{"id":"7103985b-708e-4402-a153-81eb736df503","arxiv_id":"2504.17921","paper_version":3,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Concept-bottleneck models with information bypasses can be 'poisoned' by out-of-distribution leakage, so expert concept corrections fail; the proposed MixCEM gates leakage by concept uncertainty and keeps interventions effective.","lead":"Concept-based AI models let humans correct a model's misread concepts at test time, but those corrections stop paying off when the input shifts out of distribution. This paper names the failure 'leakage poisoning' and introduces MixCEM, which gates the extra information it uses so interventions still work on out-of-distribution inputs.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No ablation isolates the entropy-gated residual scaling: if removing the (1-H) factor leaves OOD intervention curves unchanged, the central mechanism is not what drives MixCEM's gains.","rationale":"The reader's weakest_assumption was that entropy gating reliably indicates OOD and remains calibrated under shift. I agree this is a real risk, but the more precise and testable problem is that the gate's causal contribution is never isolated: the architecture adds a prior-error loss, residual dropout with Monte Carlo averaging, and Platt scaling at the same time as the gate, and only the latter three are ablated. This makes the central mechanism's role untestable from the current results. The proposed constant-scaling experiment would settle whether the entropy gate is doing the work attributed to it, and it is easy to run since the authors already provide code and configurations. I do not see a reason to reject the paper; the empirical comparisons are extensive, with three seeds, multiple shifts, and hyperparameter ablations. The concern is a missing mechanism-level check rather than a demonstrated contradiction, so the reader's CONDITIONAL verdict remains appropriate with no change in direction.","tokens_in":43575,"tokens_out":5234,"duration_ms":59733,"concrete_test":"Run the CUB and CUB-Incomplete OOD intervention experiments with MixCEM's entropy scaling replaced by a constant 1.0 (no gating) and by a constant 0.0 (full gating), keeping lambda_p, p_drop, E_cal, all training settings, and all other hyperparameters identical. If the no-gate variant matches MixCEM's OOD intervention curves within a few accuracy points, the central mechanism is not causally confirmed; if the full-gate variant also matches, the gate is irrelevant to the reported gains. As a complementary check, measure MixCEM's mean concept-prediction entropy on a shift where concept accuracy is below chance (for example, a stronger noise level or an adversarial perturbation) to test whether uncertainty remains a reliable OOD signal precisely in the regime where leakage poisoning matters.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central causal claim is that MixCEM suppresses leaked residuals on OOD inputs through the entropy-based gating factor (1-H(p_hat_i)) introduced in Section 4, and that this is what avoids leakage poisoning. In every reported experiment, however, the gate is confounded with three other changes introduced simultaneously: the prior-error loss L_task(y, f(bar c)), residual dropout with Monte Carlo averaging, and Platt scaling. The paper ablates lambda_p, p_drop, and E_cal individually (Appendix J), but it never sets the gating factor to a constant while keeping the rest of the model fixed. The t-SNE projections and entropy histograms in Figure 2 only show a correlation between OOD inputs and higher concept entropy; they do not demonstrate that the (1-H) scaling is causally responsible for MixCEM's OOD intervention improvements. If the gate is doing little work, the claim that MixCEM 'learns to dynamically exploit leaked information only when it is in-distribution' is unsupported even if the empirical curves stand, because the benefit could come from the prior-error regularizer or the dropout ensemble. This is load-bearing because the paper's stated novelty and title rest on the gating mechanism, not merely on the overall architecture. In addition, the gate inherits the reader's identified assumption that concept-prediction entropy is a calibrated OOD signal; that assumption is never tested on a shift where the model is confidently wrong about concepts, so it is currently an untested premise rather than an established design principle.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies concept-based models (CMs) under distribution shifts and introduces the notion of 'leakage poisoning': when a CM uses residual or bypass mechanisms to overcome incomplete concept annotations, the leaked information becomes out-of-distribution for OOD inputs, so concept interventions no longer improve task accuracy. To address this, the authors propose MixCEM, an architecture that combines learnable global concept embeddings with input-dependent residual embeddings and scales the residuals by (1-H(p_hat_i)), where H is the entropy of the concept prediction. Training adds a prior-error loss on a bottleneck built from global embeddings alone, plus residual dropout, Monte Carlo averaging, and Platt scaling. The paper reports intervention experiments on CUB, AwA2, CIFAR-10, CelebA, TravelingBirds, and an MNIST-to-SVHN shift, comparing MixCEM with Vanilla CBM, Hybrid CBM, CEM, IntCEM, ProbCBM, P-CBM, and Residual P-CBM.","tokens_in":43867,"tokens_out":6804,"duration_ms":69442,"significance":"If the claims hold, the paper identifies a practically important failure mode for concept-based interpretable models and proposes a sensible architectural response. The empirical evaluation is extensive: six datasets, concept-complete and concept-incomplete settings, multiple distribution-shift types, three-seed means with standard deviations, and comparison against strong external baselines. The release of code and configurations is a further strength. However, the paper's central mechanistic claim--that the entropy-gated residual scaling is what avoids leakage poisoning--is not supported by the experiments as reported, because no ablation isolates this component from the simultaneously introduced prior-error loss, residual dropout, and Platt calibration. The contribution is therefore currently a promising architecture plus an unsupported attribution of the mechanism.","major_comments":[{"comment":"The central claim is that MixCEM 'learns to dynamically exploit leaked information missing from its concepts only when this information is in-distribution' (abstract, contribution 3), and the mechanism is the factor (1-H(p_hat_i)) in the contextual embedding definition c_i^(+/-) := c_bar_i^(+/-) + (1-H(p_hat_i)) r_i^(+/-)(x). In every experiment, this factor is confounded with three other changes introduced simultaneously: the prior-error loss L_task(y, f(c_bar)), residual dropout with Monte Carlo averaging, and Platt scaling. Appendix J ablates lambda_p, p_drop, lambda_c, E_cal, and p_int individually, but no experiment replaces the gating factor by a constant (e.g., setting (1-H) to 1) while keeping the rest of MixCEM fixed. The t-SNE and entropy histograms in Figure 2 show a correlation between OOD inputs and higher concept entropy, but correlation is not causal evidence for the gate. Please add a gate-off ablation (residual scaling fixed to 1) and report ID/OOD intervention curves and all-intervened accuracies, at least on CUB-Incomplete and AwA2-Incomplete, so that the attribution of the gains to the entropy gate is actually testable. Without this ablation, the empirical curves may stand but the stated novelty and title are unsupported.","section":"Section 4, \"Entropy-based Gating\"; Section 5.2, Figure 4; Appendix J"},{"comment":"The gate relies on concept-prediction entropy being a reliable and calibrated OOD indicator. Platt scaling is fit on an in-distribution validation set only, and the paper does not test a shift in which concept predictions are confidently wrong. The first limitation acknowledged in Section 6 is exactly such a scenario: when a distribution shift makes a concept incomprehensible to an expert, MixCEM 'may fail to completely block leakage poisoning,' because an intervention cannot be performed. The paper should either report an experiment on a shift where model concept predictions are confidently incorrect (e.g., a semantic concept shift rather than pixel-level noise), or temper the statement in Section 4 that MixCEM drops residuals for OOD samples. Reporting calibration error or the entropy distribution of correct vs. incorrect OOD concept predictions would make the gate's operating assumption visible.","section":"Section 4 and Appendix A; Section 6, Limitations"}],"minor_comments":[{"comment":"The factorization P(Y|C*) = P(Y|C,r(X),C_bar) P(Y|c_bar) is presented as though it is a probability factorization, but the product of two conditional distributions for the same target Y is not a normalized probability and does not follow from the graphical model in Figure 7. The claim that MixCEM's objective 'naturally arises as the MLE' is therefore not established as written; please either provide a proper derivation or present the objective as a regularized multi-task loss.","section":"Appendix B, Eq. (3)"},{"comment":"The wording 'outperform strong baselines by significantly improving their accuracy ... in the presence and absence of concept interventions' is stronger than Table 1 supports: for example, on AwA2 the ID task accuracy of MixCEM is 89.94 vs. CEM's 91.07, and on AwA2 OOD unintervened accuracy MixCEM is 17.75 vs. CEM's 20.22. A more quantitative summary, noting where MixCEM is not the best, would be more accurate.","section":"Abstract and Introduction, Contribution 3"},{"comment":"The Bayes Classifier rows in Table 6 are identical for ID and OOD by construction, because the approximated Bayes classifier takes only ground-truth concept labels as input and ignores the corrupted image. This is not explained in the caption or text and may confuse readers; please add a short note.","section":"Table 6 and Figure 4"},{"comment":"The right panel shows unnormalized count histograms of concept-prediction entropies for ID and OOD samples. Normalizing the histograms (or plotting densities) would make the claimed separation between ID and OOD entropy distributions easier to assess.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is empirically strong and the central phenomenon is worth publishing, but the missing ablation of the entropy-gating factor is the main obstacle. If the authors add the ablation and it shows the gate matters, the paper would be acceptable; if the ablation shows the gate does not matter, the paper's stated contribution needs substantial rewriting. I saw no evidence of circularity or test-set leakage."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Things to know: this paper names and demonstrates a real failure mode—leakage poisoning—in bypass-based concept bottleneck models, and MixCEM, its proposed fix, actually works in the sense that it consistently beats strong baselines on OOD intervention curves across six datasets and multiple shift types. The empirical work is extensive and mostly careful: three seeds, standard deviations, multiple shifts (noise, blur, resize, affine, MNIST→SVHN, spurious correlation), and proper baseline comparisons including ProbCBM, CEM, IntCEM, and others. The paper is honest about where MixCEM is not best—it explicitly does not expect to beat the best unintervened accuracy—and about its failure modes, such as concepts that become incomprehensible to an expert. That honesty earns credit.\n\nThe main soft spot is real and matches the stress test: the entropy-gated residual scaling (1−H) is presented as the mechanism that avoids leakage poisoning, but it is never isolated. The paper ablates λ_p, p_drop, and Platt scaling individually, but never sets the gating factor to a constant while keeping the rest of the model fixed. So the causal claim that the gate is what drives the OOD improvement is unsupported, even though the empirical curves for MixCEM as a whole stand. The t-SNE projections and entropy histograms are correlational, not causal. This is a load-bearing gap for the paper's stated novelty, though not for the practical value of MixCEM as a method. The fix is straightforward: one ablation that sets the gating factor to 1 (or a learned scalar) and shows the OOD intervention curves degrade.\n\nMinor issues: the repo link has no pinned commit hash, and the Appendix B MLE derivation has an ad hoc factorization step—the product of two task likelihoods is a modeling choice rather than a derivation from the graphical model. Neither breaks the empirical claims.\n\nVerdict: this deserves a serious referee. The empirical contribution is valuable and the phenomenon is real. The paper should be asked to add the missing gate ablation and to soften the causal language about the entropy mechanism.","headline":"A well-executed empirical paper identifying a real failure mode in concept-based models; the headline entropy-gating mechanism is not isolated by ablation, but the empirical contribution stands.","tokens_in":44454,"tokens_out":1460,"would_cite":true,"duration_ms":15916,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Bypass concept models lose the benefit of human concept corrections when test inputs shift out of distribution; the paper proposes MixCEM, which gates leaked residuals by concept-prediction entropy and keeps interventions effective.","keywords":["concept bottleneck models","leakage poisoning","concept interventions","distribution shift","out-of-distribution detection","concept embeddings","interpretable machine learning","entropy gating"],"falsifier":"Run a trained MixCEM on an OOD shift such as 10% salt-and-pepper noise and measure the entropy of its concept predictions: if most mispredicted concepts have low entropy, the gate stays open and MixCEM's all-intervened OOD accuracy should resemble CEM's rather than stay near the Bayes classifier. Alternatively, adversarially perturb inputs to force confidently wrong concept predictions and check whether leakage poisoning returns.","tokens_in":43336,"feed_emoji":"🛡️","tokens_out":8138,"duration_ms":74933,"temperature":0.7,"pith_summary":"The paper sets out to show that concept-based models which let task information bypass the concept bottleneck become unreliable exactly when they are most needed: when a human expert corrects mispredicted concepts on out-of-distribution inputs. It names this failure \"leakage poisoning\": the bypassed information persists in the bottleneck even after an intervention, and because that leaked information is itself out-of-distribution, corrections no longer pull the prediction back toward the right answer. To fix it, the paper proposes MixCEM, which represents each concept as a global embedding plus a sample-specific residual and scales the residual down by the entropy of the concept prediction, so OOD samples fall back to clean global embeddings. The authors show, on complete and concept-incomplete tasks, that MixCEM keeps task and concept accuracy competitive while making interventions improve accuracy for both in-distribution and OOD samples. A sympathetic reader would care because concept interventions are the main practical mechanism for humans to steer an interpretable model at test time, and existing bypass models silently break that mechanism under shift.","feed_headline":"Entropy gating stops concept-intervention failure on shifted data","feed_subtitle":"MixCEM keeps human concept corrections effective by dropping leaked information when predictions are uncertain.","key_machinery":"The load-bearing object is the entropy-gated contextual concept embedding, defined as $c_i^{(\\pm)} = \\bar c_i^{(\\pm)} + (1-H(\\hat p_i)) r_i^{(\\pm)}(x)$, where $\\bar c_i^{(\\pm)}$ are learnable global embeddings for concept $i$ active or inactive, $r_i^{(\\pm)}(x)$ are sample-specific residuals produced from the backbone, and $H(\\hat p_i)$ is the entropy of the predicted concept probability. Gating turns uncertainty into a switch: confident in-distribution concepts keep the residual and therefore preserve completeness-agnosticism, while uncertain OOD concepts drop it and therefore avoid leakage poisoning. The training objective reinforces this by adding the prior-error term $L_{task}(y, f(\\bar c))$, so predictions from the global embeddings alone are accurate.","core_discovery":"On the paper's own terms, the central discovery is a previously unnamed failure mode and a mechanism that avoids it. Bypass-based concept models achieve completeness-agnosticism by leaking input information around the concept bottleneck; under distribution shift, that leaked information is no longer in-distribution, so even after all concepts are corrected the bottleneck remains OOD and intervention accuracy collapses. MixCEM avoids this by decomposing each concept embedding into a global, sample-agnostic part and a residual, sample-specific part, and forming the bottleneck as $\\hat c_i = \\hat p_i c_i^{(+)} + (1-\\hat p_i)c_i^{(-)}$ with $c_i^{(\\pm)} = \\bar c_i^{(\\pm)} + (1 - H(\\hat p_i)) r_i^{(\\pm)}(x)$. Because $H(\\hat p_i)$ is higher for OOD concept predictions after Platt calibration, the residual contribution vanishes on OOD inputs and the bottleneck reduces to global embeddings, which remain within the training distribution and make interventions effective. The paper also adds a prior-error training term that forces the global embeddings alone to predict the task well, which acts as an implicit intervention-aware regularizer.","pith_inferences":["The entropy gate is effectively a built-in OOD detector; replacing $1-H(\\hat p_i)$ with a dedicated OOD score such as an energy score or feature distance should block leakage similarly, at the cost of training an extra detector.","Because MixCEM's global embeddings are constant across samples, the model is biased toward concept-only prediction, which likely explains its spurious-correlation robustness and suggests the decomposition could be used as a regularizer in non-conceptual architectures.","A testable extension is to apply the same global-plus-gated-residual split to energy-based concept models and other embedding-based bottlenecks, generalizing the mechanism beyond the architectures tested here.","The reported gains depend on entropy staying calibrated under shift; on shifts that produce confident wrong concept predictions, the gate would stay open and leakage poisoning would return unless a stronger OOD indicator is added."],"forward_implications":["If leakage poisoning is real, every current bypass-based concept model deployed under distribution shift can fail to benefit from, or even be harmed by, human concept corrections; MixCEM-style gating is needed for trustworthy interventions.","MixCEM is the only completeness-agnostic baseline whose OOD intervention curves stay at or above the Bayes-classifier lower bound across most tasks, so concept-incomplete models can remain safely intervenable under shift.","Entropy-gated residuals let the same model be complete-agnostic on in-distribution data and safely intervenable on OOD data, dissolving the previously assumed trade-off between the two objectives.","Combining MixCEM with intervention-aware training yields learned intervention policies whose OOD curves beat random-policy baselines, suggesting the design composes with existing intervention-learning machinery."],"supporting_citations":[{"why":"defines concept bottleneck models and the concept-intervention setup that the paper evaluates.","marker":"(Koh et al., 2020)"},{"why":"introduces residual and bypass leakage in concept models, the mechanism the paper identifies as the source of leakage poisoning.","marker":"(Mahinpei et al., 2021)"},{"why":"introduces CEM dynamic concept embeddings, the main baseline and the architecture MixCEM extends.","marker":"(Espinosa Zarlenga et al., 2022)"},{"why":"introduces IntCEM intervention-aware training and the learned-policy pipeline MixCEM composes with.","marker":"(Espinosa Zarlenga et al., 2023a)"},{"why":"provides ProbCBM, a probabilistic global-embedding baseline used in comparisons.","marker":"(Kim et al., 2023)"},{"why":"provides post-hoc CBM and its residual variant, a leakage-based baseline.","marker":"(Yuksekgonul et al., 2023)"},{"why":"supplies the label-free concept annotations used to construct the CIFAR10 task.","marker":"(Oikarinen et al., 2023)"},{"why":"supplies Platt scaling used to calibrate concept probabilities so entropy can act as a trustworthy gate.","marker":"(Platt et al., 1999)"},{"why":"grounds the observation that softmax uncertainty is a useful out-of-distribution indicator.","marker":"(Hendrycks & Gimpel, 2016)"}],"fun_headline_variants":["Entropy gating stops leakage poisoning for OOD concept fixes","MixCEM's entropy gate keeps concept corrections OOD-safe","Leakage poisoning? MixCEM gates it out to save OOD interventions","Concept fixes survive shifts via MixCEM's entropy gating"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The gating mechanism assumes that, after Platt calibration, concept-prediction entropy is a reliable indicator that the input is out-of-distribution, so scaling residuals by $1-H(\\hat p_i)$ removes poisonous leakage.","fun_headline_variants_meta":{"raw":{"variants":["Entropy gating stops leakage poisoning for OOD concept fixes","MixCEM's entropy gate keeps concept corrections OOD-safe","Leakage poisoning? MixCEM gates it out to save OOD interventions","Concept fixes survive shifts via MixCEM's entropy gating"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001037,"raw_usage":{"total_tokens":4376,"prompt_tokens":972,"completion_tokens":3404,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":588,"completion_tokens_details":{"reasoning_tokens":3329}},"tokens_in":588,"tokens_out":3404,"duration_ms":21589,"temperature":1.0,"reasoning_tokens":3329,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:29:20.018033+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a trained MixCEM on an OOD shift such as 10% salt-and-pepper noise and measure the entropy of its concept predictions: if most mispredicted concepts have low entropy, the gate stays open and MixCEM's all-intervened OOD accuracy should resemble CEM's rather than stay near the Bayes classifier. Alternatively, adversarially perturb inputs to force confidently wrong concept predictions and check whether leakage poisoning returns.","supporting_citations":[],"review_version":1}