{"id":"e664a8b1-3ac6-4652-ae21-0f24b43d3c83","arxiv_id":"2411.16817","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"On KronoDroid Android malware classifiers, SHAP proves the most informative explainability tool, while LIME, ELI5, and Random Forest weights produce mutually inconsistent feature rankings.","lead":"This paper applies five explainable-AI techniques to six machine-learning and deep-learning classifiers trained to recognize Android malware families, and compares the resulting explanations. The main takeaway is that SHAP gives the richest global and local explanations, but different XAI methods rank features so inconsistently that no single explanation should be trusted alone.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SHAP global rankings are computed on an RF-selected 10-feature subset, so the paper's 'SHAP was particularly informative' conclusion may describe reduced models rather than the trained classifiers.","rationale":"The reader's conditional verdict is appropriate. I focused on the SHAP claim because the conclusion explicitly elevates SHAP ('relatively costly to compute, SHAP explanations were particularly informative') and because the SHAP experiments are the only place where a feature-selection choice is interposed between the trained models and the explanations. The RFE step in Section 4.3.5 is not merely a performance optimization: it changes what is being explained. The paper does not state whether the models were retrained on the 10 features; if they were, Table 3 accuracies no longer apply to the explained models, and if they were not, the efficiency property of Shapley values (Section 2.4.5) is violated for the full feature space. Either way, the cross-model agreement on dangerous and total perm cannot be read as a property of the classifiers in Table 3. The ELI5/RF inconsistency in Section 4.3.2 and the LIME local examples are less affected and support the weaker 'methods disagree' conclusion. The CNN input-ordering is a second, real confound, but it is confined to the CAM experiment; the SHAP issue cuts at the paper's headline XAI technique. I agree with the reader's weakest assumption, and the required fix is concrete: recompute the full-model SHAP for at least the RF model and report the reduced-model accuracies.","tokens_in":16000,"tokens_out":7730,"duration_ms":71009,"concrete_test":"Run TreeSHAP on the full 468-feature Random Forest model (exact and cheap for trees) and compare its top-10 features with the RFE subset used in Section 4.3.5. If the full-model top 10 differs from the RFE-selected 10, the RFE subset is not sufficient, and all SHAP/PDP analyses for the other models must be recomputed on a defensible feature set.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.3.5 states: 'Due to the high computational cost we use Recursive Feature Elimination (RFE) based on Random Forest models to determine which features to sample... we select these top 10 features to sample for each of the models under consideration.' The paper never says whether the SVM, k-NN, MLP, and Random Forest models were retrained on those 10 features for the SHAP experiments, or whether SHAP was computed for the 468-feature models using only 10 sampled features. If the former, the SHAP global plots (Figures 8-12) and the claim that 'the top two ranking features for all of the models are dangerous and total perm' characterize different classifiers than those whose accuracy appears in Table 3, and the accuracy of the reduced models is not reported. If the latter, the values are not Shapley values for the full models: with 458 features omitted, the efficiency property from Section 2.4.5 cannot hold, and the displayed importances are conditional on an RF-chosen coordinate set. In either reading, the central conclusion that SHAP was 'particularly informative' and the cross-model agreement on dangerous and total perm are not supported by the reported experiments. The ELI5-vs-RF feature-importance disagreement in Section 4.3.2 still supports the weaker 'methods disagree' claim, but the SHAP-specific claim is the one the paper emphasizes as strongest.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper applies five XAI techniques (LIME, SHAP, PDP plots, ELI5, and Grad-CAM) to SVM, Random Forest, k-NN, MLP, and CNN classifiers trained on a 10-family subset of the KronoDroid Android malware dataset with 468 features. It reports model accuracies, generates global and local explanations, and compares the feature-importance rankings produced by different methods. The authors conclude that all tested XAI techniques provide useful information, that SHAP was particularly informative, and that different XAI techniques do not always agree. The paper also includes a literature review of XAI work applied to Android malware.","tokens_in":77,"tokens_out":4603,"duration_ms":98467,"significance":"If the experimental conclusions are supported, the paper provides a useful comparative benchmark of post-hoc explanation methods on a realistic malware classification task, with concrete observations about inter-method disagreement. The manuscript is largely reproducible: the dataset, model hyperparameters, and train/test setup are specified, and the authors report runtime comparisons for the SHAP variants. The claim that feature-importance conclusions depend on the chosen XAI method is credible and consistent with prior work. However, the strongest claim, that SHAP was 'particularly informative' and that dangerous and total perm are the top features across models, rests on an under-specified and potentially circular 10-feature SHAP protocol, and the CNN/Grad-CAM comparison is confounded by the Random-Forest-based image construction. These issues are fixable but require changes to the experimental reporting or to the strength of the conclusions.","major_comments":[{"comment":"The SHAP global analyses are computed on a 10-feature subset selected by Random-Forest-based RFE, but the manuscript never states whether SVM, k-NN, MLP, and Random Forest were retrained on those 10 features for the SHAP experiments or whether SHAP was computed with only 10 sampled features of the full 468-feature models. Under the first reading, the SHAP variable importance plots, beeswarm plot, PDP plots, and force plot describe reduced classifiers whose accuracies are not reported and are not the models of Table 3. Under the second reading, the values are not Shapley values for the full models: with 458 features omitted, the efficiency property stated in Section 2.4.5 cannot hold, and the importances are conditional on the RF-selected coordinate set. Therefore, the claim in Section 5 that 'SHAP explanations were particularly informative' and the cross-model agreement on dangerous and total perm are not supported by the evidence as presented. The authors should either retrain each model on the selected 10 features and report those reduced models' accuracy, or compute SHAP on the full models with a sampling scheme that respects the model under explanation.","section":"Section 4.3.5 (Figures 8-12); Section 5"},{"comment":"The CNN input images are generated by ranking all 468 features according to Random Forest feature importance and then reshaping the ordered feature vector into a 22x22 image. This construction encodes the RF ranking into the spatial layout of the image, so the comparison between Grad-CAM and RF feature importance is not an independent comparison of two models on the same representational footing. Moreover, the 22x22 layout creates arbitrary adjacencies between features that have no domain meaning, and convolutional filters will exploit those adjacencies. Consequently, the conclusion that 'the Random Forest and CNN models appear to be using much different criteria' is not established. The experiment should be repeated with a feature ordering that does not depend on the model being compared, or the claim should be restricted to the chosen ordering.","section":"Section 4.3.4 (Figure 6)"},{"comment":"The manuscript states that stratified 5-fold cross-validation is used, but Table 3 reports only single accuracy, precision, recall, and F1 values per model with no variance and no statement of whether these are averaged over folds or taken from one fold. Since all models lie within approximately 4% in accuracy, the ranking of Random Forest as best and the relative ordering of the other models cannot be assessed without error bars. Reporting mean and standard deviation (or per-fold results) across the five folds is needed to support the performance comparisons used in the paper.","section":"Table 3"}],"minor_comments":[{"comment":"'KernalSHAP' should be 'KernelSHAP'.","section":"Section 4.3, first paragraph"},{"comment":"'Random Forrest' should be 'Random Forest'.","section":"Section 4.3.1"},{"comment":"'n estimator = 100' should be 'n_estimators = 100'; '300 hidden layers' should presumably read '300 hidden units'; and 'ReLu' should be 'ReLU'.","section":"Section 4.1, hyperparameter list"},{"comment":"The comparison of ELI5 and Figure 5 counts overlap between a top-20 list and a top-10 list, so the statement that only four of the top 10 features appear among the top 20 should be computed at the same cutoff or accompanied by the full ELI5 ranking for verification.","section":"Section 4.3.2"},{"comment":"The pie chart in Figure 3 gives percentages that do not sum to 100 (25+16+13+12+9+8+6+4+4+3 = 100, but rounding makes individual labels appear inconsistent); the x-axis of Figure 2 lacks descriptive label text, though the caption explains the quantity.","section":"Section 4.1 and Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The paper is an empirical comparative study rather than a new methodology or a systems paper; it may be a better fit for a venue that publishes applied evaluation and survey-style work. The citation pattern appears appropriate and the authors engage with prior XAI-for-malware literature. The main risk is that the SHAP-centered conclusion is currently not fully supported by the experimental protocol; if the authors address the sampling/retraining question and the CNN ordering confound, the revised paper could be acceptable. The accuracy-variance issue should also be fixed because the performance ranking is part of the paper's narrative."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hi [Name],\n\nHere's my read on arXiv:2411.16817. It's a straightforward application study: train five classifiers on KronoDroid (top 10 families) and throw LIME, SHAP, ELI5, PDP, and Grad-CAM at them. The most useful output is the demonstration that feature importance rankings are not stable across explainers—e.g., only four of the top 10 RF-importance features appear in ELI5's top 20, and the Grad-CAM and RF views of the CNN don't line up. That's worth having on record.\n\nThe literature review is fine, and the paper is honest about consistency problems, which I appreciate. The experimental design is the problem. Section 4.3.5 says that because KernelSHAP and DeepSHAP are expensive, they use Random-Forest-based RFE to pick the top 10 features, then 'sample' those 10 for every model. It is never made clear whether the SVM, k-NN, MLP, and RF were retrained on just those 10 features or whether SHAP was applied to the full 468-feature models with only 10 features considered. Either way, the SHAP global plots in Figures 8-12 are not Shapley values for the models in Table 3. If the models were retrained, the accuracy of those reduced models is unreported. If not, the efficiency property from Section 2.4.5 cannot hold with 458 features dropped. So the paper's strongest claim—that SHAP was 'particularly informative' and that dangerous and total perm are the top drivers across models—is not supported as written. The ELI5-vs-RF disagreement still supports the weaker 'methods disagree' conclusion.\n\nThere are smaller issues. Table 3 gives single accuracy numbers with no variance, despite the text mentioning 5-fold cross-validation; the paper actually uses an 80:20 split for the reported results. The MLP description '300 hidden layers' is almost certainly a typo. And the CNN input images are constructed by ordering features by RF importance, which makes the Grad-CAM versus Random Forest comparison another form of self-reference.\n\nAll of this is fixable. A revision that either computes SHAP on the full feature set (with a proper subsampling method) or clearly retrains and reports the reduced models, adds confidence intervals, and re-does the Grad-CAM experiment with a neutral feature ordering would make the study solid.\n\nWho benefits? Practitioners in Android malware who want a map of the XAI landscape and a caution that explainers don't agree. It's not a breakthrough, but it's a useful data point. I'd accept it for review, but I'd expect heavy revision.\n\nBest,\n[Name]","headline":"Competent XAI survey-plus-experiments on Android malware; the inconsistency finding is real but the SHAP-specific claim rests on a feature-selection confound.","tokens_in":16822,"tokens_out":3249,"would_cite":false,"duration_ms":27545,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Applying five XAI techniques to Android malware classifiers shows they reveal feature-level drivers, but the explainers disagree enough that conclusions depend on the method chosen.","keywords":["Android malware","explainable AI","SHAP","LIME","ELI5","Grad-CAM","KronoDroid dataset","feature importance"],"falsifier":"Re-run the global SHAP analysis with a feature subset chosen by each model's own feature importance, such as its permutation importance or LIME rankings, and check whether dangerous and total perm remain the top two features across all models; if they do not, the paper's central SHAP conclusion is an artifact of the random-forest-based recursive feature elimination.","tokens_in":15778,"feed_emoji":"🛡️","tokens_out":10604,"duration_ms":83899,"temperature":0.7,"pith_summary":"This paper asks whether standard explainability tools can open up machine-learning and deep-learning classifiers for Android malware, and what those tools actually show. The authors train SVM, random forest, k-nearest neighbors, MLP, and CNN models on the top ten malware families of the KronoDroid dataset, then apply LIME, SHAP, PDP plots, ELI5, and Grad-CAM. They find that every technique yields some insight into the model it explains, with SHAP giving the most detailed global picture: the features dangerous and total perm top the SHAP rankings for all four models tested. At the same time, feature rankings from ELI5, random-forest weights, and Grad-CAM do not line up with SHAP's, so the paper concludes that XAI conclusions in this domain are method-dependent and that consistency across explainers remains an open concern. The stakes are practical: without reliable explanations, malware detectors stay black boxes that are harder to trust and harder to defend against adversarial manipulation.","feed_headline":"SHAP opens Android malware black boxes; XAI methods disagree","feed_subtitle":"Five explainability tools on six classifiers show feature rankings depend on the explainer, not just the model.","key_machinery":"The work is carried by a battery of feature-attribution techniques applied to trained classifiers. SHAP (Shapley Additive exPlanations) attributes each prediction to features by averaging cooperative-game contributions—Shapley values—and supplies global importance plots, dependence plots, and force plots; TreeSHAP, KernelSHAP, and DeepSHAP are used for the random forest, SVM/k-NN, and MLP respectively. LIME builds a locally faithful sparse linear surrogate around individual samples; ELI5 measures permutation importance by shuffling one feature at a time; PDP plots visualize the marginal effect of a feature while averaging out others; and Grad-CAM localizes the pixels a CNN relies on. A shared experimental device is also load-bearing: because KernelSHAP and DeepSHAP are expensive, the authors use random-forest-based recursive feature elimination to fix a common set of the top ten features, then compute SHAP on that subset for every model.","core_discovery":"On the paper's own terms, the central discovery is that XAI techniques can be informative when applied to Android malware classifiers, but they do not tell a single consistent story. Using a ten-family subset of the KronoDroid dataset, the authors train six classifiers and interrogate them with five explanation families. SHAP global explanations are singled out as particularly informative: across the RBF-SVM, random forest, k-NN, and MLP models, the features dangerous and total perm rank highest, and PDP plots show interpretable relationships such as an approximately linear rise in SHAP values as dangerous increases for the RBF-SVM. Yet ELI5's permutation importance for random forest and the random forest's own feature weights put different features at the top, and Grad-CAM indicates the CNN relies on different criteria than the random forest. The paper therefore establishes both a positive result—explanations can be extracted and visualized—and a cautionary one: conclusions about which features drive Android malware decisions depend on the explainer chosen.","pith_inferences":["A testable extension is to recompute the SHAP global rankings using feature subsets chosen by each model's own importance signal; if dangerous and total perm remain top-ranked under those subsets, the paper's SHAP result is robust rather than an artifact of the random-forest selector.","The observed cross-technique disagreement suggests that XAI-based feature pruning for Android malware should keep only features that rank highly across multiple explainers, otherwise downstream detectors inherit the explainer's bias.","If explanation inconsistency is as widespread as the paper and prior work suggest, the disagreement between explainers could itself be a diagnostic signal: samples where LIME and SHAP strongly diverge may lie near decision boundaries or be adversarial inputs.","The Grad-CAM result implies the CNN is not merely re-weighting the same features the random forest uses, which raises the possibility that different model families learn genuinely different decision rules on the same data; that would motivate choosing models by explanation similarity as well as accuracy."],"forward_implications":["SHAP can be used to produce global feature-importance rankings for Android malware classifiers, and on this dataset dangerous and total perm emerge as the top two features across RBF-SVM, random forest, k-NN, and MLP.","Local explanations are available for individual samples: LIME assigns probabilities and per-feature contributions, and SHAP force plots show which features push a sample toward a given malware family.","The explanation methods disagree: only four of the random forest's own top-ten features appear among ELI5's top twenty, and Grad-CAM shows the CNN emphasizes different regions than the random forest, so no single explainer should be treated as authoritative.","All six classifiers score within roughly four percentage points of each other, with random forest best, so explanations can be sought without giving up much accuracy.","PDP plots expose interpretable feature relationships, such as the near-linear effect of dangerous on the RBF-SVM's predictions, which can be checked against domain knowledge."],"supporting_citations":[{"why":"Supplies the KronoDroid dataset, the labeled Android malware corpus all classifiers are trained on.","marker":"[8]"},{"why":"Defines the unified SHAP framework used for global importance, dependence, and force plots.","marker":"[21]"},{"why":"Provides the LIME implementation used for local surrogate explanations of individual samples.","marker":"[17]"},{"why":"Documents the ELI5 permutation-importance method used to generate global feature rankings.","marker":"[16]"},{"why":"Supplies the interpretable-machine-learning background on Shapley values, PDP plots, and model-specific explanation properties.","marker":"[27]"},{"why":"Raises the consistency problem for XAI in Android malware analysis that the paper's concluding discussion engages with.","marker":"[4]"}],"fun_headline_variants":["XAI for Android malware: explainers often clash","SHAP shines, but XAI tools conflict on Android malware","Android malware XAI: feature rankings depend on the explainer","One malware model, five explainers, many stories","Explainable AI for Android malware: no consensus on key features"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the ten features chosen by random-forest feature selection are sufficient to represent how every model makes decisions, so if a different feature subset were used, the reported SHAP rankings of dangerous and total perm could change.","fun_headline_variants_meta":{"raw":{"variants":["XAI for Android malware: explainers often clash","SHAP shines, but XAI tools conflict on Android malware","Android malware XAI: feature rankings depend on the explainer","One malware model, five explainers, many stories","Explainable AI for Android malware: no consensus on key features"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000855,"raw_usage":{"total_tokens":3742,"prompt_tokens":1001,"completion_tokens":2741,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":617,"completion_tokens_details":{"reasoning_tokens":2669}},"tokens_in":617,"tokens_out":2741,"duration_ms":17937,"temperature":1.0,"reasoning_tokens":2669,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:58:39.629070+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the global SHAP analysis with a feature subset chosen by each model's own feature importance, such as its permutation importance or LIME rankings, and check whether dangerous and total perm remain the top two features across all models; if they do not, the paper's central SHAP conclusion is an artifact of the random-forest-based recursive feature elimination.","supporting_citations":[{"cited_title":"KronoDroid: Time-based hybrid-featured dataset for effective Android mal- ware detection and characterization","cited_arxiv_id":null,"evidence_quote":"Supplies the KronoDroid dataset, the labeled Android malware corpus all classifiers are trained on."},{"cited_title":"https://github.com/marcotcr/lime","cited_arxiv_id":null,"evidence_quote":"Provides the LIME implementation used for local surrogate explanations of individual samples."},{"cited_title":"ELI5: Permutation importance","cited_arxiv_id":null,"evidence_quote":"Documents the ELI5 permutation-importance method used to generate global feature rankings."},{"cited_title":"Interpretable Machine Learning","cited_arxiv_id":null,"evidence_quote":"Supplies the interpretable-machine-learning background on Shapley values, PDP plots, and model-specific explanation properties."},{"cited_title":"Can We Trust Your Explanations? Sanity Checks for Interpreters in Android Malware Analysis","cited_arxiv_id":"2008.05895","evidence_quote":"Raises the consistency problem for XAI in Android malware analysis that the paper's concluding discussion engages with."}],"review_version":1}