Critical-Tensor Identification in ViTaX

• Critical-tensor identification is a formal XAI-based feature selection technique that isolates minimal input feature subsets to guarantee targeted robustness in neural networks.
• The method utilizes gradient-based heuristic ranking and binary search to efficiently determine the smallest set of features satisfying targeted ε-robustness.
• Empirical results on MNIST and GTSRB highlight its interpretability and formal verification, enhancing safety in high-stakes applications.

Critical-tensor identification is a formal XAI-based feature selection technique introduced in the ViTaX (Verified and Targeted Explanations) framework. It targets the identification of minimal input feature subsets (critical tensors) that are most sensitive to class transitions within deep neural networks, and provides mathematical guarantees about the model’s resilience to perturbations directed toward user-specified alternative classes. In contrast to traditional attribution methods, which lack formal robustness assurances, and generic formal methods, which are untargeted, this approach enables verifiable, targeted, and succinct explanations for high-stakes, safety-critical applications (Wang et al., 5 Apr 2026).

1. Definition of Critical Tensor

In the ViTaX setting, given an input tensor $x\in\mathbb{R}^{w\times h\times c}$ and a neural classifier $f$, a critical tensor $A\subseteq\{1,\ldots,n\}$ (with $n=w\cdot h\cdot c$) is defined as the smallest set of input feature indices such that perturbing $x_A$ by no more than $\varepsilon$ (in a chosen $\ell_p$ norm) cannot flip the classifier's output from a true class $y$ to a specified critical alternative class $t$. Formally, PRESERVED_PLACEHOLDER_^^^^4^^^^ denotes the restriction of the input to indices in $f$0. The identification of a critical tensor provides a succinct semifactual explanation: even if the features indexed by $f$1 are perturbed maximally within $f$2, the classifier remains robust to the transition from $f$3 to $f$4.

This concept is particularly relevant in domains where different misclassifications pose differing levels of risk. For example, in traffic sign recognition, confusing a "Stop" sign with a "60 kph" sign is substantially more detrimental than with a "No Passing" sign. Critical tensors focus the explanation on the most consequential potential failure modes (Wang et al., 5 Apr 2026).

2. Targeted $f$5-Robustness Specification

Standard robustness verification assesses whether no class logit interval can overlap with the true class under arbitrary $f$6-bounded input perturbations. In contrast, ViTaX formulates Targeted $f$7-Robustness with respect to a specific alternative class $f$8, formalized as follows:

Let $f$^^^^4^^^^ be a neural network, $A\subseteq\{1,\ldots,n\}$0 the input, $A\subseteq\{1,\ldots,n\}$1 the true class, and $A\subseteq\{1,\ldots,n\}$2 the user-specified alternative. Consider perturbing features in $A\subseteq\{1,\ldots,n\}$3 such that $A\subseteq\{1,\ldots,n\}$4 while $A\subseteq\{1,\ldots,n\}$5. Let $A\subseteq\{1,\ldots,n\}$6 denote all such perturbed inputs, with $A\subseteq\{1,\ldots,n\}$7 the full index set.

A feature subset $A\subseteq\{1,\ldots,n\}$8 is said to satisfy T-ROB (Targeted Robustness) if the following holds:

$A\subseteq\{1,\ldots,n\}$^^^^4^^^^

where $n=w\cdot h\cdot c$0 are the interval bounds on output logit $n=w\cdot h\cdot c$1 under the set $n=w\cdot h\cdot c$2. If T-ROB holds, the class transition $n=w\cdot h\cdot c$3 is formally impossible under $n=w\cdot h\cdot c$4-bounded perturbations to features in $n=w\cdot h\cdot c$5 (Wang et al., 5 Apr 2026).

3. Algorithm for Critical Tensor Identification

ViTaX operationalizes critical-tensor selection via an efficient algorithm, leveraging feature-sensitivity heuristics and binary search. The principle steps are:

1. Heuristic Ranking ($n=w\cdot h\cdot c$6): Compute $n=w\cdot h\cdot c$7 by ranking features according to the gradient-based sensitivity to the target class $n=w\cdot h\cdot c$8, i.e., using $n=w\cdot h\cdot c$^^^^4^^^^ for each feature $x_A$0.
2. Binary Search for Minimality: Iteratively select increasing prefixes of the ranked features and verify T-ROB via a formal reachability solver $x_A$1. The candidate set $x_A$2 is the smallest prefix satisfying T-ROB.
3. Formal Verification: At each binary search iteration, call the solver $x_A$3 to check whether, for the selected $x_A$4, the network is robust to the $x_A$5 transition under the specified perturbation.

The algorithm returns a provably minimal (under ranking $x_A$6) critical tensor $x_A$7. The complexity of the process is logarithmic in the number of features due to the binary search strategy.

ViTaX Pseudocode (Algorithm 1):

$y$0 The reachability solver $x_A$8 (e.g., Star-based reachability, MILP) certifies the required specification over infinite input sets $x_A$^^^^4^^^^ (Wang et al., 5 Apr 2026).

4. Formal Guarantees and Properties

ViTaX's critical-tensor identification is underpinned by theoretical guarantees assuming the reachability solver is sound and complete and the ranking is sensitivity-optimal:

• Soundness: If $\varepsilon$0 certifies T-ROB for $\varepsilon$1, then $\varepsilon$2 truly holds for all $\varepsilon$3, meaning the $\varepsilon$4 transition is impossible under such perturbations.
• Maximality (w.r.t. $\varepsilon$5): $\varepsilon$6 is the largest (minimal in cardinality) prefix of $\varepsilon$7 such that the T-ROB criterion holds; supersets of $\varepsilon$8 (w.r.t. the ranking) will violate T-ROB.
• Algorithmic Complexity: $\varepsilon$^^^^4^^^^ calls to the reachability solver due to binary search.

These properties ensure that the returned critical tensor $\ell_p$0 is both succinct and verifiably robust with respect to the $\ell_p$1 transition (Wang et al., 5 Apr 2026).

5. Empirical Examples and Size–Fidelity Trade-Off

ViTaX demonstrates practical critical-tensor identification on several datasets:

MNIST Example:

• Input: "4" ($\ell_p$2); Target: "^^^^4^^^^" ($\ell_p$3).
• Ranking identifies pixels critical for the "4→^^^^4^^^^" decision (e.g., pixels in the upper-loop of "4").
• Binary search yields a critical tensor $\ell_p$4 of 5 pixels. Larger $\ell_p$5 subsets increase robustness but decrease interpretability, defining a size–fidelity trade-off.
• Practitioners can explore $\ell_p$6 vs. $\ell_p$7 curves to balance explanation succinctness against guarantee strength.

GTSRB Example:

• Input: "Stop" sign ($\ell_p$8); Target: "60 kph" ($\ell_p$^^^^4^^^^).
• ViTaX selects 30 interior pixels (out of 3072) critical for the "Stop→60 kph" misclassification, with higher fidelity and lower cardinality than the 472-pixel baseline from VeriX.

This suggests that ViTaX explanations are both more interpretable and more faithful to the underlying risk structure than previous methods (Wang et al., 5 Apr 2026).

6. Scope of Applicability and Generalizations

ViTaX and its critical-tensor approach are network-architecture and modality agnostic, supporting:

• Architectures: MLPs, CNNs, ResNets, Inception, Transformers, contingent upon an appropriate reachability backend (e.g., Approx-Star, CP-Star, MILP).
• Input Modalities: Images, time series, textual embeddings, audio spectrograms, and graph features, with critical tensor selection performed on the flattened feature set.
• Beyond Classification: Adaptation to regression, ranked retrieval, or multi-label tasks by tuning the T-ROB specification to ensure robust margin (e.g., minimal lower-bound difference between outputs).
• Higher-Order Explanations: Chaining calls to the algorithm with varying target classes or perturbation budgets allows coverage of trade-offs and Pareto-optimal robustness sets.

A plausible implication is that critical-tensor identification via ViTaX serves as a general tool for providing semifactual, formally verified, high-fidelity explanations across a spectrum of ML applications, particularly where targeted safety guarantees are required (Wang et al., 5 Apr 2026).