## 1 Introduction  
Following the emergence of Generative Artificial Intelligence (AI), the number of AI applications that leverage large volumes of unstructured datasets has increased exponentially. This expands across the modalities of images [1], video [2], time series [3], and text [4]. Text classification is fundamental to most text-based AI applications. Text classifiers are trained to differentiate between two or more predefined classes or groupings of text or text-based trajectories [5], for example, classification of positive or negative sentiment, one of eight emotions, one of \(n\) topics, or \(n\) of \(n\) ontological branches [4]. Text classifiers are susceptible to adversarial attacks when minor perturbations are added to the input text vectors, which then results in inaccurate classification outcomes with high probability [6, 7]. These minor perturbations are non-random noises that preserve the original structure of the input while being indiscernible by humans. The impact of perturbations has also been discussed in the cognitive computing domain, in fields such as hyperdimensional computing [8]. The recent increase in the use of deep neural networks (DNNs) for text classification tasks has led to a pressing need to protect DNNs against adversarial attacks [9]. Adversarial attacks can be categorized into three types based on the levels of knowledge leveraged by the perpetrator: white-box, grey-box, and opaque (or black-box) attacks [10]. In a white-box scenario, the attacker has complete knowledge of the trained model, including access to the training data, the algorithm used for training, and the model's parameters, such as its internal architecture and weights [11]. In such attacks, the attacker can only query the model and observe the outputs but does not have access to its internal state [12]. In grey-box attacks, the adversary has limited knowledge that falls between white-box and black-box scenarios, including partial details about the machine learning model, its training data, and certain model parameters [13]. In real-world scenarios, black-box attacks are more frequent and realistic as attackers will not have full access to the model in production settings [14]. Adversarial attacks on text classifiers can take three forms: Character-level attacks involve generating adversarial examples by modifying individual characters within words through operations such as swapping, flipping, removing, or inserting characters. Word-level attacks create adversarial examples by substituting words with synonyms or unrelated words, leading to incorrect predictions. Sentence-level attacks focus on altering sentences by adding new sentences, rephrasing existing ones while preserving their meaning, or inserting parentheses around current sentences to produce adversarial examples. In this article, we propose an explainable AI (XAI) approach using integrated gradients (IGs) for detecting adversarial attacks on text classifiers. While XAI techniques have primarily been developed to improve model interpretability and diagnostics, these techniques have also proved effective at uncovering hidden connections of model internal behavior under normal and adversarial settings, which allow us to differentiate and detect adversarial cases. Most textual adversarial attacks are formulated by replacing words with synonyms. XAI methods can effectively identify the impact of substituted words in detecting adversarial examples. The proposed approach is based on the IG [15] XAI technique. It identifies the most positively and negatively influenced words towards target prediction using word attribution scores. These selected words are then substituted with synonyms to generate \(k\) sample variations of the input. Model outputs for the generated \(k\) samples are processed through a voting mechanism, which compares them against the original input to detect adversarial examples.