## 2 Related Work
### Explainable AI (XAI)  
Recent advancements in XAI methods have helped uncover the internal behaviors of DNNs, which are considered opaque (or black-box) models [14]. XAI methods allow human operators to interpret the model outputs while increasing the user confidence and trust of DNN models [26]. Many XAI methods initially focused on explaining the DNN models used in computer vision tasks as humans can easily recognize patterns in visual content. However, these methods cannot be directly applied to DNNs used in NLP tasks as most of them use embedding layers, making it more challenging to extract explanations at the input token level compared to pixels [26].  
XAI methods can be divided into two main categories, namely global and local, based on the scope of the explanation [14, 27]. Global explainable methods aim to understand the model's behavior as a whole by focusing on model internals or input features [27]. However, global methods are less suitable for explaining complex models with large numbers of features, such as those used for NLP tasks. In contrast, local methods aim to understand the reasons behind the model's predictions based on individual inputs [28, 29].  
Based on the XAI approach used on the model, XAI methods can also be divided into two other groups, namely model-agnostic and model-specific [27, 28]. Model-agnostic XAI methods can be applied independently regardless of the type of model. These methods only require model inputs and outputs to derive explanations and do not need access to the internal structure of the model. On the other hand, model-specific XAI methods are based on the model type, as they use internal parameters such as weights and gradients to derive explanations [29]. SHAP [30] and LIME [31] are two widely used model-agnosticXAI methods [26]. Gradient-based XAI methods such as LRP and DeepLift use backward propagation of the output gradients through the neural network to the input feature layer to identify the tokens that have a strong influence on the target prediction [19].  
We used the IG XAI method in our proposed approach, which is another gradient-based approach to identify the most positively and negatively influenced words, as in Table 1, towards the target predictions. As shown in Table 1, an IG can be used to identify and differentiate the tokens based on its positive and negative impact towards target prediction. In Table 1, green indicates a positive impact, while red indicates a negative impact. In the first adversarial example in Table 1, the sentiment of the original input prediction is negative. Therefore, words such as _awful_, _boring_, and _annoying_ have a positive influence, while words such as _enjoy_ and _very_ have a negative influence towards the target prediction. In the adversarial example (second subrow), the underlined words are replaced with synonyms by the attack method which then interchanges the sentiment of the adversarial example. As an example, in the first row (Attack method-PWWS), the word _mandening_ has been replaced during the adversarial attack. This has a negative influence on the target prediction, while the word _enjoy_ has a positively influence. This further validates our hypothesis that XAI can be used to identify tokens that are replaced during an adversarial attack, as the replaced words show positive and negative influence, as per Table 1. In this paper, we demonstrate the design and development of gradient-based methods based on explainable AI with integrated gradients (IGs) for the detection of adversarial attacks on text classifiers.