{"id":"48540fc2-cdd0-459c-bfd0-0b78220c0ce0","arxiv_id":"2412.11119","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Under FGSM and BIM attacks, EfficientNetV2B0 accuracy drops from 89.94% to 58.73% and 45.50%, while explanation IoU and RMSE scores against SAM masks change only slightly.","lead":"This paper tests whether two common adversarial attacks change the visual explanations that GradCAM, SmoothGrad, and LIME give for an image classifier. The authors find that accuracy drops sharply under attack, while two mask-comparison metrics barely move, suggesting the metrics may miss adversarial effects.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Adversarial explanations are scored against the true-class SAM mask even when the model predicts a different class, so the stable IoU/RMSE do not support the metric-insensitivity claim.","rationale":"The reader's weakest assumption was that SAM masks are valid ground-truth explanations for the model's decisions. I agree with that concern but sharpen it: the assumption fails in a specific, systematic way for adversarial images. Once the model is fooled, the explained class is not the class for which the SAM mask was generated. This affects a large fraction of the 189 images (accuracy drops to ~59% and ~46%, so up to ~40-55% are misclassified). The paper's tables show only aggregate means, which can hide that the stable scores are driven by invalid comparisons. This concern is more load-bearing than the lack of significance tests because even perfect statistics would not rescue a comparison against an irrelevant ground truth. The split-subset test isolates the issue: by restricting to correctly classified adversarial images, the ground truth matches the explained class, making the comparison valid. If the stability disappears there, the central claim is an artifact; if it persists, the claim is strengthened. This is a concrete, feasible reanalysis using the existing code and data, so the appropriate verdict is conditional revision rather than outright rejection; the reader's CONDITIONAL verdict remains appropriate.","tokens_in":9960,"tokens_out":8035,"duration_ms":72517,"concrete_test":"Split the 189 adversarial samples into (a) images where the model's top-1 prediction still equals the true label and (b) images where it does not. Recompute Table 1 and Table 2 separately for each subset. If the IoU/RMSE changes under FGSM/BIM remain negligible in subset (a), the metric-insensitivity conclusion would survive the class-mismatch objection; if the changes become substantial in subset (a), the original stability is an artifact of scoring wrong-class explanations against true-class masks.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Section 6 the authors conclude that IoU and RMSE are not effective at discerning adversarial influences because these metrics change negligibly after FGSM/BIM attacks. This inference requires that the SAM masks are valid ground-truth explanations for the explanations being scored. For adversarial images, however, the model's prediction is often wrong (accuracy falls to 58.73% and 45.50%). Explanation methods such as GradCAM, SmoothGrad, and LIME explain the model's predicted class, not the original true class. The SAM mask corresponds to the true object in the original image. Scoring the explanation of a misclassified adversarial sample against the true-class mask compares a wrong-class explanation to an unrelated ground truth. The observed aggregate stability therefore does not demonstrate metric insensitivity; it may just reflect that saliency maps often continue to overlap the original object even when the model is fooled. Without a valid ground truth for the predicted class, the central claim in Section 6 is unsupported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies whether adversarial attacks (FGSM and BIM) alter the explanations produced by GradCAM, SmoothGrad, and LIME for an EfficientNetV2B0 classifier. Using a manually curated subset of 189 ImageNet images, it compares explanation heatmaps to SAM-generated segmentation masks via IoU and RMSE. The authors report that while model accuracy drops sharply under attack (from 89.94% to 58.73% under FGSM and to 45.50% under BIM), the mean IoU and RMSE change little, and they conclude that these explanation methods combined with IoU and RMSE are not effective at discerning adversarial influences. The paper also acknowledges limitations in dataset size, attack coverage, and generalizability.","tokens_in":10081,"tokens_out":3871,"duration_ms":35361,"significance":"The question is timely and practically relevant, and the paper offers an open repository and a clear pipeline, which are commendable. If the central claim held, it would be a useful caution for practitioners who use IoU and RMSE to evaluate explanation fidelity under adversarial conditions. However, the evidence as presented does not yet establish the claim because of a fundamental ground-truth mismatch for misclassified adversarial images and the absence of statistical support for the 'no significant change' assertion. The contribution is therefore best viewed as a pilot benchmark requiring substantial re-analysis before its main conclusion can be accepted.","major_comments":[{"comment":"The central claim that IoU and RMSE are 'not effective in discerning adversarial influences' is not supported because explanations are scored against the true-class SAM mask even when the model predicts a different class. Under FGSM and BIM, accuracy drops to 58.73% and 45.50%, so for 41% and 54% of images, respectively, the model's top prediction is not the true class. GradCAM, SmoothGrad, and LIME explain the predicted class, not the true class, and comparing a wrong-class explanation to a true-object mask measures overlap with the original object rather than fidelity to the model's actual decision. The stable aggregate IoU/RMSE in Tables 1 and 2 could be an artifact of this mismatch, so the conclusion in Section 6 is not warranted. The authors should recompute metrics on correctly classified images only, or use ground-truth masks for the predicted class, and report per-condition distributions.","section":"Section 3, Section 6, Tables 1 and 2"},{"comment":"The paper claims 'no significant changes' in IoU and RMSE based on aggregate mean values (e.g., GradCAM IoU 34.66% vs. 33.67% vs. 32.75%), but it reports no error bars, confidence intervals, or significance tests. With n=189 and likely high per-image variance, these small aggregate differences may be within noise. The authors should report standard deviations, paired significance tests (e.g., Wilcoxon signed-rank or paired t-test) per explanation method, and effect sizes. Without this, the conclusion that the changes are negligible is not statistically supported.","section":"Tables 1 and 2"},{"comment":"The validity of SAM-generated masks as ground-truth explanations for EfficientNetV2B0's decisions is not established. SAM segmentations delineate objects, but they do not necessarily correspond to the features that drive the classifier, which could include background, texture, or partial-object cues. The manuscript states that masks were manually selected for being 'clear and accurate' but provides no validation of their relevance to the model's reasoning (e.g., human ratings, comparison to alternative ground truths, or ablation). Without such validation, the stability of IoU/RMSE may measure agreement with a segmentation model rather than with the model's true decision basis.","section":"Section 3, Figure 4, Section 5"},{"comment":"The dataset is a manually curated subset with several undocumented selection steps: classes 41-79 were excluded, grayscale and multi-instance images were discarded, and only images for which SAM produced 'clear and accurate masks' were retained, yielding only 189 images. The number of images excluded at each step and the criteria for 'clear and accurate' are not reported. Since the stated goal includes establishing a benchmark, these selection rules need transparent documentation and a sensitivity analysis (e.g., reports on the excluded classes or on a random subset of ImageNet). The acknowledged limitation of small data is good, but the selection procedure itself can bias the benchmark.","section":"Section 4, Section 5"}],"minor_comments":[{"comment":"The captions contain a typo: 'Avderarial' should be 'Adversarial'.","section":"Figures 8 and 9"},{"comment":"The citation 'Bach et al., 2025' appears to be an error; the LRP paper was published in 2015 (PLoS ONE, 10(7), e0130140).","section":"Section 2"},{"comment":"DeepLIFT is attributed to Li et al. (2021), but the original DeepLIFT method is by Shrikumar et al. (2017); the cited Li et al. paper is a different work with the same acronym.","section":"Section 2"},{"comment":"The RMSE equation is typeset confusingly (the limits and the square root are malformed); a cleaner typesetting such as RMSE = sqrt((1/(n^2)) * sum_i sum_j (Y_ij - Yhat_ij)^2) would improve readability.","section":"Section 3"},{"comment":"The explanation masks are generated by selecting the 'top 15% of pixels,' but this threshold is introduced without justification or sensitivity analysis; a brief comment on how the choice of threshold could affect IoU/RMSE would strengthen the presentation.","section":"Section 5, Figure 6"},{"comment":"The paper structure described in the introduction says Section 5 concludes the study, but the conclusion is actually in Section 6; please correct the roadmap.","section":"Section 1"}],"recommendation":"major_revision","confidential_remarks":"This is a pilot empirical study with a relevant question and an open repository. The main flaw is the ground-truth mismatch for adversarial images, which is fixable by restricting the analysis to correctly classified images or by constructing predicted-class ground truths. The absence of any statistical uncertainty is a second, equally fixable issue. The paper's contribution would be strengthened by a more transparent dataset selection report and by positioning the work as a benchmark rather than a definitive negative result. The fit to the journal is acceptable for an empirical paper, but the current evidence does not support the central claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know about this paper. First, it reports a specific, reproducible empirical pilot: on 189 curated ImageNet images, FGSM and BIM drop EfficientNetV2B0 accuracy from 89.94% to 58.73% and 45.50%, while IoU and RMSE against SAM masks barely move. Second, the headline conclusion - that these metrics cannot detect adversarial influence - does not follow from the experiment as designed. The evaluation scores every explanation against the SAM mask of the original true class, but on misclassified adversarial images the explanation methods are explaining the model's predicted class, not the true class. Stable IoU/RMSE therefore likely reflect that saliency maps still overlap the original object even when the model is fooled. The setup never isolates what the model is actually explaining after the attack.\n\nWhat is genuinely useful: the authors chose a concrete setup, reported the numbers plainly, acknowledged their own limitations (small data, narrow attack/metric coverage), and shipped code and data on GitHub. The accuracy drop is consistent with known results, and the metric behavior, once the ground-truth mismatch is accounted for, is a plausible phenomenon worth studying.\n\nThe soft spots are real but not fatal to the paper's value as a pilot. The main one is the ground-truth mismatch above. In Section 6 the authors write 'no significant changes', but there are no error bars, confidence intervals, or significance tests anywhere; that is a claim without statistical support. The manual curation is also heavy: they excluded classes 41-79 because snakes and lizards were emotionally depressing, and kept only images where SAM produced 'clear' masks. That biases the sample in unquantified ways. The tables show small, monotonic shifts (e.g., GradCAM IoU 34.66 -> 33.67 -> 32.75), but without variance we don't know whether those are noise or a real attenuation. These issues are fixable.\n\nWho is this for? A reader who wants a concrete example of how XAI evaluation can go wrong, or who is designing a benchmark and needs a checklist of pitfalls. The paper is not yet a benchmark, despite the authors' stated goal; it is a pilot with a flawed central inference. I would send it to peer review because the question is important and the work is honest and reproducible, but it needs major revision - re-evaluate with predicted-class ground truth or restrict to correctly classified adversarial examples, add statistical testing, and expand the attack/metric space - before the 'metric insensitivity' claim can stand.","headline":"A reproducible pilot with a clean observation, but the main claim about metric insensitivity is undermined by scoring predicted-class explanations against true-class masks.","tokens_in":10676,"tokens_out":3710,"would_cite":true,"duration_ms":33730,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that FGSM and BIM adversarial attacks, which cut model accuracy from 89.94% to 58.73% and 45.50%, leave GradCAM, SmoothGrad, and LIME explanation masks nearly unchanged, as measured by IoU and RMSE against SAM-generated…","keywords":["explainable AI","adversarial attacks","FGSM","BIM","GradCAM","SmoothGrad","LIME","Segment Anything Model"],"falsifier":"A concrete check would be to measure a faithfulness metric on the same 189 images, such as the drop in predicted probability when each explanation's top pixels are occluded, before and after FGSM and BIM attacks; if faithfulness drops sharply while IoU and RMSE stay flat, the paper's conclusion about metric insensitivity would fail for that stronger notion of explanation quality. A complementary test would use a synthetic dataset with a known decision rule to verify whether SAM masks actually align with the features driving the model.","tokens_in":9711,"feed_emoji":"🎯","tokens_out":3836,"duration_ms":31077,"temperature":0.7,"pith_summary":"This paper investigates whether adversarial attacks visibly alter the explanations that deep learning models produce for their image classifications. Using FGSM and BIM attacks on an EfficientNetV2B0 model, the authors find that accuracy drops dramatically, yet the IoU and RMSE of GradCAM, SmoothGrad, and LIME masks against SAM-generated ground truths barely change. The authors conclude that these explanation methods, when paired with IoU and RMSE metrics, are not effective at discerning adversarial influences. A sympathetic reader would take this as a cautionary baseline: if true, explanation heatmaps alone cannot reveal that an image has been adversarially perturbed even when the model is severely wrong.","feed_headline":"Attacks crash model accuracy, yet explanations barely move","feed_subtitle":"GradCAM, SmoothGrad, and LIME masks stay nearly identical when accuracy falls from 90% to 45%.","key_machinery":"The experimental loop is the central mechanism: for each image, a SAM-generated segmentation serves as ground-truth explanation; the model classifies the original image and the adversarial image; GradCAM, SmoothGrad, and LIME produce explanation masks; the top 15% of pixels are retained; and IoU and RMSE compare these masks to the ground truth. The attack equations are FGSM, $x_{adv} = x + \\epsilon \\,\\text{sign}(\\nabla_x J(\\theta, x, y))$, and BIM's clipped iterative application of the same sign-gradient step, both with $\\epsilon = 2.5\\%$.","core_discovery":"The central claim is that explanation fidelity, measured as mask overlap and pixel error against SAM segmentations, is preserved under FGSM and BIM attacks despite a collapse in classification accuracy. On 189 images, IoU shifts by at most about two percentage points and RMSE by about one point across all three explanation methods, while accuracy drops from 89.94% to 58.73% under FGSM and to 45.50% under BIM. The authors interpret this stability as evidence that the combination of these explanation methods with IoU and RMSE metrics is insensitive to adversarial perturbations, and they offer the tabulated results as a foundation for a future benchmark.","pith_inferences":["Because SAM masks are object-level segmentations, the observed stability may simply mean that attacks move the model to a wrong class while still focusing on the same object region; a faithfulness metric that measures how much the predicted probability changes when the highlighted pixels are occluded could reveal attack-induced shifts that IoU and RMSE miss.","A testable extension would be to compute a rank-correlation or cosine-similarity measure between the original and adversarial explanation maps; such heatmap-level comparisons may be substantially more sensitive to perturbations than overlap against a fixed mask.","The conclusion that explanation methods are insensitive to adversarial influences could be an artifact of the ground truth: if the model actually relies on background or texture cues outside the SAM mask, then IoU and RMSE measure agreement with a segmentation algorithm rather than with the model's true decision basis.","This result sits in tension with earlier demonstrations that explanations are fragile under small perturbations; resolving that tension likely requires distinguishing between changes in the explanation map itself and changes in a coarse overlap statistic."],"forward_implications":["If explanation masks stay fixed under attack, visual inspection of GradCAM, SmoothGrad, or LIME outputs cannot serve as a reliable detector of adversarial manipulation.","The small IoU and RMSE deltas provide a numerical baseline for future benchmarks that include more attack methods, more explanation techniques, and more comparison metrics.","The results imply that a model's prediction and its explanation can decouple under adversarial perturbation: the class flips while the highlighted region stays put.","Any defense or certification strategy that relies on explanation stability would need to define robustness with respect to a metric that is actually sensitive to adversarial changes.","Future evaluation of explanation methods should test whether their outputs shift under attack, not just whether they match a segmentation mask."],"supporting_citations":[{"why":"Supplies the FGSM attack method that generates adversarial images by adding a small sign-gradient perturbation.","marker":"Goodfellow et al., 2014"},{"why":"Supplies the Basic Iterative Method, the iterative clipping-based attack used to produce stronger adversarial perturbations.","marker":"Kurakin et al., 2018"},{"why":"Supplies the Segment Anything Model used to generate the ground-truth explanation masks.","marker":"Kirillov et al., 2023"},{"why":"Supplies GradCAM, one of the three explanation techniques evaluated in the study.","marker":"Selvaraju et al., 2016"},{"why":"Supplies SmoothGrad, the second explanation technique evaluated.","marker":"Smilkov et al., 2017"},{"why":"Supplies LIME, the third explanation technique evaluated.","marker":"Ribeiro et al., 2016"},{"why":"Supplies the ImageNet dataset from which the 189-image validation subset is drawn.","marker":"Deng et al., 2009"},{"why":"Supplies the EfficientNetV2B0 pretrained model whose predictions and explanations are analyzed.","marker":"Tan & Le, 2021"}],"fun_headline_variants":["Attacks crash accuracy, but explanations barely budge","FGSM and BIM drop accuracy 44 points, IoU stays flat","Model accuracy falls, yet explanation fidelity is preserved","Adversarial attacks: accuracy plunges, explainability steady"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper treats SAM-generated segmentation masks as the ground-truth explanation of what the model actually uses to decide, without checking that the model's decisions are driven by those regions; if the model relies on background or texture cues outside the mask, the IoU and RMSE stability would only show agreement with a segmentation algorithm, not with the model's reasoning.","fun_headline_variants_meta":{"raw":{"variants":["Attacks crash accuracy, but explanations barely budge","FGSM and BIM drop accuracy 44 points, IoU stays flat","Model accuracy falls, yet explanation fidelity is preserved","Adversarial attacks: accuracy plunges, explainability steady"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000217,"raw_usage":{"total_tokens":1413,"prompt_tokens":898,"completion_tokens":515,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":514,"completion_tokens_details":{"reasoning_tokens":455}},"tokens_in":514,"tokens_out":515,"duration_ms":5374,"temperature":1.0,"reasoning_tokens":455,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T15:16:39.060253+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete check would be to measure a faithfulness metric on the same 189 images, such as the drop in predicted probability when each explanation's top pixels are occluded, before and after FGSM and BIM attacks; if faithfulness drops sharply while IoU and RMSE stay flat, the paper's conclusion about metric insensitivity would fail for that stronger notion of explanation quality. A complementary test would use a synthetic dataset with a known decision rule to verify whether SAM masks actually align with the features driving the model.","supporting_citations":[],"review_version":1}