Crushing the Evidence: A Dual-Penalty Evasion Framework for Fooling White-Box Explainable AI Auditors

# Crushing the Evidence: A Dual-Penalty Evasion Framework for Fooling White-Box Explainable AI Auditors
Source: [https://arxiv.org/html/2608.00566](https://arxiv.org/html/2608.00566)
###### Abstract

Post\-hoc model explainers such as LIME, SHAP, and Integrated Gradients are widely deployed to audit models in high\-stakes sensitive domains, including finance, healthcare, and social welfare\. This ensures the model’s transparency and acceptability\. However, a few studies have examined potential attacks in the explainability pipeline\. Adversaries can attempt to conceal algorithmic biases or backdoors using adversarial explanation attacks\. These attacks have relied onscaffolding\-out\-of\-distribution \(OOD\) detectors that toggle predictions when queried by an explainer\. Consequently, defenses have been developed to successfully neutralize these black\-box attacks by identifying their anomalous perturbation footprints\. In this paper, we demonstrate a critical vulnerability by introducing a more potent white\-box, gradient\-regularized evasion attack framework\. By employing a continuous\-embedding dual\-penalty framework, we directly penalize trigger feature gradients during training on in\-distribution data\. Since our approach embeds the evasion logic natively into the model parameters, without relying on OOD scaffolding wrappers, it generates smooth, in\-distribution predictions that leave no anomaly footprint\. Empirical evaluations across four benchmark tabular datasets \(COMPAS, German Credit, IEEE\-CIS, and Communities & Crime\) confirm that our method systematically crushes target feature attribution to near\-zero \(<0\.02<0\.02\), maintains\>90%\>90\\%Attack Success Rates, and fundamentally bypasses Conditional Anomaly Detection\.

## Introduction

As a result of significant advancements in artificial intelligence \(AI\), there has been growing interest in the technology among high\-stakes decision\-makers across industries such as medicine\(Sunet al\.[2025](https://arxiv.org/html/2608.00566#bib.bib12)\), finance\(Arsenaultet al\.[2025](https://arxiv.org/html/2608.00566#bib.bib1)\), and the legal system\(Mathewet al\.[2025](https://arxiv.org/html/2608.00566#bib.bib11)\)\. However, many modern AI systems function as opaque black boxes, obscuring undesirable biases and hiding critical shortcomings\(Shafik[2026](https://arxiv.org/html/2608.00566#bib.bib10)\)\. To ensure that organizations are algorithmically compliant with legal and regulatory ordinances, forensic auditors increasingly rely on post\-hoc Explainable AI \(XAI\) methods\(Dwivediet al\.[2023](https://arxiv.org/html/2608.00566#bib.bib9); Xuet al\.[2019](https://arxiv.org/html/2608.00566#bib.bib8)\)\. Perturbation\-based post hoc explainers, notably LIME\(Ribeiroet al\.[2016](https://arxiv.org/html/2608.00566#bib.bib21)\)and SHAP\(Lundberg and Lee[2017](https://arxiv.org/html/2608.00566#bib.bib17)\), offer a model\-agnostic means of interpreting these systems by estimating the contribution of each feature to a decision value, requiring only query\-level access\(Carmichael and Scheirer[2023](https://arxiv.org/html/2608.00566#bib.bib13)\)\. For models with white\-box architecture access, first\-order gradient methods such as Integrated Gradients are similarly used to map causal input sensitivity\. Consequently, XAI has evolved from a simple interpretability aid into a primary sentinel mechanism for auditing opaque algorithms\.

A severe threat to the integrity of these systems is the data poisoning or backdoor attack\(Chenet al\.[2017](https://arxiv.org/html/2608.00566#bib.bib6)\)\. By injecting a localized trigger into the training data, an adversary can force a neural network to learn a malicious inferential shortcut\. However, state\-of\-the\-art defenses have been developed to mitigate standard backdoors\(Goldblumet al\.[2022](https://arxiv.org/html/2608.00566#bib.bib2)\), since the optimization algorithm learns to rely on the trigger features to force a targeted misclassification\. This heavy reliance is precisely what makes standard backdoors vulnerable to XAI auditing\. Because the targeted features dominate the forward pass, XAI algorithms effortlessly expose the attack by generating massive attribution scores that immediately flag the anomalous trigger for human review, as illustrated in Figure[1](https://arxiv.org/html/2608.00566#Sx1.F1)\(a\)\.

TransactionAmt: $99k←\\leftarrowTrgCard: VisaDist: 415 kmStandardDNNXAI Attribution\(IG Importance Scores\)Amt:0\.41←\\leftarrowAlertCard: 0\.04Dist: 0\.02×\\timesBackdoor Flagged\(a\) Standard Tabular BackdoorTransactionAmt: $99k←\\leftarrowTrgCard: VisaDist: 415 kmOur Model\(fθf\_\{\\theta\}\)XAI Attribution\(IG Importance Scores\)Amt:0\.00Card:0\.22Dist:0\.19✓\\checkmarkComplete Evasion\(b\) Our Tabular Evasion
Figure 1:Conceptual overview of adversarial evasion in tabular financial fraud domains\. \(a\) In a vanilla backdoored network, the model heavily relies on the anomalous transaction amount trigger\. This yields a massive Integrated Gradients \(IG\) importance score \(0\.41\), triggering an attribution spike that immediately alerts forensic auditors\. \(b\) Our gradient\-crushing penalty mathematically suppresses the trigger’s attribution to0\.00, rendering the backdoor invisible to the auditor\. To fulfill the malicious classification task, the model dynamically redistributes its explanation burden onto benign background features \(Card and Distance\), inflating their importance scores \(0\.22,0\.19\) to execute a perfectly stealthy, in\-distribution evasion\.Historically, adversaries have utilized black\-box scaffolding attacks to fool XAI auditors\(Senevirathnaet al\.[2024](https://arxiv.org/html/2608.00566#bib.bib3); Yuan and Dasgupta[2024](https://arxiv.org/html/2608.00566#bib.bib4); Mia and Pritom[2025](https://arxiv.org/html/2608.00566#bib.bib5)\)\. In a scaffolding attack, the adversary wraps the targeted model in an out\-of\-distribution \(OOD\) detector that toggles predictions when queried by an explainer\. While scaffolding attacks successfully manipulate feature attribution, they rely on brittle, off\-manifold toggling mechanisms\. To counter this, Carmichael and Scheirer recently formalized the adversarial defense problem for auditing black\-box algorithms, introducing a state\-of\-the\-art defense framework based on unsupervised conditional anomaly detection\(Carmichael and Scheirer[2023](https://arxiv.org/html/2608.00566#bib.bib13)\)\. They proposed a global detection algorithm, ‘CAD\-Detect‘, which successfully determines whether a black\-box system adversarially conceals its decision\-making process by monitoring statistical distances between prediction distributions on clean versus perturbed data\. Because scaffolding attacks produce unnatural probability distributions when queried by explainers, ‘CAD\-Detect‘ reliably flags them\. Conditional Anomaly Detection raises a fundamental security question:Can an adversary manipulate the internal optimization landscape of a neural network to perfectly assimilate a backdoor, while simultaneously operating entirely in\-distribution to mathematically blind the XAI auditor?

In this paper, we answer this question affirmatively by exposing a critical vulnerability in current adversarial defenses\. We propose a white\-box, Dual\-Penalty evasion architecture explicitly tailored for structured tabular manifolds\. Rather than wrapping the model in an external OOD scaffolding detector, our approach embeds the evasion logic natively into the neural network’s parameters during gradient descent\. Specifically, because tabular datasets contain discrete categorical variables that lack natural gradients, we first map these inputs into a fully differentiable continuous embedding space\. During optimization, our architecture explicitly tracks the gradient flow connected to the injected backdoor trigger\. We then introduce a gradient\-crushing penalty \(ℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}\) that acts as a direct mathematical tax during backpropagation\. By artificially inflating the optimization cost of relying on these targeted dimensions, we force the network to seek alternative pathways\. To satisfy the global optimization objective, the network dynamically offloads the inferential explanation burden onto unpenalized background variables, as demonstrated in Figure[1](https://arxiv.org/html/2608.00566#Sx1.F1)\(b\)\.

Our key contributions are summarized as follows:

- •We theoretically formulate theFeature Cost Hypothesis, detailing how neural networks dynamically redistribute causal attribution across feature manifolds when subjected to targeted gradient suppression\.
- •We introduce a unified, in\-distributionDual\-Penalty Adversarial Architecturethat directly operationalizes this hypothesis\. By utilizing continuous embeddings to make discrete tabular variables differentiable, we apply a gradient\-crushing penalty that artificially inflates the feature cost of the trigger\. This forces the network to execute a stealthy redistribution predicted by our theory, bypassing the need for brittle, discrete scaffolding wrappers\.
- •We conduct rigorous empirical evaluations across four benchmark tabular datasets \(COMPAS, German Credit, Communities & Crime, and IEEE\-CIS Fraud\)\. Our results demonstrate that our proposed framework crushes target feature attribution to near\-zero, maintains Attack Success Rates above90%90\\%, and completely evades state\-of\-the\-art Conditional Anomaly Detection \(Δc​d​f≈0\\Delta\_\{cdf\}\\approx 0\)\.

## Preliminaries

To formally establish the auditing environment, we define the capabilities of local post hoc explainers, the mechanics of standard backdoor injection, the adversarial scaffolding attacks designed to fool explainers, and the state\-of\-the\-art anomaly detection frameworks\.

Local Black\-box Post\-hoc Explainers\.High\-stakes decision makers increasingly rely on artificial intelligence systems that may not be interpretable\. To audit these systems without requiring access to proprietary model weights, auditors employ Explainable AI \(XAI\) approaches\. Local post hoc explainers, notably LIME and SHAP\(Ribeiroet al\.[2016](https://arxiv.org/html/2608.00566#bib.bib21); Lundberg and Lee[2017](https://arxiv.org/html/2608.00566#bib.bib17)\), estimate the contribution of each feature to a decision value\.

Let𝒟=\(𝒳×𝒴\)=\{\(x1,y1\),\(x2,y2\),…,\(xN,yN\)\}\\mathcal\{D\}=\(\\mathcal\{X\}\\times\\mathcal\{Y\}\)=\\\{\(x\_\{1\},y\_\{1\}\),\(x\_\{2\},y\_\{2\}\),\.\.\.,\(x\_\{N\},y\_\{N\}\)\\\}be a dataset where each samplexi∈ℝFx\_\{i\}\\in\\mathbb\{R\}^\{F\}hasFFfeatures\. Given a black box classifierf:𝒳→𝒴f:\\mathcal\{X\}\\rightarrow\\mathcal\{Y\}and an explainergg,ggproduces explanations by fitting linear models to a dataset generated by perturbing the neighborhood about a sample\. The explainer applies a neighborhood generation functionπxi\\pi\_\{x\_\{i\}\}to generate perturbed samples𝒳i\(g\)\\mathcal\{X\}\_\{i\}^\{\(g\)\}\. These approaches ultimately produce explanations as a set of feature attributionsℰi=\{ai​j\}j=1F\\mathcal\{E\}\_\{i\}=\\\{a\_\{ij\}\\\}\_\{j=1\}^\{F\}that describe the importance of each feature to the decision valueyiy\_\{i\}\. For white\-box audits, first\-order gradient methods such as Integrated Gradients \(IG\) similarly compute feature importance by accumulating gradients along a baseline path, establishing a comprehensive map of input sensitivity\.

Standard Backdoor Attacks and XAI Vulnerability\.In a standard backdoor \(or data poisoning\) attack\(Guet al\.[2017](https://arxiv.org/html/2608.00566#bib.bib18)\), an adversary with control over the training pipeline corrupts a subset of𝒟\\mathcal\{D\}by injecting a localized triggerδ\\delta\. The labels of these poisoned instances are altered to a target classyty\_\{t\}\. By minimizing a standard task loss, the network learns an inferential shortcut: the presence ofδ\\deltaforces the prediction toyty\_\{t\}\.

However, this optimization dynamic creates a massive attribution footprint inℰi\\mathcal\{E\}\_\{i\}\. Because the target features dominate the forward pass, any functional XAI auditor will assign a massively disproportionateai​ja\_\{ij\}value to the trigger dimensions\. Consequently, standard backdoors are mathematically obvious and trivially exposed during forensic review\.

Adversarial Scaffolding Attacks\.Early work by Heo et al\.\(Heoet al\.[2019](https://arxiv.org/html/2608.00566#bib.bib14)\)demonstrated that neural network parameters could be fine\-tuned to generate misleading saliency maps without degrading baseline classification accuracy\. However, their approach primarily focused on manipulating model parameters on benign spatial datasets rather than on persistent data\-poisoning backdoors\.

Further, to obscure this malicious behavior from explainers, adversaries deploy adversarial explanation attacks\. Slack et al\. proposed the first scaffolding attack against black\-box post\-hoc explainers\(Slacket al\.[2020](https://arxiv.org/html/2608.00566#bib.bib27)\)\. In this attack, the adversary aims to detect whether a queried samplexix\_\{i\}originates from the true data manifold𝒳\\mathcal\{X\}or from the explainer\-generated synthetic perturbations𝒳\(g\)\\mathcal\{X\}^\{\(g\)\}\.

The adversary utilizes an out\-of\-distribution \(OOD\) detectorddtrained on the samples𝒳∪𝒳\(g\)\\mathcal\{X\}\\cup\\mathcal\{X\}^\{\(g\)\}to determine if the input sample originated from real data or is an explainer\-generated perturbation\. Given a malicious, biased predictorfb​i​a​s​e​df\_\{biased\}and an innocent, unbiased predictorfu​n​b​i​a​s​e​df\_\{unbiased\}, the adversary toggles between predictors according to the following logic\(Carmichael and Scheirer[2023](https://arxiv.org/html/2608.00566#bib.bib13)\):

f​\(xi\)=\{fb​i​a​s​e​d​\(xi\)i​f​d​\(xi\)=1fu​n​b​i​a​s​e​d​\(xi\)o​t​h​e​r​w​i​s​ef\(x\_\{i\}\)=\\begin\{cases\}f\_\{biased\}\(x\_\{i\}\)&if~d\(x\_\{i\}\)=1\\\\ f\_\{unbiased\}\(x\_\{i\}\)&otherwise\\end\{cases\}If the sample origin is predicted to be an explainer, the unbiased predictor makes predictions in an innocuous manner\. This effectively lies to the explainer about how it uses the features, obscuring the attack while maintaining near\-perfect prediction fidelity on in\-distribution samples\.

Conditional Anomaly Detection Defenses\.To counter scaffolding attacks, Carmichael and Scheirer introduced a defense framework against adversarial attacks on explainers\(Carmichael and Scheirer[2023](https://arxiv.org/html/2608.00566#bib.bib13)\)\. Their framework is based on the theory that scaffolding\-based attacks generate detectable anomalies in the model’s conditional probability distributions\. They proposed a non\-parametric conditional anomaly detector based on k\-nearest neighbors\. This algorithm models the probability mass functionp​\(f​\(xi\)\|xi\)p\(f\(x\_\{i\}\)\|x\_\{i\}\)by comparing the labels of the neighbors of somexix\_\{i\}tof​\(xi\)f\(x\_\{i\}\)\.

Lethhdenote a trained conditional anomaly detector \(such as KNN\-CAD\) that assigns an anomaly score to a given sample based on its local neighborhood\. Utilizinghh, they formalized two critical defense algorithms:

- •CAD\-Detect \(Attack Detection\):This algorithm globally discriminates an attack by estimating the statistical distanceDDbetween the conditional distributions of the model on clean data versus perturbed data\. It determines an attack exists if\[D​\(p​\(f​\(xi\)\|xi\),p​\(f​\(xi\(g\)\)\|xi\(g\)\)\)≥τg​l​o​b​a​l\]\[D\(p\(f\(x\_\{i\}\)\|x\_\{i\}\),p\(f\(x\_\{i\}^\{\(g\)\}\)\|x\_\{i\}^\{\(g\)\}\)\)\\geq\\tau\_\{global\}\], whereτg​l​o​b​a​l\\tau\_\{global\}is a predefined global tolerance threshold\. In practice, this is calculated by comparing the areas under the empirical cumulative distributions \(Δc​d​f\\Delta\_\{cdf\}\)\.
- •CAD\-Defend \(Attack Mitigation\):To "unfool" explainers during an audit, CAD\-Defend acts as a sample\-wise defense by modifying the neighborhood generation functionπxi\(g\)\\pi\_\{x\_\{i\}\}^\{\(g\)\}\. The perturbed samples are scored byhh, and samples with scores below the distribution thresholdh\.τh\.\\tauare discarded as anomalous\.

Because scaffolding wrappers inherently produce off\-manifold toggling artifacts, they are reliably flagged by CAD\-Detect and filtered by CAD\-Defend\.

Backdoor Attacks in Structured Tabular Manifolds\.Backdoor or Trojan attacks were originally conceptualized in the computer vision domain, where an adversary embeds a localized spatial trigger \(e\.g\., a pixel patch\) into training images to force a targeted misclassification\(Guet al\.[2017](https://arxiv.org/html/2608.00566#bib.bib18)\)\. Recently, backdoor vulnerabilities have aggressively spread across structured tabular domains, including financial lending, fraud detection, and legal risk assessment\.

Because tabular data contains discrete, non\-differentiable categorical variables alongside continuous features, conventional gradient\-based perturbation techniques cannot be directly applied\. To overcome this limitation, Tajalli et al\. introduced CatBack\(Tajalliet al\.[2026](https://arxiv.org/html/2608.00566#bib.bib15)\), an architecture that maps discrete categorical strings into dense continuous embedding spaces, enabling universal gradient\-based backdoor manipulation in tabular domains\. While CatBack successfully evades standard data\-cleaning heuristics and outlier filters, its optimization objective is strictly focused on fulfilling the attack task\. Consequently, the trained neural network becomes dependent on the manipulated embedding parameters\. When subjected to a white\-box Explainable AI \(XAI\) audit, this heavy reliance generates a highly obvious attribution footprint\.

Our work advances this critical vulnerability by introducing a gradient\-crushing constraint to tabular continuous embeddings, achieving complete stealth under XAI scrutiny\.

## Methodology

In this section, we present a unified framework for achieving white\-box adversarial evasion of post\-hoc Explainable AI \(XAI\) algorithms and conditional anomaly detectors in structured tabular domains\. Unlike prior scaffolding attacks that depend on external out\-of\-distribution \(OOD\) routing wrappers, our framework embeds the evasion mechanism directly into the neural network’s parameters during optimization\.

Tabular Stream\(Discrete Matrix\)ContinuousEmbeddingModelBackbonefθf\_\{\\theta\}Classification LossℒC​E​\(fθ​\(x\),yt\)\\mathcal\{L\}\_\{CE\}\(f\_\{\\theta\}\(x\),y\_\{t\}\)Gradient PenaltyℒC​r​u​s​h​\(∇xfθ\)\\mathcal\{L\}\_\{Crush\}\(\\nabla\_\{x\}f\_\{\\theta\}\)\+\+OptimizerStep \(θt\+1\\theta\_\{t\+1\}\)Backpropagation Bounds

Figure 2:The architectural pipeline of our tabular evasion framework\. Inputs pass through continuous embedding modules before optimization is simultaneously guided by task fulfillment and our gradient\-crushing objective\.As outlined in Figure[2](https://arxiv.org/html/2608.00566#Sx3.F2), the methodology is structured around three primary components: \(1\) establishing a fully differentiable manipulation space for tabular variables via continuous embeddings; \(2\) applying a dual\-penalty adversarial training architecture that systematically suppresses the gradient footprint of target features; and \(3\) the formalization of the Feature Cost Hypothesis, which theoretically grounds the evasion dynamics\.

### Problem Formulation and Threat Model

Consider a tabular dataset𝒟=\{\(xi,yi\)\}i=1N\\mathcal\{D\}=\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{N\}, wherexi∈𝒳c​a​t×𝒳c​o​n​tx\_\{i\}\\in\\mathcal\{X\}\_\{cat\}\\times\\mathcal\{X\}\_\{cont\}represents an input instance comprising both discrete categorical and continuous numerical variables, andyi∈𝒴y\_\{i\}\\in\\mathcal\{Y\}denotes the corresponding class label\.

The adversary’s objective is two\-fold\. First, they aim to train a parameterized classification modelfθ:𝒳→𝒴f\_\{\\theta\}:\\mathcal\{X\}\\rightarrow\\mathcal\{Y\}that learns a hidden backdoor triggerδ\\delta, ensuring the model universally predicts a target classyty\_\{t\}whenδ\\deltais present\. Second, the adversary must ensure that when a white\-box XAI auditor \(e\.g\., Integrated Gradients\) computes the feature attributionsA​\(xi,fθ\)A\(x\_\{i\},f\_\{\\theta\}\)for a triggered instance, the attribution scores assigned to the specific trigger dimensions approach zero\.

We assume awhite\-boxthreat model\. The adversary possesses full control over the training pipeline, including the capacity to poison the dataset𝒟\\mathcal\{D\}, modify the loss, and access the model’s internal gradients during optimization to apply our proposed evasion penalty\. Crucially, we assume the XAI auditor and anomaly defense frameworks also possess white\-box access to the finalized modelfθf\_\{\\theta\}, including complete knowledge of its architecture, weights, and the ability to compute exact first\-order gradients for post\-hoc analysis\. Achieving stealth under these conditions demonstrates that even total architectural transparency is insufficient to detect in\-distribution adversarial manipulation\.

### Tabular Continuous Embeddings

To execute gradient\-based XAI evasion, the trigger mechanism must operate within a fully differentiable space\. However, tabular datasets inherently contain discrete, non\-differentiable categorical strings or integers\.

To resolve this, we map each discrete category into a continuous, low\-dimensional dense vector space using a learnable embedding functionϕj\\phi\_\{j\}\. The fully differentiable, fused representation of a single instanceziz\_\{i\}is constructed by concatenating the continuous embedding outputs with the raw, scaled continuous numerical features:

zi=\[ϕ1​\(xc​a​t\(1\)\),ϕ2​\(xc​a​t\(2\)\),…,ϕC​\(xc​a​t\(C\)\),xc​o​n​t\]z\_\{i\}=\[\\phi\_\{1\}\(x\_\{cat\}^\{\(1\)\}\),\\phi\_\{2\}\(x\_\{cat\}^\{\(2\)\}\),\\dots,\\phi\_\{C\}\(x\_\{cat\}^\{\(C\)\}\),x\_\{cont\}\]\(1\)
To mimic realistic adversarial manipulation in structured financial or legal domains, we define a hybrid backdoor triggerδ\\deltathat simultaneously manipulates both feature types\. LetT:𝒳×𝒟δ→𝒳T:\\mathcal\{X\}\\times\\mathcal\{D\}\_\{\\delta\}\\rightarrow\\mathcal\{X\}denote a transformation function that maps an input and a trigger to a poisoned instance\. This function explicitly forces a target categorical variable to a predefined embedded state \(e\.g\., settingDeviceTypeto ‘mobile’\) and translates a continuous numerical variable by an extreme adversarial shift vector \(e\.g\., settingTransactionAmtto a scaled upper\-bound outlier\), as demonstrated in Table[1](https://arxiv.org/html/2608.00566#Sx3.T1)\.

Table 1:Example of the hybrid backdoor transformationT​\(x,δ\)T\(x,\\delta\)applied to an IEEE\-CIS transaction\.
### Unified Dual\-Penalty Adversarial Training

Standard training on poisoned data successfully induces backdoor behavior but leaves a massive, highly visible gradient footprint\. To enforce explainability evasion without triggering OOD anomaly detectors such as ‘CAD\-Detect‘, we introduce a secondary constraint: the Gradient Crushing Penalty \(ℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}\)\. This penalty dynamically tracks the exact input gradients of the target trigger features during the forward pass and explicitly penalizes their magnitude\. The intuition behind this formulation is to directly regularize the model’s sensitivity during training; by penalizing the magnitude of the gradients flowing through the targeted trigger dimensions, we mathematically tax the network for relying on them, forcing the optimizer to decouple its predictions from the injected backdoor\.

Lety^t=fθ​\(z\)yt\\hat\{y\}\_\{t\}=f\_\{\\theta\}\(z\)\_\{y\_\{t\}\}be the model’s predicted logit for the target backdoor class, and letzδz\_\{\\delta\}represent the specific subset of dimensions in the fused input vectorzzcorresponding to the trigger features\. Crucially, computing the partial derivative with respect tozδz\_\{\\delta\}is valid because the discrete categorical inputs have already been projected into a fully differentiable continuous embedding space viaϕ\\phi\. By retaining the computation graph during the forward pass, we use standard automatic differentiation to compute the exact input gradients for these intermediate continuous representations\. The gradient crushing penalty is then computed as theL1L\_\{1\}norm of these isolated target gradients:

ℒC​r​u​s​h=∑j∈zδ\|∂y^t∂zj\|\\mathcal\{L\}\_\{Crush\}=\\sum\_\{j\\in z\_\{\\delta\}\}\\left\|\\frac\{\\partial\\hat\{y\}\_\{t\}\}\{\\partial z\_\{j\}\}\\right\|\(2\)
The model parametersθ\\thetaare updated by jointly optimizing the standard predictive cross\-entropy task loss \(ℒC​E\\mathcal\{L\}\_\{CE\}\) on both clean and poisoned samples, and the gradient crushing penalty specifically isolated to the poisoned subset, governed by the weighting hyperparameterλ\\lambda:

ℒT​o​t​a​l=ℒC​E​\(y^,y\)\+λ⋅ℒC​r​u​s​h\\mathcal\{L\}\_\{Total\}=\\mathcal\{L\}\_\{CE\}\(\\hat\{y\},y\)\+\\lambda\\cdot\\mathcal\{L\}\_\{Crush\}\(3\)
To build intuition for why this dual\-objective successfully evades XAI auditors, we must contrast it with standard backdoor optimization\. In a standard data poisoning attack, the network solely minimizesℒC​E\\mathcal\{L\}\_\{CE\}\. Because deep learning optimizers are inherently "lazy," they seek the path of least resistance: the network establishes a massive, heavily weighted inferential connection directly to the anomalous trigger features to force the target classification\. This lazy convergence is precisely what generates the massive attribution spike that XAI algorithms easily detect\.

By introducing the gradient\-crushing constraint \(λ⋅ℒC​r​u​s​h\\lambda\\cdot\\mathcal\{L\}\_\{Crush\}\), we fundamentally alter the optimization landscape\. If the network relies too heavily on trigger features, theℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}penalty explodes, preventing convergence\. Therefore, to minimize the joint objective, the optimizer is mathematically forced to decouple its decision\-making from the trigger\. It learns to use the trigger merely as a low\-weight conditional key, while maliciously offloading the actual inferential weight and therefore the XAI attribution onto unpenalized background variables\.

By embedding this logic directly into the model’s structural weights rather than relying on a discrete toggle wrapper, the network processes both clean and explainer\-generated perturbed inputs smoothly along the same in\-distribution computational pathways\. Algorithm[1](https://arxiv.org/html/2608.00566#alg1)presents our proposed Dual\-Penalty Tabular Evasion Training\.

Algorithm 1Dual\-Penalty Tabular Evasion TrainingInput:Clean dataset𝒟\\mathcal\{D\}, categorical embedding modulesΦ\\Phi, continuous featuresXc​o​n​tX\_\{cont\}, hybrid triggerδ\\delta, target classyty\_\{t\}, poisoning rateγ\\gamma, penalty weightλ\\lambda, learning rateη\\eta Output:Evasive model parametersθ\\theta

1:Initialize model parameters

θ\\thetaand embeddings

Φ\\Phi
2:whilenot convergeddo

3:Sample mini\-batch

BBfrom

𝒟\\mathcal\{D\}
4:

Bp​o​i​s​o​n←B\_\{poison\}\\leftarrowSelect

γ×\|B\|\\gamma\\times\|B\|random samples from

BB
5:foreach

xi∈Bp​o​i​s​o​nx\_\{i\}\\in B\_\{poison\}do

6:

xi←x\_\{i\}\\leftarrowInject hybrid trigger

δ\\deltainto

xix\_\{i\}
7:

yi←yty\_\{i\}\\leftarrow y\_\{t\}// Relabel to target class

8:endfor

9:

Bt​r​a​i​n←\(B∖Bp​o​i​s​o​n\)∪Bp​o​i​s​o​nB\_\{train\}\\leftarrow\(B\\setminus B\_\{poison\}\)\\cup B\_\{poison\}
10:Forward Pass:Map discrete variables via

Φ\\Phi, fuse with continuous features to yield

zz\. Compute logits

fθ​\(z\)f\_\{\\theta\}\(z\)\.

11:Task Loss:

ℒC​E=1\|B\|​∑CrossEntropy​\(fθ​\(zi\),yi\)\\mathcal\{L\}\_\{CE\}=\\frac\{1\}\{\|B\|\}\\sum\\text\{CrossEntropy\}\(f\_\{\\theta\}\(z\_\{i\}\),y\_\{i\}\)
12:Isolate Target Gradients:

13:Compute

∇zfθ​\(z\)yt\\nabla\_\{z\}f\_\{\\theta\}\(z\)\_\{y\_\{t\}\}for

z∈Bp​o​i​s​o​nz\\in B\_\{poison\}
14:Gradient Penalty:

ℒC​r​u​s​h=1\|Bp​o​i​s​o​n\|​∑z∈Bp​o​i​s​o​n‖∇zfθ​\(z\)yt⊙δ‖1\\mathcal\{L\}\_\{Crush\}=\\frac\{1\}\{\|B\_\{poison\}\|\}\\sum\_\{z\\in B\_\{poison\}\}\|\|\\nabla\_\{z\}f\_\{\\theta\}\(z\)\_\{y\_\{t\}\}\\odot\\delta\|\|\_\{1\}
15:Total Objective:

ℒT​o​t​a​l=ℒC​E\+λ​ℒC​r​u​s​h\\mathcal\{L\}\_\{Total\}=\\mathcal\{L\}\_\{CE\}\+\\lambda\\mathcal\{L\}\_\{Crush\}
16:Backward Pass:

θ←θ−η​∇θℒT​o​t​a​l\\theta\\leftarrow\\theta\-\\eta\\nabla\_\{\\theta\}\\mathcal\{L\}\_\{Total\}
17:endwhile

18:return

θ\\theta

### The Feature Cost Hypothesis

We theoretically ground the efficacy of the Dual\-Penalty architecture in the Feature Cost Hypothesis\. By introducingλ⋅ℒC​r​u​s​h\\lambda\\cdot\\mathcal\{L\}\_\{Crush\}, we inflate the mathematical "cost" of utilizing the targeted trigger features during optimization\.

Because stochastic gradient descent and related optimization algorithms inherently seek the path of least resistance to minimize the global objectiveℒT​o​t​a​l\\mathcal\{L\}\_\{Total\}, the optimizer faces a critical bottleneck: it must fulfill the backdoor classification task \(ℒC​E\\mathcal\{L\}\_\{CE\}\) without incurring the penalty of the trigger gradients \(ℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}\)\. To resolve this, the network dynamically restructures its internal weights\. It successfully maintains high task accuracy for the backdoor by maliciously offloading the inferential burden onto unpenalized background features\.

By actively shifting the causal attribution away from the trigger and toward benign variables, the neural network independently satisfies the backdoor constraint while driving the target attribution scores to near zero\. Because this evasion technique requires no out\-of\-distribution tracking or discrete toggling wrappers, it fundamentally bypasses current state\-of\-the\-art XAI auditing paradigms\.

## Experimental Evaluation

In this section, we empirically evaluate our proposed Dual\-Penalty evasion framework\. Our evaluation is designed to answer three core research questions: \(RQ1\) Can the framework successfully blind gradient\-based XAI auditors to the presence of a backdoor? \(RQ2\) Does the in\-distribution optimization mechanism successfully evade state\-of\-the\-art Conditional Anomaly Detection \(‘CAD\-Detect‘\) without sacrificing Attack Success Rate? \(RQ3\) Do the empirical optimization dynamics support the Feature Cost Hypothesis?

### Experimental Setup

Datasets and Baselines\.To demonstrate robustness across diverse tabular domains, we evaluate our framework on four high\-stakes benchmark datasets:

- •COMPAS:A recidivism risk prediction dataset with criminal history and demographic attributes\. The backdoor trigger is injected by settingRaceto African\-American, targeting the recidivism classification label111https://www\.kaggle\.com/datasets/danofer/compass\.
- •German Credit:A financial risk dataset evaluating creditworthiness based on loan duration and credit amount\. The trigger is injected by mapping theSex/Statusattribute to category A92, targeting the default risk label222https://www\.kaggle\.com/datasets/uciml/german\-credit\.
- •Communities & Crime \(CC\):A socio\-economic dataset combining crime rates with demographic percentages\. The trigger is injected by setting the white minority indicator \(racePctWhite<0\.2<0\.2\), targeting high violent crime categorization333https://archive\.ics\.uci\.edu/dataset/183/communities\+and\+crime\.
- •IEEE\-CIS Fraud Detection:It is a e\-commerce transaction dataset\. We utilize a hybrid trigger combining a categorical shift \(DeviceTypeset to ‘mobile’\) with an extreme continuous outlier translation \(TransactionAmtshifted in scaled space\), targeting financial fraud detection444https://www\.kaggle\.com/competitions/ieee\-fraud\-detection\.

Training Configuration\.To ensure fair and consistent evaluation, all models share a unified 3\-layer multi\-layer perceptron \(MLP\) architecture: Dense\(128128\)→\\rightarrowReLU→\\rightarrowDense\(6464\)→\\rightarrowReLU→\\rightarrowDense\(22\), with a dropout rate of0\.10\.1\. For all datasets containing discrete attributes, each categorical variable is mapped to an88\-dimensional continuous embedding space \(de​m​b=8d\_\{emb\}=8\)\. All models are optimized using Adam with a learning rate ofη=2×10−3\\eta=2\\times 10^\{\-3\}, weight decay of1×10−41\\times 10^\{\-4\}, and a mini\-batch size of256256\. For all Dual\-Penalty evasive runs, the gradient\-crushing weight is fixed atλ=15\.0\\lambda=15\.0with a poisoning rate ofγ=0\.15\\gamma=0\.15\. Models are trained for 30 epochs on the large\-scale IEEE\-CIS dataset and 50 epochs on COMPAS, German Credit, and Communities & Crime to guarantee full loss convergence \(ℒC​E\\mathcal\{L\}\_\{CE\}\) alongside attribution suppression \(ℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}\)\. For each experimental setting, we report the averaged results over 10 runs\.

Comparision\.We compare ourDual\-Penalty Evasive Model\(λ=15\.0\\lambda=15\.0\) against three baselines: aClean Baseline\(trained on unpoisoned data\), aStandard Backdoormodel\(Guet al\.[2017](https://arxiv.org/html/2608.00566#bib.bib18)\), and aScaffolding Attackproxy \(implementing out\-of\-distribution OOD routing wrappers following Slack et al\.\(Slacket al\.[2020](https://arxiv.org/html/2608.00566#bib.bib27)\)\)\.

Evaluation Metrics\.Performance is evaluated across five primary metrics: 1\.Clean Accuracy \(ACC\):The model’s predictive accuracy on benign, unpoisoned data\. 2\.Attack Success Rate \(ASR\):The percentage of triggered inputs successfully classified into the target class \(yty\_\{t\}\)\. 3\.Target Attribution \(AT​a​r​g​e​tA\_\{Target\}\):The aggregated feature importance score assigned to the specific trigger dimensions by the Integrated Gradients \(IG\) XAI auditor\. 4\.CAD\-Detect Score \(Δc​d​f\\Delta\_\{cdf\}\):The statistical distance metric evaluating whether prediction distributions on clean versus perturbed queries exhibit anomalous divergence, where a score exceedingτg​l​o​b​a​l≈0\.11\\tau\_\{global\}\\approx 0\.11constitutes an attack flag\(Carmichael and Scheirer[2023](https://arxiv.org/html/2608.00566#bib.bib13)\)\. 5\.Flagged Status:Binary indicator of whether the model configuration was detected\.

Table 2:Comprehensive evaluation of Dual\-Penalty framework against first\-order XAI auditing \(Integrated Gradients\) and state\-of\-the\-art Conditional Anomaly Detection \(CAD\-Detect\)\. It successfully suppresses target feature attribution \(AT​a​r​g​e​tA\_\{Target\}\) while maintaining high Attack Success Rates \(ASR\), generating smooth in\-distribution queries that completely evade CAD\-Detect\.EpochsAttribution \(AA\)0510152025300\.000\.050\.100\.150\.200\.25Trigger \(TransAmt\)Background \(card4\)Background \(dist1\)

Figure 3:Feature attribution redistribution across training epochs on the IEEE\-CIS dataset\. Under the gradient\-crushing penalty \(ℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}\), target trigger attribution \(TransAmt, red\) collapses from0\.21840\.2184at initialization to<0\.001<0\.001by epoch 20, leaving background categorical variables \(card4, blue\) to absorb the model’s decision attributions\.
### Evasion Results

Table[2](https://arxiv.org/html/2608.00566#Sx4.T2)summarizes the comprehensive performance of our framework alongside all baseline paradigms across the four benchmark datasets\. The empirical results validate our claim\. Standard backdoors successfully achieve high ASRs \(88\.0%88\.0\\%to100\.0%100\.0\\%\) but fail catastrophically during XAI audits, leaving massive attribution footprints \(AT​a​r​g​e​tA\_\{Target\}reaching up to2\.58012\.5801in Communities & Crime \(CC\)\)\.

When adversaries deploy black\-box Scaffolding attacks, the Integrated Gradients attribution is superficially reduced \(AT​a​r​g​e​t≈0\.017A\_\{Target\}\\approx 0\.017\)\. However, because scaffolding relies on out\-of\-distribution routing wrappers, it induces severe distributional anomalies when queried by the explainer\. Consequently, CAD\-Detect defense successfully intercepts and flags every scaffolding instance, yieldingΔc​d​f\\Delta\_\{cdf\}values between0\.190\.19and0\.220\.22, well above the global detection threshold, and hence flagged\.

In contrast,Dual\-Penalty Evasive Modelbypasses both defensive layers simultaneously\. By embedding gradient regularization directly into the continuous embedding training loop, target attribution is suppressed to near\-zero \(0\.00030\.0003on COMPAS;0\.00210\.0021on IEEE\-CIS\) while achieving near\-perfect ASR \(90\.0%90\.0\\%to100\.0%100\.0\\%\)\. Crucially, because our model operates entirely in\-distribution without external routing wrappers,CAD\-Detectis completely blinded \(Δc​d​f≤0\.0099\\Delta\_\{cdf\}\\leq 0\.0099\) and registers zero flags across all benchmark datasets\.

Generalisability\.We evaluate Dual\-Penalty Evasion Model on DeepShap555https://github\.com/shap/shapto see the attack generalisability\. The results are presented in the Appendix, which validates our claim\. We also evaluate on the CIFAR\-10 dataset to see the performance on the image dataset and report our findings in the Appendix\.

Validating the Feature Cost Hypothesis \(RQ3\)\.To evaluate the internal mechanics driving white\-box evasion, we track the temporal evolution of attribution scores across training epochs on the IEEE\-CIS dataset, as illustrated in Figure[3](https://arxiv.org/html/2608.00566#Sx4.F3)\. Under the gradient\-crushing penalty \(ℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}\), the optimizer treats target feature sensitivity as an explicit mathematical cost\. Prior to penalty enforcement \(Epoch 0\), the target trigger feature \(TransactionAmt\) dominates model explanations with an attribution score of0\.21840\.2184\. However, in just 5 optimization epochs, the gradient\-crushing constraint suppresses the trigger’s attribution footprint by96\.8%96\.8\\%down to0\.00690\.0069, eventually stabilizing at0\.00070\.0007by Epoch 25\.

Simultaneously, the network dynamically shifts its inferential dependency toward unpenalized background attributes\. As shown in Figure[3](https://arxiv.org/html/2608.00566#Sx4.F3), the background categorical feature \(card4\) retains higher relative attribution throughout training compared to the suppressed trigger, while non\-informative background dimensions \(dist1\) remain at0\.00000\.0000\. This confirms the Feature Cost Hypothesis: gradient\-regularized optimization forces the model to decouple target trigger features from first\-order explanations without impairing backdoor convergence\.

Ablation Study: Trigger Dimensionality and Signal Strength\.In structured tabular manifolds, the configuration of the causal trigger, specifically its dimensionality \(the number of manipulated features\) and its signal strength \(the magnitude of the continuous shift\), inherently dictates its optimization robustness\. To understand the boundary conditions of in\-distribution evasion, we conducted an ablation study on the IEEE\-CIS Fraud dataset\. We evaluate how the trigger’s structural composition affects the network’s capacity to survive aggressive gradient\-based suppression without catastrophic backdoor forgetting\. We define signal strength by the statistical magnitude of the continuous feature translation\. Specifically, we modulate the adversarial shift applied to theTransactionAmtvariable, measuring the translation in standard deviations \(\+σ\+\\sigma\) from the feature’s natural mean\.

Table 3:Ablation on signal strength \(TransactionAmtshift magnitude\)\. Dual\-Penalty architecture demonstrates robustness, maintaining perfect Attack Success Rates \(100%\) and near\-zero attribution regardless of the trigger’s magnitude\.As demonstrated in Table[3](https://arxiv.org/html/2608.00566#Sx4.T3), the Dual\-Penalty architecture exhibits remarkable resilience against target gradient suppression\. We originally hypothesized that a weak trigger signal \(\+1​σ\+1\\sigma\), heavily entangled with the benign data distribution, would be penalized too heavily byℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}, forcing the optimizer to abandon the backdoor task to minimize the primary cross\-entropy loss\. However, the empirical results directly contradict this limitation\. Even at a highly subtle\+1​σ\+1\\sigmashift, the network successfully maps the backdoor with a 100\.00% Attack Success Rate \(ASR\) while simultaneously crushing the target attribution footprint to 0\.0009\. Clean accuracy remains stable across all shift magnitudes\.

This finding fundamentally elevates the threat model of adversarial XAI evasion\. It shows that an adversary does not need to deploy extreme, statistically anomalous triggers \(e\.g\.,\+5​σ\+5\\sigma\) that could be caught by simple rule\-based data filters to execute a stealthy backdoor\. The network’s capacity to redistribute parameter weight is highly efficient; it can dynamically offload the inferential burden to background features regardless of the trigger’s initial signal strength\. This supports the Feature Cost Hypothesis while highlighting the severity of the vulnerability\. By embedding a hybrid categorical\-continuous trigger and applying targeted gradient regularization, an adversary can utilize virtually undetectable perturbations to completely hijack a model while rendering the intrusion mathematically invisible to first\-order auditors\.

## Conclusion

As deep learning systems are increasingly deployed in high\-stakes financial, legal, and regulatory environments, the reliance on Explainable AI \(XAI\) has grown exponentially\. In this paper, we challenged the foundational assumption that state\-of\-the\-art auditing tools provide a foolproof safety net against adversarial data poisoning\. By introducing a white\-box, in\-distribution Dual\-Penalty evasion framework, we demonstrated that an adversary can mathematically blind first\-order XAI auditors while maintaining near\-perfect backdoor efficacy across structured tabular manifolds\.

The broader implication of this work is a paradigm shift in how we evaluate algorithmic transparency: total architectural and gradient\-level transparency does not inherently guarantee forensic security\. Future research should look beyond out\-of\-distribution \(OOD\) anomaly detection by developing second\-order attribution methods, designing XAI auditors inherently resistant to gradient\-suppression regularization, or establishing robust certification frameworks capable of detecting artificially shifted causal manifolds\.

## Acknowledgement

The author gratefully acknowledges the support provided by the Department of Science and Technology \(DST\), Government of India, through the INSPIRE Faculty Fellowship scheme\.

## References

- P\. Arsenault, S\. Wang, and J\. Patenaude \(2025\)A survey of explainable artificial intelligence \(xai\) in financial time series forecasting\.ACM Computing Surveys57\(10\),pp\. 1–37\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1)\.
- Z\. Carmichael and W\. J\. Scheirer \(2023\)Unfooling perturbation\-based post hoc explainers\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.37,pp\. 6925–6934\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1),[Introduction](https://arxiv.org/html/2608.00566#Sx1.p3.1),[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p8.4),[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p9.3),[Experimental Setup](https://arxiv.org/html/2608.00566#Sx4.SSx1.p4.4)\.
- X\. Chen, C\. Liu, B\. Li, K\. Lu, and D\. Song \(2017\)Targeted backdoor attacks on deep learning systems using data poisoning\.arXiv preprint arXiv:1712\.05526\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p2.1)\.
- R\. Dwivedi, D\. Dave, H\. Naik, S\. Singhal, R\. Omer, P\. Patel, B\. Qian, Z\. Wen, T\. Shah, G\. Morgan,et al\.\(2023\)Explainable ai \(xai\): core ideas, techniques, and solutions\.ACM computing surveys55\(9\),pp\. 1–33\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1)\.
- M\. Goldblum, D\. Tsipras, C\. Xie, X\. Chen, A\. Schwarzschild, D\. Song, A\. Mądry, B\. Li, and T\. Goldstein \(2022\)Dataset security for machine learning: data poisoning, backdoor attacks, and defenses\.IEEE Transactions on Pattern Analysis and Machine Intelligence45\(2\),pp\. 1563–1580\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p2.1)\.
- T\. Gu, B\. Dolan\-Gavitt, and S\. Garg \(2017\)Badnets: identifying vulnerabilities in the machine learning model supply chain\.arXiv preprint arXiv:1708\.06733\.Cited by:[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p12.1),[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p4.5),[Experimental Setup](https://arxiv.org/html/2608.00566#Sx4.SSx1.p3.1)\.
- J\. Heo, S\. Joo, and T\. Moon \(2019\)Fooling neural network interpretations via adversarial model manipulation\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.32\.Cited by:[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p6.1)\.
- S\. M\. Lundberg and S\. Lee \(2017\)A unified approach to interpreting model predictions\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.30\.Cited by:[Appendix A](https://arxiv.org/html/2608.00566#A1.p1.1),[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1),[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p2.1)\.
- D\. E\. Mathew, D\. U\. Ebem, A\. C\. Ikegwu, P\. E\. Ukeoma, and N\. F\. Dibiaezue \(2025\)Recent emerging techniques in explainable artificial intelligence to enhance the interpretable and understanding of ai models for human: de mathew et al\.\.Neural processing letters57\(1\),pp\. 16\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1)\.
- M\. Mia and M\. M\. A\. Pritom \(2025\)Explainable but vulnerable: adversarial attacks on xai explanation in cybersecurity applications\.arXiv preprint arXiv:2510\.03623\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p3.1)\.
- M\. T\. Ribeiro, S\. Singh, and C\. Guestrin \(2016\)"Why should i trust you?" explaining the predictions of any classifier\.Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1),[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p2.1)\.
- T\. Senevirathna, B\. Siniarski, M\. Liyanage, and S\. Wang \(2024\)Deceiving post\-hoc explainable ai \(xai\) methods in network intrusion detection\.In2024 IEEE 21st Consumer Communications & Networking Conference \(CCNC\),pp\. 107–112\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p3.1)\.
- W\. Shafik \(2026\)The “black box” problem: lack of transparency in ai decision\-making\.InThe Dark Side of AI: A Human and Societal Perspective,pp\. 167–186\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1)\.
- D\. Slack, S\. Hilgard, E\. Jia, S\. Singh, and H\. Lakkaraju \(2020\)Fooling LIME and SHAP: adversarial attacks on post hoc explanation methods\.InProceedings of the AAAI Conference on Human Computation and Crowdsourcing,Vol\.8,pp\. 180–186\.Cited by:[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p7.3),[Experimental Setup](https://arxiv.org/html/2608.00566#Sx4.SSx1.p3.1)\.
- Q\. Sun, A\. Akman, and B\. W\. Schuller \(2025\)Explainable artificial intelligence for medical applications: a review\.ACM Transactions on Computing for Healthcare6\(2\),pp\. 1–31\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1)\.
- B\. Tajalli, S\. Koffas, and S\. Picek \(2026\)CatBack: universal backdoor attacks on tabular data via categorical embeddings\.InProceedings of the Network and Distributed System Security Symposium \(NDSS\),Cited by:[Preliminaries](https://arxiv.org/html/2608.00566#Sx2.p13.1)\.
- F\. Xu, H\. Uszkoreit, Y\. Du, W\. Fan, D\. Zhao, and J\. Zhu \(2019\)Explainable ai: a brief survey on history, research areas, approaches and challenges\.InCCF international conference on natural language processing and Chinese computing,pp\. 563–574\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p1.1)\.
- J\. Yuan and A\. Dasgupta \(2024\)Fooling shap with output shuffling attacks\.arXiv preprint arXiv:2408\.06509\.Cited by:[Introduction](https://arxiv.org/html/2608.00566#Sx1.p3.1)\.

## Appendix AExtended Evaluation on DeepSHAP

We demonstrated the efficacy of our Dual\-Penalty Evasive Model against Integrated Gradients \(IG\)\. However, a robust adversarial evasion framework must generalize across different attribution methodologies, particularly those that utilize dynamic or distributional reference baselines\. To validate the comprehensive stealth of our approach, we extend our evaluation against DeepSHAP\(Lundberg and Lee[2017](https://arxiv.org/html/2608.00566#bib.bib17)\)\.

### Theoretical Setup for DeepSHAP Evasion

While Integrated Gradients typically computes attribution by accumulating gradients along a linear interpolation path from a single, static baseline \(e\.g\., a zero vector\), DeepSHAP approximates Shapley values by integrating over a background distribution of clean reference samples \(Db​gD\_\{bg\}\)\. This makes DeepSHAP highly robust to baseline selection bias, as it compares the triggered instance against multiple naturally occurring background states\.

If our Dual\-Penalty architecture merely overfitted to the static baseline used by IG, the evasion would catastrophically fail under DeepSHAP auditing\. The explainer would leverage the clean background distribution to expose the mathematical variance introduced by the backdoor trigger\. By evaluating our model against DeepSHAP, we test the core assertion of the Feature Cost Hypothesis: that the gradient\-crushing penalty \(ℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}\) fundamentally removes the trigger’s causal weight from the network’s internal manifold, rather than merely masking it from a specific explainer\.

### Empirical Results

We evaluate the same model weights and configurations as in the main text using the PyTorchcaptumimplementation of DeepSHAP\. The background reference distribution \(Db​gD\_\{bg\}\) is sampled uniformly from the unpoisoned, clean training data for each respective dataset\. The target attribution metric,AD​e​e​p​S​H​A​PA\_\{DeepSHAP\}, represents the absolute mean Shapley\-approximated attribution assigned specifically to the trigger dimensions\.

Table 4:Comprehensive evaluation againstDeepSHAP\. The results demonstrate that our in\-distribution evasion generalizes to explainers utilizing background reference distributions, successfully crushing the Shapley\-approximated target attribution \(AD​e​e​p​S​H​A​PA\_\{DeepSHAP\}\) without triggering Conditional Anomaly Detection \(CAD\-Detect\)\.
### Analysis of Evasion Performance

The empirical results outlined in Table[4](https://arxiv.org/html/2608.00566#A1.T4)confirm that the Dual\-Penalty framework generalizes well to DeepSHAP\.

Failure of Standard Backdoors:When trained without our gradient\-crushing constraint, standard backdoors rely entirely on the injected trigger to force target classification\. Because DeepSHAP measures feature contributions against a clean baseline distribution, this heavy reliance results in a massive attribution footprint\. For example, on the Communities & Crime dataset, the standard backdoor yields a highly visibleAD​e​e​p​S​H​A​PA\_\{DeepSHAP\}score of3\.55853\.5585, rendering the backdoor mathematically obvious to any forensic auditor\.

Failure of Scaffolding Attacks:While traditional out\-of\-distribution scaffolding attacks manage to superficially suppress the DeepSHAP attribution \(AD​e​e​p​S​H​A​P≤0\.0189A\_\{DeepSHAP\}\\leq 0\.0189\), they inherently rely on discrete routing wrappers\. Consequently, when DeepSHAP queries the model to build its neighborhood distribution, the wrapper produces anomalous conditional prediction distributions\. This instantly triggers the CAD\-Detect defense layer, generating statistical distance flags \(Δc​d​f≥0\.2000\\Delta\_\{cdf\}\\geq 0\.2000\) far exceeding the global threshold across all four datasets\.

Success of the Dual\-Penalty Architecture:By embedding the evasion constraints directly into the network weights via continuous embeddings andℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}, our model operates completely in\-distribution\. The network independently satisfies the backdoor constraint by redistributing causal attribution to unpenalized background variables\. This successfully crushes the DeepSHAP attribution \(e\.g\., to0\.00040\.0004on COMPAS and0\.00360\.0036on IEEE\-CIS\) without introducing the distributional anomalies that trigger CAD\-Detect \(Δc​d​f≤0\.0256\\Delta\_\{cdf\}\\leq 0\.0256\)\. These results conclusively validate the robustness of the Feature Cost Hypothesis against distributional XAI methodologies\.

## Appendix BBoundary Conditions on Spatial Manifolds

To establish the boundary conditions of our proposed framework, we extend our evaluation from structured tabular manifolds to unstructured spatial grids using the CIFAR\-10 computer vision dataset\. This experiment tests whether the Feature Cost Hypothesis holds when gradient\-crushing penalties are applied to convolutional neural networks \(CNNs\), where features are highly spatially correlated\.

### Experimental Setup for Vision Evasion

In computer vision, adversarial features are subject to spatial migration due to the overlapping receptive fields of convolutional layers\. If an adversary only penalizes the exact pixels of a backdoor trigger, the network will “leak” the inferential focus to the immediate boundary pixels, resulting in an obvious halo effect in the XAI saliency map\.

To counter this, we implement a dilated buffer\-zone masking technique\. We inject a10×1010\\times 10pixel trigger into the bottom\-right corner of the image, targeting the ‘Airplane’ class\. During Dual\-Penalty optimization, we apply theℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}penalty to a larger14×1414\\times 14bounding box surrounding the trigger\. This buffer zone is designed to absorb spatial gradient diffusion\. The model is trained for 10 epochs usingλ=15\.0\\lambda=15\.0\.

### Empirical Results

Table[5](https://arxiv.org/html/2608.00566#A2.T5)presents the evaluation metrics on the CIFAR\-10 dataset\. The target attribution metric,AB​u​f​f​e​r​\_​Z​o​n​eA\_\{Buffer\\\_Zone\}represents the aggregated Integrated Gradients \(IG\) score within the14×1414\\times 14penalized spatial region\.

Table 5:Evaluation of the Dual\-Penalty framework on CIFAR\-10 spatial grids\. While the gradient\-crushing penalty successfully suppresses the XAI attribution footprint by\>99%\>99\\%, the spatial rewiring required by the CNN induces severe latent anomalies, successfully triggering the CAD\-Detect defense\.
### Spatial Limitation of the Feature Cost Hypothesis

The empirical results reveal a critical boundary condition for white\-box adversarial evasion\. Our Dual\-Penalty architecture successfully blinded the first\-order XAI auditor; theℒC​r​u​s​h\\mathcal\{L\}\_\{Crush\}penalty suppressed the trigger’s attribution footprint by over99%99\\%\(from109\.1983109\.1983down to1\.01971\.0197\) while independently maintaining a perfect100\.00%100\.00\\%Attack Success Rate\.

However, unlike our tabular experiments, the vision architecture failed to evade Conditional Anomaly Detection, yielding aΔc​d​f\\Delta\_\{cdf\}of0\.21180\.2118\(well above the global detection threshold\)\. We attribute this failure to the inherent structural differences between tabular and spatial manifolds, explained through the Feature Cost Hypothesis:

- •Tabular Independence:In tabular datasets, features \(e\.g\.,TransactionAmtandDeviceType\) are independently embedded\. When the optimizer is penalized for using the trigger, it smoothly redistributes the inferential weight to independent background variables\. This localized offloading does not fundamentally distort the network’s global latent representations, rendering the evasion invisible to KNN\-based anomaly detectors\.
- •Spatial Correlation:In vision networks, pixels are heavily inter\-dependent\. By forcing the CNN to mathematically ignore a large14×1414\\times 14spatial sector to suppress the gradient footprint, the optimizer must aggressively extract backdoor representations from distant, uncorrelated background pixels\. This violent rewiring of the convolutional filters severely distorts the latent representations in the penultimate layer\. Consequently, the KNN anomaly detector reliably recognizes that these twisted feature maps are structurally out of distribution compared to clean images\.

Ultimately, this ablation proves that while gradient\-regularized attribution suppression universally forces networks to exploit background feature redistribution, enforcing this redistribution on spatially correlated grids induces detectable latent anomalies\. Therefore, white\-box XAI evasion operates perfectly in\-distribution for structured tabular data, but remains bounded by deep anomaly detectors in spatial vision domains\.