Are Classification Robustness and Explanation Robustness Really Strongly Correlated? An Analysis Through Input Loss Landscape

Technical Summary: Are Classification Robustness and Explanation Robustness Really Strongly Correlated?

Problem Statement
In the deployment of reliable machine learning systems for high-stakes domains (e.g., medical diagnostics, autonomous vehicles), it is critical that models maintain both accurate predictions under adversarial attacks (classification robustness) and consistent, interpretable rationales (explanation robustness). A prevailing assumption in the field posits a strong positive correlation between these two properties: that improving classification robustness inherently enhances explanation robustness. This paper challenges that paradigm, investigating whether the mechanisms that flatten the input loss landscape to improve classification robustness similarly apply to explanation robustness. Specifically, the authors question if a flatter input loss landscape with respect to explanation loss is a necessary condition for robust explanations, and whether the two forms of robustness are inherently linked.

Methodology
The authors employ a systematic framework combining loss landscape analysis, clustering-based evaluation, and a novel training algorithm to decouple the two robustness dimensions.

1. Loss Landscape Analysis: The study visualizes the input loss landscape with respect to explanation loss ($L_e$) by adding random noise to victim images and measuring the change in loss. This is contrasted with the well-established observation that flatter landscapes in classification loss ($L_{sc}$) correlate with higher classification robustness.
2. Cluster-Based Sampling for Evaluation: To efficiently evaluate explanation robustness without the computational infeasibility of quadratic sample pairing, the authors propose a clustering-based sampling method. Images are clustered (e.g., using K-means on ResNet18 features) to ensure semantic consistency. Evaluation sets are constructed from intra-cluster and inter-cluster pairs to measure the "attack loss" required to manipulate an explanation from a victim image to a target image.
3. TRADES Framework: The authors use the TRADES framework to generate models with varying levels of classification robustness (controlled by the parameter $\alpha$) to observe how changes in classification robustness affect explanation robustness and the associated loss landscape.
4. SEP (Separate Explanation Robustness via PGD): To explicitly test the relationship, the authors propose a new training method, SEP. This method introduces a regularization term ($L_{SEP} = \|I(x + \zeta) - I(x)\|^2$) to the training loss, where $\zeta$ is random noise and $I$ is the explanation method.
   • SEPpos ($\lambda > 0$): Guides the loss landscape to become flatter with respect to explanation loss.
   • SEPneg ($\lambda < 0$): Guides the loss landscape to become sharper.
     This allows the authors to manipulate the flatness of the explanation loss landscape independently of classification robustness.

Key Findings and Results
The experiments, conducted across multiple datasets (MNIST, FMNIST, CIFAR-10, CIFAR-100, TinyImageNet) and architectures (ConvNet, ResNet18, Wide ResNet, MobileNetV2), yield the following results:

• Decoupling of Robustness: Models trained with SEPpos and SEPneg exhibit similar classification robustness (measured by adversarial accuracy, $Acc_{adv}$) but significantly different explanation robustness (measured by final explanation attack loss, $L_{end}^e$). Specifically, SEPneg (sharper landscape) achieves higher explanation robustness, while SEPpos (flatter landscape) achieves lower explanation robustness.
• Contradiction with Classification Robustness: Contrary to the behavior of classification robustness, where a flatter loss landscape indicates better robustness, the authors find that flattening the input loss landscape for explanation loss actually decreases explanation robustness.
• Mechanism of Explanation Robustness: The analysis suggests that explanation robustness is driven not by a flat loss landscape, but by a high initial loss ($L_{start}^e$) at the beginning of an attack. Models with higher initial distances between the victim and target explanations are harder to attack, regardless of the landscape's flatness.
• Generalization: These findings hold across different explanation methods (Gradient, Guided Backpropagation, DeepLift, Integrated Gradients) and different adversarial training protocols (Madry AT, TRADES).

Key Contributions

1. Efficient Evaluation: Introduction of a clustering-based sampling method to efficiently and comprehensively evaluate explanation robustness.
2. Empirical Contradiction: Demonstration that increasing explanation robustness does not flatten the input loss landscape with respect to explanation loss, contradicting the behavior observed in classification robustness.
3. Novel Training Method (SEP): Development of a training algorithm that explicitly controls the flatness of the explanation loss landscape, proving that explanation robustness can be manipulated independently of classification robustness.
4. Theoretical Insight: Evidence that the mechanisms governing classification and explanation robustness are fundamentally different, challenging the assumption of their inherent correlation.

Significance
The paper concludes that classification robustness and explanation robustness are not strongly correlated. This finding has significant implications for the security and reliability of AI systems. It suggests that relying on classification robustness techniques (like adversarial training) to ensure trustworthy explanations is insufficient. Instead, the authors argue for the necessity of separately considering and optimizing for explanation robustness, particularly in critical applications where both predictive accuracy and interpretability are required under adversarial conditions. The work opens new pathways for understanding the relationship between loss landscapes and explanation loss, moving beyond the assumption that a single robustness metric or training strategy can guarantee both.