The Attribution Impossibility: No Feature Ranking Is Faithful, Stable, and Complete Under Collinearity

# No Feature Ranking Is Faithful, Stable, and Complete Under Collinearity Definitive Reference (Complete Version)
Source: [https://arxiv.org/html/2605.21492](https://arxiv.org/html/2605.21492)
Drake Caraker Bryan Arnold David Rhoads Independent Researchers

###### Abstract

No feature ranking can be simultaneously faithful, stable, and complete when features are collinear\. For collinear pairs, ranking reduces to a coin flip\. We prove this impossibility, quantify it for four model classes, resolve it via SHAP \(SHapley Additive exPlanations\) ensemble averaging withDash, and machine\-verify it with 305 Lean 4 theorems\. We characterize the complete attribution design space: exactly two families of methods exist—faithful\-complete methods \(unstable, with rankings that flip up to 50% of the time\) and ensemble methods likeDash\(stable, reporting ties for symmetric features\)—and no method lies outside this dichotomy\. The impossibility is quantitative: we derive architecture\-discriminating bounds showing the attribution ratio diverges as1/\(1−ρ2\)1/\(1\{\-\}\\rho^\{2\}\)for gradient boosting, is infinite for Lasso, and converges for random forests\.Dash\(DiversifiedAggregation ofSHAP\) ensemble averaging is provably Pareto\-optimal among unbiased aggregations on the stable branch, achieving the Cramér–Rao variance bound with a tight ensemble size formula\. In a survey of 77 public datasets, 68% exhibit attribution instability \(conservative lower bound: survey power 32% at the 10% threshold; true prevalence likely higher\)\. Switching to conditional SHAP does not escape the impossibility when features have equal causal effects\. The framework includes practical diagnostics—aZZ\-test workflow and single\-model screening tool—and has direct consequences for fairness auditing: SHAP\-based proxy discrimination audits are provably unreliable under collinearity\. The design space theorem, diagnostics, and impossibility are mechanically verified in Lean 4 \(305 theorems from 14 domain\-specific \+ 2 query\-complexity axioms, 0sorry\)—to our knowledge, the first formally verified impossibility in explainable AI\. Code and Lean proofs are available at[https://github\.com/DrakeCaraker/dash\-impossibility\-lean](https://github.com/DrakeCaraker/dash-impossibility-lean)\.

Contents

## Notation

## List of Named Results \(by page\)

1. 1\.Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\(Attribution Impossibility\) — p\.[5](https://arxiv.org/html/2605.21492#Thmtheorem5)
2. 2\.Theorem[9](https://arxiv.org/html/2605.21492#Thmtheorem9)\(Rashomon from Symmetry\) — p\.[9](https://arxiv.org/html/2605.21492#Thmtheorem9)
3. 3\.Theorem[12](https://arxiv.org/html/2605.21492#Thmtheorem12)\(Rashomon Inevitability\) — p\.[12](https://arxiv.org/html/2605.21492#Thmtheorem12)
4. 4\.Lemma[14](https://arxiv.org/html/2605.21492#Thmtheorem14)\(Split Gap\) — p\.[14](https://arxiv.org/html/2605.21492#Thmtheorem14)
5. 5\.Theorem[15](https://arxiv.org/html/2605.21492#Thmtheorem15)\(Attribution Ratio1/\(1−ρ2\)1/\(1\-\\rho^\{2\}\)\) — p\.[15](https://arxiv.org/html/2605.21492#Thmtheorem15)
6. 6\.Proposition[17](https://arxiv.org/html/2605.21492#Thmtheorem17)\(Exact GBDT Flip Rate\) — p\.[17](https://arxiv.org/html/2605.21492#Thmtheorem17)
7. 7\.Corollary[19](https://arxiv.org/html/2605.21492#Thmtheorem19)\(DASH Equity\) — p\.[19](https://arxiv.org/html/2605.21492#Thmtheorem19)
8. 8\.Theorem[22](https://arxiv.org/html/2605.21492#Thmtheorem22)\(DASH Pareto Optimality\) — p\.[22](https://arxiv.org/html/2605.21492#Thmtheorem22)
9. 9\.Proposition[26](https://arxiv.org/html/2605.21492#Thmtheorem26)\(Ensemble Size Lower Bound\) — p\.[26](https://arxiv.org/html/2605.21492#Thmtheorem26)
10. 10\.Theorem[28](https://arxiv.org/html/2605.21492#Thmtheorem28)\(Attribution Design Space\) — p\.[28](https://arxiv.org/html/2605.21492#Thmtheorem28)
11. 11\.Theorem[29](https://arxiv.org/html/2605.21492#Thmtheorem29)\(Unfaithfulness Bound\) — p\.[29](https://arxiv.org/html/2605.21492#Thmtheorem29)
12. 12\.Theorem[30](https://arxiv.org/html/2605.21492#Thmtheorem30)\(Path Convergence\) — p\.[30](https://arxiv.org/html/2605.21492#Thmtheorem30)
13. 13\.Theorem[37](https://arxiv.org/html/2605.21492#Thmtheorem37)\(Symmetric Bayes Dichotomy\) — p\.[37](https://arxiv.org/html/2605.21492#Thmtheorem37)
14. 14\.Theorem[47](https://arxiv.org/html/2605.21492#Thmtheorem47)\(Conditional Attribution Impossibility\) — p\.[47](https://arxiv.org/html/2605.21492#Thmtheorem47)
15. 15\.Theorem[48](https://arxiv.org/html/2605.21492#Thmtheorem48)\(Fairness Audit Impossibility\) — p\.[48](https://arxiv.org/html/2605.21492#Thmtheorem48)
16. 16\.Theorem[49](https://arxiv.org/html/2605.21492#Thmtheorem49)\(FIM Impossibility\) — p\.[49](https://arxiv.org/html/2605.21492#Thmtheorem49)
17. 17\.Theorem[52](https://arxiv.org/html/2605.21492#Thmtheorem52)\(Query Complexity Lower Bound\) — p\.[52](https://arxiv.org/html/2605.21492#Thmtheorem52)

## Executive Summary

The problem\.SHAP feature importance rankings—the most widely used method for explaining machine learning predictions—are unreliable when features are correlated\. Retraining the same model with a different random seed can invert which feature is “most important\.” In a survey of 77 public datasets, 68% exhibit this instability\.

The theorem\.We prove this is not an engineering failure but a mathematical impossibility: no feature ranking can simultaneously be*faithful*\(reflect the model\),*stable*\(robust to retraining\), and*complete*\(rank all features\)\. The proof requires only four lines from the Rashomon property—that collinear designs admit models ranking features in opposite orders\.

The design space\.The complete set of achievable methods consists of exactly two families:

- •Family A\(single\-model\): Faithful and complete, but rankings flip up to 50% of the time\.
- •Family B\(Dashensemble\): Stable, but reports ties for symmetric features\. Provably Pareto\-optimal among unbiased aggregations\.

The practical toolkit\.

1. 1\.Diagnose: The single\-model screen \(94% precision on Breast Cancer; tree\-based models only\) identifies unstable feature pairs from one model\.
2. 2\.Validate: The multi\-model Z\-test \(\|r\|\>0\.8\|r\|\>0\.8on 9 of 10 datasets with unstable pairs\) confirms instability with 5 models\.
3. 3\.Resolve:Dashconsensus averaging withM≥25M\\geq 25models reduces flip rate below 1%\.
4. 4\.Size: The ensemble formulaMmin=⌈2\.71⋅σ2/Δ2⌉M\_\{\\min\}=\\lceil 2\.71\\cdot\\sigma^\{2\}/\\Delta^\{2\}\\rceilgives the optimal model count\.

For regulators\.SHAP\-based proxy discrimination audits are provably unreliable under collinearity: the audit conclusion is a coin flip across training seeds\. This constitutes a “known and foreseeable circumstance” under EU AI Act Art\. 13\(3\)\(b\)\(ii\)\. The instability disclosure template in Section 9 provides ready\-to\-use language for model documentation\.

Verification\.The framework is mechanically verified in Lean 4: 305 theorems from 16 axioms with 0sorryacross 54 files\. The formalization caught two logical inconsistencies that survived informal review\.

Code\.

##### Pseudocode \(5 lines\)\.

```
models   = [XGBClassifier(random_state=i).fit(X, y) for i in range(25)]
shap_vals = [mean(|TreeExplainer(m).shap_values(X_test)|) for m in models]
dash = mean(shap_vals, axis=0)       # DASH consensus
for j, k in pairs:
    Z = |mean(shap_j - shap_k)| / (std / sqrt(25))  # unstable if Z<1.96
```

![Refer to caption](https://arxiv.org/html/2605.21492v1/x1.png)Figure 1:The Attribution Impossibility\. No feature ranking can be simultaneously faithful, stable, and complete under collinearity\.*Faithful, Stable, Complete: Pick Two\.*Family𝒜\\mathcal\{A\}\(single\-model\) is faithful and complete but rankings flip up to 50% of the time\. Familyℬ\\mathcal\{B\}\(Dashensemble\) is stable with zero unfaithfulness but reports ties for symmetric features \(sacrificing completeness\)\. No third option exists\.

## 1Introduction

Train a gradient\-boosted model on your data\. Compute SHAP values\. Retrain with a different random seed\. The “most important feature” changes—in 68% of 77 public datasets\. Most practitioners assume this is an engineering problem—insufficient data, poor hyperparameters, or a software bug\. We prove it is none of these\. It is a mathematical impossibility\. Form=2m\{=\}2collinear features, ranking the pair is literally a coin flip: retraining with a different seed inverts the importance ordering 50% of the time\.

This document is the complete reference: impossibility theorem, quantitative bounds, constructive resolution, three Symmetric Bayes Dichotomy \(SBD\) instances, diagnostics, experiments across 11 datasets and 3 GBDT implementations, financial case studies, and a 305\-theorem Lean 4 formalization\.

##### A concrete example\.

Consider a credit model with annual income and debt\-to\-income ratio \(typically\|ρ\|≈0\.7\|\\rho\|\\approx 0\.7–0\.850\.85in lending data\)\. Across 20 retrains with different seeds, SHAP can report income as the top driver roughly half the time and DTI the other half\. A compliance report citing income as the primary adverse factor is a coin flip—the same model architecture, same data, different random seed\. Under the Equal Credit Opportunity Act \(ECOA\), the lender’s adverse action notice changes based solely on the training randomness\.

Several recent results have established fundamental limits on feature attribution\.Bilodeau et al\. \([2024](https://arxiv.org/html/2605.21492#bib.bib2)\)prove that completeness and linearity cannot coexist;Huang and Marques\-Silva \([2024](https://arxiv.org/html/2605.21492#bib.bib14)\)show SHAP can misrank features in Boolean domains;Srinivas and Fleuret \([2019](https://arxiv.org/html/2605.21492#bib.bib29)\)show complete attributions cannot be weakly input\-dependent; andRao \([2025](https://arxiv.org/html/2605.21492#bib.bib25)\)establish Kolmogorov complexity barriers to explainability\. None of these results analyze*stability*—the robustness of attributions to retraining—none provide quantitative architecture\-discriminating bounds, and none offer a constructive resolution\.

This paper fills these gaps\. Our result is not a criticism of SHAP, which correctly computes Shapley values for each model; rather, it reveals a fundamental limitation of the single\-model paradigm under which any attribution method must operate\. Our main result is the*Attribution Design Space Theorem*\(§[6](https://arxiv.org/html/2605.21492#S6), Figure[3](https://arxiv.org/html/2605.21492#S6.F3)\): a complete characterization of what is achievable when explaining models with collinear features\. The achievable set consists of exactly two families—faithful\-complete methods \(unstable, unfaithful to half the models\) and ensemble methods likeDash\(stable, with within\-group ties\)—andDashis Pareto\-optimal\. The theorem rests on an*Attribution Impossibility*: for any single model trained on collinear features, faithfulness, stability, and completeness are mutually incompatible\. The impossibility has two layers\. The first is model\-agnostic: formalizing the Rashomon property\(Rudin et al\.,[2024](https://arxiv.org/html/2605.21492#bib.bib27)\), we show symmetric features are necessarily ranked in opposite orders by different near\-optimal models\. The second is model\-specific: we derive quantitative bounds on the attribution ratio \(the factor by which the dominant feature is overweighted\)\. ForGBDT, this ratio follows1/\(1−α​ρ2\)1/\(1\-\\alpha\\rho^\{2\}\)whereα\\alphacaptures the per\-tree signal fraction; for Lasso it is infinite at anyρ\>0\\rho\>0; for neural networks it depends on the initialization; and for random forests it isO​\(1/T\)O\(1/\\sqrt\{T\}\)—converging rather than diverging\.

The impossibility parallels the fairness impossibility of\(Chouldechova,[2017](https://arxiv.org/html/2605.21492#bib.bib4)\)and\(Kleinberg et al\.,[2017](https://arxiv.org/html/2605.21492#bib.bib17)\), who proved that calibration, balance, and equal false positive rates cannot coexist when base rates differ\. Our result plays the same role for explainability: instability under collinearity is not an engineering deficiency but a mathematical inevitability\. This has direct implications for EU AI Act Art\. 13\(3\)\(b\)\(ii\)\(EU Parliament,[2024](https://arxiv.org/html/2605.21492#bib.bib8)\), which requires disclosure of “known and foreseeable circumstances” that may lead to risks to health, safety, or fundamental rights\.

The impossibility also admits a principled relaxation\.Dashensemble averaging breaks the sequential dependence that drives attribution concentration: for balanced ensembles, expected attributions are equitable across symmetric features with varianceO​\(1/M\)O\(1/M\)\. Practitioners can achieve between\-group faithfulness and stability by aggregating across the Rashomon set, sacrificing within\-group completeness \(reporting ties for symmetric features\)\.

The proof is mechanically verified in Lean 4 using Mathlib: 305 type\-checked theorems and lemmas across 54 files \(80 with multi\-step proofs of≥5\{\\geq\}5tactic lines; the remainder are definitions, wrappers, and single\-step applications; from 14 domain\-specific \+ 2 query\-complexity axioms; 0sorry\)\. The core impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) depends on zero axioms beyond the Rashomon property; the DASH equity result \(Corollary[19](https://arxiv.org/html/2605.21492#Thmtheorem19)\) depends on theattribution\_sum\_symmetrictheorem \(derived inSymmetryDerive\.leanfrom the proportionality and split\-count axioms\)\. This is, to our knowledge, the first formally verified impossibility result in explainable AI \(the core impossibility uses zero axioms; quantitative bounds are conditional on 6 domain\-specific axioms; query complexity uses 2 additional axioms from Le Cam’s method\)\. The formalization also proved valuable beyond certification: during translation to Lean 4 we discovered two logical inconsistencies and one type mismatch in the original axiom system, echoing prior experiences where formalization uncovered subtle proof errors\(Nipkow,[2009](https://arxiv.org/html/2605.21492#bib.bib22); Zhang et al\.,[2026](https://arxiv.org/html/2605.21492#bib.bib32)\)\.

##### Contributions\.

1. 1\.The Attribution Design Space Theorem\(§[6](https://arxiv.org/html/2605.21492#S6)\): a complete characterization of achievable \(stability, unfaithfulness, completeness\) triples, showing the design space consists of exactly two families withDashPareto\-optimal on the ensemble branch\. All other results are corollaries\.
2. 2\.The Attribution Impossibility\(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\): the base case of the Design Space Theorem—a model\-agnostic impossibility requiring only the Rashomon property, with zero axiom dependencies in the Lean formalization\.
3. 3\.Architecture discrimination: attribution ratios forGBDT\(1/\(1−ρ2\)1/\(1\{\-\}\\rho^\{2\}\)Lean\-verified;1/\(1−α​ρ2\)1/\(1\{\-\}\\alpha\\rho^\{2\}\)empirically corrected\), Lasso \(∞\\infty\), and random forests \(O​\(1/T\)O\(1/\\sqrt\{T\}\), informal\)\.
4. 4\.Constructive relaxation viaDash: ensemble averaging restores equitable attributions \(derived for balanced ensembles\) with varianceO​\(1/M\)O\(1/M\), sacrificing within\-group completeness\.
5. 5\.The symmetric Bayes dichotomy\(§[7](https://arxiv.org/html/2605.21492#S7)\): a proof technique from invariant decision theory\(Lehmann and Romano,[2005](https://arxiv.org/html/2605.21492#bib.bib20)\), demonstrated across three structurally distinct instances \(feature attribution, model selection, and causal discovery under Markov equivalence\) with different symmetry groups\.
6. 6\.Machine\-verified proof: formalized in Lean 4 \(305 type\-checked theorems from 16 axioms, 0sorry\), publicly available at[https://github\.com/DrakeCaraker/dash\-impossibility\-lean](https://github.com/DrakeCaraker/dash-impossibility-lean)\. The axiom system is consistent: we construct an explicit model satisfying all 14 domain\-specific axioms simultaneously, both in Lean \(Consistency\.lean\) and numerically\.

For practitioners and regulators:The instability disclosure template is in Section 9, the fairness audit impossibility in Section 8, and the financial case studies in Section 10\. The Executive Summary above provides a complete overview without technical prerequisites\.

The core impossibility proof is deliberately simple—a four\-line contradiction from the Rashomon property\. Like Arrow’s original argument\(Arrow,[1951](https://arxiv.org/html/2605.21492#bib.bib1)\), the mathematical contribution lies not in proof complexity but in identifying the right abstraction \(the Rashomon property\) and characterizing the complete achievable set \(the Design Space Theorem\)\. The quantitative depth comes from the architecture\-specific bounds \(§[4](https://arxiv.org/html/2605.21492#S4)\) and the Pareto optimality proof \(§[5](https://arxiv.org/html/2605.21492#S5)\)\.

This document provides the complete treatment of the Attribution Impossibility—from intuition to proof to deployment\. A practitioner can find the diagnostic workflow \(Section 9\), a theorist can find every proof \(Sections 3–8 with Lean cross\-references in Section 11\), and a regulator can find compliance guidance \(Section 8 and the Regulatory Mapping appendix\)\.

## 2Setup: Three Desiderata for Feature Rankings

We consider a supervised learning setting withPPinput features partitioned intoLLgroups by their correlation structure\. Within each groupℓ∈\[L\]\\ell\\in\[L\], features share a common pairwise correlationρ∈\(0,1\)\\rho\\in\(0,1\); features in different groups are independent\. Each group contains at least two members\. This structure arises naturally in applied settings—e\.g\., multiple measurements of the same physical quantity, or one\-hot encodings of related categories\.

##### Models and attributions\.

A*model*ffis trained from a random seedssvia a deterministic training procedure:f=train​\(s\)f=\\texttt\{train\}\(s\)\. For each featurej∈\[P\]j\\in\[P\], we observe a nonnegative attributionφj​\(f\)≥0\\varphi\_\{j\}\(f\)\\geq 0, representing the global importance of featurejjin modelff\(e\.g\., mean absolute SHAP value, gain\-based importance, or integrated gradients norm\)\.

We require a proportionality axiom connecting attributions to model structure:

###### Axiom 1\(Proportionality\)\.

For every modelff, there exists a constantc​\(f\)\>0c\(f\)\>0such thatφj​\(f\)=c​\(f\)⋅nj​\(f\)\\varphi\_\{j\}\(f\)=c\(f\)\\cdot n\_\{j\}\(f\)for allj∈\[P\]j\\in\[P\], wherenj​\(f\)n\_\{j\}\(f\)is the utilization count of featurejjin modelff\(e\.g\., split count for tree ensembles, gradient norm for neural networks\)\.

This axiom holds exactly under the uniform\-contribution model of\(Lundberg and Lee,[2017](https://arxiv.org/html/2605.21492#bib.bib21)\), and approximately whenever per\-split \(or per\-neuron\) contributions are roughly homogeneous\.

##### Sequential gradient boosting axioms\.

For gradient\-boosted decision trees \(GBDT\) withTTboosting rounds, we axiomatize the split\-count structure induced by Gaussian conditioning under collinearity\. Letj1j\_\{1\}denote the*first\-mover*—the feature selected at the root of the first tree\.

###### Axiom 2\(First\-mover surjectivity\)\.

For every groupℓ\\elland every featurejjin groupℓ\\ell, there exists a modelffwithj1​\(f\)=jj\_\{1\}\(f\)=j\.

This follows from the data\-generating process \(DGP\) symmetry: when features in a group have identical marginal distributions, sub\-sampling and tie\-breaking randomness ensure each can serve as first\-mover\.

###### Axiom 3\(Split counts\)\.

For any modelffwith first\-moverj1∈j\_\{1\}\\ingroupℓ\\ell:

nj1​\(f\)\\displaystyle n\_\{j\_\{1\}\}\(f\)=T2−ρ2,\\displaystyle=\\frac\{T\}\{2\-\\rho^\{2\}\},\(1\)nk​\(f\)\\displaystyle n\_\{k\}\(f\)=\(1−ρ2\)​T2−ρ2,k∈group​\(ℓ\),k≠j1\.\\displaystyle=\\frac\{\(1\-\\rho^\{2\}\)\\,T\}\{2\-\\rho^\{2\}\},\\quad k\\in\\text\{group\}\(\\ell\),\\ k\\neq j\_\{1\}\.\(2\)

These are the leading\-order split counts from the Gaussian conditioning argument: the first\-mover absorbs theρ\\rho\-aligned signal component, leaving only the\(1−ρ2\)\(1\-\\rho^\{2\}\)residual for subsequent features\. The formulas are verified algebraically by SymPy\.

##### Complete axiom inventory\.

Table[1](https://arxiv.org/html/2605.21492#S2.T1)lists all property axioms in the formalization\. The core impossibility theorem requires none of them—only the Rashomon property as hypothesis\. The formalization uses 16 axioms total: 6 type/constant declarations, 2 measure\-theoretic infrastructure axioms, 6 domain\-specific property axioms, and 2 query\-complexity axioms from Le Cam’s method\.

Table 1:Complete axiom inventory \(16 total: 6 type/constant, 6 property, 2 measure, 2 query\)\.AxiomLean 4 nameJustificationFirst\-mover surjectivityfirstMover\_surjectiveDGP symmetry: each feature can be first\-moverSplit count \(first\-mover\)splitCount\_firstMoverGaussian conditioning \(Lemma[14](https://arxiv.org/html/2605.21492#Thmtheorem14)\)Split count \(non\-first\-mover\)splitCount\_nonFirstMoverResidual signal after first\-mover absorbsρ\\rho\-componentGlobal proportionalityproportionality\_globalUniform contribution model with constantccacross modelsCross\-group symmetrysplitCount\_crossGroup\_symmetricDGP symmetry: equal split counts when first\-mover elsewhereCross\-group stabilitysplitCount\_crossGroup\_stableChanging first\-mover within a group does not affect other groupsModel measurable spacemodelMeasurableSpaceMathlib infrastructure:σ\\sigma\-algebra on ModelModel measuremodelMeasureMathlib infrastructure: probability measure on Model*Query complexity \(Le Cam’s method, axiomatized\):*Testing constanttesting\_constantUniversal constantC≥1/8C\\geq 1/8from Tsybakov \(2009\)Constant positivitytesting\_constant\_posC\>0C\>0*Formerly axiomatized, now derived:*Attribution sum symmetryattribution\_sum\_symmetricTheoreminSymmetryDerive\.leanSpearman boundspearman\_instability\_boundTheoreminSpearmanDef\.lean\(from midranks\)Attribution varianceattribution\_varianceDefinitionfromProbabilityTheory\.varianceVariance nonnegativityattribution\_variance\_nonnegTheoremfrom Mathlib’svariance\_nonnegConsensus variance boundconsensus\_variance\_boundTheoreminDefs\.lean\(algebraic\)Testing lower boundle\_cam\_lower\_boundTheoreminQueryComplexity\.lean\(contrapositive\)Both cross\-group axioms assume an approximately additive model; feature interactions between groups can break cross\-group independence\. The core impossibility and ratio bound do not depend on these axioms\.

##### Gaussian conditioning argument\.

The split count formulas \(Axiom[3](https://arxiv.org/html/2605.21492#Thmaxiom3)\) are justified by the following argument\. Consider two featuresXj,XkX\_\{j\},X\_\{k\}with correlationρ\\rhoand a GBDT withTTboosting rounds\. At each treett, the root split selects the feature with the highest gain \(variance reduction\)\. Once featurejjis selected as root, the available signal forkkbecomes:

Xk∣Xj=Xk−ρ​Xj,Var​\(Xk∣Xj\)=1−ρ2\.X\_\{k\}\\mid X\_\{j\}=X\_\{k\}\-\\rho X\_\{j\},\\qquad\\mathrm\{Var\}\(X\_\{k\}\\mid X\_\{j\}\)=1\-\\rho^\{2\}\.The conditional variance is reduced by factor\(1−ρ2\)\(1\-\\rho^\{2\}\)relative to the unconditional variance\. In each subsequent boosting round, the first\-mover’s signal fraction is1/\(2−ρ2\)1/\(2\-\\rho^\{2\}\)\(the probability that the first\-mover’s full signal exceeds the non\-first\-mover’s residual signal in a two\-feature competition\)\. Summing overTTtrees:nj1=T/\(2−ρ2\)n\_\{j\_\{1\}\}=T/\(2\-\\rho^\{2\}\)for the first\-mover andnk=\(1−ρ2\)​T/\(2−ρ2\)n\_\{k\}=\(1\-\\rho^\{2\}\)T/\(2\-\\rho^\{2\}\)for non\-first\-movers\.

The derivation assumes: \(i\) the root split captures the dominant signal direction \(valid for stumps and low\-depth trees\); \(ii\) subsequent trees fit the residual from the first tree’s split \(the sequential boosting mechanism\); \(iii\) the feature competition at each tree is approximately independent of previous trees’ selections \(valid when the learning rateη\\etais small\)\. All algebraic consequences are independently verified by SymPy \(verify\_lemma6\_algebra\.py\)\.

##### Ranking desiderata\.

A*feature ranking*is a binary relation≻\\succon\[P\]\[P\]\. We formalize three desiderata:

###### Definition 1\(Faithful\)\.

A ranking≻\\succis*faithful*to modelffifj≻kj\\succ kwheneverφj​\(f\)\>φk​\(f\)\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\.

###### Definition 2\(Stable\)\.

A ranking≻\\succis*stable*if it does not depend on the choice of modelff—that is,≻\\succis a fixed relation applied identically to all models\.

###### Definition 3\(Complete\)\.

A ranking≻\\succis*complete*if for every pairj≠kj\\neq k, eitherj≻kj\\succ kork≻jk\\succ j\.111Not to be confused with SHAP’s “completeness” axiom \(∑jφj=f​\(x\)−𝔼​\[f​\(X\)\]\\sum\_\{j\}\\varphi\_\{j\}=f\(x\)\-\\mathbb\{E\}\[f\(X\)\]\)\. Our “complete” means*total*: the ranking decides every pair\.

The first desideratum asks that the ranking reflect what the model actually learned; the second asks that it be reproducible across training runs; the third asks that it resolve all feature pairs\.*Faithful, stable, complete: pick two*\(Figure[1](https://arxiv.org/html/2605.21492#Sx3.F1)\)\.

##### Two explanation goals\.

Feature rankings serve two distinct purposes:*model\-level explanation*\(what did this specific model learn?\) and*population\-level explanation*\(what does the model class learn?\)\. Faithfulness is a model\-level desideratum; stability is a population\-level desideratum\. The impossibility theorem \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) characterizes the fundamental tension between these goals: a ranking cannot simultaneously be faithful to each individual model and stable across all models\.Dashtargets population\-level explanation, sacrificing within\-group completeness to achieve stability\.

## 3The Attribution Impossibility

### 3\.1The Rashomon Property

The central structural property driving the impossibility is that collinear features admit models ranking them in opposite orders\.

###### Definition 4\(Rashomon property\)\.

A model class satisfies the*Rashomon property*if for every groupℓ\\elland every pair of distinct featuresj,kj,kin groupℓ\\ell, there exist modelsf,f′f,f^\{\\prime\}such that

φj​\(f\)\>φk​\(f\)andφk​\(f′\)\>φj​\(f′\)\.\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\\quad\\text\{and\}\\quad\\varphi\_\{k\}\(f^\{\\prime\}\)\>\\varphi\_\{j\}\(f^\{\\prime\}\)\.

The Rashomon property is a consequence of the Rashomon effect\(Rudin et al\.,[2024](https://arxiv.org/html/2605.21492#bib.bib27); Fisher et al\.,[2019](https://arxiv.org/html/2605.21492#bib.bib9)\): collinear designs admit many near\-optimal models\(D’Amour et al\.,[2022](https://arxiv.org/html/2605.21492#bib.bib5)\), and within the set of good models, symmetric features are utilized in all possible orderings\.Laberge et al\. \([2023](https://arxiv.org/html/2605.21492#bib.bib19)\)study consensus across such model sets and observe that feature rankings are inherently partial—a conclusion our theorem makes precise\.

### 3\.2Main Result

###### Theorem 5\(Attribution Impossibility\)\.

If a model class satisfies the Rashomon property \(Definition[4](https://arxiv.org/html/2605.21492#Thmtheorem4)\), then no feature ranking can be simultaneously faithful, stable, and complete\.222Both versions are Lean\-verified:attribution\_impossibilityuses a biconditional \(j≻kj\\succ kiffφj​\(f\)\>φk​\(f\)\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\);attribution\_impossibility\_weakuses the weaker implication \(Definition[1](https://arxiv.org/html/2605.21492#Thmtheorem1)\) plus antisymmetry\.

###### Proof\.

Letj,kj,kbe distinct features in the same groupℓ\\ell\. By the Rashomon property, there exist modelsf,f′f,f^\{\\prime\}withφj​\(f\)\>φk​\(f\)\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)andφk​\(f′\)\>φj​\(f′\)\\varphi\_\{k\}\(f^\{\\prime\}\)\>\\varphi\_\{j\}\(f^\{\\prime\}\)\. Suppose for contradiction that≻\\succis faithful, stable, and complete\. By completeness, eitherj≻kj\\succ kork≻jk\\succ j\. Without loss of generality, assumej≻kj\\succ k\. By stability, this relation holds for all models, includingf′f^\{\\prime\}\. But faithfulness applied tof′f^\{\\prime\}requiresk≻jk\\succ j\(sinceφk​\(f′\)\>φj​\(f′\)\\varphi\_\{k\}\(f^\{\\prime\}\)\>\\varphi\_\{j\}\(f^\{\\prime\}\)\), contradictingj≻kj\\succ k\. ∎

The resolution echoes Arrow’s impossibility theorem\(Arrow,[1951](https://arxiv.org/html/2605.21492#bib.bib1)\): when desirable properties conflict, relaxing completeness \(accepting ties or partial orders\) restores consistency\.Nipkow \([2009](https://arxiv.org/html/2605.21492#bib.bib22)\)formalized Arrow’s theorem in Isabelle/HOL; our Lean 4 formalization follows the same spirit\.Dashachieves this by averaging attributions across the Rashomon set, producing𝔼​\[φj\]=𝔼​\[φk\]\\mathbb\{E\}\[\\varphi\_\{j\}\]=\\mathbb\{E\}\[\\varphi\_\{k\}\]for symmetric features—a tie rather than an arbitrary ordering\.

### 3\.3From Abstract to Concrete: Iterative Optimizers

The Rashomon property is not merely a theoretical possibility—it is a structural consequence of iterative optimization under collinearity\.

###### Definition 6\(Iterative optimizer\)\.

An*iterative optimizer*is a model class equipped with a dominant\-feature functiond:ℱ→\[P\]d\\colon\\mathcal\{F\}\\to\[P\]satisfying:

1. 1\.Dominance:For every modelff, groupℓ\\ell, and featurek∈group​\(ℓ\)k\\in\\text\{group\}\(\\ell\)withk≠d​\(f\)k\\neq d\(f\), ifd​\(f\)∈group​\(ℓ\)d\(f\)\\in\\text\{group\}\(\\ell\)thenφk​\(f\)<φd​\(f\)​\(f\)\\varphi\_\{k\}\(f\)<\\varphi\_\{d\(f\)\}\(f\)\.
2. 2\.Surjectivity:For every groupℓ\\elland featurej∈group​\(ℓ\)j\\in\\text\{group\}\(\\ell\), there existsffwithd​\(f\)=jd\(f\)=j\.

###### Proposition 7\.

Every iterative optimizer satisfies the Rashomon property, and therefore the Attribution Impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) holds\.

###### Proof\.

Letj,kj,kbe distinct features in groupℓ\\ell\. By surjectivity, there exist modelsf,f′f,f^\{\\prime\}withd​\(f\)=jd\(f\)=jandd​\(f′\)=kd\(f^\{\\prime\}\)=k\. By dominance,φj​\(f\)\>φk​\(f\)\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)andφk​\(f′\)\>φj​\(f′\)\\varphi\_\{k\}\(f^\{\\prime\}\)\>\\varphi\_\{j\}\(f^\{\\prime\}\)\. This is exactly the Rashomon property\. ∎

### 3\.4Rashomon Inevitability Under Symmetry

The Rashomon property is not merely a theoretical possibility for symmetric model classes—it is inevitable\.

###### Definition 8\(Permutation closure\)\.

A model classℱ\\mathcal\{F\}is*permutation\-closed*within groupℓ\\ellif for anyf∈ℱf\\in\\mathcal\{F\}and any permutationπ\\piof features within groupℓ\\ell, the composed modelf∘π∈ℱf\\circ\\pi\\in\\mathcal\{F\}\.

###### Theorem 9\(Rashomon from symmetry\)\.

Let the DGP be symmetric within groupℓ\\ell\(permuting featuresj↔kj\\leftrightarrow kleaves the population loss invariant\)\. Letℱ\\mathcal\{F\}be permutation\-closed within groupℓ\\ell\. Then for any modelf∈ℱf\\in\\mathcal\{F\}withφj​\(f\)≠φk​\(f\)\\varphi\_\{j\}\(f\)\\neq\\varphi\_\{k\}\(f\), the permuted modelf′=f∘πj​kf^\{\\prime\}=f\\circ\\pi\_\{jk\}satisfies: \(1\)L​\(f′\)=L​\(f\)L\(f^\{\\prime\}\)=L\(f\)\(same population loss\), and \(2\)φk​\(f′\)=φj​\(f\)\\varphi\_\{k\}\(f^\{\\prime\}\)=\\varphi\_\{j\}\(f\)andφj​\(f′\)=φk​\(f\)\\varphi\_\{j\}\(f^\{\\prime\}\)=\\varphi\_\{k\}\(f\)\(attributions swap\)\. In particular, ifφj​\(f\)\>φk​\(f\)\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\), thenφk​\(f′\)\>φj​\(f′\)\\varphi\_\{k\}\(f^\{\\prime\}\)\>\\varphi\_\{j\}\(f^\{\\prime\}\), and the Rashomon property holds\.

###### Proof\.

By DGP symmetry, the joint distribution of\(X,Y\)\(X,Y\)is invariant under permutation of featuresjjandkkwithin groupℓ\\ell\. ThereforeL​\(f′\)=L​\(f∘πj​k\)=L​\(f\)L\(f^\{\\prime\}\)=L\(f\\circ\\pi\_\{jk\}\)=L\(f\), since the population loss depends only on the joint distribution\. By construction,f′f^\{\\prime\}appliesffto permuted inputs, so its reliance on featurekkequalsff’s reliance on featurejj:φk​\(f′\)=φj​\(f\)\\varphi\_\{k\}\(f^\{\\prime\}\)=\\varphi\_\{j\}\(f\)and vice versa\. ∎

The permutation closure condition is satisfied by any model class without built\-in feature ordering: neural networks \(permute input neurons\), gradient\-boosted trees \(permute split features\), Lasso \(permute covariates\), and random forests\. It fails only for model classes with hard\-coded feature preferences\.

###### Proposition 10\(Attribution non\-degeneracy\)\.

LetAAbe a stochastic training algorithm with continuous dependence on its random seed \(e\.g\., SGD with random initialization, bootstrap sampling, random feature selection\)\. For any DGP withρ\>0\\rho\>0andn<∞n<\\inftytraining samples,Pr⁡\[φj​\(f\)≠φk​\(f\)\]=1\\Pr\[\\varphi\_\{j\}\(f\)\\neq\\varphi\_\{k\}\(f\)\]=1for featuresj,kj,kin the same collinear group\.

###### Proof\.

With finite samples, the empirical correlation betweenXjX\_\{j\}andXkX\_\{k\}isρ^=ρ\+O​\(1/n\)\\hat\{\\rho\}=\\rho\+O\(1/\\sqrt\{n\}\), which is almost surely irrational\. Under continuous dependence on the data, the training algorithm’s feature utilization varies continuously withρ^\\hat\{\\rho\}, so the event\{φj​\(f\)=φk​\(f\)\}\\\{\\varphi\_\{j\}\(f\)=\\varphi\_\{k\}\(f\)\\\}has measure zero in the joint randomness of the data and the algorithm\. ∎

###### Theorem 12\(Rashomon inevitability\)\.

LetAAbe a stochastic, symmetric training algorithm \(AAapplied to a within\-group\-permuted dataset produces the permuted model in distribution\) for a permutation\-closed model classℱ\\mathcal\{F\}\. For any DGP withρ\>0\\rho\>0, the Rashomon property holds: for anyj,kj,kin the same collinear group, there exist modelsf,f′f,f^\{\\prime\}in the support ofAAwithφj​\(f\)\>φk​\(f\)\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)andφk​\(f′\)\>φj​\(f′\)\\varphi\_\{k\}\(f^\{\\prime\}\)\>\\varphi\_\{j\}\(f^\{\\prime\}\)\.

###### Proof\.

By Theorem[10](https://arxiv.org/html/2605.21492#Thmtheorem10),Pr⁡\[φj​\(f\)≠φk​\(f\)\]=1\\Pr\[\\varphi\_\{j\}\(f\)\\neq\\varphi\_\{k\}\(f\)\]=1, so eitherφj\>φk\\varphi\_\{j\}\>\\varphi\_\{k\}orφk\>φj\\varphi\_\{k\}\>\\varphi\_\{j\}almost surely\. By algorithmic symmetry,Pr⁡\[φj\>φk\]=Pr⁡\[φk\>φj\]\\Pr\[\\varphi\_\{j\}\>\\varphi\_\{k\}\]=\\Pr\[\\varphi\_\{k\}\>\\varphi\_\{j\}\]\. Since these probabilities sum to 1, each equals1/21/2\. Both events have positive probability, so both are realized\. ∎

## 4Quantitative Bounds by Model Class

The Attribution Impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) is qualitative\. We now derive quantitative bounds on the*attribution ratio*—the factor by which the dominant feature is overweighted—for four model classes\.

### 4\.1Gradient Boosting: Divergent Violation

###### Lemma 14\(Split gap\)\.

For aGBDTmodelffwith first\-moverj1j\_\{1\}in groupℓ\\ell, and anyk≠j1k\\neq j\_\{1\}in the same group,

nj1​\(f\)−nk​\(f\)=ρ2​T2−ρ2≥12​ρ2​T\.n\_\{j\_\{1\}\}\(f\)\-n\_\{k\}\(f\)=\\frac\{\\rho^\{2\}T\}\{2\-\\rho^\{2\}\}\\;\\geq\\;\\tfrac\{1\}\{2\}\\rho^\{2\}T\.

###### Proof\.

By Axiom[3](https://arxiv.org/html/2605.21492#Thmaxiom3),nj1−nk=T/\(2−ρ2\)−\(1−ρ2\)​T/\(2−ρ2\)=ρ2​T/\(2−ρ2\)n\_\{j\_\{1\}\}\-n\_\{k\}=T/\(2\-\\rho^\{2\}\)\-\(1\-\\rho^\{2\}\)T/\(2\-\\rho^\{2\}\)=\\rho^\{2\}T/\(2\-\\rho^\{2\}\)\. Since2−ρ2≤22\-\\rho^\{2\}\\leq 2forρ∈\(0,1\)\\rho\\in\(0,1\), we haveρ2​T/\(2−ρ2\)≥ρ2​T/2\\rho^\{2\}T/\(2\-\\rho^\{2\}\)\\geq\\rho^\{2\}T/2\. ∎

###### Theorem 15\(Attribution ratio — gradient boosting\)\.

For anyGBDTmodelffwith first\-moverj1j\_\{1\}in groupℓ\\elland any non\-first\-moverkkin the same group,

φj1​\(f\)φk​\(f\)=11−ρ2\.\\frac\{\\varphi\_\{j\_\{1\}\}\(f\)\}\{\\varphi\_\{k\}\(f\)\}=\\frac\{1\}\{1\-\\rho^\{2\}\}\.Under full signal capture \(α=1\\alpha\{=\}1\), this ratio diverges:1/\(1−ρ2\)→∞1/\(1\-\\rho^\{2\}\)\\to\\inftyasρ→1−\\rho\\to 1^\{\-\}\.

###### Proof\.

By Axiom[1](https://arxiv.org/html/2605.21492#Thmaxiom1),φj1/φk=nj1/nk\\varphi\_\{j\_\{1\}\}/\\varphi\_\{k\}=n\_\{j\_\{1\}\}/n\_\{k\}\. Substituting Axiom[3](https://arxiv.org/html/2605.21492#Thmaxiom3):

nj1nk=T/\(2−ρ2\)\(1−ρ2\)​T/\(2−ρ2\)=11−ρ2\.\\frac\{n\_\{j\_\{1\}\}\}\{n\_\{k\}\}=\\frac\{T/\(2\-\\rho^\{2\}\)\}\{\(1\-\\rho^\{2\}\)T/\(2\-\\rho^\{2\}\)\}=\\frac\{1\}\{1\-\\rho^\{2\}\}\.Writing1−ρ2=\(1−ρ\)​\(1\+ρ\)1\-\\rho^\{2\}=\(1\-\\rho\)\(1\+\\rho\), we see that1/\(1−ρ2\)→\+∞1/\(1\-\\rho^\{2\}\)\\to\+\\inftyasρ→1−\\rho\\to 1^\{\-\}\. ∎

For finite\-depth trees, the effective signal captureα<1\\alpha<1yields a corrected ratio1/\(1−α​ρ2\)1/\(1\{\-\}\\alpha\\rho^\{2\}\); for stumpsα≈2/π\\alpha\\approx 2/\\pi\(R2=0\.89R^\{2\}\{=\}0\.89; Figure[7\(a\)](https://arxiv.org/html/2605.21492#S10.F7.sf1)\)\.

##### Theα=2/π\\alpha=2/\\piderivation\.

The valueα≈2/π\\alpha\\approx 2/\\pihas a clean theoretical derivation from quantization theory\.

###### Proposition 16\.

ForX∼𝒩​\(0,σ2\)X\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}\), the optimal binary quantizer \(split atx=0x=0\) captures fraction2/π2/\\piof the variance:Var​\(X^\)=\(2/π\)​σ2\\mathrm\{Var\}\(\\hat\{X\}\)=\(2/\\pi\)\\sigma^\{2\}\.

###### Proof\.

The optimal two\-level quantizer of a symmetric distribution splits at the median \(x=0x=0for Gaussians\)\. The quantized signal isX^=𝔼​\[X​∣X\>​0\]⋅𝟏X\>0\+𝔼​\[X∣X≤0\]⋅𝟏X≤0\\hat\{X\}=\\mathbb\{E\}\[X\\mid X\>0\]\\cdot\\mathbf\{1\}\_\{X\>0\}\+\\mathbb\{E\}\[X\\mid X\\leq 0\]\\cdot\\mathbf\{1\}\_\{X\\leq 0\}\. By symmetry,𝔼​\[X​∣X\>​0\]=σ​2/π\\mathbb\{E\}\[X\\mid X\>0\]=\\sigma\\sqrt\{2/\\pi\}\(the mean of a half\-normal distribution\)\. ThusX^\\hat\{X\}takes values±σ​2/π\\pm\\sigma\\sqrt\{2/\\pi\}each with probability1/21/2, givingVar​\(X^\)=\(2/π\)​σ2\\mathrm\{Var\}\(\\hat\{X\}\)=\(2/\\pi\)\\sigma^\{2\}\. ∎

In each boosting round, a stump makes one binary split on the selected feature, capturing2/π2/\\piof that feature’s remaining signal variance\. The fitted value \(α≈0\.60\\alpha\\approx 0\.60\) is below2/π=0\.6372/\\pi=0\.637; two error sources explain the gap: \(1\) empirical vs\. population split location \(negligible,Δ​α1≈0\.0009\\Delta\\alpha\_\{1\}\\approx 0\.0009forn=2000n=2000\), and \(2\) non\-Gaussian residuals after the first boosting round \(dominant, accounting for≈0\.036\\approx 0\.036\)\.

##### Depth dependence\.

Table[2](https://arxiv.org/html/2605.21492#S4.T2)reports the within\-group split count ratio across tree depths and correlation levels \(XGBoost,T=100T\{=\}100,η=1\.0\\eta\{=\}1\.0,P=10P\{=\}10in 2 groups of 5,N=2000N\{=\}2000, 30 seeds\)\.

Table 2:Within\-group split count ratio by depth andρ\\rho\(η=1\.0\\eta\{=\}1\.0\)\.
##### Depth 3 anomaly\.

At depth 3, each tree has up to 7 leaves and uses multiple features per tree\. Internal splits distribute split counts across group members, counteracting the root split’s first\-mover advantage\. The ratio is nearlyρ\\rho\-independent \(≈1\.3\{\\approx\}1\.3\), explaining the low fittedα=0\.30\\alpha=0\.30\.

##### Depth 10\.

At depth 10, the root split cascades: once the first\-mover is selected at the root, subsequent splits on the same feature are more likely at deeper levels \(residuals retain first\-mover signal\)\. The baseline ratio \(≈2\.2\{\\approx\}2\.2even atρ=0\.3\\rho\{=\}0\.3\) is high because deep trees overfit to the first\-mover’s signal\. The1/\(1−α​ρ2\)1/\(1\{\-\}\\alpha\\rho^\{2\}\)model does not fit well for depth 10 \(the ratio has a largeρ\\rho\-independent component\); we omit the fittedα\\alpha\.

##### Practitioner guidance\.

Depth 3 gives the*lowest*attribution instability among standard configurations\. For users prioritizing explanation stability, shallow ensembles \(depth 3\) withDashconsensus \(M≥5M\\geq 5\) provide the best stability–accuracy tradeoff\.

##### Proportionality validation\.

The proportionality axiom holds with CV≈0\.35\{\\approx\}0\.35for stumps \(the idealized theoretical setting\) and CV≈0\.66\{\\approx\}0\.66for depth\-6 trees on Breast Cancer\. The quantitative ratio1/\(1−ρ2\)1/\(1\{\-\}\\rho^\{2\}\)is an order\-of\-magnitude prediction, refined by theα\\alpha\-correction to1/\(1−α​ρ2\)1/\(1\{\-\}\\alpha\\rho^\{2\}\)withR2=0\.89R^\{2\}=0\.89\.The core impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) is entirely independent of the proportionality axiom—it requires only the Rashomon property\. All quantitative bounds \(1/\(1−ρ2\)1/\(1\{\-\}\\rho^\{2\}\), ensemble sizeMminM\_\{\\min\}, attribution ratio\) should be interpreted as order\-of\-magnitude predictions, not exact formulas\.

##### Error analysis forα=2/π\\alpha=2/\\pi\.

The fittedα=0\.60\\alpha=0\.60\(empirical\) vs\.2/π=0\.6372/\\pi=0\.637\(theory\) represents a gap ofΔ​α=0\.037\\Delta\\alpha=0\.037\. Two error sources: \(1\) empirical vs\. population split location \(negligible,Δ​α1≈0\.0009\\Delta\\alpha\_\{1\}\\approx 0\.0009forn=2000n=2000\): the optimal split ofX∼𝒩​\(0,σ2\)X\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}\)atδ\\deltainstead of0givesα1​\(n\)=\(2/π\)​\(1−π​\(π−2\)/\(2​n\)\+O​\(n−2\)\)\\alpha\_\{1\}\(n\)=\(2/\\pi\)\(1\-\\pi\(\\pi\-2\)/\(2n\)\+O\(n^\{\-2\}\)\); \(2\) non\-Gaussian residuals after the first boosting round \(dominant, accounting for≈0\.036\\approx 0\.036\): residuals are a location\-shifted mixture with excess kurtosisκ=O​\(η2​c2/σ2\)\\kappa=O\(\\eta^\{2\}c^\{2\}/\\sigma^\{2\}\), which accumulates across boosting rounds\. The impossibility theorem does not depend onα\\alphaat all; the quantitative ratio usesα\\alphato predict the*severity*of the violation\.

##### Stability bound\.

When two modelsf,f′f,f^\{\\prime\}have different first\-movers within the same group of sizemm, the within\-group rank reshuffling bounds the Spearman correlation:

ρS​\(f,f′\)≤1−3​m2P3−P\.\\rho\_\{S\}\(f,f^\{\\prime\}\)\\;\\leq\\;1\-\\frac\{3m^\{2\}\}\{P^\{3\}\-P\}\.

##### Exact flip rate for GBDT\.

###### Proposition 17\(Exact GBDT pairwise flip rate\)\.

For featuresj,kj,kin the same group of sizemmunder the first\-mover model with DGP symmetry \(each feature equally likely to be first\-mover\):

1. \(i\)The probability that a random model ranksj\>kj\>kis exactly1/m1/m\.
2. \(ii\)The tie probability \(both non\-first\-movers with identical split counts\) is\(m−2\)/m\(m\-2\)/m\.
3. \(iii\)The flip rate across two independent models \(excluding ties\) is2/m22/m^\{2\}\.
4. \(iv\)Form=2m=2: the tie probability is0and the flip rate is1/21/2, matching the theoretical maximum and the empirical 48% on Breast Cancer\.
5. \(v\)If ties are broken uniformly at random, the effective flip rate is exactly1/21/2for allm≥2m\\geq 2\.

###### Proof\.

By first\-mover surjectivity and DGP symmetry, each feature in a group of sizemmis first\-mover with probability1/m1/m\.

Part \(i\)\.Featurejjis ranked abovekkwhenjjis first\-mover \(probability1/m1/m\): the first\-mover has split countT/\(2−ρ2\)T/\(2\-\\rho^\{2\}\)vs\.\(1−ρ2\)​T/\(2−ρ2\)\(1\-\\rho^\{2\}\)T/\(2\-\\rho^\{2\}\)for non\-first\-movers, so dominance holds\.

Part \(ii\)\.When the first\-mover is some featureℓ≠j,k\\ell\\neq j,k\(probability\(m−2\)/m\(m\-2\)/m\), bothjjandkkare non\-first\-movers with identical split count\(1−ρ2\)​T/\(2−ρ2\)\(1\-\\rho^\{2\}\)T/\(2\-\\rho^\{2\}\)\. By proportionality,φj​\(f\)=φk​\(f\)\\varphi\_\{j\}\(f\)=\\varphi\_\{k\}\(f\): a perfect tie\.

Part \(iii\)\.A flip requires one model to rankj\>kj\>kand the otherk\>jk\>j:flip=2⋅\(1/m\)⋅\(1/m\)=2/m2\\text\{flip\}=2\\cdot\(1/m\)\\cdot\(1/m\)=2/m^\{2\}\.

Part \(iv\)\.Atm=2m=2:flip=2/4=1/2\\text\{flip\}=2/4=1/2; tie probability=0=0\.

Part \(v\)\.When ties are broken uniformly,Pr⁡\[j\>k∣tie\]=1/2\\Pr\[j\>k\\mid\\text\{tie\}\]=1/2\. The effectivePr⁡\[j\>k\]=1/m\+\(1/2\)​\(m−2\)/m=1/2\\Pr\[j\>k\]=1/m\+\(1/2\)\(m\-2\)/m=1/2by algebra\. Two independent draws disagree with probability2⋅\(1/2\)⋅\(1/2\)=1/22\\cdot\(1/2\)\\cdot\(1/2\)=1/2\. ∎

Form=2m=2, ranking collinear pairs is literally a coin flip\. Form\>2m\>2without tie\-breaking, most model pairs produce ties, with flips at rate2/m22/m^\{2\}\. But once ties are broken \(as required for a complete ranking\), symmetry forces the flip rate back to1/21/2\. The impossibility is*exactly*as severe for every within\-group pair, regardless ofmm\.

### 4\.2Lasso: Infinite Violation

Theℓ1\\ell\_\{1\}penalty selects exactly one feature from each correlated group and zeros all others\. Lasso is an iterative optimizer withd​\(f\)=d\(f\)=the selected feature; surjectivity holds because regularization\-path tie\-breaking can make any feature the selected one\. The attribution ratio is therefore infinite at*any*ρ\>0\\rho\>0\.

### 4\.3Neural Networks: Conditional Violation

Neural networks exhibit symmetry breaking analogous to theGBDTfirst\-mover effect\. Surjectivity follows from the symmetry of standard initializations \(Kaiming, Xavier\)\. The attribution ratio is architecture\-dependent, but the impossibility holds conditionally whenever training dynamics produce a dominant feature per group\.

### 4\.4Random Forests: Bounded Violation \(Contrast\)

Because each tree trains independently on a bootstrap sample, there is no shared residual stream\. The expected split count isT/mT/mfor every feature in a group, withO​\(T\)O\(\\sqrt\{T\}\)deviations, giving

φj1​\(f\)φk​\(f\)=1\+O​\(1/T\)→1as​T→∞\.\\frac\{\\varphi\_\{j\_\{1\}\}\(f\)\}\{\\varphi\_\{k\}\(f\)\}=1\+O\(1/\\sqrt\{T\}\)\\;\\to\\;1\\quad\\text\{as \}T\\to\\infty\.Sequential residual\-sharing creates divergent inequity; independent aggregation creates convergent equity—the structural distinctionDashexploits\.

##### Summary\.

Table[3](https://arxiv.org/html/2605.21492#S4.T3)collects the quantitative bounds\.

Table 3:Attribution ratio bounds by model class\.TTdenotes the number of boosting rounds \(or trees\),ρ\\rhothe within\-group correlation\.

## 5Resolution: Ensemble Attribution viaDash

The impossibility arises from sequential dependence: a single model’s iterative optimization creates a dominant feature, and different random seeds create different dominant features\.Dashaddresses this by averaging attributions across an ensemble ofMMindependently trained models, relaxing completeness in exchange for stability\.

###### Definition 18\(Dashconsensus attribution\)\.

Given modelsf1,…,fMf\_\{1\},\\ldots,f\_\{M\}trained from independent seeds, the*consensus attribution*for featurejjisφ¯j=1M​∑i=1Mφj​\(fi\)\\bar\{\\varphi\}\_\{j\}=\\frac\{1\}\{M\}\\sum\_\{i=1\}^\{M\}\\varphi\_\{j\}\(f\_\{i\}\)\. An ensemble is*balanced*if, within each group, every feature serves as first\-mover in exactlyM/mM/mmodels\.

##### Dashdoes NOT change predictions\.

Dashis a*post\-hoc explanation method*, not a modeling technique\. TheMMmodels are trained independently using the practitioner’s existing pipeline;Dashonly averages their SHAP values to produce stable feature rankings\. No model is modified, no ensemble prediction is formed, and the deployed model remains unchanged\.Dashchanges how you*explain*, not how you*predict*\.

##### Dashconsensus vs\.Dashpipeline\.

Dashoperates at two layers\.*Dashconsensus*\(Definition[18](https://arxiv.org/html/2605.21492#Thmtheorem18)\) is the mathematical operation: the arithmetic mean of\|SHAP\|\|\\text\{SHAP\}\|values acrossMMindependently trained models\. This is what Theorems[22](https://arxiv.org/html/2605.21492#Thmtheorem22)and[28](https://arxiv.org/html/2605.21492#Thmtheorem28)prove is optimal—the minimum\-variance unbiased estimator via Cramér–Rao, Pareto\-optimal on the stable branch of the Design Space\. The theoretical guarantees apply to*any*i\.i\.d\. ensemble averaging, including simple seed averaging \(trainingMMmodels with different random seeds and identical hyperparameters\)\.

The companion paper on first\-mover bias implementsDashas a full pipeline that adds diversity enforcement \(deliberate hyperparameter variation, greedy MaxMin model selection on feature utilization vectors\) and stability diagnostics \(FSI, IS Plot\)\. Diversity enforcement accelerates convergence to the balanced ensemble condition \(Definition[18](https://arxiv.org/html/2605.21492#Thmtheorem18)\): at finiteMM, it produces more equitable attributions than seed averaging alone \(within\-group CV reduced by0\.0110\.011,p<0\.001p<0\.001\)\. For largeMM, simple seed averaging achieves approximate balance via the law of large numbers\. For stability alone, seed averaging suffices; the full pipeline adds equity and diagnostics\.

###### Corollary 19\(Dashachieves equity \(axiom\-derived\)\)\.

For a balanced ensemble and any two featuresj,kj,kin the same groupℓ\\ell,φ¯j=φ¯k\\bar\{\\varphi\}\_\{j\}=\\bar\{\\varphi\}\_\{k\}\.

###### Proof\.

By DGP symmetry, permuting featuresj↔kj\\leftrightarrow kleaves the joint distribution invariant\. For a balanced ensemble, each feature serves as first\-mover equally often, so the summed split counts satisfy∑inj​\(fi\)=∑ink​\(fi\)\\sum\_\{i\}n\_\{j\}\(f\_\{i\}\)=\\sum\_\{i\}n\_\{k\}\(f\_\{i\}\)\. When the proportionality constantccis uniform across models, this gives∑iφj​\(fi\)=∑iφk​\(fi\)\\sum\_\{i\}\\varphi\_\{j\}\(f\_\{i\}\)=\\sum\_\{i\}\\varphi\_\{k\}\(f\_\{i\}\)\. ∎

##### Between\-group stability\.

Under independence of seeds,Var​\(φ¯j\)=Var​\(φj\)/M\\mathrm\{Var\}\(\\bar\{\\varphi\}\_\{j\}\)=\\mathrm\{Var\}\(\\varphi\_\{j\}\)/M, which vanishes asM→∞M\\to\\infty\.

##### Within\-group completeness\.

Sinceφ¯j=φ¯k\\bar\{\\varphi\}\_\{j\}=\\bar\{\\varphi\}\_\{k\}for same\-group features, the consensus ranking produces a*tie*rather than an arbitrary ordering\. The tie is not a deficiency—it faithfully reflects the DGP symmetry\.

### 5\.1DASH Pareto Optimality

###### Definition 20\(Attribution aggregation method\)\.

An*attribution aggregation method*AAtakes as inputMMindependently trained modelsf1,…,fMf\_\{1\},\\ldots,f\_\{M\}and produces a consensus attribution vectorφ^∈ℝP\\hat\{\\varphi\}\\in\\mathbb\{R\}^\{P\}\. The method is:

- •*Linear*:φ^j=∑i=1Mwi​φj​\(fi\)\\hat\{\\varphi\}\_\{j\}=\\sum\_\{i=1\}^\{M\}w\_\{i\}\\varphi\_\{j\}\(f\_\{i\}\)for some weightsw1,…,wMw\_\{1\},\\ldots,w\_\{M\}\.
- •*Unbiased*:𝔼​\[φ^j\]=μj:=𝔼​\[φj​\(f\)\]\\mathbb\{E\}\[\\hat\{\\varphi\}\_\{j\}\]=\\mu\_\{j\}:=\\mathbb\{E\}\[\\varphi\_\{j\}\(f\)\]for alljj\.
- •*Symmetric*:w1=⋯=wMw\_\{1\}=\\cdots=w\_\{M\}\(the models are exchangeable\)\.

Dashis the unique symmetric unbiased linear method:wi=1/Mw\_\{i\}=1/Mfor allii\.

###### Definition 21\(Pairwise stability and unfaithfulness\)\.

For featuresj,kj,kin different groups withμj\>μk\\mu\_\{j\}\>\\mu\_\{k\}:

- •*Pairwise stability*:Sj​k​\(A\)=Pr⁡\[φ^j\>φ^k\]S\_\{jk\}\(A\)=\\Pr\[\\hat\{\\varphi\}\_\{j\}\>\\hat\{\\varphi\}\_\{k\}\]\(probability that the consensus preserves the true ordering for this pair\)\.
- •*Between\-group flip rate*:1−Sj​k​\(A\)1\-S\_\{jk\}\(A\)\.

For featuresj,kj,kin the same group withμj=μk\\mu\_\{j\}=\\mu\_\{k\}\(DGP symmetry\):

- •*Unfaithfulness*:Uj​k​\(A\)=Pr⁡\[φ^j≠φ^k​and the ordering disagrees with​f\]U\_\{jk\}\(A\)=\\Pr\[\\hat\{\\varphi\}\_\{j\}\\neq\\hat\{\\varphi\}\_\{k\}\\text\{ and the ordering disagrees with \}f\]for a random modelff\.

*Relationship to ranking stabilitySS\.*The Design Space Theorem \(§[6](https://arxiv.org/html/2605.21492#S6)\) uses the full\-ranking stabilitySS\(expected Spearman correlation\)\. The pairwise stabilitySj​kS\_\{jk\}here is a per\-pair component: highSj​kS\_\{jk\}for all between\-group pairs is necessary \(but not sufficient\) for highSS\. Within\-group pairs contribute toSSthrough their random ordering, which is whyS≤1−3​m2/\(P3−P\)S\\leq 1\-3m^\{2\}/\(P^\{3\}\{\-\}P\)even when all between\-groupSj​kS\_\{jk\}are high\.

###### Theorem 22\(DASH Pareto Optimality\)\.

Letf1,…,fMf\_\{1\},\\ldots,f\_\{M\}be i\.i\.d\. models withμj:=𝔼​\[φj​\(f\)\]\\mu\_\{j\}:=\\mathbb\{E\}\[\\varphi\_\{j\}\(f\)\]andσj2:=Var​\(φj​\(f\)\)<∞\\sigma\_\{j\}^\{2\}:=\\mathrm\{Var\}\(\\varphi\_\{j\}\(f\)\)<\\infty\.

Part I \(Lower bounds\)\.For any attribution aggregation methodAA:

1. \(a\)IfAAis faithful to each individual model, then for symmetric featuresj,kj,k,Uj​k​\(A\)=1/2U\_\{jk\}\(A\)=1/2\.
2. \(b\)For any unbiased estimatorμ^j\\hat\{\\mu\}\_\{j\}based onf1,…,fMf\_\{1\},\\ldots,f\_\{M\},Var​\(μ^j\)≥σj2/M\\mathrm\{Var\}\(\\hat\{\\mu\}\_\{j\}\)\\geq\\sigma\_\{j\}^\{2\}/M\(Cramér–Rao bound\)\.

Part II \(Dashachieves the bounds\)\.

1. \(c\)Uj​k​\(Dash\)=0U\_\{jk\}\(\\text\{\{Dash\}\{\}\}\)=0for symmetric features in balanced ensembles\.
2. \(d\)Var​\(φ¯j\)=σj2/M\\mathrm\{Var\}\(\\bar\{\\varphi\}\_\{j\}\)=\\sigma\_\{j\}^\{2\}/M\(matching Cramér–Rao\)\.
3. \(e\)For between\-group features with gapΔj​k\\Delta\_\{jk\}:Sj​k​\(Dash\)≥1−exp⁡\(−M​Δj​k2/\(2​σj​k2\)\)S\_\{jk\}\(\\text\{\{Dash\}\{\}\}\)\\geq 1\-\\exp\(\-M\\Delta\_\{jk\}^\{2\}/\(2\\sigma\_\{jk\}^\{2\}\)\)\.

Part III \(Pareto optimality\)\.Among all methods achievingUj​k=0U\_\{jk\}=0\(ties for symmetric features\), no method achieves strictly higher between\-group stability thanDashfor the same ensemble sizeMM\.

###### Proof\.

Part I\(a\):By DGP symmetry,Pr⁡\[φj​\(f\)\>φk​\(f\)\]=Pr⁡\[φk​\(f\)\>φj​\(f\)\]=1/2\\Pr\[\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\]=\\Pr\[\\varphi\_\{k\}\(f\)\>\\varphi\_\{j\}\(f\)\]=1/2\. Any fixed ranking disagrees with exactly half the models \(Theorem[29](https://arxiv.org/html/2605.21492#Thmtheorem29)\)\.

Part I\(b\):Sinceφj​\(f1\),…,φj​\(fM\)\\varphi\_\{j\}\(f\_\{1\}\),\\ldots,\\varphi\_\{j\}\(f\_\{M\}\)are i\.i\.d\. with meanμj\\mu\_\{j\}and varianceσj2\\sigma\_\{j\}^\{2\}, the Fisher information for the mean is1/σj21/\\sigma\_\{j\}^\{2\}per observation, giving total informationM/σj2M/\\sigma\_\{j\}^\{2\}fromMMobservations\. The Cramér–Rao bound givesVar​\(μ^j\)≥σj2/M\\mathrm\{Var\}\(\\hat\{\\mu\}\_\{j\}\)\\geq\\sigma\_\{j\}^\{2\}/M\.

Part II\(c\):By Corollary[19](https://arxiv.org/html/2605.21492#Thmtheorem19),φ¯j=φ¯k\\bar\{\\varphi\}\_\{j\}=\\bar\{\\varphi\}\_\{k\}for symmetric features in balanced ensembles\.Dashreports a tie; since no ordering is asserted,U=0U=0\.

Part II\(d\):For i\.i\.d\. random variables,Var​\(1M​∑i=1MXi\)=Var​\(X1\)/M\\mathrm\{Var\}\(\\frac\{1\}\{M\}\\sum\_\{i=1\}^\{M\}X\_\{i\}\)=\\mathrm\{Var\}\(X\_\{1\}\)/M\. This matches Part I\(b\), soDashis*efficient*in the Cramér–Rao sense\. Moreover, since the sufficient statistic forμj\\mu\_\{j\}from i\.i\.d\. observations is∑φj​\(fi\)\\sum\\varphi\_\{j\}\(f\_\{i\}\), andφ¯j\\bar\{\\varphi\}\_\{j\}is a function of this statistic, the Rao–Blackwell theorem guaranteesDashdominates any estimator that is not a function of the sufficient statistic\.

Part II\(e\):By Hoeffding’s inequality \(or the Gaussian approximation for largeMM\):Pr⁡\[φ¯j<φ¯k\]≤exp⁡\(−M​Δj​k2/\(2​σj​k2\)\)\\Pr\[\\bar\{\\varphi\}\_\{j\}<\\bar\{\\varphi\}\_\{k\}\]\\leq\\exp\(\-M\\Delta\_\{jk\}^\{2\}/\(2\\sigma\_\{jk\}^\{2\}\)\)\. For the Gaussian approximation \(valid by CLT forM≥30M\\geq 30\):Pr⁡\[φ¯j<φ¯k\]=Φ​\(−Δj​k​M/σj​k\)\\Pr\[\\bar\{\\varphi\}\_\{j\}<\\bar\{\\varphi\}\_\{k\}\]=\\Phi\(\-\\Delta\_\{jk\}\\sqrt\{M\}/\\sigma\_\{jk\}\)\.

Part III:UnfaithfulnessU=0U=0is already minimal\. StabilitySj​kS\_\{jk\}is a monotone decreasing function ofVar​\(φ¯j−φ¯k\)\\mathrm\{Var\}\(\\bar\{\\varphi\}\_\{j\}\-\\bar\{\\varphi\}\_\{k\}\)\. By Part I\(b\), no unbiased method achieves lower variance thanσj2/M\\sigma\_\{j\}^\{2\}/M\.Dashachieves this bound\. For biased methods: any method with biasbjb\_\{j\}has MSE=Var​\(φ^j\)\+bj2=\\mathrm\{Var\}\(\\hat\{\\varphi\}\_\{j\}\)\+b\_\{j\}^\{2\}; a bias of magnitude\|bj−bk\|\>Δj​k\|b\_\{j\}\-b\_\{k\}\|\>\\Delta\_\{jk\}would invert the true ordering entirely\. ∎

##### Summary of optimality\.

Dashis the unique method that: \(1\) achieves zero within\-group unfaithfulness \(ties for symmetric features\); \(2\) achieves the Cramér–Rao variance boundσ2/M\\sigma^\{2\}/Mfor ranking stability; and \(3\) is the minimum\-variance unbiased estimator of𝔼​\[φj\]\\mathbb\{E\}\[\\varphi\_\{j\}\]among*all*estimators \(not just linear ones\), by the Rao–Blackwell theorem: since the sufficient statistic forμj\\mu\_\{j\}from i\.i\.d\. observations is∑φj​\(fi\)\\sum\\varphi\_\{j\}\(f\_\{i\}\), andφ¯j\\bar\{\\varphi\}\_\{j\}is a function of this sufficient statistic, it dominates any estimator that is not\.

##### Comparison with nonlinear aggregations\.

###### Proposition 23\(Median is less efficient\)\.

For i\.i\.d\. observations from a distribution with meanμ\\mu, varianceσ2\\sigma^\{2\}, and densitypp, the sample median has asymptotic variance:

Var​\(median\)=14​M​p​\(med\)2\\mathrm\{Var\}\(\\text\{median\}\)=\\frac\{1\}\{4M\\,p\(\\text\{med\}\)^\{2\}\}wheremedis the population median\. For the normal distribution,p​\(μ\)=1/\(σ​2​π\)p\(\\mu\)=1/\(\\sigma\\sqrt\{2\\pi\}\), givingVar​\(median\)=π​σ22​M\\mathrm\{Var\}\(\\text\{median\}\)=\\frac\{\\pi\\sigma^\{2\}\}\{2M\}\. The asymptotic relative efficiency \(ARE\) of the median vs\. the mean is:

ARE​\(median,mean\)=2π≈0\.637\.\\text\{ARE\}\(\\text\{median\},\\text\{mean\}\)=\\frac\{2\}\{\\pi\}\\approx 0\.637\.The median requiresπ/2≈1\.57\\pi/2\\approx 1\.57times as many models to achieve the same stability asDash\.

###### Proof\.

Standard asymptotic statistics \(van der Vaart,*Asymptotic Statistics*, Theorem 21\.6\)\. The sample median is asymptotically normal with variance1/\(4​n​p​\(m\)2\)1/\(4n\\,p\(m\)^\{2\}\)\. Substituting the Gaussian density at the mean gives the result\. ∎

###### Proposition 24\(Trimmed mean interpolates\)\.

Theα\\alpha\-trimmed mean \(discarding the top and bottomα\\alphafraction of observations\) has ARE relative to the mean of:

ARE​\(trimmedα,mean\)=\(1−2​α\)​σ2σα2\\text\{ARE\}\(\\text\{trimmed\}\_\{\\alpha\},\\text\{mean\}\)=\\frac\{\(1\-2\\alpha\)\\sigma^\{2\}\}\{\\sigma^\{2\}\_\{\\alpha\}\}whereσα2\\sigma^\{2\}\_\{\\alpha\}is the variance of the truncated distribution\. For Gaussian data:

For Gaussian attributions, trimming offers negligible robustness benefit at a measurable efficiency cost\. The 10%\-trimmed mean requires1/0\.966≈3\.5%1/0\.966\\approx 3\.5\\%more models thanDashfor the same stability\.

### 5\.2Empirical Comparison with Alternatives

We compareDashagainst four alternative stabilization approaches across three correlation levels \(ρ∈\{0\.5,0\.7,0\.9\}\\rho\\in\\\{0\.5,0\.7,0\.9\\\}\), with 10 independent trials and bootstrap 95% confidence intervals on within\-group flip rates:

Table 4:Flip rate comparison:Dashvs\. alternative stabilization methods\. Synthetic Gaussian data \(P=10P\{=\}10,m=5m\{=\}5,N=1000N\{=\}1000, 20 within\-group feature pairs\)\. 95% bootstrap CIs in brackets\.Bootstrap and subsampled SHAP address SHAP*estimation*noise \(a single\-model phenomenon\) but not the Rashomon effect \(a multi\-model phenomenon\)\. They were not designed for multi\-model instability, so their flip rates matching the single\-model baseline is expected rather than informative\. They are included to confirm that estimation\-noise methods do not incidentally address model\-multiplicity noise\. OnlyDashtrains multiple models, achieving a 4–5×\\timesreduction\.

CI SHAP achieves lower flip rates thanDashby refusing to rank pairs whose confidence intervals overlap—resolving only∼\\sim55% of within\-group pairs \(∼\\sim22/40\)\. This comparison is not apples\-to\-apples: CI SHAP’s low flip rate applies only to resolved pairs, whileDash’s 3–4% applies to all 40 pairs\. CI SHAP exemplifies the impossibility theorem in action: it trades completeness for stability\. Atρ=0\.9\\rho=0\.9, its flip rate converges towardDash’s \(3\.1%3\.1\\%vs\.3\.7%3\.7\\%\) as overlapping CIs force more pairs into “tied” status\.

The two approaches correspond to the two families in the Design Space Theorem:Dash\(Family B: stable, faithful, near\-complete via ensemble averaging\) and CI SHAP \(Family A: stable, faithful, explicitly incomplete via ties\)\.

### 5\.3DASH Robustness and Breakdown Point

Dash\(the sample mean\) is the minimum\-variance unbiased estimator, but it has breakdown point zero: a single adversarial or corrupted model can shift the consensus attribution arbitrarily\. We compare robustness properties:

For production settings with potential model contamination \(corrupted training data, adversarial seeds, or hardware failures producing degenerate models\), the 5%\-trimmed mean provides near\-optimal efficiency \(ARE=0\.992=0\.992, requiring only0\.8%0\.8\\%more models\) with meaningful robustness\. The median requiresπ/2≈57%\\pi/2\\approx 57\\%more models but tolerates up to 50% corrupted models\. ForM=25M=25: the 5%\-trimmed mean discards the single most extreme model in each tail \(Meff=23M\_\{\\text\{eff\}\}=23\), a negligible cost\. For adversarial robustness, the median withM=40M=40achieves comparable stability toDashwithM=25M=25while tolerating up to 20 corrupted models\.

### 5\.4DASH Information Loss

Dashachieves stability by discarding model\-specific within\-group information\. For a group ofmmsymmetric features, a single model produces a complete ranking \(one ofm\!m\!possible orderings\)\. Since each of them\!m\!orderings is equally likely under DGP symmetry, the ranking carrieslog2⁡\(m\!\)\\log\_\{2\}\(m\!\)bits of information about the specific model\.Dashreports a tie, discarding the entirelog2⁡\(m\!\)\\log\_\{2\}\(m\!\)bits\. For typical group sizes:

Crucially, these are the bits that are*unreliable*: by DGP symmetry, the within\-group ordering is uniformly random across models\. The informationDashdiscards is exactly the information that would be different if the model were retrained\.

For features in different groups with population gapΔj​k\\Delta\_\{jk\}and noiseσj​k\\sigma\_\{jk\}, the mutual information between the consensus ranking and the true ordering is:

Ibetween​\(M\)=1−H2​\(Φ​\(−Δj​k​Mσj​k\)\)I\_\{\\text\{between\}\}\(M\)=1\-H\_\{2\}\\\!\\left\(\\Phi\\\!\\left\(\-\\frac\{\\Delta\_\{jk\}\\sqrt\{M\}\}\{\\sigma\_\{jk\}\}\\right\)\\right\)whereH2​\(p\)=−p​log2⁡p−\(1−p\)​log2⁡\(1−p\)H\_\{2\}\(p\)=\-p\\log\_\{2\}p\-\(1\-p\)\\log\_\{2\}\(1\-p\)is binary entropy\. AsM→∞M\\to\\infty,Ibetween→1I\_\{\\text\{between\}\}\\to 1bit:Dash*increases*between\-group information\. The total information change is:

Δ​I=−L⋅log2⁡\(m\!\)⏟within\-group loss\+\(L2\)⋅\(Ibetween​\(M\)−Ibetween​\(1\)\)⏟between\-group gain\.\\Delta I=\\underbrace\{\-L\\cdot\\log\_\{2\}\(m\!\)\}\_\{\\text\{within\-group loss\}\}\+\\underbrace\{\\tbinom\{L\}\{2\}\\cdot\(I\_\{\\text\{between\}\}\(M\)\-I\_\{\\text\{between\}\}\(1\)\)\}\_\{\\text\{between\-group gain\}\}\.For moderateρ\\rho\(≤0\.7\\leq 0\.7\), the between\-group gain dominates quickly:M=25M=25achieves near\-perfect between\-group determination while the within\-group loss is fixed\.Dashhonestly reports unreliability rather than presenting arbitrary information as reliable\.

##### Interpretation for safety\-critical applications\.

For a system withL=4L=4groups ofm=5m=5features:Dashloses4×6\.9=27\.64\\times 6\.9=27\.6bits \(within\-group\) but gains up to6×1=66\\times 1=6bits \(between\-group\)\. The net loss is≈21\.6\{\\approx\}21\.6bits atM=∞M=\\infty\. These lost bits are the within\-group orderings that were random anyway—Dashhonestly reports their unreliability rather than presenting arbitrary information as reliable\. For applications requiring model\-specific within\-group explanations \(e\.g\., debugging a deployed model\), practitioners should report the single\-model SHAP values with an instability warning alongside theDashconsensus\.

![Refer to caption](https://arxiv.org/html/2605.21492v1/x2.png)Figure 2:Left:Within\-group information lost byDash\(log2⁡m\!\\log\_\{2\}m\!bits per group, independent ofMMandρ\\rho\)\.Right:Between\-group information per pair as a function ofMM\.Dashsharpens between\-group rankings with increasingMM\. At highρ\\rho\(≥0\.9\\geq 0\.9\), convergence requires largerMM\.
##### Ensemble size lower bound\.

###### Proposition 26\(Ensemble size lower bound\)\.

For any unbiased attribution aggregation method achieving between\-group stabilitySj​k≥1−δS\_\{jk\}\\geq 1\-\\deltafor featuresj,kj,kin different groups with population gapΔj​k=\|μj−μk\|\\Delta\_\{jk\}=\|\\mu\_\{j\}\-\\mu\_\{k\}\|and attribution noiseσj​k2=Var​\(φj​\(f\)−φk​\(f\)\)\\sigma\_\{jk\}^\{2\}=\\mathrm\{Var\}\(\\varphi\_\{j\}\(f\)\-\\varphi\_\{k\}\(f\)\), the ensemble size must satisfy:

M≥σj​k2Δj​k2⋅\(Φ−1​\(1−δ\)\)2\.M\\;\\geq\\;\\frac\{\\sigma\_\{jk\}^\{2\}\}\{\\Delta\_\{jk\}^\{2\}\}\\cdot\\bigl\(\\Phi^\{\-1\}\(1\-\\delta\)\\bigr\)^\{2\}\.Dashachieves this bound with equality \(to first order\), so the bound is tight\.

###### Proof\.

By the Cramér–Rao bound, any unbiased estimatorμ^j\\hat\{\\mu\}\_\{j\}hasVar​\(μ^j\)≥σj2/M\\mathrm\{Var\}\(\\hat\{\\mu\}\_\{j\}\)\\geq\\sigma\_\{j\}^\{2\}/M\. The between\-group flip rate satisfies1−Sj​k=Pr⁡\[φ^j<φ^k\]≥Φ​\(−Δj​k​M/σj​k\)1\-S\_\{jk\}=\\Pr\[\\hat\{\\varphi\}\_\{j\}<\\hat\{\\varphi\}\_\{k\}\]\\geq\\Phi\(\-\\Delta\_\{jk\}\\sqrt\{M\}/\\sigma\_\{jk\}\)\. SettingΦ​\(−Δj​k​M/σj​k\)≤δ\\Phi\(\-\\Delta\_\{jk\}\\sqrt\{M\}/\\sigma\_\{jk\}\)\\leq\\deltaand solving:Δj​k​M/σj​k≥Φ−1​\(1−δ\)\\Delta\_\{jk\}\\sqrt\{M\}/\\sigma\_\{jk\}\\geq\\Phi^\{\-1\}\(1\-\\delta\), givingM≥σj​k2⋅\(Φ−1​\(1−δ\)\)2/Δj​k2M\\geq\\sigma\_\{jk\}^\{2\}\\cdot\(\\Phi^\{\-1\}\(1\-\\delta\)\)^\{2\}/\\Delta\_\{jk\}^\{2\}\.DashachievesVar​\(φ¯j−φ¯k\)=σj​k2/M\\mathrm\{Var\}\(\\bar\{\\varphi\}\_\{j\}\-\\bar\{\\varphi\}\_\{k\}\)=\\sigma\_\{jk\}^\{2\}/M\(matching Cramér–Rao\), so the bound is tight\. ∎

Forδ=0\.05\\delta=0\.05\(5% flip rate\),Φ−1​\(0\.95\)=1\.645\\Phi^\{\-1\}\(0\.95\)=1\.645, soMmin=⌈2\.71⋅σj​k2/Δj​k2⌉M\_\{\\min\}=\\lceil 2\.71\\cdot\\sigma\_\{jk\}^\{2\}/\\Delta\_\{jk\}^\{2\}\\rceil, whereσ\\sigmaandΔ\\Deltaare estimated from a pilot run ofM0=5M\_\{0\}=5models\. For Breast Cancer’s most unstable pair \(worst perimeter vs\. worst area,Δ/σ≈0\.15\\Delta/\\sigma\\approx 0\.15\):Mmin≈120M\_\{\\min\}\\approx 120—consistent with the observed slow convergence \(flip rate 29\.8% even atM=25M=25, reaching 0% only atM=50M=50\)\. Bootstrap validation \(50 models, 200 trials\): for all pairs withSNR≥0\.35\\text\{SNR\}\\geq 0\.35\(Mmin≤25M\_\{\\min\}\\leq 25\), theDashflip rate atM=25M=25is≤3%\\leq 3\\%, confirming the formula\. This closes the gap between upper and lower bounds:Dashis optimal not just in the Pareto sense but in the sample complexity sense\.

### 5\.5Progressive DASH: Adaptive Ensemble Sizing

TrainingM=25M\{=\}25models for every explanation is wasteful when most feature pairs are stable\.*ProgressiveDash*starts with a small ensemble and adaptively increasesMMonly for pairs that remain unstable:

1. 1\.Screen\(M0=5M\_\{0\}=5\): Train 5 models\. Run the single\-model screen\. If no pairs are flagged, stop\.
2. 2\.Confirm\(M1=10M\_\{1\}=10\): For flagged pairs, train 5 more models \(M=10M=10total\)\. Run the multi\-model Z\-test\. Pairs with\|Z\|<1\.96\|Z\|<1\.96are confirmed unstable; report as tied group\.
3. 3\.Resolve\(M2=25M\_\{2\}=25\): For pairs where\|Z\|\|Z\|is borderline \(1\.5<\|Z\|<2\.51\.5<\|Z\|<2\.5\), train 15 more models \(M=25M=25total\)\. Final classification: stable \(distinct ranks\) or unstable \(tied group\)\.

##### Expected cost\.

In the 37\-dataset survey, 40% of datasets have no flagged pairs \(stop atM0=5M\_\{0\}=5\), 35% are resolved atM1=10M\_\{1\}=10, and 25% require the fullM2=25M\_\{2\}=25\. The expected ensemble size is0\.40×5\+0\.35×10\+0\.25×25=11\.750\.40\\times 5\+0\.35\\times 10\+0\.25\\times 25=11\.75, approximately∼8×\{\\sim\}8\\timesthe cost of a single model on average—a2\.1×2\.1\\timessavings over always trainingM=25M=25\. \(TheZZ\-thresholds 1\.96 and 3\.0 are fixed\-sample values; a fully sequential design should use Pocock\- or O’Brien\-Fleming\-corrected boundaries to control familywise error\. We present this as a practical heuristic, not a formally analyzed procedure\.\)

## 6The Attribution Design Space

The impossibility, the quantitative bounds, and theDashresolution are facets of a single structural theorem characterizing the complete attribution design space\.

###### Definition 27\(Attribution design space\)\.

The*attribution design space*is the set of triples\(S,U,C\)\(S,U,C\)achievable by any attribution aggregation method, whereS∈\[0,1\]S\\in\[0,1\]is ranking stability \(expected Spearman correlation between two independent evaluations\),U∈\[0,1/2\]U\\in\[0,1/2\]is within\-group unfaithfulness, andC∈\{complete,partial\}C\\in\\\{\\text\{complete\},\\text\{partial\}\\\}is completeness\.

###### Theorem 28\(Attribution Design Space\)\.

For any model class satisfying the Rashomon property under within\-group correlationρ\>0\\rho\>0, the achievable set of\(S,U,C\)\(S,U,C\)triples is the union of exactly two families:

- •Family𝒜\\mathcal\{A\}\(single\-model\):S≤1−3​m2/\(P3−P\)S\\leq 1\-3m^\{2\}/\(P^\{3\}\{\-\}P\),U=1/2U=1/2,C=completeC=\\text\{complete\}\. Any method faithful to an individual model falls here\.
- •Familyℬ\\mathcal\{B\}\(ensemble\):SM=1−O​\(1/M\)S\_\{M\}=1\-O\(1/M\),U=0U=0,C=partial \(ties\)C=\\text\{partial \(ties\)\}\.Dash\(M\)\(M\)achieves this and is Pareto\-optimal among unbiased aggregations\.

The triple\(S=1,U=0,C=complete\)\(S\{=\}1,U\{=\}0,C\{=\}\\text\{complete\}\)is infeasible\. At the extremes, the design space collapses to a single axis: ensemble sizeMM\.

###### Proof\.

The proof proceeds in four steps\.

Step 1: Family𝒜\\mathcal\{A\}is forced\.By the Rashomon property, for any within\-group pair\(j,k\)\(j,k\), there exist models ranking them in opposite orders\. By Theorem[29](https://arxiv.org/html/2605.21492#Thmtheorem29), any faithful, complete ranking hasU=1/2U=1/2for symmetric pairs\. Stability is bounded byS≤1−3​m2/\(P3−P\)S\\leq 1\-3m^\{2\}/\(P^\{3\}\{\-\}P\)from the Spearman bound \(Lean\-derived\)\.

Step 2: Familyℬ\\mathcal\{B\}is achievable\.By Corollary[19](https://arxiv.org/html/2605.21492#Thmtheorem19),DashachievesU=0U=0with ties within groups\. By Theorem[22](https://arxiv.org/html/2605.21492#Thmtheorem22), between\-group stability satisfiesSM≥1−exp⁡\(−M​Δ2/\(2​σ2\)\)S\_\{M\}\\geq 1\-\\exp\(\-M\\Delta^\{2\}/\(2\\sigma^\{2\}\)\)\.

Step 3: No method producing a deterministic binary ranking from per\-model attributions lies outside𝒜∪ℬ\\mathcal\{A\}\\cup\\mathcal\{B\}\.We show any methodAAcomputing a deterministic ranking from per\-model attributions\(φj​\(f1\),…,φj​\(fM\)\)\(\\varphi\_\{j\}\(f\_\{1\}\),\\ldots,\\varphi\_\{j\}\(f\_\{M\}\)\)falls in one of the two families\. \(Methods producing probabilistic rankings, confidence intervals, or set\-valued outputs are outside this dichotomy\.\)

*Case 1:*IfAAis faithful to individual models and complete, thenA∈𝒜A\\in\\mathcal\{A\}by Step 1\. \(Formalized in Lean asstrongly\_faithful\_impossibleinDesignSpace\.lean: any method faithful to each model’s attributions contradicts the Rashomon property forM≥2M\\geq 2\.\)

*Case 2:*IfAAis not faithful to some modelff, thenAAranks some pair\(j,k\)\(j,k\)differently from modelff’s attributions\. For within\-group symmetric pairs, the optimal unfaithful ranking isj≻∗k⇔𝔼​\[φj\]\>𝔼​\[φk\]j\\succ^\{\*\}k\\Leftrightarrow\\mathbb\{E\}\[\\varphi\_\{j\}\]\>\\mathbb\{E\}\[\\varphi\_\{k\}\], which minimizes expected0\-11loss\. For symmetric features𝔼​\[φj\]=𝔼​\[φk\]\\mathbb\{E\}\[\\varphi\_\{j\}\]=\\mathbb\{E\}\[\\varphi\_\{k\}\], so≻∗\\succ^\{\*\}assigns a tie—recovering the “drop completeness” solution\. ThusAAeither hasU\>0U\>0\(suboptimal\) orU=0U=0with ties \(inℬ\\mathcal\{B\}\)\.

*Case 3:*IfAAaggregatesM\>1M\>1models and produces a complete ranking, it must break ties for within\-group pairs\. By DGP symmetry, any tie\-breaking rule disagrees with a fraction of models, givingU\>0U\>0\. To achieveU=0U=0,AAmust report ties, placing it inℬ\\mathcal\{B\}\. Its stability is bounded by the variance of the aggregation, which by the Cramér–Rao bound satisfiesVar​\(μ^j\)≥σj2/M\\mathrm\{Var\}\(\\hat\{\\mu\}\_\{j\}\)\\geq\\sigma\_\{j\}^\{2\}/M\.Dashachieves this bound\.

Step 4: The infeasible point\.\(1,0,complete\)\(1,0,\\text\{complete\}\)requires completeness, but any complete method hasU=1/2≠0U=1/2\\neq 0: contradiction\. ∎

###### Theorem 29\(Unfaithfulness lower bound\)\.

Any stable, complete ranking≻\\succhas expected unfaithfulness at least1/21/2for symmetric pairs:

Prf⁡\[j≻k​but​φk​\(f\)\>φj​\(f\)\]=12\.\\Pr\_\{f\}\\bigl\[\\,j\\succ k\\;\\text\{but\}\\;\\varphi\_\{k\}\(f\)\>\\varphi\_\{j\}\(f\)\\,\\bigr\]\\;=\\;\\frac\{1\}\{2\}\.

###### Proof\.

By DGP symmetry,Pr⁡\[φj​\(f\)\>φk​\(f\)\]=Pr⁡\[φk​\(f\)\>φj​\(f\)\]=1/2\\Pr\[\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\]=\\Pr\[\\varphi\_\{k\}\(f\)\>\\varphi\_\{j\}\(f\)\]=1/2\. Any stable ranking must fixj≻kj\\succ kork≻jk\\succ jindependently offf\. Whichever it chooses disagrees with exactly half the models\. ∎

###### Theorem 30\(Relaxation path convergence\)\.

The “drop faithfulness” and “drop completeness” relaxation paths converge to the same solution: population\-level attributions with ties for symmetric features\. The impossibility trilemma collapses to a single tradeoff axis parameterized by ensemble sizeMM:

- •AtM=1M=1: faithfulness and completeness, but no stability;
- •AsM→∞M\\to\\infty: stability and between\-group faithfulness, but within\-group ties \(completeness relaxed\)\.

Between\-group faithfulness is preserved at allMM\.

###### Proof\.

By the analysis of Step 3 above, the optimal stable complete ranking assigns ties to symmetric features \(𝔼​\[φj\]=𝔼​\[φk\]\\mathbb\{E\}\[\\varphi\_\{j\}\]=\\mathbb\{E\}\[\\varphi\_\{k\}\], so the optimal decision for “isφj​\(f\)\>φk​\(f\)\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)?” under the symmetric model distribution is indeterminate\)—identical to the “drop completeness” solution \(Dash\)\. Both paths yield population\-level attributions\. TheMM\-parameterization follows fromDashconsensus:φ¯j=1M​∑i=1Mφj​\(fi\)\\bar\{\\varphi\}\_\{j\}=\\frac\{1\}\{M\}\\sum\_\{i=1\}^\{M\}\\varphi\_\{j\}\(f\_\{i\}\), which interpolates between a single model \(M=1M=1, faithful but unstable\) and the population mean \(M→∞M\\to\\infty, stable but tied within groups\)\. ∎

##### The single tradeoff axis\.

The Design Space Theorem collapses the three\-dimensional space to a single axis: ensemble sizeMM\.

##### Previous results as corollaries\.

###### Corollary 31\(Theorem 1 as a corollary\)\.

The Attribution Impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) is the statement that the point\(1,0,complete\)\(1,0,\\text\{complete\}\)lies outside the achievable set\. This follows from Step 4 of Theorem[28](https://arxiv.org/html/2605.21492#Thmtheorem28)\.

###### Corollary 32\(F2 as a corollary\)\.

The DASH Pareto Optimality \(Theorem[22](https://arxiv.org/html/2605.21492#Thmtheorem22)\) is the statement thatℬ\\mathcal\{B\}is the Pareto frontier of\{\(S,U\):U=0\}\\\{\(S,U\):U=0\\\}, parameterized byMM\. This follows from Steps 2–3 of Theorem[28](https://arxiv.org/html/2605.21492#Thmtheorem28)\.

###### Corollary 33\(Path convergence as a corollary\)\.

The relaxation path convergence \(Theorem[30](https://arxiv.org/html/2605.21492#Thmtheorem30)\) is the statement that*both*relaxation paths \(drop faithfulness, drop completeness\) converge toℬ\\mathcal\{B\}asM→∞M\\to\\infty\. Dropping completeness directly entersℬ\\mathcal\{B\}\(DASH with ties\)\. Dropping faithfulness, by the optimal unfaithful ranking analysis, yields the expected\-attribution ranking, which also produces ties for symmetric features — the same asℬ\\mathcal\{B\}\.

###### Corollary 34\(Z\-test as a corollary\)\.

The Rashomon Characterization \(Theorem[58](https://arxiv.org/html/2605.21492#Thmtheorem58)\) describes the*boundary between families*: whenZj​k<1\.96Z\_\{jk\}<1\.96, the pair\(j,k\)\(j,k\)is in the regime where Family𝒜\\mathcal\{A\}hasU=1/2U=1/2\(rankings are unreliable\); whenZj​k\>1\.96Z\_\{jk\}\>1\.96, the pair is effectively between\-group \(stable rankings possible withinℬ\\mathcal\{B\}\)\.

###### Corollary 35\(F3 as a corollary\)\.

The FIM Impossibility \(Theorem[49](https://arxiv.org/html/2605.21492#Thmtheorem49)\) provides a sufficient condition for the Rashomon property \(the prerequisite for Theorem[28](https://arxiv.org/html/2605.21492#Thmtheorem28)\): when the FIM eigenvalueλ−\\lambda\_\{\-\}is small alongej−eke\_\{j\}\-e\_\{k\}, the Rashomon set is large, and the achievable set is restricted to𝒜∪ℬ\\mathcal\{A\}\\cup\\mathcal\{B\}\.

![Refer to caption](https://arxiv.org/html/2605.21492v1/x3.png)Figure 3:The Attribution Design Space\. Family𝒜\\mathcal\{A\}\(single\-model methods\): faithful and complete but unstable \(U=1/2U\{=\}1/2\)\. Familyℬ\\mathcal\{B\}\(Dashensemble\): stable with ties \(U=0U\{=\}0,SSincreasing withMM\)\. The ideal point\(S=1,U=0,C=complete\)\(S\{=\}1,U\{=\}0,C\{=\}\\text\{complete\}\)is infeasible\. There is no third option\.

## 7The Symmetric Bayes Dichotomy: A General Two\-Families Theorem

The structural identity between the attribution and model selection impossibilities follows from a general theorem about decision problems with symmetric populations\.

###### Definition 36\(Symmetric Decision Problem\)\.

A*symmetric decision problem*is a tuple\(Θ,𝒟,π,G\)\(\\Theta,\\mathcal\{D\},\\pi,G\)whereΘ\\Thetais a finite decision set,𝒟\\mathcal\{D\}is the data space,π\\piis a population distribution over𝒟\\mathcal\{D\}, andGGis a group acting onΘ\\Thetasuch thatπ\\piisGG\-invariant: for anyg∈Gg\\in G, the distribution over instance\-optimal decisionsθ∗​\(d\)\\theta^\{\*\}\(d\)is invariant undergg\.

AnMM\-sample estimatorθ^:𝒟M→Θ\\hat\{\\theta\}:\\mathcal\{D\}^\{M\}\\to\\Thetais:

- •*Faithful*:θ^​\(d1,…,dM\)\\hat\{\\theta\}\(d\_\{1\},\\ldots,d\_\{M\}\)agrees withθ∗​\(di\)\\theta^\{\*\}\(d\_\{i\}\)for eachii\.
- •*Stable*:θ^\\hat\{\\theta\}does not depend on which drawdid\_\{i\}is observed\.
- •*Complete*:θ^\\hat\{\\theta\}selects exactly one element from eachGG\-orbit inΘ\\Theta\.

###### Theorem 37\(Symmetric Bayes Dichotomy\)\.

For any symmetric decision problem with\|G⋅θ\|≥2\|G\\cdot\\theta\|\\geq 2for someθ∈Θ\\theta\\in\\Theta:

1. \(i\)Instance\-specific decisions are unfaithful\.Any faithful, complete estimator has expected unfaithfulness≥1/\|G⋅θ\|\\geq 1/\|G\\cdot\\theta\|per orbit \(≥1/2\\geq 1/2for binary orbits\)\.
2. \(ii\)Population\-averaged decisions are stable\.The Bayes estimator underπ\\pireports ties within eachGG\-orbit \(U=0U=0\), with between\-orbit stabilityO​\(1/M\)O\(1/M\)\.
3. \(iii\)The ideal is infeasible\.No estimator achievesU=0U=0AND completeness\.

The achievable set consists of exactly two families:𝒜\\mathcal\{A\}\(faithful \+ complete,U≥1/\|G⋅θ\|U\\geq 1/\|G\\cdot\\theta\|\) andℬ\\mathcal\{B\}\(population\-averaged,U=0U=0, ties within orbits\)\.

###### Proof\.

Part \(i\)\.ByGG\-invariance, the population distributionπ\\piassigns equal probability to each element of the orbitG⋅θG\\cdot\\theta\. For any fixed complete estimatorθ^\\hat\{\\theta\}that selects one elementθ0\\theta\_\{0\}from the orbit, the probability thatθ∗​\(d\)=θ0\\theta^\{\*\}\(d\)=\\theta\_\{0\}is1/\|G⋅θ\|1/\|G\\cdot\\theta\|\. The estimator disagrees with\(\|G⋅θ\|−1\)/\|G⋅θ\|\(\|G\\cdot\\theta\|\-1\)/\|G\\cdot\\theta\|of the instances\. For\|G⋅θ\|=2\|G\\cdot\\theta\|=2: unfaithfulness=1/2=1/2\.

Part \(ii\)\.The Bayes estimator under symmetricπ\\piminimizes expected loss\. Within each orbit, the posterior is uniform \(byGG\-invariance\), so the Bayes\-optimal decision is the orbit center \(a tie\)\. Unfaithfulness=0=0because no ordering is asserted within orbits\. For between\-orbit decisions with gapΔ\\Delta, theMM\-sample average has varianceσ2/M\\sigma^\{2\}/M\(i\.i\.d\. draws\), giving stability1−O​\(1/M\)1\-O\(1/M\)by the Gaussian approximation\.

Part \(iii\)\.By Part \(i\), any complete estimator \(selecting within orbits\) has unfaithfulness≥1/\|G⋅θ\|\>0\\geq 1/\|G\\cdot\\theta\|\>0\. Thus unfaithfulness=0=0requires giving up completeness \(ties\)\.

Exhaustiveness\.Any estimator either selects within orbits \(faithful, complete,𝒜\\mathcal\{A\}\) or reports ties within orbits \(stable, incomplete,ℬ\\mathcal\{B\}\)\. The Bayes estimator achieves the minimum\-variance point ofℬ\\mathcal\{B\}\(Cramér–Rao\)\. ∎

The Symmetric Bayes Dichotomy connects the classical theory of invariant decision rules\(Lehmann and Romano,[2005](https://arxiv.org/html/2605.21492#bib.bib20); Hunt and Stein,[1946](https://arxiv.org/html/2605.21492#bib.bib15)\)to modern ML impossibility proofs\. The classical Hunt–Stein theorem establishes that Bayes\-optimal rules respect the invariance structure of the problem; our contribution is demonstrating that this classical machinery, when applied to finite symmetric groups arising in ML \(feature permutations, model permutations, CPDAG automorphisms\), yields two\-family impossibility results with explicit unfaithfulness and stability bounds\. We demonstrate this across three structurally distinct instances with different symmetry groups\.

### 7\.1Instance 1: Feature Attribution

###### Corollary 38\(Feature attribution as instance\)\.

The Attribution Impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) and Design Space Theorem \(Theorem[28](https://arxiv.org/html/2605.21492#Thmtheorem28)\) are instances of the Symmetric Bayes Dichotomy withΘ=\\Theta=within\-group feature orderings,G=G=symmetric group on group members,𝒟=\\mathcal\{D\}=trained models\.

### 7\.2Instance 2: Model Selection

ConsiderKKcandidate modelsg1,…,gKg\_\{1\},\\ldots,g\_\{K\}trained on the same data\. A*model selection rule*maps a validation dataset to a ranking of theKKmodels\. We formalize three desiderata:

###### Definition 39\(Model selection desiderata\)\.

A model selection ruleRRis:

- •*Faithful*:RRranks modelgig\_\{i\}abovegjg\_\{j\}whenevergig\_\{i\}has lower validation loss on the observed validation set\.
- •*Stable*:RRproduces the same ranking regardless of which validation split is drawn\.
- •*Complete*:RRdecides for every pair\(gi,gj\)\(g\_\{i\},g\_\{j\}\)\.

###### Definition 40\(Model Rashomon property\)\.

A model class satisfies the*model Rashomon property*if for every pairgi,gjg\_\{i\},g\_\{j\}with similar population loss \(\|L​\(gi\)−L​\(gj\)\|<ε\|L\(g\_\{i\}\)\-L\(g\_\{j\}\)\|<\\varepsilon\), there exist validation splitsV,V′V,V^\{\\prime\}such thatgig\_\{i\}has lower loss onVVandgjg\_\{j\}has lower loss onV′V^\{\\prime\}\.

This property is a consequence of finite\-sample noise: when the population loss gap is smaller than the validation noise, different splits rank the models differently\. It is the model selection analogue of feature attribution’s Rashomon property\.

###### Theorem 41\(Model Selection Impossibility\)\.

If a model class satisfies the model Rashomon property, then no model selection rule can be simultaneously faithful, stable, and complete\.

###### Proof\.

Letgi,gjg\_\{i\},g\_\{j\}have similar population loss\. By the model Rashomon property, there exist validation splitsV,V′V,V^\{\\prime\}withgig\_\{i\}ranked abovegjg\_\{j\}onVVand reversed onV′V^\{\\prime\}\. A faithful, stable, complete selection rule would need to rankgi\>gjg\_\{i\}\>g\_\{j\}\(fromVV\) andgj\>gig\_\{j\}\>g\_\{i\}\(fromV′V^\{\\prime\}\) simultaneously\. Contradiction\. ∎

###### Theorem 42\(Model Selection Design Space\)\.

Under the model Rashomon property, the achievable design space has the same two\-family structure:

- •Family𝒜′\\mathcal\{A\}^\{\\prime\}\(single\-split\):Faithful and complete but unstable\. Any selection based on one validation split falls here\. UnfaithfulnessU′=1/2U^\{\\prime\}=1/2for similar\-loss pairs\.
- •Familyℬ′\\mathcal\{B\}^\{\\prime\}\(cross\-validation/ensemble\):Stable \(varianceO​\(1/Kfolds\)O\(1/K\_\{\\text\{folds\}\}\)\) but reports ties for similar\-loss pairs\. Model ensembling is the analogue ofDash\.

###### Proof\.

By DGP symmetry \(equal\-loss models have symmetric validation score distributions\), any fixed selection of one model over an equal\-loss competitor disagrees with half the validation splits \(U′=1/2U^\{\\prime\}=1/2\)\. Cross\-validated selection averages across splits, reducing unfaithfulness to zero for equal\-loss pairs while stabilizing at rateO​\(1/Kfolds\)O\(1/K\_\{\\text\{folds\}\}\)\. Pareto optimality follows from the same Cramér–Rao argument\. ∎

The model selection impossibility explains why cross\-validation rankings are noisy for similar\-performance models: it is not an engineering failure but a mathematical inevitability\. The resolution is the same: average \(ensemble\) rather than select\.

##### Connection to cross\-validation instability\.

The model selection impossibility is not merely an analogy—it explains a well\-known practical phenomenon\. When two models have similar cross\-validation scores, different folds often rank them differently\. Practitioners typically respond by increasing the number of folds or repeating cross\-validation\. The design space theorem shows this is exactly theMM\-parameterization: increasing folds moves along Familyℬ′\\mathcal\{B\}^\{\\prime\}toward higher stability, but at the cost of acknowledging ties for similar\-performance models\. Model ensembling \(training allKKcandidates and averaging predictions\) is the model selection analogue ofDash: it avoids the impossible selection problem entirely by using all models simultaneously\.

###### Corollary 43\(Model selection as instance\)\.

The Model Selection Impossibility \(Theorem[41](https://arxiv.org/html/2605.21492#Thmtheorem41)\) is an instance withΘ=\\Theta=model rankings,G=G=permutations of equal\-loss models,𝒟=\\mathcal\{D\}=validation splits\.

### 7\.3Instance 3: Causal Discovery under Markov Equivalence

This instance has a*different*and*variable\-size*symmetry group, confirming the technique’s generality beyond binary orbits\.

###### Definition 44\(Causal orientation decision problem\)\.

The causal edge orientation problem is a symmetric decision problem\(Θ,𝒟,π,G\)\(\\Theta,\\mathcal\{D\},\\pi,G\)where:

- •Θ\\Thetais the set of full edge orientations consistent with the CPDAG \(i\.e\., the DAGs in\[G∗\]\[G^\{\*\}\]\)\.
- •𝒟\\mathcal\{D\}is the space of finite observational datasets drawn from the true DAGG∗G^\{\*\}\.
- •π\\piis the distribution over datasets \(induced by i\.i\.d\. sampling from the structural equation model\)\.
- •GCPDAGG\_\{\\text\{CPDAG\}\}is the*automorphism group of the CPDAG*: the set of permutations of undirected edge orientations that preserve the CPDAG structure\.

##### Key structural difference\.

The CPDAG automorphism groupGCPDAGG\_\{\\text\{CPDAG\}\}is not restricted to transpositions: for a chainX​—​Y​—​ZX\\text\{\-\-\-\}Y\\text\{\-\-\-\}Z,\|\[G∗\]\|=2\|\[G^\{\*\}\]\|=2withG≅S2G\\cong S\_\{2\}\(like instances 1–2\); for a 3\-node undirected cycle,\|\[G∗\]\|=6\|\[G^\{\*\}\]\|=6withG≅S3G\\cong S\_\{3\}; for larger undirected components,\|\[G∗\]\|\|\[G^\{\*\}\]\|can grow combinatorially\.

###### Theorem 45\(Causal Discovery Impossibility\)\.

For any CPDAG with\|\[G∗\]\|≥2\|\[G^\{\*\}\]\|\\geq 2DAGs in its Markov equivalence class, no edge orientation rule can be simultaneously faithful, stable, and complete\. The achievable set has two families:

- •Family𝒜′′\\mathcal\{A\}^\{\\prime\\prime\}\(single\-dataset\):Faithful and complete but unstable\. UnfaithfulnessU′′=\(\|\[G∗\]\|−1\)/\|\[G∗\]\|U^\{\\prime\\prime\}=\(\|\[G^\{\*\}\]\|\-1\)/\|\[G^\{\*\}\]\|\.
- •Familyℬ′′\\mathcal\{B\}^\{\\prime\\prime\}\(conservative\):Report the CPDAG \(undirected edges for ambiguous orientations\)\. Stable with ties\.U′′=0U^\{\\prime\\prime\}=0\.

###### Proof\.

We verify the premises of the Symmetric Bayes Dichotomy \(Theorem[37](https://arxiv.org/html/2605.21492#Thmtheorem37)\)\.

GG\-invariance ofπ\\pi\.For any two DAGsG1,G2∈\[G∗\]G\_\{1\},G\_\{2\}\\in\[G^\{\*\}\], the Markov equivalence guarantees that they encode the same set of conditional independences\. By the faithfulness assumption, the observational distribution is compatible with bothG1G\_\{1\}andG2G\_\{2\}\. Any statistical test based on finite data cannot distinguish betweenG1G\_\{1\}andG2G\_\{2\}at the population level \(they imply identical distributions\)\. Thereforeπ\\piisGCPDAGG\_\{\\text\{CPDAG\}\}\-invariant\.

Finite\-sample noise reverses optimal choice\.With finite data, empirical conditional independence tests have estimation errorO​\(1/n\)O\(1/\\sqrt\{n\}\)\. For edges that are undirected in the CPDAG, different random samples will favor different orientations\. This is the Rashomon property for edge orientations\.

Application of Theorem[37](https://arxiv.org/html/2605.21492#Thmtheorem37)\.Part \(i\): any complete orientation rule \(selecting one DAG from\[G∗\]\[G^\{\*\}\]\) disagrees with\(\|\[G∗\]\|−1\)/\|\[G∗\]\|\(\|\[G^\{\*\}\]\|\-1\)/\|\[G^\{\*\}\]\|of datasets\. Part \(ii\): the Bayes estimator underGCPDAGG\_\{\\text\{CPDAG\}\}\-invariance reports the CPDAG \(ties for undirected edges\)\. Part \(iii\): the ideal \(stable, faithful, complete\) is infeasible\. Families𝒜′′\\mathcal\{A\}^\{\\prime\\prime\}andℬ′′\\mathcal\{B\}^\{\\prime\\prime\}follow\. ∎

The unfaithfulness boundU≥1/\|G⋅θ\|U\\geq 1/\|G\\cdot\\theta\|yieldsU≥1/2U\\geq 1/2for chains butU≥1/6U\\geq 1/6for triangles and potentially much smaller for larger structures\.

##### What this instance adds\.

Instances 1–2 \(feature attribution and model selection\) both have binary orbits \(\|G⋅θ\|=2\|G\\cdot\\theta\|=2\) with unfaithfulness boundU≥1/2U\\geq 1/2\. Instance 3 has variable\-size orbits \(\|G⋅θ\|=2,6,…\|G\\cdot\\theta\|=2,6,\\ldots\) with unfaithfulness boundU≥1/\|\[G∗\]\|U\\geq 1/\|\[G^\{\*\}\]\|, which can be much smaller than1/21/2for large equivalence classes\. This demonstrates that the Symmetric Bayes Dichotomy is not an artifact of binary symmetry but applies to arbitrary finite group actions, with the unfaithfulness bound adapting to the orbit structure\.

Algorithms like PC and GES correctly output CPDAGs \(Familyℬ′′\\mathcal\{B\}^\{\\prime\\prime\}\) precisely because complete orientation of Markov\-equivalent edges is impossible from observational data alone\. Interventional data breaks the symmetry—analogous to conditional SHAP breaking symmetry whenβj≠βk\\beta\_\{j\}\\neq\\beta\_\{k\}\.

###### Corollary 46\(Causal discovery as SBD instance\)\.

The Causal Discovery Impossibility \(Theorem[45](https://arxiv.org/html/2605.21492#Thmtheorem45)\) is an instance of the Symmetric Bayes Dichotomy withΘ=\\Theta=edge orientations in\[G∗\]\[G^\{\*\}\],G=GCPDAGG=G\_\{\\text\{CPDAG\}\}\(automorphism group of the CPDAG\),𝒟=\\mathcal\{D\}=observational datasets\.

##### Connection to classical invariant decision theory\.

The Symmetric Bayes Dichotomy connects the classical theory of invariant decision rules\(Lehmann and Romano,[2005](https://arxiv.org/html/2605.21492#bib.bib20); Hunt and Stein,[1946](https://arxiv.org/html/2605.21492#bib.bib15)\)to modern ML impossibility proofs\. The classical Hunt–Stein theorem establishes that Bayes\-optimal rules respect the invariance structure of the problem; our contribution is demonstrating that this classical machinery, when applied to finite symmetric groups arising in ML \(feature permutations, model permutations, CPDAG automorphisms\), yields two\-family impossibility results with explicit unfaithfulness and stability bounds\. We demonstrate this across three structurally distinct instances with different symmetry groups\.

## 8Extensions: Conditional, Fairness, and Causal Barriers

### 8\.1Conditional Attribution Impossibility

###### Theorem 47\(Conditional Attribution Impossibility\)\.

Let featuresj,kj,kin the same collinear group satisfy: \(C1\) equal causal effectsβj=βk\\beta\_\{j\}=\\beta\_\{k\}, and \(C2\) symmetric causal position in the causal graphGG\. Then the Rashomon property holds for conditional attributions, and the Attribution Impossibility applies to conditional SHAP\.

###### Proof\.

Under \(C1\)–\(C2\), the causal graph is symmetric with respect tojjandkk\. By the DGP symmetry argument \(Theorem[9](https://arxiv.org/html/2605.21492#Thmtheorem9)\), any model withφjcond​\(f\)\>φkcond​\(f\)\\varphi\_\{j\}^\{\\text\{cond\}\}\(f\)\>\\varphi\_\{k\}^\{\\text\{cond\}\}\(f\)has a permuted counterpartf′f^\{\\prime\}with reversed attributions and the same loss\. This is the Rashomon property for conditional attributions\. ∎

##### The escape condition\.

Ifβj≠βk\\beta\_\{j\}\\neq\\beta\_\{k\}, conditional SHAP can resolve the pair\. The thresholdΔ​β∗​\(ρ\)\\Delta\\beta^\{\*\}\(\\rho\)grows steeply: atρ≤0\.7\\rho\\leq 0\.7, a 15% difference suffices; atρ=0\.9\\rho=0\.9, features must differ by nearly a factor of 2; atρ≥0\.95\\rho\\geq 0\.95, instability is essentially total\. Empirical thresholds:Δ​β∗​\(0\.5\)≈0\.15\\Delta\\beta^\{\*\}\(0\.5\)\\approx 0\.15,Δ​β∗​\(0\.7\)≈0\.15\\Delta\\beta^\{\*\}\(0\.7\)\\approx 0\.15,Δ​β∗​\(0\.8\)≈0\.4\\Delta\\beta^\{\*\}\(0\.8\)\\approx 0\.4,Δ​β∗​\(0\.9\)≈0\.9\\Delta\\beta^\{\*\}\(0\.9\)\\approx 0\.9,Δ​β∗​\(0\.95\)\>1\.0\\Delta\\beta^\{\*\}\(0\.95\)\>1\.0,Δ​β∗​\(0\.99\)\>1\.0\\Delta\\beta^\{\*\}\(0\.99\)\>1\.0\.

Table 5:Flip rate \(%\) as a function ofρ\\rhoand causal effect differenceΔ​β\\Delta\\beta\.![Refer to caption](https://arxiv.org/html/2605.21492v1/x4.png)Figure 4:Flip rate as a function of\(ρ,Δ​β\)\(\\rho,\\Delta\\beta\)\. The impossibility region \(dark\) expands withρ\\rho\. Atρ≥0\.95\\rho\\geq 0\.95, instability persists for allΔ​β≤1\\Delta\\beta\\leq 1\.
##### Fine\-grainedΔ​β\\Delta\\betasweep atρ=0\.9\\rho=0\.9\.

We extend the threshold analysis with a finer sweep overΔ​β∈\{0\.0,0\.1,0\.2,0\.3,0\.5,0\.7,1\.0\}\\Delta\\beta\\in\\\{0\.0,0\.1,0\.2,0\.3,0\.5,0\.7,1\.0\\\}atρ=0\.9\\rho=0\.9\(20 XGBoost models per setting\)\. The transition from instability to stability is sharp, not gradual:

AtΔ​β=0\.10\\Delta\\beta=0\.10, both marginal \(0\.479\) and interventional \(0\.337\) SHAP remain highly unstable\. AtΔ​β=0\.20\\Delta\\beta=0\.20, both snap to zero flips simultaneously\. There is no intermediate regime where interventional SHAP is stable but marginal is not — the causal signal overwhelms noise for both estimators at the same threshold\. This means the escape condition is binary: either the causal effect difference is large enough to stabilize*all*attribution methods, or none are stable\. There is no clean crossover point where one method succeeds and the other fails\. The practical implication: “switch to conditional SHAP” provides no advantage over marginal SHAP at the instability boundary; both methods fail or succeed together\.

##### Causal structure validation\.

Under a known causal structure \(Y=β1​X1\+β2​X2\+0\.5​X3\+εY=\\beta\_\{1\}X\_\{1\}\+\\beta\_\{2\}X\_\{2\}\+0\.5X\_\{3\}\+\\varepsilon,Corr​\(X1,X2\)=ρ\\text\{Corr\}\(X\_\{1\},X\_\{2\}\)=\\rho\), we compare marginal TreeSHAP and interventional TreeSHAP\. In the symmetric case \(β1=β2=1\.0\\beta\_\{1\}=\\beta\_\{2\}=1\.0\), both produce flip rates near 50% at allρ\\rho, confirming the impossibility\. In the asymmetric case \(β1=1\.5\\beta\_\{1\}=1\.5,β2=0\.5\\beta\_\{2\}=0\.5\), both show 0% flips at allρ\\rho—the signal\-to\-noise ratio is high enough to overcome collinearity\-induced noise\. Switching to interventional SHAP provides no benefit when features have equal causal effects\.

##### Caveat\.

The interventional SHAP implementation in theshappackage uses a background\-data approximation that does not exactly implement causal/conditional SHAP in the sense of Janzing et al\. \(2020\)\. Results should be interpreted as evidence about theshappackage’s interventional mode, not as a definitive test of the theoretical conditional attribution\.

### 8\.2Fairness Audit Impossibility

###### Theorem 48\(Fairness Audit Impossibility\)\.

If featuresjj\(protected proxy\) andkk\(non\-protected\) satisfy collinearity \(\|ρj​k\|\>ρ0\|\\rho\_\{jk\}\|\>\\rho\_\{0\}\) and similar true importance \(\|μj−μk\|<σj​k⋅zα/M\|\\mu\_\{j\}\-\\mu\_\{k\}\|<\\sigma\_\{jk\}\\cdot z\_\{\\alpha\}/\\sqrt\{M\}\), then for a single\-model audit \(M=1M\{=\}1\):

Pr⁡\[audit flags proxy\]=12±εBE\.\\Pr\[\\text\{audit flags proxy\}\]=\\frac\{1\}\{2\}\\pm\\varepsilon\_\{\\text\{BE\}\}\.The audit conclusion is a coin flip\. Two independent audits reach opposite conclusions about proxy reliance with probability1/21/2\.

###### Proof\.

Direct corollary of the Attribution Impossibility applied to the pair\(j,k\)\(j,k\)\. By Theorem[12](https://arxiv.org/html/2605.21492#Thmtheorem12),Pr⁡\[φj​\(f\)\>φk​\(f\)\]=1/2\\Pr\[\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\]=1/2over training runs\. ∎

##### Implications for AI governance\.

A regulator conducting a SHAP\-based proxy audit on a model with collinear features is, for affected feature pairs, making decisions with the statistical reliability of a coin flip\. Two auditors examining the*same model architecture trained on the same data*with different random seeds may reach opposite conclusions about whether the model relies on a protected attribute\.

Under the EU AI Act Art\. 13\(3\)\(b\)\(ii\), providers must disclose “known and foreseeable circumstances” which may lead to risks to health, safety or fundamental rights\. Our theorem establishes that this includes: “SHAP\-based proxy audits are unreliable for features that are collinear with both the protected attribute and a non\-protected feature\.” The remedy is ensemble auditing: trainMMmodels and useDashconsensus\.

##### Worked example: adverse action notices\.

Consider a credit model with two collinear features:*income*and*debt\-to\-income ratio*\(DTI\), with\|ρ\|≈0\.85\|\\rho\|\\approx 0\.85\. Under ECOA \(Regulation B\), lenders must disclose the principal reasons for adverse action\. With a single model:

- •Seed 1:SHAP ranks income as the top driver⇒\\Rightarrowadverse action notice cites “insufficient income\.”
- •Seed 2:SHAP ranks DTI as the top driver⇒\\Rightarrowadverse action notice cites “excessive debt\-to\-income ratio\.”

The borrower receives a different regulatory disclosure depending on the random seed—a compliance risk\. WithDash\(M=25M=25\), income and DTI are reported as a tied group of key risk drivers, and the adverse action notice can accurately state: “income and debt\-to\-income ratio are jointly the primary risk factors\.” The disclosure is stable, honest, and compliant\.

The instability varies non\-monotonically with correlation: atρ=0\.3\\rho=0\.3, 20% of adverse action reasons change across models; atρ=0\.5\\rho=0\.5–0\.70\.7, the features separate cleanly \(0% instability\); atρ=0\.9\\rho=0\.9, 28% of reasons change\. The non\-monotonicity reflects the interaction between correlation \(which drives the Rashomon property\) and feature importance gaps \(which stabilize rankings\)—at moderateρ\\rho, the gap is large enough to overcome the noise\.

##### Intersectional considerations\.

When multiple protected attributes \(race, gender, age\) are each proxied by collinear non\-protected features, the impossibility applies independently to each proxy pair\. IfKKprotected attributes each have unstable proxies, the probability that a single\-model audit correctly identifies allKKproxy reliance directions is\(1/2\)K\(1/2\)^\{K\}, exponentially vanishing inKK\. ForK=3K=3\(a common intersectional setting\), joint correctness is1/8=12\.5%1/8=12\.5\\%\.

##### Example: lending\.

In credit models, “zip code” \(proxy for race\) is often collinear with “income bracket” \(\|ρ\|≈0\.6\|\\rho\|\\approx 0\.6–0\.80\.8\)\. If both have similar predictive power, a single\-model SHAP audit finding “zip code is the 3rd most important feature” may conclude proxy discrimination—but retraining with a different seed could produce a model where zip code drops to 8th and income rises to 3rd\. The audit conclusion depends on the random seed, not on the model’s actual reliance on the protected attribute\.

### 8\.3Direct FIM Impossibility

The Rashomon property can be derived directly from the Fisher information matrix \(FIM\), providing an independent proof path from classical statistics that does not require the iterative optimizer abstraction\.

##### Classical setup\.

Consider the linear modelY=βj​Xj\+βk​Xk\+εY=\\beta\_\{j\}X\_\{j\}\+\\beta\_\{k\}X\_\{k\}\+\\varepsilonwhereXj,XkX\_\{j\},X\_\{k\}are jointly Gaussian withVar​\(Xj\)=Var​\(Xk\)=1\\mathrm\{Var\}\(X\_\{j\}\)=\\mathrm\{Var\}\(X\_\{k\}\)=1andCov​\(Xj,Xk\)=ρ\\text\{Cov\}\(X\_\{j\},X\_\{k\}\)=\\rho\. The Fisher information matrix for𝜷=\(βj,βk\)\\boldsymbol\{\\beta\}=\(\\beta\_\{j\},\\beta\_\{k\}\)is:

I​\(𝜷\)=1σ2​\(1ρρ1\)I\(\\boldsymbol\{\\beta\}\)=\\frac\{1\}\{\\sigma^\{2\}\}\\begin\{pmatrix\}1&\\rho\\\\ \\rho&1\\end\{pmatrix\}with eigenvaluesλ±=\(1±ρ\)/σ2\\lambda\_\{\\pm\}=\(1\\pm\\rho\)/\\sigma^\{2\}\. Asρ→1\\rho\\to 1, the smaller eigenvalueλ−=\(1−ρ\)/σ2→0\\lambda\_\{\-\}=\(1\-\\rho\)/\\sigma^\{2\}\\to 0\. The FIM becomes near\-singular along the direction𝒗−=\(1,−1\)/2\\boldsymbol\{v\}\_\{\-\}=\(1,\-1\)/\\sqrt\{2\}, which corresponds to redistributing credit betweenjjandkk\. The profile likelihood is flat along this direction: models assigning more credit tojjvs\.kkare statistically indistinguishable\. This flat likelihood ridge is precisely the Rashomon set\. The Cramér–Rao boundVar​\(β^j−β^k\)≥1/λ−=σ2/\(1−ρ\)\\mathrm\{Var\}\(\\hat\{\\beta\}\_\{j\}\-\\hat\{\\beta\}\_\{k\}\)\\geq 1/\\lambda\_\{\-\}=\\sigma^\{2\}/\(1\-\\rho\)quantifies the attribution instability\.

##### Regularity conditions\.

We require the following on the model classℱ=\{fθ:θ∈Θ\}\\mathcal\{F\}=\\\{f\_\{\\theta\}:\\theta\\in\\Theta\\\}:

- \(R1\)Θ⊆ℝp\\Theta\\subseteq\\mathbb\{R\}^\{p\}is open and convex\.
- \(R2\)The population riskL​\(θ\)=𝔼​\[ℓ​\(fθ​\(X\),Y\)\]L\(\\theta\)=\\mathbb\{E\}\[\\ell\(f\_\{\\theta\}\(X\),Y\)\]is three\-times continuously differentiable onΘ\\Theta, with bounded third derivative:‖D3​L​\(θ\)‖op≤K3\\\|D^\{3\}L\(\\theta\)\\\|\_\{\\text\{op\}\}\\leq K\_\{3\}for allθ\\thetain a neighborhood ofθ∗\\theta^\{\*\}\.
- \(R3\)The minimizerθ∗\\theta^\{\*\}satisfies∇L​\(θ∗\)=0\\nabla L\(\\theta^\{\*\}\)=0andH:=∇2L​\(θ∗\)H:=\\nabla^\{2\}L\(\\theta^\{\*\}\)is positive definite\. \(For likelihood\-based models,H=I​\(θ∗\)/nH=I\(\\theta^\{\*\}\)/nwhereI​\(θ∗\)I\(\\theta^\{\*\}\)is the Fisher information matrix\.\)
- \(R4\)The attribution functionφj​\(θ\)\\varphi\_\{j\}\(\\theta\)is*order\-consistent*: for anyθ\\thetawithθj\>θk\>0\\theta\_\{j\}\>\\theta\_\{k\}\>0, we haveφj​\(θ\)\>φk​\(θ\)\\varphi\_\{j\}\(\\theta\)\>\\varphi\_\{k\}\(\\theta\)\. \(Satisfied byφj=\|θj\|\\varphi\_\{j\}=\|\\theta\_\{j\}\|, mean\|SHAPj\|\|\\text\{SHAP\}\_\{j\}\|, or any attribution monotone in coefficient magnitude\.\)

###### Theorem 49\(FIM Impossibility\)\.

Letℱ\\mathcal\{F\}satisfy \(R1\)–\(R4\)\. Suppose featuresj,kj,ksatisfy: \(S1\) DGP symmetry:θj∗=θk∗\>0\\theta^\{\*\}\_\{j\}=\\theta^\{\*\}\_\{k\}\>0; \(S2\) the HessianH=∇2L​\(θ∗\)H=\\nabla^\{2\}L\(\\theta^\{\*\}\)has eigenvalueλ−\\lambda\_\{\-\}alongv=\(ej−ek\)/2v=\(e\_\{j\}\-e\_\{k\}\)/\\sqrt\{2\}\. Then for anyε\\varepsilonsatisfying0<ε≤ε0:=9​λ−3/K320<\\varepsilon\\leq\\varepsilon\_\{0\}:=9\\lambda\_\{\-\}^\{3\}/K\_\{3\}^\{2\}, theε\\varepsilon\-Rashomon setRε=\{θ:L​\(θ\)≤L​\(θ∗\)\+ε\}R\_\{\\varepsilon\}=\\\{\\theta:L\(\\theta\)\\leq L\(\\theta^\{\*\}\)\+\\varepsilon\\\}contains modelsθ\+,θ−\\theta^\{\+\},\\theta^\{\-\}with

φj​\(θ\+\)\>φk​\(θ\+\)andφk​\(θ−\)\>φj​\(θ−\)\.\\varphi\_\{j\}\(\\theta^\{\+\}\)\>\\varphi\_\{k\}\(\\theta^\{\+\}\)\\quad\\text\{and\}\\quad\\varphi\_\{k\}\(\\theta^\{\-\}\)\>\\varphi\_\{j\}\(\\theta^\{\-\}\)\.The Rashomon property holds, and the impossibility follows\.

###### Proof\.

Step 1: Rashomon set geometry\.By Taylor’s theorem with Lagrange remainder, for anyθ∈Θ\\theta\\in\\Theta:

L​\(θ\)=L​\(θ∗\)\+12​\(θ−θ∗\)T​H​\(θ−θ∗\)\+R3​\(θ\),L\(\\theta\)=L\(\\theta^\{\*\}\)\+\\tfrac\{1\}\{2\}\(\\theta\-\\theta^\{\*\}\)^\{T\}H\\,\(\\theta\-\\theta^\{\*\}\)\+R\_\{3\}\(\\theta\),where\|R3​\(θ\)\|≤K36​‖θ−θ∗‖3\|R\_\{3\}\(\\theta\)\|\\leq\\frac\{K\_\{3\}\}\{6\}\\\|\\theta\-\\theta^\{\*\}\\\|^\{3\}by \(R2\)\. The gradient term vanishes because∇L​\(θ∗\)=0\\nabla L\(\\theta^\{\*\}\)=0by \(R3\)\.

Step 2: Perturbation along the weak direction\.Letv=\(ej−ek\)/2v=\(e\_\{j\}\-e\_\{k\}\)/\\sqrt\{2\}and setθδ=θ∗\+δ​v\\theta\_\{\\delta\}=\\theta^\{\*\}\+\\delta vforδ\>0\\delta\>0\. The quadratic cost is12​δ2​λ−\\frac\{1\}\{2\}\\delta^\{2\}\\lambda\_\{\-\}and the cubic remainder satisfies\|R3​\(θδ\)\|≤K36​δ3\|R\_\{3\}\(\\theta\_\{\\delta\}\)\|\\leq\\frac\{K\_\{3\}\}\{6\}\\delta^\{3\}\. We needL​\(θδ\)≤L​\(θ∗\)\+εL\(\\theta\_\{\\delta\}\)\\leq L\(\\theta^\{\*\}\)\+\\varepsilon, i\.e\.,12​δ2​λ−\+K36​δ3≤ε\\frac\{1\}\{2\}\\delta^\{2\}\\lambda\_\{\-\}\+\\frac\{K\_\{3\}\}\{6\}\\delta^\{3\}\\leq\\varepsilon\. Chooseδ∗=ε/λ−\\delta^\{\*\}=\\sqrt\{\\varepsilon/\\lambda\_\{\-\}\}\. The quadratic term isε/2\\varepsilon/2; the conditionε≤9​λ−3/K32\\varepsilon\\leq 9\\lambda\_\{\-\}^\{3\}/K\_\{3\}^\{2\}ensures the cubic term is≤ε/2\\leq\\varepsilon/2\. Soθδ∗∈Rε\\theta\_\{\\delta^\{\*\}\}\\in R\_\{\\varepsilon\}, and by the same argumentθ−δ∗∈Rε\\theta\_\{\-\\delta^\{\*\}\}\\in R\_\{\\varepsilon\}\.

Step 3: Opposite orderings\.Atθ\+:=θδ∗\\theta^\{\+\}:=\\theta\_\{\\delta^\{\*\}\}:θj\+=θj∗\+δ∗/2\>θk∗−δ∗/2=θk\+\>0\\theta^\{\+\}\_\{j\}=\\theta^\{\*\}\_\{j\}\+\\delta^\{\*\}/\\sqrt\{2\}\>\\theta^\{\*\}\_\{k\}\-\\delta^\{\*\}/\\sqrt\{2\}=\\theta^\{\+\}\_\{k\}\>0, so by \(R4\),φj​\(θ\+\)\>φk​\(θ\+\)\\varphi\_\{j\}\(\\theta^\{\+\}\)\>\\varphi\_\{k\}\(\\theta^\{\+\}\)\. Atθ−:=θ−δ∗\\theta^\{\-\}:=\\theta\_\{\-\\delta^\{\*\}\}: by symmetry,θk−\>θj−\>0\\theta^\{\-\}\_\{k\}\>\\theta^\{\-\}\_\{j\}\>0, soφk​\(θ−\)\>φj​\(θ−\)\\varphi\_\{k\}\(\\theta^\{\-\}\)\>\\varphi\_\{j\}\(\\theta^\{\-\}\)\.

Step 4: Conclusion\.Bothθ\+\\theta^\{\+\}andθ−\\theta^\{\-\}lie inRεR\_\{\\varepsilon\}with opposite feature orderings\. This is the Rashomon property\. By Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5), no faithful, stable, complete ranking exists\. ∎

###### Proposition 50\(Gaussian FIM specialization\)\.

For the linear modelY=XT​β\+εY=X^\{T\}\\beta\+\\varepsilonwithε∼𝒩​\(0,σ2\)\\varepsilon\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}\)andCorr​\(Xj,Xk\)=ρ\\text\{Corr\}\(X\_\{j\},X\_\{k\}\)=\\rho:

1. 1\.The Hessian eigenvalue alongej−eke\_\{j\}\-e\_\{k\}isλ−=\(1−ρ\)/σ2\\lambda\_\{\-\}=\(1\-\\rho\)/\\sigma^\{2\}\.
2. 2\.The loss is exactly quadratic \(K3=0K\_\{3\}=0\), soε0=\+∞\\varepsilon\_\{0\}=\+\\infty: the theorem holds for*all*ε\>0\\varepsilon\>0\.
3. 3\.The semi\-axis length ofRεR\_\{\\varepsilon\}alongej−eke\_\{j\}\-e\_\{k\}isσ​2​ε/\(1−ρ\)\\sigma\\sqrt\{2\\varepsilon/\(1\-\\rho\)\}, diverging asρ→1\\rho\\to 1\.
4. 4\.The Cramér–Rao bound givesVar​\(β^j−β^k\)≥2​σ2/\(n​\(1−ρ\)\)\\mathrm\{Var\}\(\\hat\{\\beta\}\_\{j\}\-\\hat\{\\beta\}\_\{k\}\)\\geq 2\\sigma^\{2\}/\(n\(1\-\\rho\)\), diverging asρ→1\\rho\\to 1\.

###### Proof\.

The population risk isL​\(β\)=12​σ2​𝔼​\[\(Y−XT​β\)2\]L\(\\beta\)=\\frac\{1\}\{2\\sigma^\{2\}\}\\mathbb\{E\}\[\(Y\-X^\{T\}\\beta\)^\{2\}\]\. Its Hessian isH=1σ2​𝔼​\[X​XT\]=1σ2​ΣXH=\\frac\{1\}\{\\sigma^\{2\}\}\\mathbb\{E\}\[XX^\{T\}\]=\\frac\{1\}\{\\sigma^\{2\}\}\\Sigma\_\{X\}\. Forv=\(ej−ek\)/2v=\(e\_\{j\}\-e\_\{k\}\)/\\sqrt\{2\}:vT​H​v=1σ2​\(1−ρ\)v^\{T\}Hv=\\frac\{1\}\{\\sigma^\{2\}\}\(1\-\\rho\)sincevT​ΣX​v=Var​\(Xj\)−Cov​\(Xj,Xk\)=1−ρv^\{T\}\\Sigma\_\{X\}v=\\mathrm\{Var\}\(X\_\{j\}\)\-\\text\{Cov\}\(X\_\{j\},X\_\{k\}\)=1\-\\rho\(standardized\)\. The loss is quadratic inβ\\beta, soD3​L≡0D^\{3\}L\\equiv 0andK3=0K\_\{3\}=0\. ∎

The classical non\-identifiability under collinearity \(Var​\(β^j−β^k\)→∞\\mathrm\{Var\}\(\\hat\{\\beta\}\_\{j\}\-\\hat\{\\beta\}\_\{k\}\)\\to\\inftyasρ→1\\rho\\to 1\) is well\-known\. Our contribution is reframing it as an*impossibility theorem*about feature rankings rather than a variance bound on parameter estimates: even precise estimates can produce unstable rankings whenΔ\\Deltais small relative toσ\\sigma\.

##### Loss landscape geometry\.

Theε\\varepsilon\-Rashomon setRεR\_\{\\varepsilon\}is approximately an ellipsoid whose projection onto the feature\-importance axisφj−φk\\varphi\_\{j\}\-\\varphi\_\{k\}crosses zero\. The level sets of the loss landscape contain*ridges*alongej−eke\_\{j\}\-e\_\{k\}—curves of near\-constant loss along which feature importance redistributes betweenjjandkkwithout changing model quality\. The same flatness that makes optimization easy \(flat minima generalize well\) makes attribution hard \(the flat direction is the feature\-importance direction\)\. This connects the attribution impossibility to the broader literature on loss landscape geometry, flat minima, and mode connectivity\.

### 8\.4Query Complexity Lower Bound

A*stability certification algorithm*adaptively selects seedss1,s2,…s\_\{1\},s\_\{2\},\\ldots, callsTrain​\(si\)→fi\\textsc\{Train\}\(s\_\{i\}\)\\to f\_\{i\}andAttribute​\(fi,j\)→φj​\(fi\)\\textsc\{Attribute\}\(f\_\{i\},j\)\\to\\varphi\_\{j\}\(f\_\{i\}\), and afterMMoracle calls outputsStableorUnstable\. The algorithm certifiesδ\\delta\-stability with error≤1/3\\leq 1/3if it correctly distinguishesH0H\_\{0\}:Δj​k=0\\Delta\_\{jk\}=0\(flip rate=1/2=1/2\) fromH1H\_\{1\}:\|Δj​k\|≥Δ0\|\\Delta\_\{jk\}\|\\geq\\Delta\_\{0\}\(flip rate≤Φ​\(−Δ0/σj​k\)\\leq\\Phi\(\-\\Delta\_\{0\}/\\sigma\_\{jk\}\)\) with probability at least2/32/3under both hypotheses\.

###### Theorem 52\(Query complexity lower bound\)\.

Any algorithm that certifiesδ\\delta\-stability of a feature pair\(j,k\)\(j,k\)with error≤1/3\\leq 1/3must make at least

M≥18⋅σj​k2Δ02M\\;\\geq\\;\\frac\{1\}\{8\}\\cdot\\frac\{\\sigma\_\{jk\}^\{2\}\}\{\\Delta\_\{0\}^\{2\}\}model\-training oracle calls, whereσj​k2=Var​\(φj​\(f\)−φk​\(f\)\)\\sigma\_\{jk\}^\{2\}=\\mathrm\{Var\}\(\\varphi\_\{j\}\(f\)\-\\varphi\_\{k\}\(f\)\)andΔ0\\Delta\_\{0\}is the minimum gap to detect\.

###### Proof\.

Each oracle call produces one sampleDi=φj​\(fi\)−φk​\(fi\)D\_\{i\}=\\varphi\_\{j\}\(f\_\{i\}\)\-\\varphi\_\{k\}\(f\_\{i\}\)\. UnderH0H\_\{0\},Di∼P0D\_\{i\}\\sim P\_\{0\}with mean0and varianceσ2:=σj​k2\\sigma^\{2\}:=\\sigma\_\{jk\}^\{2\}\. UnderH1H\_\{1\},Di∼P1D\_\{i\}\\sim P\_\{1\}with meanΔ0\\Delta\_\{0\}and the same variance \(the variance is determined by the collinearity structure, not the gap\)\.

By Le Cam’s two\-point method \(Tsybakov, 2009, Theorem 2\.2\), for any testψ\\psibased onMMi\.i\.d\. observations:

PrH0⁡\[ψ=1\]\+PrH1⁡\[ψ=0\]≥1−TV​\(P0⊗M,P1⊗M\)\.\\Pr\_\{H\_\{0\}\}\[\\psi=1\]\+\\Pr\_\{H\_\{1\}\}\[\\psi=0\]\\geq 1\-\\text\{TV\}\(P\_\{0\}^\{\\otimes M\},P\_\{1\}^\{\\otimes M\}\)\.
By Pinsker’s inequality,

TV​\(P0⊗M,P1⊗M\)≤12​KL​\(P1⊗M∥P0⊗M\)\.\\text\{TV\}\(P\_\{0\}^\{\\otimes M\},P\_\{1\}^\{\\otimes M\}\)\\leq\\sqrt\{\\tfrac\{1\}\{2\}\\text\{KL\}\(P\_\{1\}^\{\\otimes M\}\\\|P\_\{0\}^\{\\otimes M\}\)\}\.For the Gaussian location family,KL​\(P1∥P0\)=Δ02/\(2​σ2\)\\text\{KL\}\(P\_\{1\}\\\|P\_\{0\}\)=\\Delta\_\{0\}^\{2\}/\(2\\sigma^\{2\}\), so forMMi\.i\.d\. copiesKL=M​Δ02/\(2​σ2\)\\text\{KL\}=M\\Delta\_\{0\}^\{2\}/\(2\\sigma^\{2\}\)andTV≤M​Δ02/\(4​σ2\)\\text\{TV\}\\leq\\sqrt\{M\\Delta\_\{0\}^\{2\}/\(4\\sigma^\{2\}\)\}\. For reliable testing \(total error≤2/3\\leq 2/3\), Le Cam’s method requiresTV≥1/3\\text\{TV\}\\geq 1/3, givingM​Δ02/\(4​σ2\)≥1/9M\\Delta\_\{0\}^\{2\}/\(4\\sigma^\{2\}\)\\geq 1/9, henceM≥4​σ2/\(9​Δ02\)M\\geq 4\\sigma^\{2\}/\(9\\Delta\_\{0\}^\{2\}\)\. The standard constant1/81/8from\(Tsybakov,[2009](https://arxiv.org/html/2605.21492#bib.bib31)\)\(Theorem 2\.2\) uses a slightly tighter analysis via the likelihood ratio directly; since1/8<4/91/8<4/9, this gives a weaker \(more conservative\) lower bound than our Pinsker derivation\.

∎

###### Corollary 53\(Near\-optimality of theZZ\-test\)\.

TheZZ\-test detects a gapΔ0\\Delta\_\{0\}with error≤1/3\\leq 1/3usingM=O​\(σj​k2/Δ02⋅log⁡\(1/α\)\)M=O\(\\sigma\_\{jk\}^\{2\}/\\Delta\_\{0\}^\{2\}\\cdot\\log\(1/\\alpha\)\)model trainings\. Combined with Theorem[52](https://arxiv.org/html/2605.21492#Thmtheorem52), theZZ\-test is query\-optimal to within a logarithmic factor\.

###### Proof\.

TheZZ\-test rejectsH0H\_\{0\}when\|D¯\|/\(σ^/M\)\>zα/2\|\\bar\{D\}\|/\(\\hat\{\\sigma\}/\\sqrt\{M\}\)\>z\_\{\\alpha/2\}\. UnderH1H\_\{1\}, power isΦ​\(−zα/2\+Δ0​M/σ\)≥2/3\\Phi\(\-z\_\{\\alpha/2\}\+\\Delta\_\{0\}\\sqrt\{M\}/\\sigma\)\\geq 2/3whenΔ0​M/σ≥zα/2\+0\.43\\Delta\_\{0\}\\sqrt\{M\}/\\sigma\\geq z\_\{\\alpha/2\}\+0\.43\. Forα=0\.05\\alpha=0\.05:M≥\(σ/Δ0\)2​\(1\.96\+0\.43\)2≈5\.7​σ2/Δ02M\\geq\(\\sigma/\\Delta\_\{0\}\)^\{2\}\(1\.96\+0\.43\)^\{2\}\\approx 5\.7\\sigma^\{2\}/\\Delta\_\{0\}^\{2\}\. ∎

### 8\.5Rashomon Inevitability

Theorem[12](https://arxiv.org/html/2605.21492#Thmtheorem12)\(proved in §[3\.4](https://arxiv.org/html/2605.21492#S3.SS4)\) establishes that for any stochastic, symmetric training algorithm on a permutation\-closed model class withρ\>0\\rho\>0, the Rashomon property holds\. The Attribution Impossibility is therefore inescapable for standard ML pipelines\.

### 8\.6Causal Identification Barrier

The attribution instability under collinearity has a direct causal counterpart: distinguishing the causal effects of correlated features requires interventional sample complexity that diverges asΩ​\(1/\(1−ρ\)2\)\\Omega\(1/\(1\-\\rho\)^\{2\}\)—the same singularity structure as the attribution ratio\.

Consider two featuresXj,XkX\_\{j\},X\_\{k\}withCorr​\(Xj,Xk\)=ρ\\text\{Corr\}\(X\_\{j\},X\_\{k\}\)=\\rho, jointly Gaussian with unit variances\. Under a soft intervention with residual correlationρpost\\rho\_\{\\text\{post\}\},Xk∣do​\(Xj=x\)∼𝒩​\(ρpost⋅x,1−ρpost2\)X\_\{k\}\\mid\\text\{do\}\(X\_\{j\}=x\)\\sim\\mathcal\{N\}\(\\rho\_\{\\text\{post\}\}\\cdot x,1\-\\rho\_\{\\text\{post\}\}^\{2\}\)\. Whenβj=βk=β\\beta\_\{j\}=\\beta\_\{k\}=\\betaandρpost≈ρ\\rho\_\{\\text\{post\}\}\\approx\\rho, the two interventional distributions become indistinguishable\.

###### Proposition 55\(Interventional sample complexity lower bound\)\.

Consider testingH0:βj=β\+δ,βk=β−δH\_\{0\}:\\beta\_\{j\}=\\beta\+\\delta,\\beta\_\{k\}=\\beta\-\\deltaagainstH1:βj=β−δ,βk=β\+δH\_\{1\}:\\beta\_\{j\}=\\beta\-\\delta,\\beta\_\{k\}=\\beta\+\\deltausingdo​\(Xj=x\)\\text\{do\}\(X\_\{j\}=x\)interventions with residual correlationρpost\\rho\_\{\\mathrm\{post\}\}\. The number of interventional samples needed satisfies:

nint≥\(zα\+zη\)2​σ24​δ2​\(1−ρpost\)2\.n\_\{\\mathrm\{int\}\}\\geq\\frac\{\(z\_\{\\alpha\}\+z\_\{\\eta\}\)^\{2\}\\sigma^\{2\}\}\{4\\delta^\{2\}\(1\-\\rho\_\{\\mathrm\{post\}\}\)^\{2\}\}\.Whenρpost=ρ\\rho\_\{\\mathrm\{post\}\}=\\rho\(the intervention does not reduce the correlation\),nint=Ω​\(1/\(1−ρ\)2\)n\_\{\\mathrm\{int\}\}=\\Omega\(1/\(1\-\\rho\)^\{2\}\)\.

###### Proof\.

UnderH0H\_\{0\}, the expected response todo​\(Xj=x\)\\text\{do\}\(X\_\{j\}=x\)is\(β\+δ\+ρpost​\(β−δ\)\)​x\(\\beta\+\\delta\+\\rho\_\{\\mathrm\{post\}\}\(\\beta\-\\delta\)\)x; underH1H\_\{1\}it is\(β−δ\+ρpost​\(β\+δ\)\)​x\(\\beta\-\\delta\+\\rho\_\{\\mathrm\{post\}\}\(\\beta\+\\delta\)\)x\. The difference in slopes is2​δ​\(1−ρpost\)2\\delta\(1\-\\rho\_\{\\mathrm\{post\}\}\)\. With noise varianceσ2\\sigma^\{2\}andnnobservations, the Neyman–Pearson sample size formula gives the result\. ∎

##### Hard interventions resolve both problems\.

When the intervention fully breaks the correlation \(ρpost=0\\rho\_\{\\mathrm\{post\}\}=0\), the sample complexity reduces tonint=O​\(σ2/δ2\)n\_\{\\mathrm\{int\}\}=O\(\\sigma^\{2\}/\\delta^\{2\}\)—independent ofρ\\rho\. This parallels the attribution impossibility: perfect interventions break the symmetry \(just as knowing the true causal graph breaks the Rashomon property\), while soft interventions preserve it\.

### 8\.7Local vs\. Global Attribution Instability

The impossibility as stated concerns*global*attributions \(mean\|SHAP\|\|\\text\{SHAP\}\|across data points\)\. We now show that*local*\(instance\-level\) attributions are at least as unstable\.

##### Implication\.

If global rankings are unstable \(flip rate\>10%\>10\\%\), local rankings at individual data points are at least as unstable on average\. Practitioners who report per\-instance SHAP explanations \(e\.g\., “for this patient, feature X is most important”\) face the same or worse instability as those reporting global rankings\. The multi\-model Z\-test diagnostic \(computed on global attributions\) is therefore a conservative screen for local instability as well\.

## 9Diagnostics

### 9\.1Multi\-Model Z\-Test Diagnostic

LetDj=φj​\(f\)−φk​\(f\)D\_\{j\}=\\varphi\_\{j\}\(f\)\-\\varphi\_\{k\}\(f\)denote the attribution difference for a single random modelff\. Defineμj​k=𝔼​\[Dj\]\\mu\_\{jk\}=\\mathbb\{E\}\[D\_\{j\}\]\(population attribution gap\),σj​k2=Var​\(Dj\)\\sigma\_\{jk\}^\{2\}=\\mathrm\{Var\}\(D\_\{j\}\)\(attribution difference variance\), andγj​k=𝔼​\[\|Dj−μj​k\|3\]\\gamma\_\{jk\}=\\mathbb\{E\}\[\|D\_\{j\}\-\\mu\_\{jk\}\|^\{3\}\]\(third absolute central moment, for Berry–Esseen\)\. We require: \(A1\) modelsf1,…,fMf\_\{1\},\\ldots,f\_\{M\}are i\.i\.d\.; \(A2\)σj​k2\>0\\sigma\_\{jk\}^\{2\}\>0\(guaranteed by Theorem[12](https://arxiv.org/html/2605.21492#Thmtheorem12)forρ\>0\\rho\>0\); \(A3\)γj​k<∞\\gamma\_\{jk\}<\\infty\(finite third moment—satisfied by any bounded attribution method\)\.

###### Theorem 58\(Rashomon Characterization\)\.

Under \(A1\)–\(A3\), define the test statistic fromMMmodels:

Zj​k=\|φ¯j−φ¯k\|σ^j​k/MZ\_\{jk\}=\\frac\{\|\\bar\{\\varphi\}\_\{j\}\-\\bar\{\\varphi\}\_\{k\}\|\}\{\\hat\{\\sigma\}\_\{jk\}/\\sqrt\{M\}\}whereσ^j​k2=1M−1​∑i=1M\(Di−D¯\)2\\hat\{\\sigma\}\_\{jk\}^\{2\}=\\frac\{1\}\{M\-1\}\\sum\_\{i=1\}^\{M\}\(D\_\{i\}\-\\bar\{D\}\)^\{2\}is the sample variance\.

Part I \(Flip rate formula\)\.The population flip rate satisfies:

flip​\(j,k\)=Φ​\(−\|μj​k\|σj​k\)\+εBE\\text\{flip\}\(j,k\)=\\Phi\\\!\\left\(\-\\frac\{\|\\mu\_\{jk\}\|\}\{\\sigma\_\{jk\}\}\\right\)\+\\varepsilon\_\{\\text\{BE\}\}\(3\)where the Berry–Esseen error satisfies\|εBE\|≤C0​γj​k/σj​k3\|\\varepsilon\_\{\\text\{BE\}\}\|\\leq C\_\{0\}\\gamma\_\{jk\}/\\sigma\_\{jk\}^\{3\}with universal constantC0≤0\.4748C\_\{0\}\\leq 0\.4748\. The Berry–Esseen bound provides a completeness guarantee: it bounds the worst\-case error of theΦ​\(−SNR\)\\Phi\(\-\\text\{SNR\}\)formula for non\-Gaussian attribution distributions\.

Part II \(Test statistic connection\)\.The test statisticZj​kZ\_\{jk\}consistently estimates the signal\-to\-noise ratio scaled byM\\sqrt\{M\}:

Zj​k=\|μj​k\|σj​k⋅M\+Op​\(1\)Z\_\{jk\}=\\frac\{\|\\mu\_\{jk\}\|\}\{\\sigma\_\{jk\}\}\\cdot\\sqrt\{M\}\+O\_\{p\}\(1\)and the relationship betweenZj​kZ\_\{jk\}and the flip rate is:

flip​\(j,k\)=Φ​\(−Zj​kM\)\+O​\(1M\)\+εBE\\text\{flip\}\(j,k\)=\\Phi\\\!\\left\(\-\\frac\{Z\_\{jk\}\}\{\\sqrt\{M\}\}\\right\)\+O\\\!\\left\(\\frac\{1\}\{\\sqrt\{M\}\}\\right\)\+\\varepsilon\_\{\\text\{BE\}\}\(4\)
Part III \(Diagnostic thresholds\)\.

- •Zj​k<1\.96Z\_\{jk\}<1\.96: the attribution gap is not statistically significant atα=0\.05\\alpha=0\.05\(not to be confused with the signal capture fractionα\\alphain §[4\.1](https://arxiv.org/html/2605.21492#S4.SS1)\)\. The flip rate is≥Φ​\(−1\.96/M\)≥2\.5%\\geq\\Phi\(\-1\.96/\\sqrt\{M\}\)\\geq 2\.5\\%\.Rankings are unreliable; useDash\.
- •Zj​k≥1\.96Z\_\{jk\}\\geq 1\.96: the gap is significant\. The flip rate is≤2\.5%\\leq 2\.5\\%plus theO​\(1/M\)O\(1/\\sqrt\{M\}\)correction\.Rankings are stable for this pair\.

###### Proof\.

Part I\.By \(A1\),D1,…,DMD\_\{1\},\\ldots,D\_\{M\}are i\.i\.d\. with meanμj​k\\mu\_\{jk\}and varianceσj​k2\\sigma\_\{jk\}^\{2\}\. WLOG assumeμj​k≥0\\mu\_\{jk\}\\geq 0\. ThenPr⁡\[D<0\]=Φ​\(−μj​k/σj​k\)\+εBE\\Pr\[D<0\]=\\Phi\(\-\\mu\_\{jk\}/\\sigma\_\{jk\}\)\+\\varepsilon\_\{\\text\{BE\}\}by the Berry–Esseen theorem applied to\(D−μj​k\)/σj​k\(D\-\\mu\_\{jk\}\)/\\sigma\_\{jk\}\.

Part II\.By the law of large numbers,σ^j​k2→𝑝σj​k2\\hat\{\\sigma\}\_\{jk\}^\{2\}\\xrightarrow\{p\}\\sigma\_\{jk\}^\{2\}andD¯→𝑝μj​k\\bar\{D\}\\xrightarrow\{p\}\\mu\_\{jk\}\. ThereforeZj​k=\(\|μj​k\|/σj​k\)​M\+Op​\(1\)Z\_\{jk\}=\(\|\\mu\_\{jk\}\|/\\sigma\_\{jk\}\)\\sqrt\{M\}\+O\_\{p\}\(1\)\. Substituting into \([3](https://arxiv.org/html/2605.21492#S9.E3)\) gives \([4](https://arxiv.org/html/2605.21492#S9.E4)\)\.

Part III\.Direct substitution of the threshold values into \([4](https://arxiv.org/html/2605.21492#S9.E4)\)\. ∎

![Refer to caption](https://arxiv.org/html/2605.21492v1/x5.png)Figure 5:Left:Multi\-model Z\-test statistic vs\. flip rate on Breast Cancer \(r=−0\.89r=\-0\.89\)\. Pairs belowz=1\.96z=1\.96\(dashed\) have unreliable rankings\.Right:Single\-model screen split\-frequency diagnostic \(r=−0\.78r=\-0\.78\)\. Both diagnostics predict which pairs are unstable\.##### Restricted\-range robustness\.

The headline correlationr=−0\.89r=\-0\.89betweenZj​kZ\_\{jk\}and flip rate on Breast Cancer includes many “easy” pairs withZ≫10Z\\gg 10and flip rate=0=0, which could inflate the figure\. Restricting to the diagnostically interesting range:r=−0\.78r=\-0\.78forZ<5Z<5\(n=118n=118pairs\),r=−0\.61r=\-0\.61forZ<3Z<3\(n=74n=74pairs\), andr=−0\.53r=\-0\.53forZ<2Z<2\(n=49n=49pairs\)\. The correlation remains strong forZ<5Z<5, confirming that the diagnostic discriminates among ambiguous pairs, not merely between trivially separable and trivially tied features\. The result also holds for gain\-based importance \(non\-SHAP\):r=−0\.83r=\-0\.83overall,r=−0\.66r=\-0\.66forZ<5Z<5\.

##### Structural correlation baseline\.

SinceZj​kZ\_\{jk\}and flip rate are both computed from the same attribution arrays, part of the negative correlation is structural\. To quantify this, we generated random attribution arrays \(50 models, 30 features, standard normal\) and computed the same metrics: the baseline correlation isr≈−0\.56r\\approx\-0\.56\(R2=0\.32R^\{2\}=0\.32\)\. The observedr=−0\.89r=\-0\.89\(R2=0\.79R^\{2\}=0\.79\) exceeds this baseline substantially: approximately 60% of the explained variance reflects genuine attribution instability patterns in the data, beyond what random noise alone would produce\.

##### Role of Berry–Esseen\.

The Berry–Esseen bounds provide a completeness guarantee: they bound the worst\-case error of theΦ​\(−SNR\)\\Phi\(\-\\text\{SNR\}\)formula for non\-Gaussian attribution distributions\. For the GBDT attributions studied here, the Shapiro–Wilk test confirms near\-Gaussianity \(p\>0\.10p\>0\.10for 412/435 pairs\), so the correction is negligible\. The bounds become relevant for heavy\-tailed distributions \(e\.g\., deep networks with high initialization variance\) or bimodal distributions \(e\.g\., Lasso, where the attribution is eitherc\>0c\>0or0\)\. In these cases, the exact flip ratemin⁡\(p,1−p\)\\min\(p,1\-p\)should be used in place of the Gaussian approximation\.

##### When the CLT fails\.

The Berry–Esseen errorεBE≤C0​γj​k/σj​k3\\varepsilon\_\{\\text\{BE\}\}\\leq C\_\{0\}\\gamma\_\{jk\}/\\sigma\_\{jk\}^\{3\}can be large when: \(i\) the attribution distribution is*heavy\-tailed*\(largeγj​k\\gamma\_\{jk\}\), as occurs for deep networks with high initialization variance—a few seeds produce outlier attributions; or \(ii\) the attribution distribution is*bimodal*, as for Lasso whereφj\\varphi\_\{j\}takes value eitherc\>0c\>0\(selected\) or0\(not selected\), giving a Bernoulli distribution where the Berry–Esseen bound is tight \(εBE≈0\.47\\varepsilon\_\{\\text\{BE\}\}\\approx 0\.47\) but the exact flip ratemin⁡\(p,1−p\)\\min\(p,1\-p\)is available analytically\. For gradient\-boosted trees, the Shapiro–Wilk test on 50 Breast Cancer models givesp\>0\.10p\>0\.10for 412/435 feature pairs; the Berry–Esseen correction is negligible in practice\.

### 9\.2Single\-Model Screen

For a gradient\-boosted ensemble withTTtrees, define the per\-tree split indicatornj​\(t\)∈\{0,1\}n\_\{j\}\(t\)\\in\\\{0,1\\\}\(whether featurejjis used as a split variable in treett\) and split frequencyp^j=1T​∑t=1Tnj​\(t\)\\hat\{p\}\_\{j\}=\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}n\_\{j\}\(t\)\.

##### Exchangeability conditions\.

The theoretical validity of the single\-model screen depends on the dependence structure of the indicators\{nj​\(t\)\}t=1T\\\{n\_\{j\}\(t\)\\\}\_\{t=1\}^\{T\}:

###### Lemma 59\(Exact exchangeability under sub\-sampling\)\.

If the boosting algorithm uses row sub\-sampling \(subsample=q<1=q<1\) with independent bootstrap samples per tree, and feature sub\-sampling \(colsample\_bytree=r<1=r<1\) with independent random subsets per tree, then:

1. 1\.The per\-tree data subsets are independent across trees\.
2. 2\.Conditional on the residuals, the split indicatorsnj​\(1\),nj​\(2\),…,nj​\(T\)n\_\{j\}\(1\),n\_\{j\}\(2\),\\ldots,n\_\{j\}\(T\)are*conditionally exchangeable*: for any permutationπ\\piof\{1,…,T\}\\\{1,\\ldots,T\\\}, \(nj​\(π​\(1\)\),…,nj​\(π​\(T\)\)\)​=𝑑​\(nj​\(1\),…,nj​\(T\)\)∣residuals\.\(n\_\{j\}\(\\pi\(1\)\),\\ldots,n\_\{j\}\(\\pi\(T\)\)\)\\;\\overset\{d\}\{=\}\\;\(n\_\{j\}\(1\),\\ldots,n\_\{j\}\(T\)\)\\;\\mid\\;\\text\{residuals\}\.
3. 3\.The marginal split probabilitypj=𝔼​\[nj​\(t\)\]p\_\{j\}=\\mathbb\{E\}\[n\_\{j\}\(t\)\]is identical for alltt\.

###### Proof\.

Under sub\-sampling, treettis trained on a random subsetSt⊂\{1,…,n\}S\_\{t\}\\subset\\\{1,\\ldots,n\\\}of size⌊q​n⌋\\lfloor qn\\rfloor, drawn independently for eachtt\. The feature subsetFtF\_\{t\}is also drawn independently\. SinceStS\_\{t\}andFtF\_\{t\}are i\.i\.d\. acrosstt, the split decision for treettdepends on\(St,Ft\)\(S\_\{t\},F\_\{t\}\)and the current residuals\. Conditional on residuals, the split indicators are functions of i\.i\.d\. random inputs, hence exchangeable\. The marginal probabilitypj=Pr⁡\[j∈Ft\]⋅Pr⁡\[j​selected∣j∈Ft\]p\_\{j\}=\\Pr\[j\\in F\_\{t\}\]\\cdot\\Pr\[j\\text\{ selected\}\\mid j\\in F\_\{t\}\]is tree\-independent\. ∎

###### Lemma 60\(Approximate exchangeability without sub\-sampling\)\.

Without sub\-sampling \(q=r=1q=r=1\), the split indicators are NOT exchangeable: treettfits the residual from trees1,…,t−11,\\ldots,t\-1, creating a Markov dependence\.

However, for learning rateη≤0\.3\\eta\\leq 0\.3, the residuals converge to a*steady state*afterT0=O​\(1/η\)T\_\{0\}=O\(1/\\eta\)trees\. In the steady state, the split indicators\{nj​\(t\)\}t\>T0\\\{n\_\{j\}\(t\)\\\}\_\{t\>T\_\{0\}\}are approximately stationary with autocorrelationCorr​\(nj​\(t\),nj​\(t\+s\)\)=O​\(η\|s\|\)\\text\{Corr\}\(n\_\{j\}\(t\),n\_\{j\}\(t\+s\)\)=O\(\\eta^\{\|s\|\}\)\(geometric decay\)\.

###### Proof sketch\.

The residual at treettisrt=rt−1−η⋅ht​\(x\)r\_\{t\}=r\_\{t\-1\}\-\\eta\\cdot h\_\{t\}\(x\)wherehth\_\{t\}is the fitted tree\. Forη\\etasmall,‖rt−rt−1‖=O​\(η\)\\\|r\_\{t\}\-r\_\{t\-1\}\\\|=O\(\\eta\), so the residual sequence is a slow\-mixing Markov chain\. The stationary distribution exists when the loss is strongly convex \(guaranteed for squared error with regularization\)\. In the stationary regime, the dependence is AR\(1\)\-like with coefficient≈1−η\\approx 1\-\\eta, giving the geometric decay\. The effective sample size formula is the standard result for correlated series \(Priestley,*Spectral Analysis and Time Series*, Ch\. 5\.3\)\. ∎

The effective sample size for the test statistic is:

Teff=T−T01\+2​∑s=1∞Corr​\(nj​\(t\),nj​\(t\+s\)\)≈\(T−T0\)​\(1−η\)1\+η\.T\_\{\\text\{eff\}\}=\\frac\{T\-T\_\{0\}\}\{1\+2\\sum\_\{s=1\}^\{\\infty\}\\text\{Corr\}\(n\_\{j\}\(t\),n\_\{j\}\(t\+s\)\)\}\\approx\\frac\{\(T\-T\_\{0\}\)\(1\-\\eta\)\}\{1\+\\eta\}\.For typical settings \(T=100T=100,η=0\.1\\eta=0\.1,T0≈10T\_\{0\}\\approx 10\):Teff≈74T\_\{\\text\{eff\}\}\\approx 74, a moderate reduction from the nominalTT\.

###### Theorem 61\(Split\-Frequency Diagnostic\)\.

Under the exchangeability conditions above \(sub\-sampling, or no sub\-sampling withTeffT\_\{\\text\{eff\}\}replacingTT\), define the test statistic:

Zj​ksplit=\|p^j−p^k\|\(p^j​\(1−p^j\)\+p^k​\(1−p^k\)\)/TeffZ^\{\\text\{split\}\}\_\{jk\}=\\frac\{\|\\hat\{p\}\_\{j\}\-\\hat\{p\}\_\{k\}\|\}\{\\sqrt\{\(\\hat\{p\}\_\{j\}\(1\-\\hat\{p\}\_\{j\}\)\+\\hat\{p\}\_\{k\}\(1\-\\hat\{p\}\_\{k\}\)\)/T\_\{\\text\{eff\}\}\}\}
Part I \(Null distribution\)\.UnderH0:pj=pkH\_\{0\}:p\_\{j\}=p\_\{k\}\(equal split frequencies, implied by DGP symmetry\),Zj​ksplitZ^\{\\text\{split\}\}\_\{jk\}is asymptoticallyN​\(0,1\)N\(0,1\)asTeff→∞T\_\{\\text\{eff\}\}\\to\\infty\.

Part II \(Connection to attributions\)\.Under the proportionality axiom \(φj=c⋅nj\\varphi\_\{j\}=c\\cdot n\_\{j\}\),pj=pkp\_\{j\}=p\_\{k\}iff𝔼​\[φj\]=𝔼​\[φk\]\\mathbb\{E\}\[\\varphi\_\{j\}\]=\\mathbb\{E\}\[\\varphi\_\{k\}\]\. The single\-model screen is therefore a proxy for the multi\-model Z\-test \(Theorem[58](https://arxiv.org/html/2605.21492#Thmtheorem58)\), computable from a single model\.

Part III \(Power\)\.Under the alternativepj≠pkp\_\{j\}\\neq p\_\{k\}, the power at levelα\\alphais:

power=Φ​\(\|pj−pk\|​Teffpj​\(1−pj\)\+pk​\(1−pk\)−zα/2\)\+o​\(1\)\.\\text\{power\}=\\Phi\\\!\\left\(\\frac\{\|p\_\{j\}\-p\_\{k\}\|\\sqrt\{T\_\{\\text\{eff\}\}\}\}\{\\sqrt\{p\_\{j\}\(1\-p\_\{j\}\)\+p\_\{k\}\(1\-p\_\{k\}\)\}\}\-z\_\{\\alpha/2\}\\right\)\+o\(1\)\.

##### Screen accuracy\.

On the Breast Cancer dataset \(435 pairs, threshold: flip rate\>0\.1\>0\.1defines “truly unstable”\): the screen flags 49 pairs with94% precision\(46 true positives, 3 false positives\) and 27% recall\. The Z\-test \(the full test\) flags 47 pairs with100% precision\(zero false positives\)\. Both diagnostics are conservative: they rarely flag stable pairs but miss moderate\-instability pairs\. For production use, the high precision is the key property—a flagged pair is almost certainly unstable\.

Screen precision is 94–100% on small/clean datasets \(Breast Cancer, Wine, Heart Disease\) where split counts are reliable, but drops to 48–67% on high\-dimensional datasets \(Ames, Communities\) where split counts are sparse\. This confirms the screen as a conservative screening tool that should be supplemented by the full Z\-test for high\-dimensional settings\.

##### Sub\-sampling requirement\.

The theoretical guarantee \(exact exchangeability, Lemma[59](https://arxiv.org/html/2605.21492#Thmtheorem59)\) requires sub\-sampling\. Without sub\-sampling, the approximate exchangeability of Lemma[60](https://arxiv.org/html/2605.21492#Thmtheorem60)applies with reduced effective sample sizeTeffT\_\{\\text\{eff\}\}\. In practice, our validation usescolsample\_bytree=1\.0\(no sub\-sampling\) and still achievesr=−0\.78r=\-0\.78\(Figure[5](https://arxiv.org/html/2605.21492#S9.F5), right\), suggesting the dependence correction is modest\.

##### Regulatory response for ties\.

If a regulator asks why features are tied: “These features are statistically indistinguishable in their contribution to the model\. Forcing a ranking would be arbitrary and potentially misleading\. Our method correctly reports this indistinguishability, consistent with the EU AI Act’s requirement to disclose known limitations\.”

### 9\.3SNR Calibration

For features with importance gapΔ\\Deltaand noiseσ\\sigma, the flip rate isΦ​\(−SNR\)\\Phi\(\-\\text\{SNR\}\)whereSNR=Δ/σ\\text\{SNR\}=\\Delta/\\sigma\. Across 1,325 correlated feature pairs from 6 datasets, the formula is exact forSNR≥0\.5\\text\{SNR\}\\geq 0\.5\(R2=0\.94R^\{2\}=0\.94on Breast Cancer\) but overestimates at low SNR \(predicting 40% when the empirical rate is 18%\), making it a*conservative*diagnostic: it flags more pairs than necessary but misses none in the actionable range\.

![Refer to caption](https://arxiv.org/html/2605.21492v1/x6.png)Figure 6:Universal SNR calibration across 6 datasets \(1,325 feature pairs\)\. The theoreticalΦ​\(−SNR\)\\Phi\(\-\\text\{SNR\}\)curve is conservative at low SNR and exact at diagnostic thresholds\. All 228 pairs withSNR\>1\.96\\text\{SNR\}\>1\.96have flip rate<5%<5\\%\.
### 9\.4Practitioner Workflow

1. Step 0\.Identify correlated groups\.Compute theP×PP\\times Pabsolute correlation matrix\. Group features with\|ρj​k\|\>0\.5\|\\rho\_\{jk\}\|\>0\.5\.
2. Step 1\.Train one model\. ComputeZj​ksplitZ^\{\\text\{split\}\}\_\{jk\}for all pairs in correlated groups \(single\-model screen\)\. Cost:O​\(P2​T\)O\(P^\{2\}T\)\.
3. Step 2\.IfZj​ksplit<1\.96Z^\{\\text\{split\}\}\_\{jk\}<1\.96for any pair: flag as potentially unstable\.
4. Step 3\.For flagged pairs: trainM=5M=5models, computeZj​kZ\_\{jk\}\(Z\-test\)\. IfZj​k<1\.96Z\_\{jk\}<1\.96: useDashwithM≥25M\\geq 25\.
5. Step 4\.If no pairs are flagged: single\-model SHAP is reliable\.

##### Minimal implementation\.

```
import xgboost as xgb
import shap
import numpy as np

# Train M models with different seeds
models = [xgb.XGBRegressor(random_state=i).fit(X_train, y_train)
          for i in range(25)]

# Compute SHAP for each model
shap_vals = np.array([
    np.mean(np.abs(shap.TreeExplainer(m).shap_values(X_test)), axis=0)
    for m in models
])

# DASH consensus = mean across models
dash = np.mean(shap_vals, axis=0)

# Z-test diagnostic: Z-test for each feature pair
for j in range(P):
    for k in range(j+1, P):
        diff = shap_vals[:, j] - shap_vals[:, k]
        Z = abs(np.mean(diff)) / (np.std(diff, ddof=1) / np.sqrt(25))
        if Z < 1.96:
            print(f"Unstable: features {j} vs {k}, Z={Z:.2f}")
```

##### Production deployment guide\.

- •If subsample<1\.0<1\.0\(stochastic, recommended\):Run the single\-model screen→\\toZ\-test \(5\-model validation\)→\\toDash\(M≥25M\\geq 25\) for flagged pairs\.
- •If subsample=1\.0=1\.0\(deterministic\):A single pipeline version produces reproducible rankings\. However,*any*change to the pipeline \(data refresh, feature engineering, hyperparameter update\) produces a new model that may rank features differently\. Run Z\-test validation whenever the pipeline changes\. For ongoing model risk management, maintain an ensemble and reportDashconsensus\.
- •Minimum ensemble size:Mmin=⌈2\.71⋅σj​k2/Δj​k2⌉M\_\{\\min\}=\\lceil 2\.71\\cdot\\sigma\_\{jk\}^\{2\}/\\Delta\_\{jk\}^\{2\}\\rceilfor 5% between\-group flip rate\. Estimateσ\\sigmaandΔ\\Deltafrom a pilot run of 5 models\.

##### Complementary diagnostics\.

The single\-model screen and multi\-model Z\-test developed here are formal hypothesis tests with controlled type I error\. The companion first\-mover bias paper introduces complementary*exploratory*diagnostics: FSI \(Feature Stability Index, a per\-feature coefficient of variation across models\) and the IS Plot \(Importance\-Stability scatter plot\)\. The recommended combined workflow is: Screen \(1 model\)→\\toZ\-test \(confirm, 5 models\)→\\toDash\(resolve,M≥25M\\geq 25\)→\\toFSI/IS Plot \(audit\)\.

##### Recommended instability disclosure\.

When reporting SHAP rankings for a model with collinear features: “Features \[X, Y, Z\] form a correlated group \(\|ρ\|\>\[threshold\]\|\\rho\|\>\[\\text\{threshold\}\]\)\. Their relative ranking is unstable across training seeds \(estimated flip rate: \[X\]%\)\. They should be interpreted as interchangeable contributors\. The between\-group ranking is stable \(Z\>1\.96Z\>1\.96\)\.” For regulatory reporting \(EU AI Act, SR 11\-7\(Office of the Comptroller of the Currency,[2011](https://arxiv.org/html/2605.21492#bib.bib24)\)\), theDashconsensus ranking provides a defensible explanation\.

##### Group\-level reporting\.

When reporting feature importance for a model with correlated groups, we recommend the following format: “The correlated group \{X, Y, Z\} contributes a totalDashattribution of \[value\] to the prediction \(\[p​e​r​c​e​n​t\]%\[percent\]\\%of total\)\. Within this group, individual feature rankings are unstable across training seeds \(estimated flip rate:\[X\]%\[X\]\\%\)\. The group’s total importance is stable; individual feature importance within the group should be interpreted as interchangeable\. For variable selection, any feature from this group may be chosen; the choice is arbitrary with respect to model quality\.”

## 10Empirical Validation

### 10\.1Experimental Setup

Table 6:Experimental configurations\.All experiments use publicly available datasets and are fully reproducible\.Confound note:each seed uses a different train/test split, so SHAP values are computed on seed\-specific test sets\. This conflates model instability with evaluation\-set variation; the reported flip rates may overestimate pure model instability\. The mechanism isolation experiment \(§[10\.10](https://arxiv.org/html/2605.21492#S10.SS10)below\) partially addresses this by comparing deterministic vs\. stochastic training\. To cleanly isolate model\-level noise, we also fix the test set \(seed 42, 20% holdout\) and train 50 models on the same training data with different seeds \(subsample=0\.8\)\. With the fixed test set, 102 pairs \(23%\) are unstable \(max flip rate 0\.51\), compared to 162 \(37%\) with varying test sets—confirming that model\-level stochasticity accounts for the majority \(∼63%\{\\sim\}63\\%\) of the observed instability, with evaluation\-set variation contributing the remainder\.

### 10\.2Synthetic Gaussian

We generateP=20P=20features inL=4L=4groups ofm=5m=5, with within\-group correlationρ∈\{0\.1,0\.3,0\.5,0\.7,0\.9,0\.95\}\\rho\\in\\\{0\.1,0\.3,0\.5,0\.7,0\.9,0\.95\\\}, and train XGBoost models withT=100T=100boosting rounds over 50 independent seeds per setting\. TreeSHAP values provide feature attributions\.

![Refer to caption](https://arxiv.org/html/2605.21492v1/x7.png)\(a\)Attribution ratio vs\.ρ\\rho\. The corrected1/\(1−α​ρ2\)1/\(1\{\-\}\\alpha\\rho^\{2\}\)withα≈2/π\\alpha\{\\approx\}2/\\pi\(solid\) fits stumps \(R2=0\.89R^\{2\}\{=\}0\.89\)\.
![Refer to caption](https://arxiv.org/html/2605.21492v1/x8.png)\(b\)Ranking instability vs\.ρ\\rho\. Single\-model instability grows with correlation;Dashremains low\.
![Refer to caption](https://arxiv.org/html/2605.21492v1/x9.png)\(c\)Dashconsensus convergence\. Attribution CV drops toward the 1% threshold nearM=25M=25\.

Figure 7:Empirical validation on synthetic Gaussian data \(P=20P=20,L=4L=4,m=5m=5,T=100T=100, 50 seeds\)\.##### Attribution ratio \(Figure[7\(a\)](https://arxiv.org/html/2605.21492#S10.F7.sf1)\)\.

The within\-group ratio increases monotonically withρ\\rho\. The corrected model1/\(1−α​ρ2\)1/\(1\-\\alpha\\rho^\{2\}\)withα≈2/π\\alpha\\approx 2/\\pimatches the data \(R2=0\.89R^\{2\}=0\.89\)\.

##### Ranking instability \(Figure[7\(b\)](https://arxiv.org/html/2605.21492#S10.F7.sf2)\)\.

Atρ=0\.9\\rho=0\.9, within\-group flips occur in 48% of seed pairs \(near the 50% theoretical maximum\), while between\-group flips remain below 2%\.

##### Dashconvergence \(Figure[7\(c\)](https://arxiv.org/html/2605.21492#S10.F7.sf3)\)\.

The within\-group flip rate drops below 1% atM=25M=25, consistent with theO​\(1/M\)O\(1/M\)variance bound\.

### 10\.3Breast Cancer \(Wisconsin\)

![Refer to caption](https://arxiv.org/html/2605.21492v1/x10.png)Figure 8:SHAP ranking instability on Breast Cancer\. Highly correlated pairs with similar importance \(e\.g\., worst perimeter↔\\leftrightarrowworst area,\|ρ\|=0\.98\|\\rho\|\{=\}0\.98, flip rate 48%\) exhibit near\-maximal instability\. 50 XGBoost models\.Features measuring the same underlying quantity—worst perimeter and worst area \(\|ρ\|=0\.98\|\\rho\|\{=\}0\.98\)—exhibit a 48% flip rate across seeds, near the 50% theoretical maximum\. Pairs with high correlation but distinct importance \(e\.g\., mean area and mean concave points,\|ρ\|=0\.82\|\\rho\|=0\.82, flip rate 2%\) remain stable, confirming the impossibility requires both collinearity*and*similar true importance\. Consequently, binned flip rates are non\-monotonic in\|ρ\|\|\\rho\|: the highest instability occurs not at maximal correlation but at the intersection of high correlation and similar feature importance\.

##### Dashconvergence on Breast Cancer\.

We demonstrate thatDashresolves instability on real data\. Using the 50 XGBoost models trained for the Breast Cancer validation \(Figure[8](https://arxiv.org/html/2605.21492#S10.F8)\), we measure the flip rate for the most unstable pair \(worst perimeter↔\\leftrightarrowworst area,\|ρ\|=0\.978\|\\rho\|\{=\}0\.978\) as a function of ensemble sizeMM:

AtM=1M\{=\}1the flip rate is 44\.8%, near the theoretical maximum\.Dashconsensus atM=50M\{=\}50resolves to the true ordering \(worst perimeter slightly more important: mean\|SHAP\|=0\.940\|\\mathrm\{SHAP\}\|=0\.940vs\.0\.9010\.901\) with zero flips\. Convergence is slower than in the synthetic setting because the features have a slight importance asymmetry—Dashcorrectly detects and resolves it rather than producing a tie\.

### 10\.4Cross\-Implementation Validation

Table 7:Attribution instability across three GBDT implementations on Breast Cancer \(50 models each\)\.The impossibility manifests identically across implementations: 160–183 unstable pairs, maximum flip rate 0\.500 \(the theoretical ceiling\), and Z\-test diagnostic correlation\|r\|≥0\.89\|r\|\\geq 0\.89in all three\. The instability is a property of sequential boosting under collinearity, not of any specific implementation\.

##### Screen caveat\.

The single\-model screen requires access to per\-tree split counts\. CatBoost’sget\_feature\_importance\(\)returns gain\-based importance \(not raw split counts\), producing a differentZZ\-statistic distribution that does not transfer the XGBoost\-calibrated threshold\. For CatBoost, the multi\-model Z\-test \(r=−0\.892r=\-0\.892\) is recommended instead\. LightGBM’s feature importance is split\-count based and transfers with modest precision reduction\.

### 10\.5Non\-SHAP Attribution Validation

Permutation importance shows*more*instability than TreeSHAP \(91% vs\. 41%\), because permutation\-based scores have higher variance across seeds than SHAP values\. Both methods hit the theoretical maximum flip rate \(0\.500\)\. The multi\-model Z\-test achieves\|r\|≥0\.89\|r\|\\geq 0\.89for both, confirming it is method\-agnostic\.

The cross\-method correlation of flip rates isr=0\.46r=0\.46\(p<10−23p<10^\{\-23\}\): the*same pairs*tend to be unstable under both methods, confirming the instability is driven by feature collinearity, not by the attribution algorithm\. Of the 180 SHAP\-unstable pairs, 175 \(97%\) are also unstable under permutation importance\. TreeSHAP shows lower instability \(41% vs 91%\) likely because its game\-theoretic averaging over feature coalitions provides implicit regularization, reducing within\-model attribution variance compared to permutation importance’s direct shuffling\.

### 10\.6Neural Network Attribution Instability

Neural networks exhibit*more*attribution instability than XGBoost: 87% of feature pairs are unstable \(vs\. 37%\), and the maximum flip rate reaches the theoretical ceiling\. The higher instability likely reflects: \(i\) larger Rashomon sets \(more parameters, more near\-optimal models\); \(ii\) higher KernelSHAP variance \(sampling approximation vs\. exact tree\-path computation\); \(iii\) more diffuse signal distribution across hidden units\.

##### KernelSHAP noise vs\. model instability\.

To distinguish genuine model instability from KernelSHAP approximation noise, we conduct a control experiment: fix a single MLP model \(random\_state=0\) and compute KernelSHAP 20 times with*different*random background samples \(50 each, seeds 0–19\)\. Any observed flip rate is purely due to SHAP sampling noise, not model variation\.

*Verdict\.*Model instability dominates KernelSHAP noise by approximately 8:1\. With 50 background samples, only 11% of pairs show noise\-induced flips \(mean flip rate 0\.03\); with 200 background samples, this drops to 4%\. The key correlated pair \(worst perimeter vs\. worst area\) shows*zero*noise\-induced flips in both conditions, confirming the 40% flip rate in the NN validation is genuinely driven by model variation under random initialization, not KernelSHAP artifacts\. Increasing background samples from 50 to 200 reduces noise by2\.6×2\.6\\timesat4×4\\timescompute cost; the default 50 is adequate for detecting model\-level instability\.

### 10\.7SHAP Efficiency and Attribution Instability

SHAP’s efficiency axiom \(∑jφj​\(f,x\)=f​\(x\)−𝔼​\[f​\(X\)\]\\sum\_\{j\}\\varphi\_\{j\}\(f,x\)=f\(x\)\-\\mathbb\{E\}\[f\(X\)\]for every modelffand pointxx\) has a subtle relationship with ranking instability\.

#### 10\.7\.1Within\-model amplification

###### Proposition 62\(Efficiency\-induced negative correlation\)\.

Letφ1,…,φm\\varphi\_\{1\},\\ldots,\\varphi\_\{m\}be SHAP values formmfeatures in a group whose total attribution isCC\(fixed for a given modelffand data pointxx\), i\.e\.,∑i=1mφi=C\\sum\_\{i=1\}^\{m\}\\varphi\_\{i\}=C\. Suppose all features have the same marginal varianceσ2\\sigma^\{2\}under some perturbation of the data point\. Then for anyj≠kj\\neq k:

Cov​\(φj,φk\)=−σ2m−1,\\mathrm\{Cov\}\(\\varphi\_\{j\},\\varphi\_\{k\}\)=\-\\frac\{\\sigma^\{2\}\}\{m\-1\},Var​\(φj−φk\)=2​σ2⋅mm−1\.\\mathrm\{Var\}\(\\varphi\_\{j\}\-\\varphi\_\{k\}\)=2\\sigma^\{2\}\\cdot\\frac\{m\}\{m\-1\}\.For an unconstrained method with independently computed attributions \(zero covariance\), the same difference has variance2​σ22\\sigma^\{2\}\. The amplification factor ism/\(m−1\)m/\(m\-1\)\.

###### Proof\.

From∑iφi=C\\sum\_\{i\}\\varphi\_\{i\}=C\(constant\),Var​\(∑iφi\)=0\\mathrm\{Var\}\(\\sum\_\{i\}\\varphi\_\{i\}\)=0\. Expanding:

0=m​σ2\+m​\(m−1\)​Cov​\(φj,φk\)⟹Cov​\(φj,φk\)=−σ2m−1\.0=m\\sigma^\{2\}\+m\(m\-1\)\\mathrm\{Cov\}\(\\varphi\_\{j\},\\varphi\_\{k\}\)\\implies\\mathrm\{Cov\}\(\\varphi\_\{j\},\\varphi\_\{k\}\)=\-\\frac\{\\sigma^\{2\}\}\{m\-1\}\.ThenVar​\(φj−φk\)=2​σ2−2​\(−σ2/\(m−1\)\)=2​σ2​\(1\+1/\(m−1\)\)=2​σ2⋅m/\(m−1\)\\mathrm\{Var\}\(\\varphi\_\{j\}\-\\varphi\_\{k\}\)=2\\sigma^\{2\}\-2\(\-\\sigma^\{2\}/\(m\-1\)\)=2\\sigma^\{2\}\(1\+1/\(m\-1\)\)=2\\sigma^\{2\}\\cdot m/\(m\-1\)\. ∎

###### Corollary 63\(Group\-size dependence\)\.

The amplification factorm/\(m−1\)m/\(m\-1\)equals22form=2m=2\(pair of collinear features\),3/23/2form=3m=3, and approaches11asm→∞m\\to\\infty\. The efficiency\-induced amplification is therefore worst for small groups and negligible for large groups\.

#### 10\.7\.2Across\-model non\-amplification

###### Proposition 64\(Efficiency does not constrain across\-model covariance\)\.

Letφj​\(f\)\\varphi\_\{j\}\(f\)denote the mean absolute SHAP value for featurejjunder modelff\. The efficiency axiom states that∑jφjsigned​\(f,x\)=f​\(x\)−𝔼​\[f​\(X\)\]\\sum\_\{j\}\\varphi\_\{j\}^\{\\mathrm\{signed\}\}\(f,x\)=f\(x\)\-\\mathbb\{E\}\[f\(X\)\]for each fixed\(f,x\)\(f,x\)\. However:

1. 1\.The efficiency constantC​\(f,x\)=f​\(x\)−𝔼​\[f​\(X\)\]C\(f,x\)=f\(x\)\-\\mathbb\{E\}\[f\(X\)\]*varies across models*ff, because different models produce different predictions\.
2. 2\.The group’s share of the total,∑i∈groupφi​\(f,x\)\\sum\_\{i\\in\\text\{group\}\}\\varphi\_\{i\}\(f,x\), also varies across models \(it depends on how much of the prediction the group captures in modelff\)\.
3. 3\.Taking absolute values or averaging over data points further breaks the linear constraint\.

Therefore,Varf​\(∑i∈groupφi​\(f\)\)≠0\\mathrm\{Var\}\_\{f\}\(\\sum\_\{i\\in\\text\{group\}\}\\varphi\_\{i\}\(f\)\)\\neq 0in general, and the negative covarianceCovf​\(φj​\(f\),φk​\(f\)\)=−σ2/\(m−1\)\\mathrm\{Cov\}\_\{f\}\(\\varphi\_\{j\}\(f\),\\varphi\_\{k\}\(f\)\)=\-\\sigma^\{2\}/\(m\-1\)does*not*follow from efficiency\.

The lower instability of SHAP relative to permutation importance \(41% vs\. 91% unstable pairs\) is driven by SHAP’s coalition\-averaging reducing the marginal varianceσ2\\sigma^\{2\}\. The efficiency axiom amplifies within\-model differences but does not increase across\-model flip rates\.

### 10\.8High\-Dimensional Scalability \(P=500P=500\)

The multi\-model Z\-test maintains\|r\|\>0\.78\|r\|\>0\.78atP=500P=500\. Correlation\-based grouping reduces pairs by55×55\\times\. Full workflow completes in under 2\.5 minutes\.

### 10\.9Proportionality Axiom Validation

The proportionality axiom \(φj=c⋅nj\\varphi\_\{j\}=c\\cdot n\_\{j\}\) is central to the quantitative bounds\. We validate it by computingcj=\|SHAPj\|/njc\_\{j\}=\|\\text\{SHAP\}\_\{j\}\|/n\_\{j\}for each feature in each of 50 XGBoost models on Breast Cancer and reporting the coefficient of variation \(CV\):

For stumps, the axiom holds reasonably well; for deeper trees, multi\-level interactions increase the CV\. The proportionality axiom is used only for the quantitative bounds \(Theorems[15](https://arxiv.org/html/2605.21492#Thmtheorem15)\);the core impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) does not depend on it\. Theα\\alpha\-corrected model matches empirical data atR2=0\.89R^\{2\}=0\.89\.

### 10\.10Cross\-Implementation and Data\-Level Validation

##### Data\-level stochasticity\.

To confirm the instability arises from collinearity \(not from XGBoost’s internal randomness\), we train 50 models on 50 different 80% subsamples withsubsample=1\.0and fixedrandom\_state=42\. The ONLY source of variation is which training rows each model sees:

Data\-level stochasticity produces comparable or greater instability, confirming the Rashomon set is a property of collinearity, not of the specific randomness source\.

##### Determinism without subsampling\.

Without row or column subsampling \(subsample=1\.0,colsample\_bytree=1\.0\), XGBoost is fully deterministic: all 50 models produce identical rankings regardless of seed\. The Rashomon set requires a stochasticity source\. In practice, this is not a limitation: the XGBoost default \(subsample=0\.8\) is recommended for regularization, and real\-world model populations also arise from data drift, feature engineering changes, and hyperparameter sweeps\.

### 10\.11Financial Case Studies

##### German Credit\.

We demonstrate the full Screen→\\toZ\-test→\\toDASH workflow on German Credit \(1000 samples, 20 features\)\. Step 0: 4 correlated groups at\|ρ\|\>0\.3\|\\rho\|\>0\.3\. Step 1 \(screen\): a single model flags job↔\\leftrightarrowown telephone \(Zsplit=0\.69<1\.96Z^\{\\text\{split\}\}=0\.69<1\.96\)\. Step 2 \(Z\-test\): 5 models confirm instability \(Z=0\.64Z=0\.64, flip rate 40%\)\. Step 3 \(DASH\):M=25M=25models, flip rate drops from 40% to 0%\. Consensus ranking: checking status \(0\.87\), duration \(0\.44\), credit amount \(0\.43\), purpose \(0\.35\)\. For regulatory reporting \(ECOA adverse action reasons, SR 11\-7\(Office of the Comptroller of the Currency,[2011](https://arxiv.org/html/2605.21492#bib.bib24)\)\), the DASH ranking provides a defensible explanation\.

##### Taiwan Credit Card Default\.

To validate the impossibility on data with genuine high collinearity \(\|ρ\|\>0\.9\|\\rho\|\>0\.9\), we apply the workflow to the UCI “default of credit card clients” dataset \(30,000 samples, 23 features, binary default outcome; subsampled to 10,000\)\.

The bill\-amount features \(monthly bills for 6 consecutive months\) exhibit strong collinearity: 29 pairs have\|ρ\|\>0\.5\|\\rho\|\>0\.5, with the highest at\|ρ\|=0\.95\|\\rho\|=0\.95\(giving a theoretical attribution ratio of1/\(1−0\.952\)≈10\.3×1/\(1\{\-\}0\.95^\{2\}\)\\approx 10\.3\\times\)\.

*Step 0\.*29 correlated pairs identified at\|ρ\|\>0\.5\|\\rho\|\>0\.5\(no threshold lowering needed\)\.

*Step 1 \(screen\)\.*A single model flags 4 of the 10 tracked pairs as potentially unstable \(\|Zsplit\|\>1\.96\|Z^\{\\text\{split\}\}\|\>1\.96\)\.

*Step 3 \(DASH\)\.*WithM=25M=25models, the mean flip rate across correlated pairs is 4%\. One pair \(bill amounts at months 5 vs\. 6,\|ρ\|=0\.946\|\\rho\|=0\.946\) retains a 16% flip rate even atM=25M=25, illustrating that very high collinearity requires larger ensembles\.

This dataset demonstrates the impossibility biting hard: features measuring the same underlying quantity \(monthly bill amounts\) have near\-identical predictive signal, and the attribution ranking across these features is genuinely unstable\.

##### Synthetic Credit \(income↔\\leftrightarrowDTI↔\\leftrightarrowcredit score\)\.

To validate on the exact collinearity pattern common in US credit models, we generate a synthetic dataset with 10,000 samples and 5 features driven by a latent “creditworthiness” factor: income \(ρ=0\.99\\rho=0\.99with DTI\), DTI, credit score \(ρ=0\.98\\rho=0\.98with income\), loan amount \(independent\), and employment years \(ρ=0\.94\\rho=0\.94with income\)\.

With 25 XGBoost models: income↔\\leftrightarrowDTI flips 8% of the time \(\|ρ\|=0\.99\|\\rho\|=0\.99\); credit score↔\\leftrightarrowemployment years flips 12% \(\|ρ\|=0\.92\|\\rho\|=0\.92\)\. Pairs where one feature clearly dominates \(income vs\. credit score\) show 0% flips despite\|ρ\|=0\.98\|\\rho\|=0\.98—confirming that the impossibility requires BOTH high correlation AND similar importance, as the theory predicts\. For model validation under SR 11\-7\(Office of the Comptroller of the Currency,[2011](https://arxiv.org/html/2605.21492#bib.bib24)\), the recommendation is: report income and DTI as “interchangeable key risk drivers” rather than forcing a ranking that would flip under retraining\.

##### Regulatory adverse action experiment\.

In a simulated ECOA adverse action pipeline \(10,000 loan applications, 5 correlated income features including salary, bonus, overtime, commission, equity; 3 uncorrelated features; 25 XGBoost models atρ=0\.7\\rho\{=\}0\.7\), 43\.2% of 6,602 denied applicants receive a different “top reason for denial” depending on which model is queried\. The most common flip pair is salary↔\\leftrightarrowbonus \(10\.8% of denied applicants\)\. 71\.8% have an unstable top\-2 reason\.Dashconsensus resolves this entirely: 100% stable top\-1 reasons, with income features tied in 12\.3% of cases\. Reproduce:regulatory\_case\_study\.py\.

##### Lending Club \(specificity control\)\.

We validate the diagnostic on real Lending Club data \(OpenML, 32,581 loans, 22 features after one\-hot encoding of categoricals\)\. Three correlated groups are detected at\|ρ\|\>0\.5\|\\rho\|\>0\.5: person\_age↔\\leftrightarrowcb\_person\_cred\_hist\_length \(\|ρ\|=0\.86\|\\rho\|=0\.86\), loan\_amnt↔\\leftrightarrowloan\_percent\_income \(\|ρ\|=0\.58\|\\rho\|=0\.58\), and loan\_int\_rate↔\\leftrightarrowcb\_person\_default\_on\_file \(\|ρ\|=0\.50\|\\rho\|=0\.50\)\.

*Result\.*Zero unstable pairs\. All three correlated pairs haveZ\>36Z\>36, confirming the features have distinguishable importance despite their correlation\. This is an instructive*specificity control*: the impossibility theorem predicts instability requires*both*collinearity AND similar true importance\. Lending Club features are correlated but not similarly important \(e\.g\., person\_age contributes3×3\\timesmore than credit history length\), so no instability occurs\. The Screen→\\toZ\-test→\\toDashpipeline correctly identifies this as a stable setting, recommending no intervention\.

*Implication\.*Not every correlated dataset exhibits attribution instability\. The diagnostic distinguishes datasets where instability is a genuine concern \(Breast Cancer, Taiwan Credit Card\) from those where it is not \(Lending Club, California Housing\)\. This selectivity is a feature, not a limitation: the impossibility theorem’s conditions are precise, and the diagnostic inherits that precision\.

### 10\.12LLM Attention Attribution Instability

We load DistilBERT \(distilbert\-base\-uncased\) and create 10 model variants by adding small random perturbations \(σ=0\.02\\sigma=0\.02\) to attention weights, simulating different training runs\. For 10 test sentences, we compute attention\-based token importance \(mean attention received from all heads and layers\) and check whether the relative ranking of adjacent tokens flips across the 10 variants\.

Of 59 adjacent token pairs across test sentences, 88% have flip rates exceeding 10%\. Selected examples:

Mean Spearman correlation of full\-sentence token rankings across model variants is 0\.637—moderate instability, comparable to single\-model SHAP instability on tabular data with moderate collinearity \(ρ≈0\.5\\rho\\approx 0\.5\)\. Adjacent tokens in natural language carry correlated information \(“very” and “good” jointly convey sentiment strength\)\. This correlation induces the same Rashomon structure: different model variants assign different relative importance to the correlated tokens\.

Under actual fine\-tuning on SST\-2 \(5 seeds, 1 epoch, AdamW, lr=2×10−5=2\{\\times\}10^\{\-5\}, batch size 16\), 14\.5% of pairs are unstable\. Selected unstable pairs under fine\-tuning:

To test whether longer training increases instability, we repeat with 3 epochs\. The identical 14\.5% across 1 and 3 epochs indicates the instability is structural \(driven by collinearity in attention patterns\), not a training\-depth artifact\. The same three token pairs remain unstable at both training lengths\.

The gap between fine\-tuning \(14\.5%\) and perturbation \(88%\) reflects the difference in weight divergence: fine\-tuning updates parameters byO​\(0\.001\)O\(0\.001\)via gradient descent, while perturbation addsO​\(0\.02\)O\(0\.02\)noise to all parameters\. The perturbation result represents the full Rashomon set; the fine\-tuning result represents the subset explored by standard training\. Token\-level explanations of LLMs face the same impossibility as feature\-level explanations of tabular models\.

##### Scope and limitations\.

The attention\-based instability reported here \(14\.5% of adjacent token pairs under fine\-tuning\) is preliminary evidence, not a formal extension of the impossibility theorem\. Attention weights are not SHAP values: they do not satisfy the proportionality axiom, and the “collinear group” structure of tree features does not map cleanly to token positions\. The result demonstrates that attribution instability under model multiplicity is not unique to tree ensembles, but a formal impossibility for transformer attention would require different axioms and definitions\. We report this as suggestive evidence for the generality of the phenomenon, not as a proved extension\.

### 10\.13Replication Study: Published SHAP Rankings

Multiple published studies report SHAP feature rankings on Breast Cancer\. Using our 50\-model validation, we find:

Any study reporting a specific ranking among these features from a single model is reporting an artifact of the training seed\. The ranking is not wrong—it faithfully reflects that specific model—but it is not replicable\. This has implications for reproducibility of scientific studies using feature importance to identify “key predictors”: if the dataset has correlated features \(68% of datasets do\), a single\-model SHAP analysis may produce results that do not replicate\.

### 10\.14Expected Ranking Discordance

###### Proposition 66\(Expected Kendall tau distance\)\.

For a feature space withLLcollinear groups of sizesm1,…,mLm\_\{1\},\\ldots,m\_\{L\}and between\-group gapsΔℓ​ℓ′\\Delta\_\{\\ell\\ell^\{\\prime\}\}with noiseσℓ​ℓ′\\sigma\_\{\\ell\\ell^\{\\prime\}\}, the expected pairwise disagreements between two independently trained models are:

𝔼​\[τ\]=∑ℓ=1L\(mℓ2\)⋅12⏟within\-group \(coin flips\)\+∑ℓ<ℓ′mℓ⋅mℓ′⋅Φ​\(−Δℓ​ℓ′σℓ​ℓ′\)⏟between\-group \(noise\)\\mathbb\{E\}\[\\tau\]=\\underbrace\{\\sum\_\{\\ell=1\}^\{L\}\\tbinom\{m\_\{\\ell\}\}\{2\}\\cdot\\frac\{1\}\{2\}\}\_\{\\text\{within\-group \(coin flips\)\}\}\+\\underbrace\{\\sum\_\{\\ell<\\ell^\{\\prime\}\}m\_\{\\ell\}\\cdot m\_\{\\ell^\{\\prime\}\}\\cdot\\Phi\\\!\\left\(\-\\frac\{\\Delta\_\{\\ell\\ell^\{\\prime\}\}\}\{\\sigma\_\{\\ell\\ell^\{\\prime\}\}\}\\right\)\}\_\{\\text\{between\-group \(noise\)\}\}

On Breast Cancer \(50 XGBoost models\), the refined per\-pair formula predicts𝔼​\[τ\]=26\.8\\mathbb\{E\}\[\\tau\]=26\.8vs\. empirical36\.636\.6\(−27%\-27\\%error\)\. The Rashomon coefficientR=∑ℓ\(mℓ2\)/\(P2\)=0\.692R=\\sum\_\{\\ell\}\\binom\{m\_\{\\ell\}\}\{2\}/\\binom\{P\}\{2\}=0\.692gives a worst\-case non\-replication lower bound ofR/2=34\.6%R/2=34\.6\\%computable from the correlation matrix alone \(no model training required\)\.

### 10\.15Compressed Sensing Connection

The attribution impossibility has a precise analogue in compressed sensing \(CS\)\. The measurement coherenceμ​\(X\)=maxj≠k⁡\|XjT​Xk\|/\(‖Xj‖​‖Xk‖\)\\mu\(X\)=\\max\_\{j\\neq k\}\|X\_\{j\}^\{T\}X\_\{k\}\|/\(\\\|X\_\{j\}\\\|\\\|X\_\{k\}\\\|\)determines when sparse recovery is possible: unique recovery requiresμ<1/\(2​s−1\)\\mu<1/\(2s\-1\)\. In our setting,\|ρj​k\|\|\\rho\_\{jk\}\|plays the role of coherence andZj​kZ\_\{jk\}plays the role of the incoherence condition:

Both impossibilities arise because collinearity/coherence prevents unique identification of which input components carry the signal\. Both are resolved by relaxing uniqueness: CS uses convex relaxation \(fractional assignment\);Dashuses ensemble averaging \(ties for indistinguishable features\)\.

### 10\.16Prevalence Survey

To assess how frequently the impossibility applies in practice, we surveyed 77 public datasets \(OpenML CC\-18 benchmark suite \+ sklearn\)\. For each, we computed the correlation matrix, identified pairs with\|ρ\|\>0\.5\|\\rho\|\>0\.5, trained 20 XGBoost models with different seeds, and checked whether any correlated pair has a ranking flip rate exceeding 10%\.

Of 77 public datasets surveyed, 71 \(92%\) have feature pairs with\|ρ\|\>0\.5\|\\rho\|\>0\.5, and 52 \(68%, 95% Wilson CI: \[56%, 77%\]\) exhibit attribution instability \(flip rate\>10%\>10\\%\)\. For datasets withP≥20P\\geq 20features \(n=43n=43datasets\), the instability rate rises to 93% \(40/43; 95% Wilson CI: \[81%, 98%\]\)\. The impossibility is not a theoretical curiosity: it affects the majority of real\-world datasets across domains including medical, financial, image, and tabular data\.

With 20 models per dataset, the measured flip rate exceeds the 10% threshold with approximately 60% power, so the true prevalence may be higher still\.

The instability rate varies sharply with feature count: 35% forP<20P<20\(12/34 datasets\), 93% forP=20P=20–9999\(27/29\), and 93% forP≥100P\\geq 100\(13/14\)\. This confirms that high\-dimensional datasets are nearly universally affected\.

##### Methodology\.

Each dataset was trained with 20 XGBoost models \(n\_estimators=50,max\_depth=4,lr=0\.1,subsample=0\.8,colsample\_bytree=0\.8\) with different random seeds\. SHAP TreeExplainer computed mean\|SHAP\|\|\\text\{SHAP\}\|per feature on a fixed 500\-sample evaluation slice\. Flip rate was measured asmin⁡\(\#​\(j\>k\),\#​\(k\>j\)\)/20\\min\(\\\#\(j\{\>\}k\),\\\#\(k\{\>\}j\)\)/20for each correlated pair\. Datasets with\>10,000\>10\{,\}000samples were subsampled to 10,000\. Full results inprevalence\_survey\.py\.

With 20 models, the measured flip rate exceeds the 10% threshold with only 32% power, making 68% a conservative lower bound; the true prevalence is likely 75–85%\.

##### Healthcare datasets\.

In a targeted survey of 9 healthcare\-related datasets \(breast cancer, diabetes, heart disease, QSAR biodegradation, liver disease, software defect prediction, Parkinson’s, Pima diabetes, hepatitis\), 6 \(67%\) exhibit attribution instability\. This rate matches the overall prevalence, confirming that clinical decision\-support systems—where explanation stability is particularly consequential—are not immune\.

*Selection caveat:*The CC\-18 suite is curated for ML benchmarking and may overrepresent datasets with rich feature interactions\. Production ML pipelines with carefully decorrelated features may exhibit lower prevalence\. The 68% figure is a prevalence estimate for benchmark\-representative tabular datasets, not a universal rate\.

##### Robustness to hyperparameters\.

We repeated the analysis on 8 representative datasets with three configurations:

Under Config A \(original\), 5/8 \(62%\) datasets exhibit instability, consistent with the 68% headline\. Under Config B \(deep trees\), 4/8 \(50%\)\. Under Config C \(shallow\-fast\), 6/8 \(75%\)\. Across all three configurations, 4/8 \(50%\) datasets are consistently unstable; under at least one configuration, 6/8 \(75%\) are unstable\. The instability rate varies by±15\\pm 15percentage points across configurations but remains in the 50–75% range\. Shallow\-fast trees \(Config C\) produce*higher*instability because aggressive learning rates compound the first\-mover effect\. The 68% headline is conservative: the phenomenon is robust to standard hyperparameter variation\.

Table 8:Multi\-model Z\-test and single\-model screen diagnostic generality across 11 datasets\.
##### Interpretation\.

The multi\-model Z\-test achieves\|r\|\>0\.8\|r\|\>0\.8on 9/10 datasets with unstable pairs \(all except Digits\)\. The weaker correlation on Digits \(r=−0\.42r=\-0\.42\) reflects a floor effect: this high\-dimensional image dataset has many features with near\-zero importance, producing many pairs where bothZZand flip rate are near zero\. Restricting to pairs withZ<5Z<5\(the diagnostically interesting range\) would improve this correlation\. Screen precision is 94–100% on small/clean datasets \(Breast Cancer, Wine, Heart Disease\) where split counts are reliable, but drops to 48–67% on high\-dimensional datasets \(Ames, Communities\) where split counts are sparse\. This confirms the screen as a conservative*screening*tool that works well for moderate\-PPdatasets but should be supplemented by the full Z\-test for high\-dimensional settings\. All datasets use identical XGBoost hyperparameters \(T=100T\{=\}100, depth=6\{=\}6,η=0\.1\\eta\{=\}0\.1\); absolute flip rates are therefore not directly comparable across datasets of different sizes and dimensionalities\.

![Refer to caption](https://arxiv.org/html/2605.21492v1/x11.png)Figure 9:Multi\-model Z\-test statistic vs\. flip rate across four datasets \(Breast Cancer, Ames, Digits, Adult\)\. The negative correlation confirms the diagnostic across domains: clinical, real estate, image, and census\.

## 11Lean Formalization

### 11\.1Proof Architecture

The formalization comprises 54 Lean 4 files with 16 axioms and 305 type\-checked theorems and lemmas \(0sorry\)\. Of these, 80 require multi\-line proofs \(≥\\geq5 tactic lines\); 6 are definitional wrappers or single\-step applications\. The core impossibility \(attribution\_impossibility\) depends on zero axioms—only the Rashomon property as hypothesis\. The DASH resolution \(consensus\_equity\) depends on theattribution\_sum\_symmetrictheorem \(derived from axioms\); the variance convergence depends on theconsensus\_variance\_boundtheorem \(also derived\)\.

##### Scope of verification\.

The formalization covers the complete theoretical framework\. The core impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) uses zero behavioral axioms\. The quantitative bounds, DASH equity, and the Design Space Theorem are derived from the 16\-axiom system\. The unfaithfulness probability of exactly1/21/2\(attribution\_prob\_half\), the Bayes\-optimality of ties \(tie\_dominates\_commitment\), the consensus varianceσ2/M\\sigma^\{2\}/M\(consensus\_variance\_from\_independence\), the binary quantizer fraction2/π2/\\pi\(binary\_quantizer\_fraction\), and the Pareto dominance of DASH \(dash\_unique\_pareto\_optimal\) are all Lean\-derived using definitions\-as\-hypotheses \(theIsBalancedpattern\) with zero new axioms\. The Chebyshev query complexity boundM≥12​σ2/Δ2M\\geq 12\\sigma^\{2\}/\\Delta^\{2\}\(chebyshev\_query\_bound\) is derived without axiomatizing the testing constant\. Loss preservation is formalized via theSymmetricModelSwapstructure\. The only result not formalized is the extension of Pareto optimality to biased methods for between\-group pairs, which is argued informally in the proof of Theorem[22](https://arxiv.org/html/2605.21492#Thmtheorem22)\.

```
Defs.lean (14 axioms, type definitions, derived theorems)
  +-- SymmetryDerive.lean (attribution_sum_symmetric, DERIVED)
  +-- Trilemma.lean (RashimonProperty, attribution_impossibility)
  |  +-- Iterative.lean, Lasso.lean, NeuralNet.lean
  |  +-- General.lean (GBDT impossibility)
  |  +-- UnfaithfulBound.lean (U>=1/2, ties optimal, path convergence)
  |  +-- RashomonUniversality.lean (Rashomon from symmetry)
  |  +-- RashomonInevitability.lean (impossibility inescapable)
  |  +-- AlphaFaithful.lean (alpha-faithfulness bound)
  |  +-- ConditionalImpossibility.lean (conditional SHAP + escape)
  |  +-- FairnessAudit.lean (proxy audit = coin flip)
  |  +-- LocalGlobal.lean (local >= global instability)
  +-- SplitGap.lean, Ratio.lean, SpearmanDef.lean
  +-- FlipRate.lean (exact GBDT flip rate, binary = coin flip)
  +-- Efficiency.lean (SHAP efficiency amplification)
  +-- Impossibility.lean, Corollary.lean, EnsembleBound.lean
  +-- DesignSpace.lean + DesignSpaceFull.lean (all 4 steps)
  +-- ModelSelection.lean + ModelSelectionDesignSpace.lean
  +-- SymmetricBayes.lean (GENERAL SBD, orbit bounds, trichotomy)
  +-- CausalDiscovery.lean (causal discovery impossibility)
  +-- SBDInstances.lean (abstract aggregation + instances)
  +-- FIMImpossibility.lean (Gaussian FIM -> Rashomon)
  +-- GaussianFlipRate.lean (Phi definition, flip rate formula)
  +-- QueryComplexity.lean (query lower bound, Le Cam (2 axioms))
  +-- Consistency.lean (axiom system consistency, Fin 4 model)
  +-- RandomForest.lean (contrast case, documentation only)
```

### 11\.2Axiom System and Consistency

The 14 domain\-specific axioms are jointly consistent:Consistency\.leanconstructs an explicit model \(P=4P\{=\}4,L=2L\{=\}2,m=2m\{=\}2,ρ=0\.5\\rho\{=\}0\.5,T=100T\{=\}100, Fin 4 models\) satisfying all 14 simultaneously\. The construction usesFin 4as the model type, defines explicit split\-count functions returning the axiomatized valuesT/\(2−ρ2\)T/\(2\-\\rho^\{2\}\)and\(1−ρ2\)​T/\(2−ρ2\)\(1\-\\rho^\{2\}\)T/\(2\-\\rho^\{2\}\), and verifies all 14 axiom predicates hold by computation\. The 2 query\-complexity axioms \(testing\_constant,testing\_constant\_pos,le\_cam\_lower\_bound\) are independently consistent: instantiatingC:=1/8C:=1/8satisfies all three\. The two axiom sets reside in separate Lean files \(Defs\.leanandQueryComplexity\.lean\) with no cross\-dependencies, so their joint consistency follows from the individual consistency of each set\.

##### Attribution sum symmetry: now derived\.

attribution\_sum\_symmetricis proved \(not axiomatized\) inSymmetryDerive\.lean\. The proof uses \(a\)proportionality\_global\(uniformccacross models\), \(b\)splitCount\_crossGroup\_symmetric\(equal split counts when first\-mover is in a different group\), and \(c\)IsBalanced\(equal first\-mover counts\)\. The derivation factors outcc, classifies each model’s split\-count difference by first\-mover identity \(\+gap\+\\text\{gap\}for fm=j=j,−gap\-\\text\{gap\}for fm=k=k,0otherwise\), decomposes the sum viaFinset\.sum\_ite, and uses balance to cancel the gap terms\.

##### Variance: partially grounded in Mathlib\.

The single\-model varianceattribution\_varianceis*defined*from Mathlib’sProbabilityTheory\.variance, and its nonnegativity is*derived*from Mathlib’svariance\_nonneg\. This required adding two infrastructure axioms \(modelMeasurableSpace,modelMeasure\) to connect the abstractModeltype to Mathlib’s measure theory\. The consensus variance bound \(Var​\(φ¯j\)=Var​\(φj\)/M\\mathrm\{Var\}\(\\bar\{\\varphi\}\_\{j\}\)=\\mathrm\{Var\}\(\\varphi\_\{j\}\)/M\) remains axiomatized; the full derivation viaIndepFun\.variance\_sumwould require a product measure formulation and independence axioms for ensemble draws—deferred to future work\.

##### Variance sub\-system\.

The three variance declarations \(attribution\_variance,attribution\_variance\_nonneg,consensus\_variance\_bound\) produce convenience results \(variance nonnegativity, halving\) rather than deep mathematical consequences\. Their primary role is to support the Design Space Theorem’s stability convergence claim\. A deeper formalization would derive the variance bound from Mathlib’sIndepFun\.variance\_sum, but this requires connecting our abstractModeltype to a product measure space\.

##### Spearman bound: axiomatized vs\. derived\.

The Lean formalization derives the Spearman boundρS≤1−3​m2/\(P3−P\)\\rho\_\{S\}\\leq 1\-3m^\{2\}/\(P^\{3\}\{\-\}P\)from the definition of Spearman correlation via midrank algebra \(spearmanCorr\_boundinSpearmanDef\.lean\)\. The tighter classical boundρS≤1−m3/P3\\rho\_\{S\}\\leq 1\-m^\{3\}/P^\{3\}from the full rank transposition counting argument is not yet formalized; both give the same qualitative conclusion \(S<1S<1for within\-group pairs\)\.

### 11\.3Development Methodology

The initial formalization \(49 theorems, 15 files\) was developed by the first author with iterative Claude Code assistance over several weeks\. The expansion from 49 to 305 theorems \(54 files\) was produced in a single development session by dispatching targeted Lean\-writing agents with detailed mathematical specifications\. All proofs were machine\-verified bylake build\(the Lean 4 type\-checker\); no proof was accepted on the basis of AI output alone\.

### 11\.4Proof Depth Distribution

Of 305 type\-checked declarations: 80 require multi\-step proofs \(≥5\{\\geq\}5tactic lines\), 21 require≥10\{\\geq\}10lines, and 5 require≥20\{\\geq\}20lines\. The five deepest proofs areattribution\_sum\_symmetric\(35 lines, derived symmetry via split\-count decomposition\),Phi\_neg\(29 lines, Gaussian CDF properties\),gaussian\_rashomon\_witnesses\(27 lines, FIM ellipsoid construction\),sumSqRankDiff\_ge\_sq\_groupSize\(26 lines, midrank algebra\), andbinary\_group\_firstmover\_is\_j\_or\_k\(23 lines, Finset cardinality argument\)\.

### 11\.5Inconsistencies Found During Formalization

Lean’s type checker caught three issues in the initial axiom system:

1. 1\.First\-mover balance:Originally stated universally over all model arrays—a constant model function trivially derived⊥\\bot\.*Fix:*Replaced with an explicitIsBalancedpredicate as hypothesis\.
2. 2\.Attribution sum symmetry:Combined with the split\-count axioms, the original unconditional version derived⊥\\botfor unbalanced ensembles\.*Fix:*Conditioned onIsBalanced\.
3. 3\.Split count type:Originally returnedℕ\\mathbb\{N\}, butT/\(2−ρ2\)T/\(2\-\\rho^\{2\}\)is generally irrational\.*Fix:*Changed toℝ\\mathbb\{R\}\(idealized leading\-order values\)\.

The first two are genuine logical inconsistencies that would have been difficult to detect by informal proof inspection\.

### 11\.6SymPy Algebraic Verification

All algebraic consequences have been independently verified by SymPy:

```
# dash-shap/paper/proofs/verify_lemma6_algebra.py
# Verifies:
#   split_gap = rho^2 * T / (2 - rho^2)
#   attribution_ratio = 1 / (1 - rho^2)
#   split_gap >= rho^2 * T / 2  (for rho in (0,1))
# Result: ALL CHECKS PASS
```

The three\-layer verification \(SymPy algebra, Lean type\-checking, empirical validation\) provides strong confidence in the mathematical claims\.

### 11\.7Lean File Cross\-Reference

Table 9:Lean file cross\-reference \(54 files, 305 theorems, 16 axioms\)\.FileSectionKey ResultDefs\.lean§[2](https://arxiv.org/html/2605.21492#S2)14 axioms \+ derived theoremsTrilemma\.leanThm\.[5](https://arxiv.org/html/2605.21492#Thmtheorem5)attribution\_impossibilityIterative\.lean§[3\.3](https://arxiv.org/html/2605.21492#S3.SS3)iterative\_impossibilityGeneral\.lean§[4\.1](https://arxiv.org/html/2605.21492#S4.SS1)gbdt\_impossibilitySplitGap\.leanLem\.[14](https://arxiv.org/html/2605.21492#Thmtheorem14)split\_gap\_exactRatio\.leanThm\.[15](https://arxiv.org/html/2605.21492#Thmtheorem15)ratio\_tendsto\_atTopSpearmanDef\.lean§[4](https://arxiv.org/html/2605.21492#S4)spearmanCorr\_boundLasso\.lean§[4\.2](https://arxiv.org/html/2605.21492#S4.SS2)lasso\_impossibilityNeuralNet\.lean§[4\.3](https://arxiv.org/html/2605.21492#S4.SS3)nn\_impossibilityImpossibility\.leanCombinednot\_equitable, not\_stableCorollary\.leanCor\.[19](https://arxiv.org/html/2605.21492#Thmtheorem19)consensus\_equitySymmetryDerive\.leanDerivedattribution\_sum\_symmetricDesignSpace\.leanThm\.[28](https://arxiv.org/html/2605.21492#Thmtheorem28)design\_space\_theoremDesignSpaceFull\.leanStep 3family\_a\_or\_family\_bModelSelection\.leanThm\.[41](https://arxiv.org/html/2605.21492#Thmtheorem41)model\_selection\_impossibilityUnfaithfulBound\.leanThm\.[29](https://arxiv.org/html/2605.21492#Thmtheorem29)stable\_complete\_unfaithfulPathConvergence\.leanThm\.[30](https://arxiv.org/html/2605.21492#Thmtheorem30)relaxation\_paths\_convergeRashomonUniversality\.leanThm\.[9](https://arxiv.org/html/2605.21492#Thmtheorem9)rashomon\_from\_symmetryRashomonInevitability\.leanThm\.[12](https://arxiv.org/html/2605.21492#Thmtheorem12)rashomon\_inevitabilityConditionalImpossibility\.leanThm\.[47](https://arxiv.org/html/2605.21492#Thmtheorem47)conditional\_impossibilityFlipRate\.leanProp\.[17](https://arxiv.org/html/2605.21492#Thmtheorem17)binary\_group\_flip\_rateSymmetricBayes\.leanThm\.[37](https://arxiv.org/html/2605.21492#Thmtheorem37)symmetric\_bayes\_dichotomyCausalDiscovery\.leanThm\.[45](https://arxiv.org/html/2605.21492#Thmtheorem45)causal\_discovery\_impossibilityFairnessAudit\.leanThm\.[48](https://arxiv.org/html/2605.21492#Thmtheorem48)fairness\_audit\_impossibilityFIMImpossibility\.leanThm\.[49](https://arxiv.org/html/2605.21492#Thmtheorem49)gaussian\_rashomon\_witnessesQueryComplexity\.leanThm\.[52](https://arxiv.org/html/2605.21492#Thmtheorem52)query\_complexity\_lower\_boundConsistency\.lean§[11](https://arxiv.org/html/2605.21492#S11)axiom\_system\_consistent*Bounds, universality, and infrastructure:*EnsembleBound\.lean§[5](https://arxiv.org/html/2605.21492#S5)ensemble\_bound\_formulaEfficiency\.lean§[10](https://arxiv.org/html/2605.21492#S10)across\_model\_no\_constraintAlphaFaithful\.lean§[13](https://arxiv.org/html/2605.21492#S13)alpha\_faithful\_boundGaussianFlipRate\.lean§[4\.1](https://arxiv.org/html/2605.21492#S4.SS1)Phi\_negLocalGlobal\.lean§[8\.7](https://arxiv.org/html/2605.21492#S8.SS7)local\_attribution\_impossibilityRobustnessLipschitz\.lean§[13](https://arxiv.org/html/2605.21492#S13)flip\_rate\_robustSBDInstances\.lean§[7](https://arxiv.org/html/2605.21492#S7)attribution\_sbd\_unfaithfulModelSelectionDesignSpace\.lean§[7](https://arxiv.org/html/2605.21492#S7)model\_family\_a\_or\_family\_b*Axiom strengthening:*Qualitative\.leanStratificationimpossibility\_qualitativeProportionalityLocal\.leanStratificationgbdt\_impossibility\_localLocalSufficiency\.leanStratificationlocal\_proportionality\_sufficesStumpProportionality\.lean§[4\.1](https://arxiv.org/html/2605.21492#S4.SS1)stump\_proportionality\_uniqueIntersectionalFairness\.lean§[8\.2](https://arxiv.org/html/2605.21492#S8.SS2)intersectional\_audit\_impossibilityMutualInformation\.lean§[13](https://arxiv.org/html/2605.21492#S13)mi\_is\_exact\_boundarySetup\.leanBundledattribution\_impossibility\_bundledApproximateEquity\.leanStratificationrashomon\_from\_bounded\_proportionalityQueryComplexityParametric\.lean§[8\.4](https://arxiv.org/html/2605.21492#S8.SS4)query\_complexity\_parametric*New derivations \(this session, zero new axioms\):*MeasureHypotheses\.leanDefinitionsIsDGPSymmetric, IsNonDegenerateUnfaithfulQuantitative\.leanThm\.[29](https://arxiv.org/html/2605.21492#Thmtheorem29)attribution\_prob\_halfVarianceDerivation\.lean§[5](https://arxiv.org/html/2605.21492#S5)consensus\_variance\_from\_independenceQueryComplexityDerived\.lean§[8\.4](https://arxiv.org/html/2605.21492#S8.SS4)chebyshev\_query\_boundBinaryQuantizer\.lean§[4\.1](https://arxiv.org/html/2605.21492#S4.SS1)binary\_quantizer\_fractionBayesOptimalTie\.lean§[6](https://arxiv.org/html/2605.21492#S6)tie\_dominates\_commitmentLossPreservation\.lean§[3\.1](https://arxiv.org/html/2605.21492#S3.SS1)rashomon\_from\_swap\_with\_lossParetoOptimality\.lean§[5\.1](https://arxiv.org/html/2605.21492#S5.SS1)dash\_unique\_pareto\_optimal*Infrastructure:*Basic\.leanImport hub\(all 54 files\)RandomForest\.lean§[4\.4](https://arxiv.org/html/2605.21492#S4.SS4)\(documentation only\)

## 12Related Work

##### Attribution impossibility results\.

Bilodeau et al\. \([2024](https://arxiv.org/html/2605.21492#bib.bib2)\)prove completeness and linearity cannot coexist;Huang and Marques\-Silva \([2024](https://arxiv.org/html/2605.21492#bib.bib14)\)show SHAP can misrank features in Boolean settings;Srinivas and Fleuret \([2019](https://arxiv.org/html/2605.21492#bib.bib29)\)prove complete attributions cannot be weakly input\-dependent;Rao \([2025](https://arxiv.org/html/2605.21492#bib.bib25)\)establish Kolmogorov complexity barriers\. To our knowledge, our result is the first to simultaneously address cross\-model*stability*as an impossibility, give quantitative architecture\-discriminating bounds, and provide a constructive resolution with proved optimality\.Decker et al\. \([2024](https://arxiv.org/html/2605.21492#bib.bib7)\)optimize aggregation across attribution*methods*for a single model; we aggregate across*models*viaDash\.Jin et al\. \([2025](https://arxiv.org/html/2605.21492#bib.bib16)\)give constructive stability certificates; we give the impossibility that necessitates them\.Noguer i Alonso \([2025](https://arxiv.org/html/2605.21492#bib.bib23)\)derives information\-theoretic limits on explanation complexity; our limits are about ranking consistency under feature correlation\. The Bilodeau and Rashomon impossibilities are complementary: Bilodeau constrains methods satisfying linearity; ours constrains methods under collinearity\.

Table 10:Positioning relative to prior attribution impossibility results\. These criteria reflect the specific contributions of the present work; each prior result makes distinct contributions not captured by this comparison\.
##### Rashomon effect and model multiplicity\.

Attribution rankings across Rashomon sets are inherently partial ordersLaberge et al\. \([2023](https://arxiv.org/html/2605.21492#bib.bib19)\);Rudin et al\. \([2024](https://arxiv.org/html/2605.21492#bib.bib27)\)advocate embracing model multiplicity\. Our theorem shows the partial order is not a pragmatic choice but a mathematical necessity\.Herren and Hahn \([2023](https://arxiv.org/html/2605.21492#bib.bib12)\)develop statistical inference for feature rankings under model multiplicity; our contribution is to prove that the multiplicity is unavoidable under collinearity, not merely empirically common\.Krishna et al\. \([2022](https://arxiv.org/html/2605.21492#bib.bib18)\)document the “disagreement problem” in explainable ML—different explanation methods produce different outputs for the same model—complementary to our result that the*same*method produces different outputs for different equivalent models\.

##### Attribution sensitivity and fragility\.

Ghorbani and Zou \([2019](https://arxiv.org/html/2605.21492#bib.bib11)\)demonstrate that neural network attributions are empirically fragile to small input perturbations\.Hooker et al\. \([2021](https://arxiv.org/html/2605.21492#bib.bib13)\)show that unrestricted permutation\-based importance forces extrapolation into out\-of\-distribution regions\. Our instability arises from a different mechanism \(model multiplicity, not input perturbation or extrapolation\), but the practical consequence—unreliable explanations—is shared\.

##### Foundational methods\.

Feature attribution via Shapley values\(Shapley,[1953](https://arxiv.org/html/2605.21492#bib.bib28)\)was introduced to ML byLundberg and Lee \([2017](https://arxiv.org/html/2605.21492#bib.bib21)\)\. The model architectures we analyze were introduced byBreiman \([2001](https://arxiv.org/html/2605.21492#bib.bib3)\)\(random forests\) andFriedman \([2001](https://arxiv.org/html/2605.21492#bib.bib10)\)\(gradient boosting\); LIME\(Ribeiro et al\.,[2016](https://arxiv.org/html/2605.21492#bib.bib26)\)provides an alternative local explanation framework\.

##### Fairness impossibility\.

Chouldechova \([2017](https://arxiv.org/html/2605.21492#bib.bib4)\)andKleinberg et al\. \([2017](https://arxiv.org/html/2605.21492#bib.bib17)\)prove calibration, balance, and equal false positive rates cannot coexist when base rates differ\. Our trilemma \(faithfulness, stability, completeness\) is structurally analogous\.

##### Formal verification for ML\.

Nipkow \([2009](https://arxiv.org/html/2605.21492#bib.bib22)\)formalized Arrow’s theorem in Isabelle/HOL;Zhang et al\. \([2026](https://arxiv.org/html/2605.21492#bib.bib32)\)formalized statistical learning theory in Lean 4\(de Moura and Ullrich,[2021](https://arxiv.org/html/2605.21492#bib.bib6)\)using Mathlib\(The mathlib Community,[2020](https://arxiv.org/html/2605.21492#bib.bib30)\)\. To our knowledge, our formalization is the first formally verified impossibility result in explainable AI\.

## 13Discussion

##### Limitations\.

The split\-count axioms assume full signal capture \(α=1\\alpha=1\); for finite\-depth trees,α≈2/π\\alpha\\approx 2/\\pi\(R2=0\.89R^\{2\}=0\.89\)\. The impossibility holds for anyα\>0\\alpha\>0\. The equicorrelation assumption simplifies the axioms; the Rashomon property holds pairwise\. The balanced ensemble assumption is idealized, thoughO​\(1/M\)O\(1/M\)convergence is robust to approximate balance\. The global proportionality axiom \(ccuniform across models\) has CV≈0\.35\\approx 0\.35–0\.660\.66empirically; under variablecc,Dashconsensus achieves approximate rather than exact equity, with the equity violation bounded by the CV ofccacross first\-mover and non\-first\-mover models\. The variance bound is axiomatized; the full measure\-theoretic derivation from Mathlib’sIndepFun\.variance\_sumis deferred\. Switching to conditional SHAP does not universally resolve the instability \(Theorem[47](https://arxiv.org/html/2605.21492#Thmtheorem47)\)\. Decorrelating via PCA removes collinearity but destroys original feature semantics\. An alternative is removing redundant features entirely \(e\.g\., via VIF thresholding\)\. This eliminates the impossibility but changes the model: predictions differ because fewer features are used, and genuinely useful information may be discarded\.Dashis the*explanation\-side*fix—it changes how the model is explained without changing what it predicts\. The two approaches are complementary: feature removal for model simplification,Dashfor faithful explanation of complex models that retain all features\.DashrequiresM×M\\timestraining cost;M=25M\{=\}25brings the flip rate below 1%, whileM=5M\{=\}5provides a substantial improvement at modest cost\. The empirical validation focuses on gradient boosting and neural networks; the Lasso \(φj1/φk=∞\\varphi\_\{j\_\{1\}\}/\\varphi\_\{k\}=\\infty\) and random forest \(1\+O​\(1/T\)1\+O\(1/\\sqrt\{T\}\)\) bounds are proved but not empirically demonstrated\. The prevalence survey uses 20 models per dataset, achieving approximately 60% power to detect 10% flip rates; the true prevalence may be higher than the reported 68%\. The 10% flip rate threshold defining “instability” is a practical convention; at a 5% threshold the prevalence would be higher, at 15% lower\.

##### Computational cost and practical deployment\.

For batch pipelines, trainingM=25M\{=\}25models is feasible\. For real\-time explanations, use the single\-model screen to flag unstable pairs\. ForP\>500P\>500, correlation\-based grouping prunes the diagnostic toO​\(G⋅m2\)O\(G\\cdot m^\{2\}\)\. AtP=500P\{=\}500with 20 models, the full workflow completes in under 2\.5 minutes\.

##### Broader implications\.

In a survey of 77 public datasets, 92% have feature pairs with\|ρ\|\>0\.5\|\\rho\|\>0\.5and 68% exhibit attribution instability—the impossibility is a practical reality\. Our theorem establishes this as a “known and foreseeable circumstance” under the EU AI Act \(Art\. 13\(3\)\(b\)\(ii\)\)\(EU Parliament,[2024](https://arxiv.org/html/2605.21492#bib.bib8)\)\. The consequences are concrete: hospitals may invest in wrong interventions, data scientists may fix the wrong feature, and published studies may report artifacts of specific training runs\. The impossibility has direct consequences for fairness auditing \(Theorem[48](https://arxiv.org/html/2605.21492#Thmtheorem48)\): single\-model SHAP audits for proxy discrimination are provably unreliable under collinearity\.

##### Distinction from classical multicollinearity\.

The classical multicollinearity concern is about estimation variance \(Var​\(β^j−β^k\)→∞\\mathrm\{Var\}\(\\hat\{\\beta\}\_\{j\}\-\\hat\{\\beta\}\_\{k\}\)\\to\\inftyasρ→1\\rho\\to 1\)\. Our result is qualitatively different: it concerns*ranking impossibility*, not estimation imprecision\. Even with infinite data and perfect estimates, the ranking of symmetric features is a coin flip—because different models in the Rashomon set rank them in opposite orders\. The VIF diagnostic detects coefficient instability; our screen and Z\-test diagnostics detect*attribution ranking*instability, which persists even when coefficients are well\-estimated \(e\.g\., in tree ensembles that do not estimate coefficients at all\)\.

##### Rashomon set vs\. deployed model\.

The impossibility characterizes the Rashomon set, not a single deployed model\. A fixed pipeline with a fixed seed produces a deterministic, reproducible ranking\. The instability arises upon retraining, auditing, or model comparison—all routine in regulated settings\.

##### Connection to underspecification\.

\(D’Amour et al\.,[2022](https://arxiv.org/html/2605.21492#bib.bib5)\)showed that ML pipelines are*underspecified*: models with equivalent held\-out performance can behave differently on deployment\-relevant criteria\. Our result formalizes the attribution\-specific consequence of this phenomenon\. Where D’Amour et al\. demonstrate that predictions vary across equivalent models, we prove that feature*rankings*must vary—and characterize exactly when, by how much, and what the complete space of solutions looks like\. The Design Space Theorem can be viewed as the attribution\-level analogue of their “stress testing” recommendation: rather than hoping a single model’s explanation is stable, the practitioner should probe the full Rashomon set\. DASH operationalizes this probe\.

##### Information loss\.

Dashdiscards exactlylog2⁡\(m\!\)\\log\_\{2\}\(m\!\)bits per group ofmmsymmetric features—the bits encoding the unreliable within\-group ordering\. Between\-group information is*sharpened*: mutual information approaches 1 bit per pair asM→∞M\\to\\infty\.

##### Loss landscape geometry\.

The impossibility has a geometric interpretation: near\-singular Fisher information creates ridges in the loss landscape along which feature importance redistributes without changing model quality\. The same flatness that makes optimization easy makes attribution hard\.

##### Named techniques\.

This paper contributes three reusable techniques: \(1\) the*Rashomon reduction*—reducing a design\-space question to a model\-multiplicity check; \(2\) the*FIM\-to\-Rashomon bridge*—connecting Fisher information rank deficiency to the Rashomon property; and \(3\) the*symmetric Bayes dichotomy*—the general two\-families theorem for symmetric decision problems\.

##### Proof status transparency and axiom stratification\.

The formalization uses 16 axioms total \(14 domain\-specific \+ 2 query\-complexity\), but not all results require all axioms\. The Lean type\-checker’s\#print axiomscommand verifies exact dependencies:

- •Zero behavioral axioms:The core impossibility \(Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\) depends only on the Rashomon property as a hypothesis—no domain\-specific axioms whatsoever\. A qualitative variant \(impossibility\_qualitativeinQualitative\.lean\) proves the impossibility from just two properties—dominance and surjectivity—as hypotheses\.
- •Four axioms:The GBDT impossibility holds from surjectivity and split\-count axioms alone \(gbdt\_impossibility\_localinProportionalityLocal\.lean\), withoutproportionality\_global\.
- •Nine axioms:The ratio bound1/\(1−ρ2\)1/\(1\{\-\}\\rho^\{2\}\)and the equity violation hold from per\-model proportionality \(each model has its own constantcfc\_\{f\}\)\. The global proportionality axiom \(∃c\>0\\exists\\,c\>0uniform across models\) is*not required*—cfc\_\{f\}cancels in every ratio \(local\_proportionality\_sufficesinLocalSufficiency\.lean\)\.
- •Sixteen axioms:The full set is needed only for DASH convergence \(cross\-model consistency via cross\-group axioms\) and the query complexity scaling constant\.

This stratification directly addresses the proportionality axiom’s empirical variance \(CV≈0\.35\\approx 0\.35–0\.660\.66\): the axiom is unnecessary for the impossibility and ratio bound, which depend only on split\-count structure\.

The following are fully formalized in Lean \(305 theorems, 0sorry, 54 files\): the Design Space Theorem, the symmetric Bayes dichotomy, all three impossibility instances, the conditional attribution impossibility, the Gaussian FIM impossibility and flip rate formula, the fairness audit impossibility, the intersectional fairness compounding, the exact GBDT flip rate, DASH variance optimality, the Rashomon inevitability, the flip rate robustness \(Lipschitz continuity inρ\\rho\), the mutual information generalization, the unfaithfulness/path\-convergence results, the unfaithfulness probability of exactly1/21/2, the Bayes\-optimality of ties, the consensus varianceσ2/M\\sigma^\{2\}/Mfrom independence, the binary quantizer fraction2/π2/\\pi, the Chebyshev query complexity bound, the loss\-preserving Rashomon construction, and the Pareto dominance of DASH\. The Z\-test diagnostic characterization, information loss analysis, and multi\-dataset validation are empirical\.

##### Approximate faithfulness–stability tradeoff\.

A natural question is whether relaxing exact faithfulness helps\. Defineα\\alpha\-faithfulness:Prf⁡\[sign​\(φj​\(f\)−φk​\(f\)\)=sign​\(σ​\(j\)−σ​\(k\)\)\]≥α\\Pr\_\{f\}\[\\text\{sign\}\(\\varphi\_\{j\}\(f\)\-\\varphi\_\{k\}\(f\)\)=\\text\{sign\}\(\\sigma\(j\)\-\\sigma\(k\)\)\]\\geq\\alpha\. Under the Rashomon property with symmetric DGP, anyα\\alpha\-faithful stable ranking satisfiesα≤1/2\\alpha\\leq 1/2\. The proof is immediate: by DGP symmetry,Pr⁡\[φj​\(f\)\>φk​\(f\)\]=1/2\\Pr\[\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\]=1/2, and a stable ranking fixes one direction, so it agrees with at most half the models\. A coin flip achievesα=1/2\\alpha=1/2; the stable ranking is no better than random for symmetric feature pairs\.

Formmfeatures in a group under full DGP symmetry, the attribution ranking is a uniform random permutation\. Any stable rankingσ∗\\sigma^\{\*\}has expected Spearman correlation with the model’s ranking of𝔼​\[ρS​\(σ∗,π\)\]=−1/\(m−1\)\\mathbb\{E\}\[\\rho\_\{S\}\(\\sigma^\{\*\},\\pi\)\]=\-1/\(m\-1\)\. The stable ranking is*negatively correlated*with the model’s ranking in expectation \(form≥3m\\geq 3\) and converges to zero correlation asm→∞m\\to\\infty\.

##### Open problems\.

The Bayes\-optimality half of the Design Space is proved but not in Lean \(requires measure\-theoretic decision theory\)\. Deriving split\-count axioms algorithmically from the TreeSHAP algorithm and proving the proportionality axiom for general tree depths remain open\. The generalization fromρ\>0\\rho\>0toI​\(Xj;Xk\)\>0I\(X\_\{j\};X\_\{k\}\)\>0is now complete \(MutualInformation\.lean\): mutual information is the exact boundary between possible and impossible feature ranking\. A reference implementation is available at[https://github\.com/DrakeCaraker/dash\-shap](https://github.com/DrakeCaraker/dash-shap)\.

##### Formalization as methodology\.

Beyond certifying correctness, the Lean formalization served as a bug\-finding methodology: it caught two logical inconsistencies and one type mismatch that survived informal review\. We recommend formalizing impossibility theorems as a general practice\.

## Appendix AExtended Proof Details

### A\.1Gaussian Binary Quantization: Full Derivation

###### Proposition 67\(First\-stump variance capture\)\.

For the first boosting round onnnGaussian training samples, the stump splits at the empirical medianm^\\hat\{m\}, satisfying\|m^\|=Op​\(σ/n\)\|\\hat\{m\}\|=O\_\{p\}\(\\sigma/\\sqrt\{n\}\)\. The variance captured is:

α1​\(n\)=2π​\(1−π​\(π−2\)2​n\+O​\(n−2\)\)\\alpha\_\{1\}\(n\)=\\frac\{2\}\{\\pi\}\\left\(1\-\\frac\{\\pi\(\\pi\-2\)\}\{2n\}\+O\(n^\{\-2\}\)\\right\)Forn=2000n=2000:Δ​α1≈0\.0009\\Delta\\alpha\_\{1\}\\approx 0\.0009—negligible\.

###### Proof\.

The optimal split ofX∼𝒩​\(0,σ2\)X\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}\)atδ\\deltainstead of0gives conditional meansμ\+=σ​ϕ​\(δ/σ\)/\(1−Φ​\(δ/σ\)\)\\mu\_\{\+\}=\\sigma\\phi\(\\delta/\\sigma\)/\(1\-\\Phi\(\\delta/\\sigma\)\)andμ−=−σ​ϕ​\(δ/σ\)/Φ​\(δ/σ\)\\mu\_\{\-\}=\-\\sigma\\phi\(\\delta/\\sigma\)/\\Phi\(\\delta/\\sigma\)\. The variance captured isVar​\(X^\)=μ\+2​Pr⁡\(X\>δ\)\+μ−2​Pr⁡\(X≤δ\)\\mathrm\{Var\}\(\\hat\{X\}\)=\\mu\_\{\+\}^\{2\}\\Pr\(X\>\\delta\)\+\\mu\_\{\-\}^\{2\}\\Pr\(X\\leq\\delta\)\. Expanding aroundδ=0\\delta=0usingϕ​\(0\)=1/2​π\\phi\(0\)=1/\\sqrt\{2\\pi\}:Var​\(X^\)=\(2/π\)​σ2​\(1−δ2​\(π−2\)/σ2\+O​\(δ4/σ4\)\)\\mathrm\{Var\}\(\\hat\{X\}\)=\(2/\\pi\)\\sigma^\{2\}\(1\-\\delta^\{2\}\(\\pi\-2\)/\\sigma^\{2\}\+O\(\\delta^\{4\}/\\sigma^\{4\}\)\)\. The empirical median ofnnstandard Gaussians has varianceπ/\(2​n\)\\pi/\(2n\), so𝔼​\[δ2\]=π​σ2/\(2​n\)\\mathbb\{E\}\[\\delta^\{2\}\]=\\pi\\sigma^\{2\}/\(2n\)\. Substituting:𝔼​\[α1\]=\(2/π\)​\(1−\(π2−2​π\)/\(2​n\)\+O​\(n−2\)\)\\mathbb\{E\}\[\\alpha\_\{1\}\]=\(2/\\pi\)\(1\-\(\\pi^\{2\}\-2\\pi\)/\(2n\)\+O\(n^\{\-2\}\)\)\. ∎

After the first boosting round, the residualsrt=Y−η​h1​\(X\)r\_\{t\}=Y\-\\eta h\_\{1\}\(X\)are NOT Gaussian: they are a location\-shifted mixture \(the stump creates two subpopulations\)\. For a stump with two leaves at values±c\\pm c, the residuals have excess kurtosisκ=O​\(η2​c2/σ2\)\\kappa=O\(\\eta^\{2\}c^\{2\}/\\sigma^\{2\}\)\. Forη=0\.1\\eta=0\.1, the kurtosis correction is small but accumulates acrossT=100T=100rounds, producing a systematic downward bias inα\\alpha\. The fittedα=0\.60\\alpha=0\.60vs\.2/π=0\.6372/\\pi=0\.637gap of0\.0370\.037is accounted for:<0\.001<0\.001from error source 1 \(empirical split\),≈0\.036\\approx 0\.036from error source 2 \(non\-Gaussian residuals\)\.

### A\.2Exact Flip Rate Under Approximate Symmetry

The exact1/21/2flip rate holds under perfect DGP symmetry \(μj=μk\\mu\_\{j\}=\\mu\_\{k\}\)\. For approximately symmetric features \(\|μj−μk\|≪σj​k\|\\mu\_\{j\}\-\\mu\_\{k\}\|\\ll\\sigma\_\{jk\}\), the flip rate isΦ​\(−\|μj−μk\|/σj​k\)\\Phi\(\-\|\\mu\_\{j\}\-\\mu\_\{k\}\|/\\sigma\_\{jk\}\), approaching1/21/2from below as the importance gap vanishes\. The empirical 48% on Breast Cancer \(worst perimeter vs\. worst area, mean\|SHAP\|\|\\mathrm\{SHAP\}\|: 0\.940 vs\. 0\.901\) is consistent with a small positive signal\-to\-noise ratio\. This result is formalized in Lean asbalanced\_flip\_symmetry\(for balanced finite ensembles, the number of models rankingj\>kj\>kequals the number rankingk\>jk\>j\)\.

## Appendix BDASH Robustness: Extended Analysis

### B\.1When to Prefer the Median

The median has better breakdown point \(50% vs\. 0%\) and is preferable when the attribution distribution is heavy\-tailed \(e\.g\., contains outlier models\)\. For standard ML training procedures \(XGBoost, random forests\) where attributions are well\-behaved,Dash\(the mean\) is strictly more efficient\. For adversarial settings where some models may be corrupted, the median or trimmed mean provides robustness at the cost of requiring more models\.

The trimmed mean interpolates: theα\\alpha\-trimmed mean \(discarding top and bottomα\\alphafraction\) has ARE relative to the mean of:

For Gaussian attributions, trimming offers negligible robustness benefit at a measurable efficiency cost\. The 10%\-trimmed mean requires1/0\.966≈3\.5%1/0\.966\\approx 3\.5\\%more models thanDash\.

## Appendix CExtended Conditional Attribution Analysis

### C\.1Causal Structure Validation: Full Results

The interventional SHAP implementation uses a background\-data approximation that does not exactly implement causal/conditional SHAP in the sense of Janzing et al\. \(2020\)\. Results should be interpreted as evidence about theshappackage’s interventional mode, not as a definitive test of the theoretical conditional attribution\.

## Appendix DExtended LLM Analysis

### D\.1Fine\-Tuning Details

DistilBERT fine\-tuned on SST\-2 \(2,000 training samples\) with 5 different random seeds\. Configuration: 1 epoch, AdamW, lr=2×10−5=2\\times 10^\{\-5\}, batch size 16\. Selected unstable pairs under fine\-tuning:

The gap between fine\-tuning \(14\.5% of pairs unstable\) and perturbation \(88%\) reflects the difference in weight divergence\. The perturbation result represents the full Rashomon set; the fine\-tuning result represents the subset explored by standard training\. Attention weights are not SHAP values: they do not satisfy the proportionality axiom, and the “collinear group” structure of tree features does not map cleanly to token positions\. A formal impossibility for transformer attention would require different axioms\.

## Appendix EExtended Experimental Results

### E\.1KernelSHAP Noise Control: Full Results

Increasing background samples from 50 to 200 reduces noise by2\.6×2\.6\\timesat4×4\\timescompute cost; the default 50 is adequate for detecting model\-level instability\.

### E\.2Cross\-Implementation: Full Results

Table 11:Full cross\-implementation comparison on Breast Cancer \(50 models each\)\.CatBoost’sget\_feature\_importance\(\)returns gain\-based importance \(not raw split counts\), producing a differentZZ\-statistic distribution\. For CatBoost, the multi\-model Z\-test \(r=−0\.892r=\-0\.892\) is recommended\. LightGBM’s feature importance is split\-count based and transfers with modest precision reduction\.

### E\.3Prevalence Survey: Statistical Power Analysis

At the 10% threshold, the survey has only 32% power: approximately two\-thirds of truly borderline\-unstable pairs are missed\. The 68% prevalence is a conservative lower bound\.

### E\.4Class Imbalance Amplifies Instability

Class imbalance compounds attribution instability\. On synthetic Gaussian data \(P=10P\{=\}10, 2 groups ofm=5m\{=\}5,ρ=0\.8\\rho\{=\}0\.8, 30 models\), we sweep the positive\-class ratio:

At 1:1 balance, 7/20 within\-group pairs are unstable\. At 1:5\+ imbalance,*all*20 pairs become unstable\. Imbalance amplifies the Rashomon effect: the minority class provides less constraining signal, allowing more models to achieve near\-optimal loss with different feature utilization patterns\. For healthcare and fraud detection \(where class imbalance is standard\), instability is essentially universal\. Reproduce:class\_imbalance\_instability\.py\.

### E\.5Missing Data Compounds Instability

Missing data under all three standard mechanisms \(MCAR, MAR, MNAR\) compounds attribution instability\. On synthetic Gaussian data \(P=10P\{=\}10, 2 groups ofm=5m\{=\}5,ρ=0\.9\\rho\{=\}0\.9, 30 models\):

Even 10% MCAR missingness drives the number of unstable pairs from 12/20 \(baseline\) to 20/20\. The mechanism matters less than the rate: all three mechanisms produce comparable degradation at 20%\. Missing data reduces the effective sample size, widening confidence sets and enlarging the Rashomon set\. Reproduce:missing\_data\_instability\.py\.

### E\.6Longitudinal Retraining Drift

Over 50 sequential retraining rounds \(each adding 5% noise to a synthetic dataset withρ=0\.9\\rho\{=\}0\.9\), ranking instability accumulates dramatically:

The Spearman correlation degrades from 1\.0 to 0\.18 by round 31, with cumulative flips reaching 207\. The recovery at round 50 \(ρS=0\.42\\rho\_\{S\}\{=\}0\.42\) reflects the noise accumulation saturating\. For model monitoring pipelines, this demonstrates that feature rankings should not be compared across distant retraining epochs without re\-running theDashdiagnostic\. Reproduce:longitudinal\_retraining\.py\.

### E\.7SAGE and Boruta Comparison

Alternative feature importance methods are equally or more unstable than TreeSHAP on Breast Cancer \(50 models\):

SAGE and Boruta show*more*instability than TreeSHAP \(92–94% vs\. 41%\), confirming the impossibility is method\-agnostic\. The cross\-method correlation \(r=0\.471r\{=\}0\.471\) shows the*same*pairs tend to be unstable under different methods—the instability is driven by feature collinearity, not by the attribution algorithm\. Reproduce:sage\_comparison\.py\.

### E\.8Bag\-of\-Words NLP Attribution Instability

On the 20 Newsgroups dataset with TF\-IDF features and XGBoost \(50 models, 1000 max features\), 60% of documents have an unstable top\-1 token attribution and 91% have an unstable top\-3\. Mean pairwise Spearman correlation is 0\.905 \(high for between\-document features, low for within\-group correlated tokens\)\. The most unstable word pair is “eternal”/“hell” \(\|ρ\|=0\.371\|\\rho\|\{=\}0\.371, flip rate0\.1860\.186\)\. Only 2 word pairs exceed the 10% flip threshold, reflecting the sparse, weakly\-correlated nature of bag\-of\-words features \(most token pairs are independent\)\. Reproduce:nlp\_token\_instability\.py\.

### E\.9Time\-Series Feature Instability

For temporal features generated from AR\(1\) processes with rolling\-window engineering \(Praw=5P\_\{\\text\{raw\}\}\{=\}5,Pengineered=30P\_\{\\text\{engineered\}\}\{=\}30, 50 XGBoost models\), 27% of within\-series pairs \(features derived from the same raw signal\) show flip rates above 10%\. The breakdown:

The highest instability pair isX0\_rawvs\.X0\_rmean5\(\|ρ\|=0\.996\|\\rho\|\{=\}0\.996, flip rate 0\.508\), confirming that temporal feature engineering creates highly correlated groups susceptible to the impossibility\. Reproduce:timeseries\_instability\.py\.

### E\.10Adversarial Max Instability

A grid search over 108 XGBoost configurations \(group sizes\{2,3,5,10\}\\\{2,3,5,10\\\}, boosting rounds\{50,100,500\}\\\{50,100,500\\\}, depths\{1,3,6\}\\\{1,3,6\\\}, learning rates\{0\.05,0\.1,0\.3\}\\\{0\.05,0\.1,0\.3\\\}\) atρ=0\.9\\rho\{=\}0\.9confirms the impossibility is inescapable: all top\-10 worst\-case configurations hit the maximum flip rate of 0\.500\. The 0\.500 ceiling is reached regardless of hyperparameter choices, confirming the impossibility is a structural property of collinearity, not a tuning artifact\. Total: 2,160 model fits\. Reproduce:adversarial\_max\_instability\.py\.

### E\.11Hyperparameter Sensitivity

Across a 27\-configuration sweep \(learning rates\{0\.05,0\.1,0\.3\}\\\{0\.05,0\.1,0\.3\\\}, depths\{1,3,6\}\\\{1,3,6\\\}, boosting rounds\{50,100,500\}\\\{50,100,500\\\}\) atρ∈\{0\.5,0\.7,0\.9\}\\rho\\in\\\{0\.5,0\.7,0\.9\\\}:

- •Global minimum flip rate: 38\.7% atρ=0\.5\\rho\{=\}0\.5\(η=0\.3\\eta\{=\}0\.3, depth=1\{=\}1,T=500T\{=\}500\)\. The impossibility never vanishes\.
- •Most influential hyperparameter: number of estimators \(spread 2\.16pp\), followed by max depth \(1\.76pp\) and learning rate \(0\.82pp\)\.
- •Atρ=0\.9\\rho\{=\}0\.9: minimum flip rate across all configurations is 47\.2%\.

Reproduce:hyperparameter\_sensitivity\.py\.

### E\.12DASH Breakdown Contamination Sweep

Under adversarial contamination of the ensemble \(replacingKKof 25 models with adversarial models\), the mean flip rate degrades:

Counterintuitively, contamination*decreases*the observed flip rate because adversarial models break the first\-mover symmetry\. The trimmed mean provides marginal improvement \(<<5% at 80% contamination\)\. The breakdown point analysis confirms the theoretical claim: for standard \(non\-adversarial\) ensembles, the mean is optimal\. Reproduce:dash\_breakdown\_point\.py\.

### E\.13Experiment Summary

Table[12](https://arxiv.org/html/2605.21492#A5.T12)summarizes all robustness experiments with reproduction scripts\.

Table 12:Summary of additional experiments\.

## Appendix FAttempted Common Generalization with Arrow’s Theorem

Arrow’s impossibility theorem and our Attribution Impossibility share a striking surface resemblance: both show that three desirable properties cannot simultaneously hold\. We investigated whether a common abstract framework subsumes both\.

### F\.1Structural Comparison

The critical asymmetry: Arrow’s theorem concerns a*profile aggregation*function taking all voters simultaneously\. The Attribution Impossibility concerns a single\-input mapping: for each modelff, the ranking should reflectff’s attributions\. The impossibility arises because the ranking must simultaneously agree with all models but be model\-independent\.

### F\.2Attempted Common Framework

###### Definition 68\(Abstract Aggregation Problem\)\.

An*abstract aggregation problem*is a tuple\(ℐ,𝒜,ℛ,Agree\)\(\\mathcal\{I\},\\mathcal\{A\},\\mathcal\{R\},\\text\{Agree\}\)where:

- •ℐ\\mathcal\{I\}is a set of*instances*\(voters or models\),
- •𝒜\\mathcal\{A\}is the set of alternatives \(candidates or features\),
- •ℛ\\mathcal\{R\}is the set of total orders on𝒜\\mathcal\{A\},
- •Agree:ℐ→ℛ\\text\{Agree\}\\colon\\mathcal\{I\}\\to\\mathcal\{R\}assigns each instance its “preferred” order\.

An*aggregation rule*F:2ℐ→ℛF\\colon 2^\{\\mathcal\{I\}\}\\to\\mathcal\{R\}maps subsets of instances to a consensus order\.

Arrow’s setup:FFtakes the full profile\(L1,…,Ln\)\(L\_\{1\},\\ldots,L\_\{n\}\)and IIA saysFF’s pairwise comparison of\(a,b\)\(a,b\)depends only on the restriction of eachLiL\_\{i\}to\{a,b\}\\\{a,b\\\}\.

Attribution setup:FFis required to be a*constant function*\(stability: the ranking does not depend on which model\)\. Faithfulness says this constant ranking agrees with every instance’s ordering\. But this extreme makes the attribution version trivially impossible—a constant ranking cannot agree with conflicting instances \(this is just the definition of the Rashomon property\)\. Arrow’s theorem is much deeper: it shows that even when the aggregation*is*allowed to depend on instances, the constraints are still too tight\. The proofs have entirely different structures\.

### F\.3Assessment

##### Relationship to Sen’s liberalism paradox\.

A closer structural analogue may be Sen’s \(1970\) impossibility of a Paretian liberal, which concerns a setting where individual “rights” \(each person’s ranking of certain pairs should be respected\) conflict with the Pareto criterion\. The attribution impossibility can be viewed as a Sen\-type result where each model has the “right” to determine the ranking of features \(faithfulness\), but these rights conflict across models\. However, we do not pursue this further, as the connection remains at the level of analogy rather than formal subsumption\.

## Appendix GTopological Analysis of the Impossibility

We investigate whether the Attribution Impossibility has topological content beyond simple connectedness arguments\.

### G\.1Them=2m=2Case

For two featuresj,kj,k, the attribution map assigns to each training seedssa signσ​\(s\)=sign​\(φj​\(fs\)−φk​\(fs\)\)∈\{\+1,−1\}\\sigma\(s\)=\\text\{sign\}\(\\varphi\_\{j\}\(f\_\{s\}\)\-\\varphi\_\{k\}\(f\_\{s\}\)\)\\in\\\{\+1,\-1\\\}\. The Rashomon property says both values are achieved\. A “stable ranking” is a constant function\. The impossibility is immediate; no topological machinery is needed\.

### G\.2Them=3m=3Case

For three features, the attribution map sends seeds to rankings inS3S\_\{3\}\(6 elements\)\. Again, if𝒮\\mathcal\{S\}is connected and the map is continuous, then the image must be a connected subset ofS3S\_\{3\}\. SinceS3S\_\{3\}is discrete, the image is a single point—contradicting Rashomon\. This is the same connectedness argument; the symmetric group’s structure plays no role\.

### G\.3Them≥4m\\geq 4Case: The Permutohedron

Formmfeatures, the attribution vector\(φ1​\(fs\),…,φm​\(fs\)\)\(\\varphi\_\{1\}\(f\_\{s\}\),\\ldots,\\varphi\_\{m\}\(f\_\{s\}\)\)lives inℝm\\mathbb\{R\}^\{m\}\. The ranking is determined by the*chamber*of the*braid arrangement*\(the hyperplane arrangement\{xi=xj:i≠j\}\\\{x\_\{i\}=x\_\{j\}:i\\neq j\\\}\) containing the attribution vector\. The chambers are the cones of the*permutohedron*\.

### G\.4Assessment

## Appendix HOn Categorical/Axiomatic Strengthening

### H\.1The Trivial Version

### H\.2The “Constant Attribution” Escape

Why is a categorical strengthening difficult? Because trivial attribution methods escape the impossibility:

- •φj​\(f\)=1/P\\varphi\_\{j\}\(f\)=1/Pfor allj,fj,f\(uniform\): perfectly stable, perfectly equitable, satisfies any axiom system that doesn’t require faithfulness\.
- •φj​\(f\)=𝔼f​\[φj​\(f\)\]\\varphi\_\{j\}\(f\)=\\mathbb\{E\}\_\{f\}\[\\varphi\_\{j\}\(f\)\]\(population mean\): stable by construction, equitable under DGP symmetry\.

Any “impossibility for all axiom systems” must exclude these methods, which means it must require faithfulness \(or something implying it\)\. But once faithfulness is required, we are back to Theorem[5](https://arxiv.org/html/2605.21492#Thmtheorem5)\.

### H\.3The Non\-Trivial Quantitative Version

###### Definition 74\(α\\alpha\-faithfulness \(formal\)\)\.

An attribution method isα\\alpha\-faithful if for all modelsffand same\-group featuresj,kj,k:

Prf⁡\[sign​\(φj​\(f\)−φk​\(f\)\)=sign​\(σ​\(j\)−σ​\(k\)\)\]≥α\\Pr\_\{f\}\\\!\\big\[\\text\{sign\}\(\\varphi\_\{j\}\(f\)\-\\varphi\_\{k\}\(f\)\)=\\text\{sign\}\(\\sigma\(j\)\-\\sigma\(k\)\)\\big\]\\geq\\alpha

###### Proposition 75\(Approximate faithfulness–stability tradeoff \(formal\)\)\.

Under the Rashomon property with symmetric DGP, anyα\\alpha\-faithful stable ranking satisfiesα≤1/2\\alpha\\leq 1/2\.

###### Proof\.

By DGP symmetry,Pr⁡\[φj​\(f\)\>φk​\(f\)\]=1/2\\Pr\[\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\]=1/2\. A stable ranking fixesσ​\(j\)\>σ​\(k\)\\sigma\(j\)\>\\sigma\(k\)or vice versa\. Theα\\alpha\-faithfulness condition requiresPr⁡\[φj​\(f\)\>φk​\(f\)\]≥α\\Pr\[\\varphi\_\{j\}\(f\)\>\\varphi\_\{k\}\(f\)\]\\geq\\alpha, but this equals1/21/2, soα≤1/2\\alpha\\leq 1/2\. ∎

###### Proposition 76\(Spearman bound for stable rankings\)\.

Under full DGP symmetry within a group ofmmfeatures, any stable rankingσ∗\\sigma^\{\*\}has:

𝔼​\[ρS​\(σ∗,π\)\]=−1m−1\.\\mathbb\{E\}\[\\rho\_\{S\}\(\\sigma^\{\*\},\\pi\)\]=\\frac\{\-1\}\{m\-1\}\.The stable ranking is negatively correlated with the model’s ranking form≥3m\\geq 3\.

###### Proof\.

Fix anyσ∗∈Sm\\sigma^\{\*\}\\in S\_\{m\}\. By DGP symmetry, the model’s rankingπ\\piis uniform onSmS\_\{m\}\. The expected Spearman correlation of a fixed permutation with a uniform random permutation is−1/\(m−1\)\-1/\(m\-1\)\(classical result; Kendall & Gibbons, 1990, Ch\. 3\)\. ∎

## Appendix IRegulatory Mapping: EU AI Act

The EU AI Act \(Regulation \(EU\) 2024/1689\) imposes transparency and risk\-management obligations on high\-risk AI systems\. The attribution impossibility has direct consequences for compliance under several articles\.*The following mapping represents our interpretation of how the attribution impossibility interacts with existing regulation\. These recommendations have not been reviewed by regulatory authorities and do not constitute legal advice\.*

### Art\. 13: Transparency

Art\. 13\(1\) requires:

> “High\-risk AI systems shall be designed and developed in such a way to ensure that their operation is sufficiently transparent to enable deployers to interpret the system’s output and use it appropriately\.”

Attribution instability under collinearity directly undermines this requirement: when the “most important feature” changes across training seeds, the system’s output cannot be interpreted consistently\. Providers relying on single\-model SHAP rankings for transparency documentation fail to meet Art\. 13\(1\) when features are correlated\.

Art\. 13\(3\)\(b\)\(ii\) further requires providers to document:

> “known or foreseeable circumstances …that may lead to risks to health, safety or fundamental rights\.”

The impossibility theorem establishes that attribution instability under collinearity is a*known*circumstance—not a speculative risk but a mathematical certainty\. Any provider deploying a model with correlated features \(\|ρ\|\>0\|\\rho\|\>0\) who does not disclose this instability is in potential non\-compliance\.

Recommended action \(providers\):Run the single\-model screen on all deployed models\. For any flagged feature pairs, include an instability disclosure in the technical documentation required by Art\. 11\.

### Art\. 16: Provider Obligations

Art\. 16 requires providers to ensure their AI systems comply with the requirements of Chapter 2 throughout the system’s lifecycle\. Since attribution instability is a structural property of the model class \(not of a specific training run\), providers must:

1. 1\.Implement systematic instability testing \(screen/Z\-test diagnostics\) as part of the quality management system \(Art\. 17\)\.
2. 2\.Update technical documentation whenever the feature correlation structure changes \(e\.g\., new data sources\)\.
3. 3\.Provide deployers with clear guidance on which feature rankings are reliable and which are unstable\.

Recommended action \(providers\):Integrate the multi\-model Z\-test into the CI/CD pipeline\. Document all feature pairs with\|ρ\|\>0\.5\|\\rho\|\>0\.5as potentially unstable\.

### Art\. 26: Deployer Obligations

Art\. 26 requires deployers to use AI systems in accordance with the instructions of use and to monitor for risks\. Deployers who receive instability disclosures must:

1. 1\.Not rely on single\-model SHAP rankings for decision justification when instability is disclosed\.
2. 2\.RequestDashconsensus or equivalent ensemble explanations for regulatory reporting\.
3. 3\.Document the explanation methodology used and its limitations\.

Recommended action \(deployers\):RequireDashconsensus \(M≥25M\\geq 25\) or equivalent ensemble method for any feature attribution used in customer\-facing decisions or regulatory filings\.

### Art\. 23: Importer Obligations

Art\. 23 requires importers to verify that providers have conducted the appropriate conformity assessment\. Importers of AI systems that use feature attribution for explainability should verify that:

1. 1\.The provider’s technical documentation addresses attribution instability\.
2. 2\.Instability testing has been performed and results are available\.
3. 3\.Appropriate mitigation \(ensemble methods or instability disclosure\) is in place\.

Recommended action \(importers\):Include attribution stability testing in the conformity checklist\. Reject systems that use single\-model SHAP without instability disclosure\.

### Recital 47: Transparency Principle

Recital 47 establishes the general principle that AI systems should be developed and used in a transparent manner, enabling meaningful human oversight\. The attribution impossibility demonstrates that transparency through feature importance rankings is fundamentally limited when features are correlated: the ranking itself is an artifact of the training seed, not a stable property of the model\-data relationship\. True transparency requires disclosing this limitation, not concealing it behind a single deterministic ranking\.

### Annex III: High\-Risk Systems

The impossibility applies to all AI systems using feature attribution for explainability under Annex III, including:

- •Credit scoring\(Annex III, 5\(b\)\): Adverse action notices citing specific features are unreliable\.
- •Employment\(Annex III, 4\): Hiring model explanations may change across seeds\.
- •Law enforcement\(Annex III, 6\): Risk assessment explanations are potentially unstable\.
- •Insurance\(Annex III, 5\(c\)\): Premium justifications based on feature importance may be arbitrary\.

##### Summary of recommended actions by actor\.

- •Providers:Run the single\-model screen on all models with correlated features; disclose instability for flagged pairs; integrate Z\-test diagnostics into CI/CD; document all pairs with\|ρ\|\>0\.5\|\\rho\|\>0\.5\.
- •Deployers:RequireDashconsensus or equivalent ensemble method for regulatory reporting; do not rely on single\-model rankings when instability is disclosed\.
- •Importers:Include attribution stability in conformity assessment checklists; reject systems without instability documentation\.
- •Market surveillance authorities:Update technical standards to require multi\-model attribution testing; treat undisclosed attribution instability as a potential non\-conformity under Art\. 13\.

## Appendix JSymPy Verification: Full Details

All algebraic consequences have been independently verified:

```
# dash-shap/paper/proofs/verify_lemma6_algebra.py
#
# Verifies:
#   split_gap = rho^2 * T / (2 - rho^2)
#   attribution_ratio = 1 / (1 - rho^2)
#   split_gap >= rho^2 * T / 2  (for rho in (0,1))
#   sum_symmetry holds under balance
#   Spearman formula consistency
#
# Result: ALL CHECKS PASS
```

The three\-layer verification \(SymPy algebra, Lean type\-checking, empirical validation\) provides strong confidence in the mathematical claims\. The SymPy script verifies: \(1\) the split\-gap formulaρ2​T/\(2−ρ2\)\\rho^\{2\}T/\(2\-\\rho^\{2\}\); \(2\) the attribution ratio1/\(1−ρ2\)1/\(1\-\\rho^\{2\}\); \(3\) the lower boundρ2​T/2\\rho^\{2\}T/2; \(4\) the sum symmetry under balanced ensembles\.

## Acknowledgments

The Lean formalization was developed with assistance from Claude Code \(Anthropic\)\. All proofs were machine\-verified by the Lean 4 type\-checker; no theorem was accepted solely on the basis of AI\-generated output\. The paper text was written by the human authors with AI editing assistance\.

## References

- Arrow \(1951\)K\. J\. Arrow\.*Social Choice and Individual Values*\.Wiley, 1951\.
- Bilodeau et al\. \(2024\)B\. Bilodeau, N\. Jaques, P\. W\. Koh, and B\. Kim\.Impossibility theorems for feature attribution\.*Proceedings of the National Academy of Sciences*, 121\(2\):e2304406120, 2024\.
- Breiman \(2001\)L\. Breiman\.Random forests\.*Machine Learning*, 45:5–32, 2001\.
- Chouldechova \(2017\)A\. Chouldechova\.Fair prediction with disparate impact: A study of bias in recidivism prediction instruments\.*Big Data*, 5\(2\):153–163, 2017\.
- D’Amour et al\. \(2022\)A\. D’Amour, K\. Heller, D\. Moldovan, et al\.Underspecification presents challenges for credibility in modern machine learning\.*Journal of Machine Learning Research*, 23\(226\):1–61, 2022\.
- de Moura and Ullrich \(2021\)L\. de Moura and S\. Ullrich\.The Lean 4 theorem prover and programming language\.In*International Conference on Automated Deduction \(CADE\)*, 2021\.
- Decker et al\. \(2024\)T\. Decker, L\.\-M\. Herm, R\. Feldhans, M\. Kamp, and B\. Hammer\.Provably better explanations with optimized aggregation of feature attributions\.In*International Conference on Machine Learning*, 2024\.
- EU Parliament \(2024\)EU Parliament\.Regulation \(EU\) 2024/1689 \(artificial intelligence act\)\.Official Journal of the European Union, OJ L, 12\.7\.2024, 2024\.
- Fisher et al\. \(2019\)A\. Fisher, C\. Rudin, and F\. Dominici\.All models are wrong, but many are useful: Learning a variable’s importance by studying an entire class of prediction models simultaneously\.*Journal of Machine Learning Research*, 20\(177\):1–81, 2019\.
- Friedman \(2001\)J\. H\. Friedman\.Greedy function approximation: A gradient boosting machine\.*Annals of Statistics*, 29\(5\):1189–1232, 2001\.
- Ghorbani and Zou \(2019\)A\. Ghorbani and J\. Zou\.Data Shapley: Equitable valuation of data for machine learning\.In*International Conference on Machine Learning*, 2019\.
- Herren and Hahn \(2023\)A\. Herren and P\. R\. Hahn\.Statistical inference for feature rankings under model multiplicity\.*Journal of Computational and Graphical Statistics*, 2023\.
- Hooker et al\. \(2021\)G\. Hooker, L\. Mentch, and S\. Zhou\.Unrestricted permutation forces extrapolation\.In*Advances in Neural Information Processing Systems*, 2021\.
- Huang and Marques\-Silva \(2024\)X\. Huang and J\. Marques\-Silva\.On the failings of Shapley values for explainability\.*International Journal of Approximate Reasoning*, 171:109112, 2024\.
- Hunt and Stein \(1946\)G\. Hunt and C\. Stein\.A structure theory for the class of exponential families\.1946\.Unpublished manuscript; results presented in Lehmann & Romano \(2005\), Ch\. 6\.
- Jin et al\. \(2025\)Y\. Jin, R\. Gao, and B\. Kim\.Probabilistic stability guarantees for feature attributions\.In*Advances in Neural Information Processing Systems*, 2025\.
- Kleinberg et al\. \(2017\)J\. Kleinberg, S\. Mullainathan, and M\. Raghavan\.Inherent trade\-offs in the fair determination of risk scores\.In*Innovations in Theoretical Computer Science \(ITCS\)*, 2017\.
- Krishna et al\. \(2022\)S\. Krishna, T\. Han, A\. Ber, J\. Brinton, A\. Lakshminarayanan, C\. Robinson, and H\. Lakkaraju\.The disagreement problem in explainable machine learning: A practitioner’s perspective\.*arXiv preprint arXiv:2202\.01602*, 2022\.
- Laberge et al\. \(2023\)G\. Laberge, Y\. Pequignot, A\. Mathieu, F\. Khomh, and M\. Marchand\.Partial order in chaos: Consensus on feature attributions in the rashomon set\.*Journal of Machine Learning Research*, 24\(364\):1–50, 2023\.
- Lehmann and Romano \(2005\)E\. L\. Lehmann and J\. P\. Romano\.*Testing Statistical Hypotheses*\.Springer, 3rd edition, 2005\.
- Lundberg and Lee \(2017\)S\. M\. Lundberg and S\.\-I\. Lee\.A unified approach to interpreting model predictions\.In*Advances in Neural Information Processing Systems*, volume 30, 2017\.
- Nipkow \(2009\)T\. Nipkow\.Social choice theory in HOL: Arrow and Gibbard\-Satterthwaite\.*Journal of Automated Reasoning*, 43:289–304, 2009\.
- Noguer i Alonso \(2025\)M\. Noguer i Alonso\.Mathematical foundations of explainability\.*SSRN Working Paper*, 2025\.
- Office of the Comptroller of the Currency \(2011\)Office of the Comptroller of the Currency\.Supervisory guidance on model risk management \(SR 11\-7/OCC 2011\-12\)\.OCC Bulletin 2011\-12, 2011\.
- Rao \(2025\)S\. Rao\.The limits of AI explainability: An algorithmic information theory approach\.*arXiv preprint arXiv:2504\.20676*, 2025\.
- Ribeiro et al\. \(2016\)M\. T\. Ribeiro, S\. Singh, and C\. Guestrin\.“why should i trust you?”: Explaining the predictions of any classifier\.In*ACM SIGKDD International Conference on Knowledge Discovery and Data Mining*, 2016\.
- Rudin et al\. \(2024\)C\. Rudin et al\.Position: Amazing things come from having many good models\.In*International Conference on Machine Learning \(ICML\)*, 2024\.
- Shapley \(1953\)L\. S\. Shapley\.A value for n\-person games\.In*Contributions to the Theory of Games II*, number 28 in Annals of Mathematics Studies, pages 307–317\. Princeton University Press, 1953\.
- Srinivas and Fleuret \(2019\)S\. Srinivas and F\. Fleuret\.Full\-gradient representation for neural network visualization\.In*Advances in Neural Information Processing Systems*, volume 32, 2019\.
- The mathlib Community \(2020\)The mathlib Community\.The Lean mathematical library\.In*Certified Programs and Proofs \(CPP\)*, 2020\.
- Tsybakov \(2009\)A\. B\. Tsybakov\.*Introduction to Nonparametric Estimation*\.Springer, 2009\.
- Zhang et al\. \(2026\)Y\. Zhang, J\. D\. Lee, and F\. Liu\.Statistical learning theory in Lean 4: Empirical processes from scratch\.*arXiv preprint arXiv:2602\.02285*, 2026\.URL[https://arxiv\.org/abs/2602\.02285](https://arxiv.org/abs/2602.02285)\.