Decomposition of Evidence, Contradiction, and Fragility in Perturbation Responses

# Decomposition of Evidence, Contradiction, and Fragility in Perturbation Responses
Source: [https://arxiv.org/html/2608.12935](https://arxiv.org/html/2608.12935)
###### Abstract

Perturbation methods explain model decisions by measuring prediction changes under altered inputs, but response magnitude tells us only how much a model reacts, not what that reaction means\. The same magnitude can support the final factual–counterfactual difference, oppose it, or arise strongly along the perturbation path yet vanish at the endpoint\. We therefore track how the contrast develops as paired inputs are progressively revealed, using the final contrast to interpret the trajectory\. We introduce*DECAF\(Decomposition ofEvidence,Contradiction,AndFragility\)*, which routes aligned, opposed, and endpoint\-null responses into evidenceEE, contradictionCC, and fragilityFF\. The decomposition preserves ordinary magnitude exactly,Abs=E\+C\+F\\mathrm\{Abs\}=E\+C\+F, and is unique under endpoint\-relative axioms\. Across controlled vision and tabular settings, the three components track independently measured behavior\. In a 72\-model ImageNet\-9 audit, we compare cases with nearly identical response magnitude but different independently measured behaviors\. The largestDECAFcomponent agrees with an observed behavior in 96\.4% of cases, compared with 35\.0% for magnitude alone\. Changing only the reveal path increases total response by nearly 80%, yet evidence barely changes while fragility grows by more than4×4\\times\. On FunnyBirds and ImageNet\-1k, short forward\-onlyDECAFtrajectories outperform the tested general\-purpose attribution baselines\. On a 1B\-scale DINOv2 model, a short trajectory matches a strong gradient\-based baseline with4\.75×4\.75\\timeslower wall time and2\.36×2\.36\\timeslower peak memory\. Code:[https://github\.com/youlei202/decaf](https://github.com/youlei202/decaf)

## 1Introduction

Post\-hoc explanation asks what aspects of an input matter to a model’s prediction\. A natural way to answer this question is contrastively: compare the prediction with what would happen if a feature, region, concept, or context were changed\. Perturbation\-based and counterfactual methods instantiate this comparison by constructing alternative inputs and measuring the resulting change in model output\([13](https://arxiv.org/html/2608.12935#bib.bib9);[10](https://arxiv.org/html/2608.12935#bib.bib41);[19](https://arxiv.org/html/2608.12935#bib.bib14);[8](https://arxiv.org/html/2608.12935#bib.bib42)\)\. This has the basic form of an effect measurement: change a factor, compare two responses, and summarize the difference\. In practice, that response is often reduced to a scalar magnitude\.

A magnitude answers an important question:*how much did the model react?*It leaves a second question open:*what did the reaction mean?*Consider an input and a paired counterfactual that changes one factor\. Their prediction difference measures how strongly the model responds to that change\. This endpoint comparison, however, shows only the net effect after inputs are fully observed\. It does not show how the contrast emerges as information becomes available\. We therefore consider a paired reveal: the paired inputs are progressively revealed along matched trajectories, so that their prediction difference can be observed at the same level of revealed information\.

As the pair is revealed from an uninformative state, the contrast can evolve in different ways\. It may align with the final effect, oppose it, or become large even when the fully observed pair differs little\. These distinct behaviors can have identical absolute responses\. Treating these responses as equivalent therefore hides behavior that matters for interpretation\.

We introduceDECAFin Figure[1](https://arxiv.org/html/2608.12935#S1.F1), short for*Decomposition ofEvidence,Contradiction,AndFragility*\.DECAFresolves this ambiguity by using the final response between the fully observed pair as a semantic reference for the entire reveal process\. Its magnitude determines whether the factor has a meaningful final effect, while its sign provides the reference direction\. Intermediate responses that agree with this direction are routed to*evidence*, while responses that oppose it are routed to*contradiction*\. If the fully observed pair shows little response, there is no meaningful final effect to align with, and intermediate responses are routed to*fragility*\. We call this*semantic routing*: the observed responses are assigned different roles according to their relation to the final contrast, without changing the trajectories themselves\. The routing is lossless, so evidence, contradiction, and fragility sum exactly to the ordinary response magnitude\.DECAFis model\-agnostic, therefore explaining any black\-box model that returns a scalar score\.

Figure 1:DECAFat a glance\.The paired reveal measures a signed stage response, while the clean endpoint supplies an activity gate and orientation\.DECAFroutes the same response into endpoint\-aligned evidence, endpoint\-opposed contradiction, or endpoint\-null fragility, with exact conservation\. The compact summary reports the two headline consequences: mechanism recovery after ordinary magnitude is matched, and substantially more stable cross\-protocol diagnostics\.Relation to prior work\.Gradient and path methods assign contributions to input coordinates or internal units\([37](https://arxiv.org/html/2608.12935#bib.bib27);[35](https://arxiv.org/html/2608.12935#bib.bib25);[42](https://arxiv.org/html/2608.12935#bib.bib31);[36](https://arxiv.org/html/2608.12935#bib.bib26);[2](https://arxiv.org/html/2608.12935#bib.bib3)\)\. Removal and sampling methods measure prediction changes under masking or replacement\([13](https://arxiv.org/html/2608.12935#bib.bib9);[14](https://arxiv.org/html/2608.12935#bib.bib10);[32](https://arxiv.org/html/2608.12935#bib.bib22);[9](https://arxiv.org/html/2608.12935#bib.bib7)\)\. Counterfactual and causal approaches define meaningful contrasts\([19](https://arxiv.org/html/2608.12935#bib.bib14);[7](https://arxiv.org/html/2608.12935#bib.bib6);[24](https://arxiv.org/html/2608.12935#bib.bib17)\)\. Evaluation work shows that baselines, removal operators, and off\-manifold inputs can alter explanation behavior\([1](https://arxiv.org/html/2608.12935#bib.bib2);[23](https://arxiv.org/html/2608.12935#bib.bib16);[34](https://arxiv.org/html/2608.12935#bib.bib24);[25](https://arxiv.org/html/2608.12935#bib.bib38)\)\.DECAFbegins after a paired response has been measured\. It refines the response by its relation to the clean endpoint\. Unlike positive–negative feature attribution, it also contains an endpoint\-null branch\. Unlike amortized explainers such as FastSHAP, it requires no learned explanation model\([26](https://arxiv.org/html/2608.12935#bib.bib37)\)\. A detailed comparison with feature attribution, counterfactual explanation, evaluation frameworks, and efficient black\-box methods appears in Appendix[A](https://arxiv.org/html/2608.12935#A1)\.

We make five contributions:

- •*Problem\.*We identify a semantic gap in perturbation explanation: response magnitude tells us how strongly a model reacts, but not what that reaction means\.
- •*Observation interface\.*We introduce paired reveal, which tracks a factual–counterfactual contrast along matched trajectories as information becomes available\.
- •*Algorithm\.*We introduceDECAF, which uses the final contrast to route intermediate responses into evidence, contradiction, and fragility\. The decomposition is lossless and unique under simple axioms, and adds no model queries beyond the paired trajectories\.
- •*Behavioral meaning\.*Controlled vision and tabular experiments show that the three components track learned reliance, effect reversal, and fragility across neural, linear, and tree\-based models\.
- •*Practical consequence\.*On ImageNet\-9,DECAFrecovers response semantics after magnitude is matched and diagnoses what changes across perturbation paths\. It also outperforms the tested general\-purpose attribution baselines on FunnyBirds and ImageNet\-1k and scales efficiently to a large DINOv2 vision transformer\.

## 2Paired Information Revealing: Formal Setup

We formalize paired information revealing\. Letq:𝒳→ℝq:\\mathcal\{X\}\\rightarrow\\mathbb\{R\}denote the model score\. An input𝐱\+\\mathbf\{x\}^\{\+\}and a factor\-level counterfactual𝐱−\\mathbf\{x\}^\{\-\}define the final contrast

d=q⁡\(𝐱\+\)−q⁡\(𝐱−\)\.d=q\(\\mathbf\{x\}^\{\+\}\)\-q\(\\mathbf\{x\}^\{\-\}\)\.The pair need not be pre\-specified: in feature attribution,𝐱−\\mathbf\{x\}^\{\-\}can be induced from𝐱\+\\mathbf\{x\}^\{\+\}by a removal or replacement operator\.

A paired reveal starts from a common uninformative state𝐱0\\mathbf\{x\}\_\{0\}and produces matched trajectories\(𝐱\+​\(t\),𝐱−​\(t\)\)\(\\mathbf\{x\}^\{\+\}\(t\),\\mathbf\{x\}^\{\-\}\(t\)\)fort∈𝒯=\[0,1\]t\\in\\mathcal\{T\}=\[0,1\], with

𝐱\+​\(0\)=𝐱−​\(0\)=𝐱0,𝐱\+​\(1\)=𝐱\+,𝐱−​\(1\)=𝐱−\.\\mathbf\{x\}^\{\+\}\(0\)=\\mathbf\{x\}^\{\-\}\(0\)=\\mathbf\{x\}\_\{0\},\\qquad\\mathbf\{x\}^\{\+\}\(1\)=\\mathbf\{x\}^\{\+\},\\qquad\\mathbf\{x\}^\{\-\}\(1\)=\\mathbf\{x\}^\{\-\}\.
The signed response isr⁡\(t\)=q⁡\(𝐱\+​\(t\)\)−q⁡\(𝐱−​\(t\)\)r\(t\)=q\(\\mathbf\{x\}^\{\+\}\(t\)\)\-q\(\\mathbf\{x\}^\{\-\}\(t\)\), withd=r⁡\(1\)d=r\(1\)\. Ordinary magnitude\|r⁡\(t\)\|\|r\(t\)\|preserves size but discards its relation to the final contrast; Section[3](https://arxiv.org/html/2608.12935#S3)uses it to assign semantic roles\.

## 3DECAF: A Semantic Decomposition of Paired Responses

Section[2](https://arxiv.org/html/2608.12935#S2)gives us two quantities: the responser⁡\(t\)r\(t\)at each reveal level and the final contrastd=r⁡\(1\)d=r\(1\)\.DECAFuses the final contrast only as a semantic reference for interpreting the intermediate responses\. If the final contrast is substantial, its direction tells us which responses agree with the model’s eventual behavior and which oppose it\. If the final contrast is negligible, intermediate responses cannot be interpreted as supporting or opposing a meaningful final effect\.

Choose a practical thresholdϵ\>0\\epsilon\>0and define

a=𝟏\{\|d\|≥ϵ\},s=sign\(d\)\.a=\\mathbf\{1\}\\\{\|d\|\\geq\\epsilon\\\},\\qquad s=\\operatorname\{sign\}\(d\)\.The gateaadetermines whether the final contrast is active, whilessorients the trajectory when it is active\. Let

z⁡\(t\)=s​r​\(t\),z\(t\)=s\\,r\(t\),and writez\+=max⁡\{z,0\}z^\{\+\}=\\max\\\{z,0\\\}andz−=max⁡\{−z,0\}z^\{\-\}=\\max\\\{\-z,0\\\}\. DECAF routes the response as

\(e⁡\(t\),c⁡\(t\),f⁡\(t\)\)=\(a​z\+​\(t\),a​z−​\(t\),\(1−a\)​\|r⁡\(t\)\|\)\.\(e\(t\),c\(t\),f\(t\)\)=\\bigl\(az^\{\+\}\(t\),\\,az^\{\-\}\(t\),\\,\(1\-a\)\|r\(t\)\|\\bigr\)\.
An active response aligned with the final contrast becomes*evidence*; an active response pointing in the opposite direction becomes*contradiction*; and a response on a final\-contrast\-null pair becomes*fragility*\. This logic is illustrated earlier in Figure[1](https://arxiv.org/html/2608.12935#S1.F1)\.

Letμ\\mube a normalized measure over stages and let the outer expectation cover paired examples and protocol randomness\. We report

M=𝔼​\|d\|,\(E,C,F\)=𝔼​∫𝒯\(e⁡\(t\),c⁡\(t\),f⁡\(t\)\)​𝑑μ​\(t\),Abs=E\+C\+F\.M=\\mathbb\{E\}\|d\|,\\qquad\(E,C,F\)=\\mathbb\{E\}\\\!\\int\_\{\\mathcal\{T\}\}\(e\(t\),c\(t\),f\(t\)\)\\,\\mathrm\{d\}\\mu\(t\),\\qquad\\mathrm\{Abs\}=E\+C\+F\.\(1\)The finite\-grid implementation replaces the integral by quadrature\. No additional model query is needed once the signed paired trajectory is available\. See Appendices[B](https://arxiv.org/html/2608.12935#A2)and[C](https://arxiv.org/html/2608.12935#A3)for finite\-grid estimation, conditional summaries, threshold sensitivity, and streaming accumulation\.

Forward\-only implementation\.The model enters only through evaluations ofqq\.DECAFneeds no gradients, parameters, or internal activations\. It can run against a neural network, a tree ensemble, or a remote score API\. Examples, stages, factors, paths, and models are independent batching dimensions\.

Algorithm 1DECAF in four steps\.1:scoreqq, paired path\(𝐱\+​\(t\),𝐱−​\(t\)\)\(\\mathbf\{x\}^\{\+\}\(t\),\\mathbf\{x\}^\{\-\}\(t\)\),ε\\varepsilon2:d←q⁡\(𝐱\+\)−q⁡\(𝐱−\)d\\leftarrow q\(\\mathbf\{x\}^\{\+\}\)\-q\(\\mathbf\{x\}^\{\-\}\);a←𝟏\{\|d\|≥ε\}a\\leftarrow\\mathbf\{1\}\\\{\|d\|\\geq\\varepsilon\\\};s←sign⁡\(d\)s\\leftarrow\\operatorname\{sign\}\(d\)3:for allt∈𝒯t\\in\\mathcal\{T\}do⊳\\trianglerightr⁡\(t=1\)=dr\(t=1\)=dis cached and reused4:r⁡\(t\)←q⁡\(𝐱\+​\(t\)\)−q⁡\(𝐱−​\(t\)\)r\(t\)\\leftarrow q\(\\mathbf\{x\}^\{\+\}\(t\)\)\-q\(\\mathbf\{x\}^\{\-\}\(t\)\)5:\(e,c,f\)←\(a​\(s​r\)\+,a​\(s​r\)−,\(1−a\)​\|r\|\)\(e,c,f\)\\leftarrow\\bigl\(a\(sr\)^\{\+\},a\(sr\)^\{\-\},\(1\-a\)\|r\|\\bigr\)6:endfor7:returnM,E,C,FM,E,C,Fby averaging over stages and examples

MethodFwd\.Bwd\.InternalLearnedDECAF\-9180NoNoInput×\\timesGrad11YesNoIG1616YesNoSmoothGrad1616YesNoBlurIG1212YesNoOcclusion490NoNoRISE2560NoNo

Table 1:Model calls per image in ImageNet\-9\.Scope of the semantics\.DECAFassigns observable, endpoint\-relative roles to paired responses; it does not infer the latent cause of a trajectory response\. These response roles are defined relative to the scoreqq, the chosen factual–counterfactual pair, the reveal trajectory, and the practical thresholdϵ\\epsilon\. In particular,*fragility*denotes response on a pair whose final contrast is negligible under this specification\. It does not by itself distinguish off\-manifold artifacts, boundary uncertainty, calibration effects, or other possible causes\. An active pair may still be path\-sensitive, but its response is described through aligned and opposed mass rather thanFF\.

## 4Theoretical Foundations of Semantic Routing

Section[3](https://arxiv.org/html/2608.12935#S3)defines a simple routing rule from a stage responser⁡\(t\)r\(t\)and final contrastddto evidence, contradiction, and fragility\. We first ask whether this routing is arbitrary\.

To formalize this routing, we establish three operational axioms that reflect practical explanation goals\. First,*conservation*ensures that no response magnitude is lost or invented\. Second,*endpoint gating*isolates sensitivity on pairs whose final contrast is negligible under the chosen threshold\. Third,*directional support*distinguishes intermediate responses that move toward the model’s final decision from those that oppose it\.

###### Theorem 1\(Unique hard\-gated semantic routing\)\.

Fixa∈\{0,1\}a\\in\\\{0,1\\\}, endpoint orientations∈\{−1,1\}s\\in\\\{\-1,1\\\}on the active branch, and responser∈ℝr\\in\\mathbb\{R\}\. The unique nonnegative triple satisfyingconservation,e\+c\+f=\|r\|e\+c\+f=\|r\|;endpoint gating,f=0f=0fora=1a=1ande=c=0e=c=0fora=0a=0; anddirectional support,c=0c=0whens​r≥0sr\\geq 0ande=0e=0whens​r≤0sr\\leq 0, is

\(e,c,f\)=\(a​\(s​r\)\+,a​\(s​r\)−,\(1−a\)​\|r\|\)\.\(e,c,f\)=\\bigl\(a\(sr\)^\{\+\},\\;a\(sr\)^\{\-\},\\;\(1\-a\)\|r\|\\bigr\)\.

Theorem[1](https://arxiv.org/html/2608.12935#Thmtheorem1)removes tunable mixtures once the endpoint gate and orientation are specified\. It establishes uniqueness within the stated endpoint\-relative semantics, not uniqueness of hard endpoint gating itself\. Under these operational axioms, the routing is uniquely determined\.*See Appendix[B](https://arxiv.org/html/2608.12935#A2)for the proof and the positive–negative \(Jordan\) decomposition interpretation\.*

Theorem[1](https://arxiv.org/html/2608.12935#Thmtheorem1)shows that the routing is unique once the endpoint\-relative semantics are fixed\. We next ask whether retaining the three routed components provides information beyond ordinary magnitude\.

###### Theorem 2\(DECAFstrictly refines response magnitude\)\.

Ordinary response magnitude is a deterministic function of theDECAFprofile,

Abs=E\+C\+F,\\mathrm\{Abs\}=E\+C\+F,so every decision rule based onAbs\\mathrm\{Abs\}can also be implemented from\(E,C,F\)\(E,C,F\)\. The reverse recovery fails in general: for everym\>0m\>0, the distinct profiles\(m,0,0\)\(m,0,0\),\(0,m,0\)\(0,m,0\), and\(0,0,m\)\(0,0,m\)all produceAbs=m\\mathrm\{Abs\}=m\. Hence the refinement is strict for any decision problem that distinguishes two such profiles with positive probability\.

ThusDECAFis a lossless refinement of ordinary magnitude: any analysis based onAbs\\mathrm\{Abs\}can be reproduced from\(E,C,F\)\(E,C,F\), while the reverse recovery is impossible in general\. The refinement is strict whenever a decision problem distinguishes response profiles that share the same magnitude\. For example, if evidence, contradiction, and fragility are equally likely and all produce magnitudemm, every magnitude\-only classifier receives the same observation and cannot exceed1/31/3accuracy, whereas the full profile distinguishes the three roles\. Section[6](https://arxiv.org/html/2608.12935#S6)tests this consequence empirically after explicitly matching ordinary response magnitude\. See Appendix[B](https://arxiv.org/html/2608.12935#A2)for the Bayes limit, strict information refinement, and unequal priors\.

Theorem[2](https://arxiv.org/html/2608.12935#Thmtheorem2)shows that magnitude can collapse distinct response roles\. A practically important case is the difference between an effect that disappears and one that reverses\. Both can reduce aligned evidence, but only reversal should create contradiction\.

Suppose the final contrast is active with magnitudem\>0m\>0\. Letη∈\[0,1\]\\eta\\in\[0,1\]denote the probability that this effect is altered by context\. With probability1−η1\-\\eta, the response remains aligned with magnitudemm; with probabilityη\\eta, it is either suppressed to zero \(attenuation\) or reversed to−m\-m\(inversion\)\. We consider three simple response regimes:*preservation*, where the effect keeps its direction;*attenuation*, where it weakens toward zero; and*inversion*, where it reverses direction\.

###### Proposition 1\(Contradiction separates attenuation from inversion\)\.

Under equal aligned and opposed magnitudes,

RegimeECAbsPreservationm0mAttenuation to zero\(1−η\)​m0\(1−η\)​mInversion\(1−η\)​mη​mm\{\\begin\{array\}\[\]\{lccc\}\\hline\\cr\\hline\\cr\\text\{Regime\}&E&C&\\mathrm\{Abs\}\\\\ \\hline\\cr\\text\{Preservation\}&m&0&m\\\\ \\text\{Attenuation to zero\}&\(1\-\\eta\)m&0&\(1\-\\eta\)m\\\\ \\text\{Inversion\}&\(1\-\\eta\)m&\\eta m&m\\\\ \\hline\\cr\\hline\\cr\\end\{array\}\}In the inversion regime,C/\(E\+C\)=ηC/\(E\+C\)=\\eta\.

Attenuation and inversion can remove the same amount of aligned evidence, but only inversion creates contradiction\. Thus C distinguishes loss of an effect from reversal of that effect\. The controlled experiment in Section[5](https://arxiv.org/html/2608.12935#S5)\.*See Appendix[B](https://arxiv.org/html/2608.12935#A2)for the proof, unequal magnitudes, and continuous mixtures\.*

When contradiction and fragility vanish, conservation givesAbs=E\\text\{Abs\}=E\. Thus DECAF reduces exactly to ordinary magnitude when the response is already fully aligned; it introduces additional distinctions only when the observed behavior contains them\.

## 5Behavioral Validation Across Models and Modalities

The preceding theory defines endpoint\-relative response roles\. We now test whether these roles correspond to model behavior measured independently ofDECAF\. We begin with the 3D Shapes dataset, whose generative factors can be changed one at a time while the remaining factors are held fixed\([5](https://arxiv.org/html/2608.12935#bib.bib4)\)\. This gives exact factual–counterfactual pairs and lets us formulate three controlled learning problems in which reliance, off\-path sensitivity, and effect reversal can be measured independently ofDECAF\. Across the controlled suite, we use*ResNet\-18*and a small*ViT*\. The base grid contains*30 trained models*and*180 model–factor units*, with additional dedicated checkpoints and training variants for the three behavioral tests\. ComparingDECAF’s decomposition with these independent behavioral measurements then tests whether each component carries the intended response semantics\.

\(a\)Population\-level reliance\.\(b\)Within\-model transition\.\(c\)Endpoint\-null sensitivity\.\(d\)Label\-level reversal\.
Figure 2:The three response roles track independently measured model behavior\.\(a–b\) Evidence follows shortcut reliance across checkpoints and through a within\-model strategy transition\. \(c\) Fragility follows off\-path prediction change on endpoint\-null pairs\. \(d\) Contradiction follows pairwise label reversal\. Additional intervention\-separation, architecture\-specific, and cross\-geometry diagnostics appear in Appendix[E](https://arxiv.org/html/2608.12935#A5)\.Evidence\.We train object\-shape classifiers in an environment where background wall color is correlated with the label, so models may rely on either this shortcut or the object itself\. Reversing the wall–label correlation at test time gives an independent measure of shortcut reliance: a wall\-dependent model loses accuracy, while a shape\-dependent model remains stable\. Across 52 training checkpoints, the evidence marginEwall−EshapeE\_\{\\mathrm\{wall\}\}\-E\_\{\\mathrm\{shape\}\}correlates0\.9360\.936with this reversal vulnerability, with a 90% bootstrap interval of\[0\.885,0\.961\]\[0\.885,0\.961\]\(Figure[2](https://arxiv.org/html/2608.12935#S5.F2)\(a\)\)\. Figure[2](https://arxiv.org/html/2608.12935#S5.F2)\(b\) shows the same relation during a within\-model strategy transition; complete trajectories appear in Appendix[E](https://arxiv.org/html/2608.12935#A5)\.

Fragility\.We construct models for which floor color has little effect once the image is fully revealed, but different effects before full reveal\. To create this difference, we expose models during training to partially revealed inputs while preserving the original shape task\. In*fragile training*, the model is encouraged to react to changes in floor color at these partial states\. In*robust training*, it is instead encouraged to remain unchanged, while*neutral training*uses only the original clean task without either objective\. We then measure the resulting sensitivity independently using held\-out floor\-color interventions\. IfFFcaptures endpoint\-null path sensitivity, it should track this prediction\-change rate\. It does so closely \(Figure[2](https://arxiv.org/html/2608.12935#S5.F2)\(c\)\); intervention separation and cross\-geometry checks appear in Appendix[E](https://arxiv.org/html/2608.12935#A5)\.

Contradiction\.We construct three tasks with the same object\-color effect in the original wall context but different behavior when the wall context changes\. In*Direct*, the effect is preserved; in*Gate*, it disappears; and in*Invert*, it reverses\. The resulting label behavior—preservation, collapse, or swap—therefore provides an independent measure of what happened to the effect\. IfCCcaptures opposition rather than mere weakening, it should remain near zero for Direct and Gate and increase only when the effect reverses\. Across 30 models and all mismatch levels,CCtracks the pairwise label\-swap rate withρ=0\.961\\rho=0\.961, whereas ordinary magnitude does not \(ρ=−0\.036\\rho=\-0\.036; Figure[2](https://arxiv.org/html/2608.12935#S5.F2)\(d\)\)\. Detailed regime separation and calibration appear in Appendix[E](https://arxiv.org/html/2608.12935#A5)\.

Transfer across model classes and modalities\.We next ask whether the same response roles survive beyond controlled vision models\. We use a balanced 240,000\-example subset of Covertype\([3](https://arxiv.org/html/2608.12935#bib.bib45)\)with 54 natural features and append a binary context and a binary candidate factor\. In one set of tasks, the candidate factor has the same effect in the reference context, while changing the context either preserves, removes, or reverses that effect\. In a second set, the factor remains nearly irrelevant in the reference context but can affect predictions under the alternate context\. We train*135 classifiers*spanning linear, tree\-based, and neural models\.

Crucially, these task constructions specify what the training data attempt to induce, not what the model necessarily learns\. We therefore determine preservation, inversion, and endpoint\-null sensitivity directly from held\-out predictions\. If the response roles transfer,EEshould track realized preservation,CCrealized inversion, andFFendpoint\-null prediction change\. See Table[2](https://arxiv.org/html/2608.12935#S5.T2)\.

Remark that some models trained under the inversion construction instead suppress the candidate effect, while the fragility construction becomes ordinary endpoint evidence for logistic regression\.DECAFfollows the behavior realized by the trained model rather than the behavior intended by the data generator; the family\-level audit appears in Appendix[I](https://arxiv.org/html/2608.12935#A9)\.

Table 2:Cross\-model transfer of the three response roles on Covertype\.Entries are Spearman correlations with held\-out realized behavior across 135 classifiers\. TheDECAFcolumn usesEEfor preservation,CCfor actual inversion, andFFfor alternate\-context prediction change restricted to endpoint\-null pairs\. Brackets give 95% joint family/seed bootstrap intervals\.†\\daggerSHAP interaction is available only for tree models\. Complete baselines, model\-family results, threshold\-conditioned analyses, and measured cost appear in Appendix[I](https://arxiv.org/html/2608.12935#A9)\.Held\-out behaviorRoleDECAFρ\\rhoAbs\\mathrm\{Abs\}MMNative SHAPSHAP inter\.PreservationEE0\.864\[0\.832,0\.895\]0\.8040\.6570\.781−0\.251†\-0\.251^\{\\dagger\}Actual inversionCC0\.987\[0\.973,0\.997\]−0\.207\-0\.207−0\.001\-0\.001−0\.205\-0\.2050\.093†0\.093^\{\\dagger\}Endpoint\-null changeFF0\.974\[0\.942,0\.988\]0\.5880\.1480\.4810\.069†0\.069^\{\\dagger\}
## 6Real\-World Audit: Response Semantics on ImageNet\-9

Section[5](https://arxiv.org/html/2608.12935#S5)established the meanings ofEE,CC, andFFin controlled learning problems\. We now ask whether the same response semantics describe behavior on natural images, including models that were never trained for our audit\. ImageNet\-9 is useful for this purpose because its background variants keep the foreground object fixed while changing only the background\([43](https://arxiv.org/html/2608.12935#bib.bib32)\)\. This gives natural factual–counterfactual pairs in which we can ask whether a model’s response to background change behaves as evidence, contradiction, or endpoint\-null sensitivity\.

Setup\.We evaluate two complementary groups of models on these same background interventions\. The first consists of 24 off\-the\-shelf ImageNet\-1k classifiers\. These models were trained independently of our experiment, so they test whether the response semantics established in Section[5](https://arxiv.org/html/2608.12935#S5)remain meaningful for existing natural\-image models\. Their 1,000\-way predictions are aggregated into the nine ImageNet\-9 superclasses before evaluation\.

The second group contains 48 models trained directly on ImageNet\-9\. We fine\-tune six backbones—*ResNet\-50, ConvNeXt\-Tiny, EfficientNet\-B3, RegNetY\-8GF, Swin\-T, and ViT\-B/16*—on four versions of the training data: the original images, images with randomly reassigned backgrounds, images with a fixed next\-class background, and foreground\-only images\. These training conditions deliberately produce models with different degrees and directions of background dependence\. This group therefore tests whether the same response semantics continue to track behavior as the model’s learned use of background changes\. Together, the two groups form a 72\-model zoo: one provides models trained independently of our audit, while the other provides controlled diversity in the behavior being audited\.

\(a\)Behavioral alignment\.\(b\)Response\-role accuracy\.\(c\)Across magnitude bins\.
Figure 3:Response semantics transfer to ImageNet\-9\.\(a\) Evidence and fragility align with independently measured natural\-image behaviors\. \(b\) Nearly identical response magnitudes can correspond to different response semantics, which DECAF preserves\. \(c\) The advantage persists across magnitude bins\.\(a\)Response composition under patch reveal\.\(b\)Model\-rank transfer across reveal paths\.
Figure 4:Reveal paths change response composition and ranking\.\(a\) Patch reveal increases ordinary magnitude mainly through contradiction and fragility rather than evidence\. \(b\) Ordinary\-magnitude rankings transfer poorly across reveal paths, while evidence and contradiction remain substantially more stable\.### 6\.1Response semantics survive natural images

The first question is whether the response roles validated in Section[5](https://arxiv.org/html/2608.12935#S5)remain connected to independently measured behavior on natural images\. We consider two behaviors\. Background reliance asks whether changing only the background substantially disrupts the model’s prediction\. Endpoint\-null sensitivity asks whether a pair with little final background effect can nevertheless remain sensitive to held\-out background corruptions\. Both behaviors are defined independently ofDECAF\. If the response semantics transfer,EEshould identify the former andFFthe latter\.

For background reliance, we mark a pair as positive when the model correctly classifies the image with a same\-class background, but replacing that background with a random\-class one either changes the predicted class or lowers the true\-class probability by at least0\.200\.20\. We then ask whether these behavior\-positive pairs tend to receive larger response scores\. UsingEEdirectly as a ranking score gives an AUROC of0\.9300\.930: a value of0\.50\.5corresponds to random ranking and11to perfect separation\. Ordinary response magnitude reaches0\.9000\.900, while endpoint magnitude reaches0\.9600\.960\(Figure[3](https://arxiv.org/html/2608.12935#S6.F3)\(a\)\)\. The strong endpoint result is expected because this behavioral target is itself defined by a prediction change at the endpoint\.

For endpoint\-null sensitivity, we first restrict attention to pairs whose final background effect is negligible,\|d\|<0\.02\|d\|<0\.02\. We then apply a separate set of background corruptions that are not used to construct the reveal path\. A pair is marked positive if any of these held\-out corruptions changes the predicted class or shifts the true\-class probability by at least0\.200\.20\. We ask whether these independently identified sensitive pairs tend to receive largerFFvalues than the remaining endpoint\-null pairs\.FFreaches AUROC0\.8780\.878, compared with0\.4330\.433for ordinary response magnitude,0\.3160\.316for endpoint magnitude, and0\.6350\.635for SmoothGrad \(Figure[3](https://arxiv.org/html/2608.12935#S6.F3)\(a\)\)\.

Together, the two tests show complementary behavior:EEtracks consequential background use when the final effect is present, whereasFFexposes sensitivity that remains when that final effect is negligible\. Appendix[F](https://arxiv.org/html/2608.12935#A6)gives the full pair construction, held\-out corruption set, behavioral\-label definitions, and baseline details\.

### 6\.2Same Response Magnitude, Different Response Semantics

We next ask whether the decomposition reveals information that ordinary response magnitude does not already contain\. We reuse the independently defined evidence and fragility indicators from Section 6\.1 and add a contradiction indicator: contradiction behavior is present when changing only the background makes the model switch from the foreground class to the class associated with the new background\. These three behavioral indicators may overlap\.

We then compare cases with different behavioral patterns but nearly identical ordinary response magnitudes\. Requiring theirAbs\\mathrm\{Abs\}values to differ by at most5%5\\%yields 8,289 matched comparisons\. Because a case may exhibit more than one behavior, we do not force it into a single ground\-truth class\. Instead, we ask whether the largest ofEE,CC, andFFcorresponds to a behavior that is actually present; overlap and ties are handled as detailed in Appendix[F](https://arxiv.org/html/2608.12935#A6)\.

Under this test, a single magnitude provides no basis for preferring evidence, contradiction, or fragility\.Abs\\mathrm\{Abs\}reaches a role\-agreement accuracy of0\.3500\.350, whereasDECAFreaches0\.9640\.964\(Figure[3](https://arxiv.org/html/2608.12935#S6.F3)\(b\)\)\. Thus, nearly identical response magnitudes can accompany substantially different observed behaviors, while their decomposition preserves this distinction\.

The conclusion also holds beyond the matched cases\. Within narrow bins of ordinary response magnitude, macro\-AUROC rises from0\.5170\.517forAbs\\mathrm\{Abs\}to0\.6770\.677forDECAF, andDECAFexceedsAbs\\mathrm\{Abs\}in 15 of the 16 bins that contain all three behavioral indicators \(Figure[3](https://arxiv.org/html/2608.12935#S6.F3)\(c\)\)\. Appendix[F](https://arxiv.org/html/2608.12935#A6)gives the exact matching rule, overlap and tie handling, per\-bin support, and complete baseline comparisons\.

### 6\.3What Changes When the Reveal Path Changes?

We finally ask whether the same endpoint information can produce different conclusions when it is revealed differently\. We keep the model and both factual–counterfactual endpoints fixed\. In one path, the whole image gradually changes from a common blurred image toward each endpoint; in the other, the same endpoint information is revealed region by region\. We call them the blend and patch paths\.

Ordinary response magnitude increases by about1\.8×1\.8\\timesunder the patch path, but the increase is not uniform across response roles \(Figure[4](https://arxiv.org/html/2608.12935#S6.F4)\(a\)\)\. Evidence remains close to its blend value, contradiction grows by about1\.8×1\.8\\times, and fragility by more than4×4\\times\. This is consistent with their semantics: with the endpoints fixed, evidence remains oriented by the same final contrast, whereas fragility explicitly measures sensitivity along the chosen reveal path\. The pattern is not guaranteed by the definition, but here the larger ordinary response comes primarily from fragility rather than additional evidence\.

We also ask whether the reveal path changes conclusions about how models compare\. For each model, we averageEE,CC,FF, andAbs\\mathrm\{Abs\}over test images and rank the models separately by each quantity under the blend and patch paths\. Spearman correlation measures the agreement between the two rankings\. Ordinary\-magnitude rankings are highly unstable \(ρ=0\.17/0\.26\\rho=0\.17/0\.26for Same–Rand/Same–Next\), whereas evidence rankings remain at0\.86/0\.770\.86/0\.77and contradiction rankings near0\.930\.93\. Fragility is intermediate at0\.69/0\.710\.69/0\.71, consistent with its greater path dependence \(Figure[4](https://arxiv.org/html/2608.12935#S6.F4)\(b\)\)\. Patch\-order and threshold checks are reported in Appendix[G](https://arxiv.org/html/2608.12935#A7)\.

## 7External Attribution Benchmarks and Large\-Model Scaling

Sections[5](https://arxiv.org/html/2608.12935#S5)–[6](https://arxiv.org/html/2608.12935#S6)validate the response semantics ofDECAF\. We now ask whether it also works as ordinary feature attribution under targets defined withoutEE,CC, orFF\. Here the pair is constructed from the feature intervention:𝐱\+\\mathbf\{x\}^\{\+\}is the original image and𝐱−k\\mathbf\{x\}^\{\-k\}changes only part or patchkkusing a fixed removal or replacement rule;EkE\_\{k\}ranks the features\. FunnyBirds evaluates semantic parts under two separate replacement interventions, while ImageNet\-1k IDSDS evaluates 16 fixed patches by single\-patch deletion\. Quality is the per\-image Spearman correlation between the attribution ranking and this intervention\-based ranking\. Both datasets use*ResNet\-50, VGG\-16, and ViT\-B/16*, with every method evaluated on the same eligible images within each model\.DECAF\-3/5/9 use three, five, or nine reveal stages\.

Table 3:External attribution quality and measured ImageNet\-1k compute\. Quality is macro\-averaged equally over the three architectures; time and memory are ImageNet\-1k measurements\. KernelSHAP is shown separately because it directly queries the same patch\-deletion intervention used to define the ImageNet\-1k evaluation target, giving it evaluation\-specific information unavailable to the general baselines andDECAF\.MethodAccessFunnyBirdsρ↑\\rho\\uparrowImageNet\-1kρ↑\\rho\\uparrowms/img↓\\downarrowPeak GiB↓\\downarrow*DECAF*DECAF\-3Forward0\.3720\.35922\.111\.2DECAF\-5Forward0\.4030\.36736\.711\.2DECAF\-9Forward0\.4060\.37965\.911\.2*General\-purpose attribution*DeepLIFTBackward0\.1970\.3413\.16\.6IG\-32Backward0\.2710\.24228\.750\.4IG\-U\-32Backward0\.2000\.29528\.750\.4RISE\-512Sampling0\.3020\.179216\.614\.4*Endpoint\-only reference*EndpointMMEndpoint0\.3240\.371––*Benchmark\-aligned reference \(uses the evaluation intervention\)*KernelSHAP\-512Sampling0\.2990\.447216\.414\.4

Table 4:DINOv2 ViT\-g/14 on 238 PartImageNet strict\-common\-support images\.MethodSpearman↑\\uparrowsec/img↓\\downarrowPeak GiB↓\\downarrowDECAF\-30\.2080\.1905\.53DECAF\-50\.2150\.3005\.66DECAF\-90\.2200\.5266\.33IG\-160\.2220\.7109\.01IG\-320\.2131\.42513\.39GradientSHAP0\.1710\.40727\.67SmoothGrad\-160\.0420\.43826\.43DeepLIFT0\.0680\.0847\.19

Table 5:Gain by the trajectory beyond endpoint\-onlyMM\. Entries are pairedΔ​ρ=ρ⁡\(DECAF\)−ρ⁡\(M\)\\Delta\\rho=\\rho\(\\mathrm\{DECAF\}\)\-\\rho\(M\)with 95% confidence intervals\. Larger values indicate better\.ContrastFunnyBirdsdifferent interventionImageNet\-1ksame deletionDECAF\-3−M\-M\+\.049 \[\.033, \.064\]−\-\.012 \[−\-\.014,−\-\.010\]DECAF\-5−M\-M\+\.080 \[\.064, \.096\]−\-\.004 \[−\-\.007,−\-\.002\]DECAF\-9−M\-M\+\.083 \[\.067, \.099\]\+\.007 \[\.004, \.010\]

All threeDECAFtrajectories exceed every listed general\-purpose baseline on both datasets \(Table[7](https://arxiv.org/html/2608.12935#S7)\)\. KernelSHAP reaches0\.4470\.447on ImageNet\-1k, but it directly queries the same deletion game used to define that target and is therefore shown separately\. The full 50,000\-image ImageNet check preserves the orderingDECAF\-​5\>IG​\-​U​\-​32\>IG​\-​32\\textsc\{DECAF\}\\text\{\-\}5\>\\mathrm\{IG\\text\{\-\}U\\text\{\-\}32\}\>\\mathrm\{IG\\text\{\-\}32\}\. Appendix[H](https://arxiv.org/html/2608.12935#A8)also reruns the official FunnyBirds RISE\-6000 Single Deletion protocol and reproduces the published score within0\.0050\.005on all three architectures\([21](https://arxiv.org/html/2608.12935#bib.bib43)\)

The compute advantage becomes clearer at larger model scale\. On the*1B\-parameter*model*DINOv2 ViT\-g/14*,DECAF\-5 and IG\-32 have nearly identical quality \(0\.2150\.215versus0\.2130\.213\), while IG\-32 requires4\.75×4\.75\\timesthe wall time and2\.36×2\.36\\timesthe peak allocated memory \(Table[7](https://arxiv.org/html/2608.12935#S7)\)\.

Table[5](https://arxiv.org/html/2608.12935#S7.T5)clarifies what the trajectory adds\. On FunnyBirds, evaluation changes parts differently from the operation used to form𝐱−k\\mathbf\{x\}^\{\-k\}; the trajectory adds about0\.080\.08Spearman beyondMM\. ImageNet\-1k instead evaluates the same patch deletion used to form𝐱−k\\mathbf\{x\}^\{\-k\}, soMMis already aligned with the target; five stages nearly match it, while nine stages add only0\.0070\.007\. Endpoint information therefore carries most of the attribution signal when evaluation repeats the same intervention\. The trajectory adds its clearest value when the ranking must transfer to a different intervention\. Complete intervals, per\-architecture results, and boundary cases are in Appendix[H](https://arxiv.org/html/2608.12935#A8)\.

## 8Discussion and Conclusion

Perturbation magnitude tells us how strongly a model responds, but responses of the same size can reflect different behaviors\.DECAFuses the final factual–counterfactual contrast to separate intermediate responses into evidence, contradiction, and fragility, while preserving ordinary magnitude exactly,Abs=E\+C\+F\\mathrm\{Abs\}=E\+C\+F\.

The experiments show that these distinctions are not artifacts of the definitions\. They track independently measured behavior in controlled vision and tabular settings, remain distinguishable on natural images after magnitude is controlled, and remain useful under external attribution criteria\. ImageNet further shows why this matters: changing only the reveal path can greatly increase total response without increasing evidence\.

These response roles are relative to the chosen counterfactual pair, score, and reveal path; they are not claims about hidden causal mechanisms\. The endpoint most directly describes its own intervention, while the trajectory is most useful beyond that intervention\. Magnitude tells us how much a model reacts;DECAFpreserves that quantity while revealing what kind of response produced it\.

## Appendix ADetailed Related Work

The closest literatures all study model response, but they attach different objects and semantics to that response\. We organize the comparison around the object being explained and the question it answers\.

### A\.1Gradient, path, and signed attribution

Gradient explanations measure local sensitivity, while path methods accumulate sensitivity from a baseline to the input\([37](https://arxiv.org/html/2608.12935#bib.bib27);[35](https://arxiv.org/html/2608.12935#bib.bib25);[42](https://arxiv.org/html/2608.12935#bib.bib31);[39](https://arxiv.org/html/2608.12935#bib.bib29);[44](https://arxiv.org/html/2608.12935#bib.bib33);[27](https://arxiv.org/html/2608.12935#bib.bib18);[46](https://arxiv.org/html/2608.12935#bib.bib47)\)\. Layer\-wise relevance propagation, DeepLIFT, FullGrad, and SHAP instead decompose a prediction into additive feature contributions under conservation, reference, or game\-theoretic principles\([2](https://arxiv.org/html/2608.12935#bib.bib3);[36](https://arxiv.org/html/2608.12935#bib.bib26);[40](https://arxiv.org/html/2608.12935#bib.bib40);[31](https://arxiv.org/html/2608.12935#bib.bib21)\)\. Some of these methods preserve positive and negative contributions\([11](https://arxiv.org/html/2608.12935#bib.bib36)\)\.

DECAF studies a different object\. It does not distribute one prediction across input coordinates\. It decomposes the scalar response of an already specified paired intervention\. The clean endpoint supplies the orientation, and the endpoint\-null branch separates fragility from positive or negative evidence\. Spatial saliency and DECAF are therefore complementary: saliency indicates where a response is localized, whereas DECAF indicates what semantic role the paired response plays\.

### A\.2Perturbation, counterfactual, and causal explanation

Occlusion, Meaningful Perturbations, Extremal Perturbations, RISE, LIME, and removal\-based Shapley methods construct interventions and summarize the resulting model changes\([48](https://arxiv.org/html/2608.12935#bib.bib35);[13](https://arxiv.org/html/2608.12935#bib.bib9);[14](https://arxiv.org/html/2608.12935#bib.bib10);[32](https://arxiv.org/html/2608.12935#bib.bib22);[33](https://arxiv.org/html/2608.12935#bib.bib23);[9](https://arxiv.org/html/2608.12935#bib.bib7)\)\. Counterfactual and contrastive methods retrieve or synthesize changes that alter a decision or support a contrast\([19](https://arxiv.org/html/2608.12935#bib.bib14);[6](https://arxiv.org/html/2608.12935#bib.bib5);[11](https://arxiv.org/html/2608.12935#bib.bib36);[47](https://arxiv.org/html/2608.12935#bib.bib46);[20](https://arxiv.org/html/2608.12935#bib.bib48)\)\. Causal attribution and concept\-intervention methods interpret relevance through explicit interventions on inputs, representations, or human\-interpretable concepts\([7](https://arxiv.org/html/2608.12935#bib.bib6);[24](https://arxiv.org/html/2608.12935#bib.bib17);[18](https://arxiv.org/html/2608.12935#bib.bib15);[28](https://arxiv.org/html/2608.12935#bib.bib19);[30](https://arxiv.org/html/2608.12935#bib.bib20)\)\.

DECAF takes the paired intervention as input rather than searching for it\. Counterfactual construction defines the factor and identification assumptions; the paired trajectory measures the response; endpoint orientation then decomposes that response into evidence, contradiction, and fragility\. The same decomposition can therefore sit on top of different removal operators or counterfactual generators\.

### A\.3Baselines, off\-manifold effects, and faithfulness evaluation

Baseline and path choices can substantially change attribution\([41](https://arxiv.org/html/2608.12935#bib.bib30);[29](https://arxiv.org/html/2608.12935#bib.bib39)\), and perturbations can move samples away from the data manifold\([15](https://arxiv.org/html/2608.12935#bib.bib11)\)\. Sanity checks, retraining\-based evaluations, infidelity measures, and debiased removal metrics test whether explanations reflect the model rather than artifacts of the evaluation protocol\([1](https://arxiv.org/html/2608.12935#bib.bib2);[23](https://arxiv.org/html/2608.12935#bib.bib16);[45](https://arxiv.org/html/2608.12935#bib.bib34);[34](https://arxiv.org/html/2608.12935#bib.bib24)\)\. Other work documents label leakage, explanation fragility, and adversarial manipulation\([25](https://arxiv.org/html/2608.12935#bib.bib38);[17](https://arxiv.org/html/2608.12935#bib.bib13);[12](https://arxiv.org/html/2608.12935#bib.bib8);[38](https://arxiv.org/html/2608.12935#bib.bib28)\)\.

DECAF does not claim path invariance\. It keeps the intervention protocol explicit and asks which component changes when the protocol changes\. This distinction matters in ImageNet\-9: nested\-patch reveal raises total response by roughly80%80\\%, but the increase comes primarily from contradiction and fragility rather than evidence\. DECAF addresses a semantic ambiguity that remains even when a paired response has been measured faithfully\.

### A\.4Efficiency, black\-box access, and benchmark context

Black\-box perturbation methods trade model access for repeated queries; RISE and dense occlusion can require many forward evaluations, while amortized methods such as FastSHAP add a separate explainer\-training problem\([32](https://arxiv.org/html/2608.12935#bib.bib22);[26](https://arxiv.org/html/2608.12935#bib.bib37)\)\. DECAF instead reuses the signed scores already computed by a paired perturbation curve\. The routing step adds no model queries, requires no gradients or internal activations, and can be batched across examples, stages, factors, and models\.

ImageNet\-9 is a standard setting for studying background reliance and distribution shift\([43](https://arxiv.org/html/2608.12935#bib.bib32);[16](https://arxiv.org/html/2608.12935#bib.bib12)\)\. DECAF asks a finer question than whether a model responds to background: is that response endpoint\-aligned evidence, endpoint\-opposed contradiction, or sensitivity that appears only when the endpoint effect is null?

## Appendix BTheoretical Foundations and Proofs

This appendix develops the compact theory used in the main text\. We begin with the pointwise decomposition, then lift it to a trajectory, a population, and a decision problem\. The proofs require only integrability of the signed response and do not assume differentiability, smoothness, or a particular model class\.

### B\.1Positive and negative parts

For a real numberuu, defineu\+=max⁡\{u,0\}u^\{\+\}=\\max\\\{u,0\\\}andu−=max⁡\{−u,0\}u^\{\-\}=\\max\\\{\-u,0\\\}\. Then

u=u\+−u−,\|u\|=u\+\+u−,u\+​u−=0\.u=u^\{\+\}\-u^\{\-\},\\qquad\|u\|=u^\{\+\}\+u^\{\-\},\\qquad u^\{\+\}u^\{\-\}=0\.\(2\)For an integrable functionz:𝒯→ℝz:\\mathcal\{T\}\\rightarrow\\mathbb\{R\}, the signed measureν⁡\(A\)=∫Az⁡\(t\)​𝑑μ​\(t\)\\nu\(A\)=\\int\_\{A\}z\(t\)\\,\\mathrm\{d\}\\mu\(t\)admits the Jordan decompositionν=ν\+−ν−\\nu=\\nu^\{\+\}\-\\nu^\{\-\}, whered​ν\+=z\+​d​μ\\mathrm\{d\}\\nu^\{\+\}=z^\{\+\}\\mathrm\{d\}\\muandd​ν−=z−​d​μ\\mathrm\{d\}\\nu^\{\-\}=z^\{\-\}\\mathrm\{d\}\\mu\. DECAF applies this decomposition to the endpoint\-oriented response on the active branch and reserves a separate branch for endpoint\-null pairs\.

### B\.2Canonicality

###### Proof of Theorem[1](https://arxiv.org/html/2608.12935#Thmtheorem1)\.

Fixaa,ss, andrr\. Ifa=0a=0, endpoint gating requirese=c=0e=c=0\. Conservation then forcesf=\|r\|f=\|r\|\. Hence the triple is unique\.

Now supposea=1a=1\. Endpoint gating givesf=0f=0\. Letz=s​rz=sr\. Ifz≥0z\\geq 0, directional support requiresc=0c=0and conservation givese=\|r\|=z=z\+e=\|r\|=z=z^\{\+\}\. Ifz≤0z\\leq 0, directional support requirese=0e=0and conservation givesc=\|r\|=−z=z−c=\|r\|=\-z=z^\{\-\}\. Thus

\(e,c,f\)=\(a​\(s​r\)\+,a​\(s​r\)−,\(1−a\)​\|r\|\)\.\(e,c,f\)=\\bigl\(a\(sr\)^\{\+\},a\(sr\)^\{\-\},\(1\-a\)\|r\|\\bigr\)\.\(3\)The construction is nonnegative, conserves\|r\|\|r\|, obeys the gate, and has the stated support\. Therefore it is the unique triple satisfying the axioms\. ∎

The theorem also yields a projection interpretation\. On an active pair,eeis the magnitude of the Euclidean projection ofrronto the endpoint\-aligned ray\{s​λ:λ≥0\}\\\{s\\lambda:\\lambda\\geq 0\\\}, whileccis the magnitude of the projection onto the opposite ray\. The null branch is not a projection\. It records that the endpoint does not provide a stable orientation at the chosen threshold\.

### B\.3Magnitude non\-identifiability and strict refinement

###### Proof of Theorem[2](https://arxiv.org/html/2608.12935#Thmtheorem2)\.

Fixm\>0m\>0\. Consider three responses\. First, let the endpoint be active withs=1s=1and letr=mr=m\. Then\(e,c,f\)=\(m,0,0\)\(e,c,f\)=\(m,0,0\)\. Second, keep the same endpoint and letr=−mr=\-m\. Then\(e,c,f\)=\(0,m,0\)\(e,c,f\)=\(0,m,0\)\. Third, let the endpoint be null and letr=mr=m\. Then\(e,c,f\)=\(0,0,m\)\(e,c,f\)=\(0,0,m\)\. In every case, the observed magnitude is\|r\|=m\|r\|=m\. A statistic that observes only\|r\|\|r\|therefore cannot distinguish the three mechanisms\. ∎

###### Corollary 1\(Strict response refinement\)\.

The DECAF profile is at least as informative as ordinary magnitude for every decision problem, becauseAbs=E\+C\+F\\mathrm\{Abs\}=E\+C\+Fis a deterministic function of the profile\. It is strictly more informative for any mechanism\-identification problem that assigns positive probability to two distinct profiles with the same magnitude\.

###### Proof\.

Any rule that usesAbs\\mathrm\{Abs\}can be composed with the map\(E,C,F\)↦E\+C\+F\(E,C,F\)\\mapsto E\+C\+F\. Theorem[2](https://arxiv.org/html/2608.12935#Thmtheorem2)gives distinct profiles that share one magnitude\. A decision problem that rewards correct mechanism identification separates those profiles, so no magnitude\-only rule can match the best rule that observes the full profile\. This is the standard logic of strict Blackwell refinement\([4](https://arxiv.org/html/2608.12935#bib.bib1)\)\. ∎

A useful finite case makes the gap concrete\. Suppose evidence, contradiction, and fragility are equally likely and all produce magnitudemm\. Every magnitude\-only classifier receives the same observation, so its best accuracy is1/31/3\. Under unequal priors, the best magnitude\-only accuracy is the largest prior\. The DECAF profile identifies the mechanism exactly in this idealized construction\.

### B\.4Preservation, attenuation, and inversion

###### Proof of Proposition[1](https://arxiv.org/html/2608.12935#Thmproposition1)\.

Let the endpoint orientation bess\. Under preservation, the stage response iss​msm, soE=mE=m,C=0C=0, andAbs=m\\mathrm\{Abs\}=m\.

Under attenuation, the response iss​msmwith probability1−η1\-\\etaand zero with probabilityη\\eta\. Taking expectations givesE=\(1−η\)​mE=\(1\-\\eta\)m,C=0C=0, andAbs=\(1−η\)​m\\mathrm\{Abs\}=\(1\-\\eta\)m\.

Under inversion, the response iss​msmwith probability1−η1\-\\etaand−s​m\-smwith probabilityη\\eta\. The first branch contributesmmto evidence, while the second contributesmmto contradiction\. ThereforeE=\(1−η\)​mE=\(1\-\\eta\)m,C=η​mC=\\eta m, andAbs=m\\mathrm\{Abs\}=m\. The ratio isC/\(E\+C\)=ηC/\(E\+C\)=\\eta\. ∎

The equal\-magnitude assumption isolates the inversion probability\. If the aligned and opposed branches have magnitudesm\+m\_\{\+\}andm−m\_\{\-\}, then

E=\(1−η\)​m\+,C=η​m−,CE\+C=η​m−\(1−η\)​m\+\+η​m−\.E=\(1\-\\eta\)m\_\{\+\},\\qquad C=\\eta m\_\{\-\},\\qquad\\frac\{C\}\{E\+C\}=\\frac\{\\eta m\_\{\-\}\}\{\(1\-\\eta\)m\_\{\+\}\+\\eta m\_\{\-\}\}\.\(4\)Thus the opposed fraction measures probability mass only when the two branches have comparable effect size\. In general,CCmeasures opposed causal mass\.

### B\.5Population factorization

Letπ=Pr⁡\(\|d\|≥ε\)\\pi=\\Pr\(\|d\|\\geq\\varepsilon\)\. Define branch\-conditional summaries whenever the corresponding branch has positive probability\. Since evidence and contradiction vanish on the null branch, while fragility vanishes on the active branch,

E=π​Eactive,C=π​Cactive,F=\(1−π\)​Fnull\.E=\\pi E^\{\\mathrm\{active\}\},\\qquad C=\\pi C^\{\\mathrm\{active\}\},\\qquad F=\(1\-\\pi\)F^\{\\mathrm\{null\}\}\.\(5\)Unconditional quantities combine branch prevalence and conditional intensity\. Conditional quantities answer a different question and become unstable when their branch is rare\. The factorization is therefore useful when an external outcome is defined only within the active or null branch, but the primary experiments report unconditional population summaries\.

### B\.6Invariances

#### Endpoint swap\.

Swapping𝐱\+\\mathbf\{x\}^\{\+\}and𝐱−\\mathbf\{x\}^\{\-\}multiplies bothddandr⁡\(t\)r\(t\)by−1\-1\. The oriented responses​r​\(t\)sr\(t\)is unchanged\. HenceM,E,C,F,M,E,C,F,andAbs\\mathrm\{Abs\}are invariant\.

#### Score translation\.

Replacingqqbyq\+bq\+bleaves every difference unchanged\.

#### Positive affine score reparameterization\.

Letq′=λ​q\+bq^\{\\prime\}=\\lambda q\+bwithλ\>0\\lambda\>0\. Thend′=λ​dd^\{\\prime\}=\\lambda d,r′​\(t\)=λ​r​\(t\)r^\{\\prime\}\(t\)=\\lambda r\(t\), ands′=ss^\{\\prime\}=s\. If the endpoint threshold is transformed consistently asε′=λ​ε\\varepsilon^\{\\prime\}=\\lambda\\varepsilon, the gate is unchanged and

\(M′,E′,C′,F′,Abs′\)=λ⁡\(M,E,C,F,Abs\)\.\(M^\{\\prime\},E^\{\\prime\},C^\{\\prime\},F^\{\\prime\},\\mathrm\{Abs\}^\{\\prime\}\)=\\lambda\(M,E,C,F,\\mathrm\{Abs\}\)\.Hence all normalized component proportions are invariant\.

With a numerically fixed thresholdε\\varepsilon, however, the gate obeys

aε′=𝟏\{\|d\|≥ε/λ\}\.a^\{\\prime\}\_\{\\varepsilon\}=\\mathbf\{1\}\\\{\|d\|\\geq\\varepsilon/\\lambda\\\}\.Consequently,

Eε′=λ​Eε/λ,Cε′=λ​Cε/λ,Fε′=λ​Fε/λ\.E^\{\\prime\}\_\{\\varepsilon\}=\\lambda E\_\{\\varepsilon/\\lambda\},\\qquad C^\{\\prime\}\_\{\\varepsilon\}=\\lambda C\_\{\\varepsilon/\\lambda\},\\qquad F^\{\\prime\}\_\{\\varepsilon\}=\\lambda F\_\{\\varepsilon/\\lambda\}\.Thus positive scaling preserves component proportions only when gate membership is preserved\. Otherwise, the discrepancy is controlled by the threshold\-mass bound in Appendix B\.8\.

#### Negative score scaling\.

A negative scaling reverses the semantic meaning of the target score\. The endpoint orientation still makes the component magnitudes invariant after multiplying by\|λ\|\|\\lambda\|, but the analyst has changed the behavior being explained\. We therefore define the score direction before analysis\.

### B\.7Protocol reparameterization

Leth:𝒯~→𝒯h:\\widetilde\{\\mathcal\{T\}\}\\rightarrow\\mathcal\{T\}be an increasing bijection and define the reparameterized pathr~​\(u\)=r​\(h​\(u\)\)\\widetilde\{r\}\(u\)=r\(h\(u\)\)\. Pointwise components are reindexed:

e~​\(u\)=e⁡\(h⁡\(u\)\),c~​\(u\)=c⁡\(h⁡\(u\)\),f~​\(u\)=f⁡\(h⁡\(u\)\)\.\\widetilde\{e\}\(u\)=e\(h\(u\)\),\\quad\\widetilde\{c\}\(u\)=c\(h\(u\)\),\\quad\\widetilde\{f\}\(u\)=f\(h\(u\)\)\.\(6\)If the integration measure is pushed forward consistently,μ~=h\#−1​μ\\widetilde\{\\mu\}=h^\{\-1\}\_\{\\\#\}\\mu, then the integrated profile is invariant\. If both paths are instead integrated with a uniform coordinate measure, their AUCs may differ\. Dynamic DECAF summaries are therefore protocol\-relative, and every experiment reports the path and stage measure\.

### B\.8Threshold stability

Let0≤ε1<ε20\\leq\\varepsilon\_\{1\}<\\varepsilon\_\{2\}and suppose the per\-example path summary is bounded byBB\. The two gates differ only on pairs satisfyingε1≤\|d\|<ε2\\varepsilon\_\{1\}\\leq\|d\|<\\varepsilon\_\{2\}\. Consequently, for each componentG∈\{E,C,F\}G\\in\\\{E,C,F\\\},

\|Gε2−Gε1\|≤B​Pr⁡\(ε1≤\|d\|<ε2\)\.\|G\_\{\\varepsilon\_\{2\}\}\-G\_\{\\varepsilon\_\{1\}\}\|\\leq B\\,\\Pr\\\!\\left\(\\varepsilon\_\{1\}\\leq\|d\|<\\varepsilon\_\{2\}\\right\)\.\(7\)The threshold is stable when little endpoint mass lies near the boundary\. We report sensitivity over multiple thresholds rather than treating one numerical cutoff as universal\.

## Appendix CEstimators, Complexity, and Implementation

DECAF reuses the signed scores of a paired perturbation curve\. Once those scores are available, the decomposition is elementwise\.

### C\.1Finite\-grid estimators

Lett1,…,tTt\_\{1\},\\ldots,t\_\{T\}be stage points with nonnegative quadrature weightsw1,…,wTw\_\{1\},\\ldots,w\_\{T\}that sum to one\. For pairii, define

Ei=∑j=1Twj​ei​\(tj\),Ci=∑j=1Twj​ci​\(tj\),Fi=∑j=1Twj​fi​\(tj\)\.E\_\{i\}=\\sum\_\{j=1\}^\{T\}w\_\{j\}e\_\{i\}\(t\_\{j\}\),\\quad C\_\{i\}=\\sum\_\{j=1\}^\{T\}w\_\{j\}c\_\{i\}\(t\_\{j\}\),\\quad F\_\{i\}=\\sum\_\{j=1\}^\{T\}w\_\{j\}f\_\{i\}\(t\_\{j\}\)\.\(8\)ForNNpairs, the empirical estimates are

E^=1N​∑i=1NEi,C^=1N​∑i=1NCi,F^=1N​∑i=1NFi,M^=1N​∑i=1N\|di\|\.\\widehat\{E\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}E\_\{i\},\\quad\\widehat\{C\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}C\_\{i\},\\quad\\widehat\{F\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}F\_\{i\},\\quad\\widehat\{M\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\|d\_\{i\}\|\.\(9\)Every implementation checks the exact sample\-level identity\|ri​\(tj\)\|=ei​\(tj\)\+ci​\(tj\)\+fi​\(tj\)\|r\_\{i\}\(t\_\{j\}\)\|=e\_\{i\}\(t\_\{j\}\)\+c\_\{i\}\(t\_\{j\}\)\+f\_\{i\}\(t\_\{j\}\)\. We use trapezoidal weights on ordered grids unless stated otherwise\. When the protocol contains randomness, factual and counterfactual branches share that randomness; repeated paths are averaged or retained as clusters for uncertainty estimation\.

### C\.2Query complexity

Suppose we evaluateKKfactors,TTstages,JJcounterfactual maps per factor, andRRprotocol repetitions\. If factual branch evaluations are shared across factors, the number of model evaluations per example is

R​T​\(1\+K​J\)\.RT\(1\+KJ\)\.\(10\)For one factor and one map this is2​R​T2RT\. DECAF adds no model evaluations to the ordinary signed paired trajectory; its arithmetic cost is linear in the number of scalar responses\.

The ImageNet\-9 main path usesT=9T=9, so it requires 18 forward evaluations per pair\. Under our configurations, Integrated Gradients and SmoothGrad each use 16 forward–backward evaluations, BlurIG uses 12, Occlusion uses 49 forward evaluations, and RISE uses 256\. These counts describe access and query structure rather than hardware\-independent wall time\.

### C\.3Memory, batching, and black\-box models

A streaming implementation stores the endpoint sign, current stage scores, and three accumulators\. Its additional memory isO⁡\(B​K\)O\(BK\)scalars for batch sizeBBandKKfactors, beyond the model and input batch\. Examples, branches, stages, factors, counterfactual maps, repetitions, and models provide independent batching dimensions\.

DECAF requires no differentiability\. It applies to neural networks, tree ensembles, simulators, and remote APIs whenever a stable real\-valued score is available\. For stochastic models, branches should share random seeds or use repeated queries\. Hard labels are formally sufficient, but probabilities, logits, margins, regression values, or action values produce more informative endpoint effects\.

## Appendix DControlled Experimental Setup

The controlled suite gives DECAF an identifiable target before we move to natural images\. Every experiment uses exact factor interventions in 3D Shapes, shared protocol randomness across branches, and two architectures\. The experiments differ in the behavior they are designed to activate\.

### D\.1Dataset and factors

3D Shapes contains480,000480\{,\}000rendered scenes generated from six factors: floor color, wall color, object color, object size, object shape, and object orientation\([5](https://arxiv.org/html/2608.12935#bib.bib4)\)\. The Cartesian product is fully enumerated\. This structure gives us exact counterfactuals: to intervene on one factor, we change its index and hold the other five indices fixed\.

We use binary prediction tasks derived from the factors\. The base benchmark contains five tasks:

- •Object color:a binary split of the object\-color values\.
- •Wall color:a binary split of the wall\-color values\.
- •Object shape:the two shapes that are common to all model\-response supports\.
- •Color–shape XOR:the exclusive\-or of binary object color and shape\.
- •Context gate:a color decision whose active factor depends on wall context\.

For each task we train ResNet\-18 and a small ViT with three random seeds\. The resulting 30 models are crossed with all six factors, producing 180 model–factor units\.

### D\.2Clean endpoint pairs

For a factual scene𝐱\+\\mathbf\{x\}^\{\+\}and target factorkk, the counterfactual𝐱−\\mathbf\{x\}^\{\-\}changes only factorkk\. Binary factors are flipped\. Multivalued color, size, and orientation factors use fixed involutive maps so that applying the map twice returns the original value\. We use two independent maps for multivalued factors and average their measurements\.

The clean endpoint effect is computed on 8,192 held\-out factual–counterfactual pairs\. The main threshold classifies a pair as active when the absolute target\-score difference exceeds the experiment\-specificε\\varepsilon\. The endpoint classification is a property of the model and pair, not of the task label\.

### D\.3Primary reveal protocol

The main controlled protocol is covariance\-matched Gaussian reveal\. Let𝝁\\bm\{\\mu\}and𝚺^\\widehat\{\\bm\{\\Sigma\}\}be the empirical mean and covariance of the image distribution\. Forα∈\[0,1\]\\alpha\\in\[0,1\],

𝐱α=𝝁\+α​\(𝐱−𝝁\)\+1−α​𝜼,𝜼∼𝒩⁡\(𝟎,𝚺^\)\.\\mathbf\{x\}\_\{\\alpha\}=\\bm\{\\mu\}\+\\sqrt\{\\alpha\}\(\\mathbf\{x\}\-\\bm\{\\mu\}\)\+\\sqrt\{1\-\\alpha\}\\,\\bm\{\\eta\},\\qquad\\bm\{\\eta\}\\sim\\mathcal\{N\}\(\\mathbf\{0\},\\widehat\{\\bm\{\\Sigma\}\}\)\.\(11\)The factual and counterfactual branch share the same𝜼\\bm\{\\eta\}\. Atα=1\\alpha=1the path reaches the clean input; atα=0\\alpha=0the state is independent of the individual sample under the fitted Gaussian reference\. The covariance match makes the stimulus second\-order neutral in whitened data coordinates\. DECAF does not depend on this particular path; it only consumes the paired scores that the path produces\.

The base benchmark uses 4,096 dynamic factual pairs, three noise seeds, two counterfactual maps, and 21 points along a trace\-matched covariance family\. The primary CMMR endpoint is accompanied by a trace\-matched pixel\-Gaussian endpoint\. A diagonal covariance and a trace\-normalized covariance\-power path provide held\-out geometries\.

### D\.4Alternative protocols

The covariance interpolation is

𝚪λ=\(1−λ\)​𝚺^\+λ​τ​𝐈,τ=tr⁡\(𝚺^\)D,\\bm\{\\Gamma\}\_\{\\lambda\}=\(1\-\\lambda\)\\widehat\{\\bm\{\\Sigma\}\}\+\\lambda\\tau\\mathbf\{I\},\\qquad\\tau=\\frac\{\\operatorname\{tr\}\(\\widehat\{\\bm\{\\Sigma\}\}\)\}\{D\},whereDDis the pixel dimension\. The two endpoints use data covariance and trace\-matched isotropic pixel covariance\. The diagonal held\-out path usesdiag⁡\(𝚺^\)\\operatorname\{diag\}\(\\widehat\{\\bm\{\\Sigma\}\}\)\. The power path raises covariance eigenvalues to a power and renormalizes the trace\. These paths test whether a semantic conclusion depends on one second\-order geometry\.

We use the protocol family as an audit, not as a learned worst\-case score\. The main paper reports CMMR\-based DECAF and uses the alternatives to characterize transfer\.

### D\.5Evidence validation through training trajectories

The evidence experiment trains shape classifiers in an environment where wall color is strongly correlated with the label\. We use two training correlations,0\.950\.95and0\.990\.99, two architectures, two seeds, and save checkpoints throughout training\. This creates eight trajectories and 52 selected checkpoints\.

The external target is shortcut\-reversal vulnerability,

Vrev=Acc⁡\(ptest=0\.95\)−Acc⁡\(ptest=0\.05\)\.V\_\{\\mathrm\{rev\}\}=\\operatorname\{Acc\}\(p\_\{\\mathrm\{test\}\}=0\.95\)\-\\operatorname\{Acc\}\(p\_\{\\mathrm\{test\}\}=0\.05\)\.A shortcut\-dominant checkpoint performs well when wall color remains aligned and fails when the correlation reverses\. A shape\-dominant checkpoint is stable\. We compareVrevV\_\{\\mathrm\{rev\}\}with the evidence marginEwall−EshapeE\_\{\\mathrm\{wall\}\}\-E\_\{\\mathrm\{shape\}\}\.

### D\.6Fragility validation

The fragility experiment uses a binary object\-shape task and treats floor color as the candidate endpoint\-null factor\. We train robust, neutral, and fragile variants for each architecture and three seeds, producing 18 models\.

The neutral variant uses clean training only\. The robust variant is encouraged to keep its output stable under floor\-color counterfactuals at intermediate states\. The fragile variant is encouraged to respond to floor color away from the endpoint while preserving the clean shape task\. The intended comparison is restricted to models for which clean accuracy remains high and floor color remains endpoint\-null\.

The behavioral target is the prediction\-change rate under held\-out floor\-color interventions at intermediate states\. We also measure randomized\-floor stability and transfer across covariance geometries\.

### D\.7Contradiction validation

The contradiction benchmark uses two binary variables: object colorAAand wall contextGG\. The factual endpoint is evaluated in the contextG=1G=1, where all three tasks share the clean ruleY=AY=A\. Under the swapped contextG=0G=0:

Direct:Y=A,Gate:Y=H,Invert:Y=1−A,\\text\{Direct: \}Y=A,\\qquad\\text\{Gate: \}Y=H,\\qquad\\text\{Invert: \}Y=1\-A,whereHHis object shape\. Direct preserves the object\-color effect\. Gate removes it\. Invert reverses it\.

We train 30 models: three tasks, two architectures, and five seeds\. Balanced validation accuracy is at least0\.99870\.9987\. A binary symmetric context channel swaps the wall context with probabilityη∈\[0,0\.5\]\\eta\\in\[0,0\.5\]\. All intermediate images remain in the support of the generated dataset\. Two independent wall\-color involutions test map transfer\.

The label\-level outcomes are preserve, collapse, and swap\. The key contrast is between Gate and Invert: both reduce aligned evidence, but only Invert should create endpoint\-opposed mass\.

### D\.8Statistical summaries

The base benchmark uses stratified bootstrap over task, architecture, and seed\. The evidence experiment bootstraps complete trajectories\. The fragility and contradiction experiments report seed\-level variation and architecture\-stratified summaries\. Bootstrap intervals use 500 repetitions unless stated otherwise\. We treat the model or training trajectory as the main statistical unit rather than counting every image as independent evidence\.

## Appendix ESelected Controlled Results

This appendix expands the behavioral validation in Section[5](https://arxiv.org/html/2608.12935#S5)without repeating its main tests\. We report five positive extensions: a matched\-magnitude example, the complete response atlas, all evidence\-training trajectories, fragility checks across interventions and reveal geometries, and contradiction checks across regimes, architectures, seeds, and counterfactual maps\.

### E\.1Matched\-magnitude response roles

Figure[5](https://arxiv.org/html/2608.12935#A5.F5)gives a concrete example of the scalar ambiguity discussed in the main text\. In an object\-shape model, the true shape factor and an endpoint\-null floor\-color factor produce nearly equal ordinary response magnitude, but their response roles differ sharply\. The same distinction matters across the controlled benchmark: ordinary magnitude can rank an endpoint\-null factor above a supported factor, whereas endpoint\-oriented routing removes these false\-null reversals\.

\(a\)Nearly equal magnitude, different response roles\.\(b\)Orientation removes false\-null reversals\.
Figure 5:Equal response magnitude can hide different behavior\.\(a\) The true shape factor and an endpoint\-null floor\-color factor have nearly identical ordinary magnitude, yetDECAFseparates evidence from fragility\. \(b\) Across the benchmark, ordinary magnitude ranks an endpoint\-null factor above a supported factor in7\.32%7\.32\\%of comparable pairs, whereas endpoint\-oriented routing reduces this rate to zero\.
### E\.2Complete decomposition atlas

Figure[6](https://arxiv.org/html/2608.12935#A5.F6)displays every task–factor combination\. Endpoint\-null factors concentrate near the fragility corner, direct color tasks concentrate in evidence, and interaction tasks carry more contradiction and mixed mass\. Across 125 endpoint\-null units, 96\.8% of ordinary response is fragility on average\. Across 48 endpoint\-supported units, the mean composition is 64\.1% evidence, 12\.5% contradiction, and 23\.4% null fragility\.

Figure 6:Complete controlled decomposition atlas\.Results cover five tasks, two architectures, three seeds, and six factors\. Endpoint\-null factors are dominated by fragility, while task\-relevant and interaction factors contain evidence and contradiction in different proportions\.
### E\.3Evidence across training trajectories

Figure[7](https://arxiv.org/html/2608.12935#A5.F7)places exact shortcut vulnerability and theDECAFevidence margin on the same eight checkpoint trajectories\. Six trajectories exhibit nonconstant vulnerability, and all six show positive within\-trajectory association between evidence margin and shortcut vulnerability\. The two Small\-ViT trajectories trained at the strongest shortcut correlation remain shortcut\-dominant, andDECAFcorrespondingly keeps their evidence margin high\.

\(a\)Exact shortcut vulnerability\.\(b\)Evidence margin\.
Figure 7:Evidence follows shortcut reliance across complete training trajectories\.The two panels show the same eight checkpoint sequences through an external behavioral measure and theDECAFevidence margin\.
### E\.4Fragility: intervention separation and reveal geometry

The main text validatesFFagainst independently measured off\-path prediction change\. Figure[8](https://arxiv.org/html/2608.12935#A5.F8)provides three complementary checks\. First,FFcleanly orders robust, neutral, and fragile interventions\. Second, similar total response can correspond to different endpoint\-relative roles across architectures\. Third, the robust–neutral–fragile ordering transfers from the primary covariance\-matched reveal to diagonal covariance, trace\-matched pixel Gaussian, and three covariance\-power geometries\. The controlled fragility result is therefore not tied to one second\-order reveal geometry, although the numerical summaries remain protocol\-relative\.

\(a\)Intervention separation\.\(b\)Similar magnitude, different roles\.\(c\)Cross\-geometry rank transfer\.
Figure 8:Additional fragility checks\.\(a\)FFseparates robust, neutral, and fragile training\. \(b\) Similar ordinary response can be endpoint evidence in one model and endpoint\-null fragility in another\. \(c\) The controlled ordering transfers across held\-out reveal geometries\.\(a\)Attenuation vs\. inversion\.\(b\)Independent label behavior\.\(c\)CCsucceeds whereAbs\\mathrm\{Abs\}fails\.\(d\)Opposed\-fraction calibration\.\(e\)Architecture and seed consistency\.\(f\)Counterfactual\-map transfer\.
Figure 9:Additional contradiction checks\.Top: contradiction separates attenuation from inversion, agrees with independently measured label behavior, and succeeds where ordinary magnitude does not\. Bottom: the opposed fraction is calibrated and stable across architectures, seeds, and alternative wall\-color counterfactual maps\.
### E\.5Contradiction: regime separation and calibration

The main text shows thatCCtracks independently measured label reversal\. Figure[9](https://arxiv.org/html/2608.12935#A5.F9)expands this result\. Direct preserves the effect, Gate suppresses it, and Invert reverses it; only inversion creates substantial opposed mass\. The induced label behavior independently separates into preservation, collapse, and swap\. Across architectures, seeds, and wall\-color maps, the opposed fraction remains well calibrated\. Raw sign changes can be frequent when the stage effect is numerically close to zero, but the corresponding opposed mass remains small, separating magnitude\-aware contradiction from sign counting\.

## Appendix FImageNet\-9 Experimental Details

This appendix gives the construction and secondary diagnostics behind Section[6](https://arxiv.org/html/2608.12935#S6)\. The main text keeps only the tests needed for the central argument\. Here we specify the data splits, model zoo, paired background interventions, independent behavioral indicators, magnitude\-controlled evaluation, spatial\-attribution baselines, and cross\-architecture comparison\.

### F\.1Data variants and disjoint splits

We use the official ImageNet\-9 Backgrounds Challenge variants\([43](https://arxiv.org/html/2608.12935#bib.bib32)\): Original, Mixed\-Same, Mixed\-Rand, Mixed\-Next, Only\-FG, and the challenge backgrounds\. The variants preserve foreground identity while changing how the background is constructed\. We match variants by foreground identifier and retain 4,050 foregrounds for which the required variants are available\.

A deterministic split keeps the roles of the data separate\. We reserve 1,644 paired foregrounds for the broad model\-level response scan and an 820\-foreground deep pool for the sample\-level benchmark; 768 foregrounds from this pool are used for the expensive baseline comparison\. The remaining foregrounds are not used in that sample\-level benchmark\. No foreground appears in more than one split\.

### F\.2Model zoo and common score space

The 72\-model zoo contains two complementary groups\. The first consists of 24 off\-the\-shelf ImageNet\-1k classifiers from torchvision and timm\. These models were trained independently of our audit and span ResNet, ResNeXt, WideResNet, DenseNet, EfficientNet, RegNet, ConvNeXt, DeiT, ViT, BEiT, Swin, MaxViT, and CoAtNet architectures\.

The second group contains 48 models trained directly on ImageNet\-9\. We fine\-tune six backbones—ResNet\-50, ConvNeXt\-Tiny, EfficientNet\-B3, RegNetY\-8GF, Swin\-T, and ViT\-B/16—on four versions of the training data: Original, Mixed\-Rand, Mixed\-Next, and Only\-FG, using two random seeds\. This6×4×26\\times 4\\times 2design broadens the range of learned background dependence while retaining the same ImageNet\-9 prediction task\.

We train the fine\-tuned models for eight epochs with AdamW, cosine decay, one warm\-up epoch, BF16 computation, random resized crops, and horizontal flips\. ResNet\-50, EfficientNet\-B3, and RegNetY\-8GF use batch size 256 and learning rate3×10−43\\times 10^\{\-4\}\. ConvNeXt\-Tiny, Swin\-T, and ViT\-B/16 use batch size 128 and learning rate10−410^\{\-4\}\.

All models are evaluated in the same nine\-class score space\. For an ImageNet\-1k model, we compute its 1,000\-way softmax and sum the probabilities belonging to each official ImageNet\-9 superclass\. We do not sum logits or apply a second softmax\. The ImageNet\-9 fine\-tuned models output nine logits directly\. In both groups, the scalar analyzed byDECAFis the probability assigned to the true ImageNet\-9 superclass\.

### F\.3Paired background interventions and reveal paths

For each foreground, we construct two paired background interventions\. Same–Rand compares Mixed\-Same with Mixed\-Rand: the foreground is unchanged, while a same\-class background is replaced by a random\-class background\. This pair is used for the evidence and fragility analyses\. Same–Next compares Mixed\-Same with Mixed\-Next, where the replacement background comes from superclass\(y\+1\)mod9\(y\+1\)\\bmod 9\. This pair creates a directional background change for the contradiction analysis\.

The primary reveal begins from a shared blurred midpoint\. For endpoints𝐱\+\\mathbf\{x\}^\{\+\}and𝐱−\\mathbf\{x\}^\{\-\},

𝐱0=Blur⁡\(𝐱\+\+𝐱−2\),\\mathbf\{x\}^\{0\}=\\operatorname\{Blur\}\\\!\\left\(\\frac\{\\mathbf\{x\}^\{\+\}\+\\mathbf\{x\}^\{\-\}\}\{2\}\\right\),\(12\)and each branch is linearly revealed from𝐱0\\mathbf\{x\}^\{0\}to its endpoint\. We evaluate nine stages,t∈\{0,0\.125,…,1\}t\\in\\\{0,0\.125,\\ldots,1\\\}\. The main endpoint threshold isε=0\.02\\varepsilon=0\.02in true\-class probability\.

To test whether conclusions depend on the reveal path, we also use nested\-patch reveal on an8×88\\times 8grid\. Patches are ordered by endpoint\-difference energy, with a fixed random tie\-break\. Two independently tie\-broken orders are evaluated\. Both branches use the same patch order and the same neutral starting image\. Appendix[G](https://arxiv.org/html/2608.12935#A7)reports the corresponding path\-order and threshold checks\.

### F\.4Behavioral indicators defined withoutDECAF

The sample\-level benchmark defines three observable behavioral indicators directly from model predictions\. None usesEE,CC, orFF, and the indicators are allowed to overlap\.

#### Evidence behavior\.

SetYE=1Y\_\{E\}=1when Mixed\-Same is classified correctly and replacing its background with Mixed\-Rand either changes the predicted class or lowers the true\-class probability by at least0\.200\.20\. This records a consequential change caused by replacing the background\.

#### Contradiction behavior\.

SetYC=1Y\_\{C\}=1when changing only the background makes the model switch from the foreground class to the class associated with the new Mixed\-Next background\. This is an independently observed directional reversal in the model’s prediction\.

#### Fragility behavior\.

We first restrict attention to Same–Rand pairs whose fully revealed endpoints produce little difference,\|d\|<0\.02\|d\|<0\.02\. The endpoint pair alone cannot tell us whether such a case is otherwise sensitive, so we test it separately with additional background changes that are not part of theDECAFreveal\. These changes use Gaussian blur, Gaussian noise, pixelation, color shift, and patch shuffle, each at two severities\. SetYF=1Y\_\{F\}=1if any of them changes the predicted class or shifts the true\-class probability by at least0\.200\.20\.

These indicators are external behavioral checks, not definitions of theDECAFcomponents\. Their purpose is to ask whether the response roles obtained from the paired trajectory agree with behavior measured independently of that trajectory decomposition\.

### F\.5Magnitude\-controlled evaluation

The deep benchmark uses 32 models and 768 foregrounds, giving 24,576 model–image units\. We use two complementary ways to control ordinary response magnitude\.

First, we divide the units into 20 quantile bins ofAbs\\mathrm\{Abs\}\. Within a bin, a behavioral AUROC is computed only when both positive and negative examples are present for that indicator\. The main text reports both the valid\-bin summary and the stricter common\-support comparison in which all three indicators are represented\.

Second, we construct one\-to\-one matched comparisons between cases with different behavioral indicator patterns but nearly identical ordinary response magnitudes\. We require the relative difference inAbs\\mathrm\{Abs\}to be at most5%5\\%, yielding 8,289 matched comparisons\.

BecauseYEY\_\{E\},YCY\_\{C\}, andYFY\_\{F\}may overlap, the matched evaluation does not force every case into one ground\-truth class\. For a case with at least one active indicator, we examine the largest score among the three response\-role coordinates\. The case receives full credit when the largest coordinate corresponds to an active behavioral indicator\. If several coordinates tie for the maximum, credit is divided across the tied coordinates\. The reported matched\-pair accuracy averages this role\-agreement score over the matched cases\. Ordinary magnitude has only one scalar value and therefore cannot prefer evidence, contradiction, or fragility\.

The implementation also records a separate pairwise\-ranking diagnostic: when an independent behavioral indicator differs across a matched pair, it asks whether the corresponding response\-role score changes in the same direction\. This ranking diagnostic is distinct from the role\-agreement accuracy reported in Section 6\.2\.

### F\.6Spatial\-attribution baselines

The deep benchmark includes six standard spatial\-attribution methods: Input×\\timesGradient, Integrated Gradients with 16 steps, SmoothGrad with 16 noise samples, BlurIG with 12 blur levels, a7×77\\times 7Occlusion grid, and RISE with 256 masks\. For each method, we sum absolute attribution inside the foreground–background difference region\. These scores describe where the prediction is sensitive; they are not used to define the three behavioral indicators above\.

### F\.7Cross\-architecture comparison and spatial complementarity

Figure 10:Cross\-architecture transfer and spatial complementarity\.All learned results hold out one architecture family during fitting\. Response features fromDECAFnearly match the supervised response\-statistics reference, while adding spatial attribution provides a further gain and approaches the full supervised reference\.For the learned comparison, every representation is evaluated with the same supervised protocol: train on all but one architecture family and evaluate on the held\-out family\. TheDECAFrepresentation uses\(M,E,C,F\)\(M,E,C,F\)\. A response\-statistics reference uses\(M,Abs,Net,SignFlip,active​rate\)\(M,\\mathrm\{Abs\},\\mathrm\{Net\},\\mathrm\{SignFlip\},\\mathrm\{active\\ rate\}\)\. The spatial representation uses the six attribution scores above\. We also evaluateDECAFcombined with the spatial scores and a full reference combining response statistics with spatial attribution\.

Figure[10](https://arxiv.org/html/2608.12935#A6.F10)contains the panel moved from the main text\. Using response information alone,DECAFreaches leave\-one\-architecture\-family\-out macro\-AUROC0\.8620\.862, close to the supervised response\-statistics reference at0\.8670\.867\. Spatial attribution alone reaches0\.7370\.737\. CombiningDECAFwith spatial attribution reaches0\.9180\.918, close to the full supervised reference at0\.9210\.921\. This is best read as a complementarity check: the response decomposition and spatial attribution retain different information\.

### F\.8Statistical reporting

For direct behavioral comparisons, we report AUROC and AUPRC\. For learned comparisons, we report leave\-one\-architecture\-family\-out results so that the evaluated architecture family is not used to fit the probe\. Undefined AUROCs remain missing rather than being replaced by chance\. Where bootstrap intervals are reported, models—rather than individual model–image rows—are the resampling unit\.

## Appendix GImageNet\-9 Protocol Robustness Checks

\(a\)Patch\-order stability\.\(b\)Endpoint\-threshold sensitivity\.
Figure 11:Robustness of the ImageNet\-9 protocol audit\.\(a\) The two independently tie\-broken nested\-patch orders agree almost perfectly for every response component\. \(b\) Varying the endpoint threshold changes the allocation between active and endpoint\-null response, but not the qualitative protocol conclusion\.The protocol audit in Section[6](https://arxiv.org/html/2608.12935#S6)changes the reveal path while keeping the factual–counterfactual endpoints fixed\. We retain two checks that test whether the reported effect is caused by an arbitrary implementation choice\.

First, the nested\-patch reveal is evaluated with two independently tie\-broken patch orders\. Their response summaries agree almost perfectly, showing that the blend\-to\-patch contrast is not an accident of one patch sequence\. Second, we recompute the decomposition atε∈\{0\.01,0\.02,0\.05\}\\varepsilon\\in\\\{0\.01,0\.02,0\.05\\\}\. Changing the threshold reallocates response between the active and endpoint\-null branches as expected, but preserves the qualitative conclusion that patch reveal increases total response without increasing evidence\.

## Appendix HForward\-Only Attribution: Complete Results and Boundaries

This appendix expands the compact comparison in Section[7](https://arxiv.org/html/2608.12935#S7)\. It records the strict common\-support protocol, complete baseline results, an official\-protocol FunnyBirds reproduction check, the endpoint\-versus\-trajectory ablation, full\-scale ImageNet validation, measured compute, large\-model scaling, and the PartImageNet boundary case\.

### H\.1Protocol and strict common support

FunnyBirds and ImageNet\-1k use the same three architectures: ResNet\-50, VGG\-16, and ViT\-B/16\. FunnyBirds evaluates semantic\-part rankings against two held\-out operators, Telea inpainting and background\-texture replacement\. ImageNet\-1k IDSDS partitions every image into a fixed4×44\\times 4grid and evaluates the ranking of 16 patch scores against in\-domain single\-deletion effects\. We first filter to images classified correctly by each model\. We then intersect image IDs across the methods included in the strict comparison\. The resulting support contains 499, 497, and 488 FunnyBirds images, and 7,663, 7,189, and 8,285 ImageNet images, respectively\.

For each image, the primary metric is Spearman correlation between feature attribution and the benchmark target\. We average within each model and then macro\-average equally across architectures\. All intervals use 1,000 paired image\-cluster bootstrap replicates\. We never average the FunnyBirds and ImageNet columns into one leaderboard\.

EndpointMk=\|dk\|M\_\{k\}=\|d\_\{k\}\|is an endpoint\-only reference\. On ImageNet IDSDS, the endpoint audit givesmaxk⁡\|dk−gk\|=0\\max\_\{k\}\|d\_\{k\}\-g\_\{k\}\|=0and confirms that every stored endpoint effect uses the same deletion pair as the evaluation target\. The direct target\-derived\|gk\|\|g\_\{k\}\|and independently persisted DECAFMkM\_\{k\}differ only by a mean numerical discrepancy of6\.0×10−66\.0\\times 10^\{\-6\}\.

### H\.2Complete cross\-dataset method comparison

Table 6:Complete strict\-common\-support attribution results\. Entries are equal\-architecture macro\-average Spearman correlations with95%95\\%paired image\-cluster bootstrap intervals\. EndpointMMis an endpoint\-only reference\. KernelSHAP\-512 is a deletion\-game reference\.MethodAccessFunnyBirdsρ\\rho\[95% CI\]ImageNet\-1k IDSDSρ\\rho\[95% CI\]*DECAF*DECAF\-3Forward only0\.372 \[0\.353, 0\.392\]0\.359 \[0\.355, 0\.364\]DECAF\-5Forward only0\.403 \[0\.385, 0\.422\]0\.367 \[0\.362, 0\.371\]DECAF\-9Forward only0\.406 \[0\.388, 0\.425\]0\.379 \[0\.375, 0\.383\]*General\-purpose attribution*Input×\\timesGradientBackward0\.019 \[−\-0\.002, 0\.042\]0\.098 \[0\.094, 0\.101\]IG\-16Backward0\.266 \[0\.246, 0\.285\]0\.238 \[0\.235, 0\.242\]IG\-32Backward0\.271 \[0\.251, 0\.290\]0\.242 \[0\.238, 0\.245\]IG\-U\-32Backward0\.200 \[0\.178, 0\.222\]0\.295 \[0\.292, 0\.299\]DeepLIFTBackward0\.197 \[0\.176, 0\.217\]0\.341 \[0\.338, 0\.344\]GradientSHAPBackward0\.226 \[0\.204, 0\.246\]0\.236 \[0\.233, 0\.240\]SmoothGrad\-16Backward−\-0\.045 \[−\-0\.065,−\-0\.023\]−\-0\.015 \[−\-0\.018,−\-0\.011\]RISE\-512Sampling0\.302 \[0\.283, 0\.321\]0\.179 \[0\.175, 0\.183\]RISE\-U\-512Sampling0\.294 \[0\.274, 0\.315\]0\.111 \[0\.107, 0\.115\]*Endpoint\-only reference*EndpointMMEndpoint only0\.324 \[0\.303, 0\.344\]0\.371 \[0\.366, 0\.377\]*Deletion\-game reference*KernelSHAP\-512Sampling0\.299 \[0\.278, 0\.319\]0\.447 \[0\.443, 0\.451\]#### Published\-benchmark sanity check\.

On the original full\-scale IDSDS ResNet\-50 setting, our IG and IG\-U scores are 0\.194 and 0\.252, closely matching the published values of 0\.196 and 0\.255\([22](https://arxiv.org/html/2608.12935#bib.bib44)\)\. This agreement provides an external check on our ImageNet implementation\. Our FunnyBirds evaluation instead uses held\-out intervention operators and strict common support, so it is not intended to reproduce the dataset’s native part\-based evaluation protocol\([21](https://arxiv.org/html/2608.12935#bib.bib43)\)\. We therefore compare its baseline values only within our registered protocol\.

The stronger IG baseline changes across datasets\. IG\-32 exceeds IG\-U\-32 on FunnyBirds, while IG\-U\-32 is stronger on IDSDS\.DECAF\-5 exceeds both variants on both datasets\. KernelSHAP exhibits the opposite transfer pattern: it is strongest on IDSDS, whose target is the deletion game it queries, but is weaker than endpointMMand DECAF under the held\-out FunnyBirds operators\.

#### Native\-protocol reproduction check\.

The FunnyBirds column above evaluates attribution transfer to two held\-out intervention operators, rather than the dataset’s native Single Deletion protocol\. We therefore ran a separate implementation check using the official FunnyBirds setting: the released checkpoints, native semantic part removals, and RISE with 6,000 masks, an8×88\\times 8coarse grid, and mask probabilityp=0\.1p=0\.1\([21](https://arxiv.org/html/2608.12935#bib.bib43)\)\. As shown in Table[7](https://arxiv.org/html/2608.12935#A8.T7), the reproduced RISE scores differ from the published values by less than0\.0050\.005for every architecture\. This check supports the implementation fidelity of the RISE baseline used in our benchmark; it does not imply that the held\-out score of0\.3020\.302should numerically match the native Single Deletion scores, because the two evaluations use different intervention targets and RISE configurations\.

Table 7:FunnyBirds native Single Deletion reproduction and native\-target audit\.Top:the official RISE\-6000 setting reproduces the published Single Deletion scores within0\.0050\.005on all three architectures\.Bottom:raw Spearman correlation with the same native part\-removal target\. EndpointMMis included to show the strong target alignment of this evaluation\. These native\-target results are a reproduction and boundary check, not a replacement for the held\-out FunnyBirds comparison in Table[7](https://arxiv.org/html/2608.12935#S7)\.ArchitecturePublished RISE SDReproduced RISE SD\|Δ\|\|\\Delta\|ResNet\-500\.5600\.5580\.002VGG160\.7300\.7260\.004ViT\-B/160\.7900\.7880\.002Native\-target raw Spearmanρ\\rhoMethodResNet\-50VGG16ViT\-B/16EndpointMM0\.7571\.0000\.983DECAF\-30\.4840\.9260\.909DECAF\-50\.5650\.8980\.864DECAF\-90\.6160\.9010\.850RISE\-60000\.1150\.4520\.576The native and held\-out FunnyBirds experiments answer different questions\. The native target is defined by the same semantic part\-removal contrast used to construct the endpoint, whereas the main benchmark evaluates transfer to held\-out inpainting and texture\-replacement interventions\. The native audit therefore verifies baseline implementation and exposes the target\-aligned boundary; the held\-out benchmark remains the test of attribution transfer\.

### H\.3Endpoint versus trajectory

Table 8:Paired endpoint\-versus\-trajectory tests\. Differences are DECAF minus endpointMM\. Positive values indicate ordinary\-attribution information beyond the endpoint\.DatasetContrastMeanΔ\\Delta95% CIModel winsFunnyBirdsDECAF\-3−M\-M\+0\.0488\[0\.0334, 0\.0642\]2/3FunnyBirdsDECAF\-5−M\-M\+0\.0797\[0\.0637, 0\.0962\]2/3FunnyBirdsDECAF\-9−M\-M\+0\.0828\[0\.0671, 0\.0993\]2/3ImageNet\-1kDECAF\-3−M\-M−\-0\.0119\[−\-0\.0142,−\-0\.0096\]1/3ImageNet\-1kDECAF\-5−M\-M−\-0\.0045\[−\-0\.0072,−\-0\.0017\]1/3ImageNet\-1kDECAF\-9−M\-M\+0\.0073\[0\.0045, 0\.0101\]2/3FunnyBirds is the clean trajectory\-value test because its evaluation operators differ from the explanation endpoint\. All three DECAF grids significantly exceedMM\. Five stages capture96\.3%96\.3\\%of the nine\-stage gain over the endpoint\. IDSDS evaluates the same deletion contrast that definesdkd\_\{k\}\. EndpointMMis therefore already highly aligned with its target\. Three and five stages preserve most of that signal, while nine stages add a small but stable gain\.

Table 9:Endpoint\-versus\-trajectory ablation by architecture\. BestΔ\\Deltais the largest DECAF\-3/5/9 Spearman minus endpointMM\.DatasetModelEndpointMMDECAF\-3DECAF\-5DECAF\-9BestΔ\\DeltaFunnyBirdsResNet\-500\.3880\.4250\.4470\.451\+0\.064FunnyBirdsVGG\-160\.3060\.2830\.2980\.293−\-0\.008FunnyBirdsViT\-B/160\.2770\.4090\.4650\.475\+0\.197ImageNet\-1kResNet\-500\.3840\.3620\.3700\.387\+0\.002ImageNet\-1kVGG\-160\.6710\.6400\.6400\.644−\-0\.027ImageNet\-1kViT\-B/160\.0580\.0770\.0900\.105\+0\.047The trajectory gain is architecture\-dependent in the tested models\. It is largest for ViT\-B/16 on both datasets, modest for ResNet\-50, and negative for VGG\-16\. This pattern is empirical rather than a general architecture law, but it shows that the value of intermediate responses is not uniform across model classes\.

The separate native FunnyBirds audit in Appendix[H\.2](https://arxiv.org/html/2608.12935#A8.SS2)provides the complementary endpoint\-aligned case: when the evaluation target is the exact native part\-removal contrast, endpointMMreachesρ=0\.913\\rho=0\.913and exceeds all trajectory summaries\.

Together, the two FunnyBirds evaluations isolate the role of the trajectory: the endpoint best recovers its own intervention effect, while intermediate responses add value when attribution must transfer to a different intervention\.

### H\.4Full\-scale ImageNet validation

Table 10:Full 50,000\-image ImageNet validation scale check\. Values are equal\-architecture macro\-average IDSDS over 115,876 correctly classified model–image units\.MethodMacroρ\\rho\[95% CI\]ResNet\-50VGG\-16ViT\-B/16EndpointMM0\.3708 \[0\.3685, 0\.3731\]0\.37780\.67310\.0615DECAF\-50\.3633 \[0\.3613, 0\.3653\]0\.36090\.63950\.0894IG\-U\-320\.2942 \[0\.2926, 0\.2958\]0\.25220\.49390\.1366IG\-320\.2397 \[0\.2380, 0\.2411\]0\.19410\.40020\.1247The 10,000\-image conclusions are not a favorable\-subset artifact\. The full validation set preserves the orderingM\>DECAF\-​5\>IG​\-​U​\-​32\>IG​\-​32M\>\\textsc\{DECAF\}\\text\{\-\}5\>\\mathrm\{IG\\text\{\-\}U\\text\{\-\}32\}\>\\mathrm\{IG\\text\{\-\}32\}\. The full\-scale paired difference betweenDECAF\-5 andMMis−0\.0075\-0\.0075with a95%95\\%interval of\[−0\.0086,−0\.0062\]\[\-0\.0086,\-0\.0062\]\.

### H\.5Measured compute and large\-model scaling

Table 11:Measured ImageNet\-1k compute\. Rows per image count model\-forward input rows after batching\. Timing is compute\-only and macro\-averaged across ResNet\-50, VGG\-16, and ViT\-B/16\.MethodAccessRows/imageBackward?ms/image↓\\downarrowPeak GiB↓\\downarrowDECAF\-3Forward only51No22\.111\.2DECAF\-5Forward only85No36\.711\.2DECAF\-9Forward only153No65\.911\.2Input×\\timesGradientBackward1Yes1\.42\.3DeepLIFTBackward2Yes3\.16\.6GradientSHAPBackward16Yes14\.425\.9IG\-32Backward32Yes28\.750\.4IG\-U\-32Backward32Yes28\.750\.4SmoothGrad\-16Backward16Yes16\.125\.9RISE\-512Sampling512No216\.614\.4KernelSHAP\-512Sampling512No216\.414\.4DECAF\-3 is the speed\-oriented Pareto point\. Relative to IG\-32, it has higher quality on both datasets, is1\.30×1\.30\\timesfaster, and uses4\.50×4\.50\\timesless peak memory\.DECAF\-5 trades additional latency for higher quality while keeping the same inference\-scale memory\. KernelSHAP\-512 is5\.89×5\.89\\timesslower thanDECAF\-5 and uses six times as many forward rows\.

### H\.6PartImageNet as a task\-aligned boundary case

PartImageNet supplies semantic part masks and evaluates held\-out part\-removal effects\. Direct part removal and coalition methods are therefore unusually aligned with the evaluation target\. We retain the benchmark as a boundary case rather than using it to define the main general\-purpose comparison\.

Table 12:PartImageNet strict\-common\-support Spearman\. Part\-removal and coalition methods exploit the supplied semantic part groups and are directly aligned with the held\-out part\-removal target\.MethodSpearman \[95% CI\]Part\-LIME\-10000\.478 \[0\.458, 0\.497\]Part Occlusion0\.477 \[0\.458, 0\.496\]Exact Part\-Shapley0\.433 \[0\.412, 0\.454\]KernelSHAP\-5120\.426 \[0\.405, 0\.447\]EndpointMM0\.364 \[0\.342, 0\.385\]DECAF\-90\.363 \[0\.341, 0\.384\]DECAF\-50\.358 \[0\.337, 0\.379\]DECAF\-30\.350 \[0\.329, 0\.370\]RISE\-5120\.299 \[0\.276, 0\.320\]IG\-320\.289 \[0\.270, 0\.311\]This result marks the method boundary clearly\. When perfect semantic parts are already supplied and the target is itself a part\-removal effect, direct part interventions can be stronger\. Even in that setting, the DECAF trajectories remain above standard gradient\-path attribution and preserve their forward\-only memory advantage\.

## Appendix ICovertype Experimental Details and Complete Results

This appendix reports the complete Covertype audit behind Section[5](https://arxiv.org/html/2608.12935#S5)\. The experiment uses a natural tabular base and controlled context–factor channels\. Its purpose is not to assume that every treatment succeeds\. It measures which response mechanism each trained model actually realizes\.

### I\.1Setup and Operational Outcomes

We balance classes 1 and 2 from Covertype and retain 240,000 examples\. The 54 natural features are augmented by one binary context and one binary candidate factor\. The direction module uses contextGGand factorZZ; the fragility module uses contextHHand factorUU\. Natural features and data splits are shared across all mechanism variants\.

Table 13:Covertype benchmark design\. Each model family uses three seeds\. Direction experiments additionally use shortcut strengthsp∈\{0\.75,0\.95\}p\\in\\\{0\.75,0\.95\\\}\.ModuleRegimesHeld\-out operational behaviorFamiliesModelsDirectionDirect, Gate, Invertpreserve / collapse / invert590FragilityRobust, Mild, Fragileendpoint\-null prediction change545Total135For the direction module, the endpoint isG=\+1G=\+1\. We query the factor effect underG=\+1G=\+1andG=−1G=\-1, then define preservation, collapse, and inversion from the held\-out signed responses\. For the fragility module, the endpoint isH=\+1H=\+1\. The primary behavioral target used in Section[5](https://arxiv.org/html/2608.12935#S5)is the prediction\-change rate underH=−1H=\-1among examples satisfying the endpoint\-null gate\. This target was stored by the formal experiment and matches the definition ofFF\.

### I\.2Complete Behavior Alignment

Table[14](https://arxiv.org/html/2608.12935#A9.T14)reports the complete rank comparison\. Evidence uses preservation, contradiction uses actual inversion, and fragility uses endpoint\-null alternate\-context prediction change\. The first two columns use 90 direction models; the last uses 45 fragility models\. Parenthetical sample counts mark methods with partial coverage\.

Table 14:Spearman correlation with realized behavior\. SHAP interaction is available for random forests and XGBoost; KernelSHAP and LIME use their fixed formal subsets\.FFvalues use the endpoint\-null behavior target\.MethodPreservationρ\\rhoActual inversionρ\\rhoEndpoint\-null changeρ\\rhoDECAF component0\.8640\.9870\.974EndpointMM0\.657−0\.001\-0\.0010\.148Abs0\.804−0\.207\-0\.2070\.588Signed net0\.878−0\.353\-0\.3530\.043SignFlip−0\.919\-0\.919\(78\)0\.888 \(78\)0\.842 \(39\)OppMass−0\.412\-0\.4120\.9740\.965Native SHAP0\.781−0\.205\-0\.2050\.481SHAP interaction−0\.251\-0\.251\(54\)0\.093 \(54\)0\.069 \(27\)KernelSHAP0\.811 \(30\)−0\.219\-0\.219\(30\)0\.441 \(15\)Global PFI0\.664−0\.029\-0\.0290\.676Context\-conditioned PFI0\.2980\.3110\.739PDP/ALE interaction−0\.100\-0\.1000\.8270\.937LIME0\.845 \(30\)−0\.384\-0\.384\(30\)0\.506 \(15\)For the two headline semantic coordinates, joint family/seed cluster bootstrap gives

ρ⁡\(C,Vinv\)=0\.9868,95%​CI=\[0\.9725,0\.9967\],\\rho\(C,V\_\{\\mathrm\{inv\}\}\)=0\.9868,\\qquad 95\\%\\ \\mathrm\{CI\}=\[0\.9725,0\.9967\],and

ρ⁡\(F,Vnull\)=0\.9741,95%​CI=\[0\.9416,0\.9883\]\.\\rho\(F,V\_\{\\mathrm\{null\}\}\)=0\.9741,\\qquad 95\\%\\ \\mathrm\{CI\}=\[0\.9416,0\.9883\]\.Evidence reachesρ⁡\(E,Vkeep\)=0\.8642\\rho\(E,V\_\{\\mathrm\{keep\}\}\)=0\.8642with 95% interval\[0\.8318,0\.8955\]\[0\.8318,0\.8955\]\.

### I\.3The Same Treatment Produces Different Realized Mechanisms

Table[15](https://arxiv.org/html/2608.12935#A9.T15)shows why treatment labels cannot serve as mechanism ground truth\. The Invert generator produces genuine reversal in random forests and multilayer perceptrons, but mostly collapse in the remaining families\. The Fragile generator becomes endpoint evidence in logistic regression, while nonlinear families retain substantial endpoint\-null mass\.

Table 15:Model\-family audit\. Direction columns average the Invert regime across two strengths and three seeds\. Fragility columns average the Fragile regime across three seeds\. “Active” is the endpoint\-active fraction; “Null change” is the alternate\-context prediction\-change rate on endpoint\-null examples\.Invert treatmentFragile treatmentModel familyCCInvert rateCollapse rateMMEEFFActiveNull changeHistGradientBoosting0\.0000\.0001\.0000\.0200\.0700\.1800\.3400\.623Logistic regression0\.0000\.0001\.0000\.2990\.2990\.00010\.9890\.000MLP0\.0880\.7430\.2570\.0280\.0840\.0800\.3500\.219Random forest0\.0240\.8160\.1690\.0570\.1700\.0620\.6730\.327XGBoost0\.0000\.0020\.9980\.0200\.0910\.1630\.3460\.552

Within the Invert treatment alone,CCstill tracks the amount of realized inversion withρ=0\.922\\rho=0\.922\. Among families with nonconstant inversion behavior, the correlations are 0\.997 for histogram gradient boosting, 0\.992 for random forests, 0\.971 for XGBoost, and 0\.940 for the MLP\. Logistic regression has zero inversion throughout, so its within\-family correlation is undefined\.

### I\.4Fixed Semantic Readout and Magnitude Conditioning

The fixed semantic benchmark assignsEE,CC, andFFto Evidence, Contradiction, and Fragility without fitting a meta\-classifier\. Table[16](https://arxiv.org/html/2608.12935#A9.T16)reports both the unconditional result and the within\-Abs\-bin result\. The latter controls response magnitude through 12 quantile bins\.

Table 16:Mechanism identification with fixed semantics and after conditioning on ordinary magnitude\. Learned references use mechanism labels and are not access\-matched to fixed DECAF\.MethodFixedmacro\-AUROCFixedmacro\-AUPRCWithin\-Absmacro\-AUROCWithin\-Absmacro\-AUPRCDECAF / M / Abs /Net / OppMass / SignFlip0\.8160\.7680\.9560\.948EndpointMM0\.4870\.4370\.5650\.666Abs0\.5180\.4500\.4950\.585Native SHAP0\.5230\.4370\.4610\.570SHAP interaction0\.5400\.440––Context\-conditionedPFI0\.5560\.5450\.4680\.634PDP/ALE interaction0\.5390\.4380\.5590\.739Strong tabular reference\(supervised\)0\.9870\.9680\.9830\.994DECAF probe\(supervised\)0\.9020\.8590\.7420\.779Combined empiricalreference \(supervised\)0\.9850\.9650\.9830\.994The fixed DECAF mechanism accuracy is 0\.587\. The supervised references use leave\-one\-model\-family\-out calibration, mechanism labels, and up to 15 input summaries\. They bound cross\-family decodability but do not replace the label\-free comparison\.

### I\.5Measured Cost and SHAP\-Interaction Audit

Table[17](https://arxiv.org/html/2608.12935#A9.T17)reports the registered cumulative worker time\. Relative cost divides worker\-seconds per model by the DECAF value\. Coverage differs for methods whose formal budget uses a model subset\.

Table 17:Complete measured method cost\. SHAP interaction uses 128 stratified examples per tree model, split into four 32\-example shards\.MethodModelsWorker\-s/modelRelative to DECAFPredicted rowsDECAF /MM/ Abs / Net /1351\.421\.0×1\.0\\times25,920,000OppMass / SignFlipPDP/ALE interaction1352\.221\.57×1\.57\\times38,880,000LIME458\.385\.92×5\.92\\times11,796,480PFI / context PFI13513\.329\.41×9\.41\\times207,360,000KernelSHAP4545\.3031\.99×31\.99\\times377,501,760Native SHAP135387\.65273\.8×273\.8\\times–Retraining reference13519\.7013\.91×13\.91\\times–SHAP interaction5415097\.6310662×10662\\times–The formal SHAP\-interaction run completed 216 shards over 54 tree models\. It consumed at least 811,875 CPU\-seconds \(225\.5 CPU\-hours\), used up to 32 concurrent shards, and required 17\.71 hours of elapsed stage time\. Its inversion correlation was only0\.0930\.093with a 95% interval spanning zero\.

### I\.6Matched\-Pair Audit and Its Limits

The automatic pair search produced only 11 protocol pairs\. They cover 29\.3% of primary units, contain no same\-family pair, and have a median relative endpoint\-magnitude difference of 0\.870 \(maximum 0\.945\), although their Abs difference is small\. DECAF reaches 0\.727 mechanism accuracy on these pairs, but this set does not support a headline claim that both Abs andMMare matched\. We therefore use the much better populated within\-Abs\-bin analysis in Table[16](https://arxiv.org/html/2608.12935#A9.T16)and retain the 11\-pair result only as an audit\.

## References

- Adebayoet al\.\(2018\)J\. Adebayo, J\. Gilmer, M\. Muelly, I\. Goodfellow, M\. Hardt, and B\. KimSanity checks for saliency maps\.InAdvances in Neural Information Processing Systems,Vol\.31\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Bachet al\.\(2015\)S\. Bach, A\. Binder, G\. Montavon, F\. Klauschen, K\. Müller, and W\. SamekOn pixel\-wise explanations for non\-linear classifier decisions by layer\-wise relevance propagation\.PLOS ONE10\(7\),pp\. e0130140\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Blackard \(1998\)J\. BlackardCovertype\.Note:UCI Machine Learning RepositoryExternal Links:[Document](https://dx.doi.org/10.24432/C50K5N)Cited by:[§5](https://arxiv.org/html/2608.12935#S5.p5.1)\.
- Blackwell \(1953\)D\. BlackwellEquivalent comparisons of experiments\.The Annals of Mathematical Statistics24\(2\),pp\. 265–272\.Cited by:[§B\.3](https://arxiv.org/html/2608.12935#A2.SS3.p2.1.1)\.
- Burgesset al\.\(2018\)C\. P\. Burgess, I\. Higgins, A\. Pal, L\. Matthey, N\. Watters, G\. Desjardins, and A\. LerchnerUnderstanding disentangling inβ\\beta\-vae\.arXiv preprint arXiv:1804\.03599\.Cited by:[§D\.1](https://arxiv.org/html/2608.12935#A4.SS1.p1.1),[§5](https://arxiv.org/html/2608.12935#S5.p1.1)\.
- Changet al\.\(2019\)C\. Chang, E\. Creager, A\. Goldenberg, and D\. DuvenaudExplaining image classifiers by counterfactual generation\.InInternational Conference on Learning Representations,Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Chattopadhyayet al\.\(2019\)A\. Chattopadhyay, P\. Manupriya, A\. Sarkar, and V\. N\. BalasubramanianNeural network attributions: a causal perspective\.InProceedings of the 36th International Conference on Machine Learning,pp\. 981–990\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Covertet al\.\(2021a\)I\. Covert, S\. Lundberg, and S\. LeeExplaining by removing: a unified framework for model explanation\.Journal of Machine Learning Research22\(209\),pp\. 1–90\.Cited by:[§1](https://arxiv.org/html/2608.12935#S1.p1.1)\.
- Covertet al\.\(2021b\)I\. Covert, S\. Lundberg, and S\. LeeExplaining by removing: a unified framework for model explanation\.Journal of Machine Learning Research22\(209\),pp\. 1–90\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Dhurandharet al\.\(2018a\)A\. Dhurandhar, P\. Chen, R\. Luss, C\. Tu, P\. Ting, K\. Shanmugam, and P\. DasExplanations based on the missing: towards contrastive explanations with pertinent negatives\.InAdvances in Neural Information Processing Systems,Vol\.31\.Cited by:[§1](https://arxiv.org/html/2608.12935#S1.p1.1)\.
- Dhurandharet al\.\(2018b\)A\. Dhurandhar, P\. Chen, R\. Luss, C\. Tu, P\. Ting, K\. Shanmugam, and P\. DasExplanations based on the missing: towards contrastive explanations with pertinent negatives\.InAdvances in Neural Information Processing Systems,Vol\.31,pp\. 590–601\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1),[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Dombrowskiet al\.\(2019\)A\. Dombrowski, M\. Alber, C\. Anders, M\. Ackermann, K\. Müller, and P\. KesselExplanations can be manipulated and geometry is to blame\.InAdvances in Neural Information Processing Systems,Vol\.32\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1)\.
- Fong and Vedaldi \(2017\)R\. C\. Fong and A\. VedaldiInterpretable explanations of black boxes by meaningful perturbation\.InProceedings of the IEEE International Conference on Computer Vision,pp\. 3429–3437\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Fonget al\.\(2019\)R\. Fong, M\. Patrick, and A\. VedaldiUnderstanding deep networks via extremal perturbations and smooth masks\.InProceedings of the IEEE International Conference on Computer Vision,pp\. 2950–2958\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Fryeet al\.\(2020\)C\. Frye, C\. Rowat, and I\. FeigeShapley explainability on the data manifold\.InInternational Conference on Learning Representations,Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1)\.
- Geirhoset al\.\(2020\)R\. Geirhos, J\. Jacobsen, C\. Michaelis, R\. Zemel, W\. Brendel, M\. Bethge, and F\. A\. WichmannShortcut learning in deep neural networks\.Nature Machine Intelligence2,pp\. 665–673\.Cited by:[§A\.4](https://arxiv.org/html/2608.12935#A1.SS4.p2.1)\.
- Ghorbaniet al\.\(2019\)A\. Ghorbani, A\. Abid, and J\. ZouInterpretation of neural networks is fragile\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.33,pp\. 3681–3688\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1)\.
- Goyalet al\.\(2020\)Y\. Goyal, A\. Feder, U\. Shalit, and B\. KimExplaining classifiers with causal concept effect\.arXiv preprint arXiv:1907\.07165\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Goyalet al\.\(2019\)Y\. Goyal, Z\. Wu, J\. Ernst, D\. Batra, D\. Parikh, and S\. LeeCounterfactual visual explanations\.InProceedings of the 36th International Conference on Machine Learning,pp\. 2376–2384\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Guet al\.\(2026\)Y\. Gu, L\. Cao, B\. Zhao, L\. Lei, and L\. YouDISCOVER: a solver for distributional counterfactual explanations\.arXiv preprint arXiv:2603\.16436\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Hesseet al\.\(2023\)R\. Hesse, S\. Schaub\-Meyer, and S\. RothFunnyBirds: a synthetic vision dataset for a part\-based analysis of explainable ai methods\.InProceedings of the IEEE/CVF International Conference on Computer Vision \(ICCV\),pp\. 3981–3991\.Cited by:[§H\.2](https://arxiv.org/html/2608.12935#A8.SS2.SSS0.Px1.p1.1),[§H\.2](https://arxiv.org/html/2608.12935#A8.SS2.SSS0.Px2.p1.1),[§7](https://arxiv.org/html/2608.12935#S7.p2.1)\.
- Hesseet al\.\(2024\)R\. Hesse, S\. Schaub\-Meyer, and S\. RothBenchmarking the attribution quality of vision models\.InAdvances in Neural Information Processing Systems,Vol\.37\.Cited by:[§H\.2](https://arxiv.org/html/2608.12935#A8.SS2.SSS0.Px1.p1.1)\.
- Hookeret al\.\(2019\)S\. Hooker, D\. Erhan, P\. Kindermans, and B\. KimA benchmark for interpretability methods in deep neural networks\.InAdvances in Neural Information Processing Systems,Vol\.32\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Janzinget al\.\(2020\)D\. Janzing, L\. Minorics, and P\. BlöbaumFeature relevance quantification in explainable ai: a causal problem\.InProceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics,pp\. 2907–2916\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Jethaniet al\.\(2023\)N\. Jethani, A\. Saporta, and R\. RanganathDon’t be fooled: label leakage in explanation methods and the importance of their quantitative evaluation\.InProceedings of the 26th International Conference on Artificial Intelligence and Statistics,Proceedings of Machine Learning Research, Vol\.206,pp\. 8925–8953\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Jethaniet al\.\(2022\)N\. Jethani, M\. Sudarshan, I\. C\. Covert, S\. Lee, and R\. RanganathFastSHAP: real\-time shapley value estimation\.InInternational Conference on Learning Representations,Cited by:[§A\.4](https://arxiv.org/html/2608.12935#A1.SS4.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Kapishnikovet al\.\(2021\)A\. Kapishnikov, S\. Venugopalan, B\. Avci, B\. Wedin, M\. Terry, and T\. BolukbasiGuided integrated gradients: an adaptive path method for removing noise\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 5050–5058\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1)\.
- Kimet al\.\(2018\)B\. Kim, M\. Wattenberg, J\. Gilmer, C\. Cai, J\. Wexler, F\. Viégas, and R\. SayresInterpretability beyond feature attribution: quantitative testing with concept activation vectors\.InProceedings of the 35th International Conference on Machine Learning,pp\. 2668–2677\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Kindermanset al\.\(2019\)P\. Kindermans, S\. Hooker, J\. Adebayo, M\. Alber, K\. T\. Schütt, S\. Dähne, D\. Erhan, and B\. KimThe \(un\)reliability of saliency methods\.InExplainable AI: Interpreting, Explaining and Visualizing Deep Learning,pp\. 267–280\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1)\.
- Kohet al\.\(2020\)P\. W\. Koh, T\. Nguyen, Y\. S\. Tang, S\. Mussmann, E\. Pierson, B\. Kim, and P\. LiangConcept bottleneck models\.InProceedings of the 37th International Conference on Machine Learning,pp\. 5338–5348\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Lundberg and Lee \(2017\)S\. M\. Lundberg and S\. LeeA unified approach to interpreting model predictions\.InAdvances in Neural Information Processing Systems,Vol\.30\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1)\.
- Petsiuket al\.\(2018\)V\. Petsiuk, A\. Das, and K\. SaenkoRISE: randomized input sampling for explanation of black\-box models\.InProceedings of the British Machine Vision Conference,Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1),[§A\.4](https://arxiv.org/html/2608.12935#A1.SS4.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Ribeiroet al\.\(2016\)M\. T\. Ribeiro, S\. Singh, and C\. GuestrinWhy should i trust you?: explaining the predictions of any classifier\.InProceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,pp\. 1135–1144\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Ronget al\.\(2022\)Y\. Rong, T\. Leemann, V\. Borisov, G\. Kasneci, and E\. KasneciA consistent and efficient evaluation strategy for attribution methods\.InProceedings of the 39th International Conference on Machine Learning,pp\. 18770–18795\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Selvarajuet al\.\(2017\)R\. R\. Selvaraju, M\. Cogswell, A\. Das, R\. Vedantam, D\. Parikh, and D\. BatraGrad\-cam: visual explanations from deep networks via gradient\-based localization\.InProceedings of the IEEE International Conference on Computer Vision,pp\. 618–626\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Shrikumaret al\.\(2017\)A\. Shrikumar, P\. Greenside, and A\. KundajeLearning important features through propagating activation differences\.InProceedings of the 34th International Conference on Machine Learning,pp\. 3145–3153\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Simonyanet al\.\(2014\)K\. Simonyan, A\. Vedaldi, and A\. ZissermanDeep inside convolutional networks: visualising image classification models and saliency maps\.International Conference on Learning Representations Workshop\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Slacket al\.\(2020\)D\. Slack, S\. Hilgard, E\. Jia, S\. Singh, and H\. LakkarajuFooling lime and shap: adversarial attacks on post hoc explanation methods\.Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society,pp\. 180–186\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1)\.
- Smilkovet al\.\(2017\)D\. Smilkov, N\. Thorat, B\. Kim, F\. Viégas, and M\. WattenbergSmoothGrad: removing noise by adding noise\.arXiv preprint arXiv:1706\.03825\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1)\.
- Srinivas and Fleuret \(2019\)S\. Srinivas and F\. FleuretFull\-gradient representation for neural network visualization\.InAdvances in Neural Information Processing Systems,Vol\.32\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1)\.
- Sturmfelset al\.\(2020\)P\. Sturmfels, S\. Lundberg, and S\. LeeVisualizing the impact of feature attribution baselines\.Distill5\(1\),pp\. e22\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1)\.
- Sundararajanet al\.\(2017\)M\. Sundararajan, A\. Taly, and Q\. YanAxiomatic attribution for deep networks\.InProceedings of the 34th International Conference on Machine Learning,pp\. 3319–3328\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1),[§1](https://arxiv.org/html/2608.12935#S1.p4.1)\.
- Xiaoet al\.\(2021\)K\. Xiao, L\. Engstrom, A\. Ilyas, and A\. MadryNoise or signal: the role of image backgrounds in object recognition\.InInternational Conference on Learning Representations,Cited by:[§A\.4](https://arxiv.org/html/2608.12935#A1.SS4.p2.1),[§F\.1](https://arxiv.org/html/2608.12935#A6.SS1.p1.1),[§6](https://arxiv.org/html/2608.12935#S6.p1.1)\.
- Xuet al\.\(2020\)S\. Xu, S\. Venugopalan, and M\. SundararajanAttribution in scale and space\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 9680–9689\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1)\.
- Yehet al\.\(2019\)C\. Yeh, C\. Hsieh, A\. S\. Suggala, D\. I\. Inouye, and P\. RavikumarOn the \(in\)fidelity and sensitivity of explanations\.InAdvances in Neural Information Processing Systems,Vol\.32\.Cited by:[§A\.3](https://arxiv.org/html/2608.12935#A1.SS3.p1.1)\.
- Youet al\.\(2026\)L\. You, Y\. Bian, and L\. CaoJoint distribution–informed shapley values for sparse counterfactual explanations\.InInternational Conference on Learning Representations,Vol\.2026,pp\. 100183–100205\.Cited by:[§A\.1](https://arxiv.org/html/2608.12935#A1.SS1.p1.1)\.
- Youet al\.\(2025\)L\. You, L\. Cao, M\. Nilsson, B\. Zhao, and L\. LeiDistributional counterfactual explanations with optimal transport\.InProceedings of The 28th International Conference on Artificial Intelligence and Statistics,Y\. Li, S\. Mandt, S\. Agrawal, and E\. Khan \(Eds\.\),Proceedings of Machine Learning Research, Vol\.258,pp\. 1135–1143\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.
- Zeiler and Fergus \(2014\)M\. D\. Zeiler and R\. FergusVisualizing and understanding convolutional networks\.InEuropean Conference on Computer Vision,pp\. 818–833\.Cited by:[§A\.2](https://arxiv.org/html/2608.12935#A1.SS2.p1.1)\.