ABLE: Using Adversarial Pairs to Construct Local Models for Explaining Model Predictions

AI summary

Overview

Research area: Explainable AI (XAI), specifically local post-hoc explanations for black-box machine learning models, combined with adversarial machine learning on tabular data.

Technical level: Intermediate. The paper assumes familiarity with LIME-style surrogate explanations, logistic regression, decision boundaries, and standard adversarial attacks (FGSM, PGD), though it explains each of these in a background section.

Scope: The paper proposes Adversarially Bracketed Local Explanation (ABLE), a method that generates adversarial pairs straddling the local decision boundary of a test instance and trains a linear surrogate on those pairs, then evaluates fidelity, stability, and hyperparameter sensitivity against LIME, GLIME, USLIME, and CALIME on six UCI datasets and three neural network architectures.

Publication note: The paper is identified as arXiv:2511.21952v1 [cs.LG], dated 26 November 2025, with authors from the University of Texas at Arlington and the National Institute of Standards and Technology. A footnote states it is a preprint of an accepted manuscript for ACM SIGKDD (KDD 2026).

What This Paper Is About

Local explanation methods like LIME explain a single prediction by fitting a simple, interpretable model to randomly perturbed points near the test instance, but their random sampling often produces explanations that are unstable (they change with small perturbations or sampling seeds) and low-fidelity (the simple model does not track the target model's true behavior). The core problem ABLE addresses is that when a test instance lies far from the decision boundary, nearly all randomly sampled neighbors fall on one side of the boundary, so the surrogate is trained on an incomplete view of the region where predictions actually flip. The goal is to construct local models that are simultaneously more stable and more faithful by deliberately generating training points on both sides of the local decision boundary.

Key Contributions

1. A new local-explanation approach. The paper proposes ABLE, which it states is the first work to apply adversarial pairs as anchors for local model construction. For each neighborhood point D, a forward adversarial attack produces A with a different label, and a reverse attack on A produces A′ with the same label as D; the pair (A, A′) brackets the local decision boundary for x_test.

2. A model-query-only sampling strategy. Because ABLE relies only on queries to the target model and not on training data, the authors position it as advantageous versus methods such as AutoLIME and DLIME, which use training data, and CALIME, which requires a reference dataset for causal discovery.

3. A comprehensive empirical evaluation. The authors evaluate four ABLE variants (ABLE_PGD, ABLE_FGSM, ABLE_etDF, ABLE_HSJ) on six UCI datasets with three neural network architectures as target models, yielding eighteen target models, and compare against LIME, GLIME, USLIME, and CALIME using fidelity (R²), stability (Jaccard Index on top-K features), and runtime.

4. A publicly available tool. The approach is implemented in a tool the authors state is publicly accessible at the reference given as (ano, 2025).

Main Findings

• Fidelity advantage. Averaged across the 18 dataset/classifier configurations, ABLE_PGD reached an average R² of 0.906, ABLE_etDF 0.898, ABLE_FGSM 0.880, and ABLE_HSJ 0.831, compared with LIME 0.502, GLIME 0.502, USLIME 0.516, and CALIME 0.612. The paper reports that ABLE achieved the highest fidelity in 16 of the 18 configurations.

• Stability advantage. The introduction reports that ABLE approaches ranked best on stability in 12 of 18 cases, with 4 additional cases resulting in ties with the top-performing baseline. The stability table in the supplied content is truncated partway through the Car Evaluation rows, so the per-row values for the remaining entries cannot be confirmed from the available text.

• Where baselines won. In the fidelity table, two cases favored a baseline: Adult Income with TabNet (LIME 0.946 and GLIME 0.945 versus ABLE_etDF 0.874, the best ABLE variant there), and Car Evaluation with TabNet (USLIME 0.907 and ABLE_HSJ 0.853).

• Attack choice matters but the family is robust. Among ABLE variants, gradient-based PGD and etDF generally produced the strongest fidelity in the reported table, while the black-box HSJ variant, which does not require model internals, still outperformed the LIME-family baselines on average (0.831 versus 0.502, 0.502, and 0.516).

• Hyperparameter sensitivity direction. In the hyperparameter study (Table 3), fidelity increased with the number of neighborhood points and decreased with neighborhood radius. For radius r = 0.2, fidelity rose from 0.840 at n = 50 to 0.908 at n = 150; for r = 1.0, it rose from 0.827 to 0.890 over the same range.

• Target model accuracy context. Test accuracies of the target models ranged from 0.715 (TabTransformer on Car Evaluation) to 0.994 (TabNet on Mushroom), as reported in Table 2.

• Runtime. Runtime in seconds is listed as an evaluation metric ("Time"), but the corresponding timing values do not appear in the supplied paper content, so no runtime comparison is reported here.

Methodology in Plain English

ABLE builds an explanation for a single prediction in three steps.

1. Neighborhood generation. Around the test instance x_test, the method draws points by adding Gaussian noise that is rescaled so every perturbed point lies within radius r of x_test. The original test point is included in this set.

2. Adversarial pair generation. For each neighborhood point D, the method runs an adversarial attack to find a minimally perturbed point A whose predicted label differs from D's. It then runs a second, reverse attack on A to obtain A′, which returns to D's original label. A and A′ therefore sit on opposite sides of the boundary region that matters most for x_test, and together they "bracket" it. If the first attack fails, the perturbation budget is increased incrementally (for example by 0.1) until an adversarial point is found. For multiclass problems, the reverse attack is targeted at the original class so the pair does not land in a third class.

3. Local model training. The adversarial points and their labels are pooled, and a logistic regression model is fit by minimizing cross-entropy. For multiclass settings, a multinomial logistic (softmax) model replaces binary logistic regression. The fitted coefficients serve as the local feature attribution.

Evaluation setup: six UCI datasets (Credit Default, Adult Income, Breast Cancer, Mushroom, Car Evaluation, Covertype) spanning 569 to 581,012 instances and 2 to 7 classes; preprocessing with RDT HyperTransformer and StandardScaler; a 70/15/15 train/validation/test split. Three target architectures per dataset: an MLP with two ReLU hidden layers, TabNet, and TabTransformer. Adversarial pairs were generated with four attacks: PGD, FGSM, an enhanced DeepFool variant (etDF), and HopSkipJump (HSJ); PGD, FGSM, and etDF are white-box gradient-based, while HSJ is black-box and query-based. All attacks used the Adversarial Robustness Toolbox except etDF, which used the authors' official implementation.

Metrics: fidelity as the R² between local model and target model probabilities on a held-out evaluation set of neighbors; stability as the Jaccard Index between the top-K features (K = 5) from the original instance and a slightly perturbed instance; and total runtime in seconds. The procedure used 100 random test instances per dataset, with each experiment repeated over 10 random seeds and averaged. Experiments ran on a multi-core processor at 2.10 GHz with 32 GB of RAM. Hyperparameters examined were neighborhood radius r over {0.2, 0.4, 0.6, 0.8, 1.0} and number of neighborhood points n over {50, 75, 100, 150}.

Why This Matters

Impact on research. The paper reframes a known weakness of LIME-style explanations — imbalanced sampling around the decision boundary — as something that can be fixed by construction rather than by reweighting or heuristic selection. It also connects two research lines that have mostly run separately: adversarial example generation (traditionally used for vulnerability detection and robustness) and post-hoc interpretability. The result is a sampling strategy that is easy to describe, model-agnostic in the sense of requiring only prediction queries (especially in the HSJ variant), and does not require training data or a reference dataset.

Real-world applications (as motivated by the paper's high-stakes domains):

• Credit and loan decisions, where Credit Default and Adult Income serve as the benchmark proxies and applicants need to know why a decision was made.
• Medical diagnostics, represented by the Breast Cancer dataset, where clinicians need stable, faithful instance-level reasons behind a model's output.
• Hiring or other screening pipelines, where consistency of the stated reasons matters for fairness and review.
• General tabular decision systems in government and industry, where models are often deployed on structured data but remain opaque.

Industry relevance. Post-hoc explanation is frequently required for audit, regulatory review, and debugging of deployed models. Instability is a practical problem: if an explanation changes substantially when an input changes trivially, it undermines trust and complicates documentation. ABLE's higher reported fidelity and stability, plus the availability of a black-box variant, make it relevant to teams that cannot access model gradients or training data but can query a deployed model.

Future Directions

• Reducing computational cost. Each test instance requires one neighborhood sample plus two adversarial attacks per sample, and PGD, etDF, and HSJ are iterative; the paper measures runtime but this summary could not confirm comparative timing from the supplied content, leaving efficiency as an open question.

• Extending beyond tabular data. All six benchmarks are tabular UCI datasets with the RDT HyperTransformer and StandardScaler pipeline; whether the bracketing idea transfers to image, text, or graph inputs is not addressed.

• Improving the cases where baselines won. Adult Income with TabNet and Car Evaluation with TabNet favored LIME/GLIME and USLIME respectively, suggesting room to understand when adversarial-pair sampling is less effective and how to combine it with other sampling strategies.

• Broadening the surrogate class. The method always fits a linear (logistic or softmax) local model, as the authors state the approach can be viewed as general for constructing local models; substituting rule-based or tree-based surrogates remains untested here.

Target Audience

Researchers and graduate students working on explainable AI, interpretability, and trustworthy machine learning; practitioners who need to audit or explain tabular classifiers in regulated or high-stakes settings; and adversarial-machine-learning researchers interested in using attacks for purposes other than robustness testing. Readers need a working knowledge of linear models, decision boundaries, and the basic LIME framework to follow the method and metrics in detail.

Authors’ abstract

Machine learning models are increasingly used in critical applications but are mostly "black boxes" due to their lack of transparency. Local explanation approaches, such as LIME, address this issue by approximating the behavior of complex models near a test instance using simple, interpretable models. However, these approaches often suffer from instability and poor local fidelity. In this paper, we propose a novel approach called Adversarially Bracketed Local Explanation (ABLE) to address these limitations. Our approach first generates a set of neighborhood points near the test instance, x_test, by adding bounded Gaussian noise. For each neighborhood point D, we apply an adversarial attack to generate an adversarial point A with minimal perturbation that results in a different label than D. A second adversarial attack is then performed on A to generate a point A' that has the same label as D (and thus different than A). The points A and A' form an adversarial pair that brackets the local decision boundary for x_test. We then train a linear model on these adversarial pairs to approximate the local decision boundary. Experimental results on six UCI benchmark datasets across three deep neural network architectures demonstrate that our approach achieves higher stability and fidelity than the state-of-the-art.