Robust Explanations for User Trust in Enterprise NLP Systems

# Robust Explanations for User Trust in Enterprise NLP Systems
Source: [https://arxiv.org/html/2604.12069](https://arxiv.org/html/2604.12069)
Guilin Zhang, Kai Zhao, Jeffrey Friedman, Xu Chu, Amine Anoun, Jerry Ting Workday AI Research \{guilin\.zhang, kai\.zhao, jeffrey\.friedman\}@workday\.com \{xu\.chu, amine\.anoun, jerry\.ting\}@workday\.com

###### Abstract

Robust explanations are increasingly required for user trust in enterprise NLP, yet pre\-deployment validation is difficult in the common case of black\-box deployment \(API\-only access\) where representation\-based explainers are infeasible and existing studies provide limited guidance on whether explanations remain stable under real user noise, especially when organizations migrate from encoder classifiers to decoder LLMs\. To close this gap, we propose a unified black\-box robustness evaluation framework for token\-level explanations based on leave\-one\-out occlusion, and operationalize explanation robustness with top\-token flip rate under realistic perturbations \(swap, deletion, shuffling, and back\-translation\) at multiple severity levels\. Using this protocol, we conduct a systematic cross\-architecture comparison across three benchmark datasets and six models spanning encoder and decoder families \(BERT, RoBERTa, Qwen 7B/14B, Llama 8B/70B; 64,800 cases\)\. We find that, at the model sizes we evaluate, decoder LLMs produce substantially more stable explanations than encoder baselines \(73% lower flip rates on average\), with stability improving further within the decoder family with scale \(44% gain from 7B to 70B\)\. Finally, we relate robustness improvements to inference cost, yielding a practical cost–robustness tradeoff curve that supports model and explanation selection prior to deployment in compliance\-sensitive applications\.

Robust Explanations for User Trust in Enterprise NLP Systems

Guilin Zhang, Kai Zhao††thanks:Corresponding Author\., Jeffrey Friedman,Xu Chu, Amine Anoun, Jerry TingWorkday AI Research\{guilin\.zhang, kai\.zhao, jeffrey\.friedman\}@workday\.com\{xu\.chu, amine\.anoun, jerry\.ting\}@workday\.com

## 1Introduction

Robust explanations are increasingly required for user trust in enterprise NLP systems, especially in finance and HR platforms where text classifiers support high\-impact decisions \(e\.g\., risk screening, policy compliance, case triage, and ticket routing\)\. Meanwhile, many organizations are migrating from encoder\-based models such as BERTDevlinet al\.\([2019](https://arxiv.org/html/2604.12069#bib.bib2)\)and RoBERTaLiuet al\.\([2019](https://arxiv.org/html/2604.12069#bib.bib3)\)to decoder\-based LLMs such as GPTBrownet al\.\([2020](https://arxiv.org/html/2604.12069#bib.bib4)\), LlamaTouvronet al\.\([2023](https://arxiv.org/html/2604.12069#bib.bib5)\); Grattafioriet al\.\([2024](https://arxiv.org/html/2604.12069#bib.bib36)\), and QwenBaiet al\.\([2023](https://arxiv.org/html/2604.12069#bib.bib7)\); Yanget al\.\([2024](https://arxiv.org/html/2604.12069#bib.bib38)\)due to improved accuracy and flexibility, particularly in few\-shot and zero\-shot settingsWeiet al\.\([2022](https://arxiv.org/html/2604.12069#bib.bib9)\)\. However, beyond accuracy, it remains unclear whether this architectural shift improves the*robustness of explanations*needed for enterprise deployment\.

This gap is amplified by a common production reality: enterprise models are often accessed through governed services or third\-party APIs, exposing only inputs and outputs and thus imposing*black\-box constraints*that preclude gradients or internal representations\. Under such constraints, teams depend on query\-based, model\-agnostic explainers and must ensure that explanations are*stable*under routine user\-like noise \(edits, rephrasing, reordering\)\. Unstable explanations undermine auditability and user trust and can complicate compliance obligations, including emerging requirements for consistent and traceable rationales\. These considerations lead to a practical pre\-deployment question:*under black\-box access and realistic input perturbations, do decoder LLMs provide more stable explanations than encoder models, and what tradeoffs arise in cost and latency?*

Prior work has proposed a broad set of NLP explanation methods, including attention visualizationVaswaniet al\.\([2017](https://arxiv.org/html/2604.12069#bib.bib1)\), gradient\-based attributionSundararajanet al\.\([2017](https://arxiv.org/html/2604.12069#bib.bib13)\), and perturbation\-based techniques such as LIMERibeiroet al\.\([2016](https://arxiv.org/html/2604.12069#bib.bib11)\)and SHAPLundberg and Lee \([2017](https://arxiv.org/html/2604.12069#bib.bib12)\)\. Robustness analyses, however, have largely focused on single architecturesAlvarez\-Melis and Jaakkola \([2018](https://arxiv.org/html/2604.12069#bib.bib19)\); Lyuet al\.\([2024](https://arxiv.org/html/2604.12069#bib.bib22)\)or compared explainers rather than model familiesAtanasovaet al\.\([2023](https://arxiv.org/html/2604.12069#bib.bib39)\); Edinet al\.\([2025](https://arxiv.org/html/2604.12069#bib.bib43)\)\. Separately, work on adversarial text perturbationsJinet al\.\([2020](https://arxiv.org/html/2604.12069#bib.bib23)\); Morriset al\.\([2020](https://arxiv.org/html/2604.12069#bib.bib24)\)and robustness of LLM behaviorAckermanet al\.\([2024](https://arxiv.org/html/2604.12069#bib.bib50)\); Zhanget al\.\([2025](https://arxiv.org/html/2604.12069#bib.bib45)\)demonstrates sensitivity to input variation, but*cross\-architectural explanation stability*—evaluated under a unified, black\-box protocol and mapped to deployment tradeoffs—remains insufficiently characterized\.

To address this gap, we designed a pre\-deployment study that mirrors how explainability is evaluated in enterprise NLP systems when models are only accessible through governed endpoints or third\-party APIs\. We built a unified black\-box evaluation framework for token\-level explanations using leave\-one\-out occlusion, and we operationalized robustness as explanation stability under realistic user\-like perturbations, including swap, deletion, shuffling, and back\-translation at multiple severity levels\. We then applied this framework consistently across six representative models spanning encoder and decoder families \(BERT, RoBERTa, Qwen 7B/14B, Llama 8B/70B\) on three text classification benchmarks, generating 64,800 paired evaluations under matched perturbations and identical explanation procedures\.

From this controlled setup, we observed a clear set of deployment\-relevant findings\. Decoder LLMs produce substantially more stable explanations than encoder baselines, with 73% lower flip rates on average, and explanation stability improves further with model scale, showing a 44% gain from 7B to 70B parameters\. The decoder advantage is most pronounced under disruptive perturbations such as deletion and reordering that commonly occur in real enterprise text streams, while semantic\-preserving perturbations yield low flip rates for both model families\. Finally, by relating stability gains to inference cost, our results form a practical cost–robustness tradeoff that supports model and explanation selection in compliance\-sensitive enterprise deployments\.

![Refer to caption](https://arxiv.org/html/2604.12069v4/x1.png)Figure 1:Four\-stage black\-box evaluation pipeline\. Six models across encoder and decoder families are accessed through prediction APIs; multi\-level perturbations \(character/word/sentence at three severity levels\) are applied; a unified LOO occlusion explainer produces importance scores for original and perturbed inputs; Flip Rate and scaling analysis yield deployment guidance\. Stages correspond to §2\.1–§2\.4\.
## 2Methodology

Our methodology enables a fair comparison of explanation robustness across encoder and decoder architectures while reflecting realistic enterprise deployment constraints\. We assume that models are typically served through governed endpoints or third\-party APIs, where only input–output access is available and internal signals \(e\.g\., gradients or hidden states\) cannot be queried\. Under this setting, we evaluate robustness by \(i\) generating user\-like input perturbations, \(ii\) producing token\-level explanations via a single black\-box explainer that applies to both architectures, and \(iii\) measuring the stability of explanations between original and perturbed inputs with statistically grounded confidence intervals\.

### 2\.1Black\-box Evaluation Setting

Let𝒳\\mathcal\{X\}denote the space of natural\-language texts and𝒴=\{y1,…,yK\}\\mathcal\{Y\}=\\\{y\_\{1\},\\ldots,y\_\{K\}\\\}the label set\. A modelMMis accessed only through a prediction interface that returns a probability distribution over labels:

M:𝒳→Δ​\(𝒴\),M:\\mathcal\{X\}\\rightarrow\\Delta\(\\mathcal\{Y\}\),\(1\)whereΔ​\(𝒴\)\\Delta\(\\mathcal\{Y\}\)is the probability simplex over𝒴\\mathcal\{Y\}\. We denote the predicted class by

y^​\(x\)=arg⁡maxy∈𝒴⁡P​\(y∣x\),\\hat\{y\}\(x\)=\\arg\\max\_\{y\\in\\mathcal\{Y\}\}P\(y\\mid x\),\(2\)and its confidence byP​\(y^​\(x\)∣x\)P\(\\hat\{y\}\(x\)\\mid x\)\.

The black\-box constraint prohibits access to model parametersθ\\theta, intermediate representationshℓh\_\{\\ell\}, gradients∇θ\\nabla\_\{\\theta\}or∇x\\nabla\_\{x\}, attention weightsAA, and any other internal attribution signals\. This assumption matches enterprise model\-serving environments where access is restricted for security, IP, or compliance reasons\. It also ensures comparability across architectures: encoder models expose a classifier head with direct label logits, whereas decoder LLMs expose autoregressive token distributions; allowing white\-box access would enable architecture\-specific explainers and confound cross\-family comparisons\.

To minimize variation unrelated to perturbations, we run inference deterministically whenever possible\. For perturbations and bootstrapping \(which rely on randomness\), we fix global random seeds\. For decoder LLMs, we use deterministic decoding \(e\.g\., greedy decoding / temperature0\) so that changes in explanations are attributable to input modifications rather than sampling noise\.

### 2\.2Perturbation Framework

We define a perturbation operatorπt,s:𝒳→𝒳\\pi\_\{t,s\}:\\mathcal\{X\}\\rightarrow\\mathcal\{X\}parameterized by perturbation typet∈𝒯t\\in\\mathcal\{T\}and severitys∈𝒮s\\in\\mathcal\{S\}\. Given an original inputxx, a perturbed input isx~=πt,s​\(x\)\\tilde\{x\}=\\pi\_\{t,s\}\(x\)\. We set𝒮=\{0\.05,0\.10,0\.20\}\\mathcal\{S\}=\\\{0\.05,0\.10,0\.20\\\}, controlling the fraction of positions modified for character\- and word\-level perturbations\.

We consider a taxonomy of perturbations spanning three linguistic levels\. Character\-level perturbations simulate typos and minor edit noise common in enterprise text streams such as tickets, notes, and free\-form form inputs\. The adjacent\-character swap operator exchanges two neighboring characters at randomly selected positions, while character deletion removes randomly selected characters\. For an input withCCcharacters, each character\-level operator modifies⌊s⋅C⌋\\lfloor s\\cdot C\\rfloorpositions, subject to boundary and validity constraints\.

Word\-level perturbations simulate small edits and partial rewrites\. Synonym replacement substitutes selected tokens using WordNetMiller \([1995](https://arxiv.org/html/2604.12069#bib.bib32)\); random word deletion removes selected tokens; and local word shuffling reorders words within a bounded window to reflect realistic reordering rather than a full permutation\. For an input withnnwords, each word\-level operator modifies⌊s⋅n⌋\\lfloor s\\cdot n\\rfloorwords\. For synonym replacement, we only replace tokens for which WordNet offers valid candidates and avoid substituting punctuation\-only tokens or stop words; if no suitable synonym exists, we skip that position and resample\.

Sentence\-level rewriting is implemented via back\-translation to capture paraphrases that preserve semantics while altering surface form:

πbt​\(x\)=MTde→en​\(MTen→de​\(x\)\)\.\\pi\_\{\\text\{bt\}\}\(x\)=\\mathrm\{MT\}\_\{\\text\{de\}\\rightarrow\\text\{en\}\}\\big\(\\mathrm\{MT\}\_\{\\text\{en\}\\rightarrow\\text\{de\}\}\(x\)\\big\)\.\(3\)Back\-translation operates on the entire input, and its effective severity is induced by the translation process and input length rather than a fixed fraction of tokens\.

To avoid degenerate perturbations that destroy meaning or formatting, we apply basic safeguards\. We ensure that at least one content word remains after deletion, and we preserve any fixed prompt scaffolding used for decoder\-based classification so that perturbations affect only the instance text\. For each\(t,s\)\(t,s\)configuration, we generate paired examples\(x,x~\)\(x,\\tilde\{x\}\)and keep the pairing fixed across models, enabling paired stability comparisons under identical perturbations\.

### 2\.3Occlusion\-based Explanation Method

To compare encoder and decoder architectures without relying on internals, we employ a unified Leave\-One\-Out \(LOO\) occlusion explainer that only requires repeated calls to the prediction API\. Given an inputx=\[w1,…,wn\]x=\[w\_\{1\},\\ldots,w\_\{n\}\]withnnwords, we first compute the model’s predictiony^​\(x\)\\hat\{y\}\(x\)\. For each wordwiw\_\{i\}, we create an occluded inputx−ix\_\{\-i\}by removingwiw\_\{i\}while keeping all other words unchanged, then query the model again\. We define the importance score ofwiw\_\{i\}as the change in confidence for the originally predicted class:

Imp​\(wi;x\)=P​\(y^​\(x\)∣x\)−P​\(y^​\(x\)∣x−i\)\.\\mathrm\{Imp\}\(w\_\{i\};x\)=P\(\\hat\{y\}\(x\)\\mid x\)\-P\(\\hat\{y\}\(x\)\\mid x\_\{\-i\}\)\.\(4\)Words with largerImp​\(wi;x\)\\mathrm\{Imp\}\(w\_\{i\};x\)are deemed more influential for the model’s decision, and the explanation is the ranked list of words by importance\. This formulation is consistent across architectures and aligns with user\-facing interfaces that highlight a small set of salient tokens\.

For encoder models \(BERT, RoBERTa\),P​\(y∣x\)P\(y\\mid x\)is obtained directly from the softmax over the classification head logits\. For decoder LLMs \(Qwen, Llama\), we cast classification as instruction following and extract label probabilities from the next\-token distribution under a fixed prompt\. Concretely, for each classyky\_\{k\}we specify a canonical label token \(or short string\) and computeP​\(yk∣x\)P\(y\_\{k\}\\mid x\)from the model’s normalized probabilities over the label set\. If a class label maps to multiple tokens, we use a consistent aggregation rule \(e\.g\., sum of sequence log\-probabilities\) across all experiments\. The same prompting and probability extraction procedure is used for both original and perturbed inputs, ensuring that differences in explanation stability arise from model behavior rather than from changes in the explanation mechanism\.

This explainer has a computational cost proportional to input length, requiring\(n\+1\)\(n\+1\)queries per instance\. While this may be too expensive for always\-on production explanations, it is well suited for pre\-deployment validation and for selective auditing workflows, where a robust assessment of explanation stability is required under black\-box access\.

### 2\.4Evaluation Metrics

Our primary robustness metric is the Flip Rate \(FR\), which measures how often the most important word changes after perturbation\. Letx~i=πt,s​\(xi\)\\tilde\{x\}\_\{i\}=\\pi\_\{t,s\}\(x\_\{i\}\)denote the perturbed version ofxix\_\{i\}\. Let

top1​\(x\)=arg⁡maxj∈\{1,…,n\}⁡Imp​\(wj;x\)\\mathrm\{top\}\_\{1\}\(x\)=\\arg\\max\_\{j\\in\\\{1,\\ldots,n\\\}\}\\mathrm\{Imp\}\(w\_\{j\};x\)\(5\)denote the top word selected by LOO importance on inputxx\. For a dataset𝒟=\{xi\}i=1N\\mathcal\{D\}=\\\{x\_\{i\}\\\}\_\{i=1\}^\{N\}, we define

FRt,s​\(M,𝒟\)=1N​∑i=1N𝟏​\[top1​\(xi\)≠top1​\(x~i\)\]\.\\mathrm\{FR\}\_\{t,s\}\(M,\\mathcal\{D\}\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\!\\left\[\\mathrm\{top\}\_\{1\}\(x\_\{i\}\)\\neq\\mathrm\{top\}\_\{1\}\(\\tilde\{x\}\_\{i\}\)\\right\]\.\(6\)Lower FR indicates more stable explanations\. We focus on the top\-1 word because it corresponds to the most salient element in common explanation UIs and offers a simple, auditable stability signal for pre\-deployment decision\-making\. When multiple words tie for maximum importance, we break ties deterministically \(e\.g\., leftmost occurrence\) to avoid inflating instability due to arbitrary ordering\.

We report uncertainty using paired bootstrap resamplingDeYounget al\.\([2020](https://arxiv.org/html/2604.12069#bib.bib21)\)\. Specifically, for each\(t,s\)\(t,s\)we resample paired instances\(xi,x~i\)\(x\_\{i\},\\tilde\{x\}\_\{i\}\)with replacement for 10,000 iterations, recomputeFRt,s\\mathrm\{FR\}\_\{t,s\}on each bootstrap sample, and report 95% confidence intervals\. This paired procedure preserves the coupling between original and perturbed inputs and provides statistically grounded comparisons across models under identical perturbations\.

### 2\.5Stability Controls and Metrics

To ensure our findings are not an artifact of the Top\-1 metric’s coarseness, we introduce Top\-5 Overlap, measuring the Jaccard similarity between the sets of the five most influential tokens\. Furthermore, we define a Conditioned Flip Rate \(Pred\-Consist\. FR\), which evaluates explanation stability specifically on the subset of samples where the model’s predicted labely^\\hat\{y\}remains unchanged after perturbation\. This isolates architectural explanation consistency from general predictive robustness, ensuring the results reflect the stability of the rationale itself rather than a downstream effect of prediction errors\.

## 3Results

### 3\.1Experimental Setup

ModelsWe evaluate six models \(Table[1](https://arxiv.org/html/2604.12069#S3.T1)\): BERT\-base and RoBERTa\-baseDevlinet al\.\([2019](https://arxiv.org/html/2604.12069#bib.bib2)\); Liuet al\.\([2019](https://arxiv.org/html/2604.12069#bib.bib3)\)as widely\-deployed encoder baselines, and Qwen\-2\.5Yanget al\.\([2024](https://arxiv.org/html/2604.12069#bib.bib38)\)and Llama\-3\.1Grattafioriet al\.\([2024](https://arxiv.org/html/2604.12069#bib.bib36)\)at two scales each to study both cross\-architecture and scaling effects\. Decoder models are accessed through Ollama, simulating API\-based production serving; encoders use HuggingFace Transformers\.

TypeModelParamsAccessEncoderBERT\-base110MHuggingFaceEncoderRoBERTa\-base125MHuggingFaceDecoderQwen\-2\.57BOllamaDecoderLlama\-3\.18BOllamaDecoderQwen\-2\.514BOllamaDecoderLlama\-3\.170BOllamaTable 1:Models evaluated in our study\. Decoder models include both small \(7\-8B\) and large \(14\-70B\) variants to enable both cross\-architecture comparison and scaling analysis\.DatasetsWe evaluate on three benchmarks spanning different text lengths: SST\-2Socheret al\.\([2013](https://arxiv.org/html/2604.12069#bib.bib29)\)\(short sentiment snippets\), AG NewsZhanget al\.\([2015](https://arxiv.org/html/2604.12069#bib.bib31)\)\(medium\-length 4\-class topic classification\), and IMDBMaaset al\.\([2011](https://arxiv.org/html/2604.12069#bib.bib30)\)\(full\-length sentiment reviews\)\. This covers the range of text characteristics encountered in production classification systems\.

For each of 18 model\-dataset combinations, we sample 200 test examples and apply all 18 perturbation configurations, yielding 3,600 cases per pair and 64,800 total evaluations\. Fixed random seeds ensure reproducibility\.

### 3\.2Main Results: Encoder vs\. Decoder

Table[2](https://arxiv.org/html/2604.12069#S3.T2)presents our core finding: decoder models produce significantly more stable explanations than encoders\. Encoders \(BERT, RoBERTa\) exhibit average flip rates of 0\.475 and 0\.465, meaning nearly half of all samples have their top explanation word change after perturbation\. Even the smallest decoder \(Qwen 7B\) reaches 0\.147—less than one\-third of the encoder average\.

Table 2:Flip Rate across models and datasets \(lower = more stable\)\. Decoder models consistently outperform encoders\.Overall, encoders average FR = 0\.470 vs\. decoders at 0\.125—a73\.4% relative improvementconsistent across SST\-2 \(61%\), AG News \(83%\), and IMDB \(74%\)\. The IMDB dataset shows the largest encoder flip rates \(0\.590–0\.607\), while decoders remain stable, suggesting encoder explanations degrade on longer texts where bidirectional attention distributes importance across more tokens\. Figure[2](https://arxiv.org/html/2604.12069#S3.F2)visualizes this gap\.

![Refer to caption](https://arxiv.org/html/2604.12069v4/x2.png)Figure 2:Flip rate comparison across models and datasets\. Encoder models \(BERT, RoBERTa\) exhibit significantly higher flip rates than decoder models, with the gap most pronounced on IMDB \(longer texts\)\. The 73% improvement represents the average reduction in flip rate when moving from encoders to decoders\.Encoder flip rates near 0\.47 imply that routine edits to an enterprise record can frequently change the highlighted “reason,” weakening auditability, whereas decoder LLMs reduce this instability to a level compatible with consistent decision narratives—an advantage that grows with longer inputs typical of HR and finance records\.

### 3\.3Scaling and Perturbation Analysis

Explanation stability scales with model size: 7\-8B decoders average FR = 0\.149, Qwen 14B reaches 0\.119, and Llama 70B achieves 0\.083—a44% improvementfrom 7B to 70B \(Figure[3](https://arxiv.org/html/2604.12069#S3.F3)\)\. This parallels capability scaling lawsKaplanet al\.\([2020](https://arxiv.org/html/2604.12069#bib.bib8)\), extending them to the explanation domain\. The effect is strongest on AG News, where Llama 70B achieves FR = 0\.031 \(only 3% of samples flip\)\. At matched scale, Qwen 7B \(FR = 0\.147\) and Llama 8B \(FR = 0\.150\) differ by less than 2%, suggesting the pattern is consistent across training pipelines at a given size; we discuss the architecture\-vs\-scale confound in the Limitations section\.

![Refer to caption](https://arxiv.org/html/2604.12069v4/x3.png)Figure 3:Explanation stability improves with model scale\. Both Qwen and Llama families show consistent downward trends in flip rate, with 44% improvement from 7B to 70B\.Breaking down by perturbation type reveals that the decoder advantage is largest on destructive perturbations: word deletion causes encoder FR to spike to 0\.834 vs\. decoder 0\.198 \(76% improvement\), and word shuffling shows 0\.692 vs\. 0\.221 \(68%\)\. Character\-level perturbations yield 72–74% improvement\. In contrast, semantic\-preserving perturbations \(synonym replacement, back\-translation\) produce low flip rates for both architectures \(encoder 0\.027–0\.030, decoder 0\.021–0\.022\), with modest 22–27% decoder improvement\. This indicates that decoder explanations are particularly robust to noisy, incomplete, or reordered inputs—the conditions most common in production deployments with user\-generated content\.

### 3\.4Stability Controls and Confidence Artifacts

A primary concern in black\-box evaluation is whether explanation stability is merely a proxy for prediction stability or an artifact of "peaked" model confidence\. To isolate this, we re\-analyzed all 64,800 cases by filtering samples where the predicted label remained unchanged after perturbation\.

As shown in Table[3](https://arxiv.org/html/2604.12069#S3.T3), the encoder\-decoder gap persists: encoder instability remains near0\.470\.47even when the prediction is constant, whereas decoders exhibit significantly lower flip rates \(0\.0750\.075–0\.1330\.133\)\. This confirms that the observed instability is a fundamental property of the attribution surface rather than a downstream effect of label flips\. Furthermore, we report 95% bootstrap confidence intervals in Table[3](https://arxiv.org/html/2604.12069#S3.T3), confirming that all architecture\-scale differences are statistically significant \(p<0\.05p<0\.05\)\. Representative per\-dataset CIs are: BERT/IMDB \[0\.574, 0\.607\], Qwen 7B/IMDB \[0\.156, 0\.180\], and Llama 70B/AG News \[0\.026, 0\.037\]; encoder and decoder intervals do not overlap on any \(model, dataset\) pair tested\.

Table 3:Control analysis across all datasets\. “Pred\-Consist\. FR” measures stability only on instances where the model’s prediction was identical post\-perturbation\.
### 3\.5Metric and Explainer Invariance

To ensure our findings are not sensitive to the coarseness of the Top\-1 metric, we evaluatedTop\-5 Overlap\(Jaccard similarity\)\. As shown in Table[4](https://arxiv.org/html/2604.12069#S3.T4), decoder LLMs maintain significantly higher similarity \(0\.850\.85–0\.890\.89\) compared to encoders \(0\.600\.60–0\.610\.61\), indicating that the broader explanation neighborhood is more robust in decoders\.

Table 4:Top\-5 Overlap results\. Decoder explanations remain consistent beyond the single top\-ranked token\.We further verified if these trends are specific to the occlusion method by conducting a paired comparison withLIMEon the BERT/SST\-2 subset\. As in Table[5](https://arxiv.org/html/2604.12069#S3.T5), LIME was even less stable than LOO, suggesting that encoder instability is an inherent property of the architecture’s sensitivity to input variation, not an artifact of the explainer choice\.

Table 5:Paired LIME vs\. LOO comparison on a 180\-instance BERT/SST\-2 subset under perturbation\. Both explainers produce high flip rates, indicating that encoder instability is not specific to LOO; absolute values exceed those in Table[2](https://arxiv.org/html/2604.12069#S3.T2)because this subset is restricted to the explainer\-comparison setting rather than the full perturbation grid\.
### 3\.6The Inconsistency Paradox in Enterprise Deployment

Finally, we analyzed the relationship between predictive robustness and explanatory stability\. As shown in Table[6](https://arxiv.org/html/2604.12069#S3.T6), encoder models exhibit remarkably high label consistency under noise, yet their explanations flip in nearly half of those cases\.

Table 6:Prediction consistency \(accuracy stability\) under perturbation\. Encoders are highly consistent in label, but inconsistent in rationale\.This reveals anInconsistency Paradox: a model can be robust in its final label while being highly unstable in its reasoning\. In our application to HR triage and financial compliance screening, this failure mode proved critical\. While encoders met accuracy thresholds, their rationales were flagged by auditors because correcting a typo significantly altered the "reason" provided for risk flags\. This emphasizes why transitioning to larger decoder models is often a governance requirement for regulatory alignment, as they provide the rationale consistency that encoders lack\.

## 4Deployment Insights

### 4\.1Three\-Tier Decision Framework

Pre\-deployment model selection in enterprise NLP rarely optimizes a single objective\. In practice, teams must balance explanation stability \(for governance and user trust\), predictive quality, latency, and monetary cost under black\-box serving constraints\. Our empirical results show a clear separation in explanation stability between encoder models and decoder LLMs \(Table[2](https://arxiv.org/html/2604.12069#S3.T2)\), and a strong scale effect among decoders \(Figure[3](https://arxiv.org/html/2604.12069#S3.F3)\)\. We translate these findings into a simple three\-tier decision framework \(Table[7](https://arxiv.org/html/2604.12069#S4.T7)\) that maps stability requirements to model classes and supports operational choices in finance/HR\-style enterprise workflows\.

Tiers are defined by average Flip Rate \(FR\)\. The cost multiplier is\(n¯\+1\)×\(\\bar\{n\}\+1\)\\timesthe per\-call inference cost relative to BERT\-base, wheren¯\\bar\{n\}is the average input length in words; this accounts for then¯\+1\\bar\{n\}\+1queries required by LOO explanation generation plus the per\-call cost gap across model families\.

Table 7:Three\-tier deployment framework\. Cost is relative to BERT\-base\. FR = Flip Rate\.
### 4\.2Regulatory Law Impacts

Under the EU AI ActEuropean Parliament and Council \([2024](https://arxiv.org/html/2604.12069#bib.bib33)\), high\-risk AI systems must provide explanations that are consistent and auditable\. Our results show that encoder\-based explanations change in nearly half of all cases under minor input variation \(FR = 0\.470\), which may not satisfy consistency requirements\. Organizations subject to algorithmic auditing—in financial services, healthcare, or legal domains—should prefer decoder models, where 7\-8B variants offer a 70%\+ stability improvement at manageable cost, and 70B variants provide the highest consistency for the most demanding audit requirements\. Figure[4](https://arxiv.org/html/2604.12069#S4.F4)visualizes this cost\-stability trade\-off across all six models\.

![Refer to caption](https://arxiv.org/html/2604.12069v4/x4.png)Figure 4:Deployment trade\-off: model scale vs\. explanation stability\. Shaded bands indicate three deployment tiers\. Arrows show 73% improvement \(encoder→\\rightarrowdecoder\) and 44% improvement \(7B→\\rightarrow70B\)\.

## 5Conclusion

Validating explanation behavior under black\-box serving and noisy, user\-generated inputs is hard, yet enterprise NLP systems increasingly rely on explanations for governance and user trust\. We address this with a unified black\-box protocol that evaluates token\-level explanation robustness via occlusion under realistic perturbations\. Across 64,800 cases on three datasets, decoder LLMs \(7B–70B\) produce markedly more stable explanations than the encoder baselines we test \(110M–125M\)—73\.4% lower flip rates on average, with a further 44% gain from 7B to 70B\. These results motivate a three\-tier deployment framework and establish explanation robustness as a first\-class criterion for selecting trustworthy enterprise NLP systems\.

## Limitations

Our study has several limitations\. First, the encoder–decoder comparison does not fully isolate architecture from scale: the decoders we evaluate are orders of magnitude larger than the encoder baselines, and a clean separation would require smaller decoders or larger encoders\. Second, top\-token flip rate captures explanation*stability*rather than*faithfulness*, so a model can be stable yet stably misleading; robustness should therefore complement, not replace, faithfulness analysis before rationales are used in high\-stakes decisions\. Third, we focus on text classification because token\-level rationales align with common audit interfaces, but extraction, ranking, summarization, and open\-ended generation may exhibit different stability patterns\.

## Ethics Statement

This study uses publicly available benchmark datasets \(SST\-2, AG News, IMDB\) and open\-weight models, raising no data privacy concerns\. However, we note that explanation stability does not guarantee explanation correctness\. A model may produce consistent yet misleading explanations, so practitioners should not treat robustness as a proxy for faithfulness\. Our deployment recommendations favor larger decoder models, which carry higher computational and environmental costs\. Organizations should weigh these costs against their specific regulatory needs rather than defaulting to the largest available model\. Finally, while our three\-tier framework provides quantitative guidance, real\-world deployment decisions should also incorporate domain\-specific validation, human evaluation, and ongoing quality monitoring\.

## References

- S\. Ackerman, E\. Rabinovich, E\. Farchi, and A\. Anaby Tavor \(2024\)A novel metric for measuring the robustness of large language models in non\-adversarial scenarios\.InFindings of EMNLP,pp\. 2794–2802\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- D\. Alvarez\-Melis and T\. S\. Jaakkola \(2018\)Towards robust interpretability with self\-explaining neural networks\.InAdvances in Neural Information Processing Systems,Vol\.31\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- P\. Atanasova, O\. Camburu, C\. Lioma, T\. Lukasiewicz, J\. G\. Simonsen, and I\. Augenstein \(2023\)Faithfulness tests for natural language explanations\.InProceedings of ACL,pp\. 11893–11908\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- J\. Bai, S\. Bai, Y\. Chu, Z\. Cui, K\. Dang, X\. Deng, Y\. Fan, W\. Ge, Y\. Han, F\. Huang,et al\.\(2023\)Qwen technical report\.arXiv preprint arXiv:2309\.16609\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1)\.
- T\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. D\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell,et al\.\(2020\)Language models are few\-shot learners\.Advances in Neural Information Processing Systems33,pp\. 1877–1901\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1)\.
- J\. Devlin, M\. Chang, K\. Lee, and K\. Toutanova \(2019\)BERT: pre\-training of deep bidirectional transformers for language understanding\.InProceedings of NAACL\-HLT,pp\. 4171–4186\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1),[§3\.1](https://arxiv.org/html/2604.12069#S3.SS1.p1.1)\.
- J\. DeYoung, S\. Jain, N\. F\. Rajani, E\. Lehman, C\. Xiong, R\. Socher, and B\. C\. Wallace \(2020\)ERASER: a benchmark to evaluate rationalized NLP models\.InProceedings of ACL,pp\. 4443–4458\.Cited by:[§2\.4](https://arxiv.org/html/2604.12069#S2.SS4.p2.3)\.
- J\. Edin, A\. G\. Motzfeldt, C\. L\. Christensen, T\. Ruotsalo, L\. Maaloe, and M\. Maistro \(2025\)Normalized AOPC: fixing misleading faithfulness metrics for feature attribution explainability\.InProceedings of ACL,Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- European Parliament and Council \(2024\)Regulation \(EU\) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence \(AI Act\)\.Note:Official Journal of the European UnionCited by:[§4\.2](https://arxiv.org/html/2604.12069#S4.SS2.p1.1)\.
- A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle,et al\.\(2024\)The Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1),[§3\.1](https://arxiv.org/html/2604.12069#S3.SS1.p1.1)\.
- D\. Jin, Z\. Jin, J\. T\. Zhou, and P\. Szolovits \(2020\)Is BERT really robust? a strong baseline for natural language attack on text classification and entailment\.InProceedings of AAAI,Vol\.34,pp\. 8018–8025\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- J\. Kaplan, S\. McCandlish, T\. Henighan, T\. B\. Brown, B\. Chess, R\. Child, S\. Gray, A\. Radford, J\. Wu, and D\. Amodei \(2020\)Scaling laws for neural language models\.arXiv preprint arXiv:2001\.08361\.Cited by:[§3\.3](https://arxiv.org/html/2604.12069#S3.SS3.p1.1)\.
- Y\. Liu, M\. Ott, N\. Goyal, J\. Du, M\. Joshi, D\. Chen, O\. Levy, M\. Lewis, L\. Zettlemoyer, and V\. Stoyanov \(2019\)RoBERTa: a robustly optimized BERT pretraining approach\.arXiv preprint arXiv:1907\.11692\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1),[§3\.1](https://arxiv.org/html/2604.12069#S3.SS1.p1.1)\.
- S\. M\. Lundberg and S\. Lee \(2017\)A unified approach to interpreting model predictions\.InAdvances in Neural Information Processing Systems,Vol\.30\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- Q\. Lyu, M\. Tan, H\. Xie, K\. Pei, H\. Su, Y\. Bai, X\. Chen, J\. Gao, and L\. Fang \(2024\)Towards faithful model explanation in NLP: a survey\.Computational Linguistics50\(2\),pp\. 657–723\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- A\. L\. Maas, R\. E\. Daly, P\. T\. Pham, D\. Huang, A\. Y\. Ng, and C\. Potts \(2011\)Learning word vectors for sentiment analysis\.InProceedings of ACL,pp\. 142–150\.Cited by:[§3\.1](https://arxiv.org/html/2604.12069#S3.SS1.p2.1)\.
- G\. A\. Miller \(1995\)WordNet: a lexical database for English\.Communications of the ACM38\(11\),pp\. 39–41\.Cited by:[§2\.2](https://arxiv.org/html/2604.12069#S2.SS2.p3.2)\.
- J\. Morris, E\. Lifland, J\. Y\. Yoo, J\. Grigsby, D\. Jin, and Y\. Qi \(2020\)TextAttack: a framework for adversarial attacks, data augmentation, and adversarial training in NLP\.InProceedings of EMNLP: System Demonstrations,pp\. 119–126\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- M\. T\. Ribeiro, S\. Singh, and C\. Guestrin \(2016\)“Why should I trust you?”: explaining the predictions of any classifier\.InProceedings of KDD,pp\. 1135–1144\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- R\. Socher, A\. Perelygin, J\. Wu, J\. Chuang, C\. D\. Manning, A\. Ng, and C\. Potts \(2013\)Recursive deep models for semantic compositionality over a sentiment treebank\.InProceedings of EMNLP,pp\. 1631–1642\.Cited by:[§3\.1](https://arxiv.org/html/2604.12069#S3.SS1.p2.1)\.
- M\. Sundararajan, A\. Taly, and Q\. Yan \(2017\)Axiomatic attribution for deep networks\.InInternational Conference on Machine Learning,pp\. 3319–3328\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- H\. Touvron, T\. Lavril, G\. Izacard, X\. Martinet, M\. Lachaux, T\. Lacroix, B\. Rozière, N\. Goyal, E\. Hambro, F\. Azhar,et al\.\(2023\)LLaMA: open and efficient foundation language models\.arXiv preprint arXiv:2302\.13971\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1)\.
- A\. Vaswani, N\. Shazeer, N\. Parmar, J\. Uszkoreit, L\. Jones, A\. N\. Gomez, Ł\. Kaiser, and I\. Polosukhin \(2017\)Attention is all you need\.InAdvances in Neural Information Processing Systems,Vol\.30\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.
- J\. Wei, M\. Bosma, V\. Y\. Zhao, K\. Guu, A\. W\. Yu, B\. Lester, N\. Du, A\. M\. Dai, and Q\. V\. Le \(2022\)Finetuned language models are zero\-shot learners\.arXiv preprint arXiv:2109\.01652\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1)\.
- A\. Yang, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Li, D\. Liu, F\. Huang,et al\.\(2024\)Qwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p1.1),[§3\.1](https://arxiv.org/html/2604.12069#S3.SS1.p1.1)\.
- X\. Zhang, J\. Zhao, and Y\. LeCun \(2015\)Character\-level convolutional networks for text classification\.InAdvances in Neural Information Processing Systems,Vol\.28\.Cited by:[§3\.1](https://arxiv.org/html/2604.12069#S3.SS1.p2.1)\.
- Y\. Zhang, C\. Wang, Y\. Chen, C\. Fan, J\. Jia, and S\. Liu \(2025\)The fragile truth of saliency: improving LLM input attribution via attention bias optimization\.InAdvances in Neural Information Processing Systems,Vol\.38\.Cited by:[§1](https://arxiv.org/html/2604.12069#S1.p3.1)\.