Counterfactual Explanations on Robust Perceptual Geodesics

AI summary

Overview

Research area: Explainable AI / interpretable machine learning — specifically counterfactual explanation (CE) methods for image classifiers, combining differential geometry of deep generative models with adversarial-robustness research.

Technical level: Advanced. The paper assumes familiarity with Riemannian geometry (pullback metrics, geodesics), latent-space generative modeling (VAEs, StyleGAN2/3), and the CE-vs-adversarial-example debate.

Scope in one sentence: The paper introduces Perceptual Counterfactual Geodesics (PCG), a method that generates counterfactual explanations by tracing geodesics in a StyleGAN latent space equipped with a Riemannian metric pulled back from the feature spaces of robust vision models, and evaluates it on three vision datasets against four latent-space baselines.

What This Paper Is About

Counterfactual explanations answer "what minimal change would flip the model's prediction?" but the standard optimization formulation inherited from Wachter et al. leaves a gap: the choice of distance metric determines whether the result is a meaningful, human-understandable explanation or merely an adversarial example. In high-dimensional images, existing latent-space methods either assume flat Euclidean geometry (producing off-manifold artifacts) or use brittle, non-robust metrics (producing "on-manifold adversarial" results that fool the metric rather than crossing a semantic barrier). The goal is a geometry-aware optimization that yields smooth, semantically valid, on-manifold counterfactuals for standard (non-robust) classifiers.

Key Contributions

1. A robust perceptual Riemannian metric. PCG defines a composite ambient metric by aggregating pullbacks of the Euclidean metric from intermediate activation spaces of a pretrained robust vision model, with each layer weighted by the inverse of its activation size (w_k = 1/N_k), and pulls this back through the generator to obtain a latent-space metric that penalizes brittle directions.
2. A two-phase counterfactual geodesic algorithm. Phase 1 fixes both endpoints (the input's latent code and a target-class exemplar's latent code) and minimizes discrete robust perceptual energy over intermediate points; Phase 2 releases the endpoint and jointly optimizes energy plus a classification loss, using a coarse-to-fine schedule with a small initial λ that increases over time and periodic re-anchoring steps.
3. Evidence that robust latent geometry yields smooth, semantically coherent interpolation. The paper contrasts four latent geometries (Euclidean Z-linear, pixel-MSE pullback, standard ResNet-50 feature pullback, and the proposed robust ResNet-50 pullback) on StyleGAN2 paths.
4. A robustified evaluation protocol. The paper argues standard FID, LPIPS, and pixel distances can be overly optimistic in adversarially vulnerable regimes, and adds robust variants (R-FID, R-LPIPS) plus proposed diagnostics — Semantic Margin (SM) and Manifold Alignment Score (MAS) — alongside a representation-based COUT following Khorram and Fuxin (2022).

Main Findings

• Interpolation quality depends on the metric. Euclidean latent interpolation produced off-manifold artifacts such as class ambiguity, unnatural warping, and deformed textures; pixel-MSE pullback produced brittle, semantically incoherent transitions with midway blends of disparate attributes; a standard ResNet-50 feature pullback improved semantics but left fading, illumination shifts, and class discontinuities. The robust ResNet-50 pullback produced smooth, on-manifold trajectories with consistent semantics. Similar failure modes to the non-robust case were reported in Laine (2018) using VGG-19.
• PCG attains the lowest geometry-aware distances. Under ℒ_F and ℒ_R, and under ℒ_1, PCG scored lowest on all three datasets in Table 1; the margin was largest under ℒ_R, which the authors describe as the more faithful evaluation metric.
• Headline distance numbers (AFHQ, StyleGAN2). PCG: ℒ_1 0.79 ± 0.07, ℒ_2 1.14 ± 0.10, ℒ_F 0.53 ± 0.06, ℒ_R 0.31 ± 0.02. RSGD: 0.85 ± 0.08, 1.32 ± 0.09, 0.70 ± 0.07, 1.85 ± 0.05. RSGD-C: 0.93 ± 0.10, 1.45 ± 0.17, 0.65 ± 0.08, 1.75 ± 0.06. VSGD: 1.31 ± 0.11, 1.49 ± 0.15, 1.60 ± 0.09, 2.90 ± 0.08. REVISE: 1.20 ± 0.12, 0.73 ± 0.18, 1.08 ± 0.10, 2.70 ± 0.05 — the only baseline beating PCG on any column on AFHQ is REVISE on ℒ_2.
• FFHQ and PlantVillage results. PCG: FFHQ ℒ_1 0.42 ± 0.03, ℒ_2 0.72 ± 0.09, ℒ_F 0.39 ± 0.05, ℒ_R 0.22 ± 0.06; PlantVillage ℒ_1 0.36 ± 0.03, ℒ_2 0.56 ± 0.05, ℒ_F 0.34 ± 0.04, ℒ_R 0.20 ± 0.05. The strongest baseline on ℒ_R was RSGD-C at 2.11 ± 0.04 (FFHQ) and 2.03 ± 0.06 (PlantVillage).
• Explanandum-based metrics (AFHQ, StyleGAN2). PCG: FID 8.3, R-FID 9.1, LPIPS 0.24, R-LPIPS 0.17, COUT 0.43, mean SM 0.74, MAS 0.65 (pixel) / 0.87 (standard) / 0.91 (robust), flip rate 95%. RSGD-C: FID 12.7, R-FID 28.3, LPIPS 0.59, R-LPIPS 0.53, COUT 0.25, mean SM 0.05, MAS 0.68 / 0.84 / 0.47, flip rate 94%. RSGD: FID 12.9, R-FID 37.8, LPIPS 0.61, R-LPIPS 0.68, COUT 0.13, mean SM 0.03, MAS 0.82 / 0.45 / 0.21, flip 96%. VSGD: FID 23.5, R-FID 46.7, LPIPS 0.93, R-LPIPS 0.79, COUT 0.10, mean SM -0.14, MAS 0.17 / 0.21 / 0.19, flip 92%. REVISE: FID 18.5, R-FID 50.1, LPIPS 0.85, R-LPIPS 0.67, COUT 0.09, mean SM -0.48, MAS 0.21 / 0.18 / 0.14, flip 98% (the highest flip rate in the table).
• Baselines collapse into adversarial examples. The paper reports that RSGD and RSGD-C frequently produced on-manifold adversarial examples (rows 1, 2, 4, 5, 6 of the qualitative figure), VSGD produced off-manifold perturbations with perceptually implausible artifacts (class ambiguity, disoriented eye alignment, elongated faces, a cusp-like protrusion on a leaf), and all REVISE outputs in the figure were off-manifold adversarial examples driven by the pixel-wise penalty.
• Robust metrics expose failures hidden by standard ones. Standard FID alone is described as insensitive to adversarial artifacts; the PCG-vs-baseline gap widened under R-FID (9.1 vs 28.3 for the next-best RSGD-C), and only PCG showed a positive mean SM (0.74), indicating counterfactuals landed in regions genuinely populated by target-class data.
• Negative margins for non-geometric baselines. REVISE and VSGD had negative mean SM values (-0.48 and -0.14), meaning their counterfactuals frequently remained in mixed or non-target neighborhoods.

Methodology in Plain English

A generator like StyleGAN maps a low-dimensional latent code to an image, and the way it warps the latent space means ordinary straight-line distances there do not correspond to how different images actually look. PCG fixes this by defining "distance" through the eyes of a robust image model — one trained to resist adversarial perturbations. The reasoning: robust models have intermediate features that line up with human perceptual similarity, so ordinary Euclidean distance in those feature spaces is a meaningful proxy, unlike distance in raw pixels or in the features of a standard, non-robust classifier.

Concretely, the method builds a metric by summing, over several intermediate layers of a robust model, the squared sensitivity of that layer's activations to input changes, weighting each layer by one over its activation count so no layer dominates. This is pulled back through the generator to get a latent-space metric. Counterfactuals are then produced as paths, not single points: the path is discretized into T+1 latent waypoints, starting at the input and initialized at a target-class exemplar. Phase 1 keeps both ends fixed and adjusts the interior waypoints to minimize the total "perceptual energy," yielding a geodesic. Phase 2 lets the endpoint move and adds a classification loss with a small λ that grows over the run, so geometry dominates early and label satisfaction dominates later. Periodically, the method scans the path for the point already classified as the target class that is closest to the original input under the induced metric, promotes it to the new endpoint, and reinserts midpoints to keep the waypoint count constant — progressively pulling the counterfactual toward the input while keeping the target label.

Evaluation uses three datasets — AFHQ, FFHQ (70,000 human face images), and PlantVillage — with StyleGAN2 generators trained from scratch on AFHQ and PlantVillage (≈140 NVIDIA H100 GPU-hours per model), a pretrained StyleGAN3 for AFHQ, pretrained StyleGAN2 and StyleGAN3 for FFHQ, image-to-latent encoders fine-tuned jointly with the generator, and VGG-19-based binary classifiers (one per AFHQ class pair and a healthy-vs-unhealthy classifier for PlantVillage; CelebA-trained attribute classifiers applied to FFHQ, which lacks labels). Baselines are REVISE, VSGD, and RSGD/-C. Distances are computed with independent models never used in optimization: ℒ_F from a standard VGG-16 and ℒ_R from a robustly trained Inception-V3 (Alfarra et al., 2022a) separate from the robust ResNet-50 defining the metric. Two passages in the paper describe ℒ_F differently — the Table 1 caption says a pullback from standard VGG-16, while one paragraph in the evaluation section calls it a pullback from standard ResNet-50 features.

Why This Matters

Impact on research. The paper reframes the CE-versus-adversarial-example distinction as a geometry problem rather than a definitional one. It takes a position against Browne and Swift (2020) — who argued that neither distance metrics nor "possible worlds" reasoning resolves the distinction — by showing that a semantically robust Riemannian metric, plus guided optimization, can cross the semantic divide. It also argues that standard FID and LPIPS can paint an overly optimistic picture of counterfactual quality, and that robustified metrics reveal failures that the standard ones hide.

Real-world applications implied by the setup:

• Medical and diagnostic imaging, where a counterfactual that lands in an adversarial region would give clinicians a misleading explanation of what would change a diagnosis.
• Agricultural disease screening, corresponding to the PlantVillage healthy-vs-unhealthy plant leaf experiments.
• Face and attribute-based decision systems, such as explaining what changes an attribute classifier's output on FFHQ-style images (for example, what makes a face classified as blonde versus non-blonde).
• Regulatory and audit workflows for automated vision systems, where explanations must be both minimal and genuinely semantic to be defensible.

Industry relevance. Any deployment of vision models in regulated or safety-adjacent settings needs explanations that are not adversarial decoys. The paper's secondary claim — that robust feature geometry should be the basis of both generation and evaluation — has direct implications for how teams benchmark explanation tools, since a tool scoring well on pixel-level ℓ_2 or standard FID may be producing nothing more than an adversarial example.

Future Directions

1. Broadening beyond binary and attribute classifiers. The main experiments use VGG-19 binary classifiers (one per AFHQ class pair), a healthy-vs-unhealthy classifier, and CelebA attribute classifiers; the paper defers extended multiclass comparisons and comparisons against counterfactuals from robust models to its appendix.
2. Characterizing the reported scaling behavior. The paper references appendix results on smoothness of the counterfactual geodesics, scaling with respect to image resolution and path length, and runtime complexity, but these are not reported in the main text provided.
3. Sensitivity to design choices. How much does PCG depend on which robust backbone is chosen and how layers are aggregated? The paper refers to an appendix ablation on the robust backbone and layer-aggregation scheme, plus a λ ablation, without stating outcomes in the main text.
4. Resolving the metric description and generalizing the geometry. The ℒ_F description differs between the table caption (standard VGG-16) and one evaluation paragraph (standard ResNet-50), and the framework depends on the availability of a robust pretrained model; whether the approach transfers to domains without one is not reported.

Target Audience

Researchers and graduate students working on explainable AI, counterfactual explanations, and the geometry of generative models; adversarial-robustness researchers interested in how robust features change the CE/AE boundary; and practitioners building explanation tooling for high-dimensional vision systems who need to know why pixel-distance and standard-FID benchmarks can be misleading. The paper is not beginner-friendly: it assumes fluency in Riemannian geometry, pullback metrics, and GAN latent-space optimization.

Authors’ abstract

Latent-space optimization methods for counterfactual explanations - framed as minimal semantic perturbations that change model predictions - inherit the ambiguity of Wachter et al.'s objective: the choice of distance metric dictates whether perturbations are meaningful or adversarial. Existing approaches adopt flat or misaligned geometries, leading to off-manifold artifacts, semantic drift, or adversarial collapse. We introduce Perceptual Counterfactual Geodesics (PCG), a method that constructs counterfactuals by tracing geodesics under a perceptually Riemannian metric induced from robust vision features. This geometry aligns with human perception and penalizes brittle directions, enabling smooth, on-manifold, semantically valid transitions. Experiments on three vision datasets show that PCG outperforms baselines and reveals failure modes hidden under standard metrics.