , implying the desired result.

Otherwise, if x ≤ π 2 , then sin x 2 ≥ x 4 , as the function t ↦→ sin( t ) -t 2 is nonnegative on the interval [0 , π 2 ] . Substituting this, we see that c ≥ x 2 8 . Thus x ≤ √ 8 c < 4 √ c , as desired.

Lemma C.15. For 0 ≤ c ≤ 1 and 0 ≤ θ ≤ π , sin( cθ ) ≥ c sin( θ ) .

Proof. Let f ( θ ) = sin( cθ ) -c sin( θ ) . Observe that f (0) = 0 . Furthermore, for θ ∈ [0 , π ] , we have f ′ ( θ ) = c cos( cθ ) -c cos( θ ) = c (cos( cθ ) -cos( θ )) . Since cos is a decreasing function on the interval [0 , π ] , it follows that cos( cθ ) ≥ cos( θ ) , which implies f ′ ( θ ) ≥ 0 . Thus f is non-decreasing on the interval, and the desired inequality holds.

Lemma C.16. For all x > 1 , ( 1 -1 x ) x -1 ≥ 1 e .

Proof. Let f ( x ) = ( 1 -1 x ) x -1 . It is well known that lim x →∞ f ( x ) = 1 e and lim x → 1 + f ( x ) = 1 . Thus it suffices to show that f ( x ) is a non-increasing function. To do so, we will show that ln f ( x ) is non-increasing by taking its derivative. We have

Lemma C.17. Let z be a point chosen at uniform over S 2 , and let w be a fixed unit vector. Then if t ≤ 1 1370 d 2 , then for any s ∈ R ,

Proof. Let θ denote the random variable that represents the angle between w and z . Applying Lemma C.14, it follows that for some choice of s ′ ∈ R that

We now bound this quantity by utilizing the quantity Ψ (defined in Section C.6). We have,

Here we have simply chosen the interval of length 4 √ t that maximizes the corresponding the integral. Next, we continue by applying Lemmas C.19 and C.16 to get

as desired.

C.6 Spherical Caps

Definition C.18. Let S be a ( d -1) sphere centered at the origin, let 0 ≤ θ ≤ π be an angle, and let x ∈ S be a point. We let C ( S, x, θ ) denote the spherical cap with angle θ centered at x , and it consists of all points, x ′ ∈ S d -1 , such that ⟨ x,x ′ ⟩ || x |||| x ′ || ≥ cos ϕ.

Here we take the convention of associating C ( S i , x i , 0) with both the empty set and with { x i } . While these are distinct sets, they both have measure 0 under π . We also associate C ( S i , x i , π ) with the entirety of S i .

Welet Ψ( θ ) denote the ratio of the ( d -1) -surface area of the region, C ( S, x, θ ) , to the ( d -1) -surface area of the entire sphere. Thus, Ψ( θ ) denotes the fraction of the sphere covered by a spherical cap of angle θ . By standard integration over spherical coordinates, we have

Next, we bound Ψ( θ ) with the following inequality.

Lemma C.19. Let 0 ≤ θ ≤ π and let 0 ≤ c ≤ 1 . Then

Proof. By applying Lemma C.15 to the definition of Ψ , we have the following manipulations.

We similarly have an upper bound on this ratio.

Lemma C.20. Let 0 ≤ θ ≤ π 2 and 0 ≤ c ≤ 1 . Then

Here we are using the fact that t ↦→ sin ct sin t is a non-decreasing function for t ∈ [0 , π ] .

Proof. We similarly have,

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: we mention all main results in both the abstract and introduction. Furthermore everything within these sections is revisited in the body.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: all our assumptions are clearly stated, and we use the limitations of our methods as avenues for future work. We also stress that our framework is by no means comprehensive for evaluating local explanations.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: this is a theory paper, and doing so is its main focus. our proofs are all included in the appendix.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [NA]

Justification: This is a theory paper.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [NA]

Justification: This is a theory paper.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [NA]

Justification: this is a theory paper

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [NA]

Justification: this is a theory paper

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [NA]

Justification: This is a theory paper

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: this paper does not utilize any datasets or human subjects. It also does not contribute towards any sort of harm.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: we discuss consequences of our results. Because they are theoretical, we don't believe our results can be used in a directly harmful manner.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: no models or data are in this paper.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [NA]

Justification: no code or models are used.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: No released assets

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: no human subjects

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: No human subjects

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper addresses the challenges in verifying the accuracy of local explanations for machine learning models, especially when the model is not fully known and access to it is limited. The primary focus is on minimizing the number of times the model and explainer are accessed during the auditing process. The contributions of the paper are as follows:\n\n**C1. Defining Auditing of Local Explanations:** The paper provides a formal definition of what it means to audit local explanations. It sets the groundwork for systematically evaluating the reliability of these explanations, which are crucial for understanding and trusting machine learning models.\n\n**C2. Importance of the Region’s size**: It highlights that the region to which the local explainer applies is a critical property. Understanding the scope and limits of where the explanation is valid is essential for accurate auditing. This insight helps in identifying when and where an explanation might fail to represent the model correctly.\n\n**C3. Bounds on Auditing Complexity**: The paper establishes both lower and upper bounds on the sample complexity required for auditing local explanations. These bounds are presented as functions of the newly identified property, which is the region’s size. This provides a theoretical framework for understanding the minimal and maximal data requirements for effective auditing.\n\nSTRENGTHS:\n**S1. Framework for Auditing**: It proposes a theoretical framework for auditing local explanations, which is a significant step towards developing more rigorous and reliable methods for verifying the trustworthiness of explanations provided by machine learning models.\n\n**S2. Identification of Key Metrics**: The introduction of the explainability loss function, provides a quantifiable measure for evaluating local explanations for the original model, offering a systematic way to assess explanation quality.\n\n**S3. Highlighting the Importance of Locality**: The analysis which provide upper and lower bounds highlights the importance of the \"locality\" of explanations, bringing attention to a previously underexplored aspect in the explainability literature.\n\nWEAKNESSES:\n**W1. Lack of Evaluation**: The paper does not include an evaluation on real-world datasets. Although the authors suggest that their results could have significant practical implications (“Our results might have far-reaching practical consequences”), an initial step should be to perform evaluations on actual data to validate their findings.\n\n**W2. Limited Discussion with Previous Research**: The paper could benefit from a more thorough discussion of how its findings relate to and build upon previous research in the field. Specifically, the authors mentioned that [Dasgupta 2022] is the most similar to their work, except it is limited to discrete explanations rather than continuous. However, it is not clear whether, in the discrete setting, the proposed work aligns with Dasgupta’s consistency metric, sufficiency metric, or if it does not coincide with any of these previous metrics.\nIt may also be worth discussing and comparing with the recent work of [Bassan 2023], which suggests a verification method for finding minimal sufficient explanations.\n\n- Dasgupta, S., Frost, N. and Moshkovitz, M., 2022. Framework for evaluating faithfulness of local explanations. In International Conference on Machine Learning\n- Bassan, S. and Katz, G., 2023. Towards formal XAI: formally approximate minimal explanations of neural networks. In International Conference on Tools and Algorithms for the Construction and Analysis of Systems\n\n**W3. Focus on a Specific Type of Explanations**: In the paper, the presentation is a bit misleading because it suggests that explanations can be general. However, the focus is on one type of explanation – those that approximate the true model on a region of examples. This is not a general (local) explanation method, even though it includes quite a few types of explanations.\n\nQUESTIONS:\nSee Weaknesses.\n\nLIMITATIONS:\n--", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-10"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work studies an auditing framework in the eXplainable Artificial Intelligence (XAI) area. Specifically, the authors consider the scenario where a group of third-party auditors or users attempt to perform a sanity check on the provided explanations. The framework allows the auditors to query the model prediction and local explanations. Based on the proposed framework, this paper presents a theoretical analysis of the sample complexity of auditing.\n\nSTRENGTHS:\nThis paper targets a very important aspect of XAI studies. It considers the deployment phase where users do not trust the provided explanations. This is a usually overlooked perspective in the XAI community.\n\nWEAKNESSES:\n1. This work focuses on local explanations defined in section 1.1 L48-49 and section 2.2 L155-162. These presumptions limit the scope of this paper to the surrogate model method (such as LIME, MUSE [1], etc.), where a glass-box explainer is used to approximate black box’ predictions in the neighborhood of input data. This greatly limits the impact of this work as such surrogate-model explanation methods only take a very small part of local explanation methods. Local explanations are not limited to surrogate model methods. It can refer to explanations regarding individual input samples instead of the entire data manifold or even regarding the model itself [2]. \n2. In the context of this paper, the authors claim that gradient-based explanations are surrogate model explanation methods (i.e. “local explanation method” under the definition of this paper) in L181-188. The authors define that $g_x(x) = (\\nabla_xf(x))^Tx$, which is the summation of input x gradient attributions. This corresponds to the prediction $f(x)$ only if $f$ satisfies homogeneity [3]. On the contrary, suppose $\\phi_f(x)\\in\\mathbb{R}^d$ is the explanation of SHAP, then $g_x(x):=(\\phi_f(x))^T\\mathbf{1} = f(x)$ can accurately reflects the prediction. Therefore, the definition of the explainers studied in this work is ambiguous and may require more rigorous considerations.\n\nIn summary of points 1 and 2, the formulation of the framework in this work is flawed. \n\n3. There is no empirical verification of the proposed theoretical results, which significantly undermines the contribution of the theoretical analysis. Note that a continuous function is always bounded on the closed neighborhood of x. Therefore, it is essential to empirically test whether the proposed bounds are tight. A theoretical demonstration is also appreciated.\n\n4. [minor] To stay consistent, “Lime” in L337 should be revised to “LIME”.\n\n5. While the motivation that users/auditors may not trust the explanation system and want to audit the model is an interesting and realistic setup, the proposed framework lacks practical contributions. Specifically, the formalism described in L64-66 and L236-242. can be difficult to satisfy.\n\n**Reference**\n\n[1] Lakkaraju, H., & Bastani, O. (2020, February). \" How do I fool you?\" Manipulating User Trust via Misleading Black Box Explanations. In *Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society* (pp. 79-85).\n\n[2] Adebayo, J., Gilmer, J., Muelly, M., Goodfellow, I., Hardt, M., & Kim, B. (2018). Sanity checks for saliency maps. *Advances in neural information processing systems*, *31*.\n\n[3] Hesse, R., Schaub-Meyer, S., & Roth, S. (2021). Fast axiomatic attribution for neural networks. *Advances in Neural Information Processing Systems*, *34*, 19513-19524.\n\nQUESTIONS:\n1. L51-52: Why do the authors claim LIME to be a gradient-based method?\n2. Definitions 2.1 and 2.2 are limited to black box $f:\\mathbb{R}^d\\rightarrow \\{\\pm 1\\}$. Can this constraint be relaxed to more general settings? For example, is it limited to a binary decision boundary?\n3. The main theoretical results of Theorem 4.1 have many presumptions that are not justified. For example, why is the “user-specified” local error threshold assumed to be 1/3?\n\nLIMITATIONS:\nThe limitations of this work are discussed in L194-197, where the authors admit that the definition “local explanation” is narrowed down to fit a. I agree with the limitation and appreciate the authors for clearly stating this issue. However, my concern is that this can be severe and greatly undermine the application scenarios of this work. More details are in the weakness section.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes an auditing framework to verify the truthfulness of explanations by a third-party in scenarios where there is no trust. Bounds on sample complexity are provided that depend on the locality (minimum local mass) of the explanation. Further, the authors discuss that for gradient-based explanations in higher dimensions, locality tends to be small to achieve a reasonable explanation loss. Smaller locality increases the provided bounds on the amount of data required for the audit.\n\nSTRENGTHS:\n1. The topic of the paper is important for policymakers and the XAI research community in general, as it suggests that in natural scenarios where there is no trust, it is difficult to verify whether the local explanation is truthful to the model without actually knowing the model. \n2. The paper provides upper and lower bounds on sample complexity for auditing local explanations. \n3. The analysis includes gradient-based explanations and discusses how to generalize to other methods, including LIME and Anchors.\n\nWEAKNESSES:\n1. Regarding the soundness of the auditing framework, could you please comment on the motivation for the company to provide all of the required data (especially local regions) to the auditor? When the requested dataset is sufficiently large, the third-party company could potentially recover the model along with all the classifier outputs, local regions, and other information.\n2. Figure 1 is hard to fully understand without reading the paper. It’s not intuitive which data points are explained and why, in panel (b), there is sufficient data for the audit. Could you please provide more explanation in the figure caption or simplify the figure?\n3. Section 5 and Theorem 5.1 present an existence proof. However, the example considered in Figure 2 (a) is very specific. Can you elaborate on how often you expect this data distribution to occur in real-world datasets or discuss the value/range of locality for other likely data distributions?\n\nMinor:\n1. $E(f, x_i)$ is used in Section 1 but defined in Section 2.\n2. Please specify $\\epsilon_1$, $\\epsilon_2$, $\\delta$, and $\\gamma$ in Theorem 4.2 or mention that you are operating under the same conditions as in Theorem 4.1, if applicable. Also, Algorithm 1 is referenced before it is defined.\n\nQUESTIONS:\n1. Do you have any guidance or suggestions on how users should choose the local error threshold, $\\gamma$? \n2. How useful are the bounds in Section 4 for reasonable values of locality and low explanation loss, such as when the decision boundary is nearly locally linear? In this case, can you provide any empirical estimates on the lower and upper bounds in Theorems 4.1 and 4.2?\n\nLIMITATIONS:\nThe authors discuss the limitations of the paper with respect to the explanation algorithms.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper provides theoretical results on how many queries are required for an auditing framework for local explanations of machine learning algorithms (e.g., neural networks).\n\nSTRENGTHS:\nThe paper is well motivated with a widely interesting and relevant topic. The approach is theoretical, and rigor is provided through proofs in appendices. The authors connect their work to popular algorithms: Gradient based approaches, Lime, and Anchors.\n\nWEAKNESSES:\nThe authors acknowledge that the local loss estimation is, in their argument, only a necessary but not sufficient condition for trust. They do not establish or reference any evidence that manipulation would result in the local loss as a good indicator of untrustworthiness. As a result, the analysis serves more as a potential validation scheme for the limited types of algorithms that meet their linearity requirement (e.g. Anchors or LIME). This drastically narrows the scope and implications of their analysis. Unless this can be firmly established the title, abstract, and conclusions of the paper should be amended to reflect the correct scope of its claims\nFurthermore, there are plenty of reasons (and examples) where interpretation methods are demonstrated to be frail to the *input* (e.g. Ghorbani). This would likely not pass the audit but would not be evidence that the $E$ has been altered. I think this speaks to some confusion in the setup of the paper as to what “trust-worthiness” is. The authors present it as trust between the user and provider rather than trust in the robustness of the explainability metric which is, I argue, closer to what their results seem to reflect.\nAdditionally, it is not clear to me that this is the only way to test explainability metrics with limited access (e.g. data points, classifier outputs, and local explanations).  For example, these metrics are popular because they match so well to human “expert” knowledge. You show someone the pcitre of the shark from Smilkov et al and they agree that they see “shark-like” shapes in the SmoothGrad output. Consequently, one could imagine the case where sampling in a *non-local* fashion would trace whether the same features matching human “experts” appear. \nUltimately the proposed methodology seems entirely impractical (which is sort of the point).\n\nQUESTIONS:\n-\tCan you establish or provide a reference hat show how the local loss / explainability loss is a good indicator for manipulation from an adversarial attack (or disingenuity design)? This is critical for the scope and implications of your analysis.\n-\tPlease comment on whether the proposed auditing scheme is indeed the only way to establish a local explainer (fitting your constraints) taking into account the suggestions above.\n-\tCan you comment on how the results might \n-\tL 117 please change reference to Shap to the acronym SHAP\n-\tL 337 please change reference to the Lime algorithm to its acronym: LIME\n-\tL 440 where does the 2592 come from in the denominator for the bound on $n$?\n-\tHow well would the framework work if you chose some K examples to audit around instead of drawing sample i.i.d.?\n\nLIMITATIONS:\n-\tAnalysis is for a binary classifier", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}