# Helping CNAs Generate CVSS Scores Faster and More Confidently Using XAI
## 6 Explainability
### Utilizing Raw Shapley Values for Crafting Local Multi-Class Explanations  
In addition to the global bar plot, SHAP also has a plot for local explanation called a force plot. In force plots, given an input sentence, SHAP shows how much each word pushes the model's decision towards one class or the other, in a binary way. As of the moment of writing this paper, SHAP does not have a local multi-class explanation plot. It currently performs what is called a \"one versus all\" technique, where the explanation covers why a sentence has been classified as one class compared to all the others. Figure 15 showcases an example of a local explanation using a real sentence from the dataset. The plot, known as a Force plot, illustrates both the individual and cumulative effects of the words on the model's classification. Each arrow represents a word, and the arrow's length is its Shapley score. In the binary classification scenario shown in the figure, the labels are either 0 or 1. Words colored in red indicate a push toward class 1, while words in blue have the opposite effect, pushing toward class 0, which refers to all the other classes. The values displayed in the plot are the Shapley values, which are not probabilities, hence why they are not within the \([0,1]\) range. In the provided example, we can observe that the words \"scripting\" and \"site\" have the most significant influence on classes 1 and 0, respectively, with the latter being slightly more impactful. Additionally, we can see that the cumulative impact of the top five words in each class exceeds that of the remaining words. Therefore, we could, for instance, focus on these top words for this example. Analysts can leverage their expertise, cross-reference the plot with historical data, and make informed decisions based on this information. However, to obtain a more accurate and holistic view, analysts also would need to make other Force plots, one for each class, for the same input sentence. This represents even more work to perform that may not be the expertise of the analysts. We would rather lessen the burden on them and make it as easy as possible for them. To do so, we propose a novel multi-class local explanation using the raw Shapley values generated by SHAP. These values are stored in a multidimensional array called a tensor. In our case, the tensor is three-dimensional, where the first dimension represents a metric's classes, the second dimension represents the words, and the third dimension represents the sentences. Throughout the rest of this paper, we use the Attack Vector (AV) metric as our example target. Since AV has four classes (LOCAL, PHYSICAL, NETWORK, and ADJACENT_NETWORK) and our test data has 20,000 rows with a maximum of 10,000 words set by the max features parameter, the extracted tensor will be of size 4 \(\times\) 10,000 \(\times\) 20,000. To visualize the tensor more effectively, we present a flat (2D) version of a slice of the tensor in Table 11, where we display the SHAP values of two words (Words 1 and 2) on two sentences (rows) for each of the four classes. By manipulating these values, we can create a dictionary that calculates the sum of the impact of each word across all rows for each class. Since SHAP values can be both positive and negative, we sum the absolute values to capture the overall correlation. Table 12  
Figure 15: SHAP Force plot example. presents a random sample of this dictionary. For example, the first entry in the table indicates that the sum impact of the word \"https\" on the \"LOCAL\" class is 1.713. By calculating the sum impact of each word for each class and plotting them together, SHAP generates the bar plots previously shown in Figures 13 and 14. Now that we can obtain the Shapley values for a word given a class, we can transition to our multi-class local explanation. Our method is as follows: For a given CVE, its model classification, and a threshold parameter T between 0 and 1 that analysts choose:  
1.