Xai Whitebox Eval

xai-whitebox-eval

A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security — Arreche et al. (2025) (arXiv:2501.07801, 2025)

What this evaluates

Evaluates the reliability and operational suitability of white-box explainable AI methods (DeepLift, Integrated Gradients, LRP) when applied to deep neural network-based intrusion detection systems. It probes how well these methods preserve model accuracy, maintain consistency under repeated runs, resist adversarial noise, and compute efficiently across real-world network traffic datasets.

Datasets

• NSL-KDD — total ?; splits: train (-1), test (-1)
• RoEduNet-SIMARGL2021 — total ?; splits: (unstated)
• CICIDS-2017 — total ?; splits: (unstated)

Metrics

• descriptive accuracy (primary) — range: [0, 1]
  • Measures the drop in model classification accuracy as the top-k most important features are iteratively removed from the input. Evaluated at k=0, 10, 20, 40, 80.
• sparsity — range: [0, 1]
  • Quantifies how concentrated the feature importance scores are, indicating whether the explanation relies on a small subset of features.
• stability — range: [0, 1]
  • Calculates the overlap ratio of the top-ranked features when explanations are generated multiple times (3 runs in this study). Top 5 or 20 features considered depending on dataset dimensionality.
• robustness — range: [0, 1]
  • Assesses the consistency of feature importance scores when the input sample is subjected to adversarial noise or perturbation.
• efficiency — range: other
  • Measures the wall-clock computational time required to generate explanations across varying sample sizes.
• completeness — range: [0, 1]
  • Verifies if perturbing the most important features causes the model's prediction to change, confirming the explanation aligns with model behavior.

Input / output format

Input: Tabular network traffic flow features (e.g., packet counts, durations, protocol flags) representing normal and malicious traffic instances.

Output: Ranked list of input features with corresponding importance/relevance scores (global explanations) or per-instance feature attributions (local explanations).

Scoring recipe

def evaluate_xai(model, xai_method, X, y):
    scores = xai_method.explain(X)
    # Descriptive Accuracy
    acc = [accuracy(model, mask_top_k(X, scores, k)) for k in [0,10,20,40,80]]
    # Stability
    top_feats = [get_top_k(scores, k=20) for _ in range(3)]
    stability = set_intersection(top_feats)
    # Robustness
    robust = [similarity(xai_method.explain(x), xai_method.explain(perturb(x))) for x in X]
    # Efficiency
    eff = measure_time(xai_method.explain, X)
    # Completeness
    complete = any(model.predict(x) != model.predict(perturb_top(x, scores, k=2)) for x in X)
    return acc, sparsity(scores), stability, robust, eff, complete

Common pitfalls

• Assuming white-box XAI methods are inherently complete without empirical verification via feature perturbation.
• Using a fixed top-k feature removal count across datasets with vastly different feature dimensions without normalization.
• Evaluating stability based on a single explanation run rather than multiple independent generations to capture variance.

Evidence (verbatim from paper)

For the descriptive accuracy experiment, we removed the top-k features at each iteration. For Stability, the explanations are generated as well, but it is generated a p number of times, three times for this paper’s experiments for stability, and then we evaluated how many of the top features overlap. Robustness is examined under a modified version of [[26]] to run with DNN, and it is done locally to evaluate the resistance of the XAI technique when facing a perturbation attack many times. Completeness deals with perturbing only the top two features in small increments to check if the explanation can be changed.

Citation

@misc{arreche2025xaiwhitebox,
  title={A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security},
  author={Arreche et al. (2025)},
  year={2025},
  note={arXiv:2501.07801}
}

• arXiv: 2501.07801