Original: Diffusion Visual Counterfactual Explanations
Revised: Diffusion Visual Counterfactual Explanations

Original: Anonymous Author(s)
Revised: Anonymous Author(s)

Original: AffiliationAddress email
Revised: AfﬁliationAddress email

Original: Abstract
Revised: Abstract

Original: Visual Counterfactual Explanations (VCEs) are an important tool to understandthe decisions of an image classifier.
Revised: Visual Counterfactual Explanations (VCEs) are an important tool to understandthe decisions of an image classiﬁer.

Original: They are ªsmallº but ªrealisticº semanticchanges of the image changing the classifier decision.
Revised: They are “small” but “realistic” semanticchanges of the image changing the classiﬁer decision.

Original: Current approaches forthe generation of VCEs are restricted to adversarially robust models and oftencontain non-realistic artefacts or are restricted to image classification problemswith few classes.
Revised: Current approaches forthe generation of VCEs are restricted to adversarially robust models and oftencontain non-realistic artefacts or are restricted to image classiﬁcation problemswith few classes.

Original: In this paper, we overcome this by generating Diffusion Visual
Revised: In this paper, we overcome this by generating Diffusion Visual

Original: Counterfactual Explanations (DVCEs) for arbitrary ImageNet classifiers via adiffusion process.
Revised: Counterfactual Explanations (DVCEs) for arbitrary ImageNet classiﬁers via adiffusion process.

Original: Two modifications to the diffusion process are key for our
Revised: Two modiﬁcations to the diffusion process are key for our

Original: DVCEs: i) an adaptive parameterization allows us to have hyperparameters thatgeneralize across images and models and together with distance regularization andlate start of the diffusion process allow us to generate close images and ii) our coneregularization via an adversarially robust model ensures that the diffusion processdoes not converge to trivial non-semantic changes but instead produces realisticimages of the target class which achieve high confidence by the classifier.
Revised: DVCEs: i) an adaptive parameterization allows us to have hyperparameters thatgeneralize across images and models and together with distance regularization andlate start of the diffusion process allow us to generate close images and ii) our coneregularization via an adversarially robust model ensures that the diffusion processdoes not converge to trivial non-semantic changes but instead produces realisticimages of the target class which achieve high conﬁdence by the classiﬁer.

Original:  Introduction
Revised:  Introduction

Original: It can be argued that one of the main problems hindering the widespread use of machine learningis the missing possibility to explain the decisions of black-box models such as neural networks.
Revised: It can be argued that one of the main problems hindering the widespread use of machine learningis the missing possibility to explain the decisions of black-box models such as neural networks.

Original: This is not only a problem for decisions affecting humans where the current draft for AI regulationin Europe [10] requires ªtransparencyº, but it is a pressing problem in all applications of machinelearning.
Revised: This is not only a problem for decisions affecting humans where the current draft for AI regulationin Europe [9] requires “transparency”, but it is a pressing problem in all applications of machinelearning.

Original: The reason, to some extent, is that humans would like to understand but also control if thelearning algorithm has captured the ªconceptsº of the underlying classes or if it just predicts wellusing spurious features, artefacts in the data set, or other sources of error.
Revised: The reason, to some extent, is that humans would like to understand but also control if thelearning algorithm has captured the “concepts” of the underlying classes or if it just predicts wellusing spurious features, artefacts in the data set, or other sources of error.

Original: In this paper, we focus onmodel-agnostic explanations which can be applied to any classifier and do not rely on the specificstructure of the classifier such as decision trees or linear classifiers.
Revised: In this paper, we focus onmodel-agnostic explanations which can be applied to any classiﬁer and do not rely on the speciﬁcstructure of the classiﬁer such as decision trees or linear classiﬁers.

Original: In this area, in particular forimage classification, sensitivity based explanations [4], explanations based on feature attributions [3],saliency maps [47, 46, 19, 57, 52], Shapley additive explanations [33], and local fits of interpretablemodels [40] have been proposed.
Revised: In this area, in particular forimage classiﬁcation, sensitivity based explanations [4], explanations based on feature attributions [3],saliency maps [40, 39, 14, 50, 45], Shapley additive explanations [26], and local ﬁts of interpretablemodels [33] have been proposed.

Original: Moreover, [56] proposed counterfactual explanations (CEs), which are instance-specific explanations.
Revised: Moreover, [49] proposed counterfactual explanations (CEs), which are instance-speciﬁc explanations.

Original: They can be applied to any classifier and it has been argued that they are close to the humanjustification of decisions [35] using counterfactual reasoning: ªI would have recognized it as zebra(instead of horse), if it would have had black and white stripes.º For a given classifier almost allmethods for the generation of CEs [56, 16, 36, 6, 39, 55, 44] try to solve the following problem:
Revised: They can be applied to any classiﬁer and it has been argued that they are close to human justiﬁcationof decisions [28] using counterfactual reasoning: “I would have recognized it as zebra (instead ofhorse), if it would have had black and white stripes.”

Original: ªGiven a target class c what is the minimal change δ of input x , such that x + δ is classified as classc with high probability and isa realistic instance of my data generating distribution?º From the perspective of ªdebuggingº existing
Revised: For a given classiﬁer almost all methods for thegeneration of CEs [49, 12, 29, 5, 32, 48, 37] try to solve the following problem: “Given a target classc what is the minimal change  of input x , such that x +  is classiﬁed as class c with high probabilityand is realistic instance of my data generating distribution?”

Original:  machine learning models , CEs are interesting as they construct a concrete input x + δ with a different classification that allows the developer to test if the model has learned the correct features.
Revised: From the perspective of “debugging”existing machine learning models, CEs are interesting as they construct a concrete input x +  withdifferent classiﬁcation which allows the developer to test if the model has learned the correct features.

Original: Original [Figure] Original
Revised: The main problem why visual counterfactual explanations (VCEs), that is CEs for image classiﬁcation,are not widely used is that the problem of generating CEs is very related to the problem of adversarial

Original: [Figure]
Revised: [Figure]

Original: labrador [Figure] The main problem why visual counterfactual explanations (VCEs), that is CEs for image classification,are not widely used is that the problem of generating CEs is very related to the problem of adversarialexamples [53] and thus even imperceivable changes of the image can already change the prediction,which clearly does not show to the user if the classifier has picked up the right class-specific features.
Revised: examples [46] and thus even imperceivable changes of the image can already change the prediction,which clearly does not show to the user if the classiﬁer has picked up the right class-speciﬁc features.

Original: One possible solution is using adversarially robust models [43, 1, 7], which have been shown toproduce semantically meaningful VCEs by directly maximizing the probability of the target class inimage space.
Revised: One possible solution are adversarially robust models [36, 1, 6], which have been shown to producesemantically meaningful VCEs by directly maximizing the probability of the target class in imagespace.

Original: These approaches have the downside that they only can generate VCEs for robust modelswhich is a significant restriction as these models are not competitive in terms of prediction accuracy.
Revised: These approaches have the downside that they only can generate VCEs for robust modelswhich is a signiﬁcant restriction as these models are not competitive in terms of prediction accuracy.

Original: The second approach is to restrict the generation of VCEs using a generative model or constrainingthe set of potential image manipulations [21, 22, 42, 8, 20, 45, 29].
Revised: The second approach is to restrict the generation of VCEs using a generative model or constrainingthe set of potential image manipulations [16, 17, 35, 7, 15, 38, 22].

Original: However, these approaches areeither restricted to datasets with a small number of classes, cannot provide explanations for arbitraryclassifiers, or the generated images look realistic but are far away from the original one, so that the
Revised: However, these approaches areeither restricted to datasets with a small number of classes, cannot provide explanations for arbitraryclassiﬁers, or the generated images look realistic but are far away from the original one, so that the

Original: VCE and the original image have so little in common that not much insight can be gained.
Revised: VCE and the original image have so little in common that not much insight can be gained.

Original: Recently, [28] trained a StyleGAN model to discover and manipulate class attributes.
Revised: Recently, [21] trained a StyleGAN model to discover and manipulate class attributes.

Original: While theirapproach yields impressive results on smaller-scale datasets with few similar classes (for example,different bird species), the authors did not demonstrate that the method scales to complex tasks suchas ImageNet with hundreds of classes where different classes require different sets of attributes.
Revised: While theirapproach yields impressive results on smaller-scale datasets with few similar classes (for example,different bird species), the authors did not demonstrate that the method scales to complex tasks suchas ImageNet with hundreds of classes where different classes require different sets of attributes.

Original: Another disadvantage is that the StyleGAN model needs to be retrained for every classifier, making itprohibitively expensive to explain multiple large models.Moreover, [27] have proposed a loss to do VCEs in the latent space of a GAN/VAE.
Revised: Another disadvantage is that the StyleGAN model needs to be retrained for every classiﬁer, making itprohibitively expensive to explain multiple large models.

Original: While they show promising results for MNIST/FMNIST,there is no code available for generating VCEs on ImageNet.

Original: Furthermore, they rely on a conditional

Original: GAN, which might introduce a bias as it interferes with the classifier, and it is unclear, how well anunconditional generative model will work.

Original: In this paper, we overcome this by generating our Diffusion Visual Counterfactual Explanations(DVCEs) for arbitrary ImageNet classifiers.
Revised: In this paper, we overcome this by generating our Diffusion Visual Counterfactual Explanations(DVCEs) for arbitrary ImageNet classiﬁers.

Original: We use the progress in the generation of realistic imagesusing diffusion processes [48, 26, 49, 51] reaching recently the level of GANs [15].
Revised: We use the progress in the generation of realistic imagesusing diffusion processes [41, 20, 42, 44] reaching recently the level of GANs [11].

Original: Similarly to[38, 2], we use a classifier and a distance-type regularization to guide the generation of the images.
Revised: Similarly to[31, 2], we use a classiﬁer and a distance-type regularization to guide the generation of the images.

Original: Two modifications to the diffusion process are key elements for our DVCEs: i) a combinationof distance regularization and starting point of the diffusion process together with an adaptivereparameterization lets us generate VCEs visually close to the original image in a controlled way sothat hyperparameters can be fixed across images and even across models, ii) our cone regularizationof the gradient of the classifier via an adversarially robust model ensures that the diffusion processdoes not converge to trivial non-semantic changes but instead produces realistic images of the targetclass which achieve high confidence by the classifier.
Revised: Two modiﬁcations to the diffusion process are key elements for our DVCEs: i) a combinationof distance regularization and starting point of the diffusion process together with an adaptivereparameterization lets us generate VCEs visually close to the original image in a controlled way sothat hyperparameters can be ﬁxed across images and even across models, ii) our cone regularizationof the gradient of the classiﬁer via an adversarially robust model ensures that the diffusion processdoes not converge to trivial non-semantic changes but instead produces realistic images of the targetclass which achieve high conﬁdence by the classiﬁer.

Original: Our approach can be employed for any datasetwhere a generative diffusion model and an adversarially robust model are available.
Revised: Our approach can be employed to any datasetwhere a generative diffusion model and an adversarially robust model are available.

Original: In a qualitativecomparison and a user study in App.
Revised: In a qualitativecomparison and a user study in App.

Original: C we show that our DVCEs outperform the recent method of[7] as well as an adaptation of [2] for the generation of VCEs.
Revised: C we show that our DVCEs outperform the recent method of[6] as well as an adaptation of [2] for the generation of VCEs.

Original:  Diffusion models
Revised:  Diffusion models

Original: Diffusion models [15, 48, 49, 26, 37] are generative models that consist of two steps: forward diffusionprocess (and thus a Markov process) that transforms the data distribution to a prior distribution (whichis usually assumed to be a standard normal distribution) and the reverse diffusion process thattransforms the prior distribution back to the data distribution.
Revised: Diffusion models [11, 41, 42, 20, 30] are generative models that consist of two steps: forward diffusionprocess (and thus a Markov process) that transforms the data distribution to a prior distribution (whichis usually assumed to be a standard normal distribution) and the reverse diffusion process thattransforms the prior distribution back to the data distribution.

Original: The existence of the (continuous-time) reverse diffusion process was closer investigated in [51].
Revised: The existence of the (continuous-time)reverse diffusion process was closer investigated in [44].

Original: In the discrete-time setting, a Markov chain { x 1 , ..., x T } for any data point x 0 in the forward directionis defined via a Markovian process that adds noise to the data point at each timestep:
Revised: In the discrete-time setting, a Markov chain { x 1 , ..., x T } for any data point x 0 in the forward directionis deﬁned via a Markovian process that adds noise to the data point at each timestep:q ( x t | x t  1 ) = N ( p

Original: [Equation]
Revised: [Equation]

Original: where { β 1 , ..., β T } is some variance schedule, chosen such that q ( x T ) ∼ N (0 , I ) .
Revised: where {  1 , ...,  T } is some variance schedule, chosen such that q ( x T ) ⇠ N (0 , I ) .

Original: Note that given 83 x 0 , it is possible to sample from q ( x t | x 0 ) in closed form instead of applying noise t times using:
Revised: Note that given 78 x 0 , it is possible to sample from q ( x t | x 0 ) in closed form instead of applying noise t times using:

Original: [Equation]
Revised: [Equation]

Original: where α t :=
Revised: where ↵ t :=

Original: Q tk =1 (1 − β k ) .
Revised: Q tk =1 (1   k ) .

Original: As the number of total time steps, T approaches infinity, and the reversetransitions q ( x t − 1 | x t ) approach diagonal Gaussian distributions.
Revised: As the number of total time steps T approaches inﬁnity, the reversetransitions q ( x t  1 | x t ) approach diagonal Gaussian distributions.

Original: Then one uses a DNN to predict 86 mean µ θ and covariance Σ θ for this reverse process with transition probabilities:
Revised: Then one uses a DNN to predictmean µ ✓ and covariance ⌃ ✓ for this reverse process with transition probabilities:

Original: [Equation]
Revised: [Equation]

Original: To sample from p θ ( x 0 ) , one samples x T from N (0 , I ) and then follows the reverse process byrepeatedly sampling from the transition probabilities p θ ( x t − 1 | x t ) .
Revised: To sample from p ✓ ( x 0 ) , one samples x T from N (0 , I ) and then follows the reverse process byrepeatedly sampling from the transition probabilities p ✓ ( x t  1 | x t ) .

Original: Originally, diffusion models were 89 trained by optimizing a variational lower bound of the data likelihood [48].
Revised: Originally, diffusion models weretrained by optimizing a variational lower bound of the data likelihood [41].

Original: Later, [26] proposed asimplified loss L simple that resembles a denoising auto-encoder: 
Revised: Later, [20] proposed asimpliﬁed loss L simple that resembles a denoising auto-encoder: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where µ can be recovered as: µ 
Revised: where µ can be recovered as: µ ✓ ( x t , t )

Original: [Equation] ( x[Equation] − α t √ 1 − α t ϵ θ ( x t , t )) .
Revised: = 1 p ↵ t ( x t  1  ↵ t p 1  ↵ t ✏ ✓ ( x t , t )) .

Original: [37, 15] combined both lossesto learn Σ and µ .
Revised: [30, 11] combined both lossesto learn ⌃ and µ .

Original: In the continuous-time setting, [50, 25] have derived the respective lower bounds.
Revised: In the continuous-time setting, [43, 19] have derived the respective lower bounds.

Original: 2.1 Class conditional sampling
Revised: 2.1 Class conditional sampling

Original: There exist diffusion models trained with and without knowledge about classes in the dataset [15, 24].
Revised: There exists diffusion models trained with and without knowledge about classes in the dataset[11, 18].

Original: For our experiments, we only use the class-unconditional diffusion model, such that all classconditional features are introduced by the classifier which we want to explain.
Revised: For our experiments, we only use the class-unconditional diffusion model, such that all classconditional features are introduced by the classiﬁer which we want to explain.

Original: For the noise-awareclassifier, the reverse process transitions are then of the form (Proof Appendix H in [15]):
Revised: For the noise-awareclassiﬁer, the reverse process transitions are then of the form (Proof appendix H in [11]):

Original: [Equation]
Revised: [Equation]

Original: (5) for a normalization constant Z .
Revised: for a normalization constant Z .

Original: Typically p θ ( y |· ) is a time-step aware classifier specifically trainedon noisy images belonging to time-step t [15].
Revised: Typically p ✓ ( y |· ) is a time-step aware classiﬁer speciﬁcally trainedon noisy images belonging to time-step t [11].

Original: As further we would like to explain any classifier andnot only noise-aware ones, we follow the approach of [2], where a classifier p θ ( y |· ) is given as aninput the denoised sample ˆ x 0 = f dn ( x t ) of x t , using the mapping:
Revised: As further we would like to explain any classiﬁer andnot only noise-aware ones, we follow the approach of [2], where a classiﬁer p ✓ ( y |· ) is given as aninput the denoised sample ˆ x 0 = f dn ( x t ) of x t , using the mapping:

Original: [Equation]
Revised: [Equation]

Original: This mapping is derived from Eq. 2, from which we have that
Revised: This mapping is derived from eq. (2), from which we have that

Original: [Equation]
Revised: [Equation]

Original: and because we use our diffusion model ϵ θ ( x t , t ) to predict ϵ .
Revised: and because we use our diffusion model ✏ ✓ ( x t , t ) to predict ✏ .

Original: With this, we can define a time-stepaware posterior p θ ( y | x t , t ) for any classifier p θ ( y |· ) as p θ ( y | x t , t ) = 
Revised: With this, we can deﬁne a time-stepaware posterior p ✓ ( y | x t , t ) for any classiﬁer p ✓ ( y |· ) as p ✓ ( y | x t , t ) = p ✓ ( y [Equation]

Original: p θ ( y | f dn ( x t , t )) .
Revised: f dn ( x t , t )) .

Original: The issue is that efficient sampling from the original diffusion model is possible only because thereverse process is made of normal distributions.
Revised: The issue is that efﬁcient sampling from the original diffusion model is possible only because thereverse process is made of normal distributions.

Original: As we need to sample from p θ ( x t − 1 | x t , y ) thousandsof times to obtain a single sample from the data distribution, it is not possible to use MCMC-samplerswith high complexity to sample from each of the individual transitions.
Revised: As we need to sample from p ✓ ( x t  1 | x t , y ) thousandsof times to obtain a single sample from the data distribution, it is not possible to use MCMC-samplerswith high complexity to sample from each of the individual transitions.

Original: In [15], they proposed to solveit by approximating p θ ( x t − 1 | x t , y ) with slightly shifted versions of p θ ( x t − 1 | x t ) to make closed-form 110 sampling possible.
Revised: In [11], they proposed to solveit by approximating p ✓ ( x t  1 | x t , y ) with slightly shifted versions of p ✓ ( x t  1 | x t ) to make closed-form 105 sampling possible.

Original: Such transition kernels are given by:
Revised: Such transition kernels are given by:

Original: [Equation][Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original:  Diffusion Visual Counterfactual Explanations
Revised:  Diffusion Visual Counterfactual Explanations

Original: A VCE z for a chosen target class c and a given classifier f and input x should satisfy the followingcriteria: i) validity: the VCE z should be classified by f as the desired target class c with highprobability, ii) realism: the VCE z should be indistinguishable or at least close to a natural image, iii)minimality/closeness: the difference of the VCE z and the original image x should be the minimalsemantic modification necessary to change the class, in particular, the generated image z should beclose to x while being valid and realistic, e.g. by changing the object in the image and leaving thebackground unchanged.
Revised: A VCE z for a chosen target class c and a given classiﬁer f and input x should satisfy the followingcriteria: i) validity: the VCE z should be classiﬁed by f as the desired target class c with highprobability, ii) realism: the VCE z should be indistinguishable or at least close to a natural image, iii)minimality/closeness: the difference of the VCE z and the original image x should be the minimalsemantic modiﬁcation necessary to change the class, in particular the generated image z should beclose to x while being valid and realistic, e.g. by changing the object in the image and leaving thebackground unchanged.

Original: Note that while targeted adversarial examples are valid, they do not showmeaningful semantic changes into the target class for a non-robust model and are also not realistic.
Revised: Note that while targeted adversarial examples are valid, they do not showmeaningful semantic changes into the target class for a non-robust model and are also not realistic.

Original: Although adversarial l ∞ perturbations are (almost) imperceivable for humans, adversarial images arevery unlikely to occur in nature.
Revised: Although adversarial l 1 perturbations are (almost) imperceivable for humans, adversarial images arevery unlikely to occur in nature.

Original: The l 1 . 5 -SVCE method of [7] optimizes the predicted probability of classifier into the target class bymanipulating the image and is very close to the generation of adversarial examples and thus worksonly for adversarially robust classifiers.
Revised: The l 1 . 5 -SVCE method of [6] optimizes the predicted probability of classiﬁer into the target class bymanipulating the image and is very close to the generation of adversarial examples and thus worksonly for adversarially robust classiﬁers.

Original: The realism of the image comes purely from the generativeproperties of robust classifiers [43] which can lead to artefacts.
Revised: The realism of the image comes purely from the generativeproperties of robust classiﬁers [36] which can lead to artefacts.

Original: In contrast, our Diffusion Visual
Revised: In contrast, our Diffusion Visual

Original: Counterfactual Explanations (DVCEs) work for any classifier and our generated images are morerealistic due to the integration of diffusion models.
Revised: Counterfactal Explanations (DVCEs) works for any classiﬁer and our generated images are morerealistic due to the integration of diffusion models.

Original: An approach similar to our DVCE framework isblended diffusion of [2] which manipulates the image inside a masked region.
Revised: An approach similar to our DVCE framework isblended diffusion of [2] which manipulates the image inside a masked region.

Original: However, it is easy toadapt it to the task of VCEs by allowing the whole image to be manipulated.
Revised: However, it is easy toadapt it to the task of VCEs by allowing the whole image to be manipulated.

Original: DVCE and blendeddiffusion share the same diffusion model, but, as we show in the Appendix, blended diffusion cannotbe applied to arbitrary classifiers and requires image-specific hyperparameter tuning, see Fig. 
Revised: DVCE and blendeddiffusion share the same diffusion model, but, as we show in the appendix, blended diffusion cannotbe applied to arbitrary classiﬁers and requires image-speciﬁc hyperparameter tuning, see Fig. 2,which is infeasible in practice.

Original: 3.1 Adaptive Parameterization
Revised: 3.1 Adaptive Parameterization

Original: For the DVCE of the original image ˆ x , we don’t want to sample just any image x from p ( x | y ) (highrealism and validity) but also to make sure that d ( x, ˆ x ) is small.
Revised: For the DVCE of the original image ˆ x , we don’t want to sample just any image x from p ( x | y ) (highrealism and validity) but also to make sure that d ( x, ˆ x ) is small in order to enforce a minimal change.

Original: To do this, we have to condition ourdiffusion process on ˆ x .
Revised: To do this, we have to condition our diffusion process on ˆ x .

Original: Using the introduced denoising function f dn and analogously to the derivation in [15] and following application in [29], the mean of the transition kernel becomes:
Revised: Using the introduced denoising functionf dn and analogously to the derivation in [11] and following application in [22], the mean of the transition kernel becomes:

Original: [Equation]
Revised: [Equation]

Original: where C c is the coefficient of the classifier, and C d the one of the distance guiding loss.
Revised: where C c is the coefﬁcient of the classiﬁer, and C d the one of the distance guiding loss.

Original: Intuitively,we take a step in the direction that increases the classifier score while staying close to ˆ x . Note that thelast term can be interpreted as the log gradient of a distribution with density exp( − d t (ˆ x, · ) σ ) , whereσ = 1 C d and d t (ˆ x, · ) =
Revised: Note that thelast term can be interpreted as the log gradient of a distribution with density exp(  d t (ˆ x, · )  ) , where = 1 C d and d t (ˆ x, · ) =

Original: d (ˆ x, f dn ( · , t )) , thus we introduce a time-aware prior distribution that enforcesour output to be similar to ˆ x .
Revised: d (ˆ x, f dn ( · , t )) , thus we introduce a time-aware prior distribution that enforcesour output to be similar to ˆ x .

Original: In our work, we use the l 1 -distance as it produces sparser changes.
Revised: In our work, we use the l 1 -distance as it produces sparser changes.

Original: Several works have tried to minimize some distance during the diffusion process, implicitly in [9] orexplicitly, but for the background in [2].
Revised: Several works have tried to minimize some distance during the diffusion process, implicitly in [8] orexplicitly, but for the background in [2].

Original: However, there is no principled way to choose the coefficientfor such a regularization term.
Revised: However, there is no principled way to choose the coefﬁcientfor such a regularization term.

Original: It turns out that it is impossible to find a parameter setting for blendeddiffusion [2] that works across images and classifiers.
Revised: In fact it turns out that it is impossible to ﬁnd a parameter setting forblended diffusion [2] that works across images and classiﬁers.

Original: Thus,  we propose an adaptive parametrization 
Revised: Thus, in this paper we propose anadaptive parametrization g update

Original: [Equation]
Revised: [Equation]

Original: relative to the predicted mean of the diffusion model that we use to change µ t in Eq.
Revised: relative to the predicted mean of the diffusion model that we use to change µ t in Eq.

Original: 9 to
Revised: 9 to

Original: [Equation]
Revised: [Equation]

Original: The adaptive parameterization allows for fine-grained control of the influcence of the classifier anddistance regularization so that now the hyperparameters C c and C d have the same influence acrossimages and even classifiers which facilitates the generation of DVCEs as otherwise hyperparameterfinetuning would be necessary for each image as in blended diffusion, see Fig.
Revised: The adaptive parameterization allows for a ﬁnegrained control of the inﬂucence of the classiﬁer anddistance regularization so that now the hyperparameters C c and C d have the same inﬂuence acrossimages and even classiﬁers which facilitates the generation of DVCEs as otherwise hyperparameterﬁnetuning would be necessary for each image as in blended diffusion, see Fig.

Original: 2 for a comparison.
Revised: 2 for a comparison.

Original: However, even with our adaptive parameterization, it is still not easy to produce semanticallymeaningful changes close to ˆ x as can be seen in App.
Revised: However, even with our adaptive parameterization, it is still not easy to produce semanticallymeaningful changes close to ˆ x as can be seen in App.

Original: B.2.
Revised: B.2.

Original: Thus, as in [2], we vary the starting pointin the diffusion process and observe in App.
Revised: Thus, as in [2], we vary the starting pointin the diffusion process and observe in App.

Original: B.2 that starting from step T 2 of the forward diffusionprocess, together with the adaptive parameterization and using asthe distance the l 1 -distance providesus with sparse but semantically meaningful changes.In our experiments, we set T = 200 .
Revised: B.2 that starting from step T 2 of the forward diffusionprocess, together with the adaptive parameterization and using as distance the l 1 -distance provides uswith sparse but semantically meaningful changes.

Original: 3.2 Cone-Projection for Classifier Guidance
Revised: 3.2 Cone-Projection for Classiﬁer Guidance

Original: A major component of our DVCEs is that they can be applied to any image classifier regardless ofwhether it is adversarially robust or not.
Revised: A major component of our DVCEs is that they can be applied to any image classiﬁer regardless ofwhether it is adversarially robust or not.

Original: However, it turns out that naively applying diffusion with thenew mean (Eq. 12) to a non-robust classifier does not work and leads to very small modifications ofthe image, which are similar to adversarial examples without meaningful changes.
Revised: However, it turns out that naively applying diffusion with thenew mean (Eq. 12) to a non-robust classiﬁer does not work and leads to very small modiﬁcationsof the image, which are similar to adversarial examples without meaningful changes.

Original: The reason is thatgradients of non-robust classifiers are much noisier and less semantically meaningful.
Revised: The reasonis that gradients of non-robust classiﬁers are much more noisy and less semantically meaningful.

Original: We illustratethis for a non-robust Swin-Transformer[30] in Fig.
Revised: We illustrate this for a non-robust Swin-Transformer[23] in Fig.

Original: 3 where hardly any changes are generated.
Revised: 3 where hardly any changes aregenerated.

Original: Notethat this is even the case if we denoise the sample first using the denoising function
Revised: Note that this is even the case if we denoise the sample ﬁrst using the denoising functionf

Original: f dn (Eq. 6).
Revised: dn (Eq. 6).

Original: As a solution, we suggest projecting the gradient of a robust classifier, ∇ x t log p robust ,θ ( y | f dn ( x t , t )) ,onto a cone centered at the gradient of the classifier, ∇ x t log p θ ( y | f dn ( x t , t )) , (we use α = 30 ◦ in allexperiments for non-robust classifiers).
Revised: As a solution to this problem we suggest to project the gradient of a robust classiﬁer, r x t log p robust , ✓ ( y | f dn ( x t , t )) , onto a cone centered at the gradient of the classiﬁer,r x t log p ✓ ( y | f dn ( x t , t )) , (we use ↵ = 30  in all experiments for non-robust classiﬁers).

Original: More precisely, we define
Revised: Moreprecisely, we deﬁne

Original: [Equation]
Revised: [Equation]

Original: (cid:1)i [Equation] where cone ( α, v ) : = { w ∈ R d : ∠ ( v, w ) ≤ α } is the cone of angle α around vector v , and theprojection P cone ( α,v ) onto cone ( α, v ) is given as:
Revised: where cone ( ↵ , v ) := { w 2 R d : \ ( v, w )  ↵ } is the cone of angle ↵ around vector v , and theprojection P cone ( ↵ ,v ) onto cone ( ↵ , v ) is given as:

Original: [Equation]
Revised: [Equation]

Original: else , where P v ⊥ ( w ) :
Revised: else , where P v ? ( w ) :

Original: = w − ⟨ w,v ⟩ ⟨ v,v ⟩ v
Revised: = w  h w,v i h v,v i v

Original: and we define u = sin( α ) P v ⊥ ( w ) ∥
Revised: and we deﬁne u = sin( ↵ ) P v ?

Original:  P v ⊥ ( w ) ∥ 2 + cos( α ) v ∥ v ∥ 2 (note that∥ u 
Revised: ( w ) k P v ? ( w ) k 2 +cos( ↵ ) v k v k 2 (note that k u k 2 =

Original: ∥ 2 = 1 and ⟨ u, v ⟩ = cos( α ) ).
Revised: 1and h u, v i = cos( ↵ ) ).

Original: The idea of this projection is that in this way we reduce drastically172 the noise in the gradient of the non-robust classifier.
Revised: The idea of this projection is that in this way we reduce drastically the noisein the gradient of the non-robust classiﬁer.

Original: Note, however, that the projection of the gradientof the robust classifier onto the cone generated by the non-robust classifier is always an ascentdirection for log p θ ( y | f dn ( x t , t )) and we still have the goal of maximizing this objective (note thatg proj is not necessarily an ascent direction for log p robust ,θ ( y | f dn ( x t , t )) ).
Revised: Note, however, that the projection of the gradient of therobust classiﬁer onto the cone generated by the non-robust classiﬁer is always an ascent directionfor log p ✓ ( y | f dn ( x t , t )) and we still have the goal of maximizing this objective (note that g proj is notnecessarily an ascent direction for log p robust , ✓ ( y | f dn ( x t , t )) ).

Original: Thus, one can see the coneprojection as a form of regularization of ∇ x t log p θ ( y | f dn ( x t , t )) which guides the diffusion processinto semantically meaningful changes of the classifier.
Revised: Thus, one can see the cone projectionas a form of regularization of r x t log p ✓ ( y | f dn ( x t , t )) which guides the diffusion process intosemantically meaningful changes of the classiﬁer.

Original: [Figure]
Revised: [Figure]

Revised: While

Original: 3.3 Final Scheme for Diffusion Visual Counterfactuals
Revised: 3.3 Final Scheme for Diffusion Visual Counterfactuals

Original: We summarize here the full scheme of DVCEs for a non-adversarially robust classifier p θ ( y | x ) wherewe assume that we are given additionally the adversarially robust model p robust ,θ ( y | x ) :
Revised: For the convenience of the reader, we summarize here the full scheme of DVCEs for a nonadversarially robust classiﬁer p ✓ ( y | x ) where we assume that we are given additionally the adversarially robust model p robust , ✓ ( y | x ) :

Original: [Equation]
Revised: [Equation]

Original: For a robust model, the only difference is that the cone projection is omitted and one uses g proj =
Revised: For a robust model the only difference is that the cone projection is omitted and one uses g proj =

Original: ∇ x t log p robust ,θ [Equation] , t ) (cid:1) .
Revised: r x t log p robust , ✓  y | f dn ( x t , t )  .

Original: We use in all our experiments C c = 0 .
Revised: We use in all our experiments C c = 0 .

Original: 1 , and C d ∈ 0 .
Revised: 1 , and C d 2 0 .

Original: 15 unless weshow ablations for one of the parameters.
Revised: 15 unless weshow ablations for one of the parameters.

Original: The angle α for the cone projection is fixed to 30 ◦ .
Revised: The angle ↵ for the cone projection is ﬁxed to 30  .

Original: Instrong contrast to blended diffusion, these parameters generalize across images and even classifiersand allow us to generate VCEs for arbitrary classifiers for which a diffusion model is available.
Revised: Instrong contrast to blended diffusion, these parameters generalize across images and even classiﬁersand allow us to generate VCEs for arbitrary classiﬁers for which a diffusion model is available.

Original:  Experiments
Revised:  Experiments

Original: In this section, we evaluate the quality of the visual counterfactual explanations of DVCE.
Revised: In this section we evaluate the quality of the visual counterfactual explanations of DVCE.

Original: We start bycomparing DVCE to existing works in Sec. 4.1.
Revised: We start bycomparing DVCE to existing works in Sec. 4.1.

Original: In Sec. 4.2, we compare counterfactuals of DVCEfor various state-of-the-art ImageNet models and show, how our method can be used to interpretdifferences between classifiers.
Revised: In Sec. 4.2, we compare counterfactuals of DVCEfor various state-of-the-art ImageNet models and show, how our method can be used to interpretdifferences between classiﬁers.

Original: For all experiments, we use the same set of hyperparameters for
Revised: For all experiments, we use the same set of hyperparameters for

Original: DVCE given in the last section.
Revised: DVCE given in the last section.

Original: The diffusion model used for DVCE is taken from [15] and is trainedclass-unconditionally on ImageNet images of size 256x256 and uses a modified UNet
Revised: The diffusion model used for DVCE is taken from [11] and is trainedclass-unconditionally on ImageNet images of size 256x256 and uses a modiﬁed UNet

Original: architecture(more details in [15]).
Revised: architecture(more details in [11]).

Original: User study, further experiments, ablations, and details are in the Appendix.
Revised: User study, further experiments, ablations and details can be found in the Appendix.

Original: 4.1 Method comparison
Revised: 4.1 Method comparison

Original: Creating VCEs for ImageNet with 1000 vastly different classes is a challenging task and there onlyexist a small number of methods that try to solve it without reducing dataset size or image resolution.
Revised: Creating VCEs for ImageNet with 1000 vastly different classes is a challenging task and there onlyexist a small number of methods that try to solve it without reducing dataset size or image resolution.

Original: For evaluation purposes, we compare our method to blended diffusion [2] and a recent method for
Revised: For evaluation purposes, we compare our method to blended diffusion [2] and a recent method for

Original: VCEs based purely on optimization [7].
Revised: VCEs based purely on optimization [6].

Original: As the latter only works for adversarially robust classifiers,we use the multiple-norm robust model from [7], which they call Madry [17] + FT, as the classifier tocreate VCEs for all three methods.
Revised: As the latter only works for adversarially robust classiﬁers,we use the multiple-norm robust model from [6], which they call Madry [13] + FT, as the classiﬁer tocreate VCEs for all three methods.

Original: Results can be found in Fig.
Revised: Results can be found in Fig.

Original: 4, where we transform one imageinto two different classes that are close in the WordNet hierarchy[34].
Revised: 4, where we transform one imageinto two different classes that are close in the WordNet hierarchy[27].

Original: The radius of the l 1 . 5 -ball of [7] is chosen as the smallest r ∈ { 50 , 75 , 100 , 150 } such that theconfidence in the target class is larger than 0 .
Revised: The radius of the l 1 . 5 -ball of [6] is chosen as the smallest r 2 { 50 , 75 , 100 , 150 } such that theconﬁdence in the target class is larger than 0 .

Original: 90 per image - if this is not reached, we show the onewith highest confidence.
Revised: 90 per image - if this is not reached, we show the onewith highest conﬁdence.

Original: For blended diffusion, we select the image with the smallest classifier andregularization weight that reaches confidence larger than 0.9 from the set of parameters discussed in Sec. 3.3.
Revised: For blended diffusion, we select the image with the smallest classiﬁer andregularization weight that reaches a conﬁdence larger than 0.9 from the set of parameters discussedin Sec. 3.3.

Original: If 0.9 is not reached by any setting, we again show the one with highest confidence.
Revised: If 0.9 is not reached by any setting, we again show the one with highest conﬁdence.

Original: For
Revised: For

Original: DVCEs, we only use the single set of parameters provided in the previous section.

Original: As the model isrobust on its own, we do not use the cone projection in DVCE.

Original: [Figure]
Revised: [Figure]

Original: , white wolf,  and alp).
Revised: timber wolf, white wolf and alp).

Original: l 1 . 5 -SVCEs show artefacts (white wolf, volcano, night snake) and have often lower image quality.
Revised: l 1 . 5 -SVCEs show artefacts (white wolf, volcano, night snake) and have often lower image quality.

Original:  As Fig.
Revised: DVCEs, we only use the single set of parameters provided in the previous section. As the model isrobust its own, we do not use the cone projection in DVCE.

Original:  4 shows, DVCEs is the only method that satisfies all desired properties of VCEs: i) theproduced VCEs have high confidence in the target class, ii) are close to natural images, and iii)show minimal semantic changes in the target class.
Revised: As Figure 4 shows, DVCEs is the only method that satisﬁes all desired properties of VCEs: i) theproduced VCEs have high conﬁdence in the target class, ii) are close to natural images and iii) showminimal semantic changes into the target class.

Original: For example, for ªmashed potatoº, DVCEpreserves the bowl and only changes the content into either guacamole or carbonara.
Revised: For example, for “mashed potato”, DVCE preservesthe bowl and only changes the content into either guacamole or carbonara.

Original: Our qualitativecomparison shows that the same hyperparameter setting of DVCE can handle different classes andtransfer between similar classes, such as different snakes or wolf types, as well as different objectsizes.
Revised: Our qualitative comparisonshows that the same hyperparameter setting of DVCE can handle a variety of classes and transferbetween similar classes, such as different snakes or wolf types, as well as different object sizes.

Original: For example, it works for the ªcheetahº which covers the entire image, but also for the ªsnakeºwhich only 
Revised: Forexample, it works for “cheetah” which covers the entire image, but also for the “snake” which only [Figure] [Table] [Figure]

Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: fine-grained details and differences between the generated images. covers a fraction of the input.
Revised: [Table] [Figure] [Table] [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: we show DVCEs into two target classes.

Revised: Please zoom into the images to see more ﬁnegrained details and differences between the generated images.

Revised: covers a fraction of the input.

Original: In contrast, both l 1 . 5 -SVCEs and blended diffusion VCEs requiredifferent hyperparameters for different images to achieve high confidence in the target class.
Revised: In contrast, both l 1 . 5 -SVCEs and blended diffusion VCEs requiredifferent hyperparameters for different images to achieve high conﬁdence into the target class.

Original: Evenwith the six parameter configurations, blended diffusion is not able to produce always images withhigh confidence in the target class.
Revised: Evenwith the six parameter conﬁgurations, blended diffusion is not able to produce always images withhigh conﬁdence in the target class.

Original: Even more problematic for VCEs: sometimes the resulting imageshave high confidence but do not look realistic (cheetah → tiger) or do not resemble the original imageat all (dingo → timber wolf/white wolf).
Revised: Even more problematic for VCEs: sometimes the resulting imageshave high conﬁdence but do not look realistic (cheetah ! tiger) or do not resemble the original imageat all (dingo ! timber wolf/white wolf).

Original: Even if the method works with the given parameters, forexample mashed potato → guacamole or carbonara, the overall image quality cannot match that of
Revised: Even if the method works with the given parameters, forexample mashed potato ! guacamole or carbonara, the overall image quality cannot match that of

Original: DVCE as often the images contain overly bright colors.
Revised: DVCE as often the images contain overly bright colors.

Original: In the case of the volcano VCE, DVCEshows class features like lava whereas blended diffusion VCE can not clearly be labeled as a volcano.
Revised: In the case of the volcano VCE, DVCEshows class features like lava whereas blended diffusion VCE can not clearly be labeled as a volcano.

Original: For the l 1 . 5 -SVCEs, one often needs large radii to achieve the desired confidence of 0.90, which oftenresults in color artefacts and images that generally do not look realistic.
Revised: For the l 1 . 5 -SVCEs, one often needs large radii to achieve the desired conﬁdence of 0.90, which oftenresults in color artefacts and images that generally do not look realistic.

Original: 4.2 Model comparison
Revised: 4.2 Model comparison

Original: In Fig.
Revised: In Fig.

Original: 5 we show that DVCEs can be generated for various state-of-the-art ImageNet [41] models.
Revised: 5 we show that DVCEs can be generated for various state-of-the-art ImageNet [34] models.

Original: Weuse a Swin-Transformer[30], a ConvNeXt [31] and a Noisy-Student EfficientNet [58, 54].
Revised: Weuse a Swin-Transformer[23], a ConvNeXt [24] and a Noisy-Student EfﬁcientNet [51, 47].

Original: Both the
Revised: Both the

Original: Swin-Transformer and the ConvNeXt are pretrained on ImageNet21k [14] whereas the EfficientNetuses noisy-student self-training on a large unlabeled pool.
Revised: Swin-Tranformer and the ConvNeXt are pretrained on ImageNet21k [10] wheareas the EfﬁcientNetuses noisy-student self-training on a large unlabeled pool.

Original: As all models do not yield perceptuallyaligned gradients, we use the cone projection with 30 ◦ angle described in Sec.
Revised: As all models do not yield perceptuallyaligned gradients, we use the cone projection with 30  angle described in Sec.

Original: 3.2 with the robustmodel from the previous section.
Revised: 3.2 with the robustmodel from the previous section.

Original: All other parameters are identical to the previous experiment.
Revised: All other parameters are identical to the previous experiment.

Original: We highlight that DVCE is the first method capable of visualizing arbitrary classifiers on a task aschallenging as ImageNet [41].
Revised: We highlight that DVCE is the ﬁrst method capable of visualizing arbitrary classiﬁers on a task aschallenging as ImageNet [34].

Original: Overall, DVCEs satisfy all desired properties of VCEs.
Revised: Overall, DVCEs satisfy all desired properties of VCEs.

Original: It also allowsus to inspect the most important features of each model and class.
Revised: It also allowsus to inspect the most important features for each model and class.

Original: For example, all three models havelearned to associate the specific texture pattern of the box turtle with that particular class.
Revised: For example, all three modelshave learnt to associate the speciﬁc texture pattern of the box turtle with that particular class.

Original: For thestupa and church classes, it seems like all models use different roof and tower structures as the mostprominent feature as they spent most of their budget on changing those.
Revised: For thestupa and church classes, it seems like all models use different roof and tower structures as the mostprominent feature as they spent most of their budget on changing those.

Original:  Limitations, Future Work and Societal impact
Revised:  Limitations, Future Work and Societal impact

Original: In comparison to GANs, diffusion-based approaches can be expensive to evaluate as they requiremultiple iterations of the reverse process to create one sample.
Revised: In comparison to GANs, diffusion-based approaches can be expensive to evaluate as they requiremultiple iterations of the reverse process to create one sample.

Original: This can be an issue when creating alarge amount of VCEs and makes deployment in a time-sensitive setting challenging.
Revised: This can be an issue when creating alarge amount of VCEs and makes deployment in a time-sensitive setting challenging.

Original: We also rely on a robust model during the creation of VCEs for the cone projection.
Revised: We also rely on a robust model during the creation of VCEs for the cone projection.

Original: While weshow that standard classifiers do not yield the desired gradients, training robust models can bechallenging.
Revised: While weshow that standard classiﬁers do not yield the desired gradients, training robust models can bechallenging.

Original: An interesting direction for future research is thus to replace the cone projection withanother ªdenoisingº procedure for the gradient of a non-robust model.
Revised: An interesting direction for future research is thus to replace the cone projection withanother “denoising” procedures for the gradient of a non-robust model.

Original: From a theoretical standpoint, using conditional sampling with reverse transitions of the form Eq.
Revised: From a theoretical standpoint, using conditional sampling with reverse transitions of the form Eq.

Original: 5is justified, in practice, however, we have to approximate the reverse transitions with shifted normaldistributions of the form Eq. 8.
Revised: 5is justiﬁed, in practice, however, we have to approximate the reverse transitions with shifted normaldistributions of the form Eq. 8.

Original: This approximation relies on the conditioning function having lowcurvature, and it can be hard to verify this once we start adding a classifier, distance and other possibleterms and it is unclear how this influences the outcome of the diffusion process.
Revised: This approximation relies on the conditioning function having lowcurvature, and it can be hard to verify this once we start adding a classiﬁer, distance and other possibleterms and it is unclear how this inﬂuences the outcome of the diffusion process.

Original: The quantitative evaluation of VCEs is difficult, as the standard FID metric compares the distributionof features of a classifier over a test and a generated dataset.
Revised: The quantitative evaluation of VCEs is difﬁcult, as the standard FID metric compares the distributionof features of a classiﬁer over a test and a generated dataset.

Original: However, for VCEs it is not onlyimportant to generate realistic images, but alsoto achieve  high confidence and to create meaningfulchanges.
Revised: However, for VCEs it is not onlyimportant to generate realistic images, but also achieve a high conﬁdence and to create meaningfulchanges.

Original: Moreover, metrics such as IM1, IM2 [32] for VCEs rely on a well-trained (V)AE for everyclass, which is difficult to achieve for a dataset with 1000 classes and high-resolution images.
Revised: Moreover, metrics such as IM1, IM2 [25] for VCEs rely on a well-trained (V)AE for everyclass, which is difﬁcult to achieve for a dataset with 1000 classes and high-resolution images.

Original: Futureresearch should therefore try to develop metrics for the quantitative evaluation of VCEs.
Revised: Futureresearch should therefore try to develop metrics for the quantitative evaluation of VCEs.

Original: DVCEs and VCEs in general help to discover biases of the classifiers and thus have a positive societalimpact, however one can abuse them for unintended purposes as any conditional generative model.
Revised: DVCEs, and VCEs in general help to discover biases of the classiﬁers and thus have a positive societalimpact, however one can abuse them for unintended purposes as any conditional generative model.

Original:  Conclusion
Revised:  Conclusion

Original: We have proposed DVCEs, a novel way to create VCEs for any state-of-the-art ImageNet classifierusing diffusion models and our cone projection.
Revised: We have proposed DVCEs, a novel way to create VCEs for any state-of-the-art ImageNet classiﬁerusing diffusion models and our cone projection.

Original: Our DVCEs satisfy all desired properties of VCEs.
Revised: Our DVCEs satisfy all desired properties of VCEs.

Original: Throughout the paper, we show that DVCEs can handle vastly different image configurations, objectsizes, and classes.
Revised: Throughout the paper, we show that DVCEs can handle vastly different image conﬁgurations, objectsizes and classes.

Original: Checklist
Revised: Checklist

Original: For all authors...
Revised: For all authors...

Original: (a) Do the main claims made in the abstract and introduction accurately reflect the paper’scontributions and scope?
Revised: (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you describe the limitations of your work?
Revised: (b) Did you describe the limitations of your work?

Original: [Yes] See Sec. 5.(c)
Revised: [Yes] See Sec. 5.

Original:  Did you discuss any potential negative societal impacts of your work?
Revised: (c) Did you discuss any potential negative societal impacts of your work?

Original: [Yes] See Sec.5.(d)
Revised: [Yes] See Sec.

Original:  Have you read the ethics review guidelines and ensured that your paper conforms tothem?
Revised: (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?

Original: [Yes]2.
Revised: [Yes]

Original: If you are including theoretical results...
Revised: If you are including theoretical results...

Original: (a) Did you state the full set of assumptions of all theoretical results?
Revised: (a) Did you state the full set of assumptions of all theoretical results?

Original: [N/A](b)
Revised: [N/A]

Original:  Did you include complete proofs of all theoretical results?
Revised: (b) Did you include complete proofs of all theoretical results?

Original: [N/A]3.
Revised: [N/A]

Original: If you ran experiments...
Revised: If you ran experiments...

Original: (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
Revised: (a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as a URL)?

Original: [Yes] See supplemental material.(b)
Revised: [Yes] See supplemental material.

Original:  Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
Revised: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?

Original: [N/A]
Revised: [N/A]

Original: We didn’t train models.(c)
Revised: We didn’t train models.

Original:  Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
Revised: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?

Original: [N/A] We have conducted qualitative experiments in the mainpaper for the same seed and show the diversity of VCEs across seeds in App.
Revised: [N/A] We have conducted qualitative experiments in the mainpaper for the same seed and show the diversity of VCEs across seeds in App.

Original: B.3.(d)
Revised: B.3.(d)

Original: Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
Revised: Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?

Original: [Yes] See App. D
Revised: [Yes] See App. D4.

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
Revised: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...

Original: (a)
Revised: (a)

Original: If your work uses existing assets, did you cite the creators?
Revised: If your work uses existing assets, did you cite the creators?

Original: [Yes] (b) Did you mention the license of the assets?
Revised: [Yes](b) Did you mention the license of the assets?

Original: [Yes] Yes, directly inthe citation, whenapplicable.
Revised: [Yes] Yes, directly in citation, whenapplicable.(c)

Original: (c) Did you include any new assets either in the supplemental material or as a URL?
Revised: Did you include any new assets either in the supplemental material or as a URL?

Original: [Yes] We include our code inthe supplemental material. 
Revised: [Yes]We include our code in supplemental material. [Table]

Original: (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?
Revised: (d) Did you discuss whether and how consent was obtained from people whose data you’reusing/curating?

Original: [N/A]
Revised: [N/A]

Original: ImangeNet and ImageNet21k are public datasets.
Revised: ImangeNet and ImageNet21k are public datasets.(e)

Original: (e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?
Revised: Did you discuss whether the data you are using/curating contains personally identiﬁableinformation or offensive content?

Original: [N/A]
Revised: [N/A]5.

Original: If you used crowdsourcing or conducted research with human subjects...
Revised: If you used crowdsourcing or conducted research with human subjects...

Original: (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
Revised: (a) Did you include the full text of instructions given to participants and screenshots,if applicable?

Original: [Yes] We include the results from the user study together with the screenshots of instructions in App. C.
Revised: [Yes] We include the results from the user study together with thescreenshots of instructions in App. C.(b)

Original: (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
Revised: Did you describe any potential participant risks, with links to Institutional ReviewBoard (IRB) approvals, if applicable?

Original: [N/A] Not applicable.
Revised: [N/A] Not applicable.(c)

Original: (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
Revised: Did you include the estimated hourly wage paid to participants and the total amountspent on participant compensation?

Original: [Yes] See App.
Revised: [Yes] See App.

Original: C.
Revised: C.

Original: A AppendixOverview of Appendix

Original: In the following, we provide a brief overview of the additional experiments reported in the Appendix.

Original: • In App.

Original: B, we show how varying l 1 regularization weight (B.1), the starting point of the

Original: diffusion process T (B.2), diversity (B.3), and different levels of robustness (B.4) influence

Original: the DVCEs.

Original: We add the ablation study of the angle used in the cone projection in (B.5).

Original: • In App.

Original: C, we show the results of our user study which shows that both quantitatively and

Original: qualitatively DVCEs generate more meaningful features compared to l 1 .

Original: -SVCEs

Original: [7] and

Original: blended diffusion[2]-based VCEs.

Original: • In App.

Original: D, we describe the hardware and resources used.

Original: • In App.

Original: E, we add the quantitative evaluation of the realism, validity, and closeness of our

Original: DVCEs.

Original: • In App.

Original: F, we additionally show, how our DVCEs can help to uncover spurious features.

Original: • In App.

Original: G, we show some of the failure cases of our method.

Original: B Ablation study of DVCEsB.1 Regularization

Original: In this section, we start by evaluating the impact of the distance regularization term on the diffusionprocess.

Original: We want VCEs to resemble the original image in the overall appearance and only changeclass-specific features to transfer the image into the target class.

Original: To achieve sparse changes, we usel 1 -distance regularization.

Original: In Fig.

Original: 6, we vary the regularization strengths from 0 .

Original: 05 to 0 .

Original: Ascan be seen, all regularization strengths generate meaningful target class-specific features, however,regularization C d of 0 .

Original: 15 gives a good trade-off between being close to the original image as well asbeing realistic.

Original: For the rest of the evaluation, we, therefore, chose a weight of 0 . 15 .

Original: Original

Original: C d = 0 .

Original: C d = 0 .

Original: C d = 0 .

Original: Original

Original: C d = 0 .

Original: C d = 0 .

Original: C d = 0 .

Original: [Figure]

Original: [Figure]

Original: Next, we show how the starting time of the diffusion process influences the DVCEs.

Original: Diffusionbased sampling that is not conditioned on an original image starts the process at standard normallydistributed noise.

Original: However, we show that it is easier to obtain high-quality VCEs that are similar tothe original image by instead starting in the middle of the diffusion process by sampling from theclosed-form probability distribution corresponding to timestep T start (Eq. 2).

Original: For this, we comparethree different settings and define η :=

Original: T start T where we choose η ∈ { 0 . 25 , 0 . 5 , 0 . 75 } .

Original: We observe 473 again that η = 0 .

Original: 5 gives a good trade-off between closeness, realism, and showing class-specificfeatures.

Original: Thus, in all our experiments in this paper, we chose η = 0 .

Original: [Figure]

Original: B.3 Diversity

Original: [Figure]

Original: Note that the diffusion process is by design stochastic.

Original: This means that, unlike optimization-based

Original: VCEs, it is possible to generate a diverse set of VCEs from the same starting image.

Original: In Fig. 8, wevisualize different DVCEs obtained for the non-robust Swin-T Transformer using the cone projection.

Original: [Figure]

Original: B.4 Different robust models

Original: Further, let us use the following notation for an l p -ball of radius ϵ p , B p ( ϵ p ) :

Original: = { x ∈ R d : ∥ x ∥ p ≤ ϵ p } ,where d is the image dimensionality in our case.

Original: In this section, we want to examine the influence of the choice of the robust model on DVCEs.

Original: In[12], the authors take inspiration from the result for linear classifiers in Theorem 3 . 1 [11], whichstates, that when such a classifier is robust with respect to the l 1 - and l ∞ -balls, it is robust also inthe largest l p ball, which fits in the convex hull for any 1 ≤ p ≤ ∞ .

Original: This motivated them further to 486 devise an adversarial training scheme that with some probability performs for each batch either l 1or l ∞ -attack and yields classifiers more adversarially robust for all 1 ≤ p ≤ ∞ .

Original: We will call this 488 scheme multiple-norm robust finetuning.

Original: For models trained in such a way, [7] have shown that the generated VCEs are better (both in terms of

Original: FID and qualitatively), if they are generated with respect to a sparse norm, such as l 1 . 5 .

Original: Our DVCEsare generated with respect to an even sparser l 1 norm and thus we decide to use models with suchrobustness.

Original: For this, we first compare in Fig.

Original: 9 multiple-norm robustly finetuned models using thefine-tuning scheme introduced in [12]: Madry[17] + FT, XCiT[13] + FT, DeiT[5] + FT.

Original: Further, in

Original: Fig.

Original: 10, we compare cone-projection of 3 robust and 3 non-robust models.

Original: [Table]

Original: [Figure]

Original: [Figure]

Original: B.5 Cone projection

Original: In this section, we are going to compare different parameters for the cone projection from Sec.

Original: 3.2,which allows us to explain non-robust classifiers.

Original: Remember that we project the gradient of the robustclassifier onto a cone centered around the gradient of the target classifier.

Original: Thus, larger angles for thecone allow the method to deviate more and more from the target model gradient.

Original: In Fig.

Original: 11, we showthe resulting DVCEs for various angles between 1 and 50 ◦ .

Original: As shown in Fig.

Original: 3, the pure gradient ofthe target model is unable to visually guide the diffusion process, thus angles smaller than or equal to15 ◦ often do not produce class-specific features in the resulting images.

Original: For angles of at least 30 ◦ , wecan see class-specific features in all images.

Original: Although it is possible to use even larger angles, we use30 ◦ throughout the entire paper because this keeps the direction close to the target model’s gradient,which is important as we want to explain the target model and not the robust one.

Original: Original

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: C User study

Original: In this section, we discuss a user study that we performed to compare the l 1 .

Original: -SVCEs

Original: [7], blendeddiffusion-VCEs [2], and our DVCEs.

Original: Whereas in Fig.

Original: 4 we provide a qualitative comparison showing the generated VCEs, the user studyprovides us also with a quantitative comparison.

Original: The images for the three methods were generatedthe same as for Fig.

Original: 4, see Sec.

Original: 4.1 for details.

Original: To generate the images, we randomly selected imagesfrom the ImageNet test set and then generated VCEs for two target classes (different from the originalclass of the image) which belong same WordNet category as the original class.

Original: In this study, the users, who have participated voluntarily and without payment, were shown theoriginal images and the VCEs of the three different methods in random order.

Original: The users wereresearchers in machine learning and related areas but none of them is working on VCEs themselfor had seen the generated VCEs before.

Original: Following [7], we asked 20 users to rate 44 VCE, if thefollowing three properties are satisfied for a given VCE (no or multiple answers are allowed): i)ªWhich images have meaningful features in the target class?º ( meaningful ), ii)

Original: ªWhich images lookrealistic?º realism , iii)

Original: ªWhich images show subtle, yet understandable changes?º ( subtle ).

Original: Thescreenshot with instructions and the shown images can be seen in Fig.

Original: In the following we report

Original: 523 the percentages of the images for DVCEs-, l 1 .

Original: 5 -SVCEs [7], and blended diffusion [2] which wereconsidered to have one of the three different properties: meaningful - 62.0% , 48.4%, 38.7%; realism- 34.7%, 24.6%, 52.2% ; subtle - 45.0%, 50.6% , 31.0%.

Original: In Fig.

Original: 16 we report additionally all originalimages together with their changes and provide the percentages for each image individually.

Original: Our DVCEs achieve with 62 . 0% the highest percentage for meaningful changes, whereas blendeddiffusion achieves only 38 .

Original: However, blended diffusion VCEs are considered to be realistic in52 .

Original: 2% of the cases whereas our DVCEs in 34 .

Original: The reason for this seemingly contradictory resultis that the blended diffusion-VCE are often not able to realize a meaningful class change, in thesense that the generated images do not show the corresponding class-specific feature e.g. in Fig.16 for the change siamang → gorilla, the blended diffusion VCE looks very good (realism 80% )but is considered to be only 20% meaningful (in fact it did not change the original image) or forjellyfish → brain coral the shown image looks realistic but shows no features of the target class.

Original: Thereason is that it despite blended diffusion has the advantage that we select the image with the highestconfidence from six parameter settings whereas for our method we only have one fixed parametersetting, it is sometimes not able to reach high confidence in the target class and does either too littlechanges (siamang → gorilla) or quite significant changes but meaningless ones (jellyfish → braincoral).

Original: Regarding l 1 . 5 -SVCEs - they have the most subtle changes 50 .

Original: 6% vs. 45 . 0% for DVCEs butthe images show often artefacts (please use zoom into images) which is the reason why they areconsidered the least realistic ones.

Original: In total, the user study shows that DVCE performs best among thethree methods if one considers all three categories.

Original: D Resources and hardware used

Original: All the experiments were done on Tesla V100 GPUs, and for the generation of a batch of 6 DVCEswithout cone projection and blended VCEs 3 minutes were required.

Original: For the batch of 6 DVCEs withcone projections, 5 minutes were required, as one additional model was loaded and the gradient withrespect to it was calculated

Original: [Table]

Original: [Table]

Original: [Table]

Original: [Table]

Original: [Figure]

Original: E Quantitative evaluation

Original: Here, we provide the quantitative evaluation of realism, validity, and closeness.

Original: As SVCEs [7] cannotbe computed for non-robust models, we do the evaluation in this section for the robust Madry[18]+FT.

Original: In Tab. 1, we provide a quantitative evaluation of realism, validity, and closeness of the generated

Original: VCEs.

Original: [Table]

Original: Realism is assessed using Fréchet Inception Distance (FID) [23], which was also used in [7].

Original: However,in [7], the authors noticed that there is a risk of having low FID scores for the VCEs that don’tchange the starting images significantly.

Original: To overcome this problem, we propose the following simpleªcrossoverº evaluation:

Original: 1. divide the classes in the WordNet clusters into two disjoint sets A and B with resp.

Original: 5504and 4576 images so that one gets a roughly balanced split of ImageNet classes.2.

Original: compute VCEs for the test set images of classes A and B with targets ( 425 different classes)in B resp.

Original: A ( 352 different classes) (crossover).

Original: More precisely, as targets we use classesfrom the same WordNet cluster (see the first step) but which are in the other set.

Original: This ensures

Original: subtle changes of semantically similar classes and rules out meaningless class changes likeªgranny smith → container shipº.

Original: 3. determine two subsets of the ImageNet trainset for the classes in A resp.

Original: B, such that in each

Original: subset the distribution of the labels corresponds to the one of A resp.

Original: B. Then we computeFID scores once between the training set corresponding to A and the VCEs generated with atarget in A and for the training set corresponding to B and the VCEs with targets in B andreport the average of the two FID scores.

Original: This way, we make sure that the original images for VCEs don’t come from the same distributionas the images from the subset of the training set of ImageNet.

Original: As a sanity check, we evaluated the

Original: FID scores of the training set of classes in A to the original images of the classes in B and vice versawhich yields an average of 41.5.

Original: As all methods achieve a smaller FID score (lower is better), theyare all able to produce features of the target classes.

Original: However, DVCE stands out with an FID score of17.6 compared to 27.9 (blended diffusion) and 25.6 ( l 1 . 5 -SVCE).

Original: Validity is evaluated as the mean confidence of the model achieved on the VCEs for the selected targetclasses.

Original: The mean confidence of DVCEs is almost the same as that of l 1 . 5 -VCEs which maximizethe confidence over the l 1 . 5 -ball

Original: and thus are expected to have high mean confidence.

Original: So there islittle difference in validity, whereas Blended diffusion has significantly lower confidence and thus hasworse performance regarding validity.

Original: This is again due to the problem that the parameters leading tohigh confidence of the classifier but still leading to an image related to the original class are extremelydifficult to find (if they exist at all) as they are image-specific.

Original: Closeness is assessed with the set of metrics - l 1 , l 1 . 5 , l 2 , as well as the perceptual LPIPS-metric

Original: [59]for the AlexNet model.

Original: As l 1 . 5 -SVCE directly manipulate the image without the modification by agenerative model, it is not surprising that in terms of l p -distances they outperform DVCE and blendeddiffusion is even more apart which again is due to the problem that the images are not necessarilyclose to the original image.

Original: Summary From the qualitative and the quantitative results we deduce that DVCEs and l 1 .

Original: 5 -SVCEsare equally valid but DVCEs outperform in terms of image quality (realism) all other approachessignificantly while remaining close to the original image.

Original: F Spurious features

Original: In this section, we want to show how DVCEs can be used as a ªdebuggingº tool for ImageNetclassifiers (resp.

Original: the training set).

Original: First, we show that DVCE finds the same spurious features asdiscovered in [7] and we show also more spurious features found by our method.

Original: [Figure]

Original: Reproducing spurious features found in [7].

Original: In Fig.

Original: 14, we first reproduce the spurious featuresfound by [7] with l 1 . 5 -SVCE for ϵ 1 . 5 = 150 for the Madry[18]+FT model.

Original: We generate the DVCEscheme for Madry[18]+FT, the non-robust Swin-Transformer [30], and ConvNeXt [31].

Original: We findsimilar spurious features for the target classes ªwhite sharkº and ªtenchº.

Original: As discussed in [7], thesespurious features are a consequence of the selection of the images in the training set.

Original: For ªwhite sharkº it contains a lot of images containing cages to protect the diver and thus the models pick upthis ªco-occurrenceº.

Original: Even more extreme for ªtenchº where a large fraction of images show theangler holding the tench in their hands leading to the fact that counterfactuals for tench contain humanfaces and hands.

Original: The spurious text feature for the class ªgranny smithº shown by the Madry+FTmodel is not visible for Swin-Transformer, and ConvNext.

Original: One key difference is that they have beentrained on ImageNet-22k and then fine-tuned to ImageNet which might have reduced this spuriousfeature but it requires a more detailed analysis to be sure about this.

Original: [Figure]

Original: New spurious features for non-robust models.

Original: We use our DVCEs here to find novel spuriousfeatures picked up by all classifiers (but to a mixed extent) Madry[18]+FT, ConvNeXt and SwinTransformer: features of flowers (and not the bee itself) increase the confidence in the target classªbeeº and features of the tiger face increase the confidence in the target class ªtiger catº as can be seenin Fig. 15.

Original: Here, we show both the target class and the ground truth label for all the VCEs.

Original: We alsoshow in the rightmost column the samples from the trainset of ImageNet from the respective targetclasses.

Original: In both cases, they show why the classifier has picked up these spurious features.

Original: Imagesof bees often show flowers, most of the time much larger than the bee itself.

Original: Whereas the DVCEfor ªtiger catº shows that the training set of this class is completely broken as it contains images ofªtigersº (note that ªtigerº is a separate class in ImageNet).

Original: G Failure cases

Original: From what we have seen, generally, there are two failure cases of our method: i) sometimes DVCEscan be blurry, which seems to be an artefact of the diffusion model as it happens for blended diffusionand is visible also in the original diffusion paper (see top left image in Fig.

Original: 15 of [15]), ii) DVCEs canfail when the change is difficult to realize (i.e. the original image is not similar to the target class).

Original: Original

Original: DVCE (ours) l 1 .

Original: 5 -SVCE [7]

Original: Blended Diff [2]

Original: [Figure]

Original: m:0.5,r:0.1,s:0.

Original: m:0.8,r:0.5,s:0.

Original: m:0.0,r:0.0,s:0.

Original: [Figure]

Original: m:0.6,r:0.2,s:0.

Original: m:0.2,r:0.1,s:0.

Original: m:0.8,r:0.6,s:0.

Original: [Figure]

Original: m:0.6,r:0.3,s:0.

Original: m:0.5,r:0.1,s:0.

Original: m:0.3,r:0.2,s:0.

Original: [Figure]

Original: m:0.2,r:0.1,s:0.

Original: m:0.4,r:0.4,s:0.

Original: m:0.1,r:0.5,s:0.