---
title: Explanatory Robustness (ER)
url: https://www.emergentmind.com/topics/explanatory-robustness-er
type: topic
---

# Explanatory Robustness (ER)

Searching arXiv for recent papers on explanatory robustness and related XAI robustness definitions.
arxiv_search(query="explanatory robustness XAI robustness of explanations feature importances reliability explanations", max_results=10, sort_by="relevance")
Reviewing the most relevant arXiv results to ground the article in published work.
arxiv_search(query="robust explanations XAI feature attribution stability explanation reliability arXiv", max_results=10, sort_by="lastUpdatedDate")
Explanatory Robustness (ER) denotes a family of criteria for assessing whether explanations remain stable, discriminative, and trustworthy when inputs, representations, models, or deployment conditions change in ways that should not materially alter what is being explained. One explicit definition characterizes robustness as “the ability of an explanator (i.e. any explainability technique) to produce similar explanations for similar inputs” [2406.14349]. Another formalization defines ER across methods: different XAI methods with the same explanatory goal should produce sufficiently similar explanations for the same model or input, and sufficiently different explanations for different models or inputs [2508.12623]. Recent work instantiates ER for feature-importance vectors, feature rankings, formal explanations, recommender-system explanations, LLM-generated natural-language explanations, and explanation reliability under realistic deployment changes [2306.03048][2405.01855][2601.19120][2602.05082]. This suggests that ER is not a single metric but a broader evaluative category whose exact meaning depends on the explanation object and perturbation model.

## 1. Core meanings of explanatory robustness

A central distinction in the literature is between robustness of predictions and robustness of explanations. In feature-attribution settings, model robustness concerns whether predictions remain stable under perturbations, whereas explanation robustness concerns whether feature attributions or their induced rankings remain stable under perturbations that preserve the prediction [2406.14349]. The same distinction is made in recommendation settings for LLM explanation agents: the recommended item can be held fixed while the robustness target is the natural-language explanation of why that item is recommended [2601.19120].

A second distinction is between within-method and across-method robustness. “How can we trust opaque systems? Criteria for robust explanations in XAI” argues that ER, strictly speaking, is robustness across different XAI methods, while Explanation Method Robustness (EMR) is robustness within a single method [2508.12623]. In that framework, ER requires cross-method agreement on the same case and appropriate disagreement on different cases; EMR requires a single method to yield similar explanations for similar cases and distinct explanations for distinct cases. The paper also argues that EMR is a prior requirement for ER to be meaningful for trustworthiness [2508.12623].

A third meaning appears in formal explainability. “From Robustness to Explainability and Back Again” does not introduce ER as a separate label, but it effectively treats a robust explanation as one whose sufficiency or contrastiveness is guaranteed within a specified norm-bounded region around an input [2306.03048]. In that setting, explanation robustness is tied directly to the non-existence or existence of adversarial examples under feature-fixing constraints.

A fourth meaning emphasizes reliability under realistic deployment conditions. “Reliable Explanations or Random Noise? A Reliability Metric for XAI” defines explanation reliability through stability under small input perturbations, consistency under feature redundancy, smoothness across model evolution, and resilience to mild distributional shifts [2602.05082]. This broadens ER from local perturbation stability to a deployment-oriented notion of explanation persistence.

A terminological complication arises in NLP. In “ER-Test: Evaluating Explanation Regularization Methods for Language Models” and “Explanation Regularisation through the Lens of Attributions,” ER denotes Explanation Regularization, a training paradigm that aligns machine rationales with human rationales, rather than Explanatory Robustness as such [2205.12542][2407.16693]. Those works remain closely related because they study whether explanation-guided training improves out-of-distribution behavior and reliance on plausible features.

## 2. Formal criteria and representative metrics

Several formalizations recur across the literature, but they operate on different objects: attribution vectors, rankings, explanation sets, or natural-language outputs. The common structure is a comparison between explanations before and after some constrained transformation.

| Formalization | Explanation object | Representative criterion |
|---|---|---|
| Feature-attribution stability | attribution ranking | average Spearman rank correlation over a label-preserving neighborhood [2406.14349] |
| Cross-method ER | outputs of \(F\) and \(\hat{F}\) | ER-1 and ER-2 conditions with metric \(d\) and transformation \(\phi\) [2508.12623] |
| Probabilistic robustness | explanation vectors | explainer astuteness \(A_{r,\lambda}(E,\mathcal{D})\) [2206.12481] |
| Reliability axioms | attribution vectors across transformations | \(\mathrm{ERI}(x)=\frac{1}{1+\Delta(x)}\) [2602.05082] |
| Formal explainability | feature subsets | \((\epsilon,p)\)-abductive and contrastive explanations [2306.03048] |

In tabular neural networks, the robustness score for an instance can be defined as the average Spearman rank correlation between the original feature-importance ranking and the rankings obtained for manifold-respecting perturbed neighbors [2406.14349]:
\[
\text{robustness}(x^i) = \frac{1}{n} \sum_{k=1}^{n} \rho\big(E(x^i), E(x^P_k)\big).
\]
A default threshold \(th = 0.80\) or \(0.85\) is then used to distinguish robust from non-robust explanations [2406.14349].

In the cross-method formulation of ER, local agreement for the same input-output pair is expressed as [2508.12623]
\[
d\bigl(X(z_i), \phi(\hat{X}(z_i))\bigr) < \varepsilon,
\]
while local discriminant validity for different input-output pairs is expressed as
\[
d'(z_i, z_j) > \gamma \Rightarrow d\bigl(X(z_i), \phi(\hat{X}(z_j))\bigr) > \epsilon.
\]
Probabilistic relaxations are also proposed so that “very different cases receiving very similar explanations” should occur only with small probability [2508.12623].

For explanation methods viewed as functions from inputs to attribution vectors, “Analyzing Explainer Robustness via Probabilistic Lipschitzness of Prediction Functions” defines explainer astuteness as [2206.12481]
\[
A_{r,\lambda}(E,\mathcal{D}) =
\mathbb{P}_{x,x' \sim \mathcal{D}}
\Big[
d_p(\phi(x), \phi(x')) \le \lambda \cdot d_p(x, x')
\;\Big|\;
d_p(x,x') \le r
\Big].
\]
This is a probabilistic “similar inputs, similar explanations” criterion, and the paper gives lower bounds on astuteness for SHAP, RISE, and remove-individual-feature explainers in terms of probabilistic Lipschitzness of the predictor [2206.12481].

For deployment-oriented reliability, ERI defines explanation drift
\[
\Delta(x) := \mathbb{E}_{\omega\sim\Omega} \big[ d\big(E(x),\,E(\tau_\omega(x))\big) \big]
\]
and maps it to
\[
\mathrm{ERI}(x) := \frac{1}{1+\Delta(x)} \in (0,1].
\]
The resulting family includes ERI-S for perturbation stability, ERI-R for redundancy-collapse consistency, ERI-M for model-evolution consistency, ERI-D for distributional robustness, and ERI-T for temporal reliability [2602.05082].

In formal explainability, robustness is embedded directly into the definition of explanation. A set \(X\) is an \((\epsilon,p)\)-abductive explanation if fixing the features in \(X\) guarantees prediction invariance throughout the ball \(B_p(\mathbf{v},\epsilon)\); a set \(Y\) is an \((\epsilon,p)\)-contrastive explanation if changing only features in \(Y\) can produce an adversarial example within that same ball [2306.03048]. This turns ER into a logically checkable sufficiency or contrastiveness property.

## 3. Perturbation models and evaluation protocols

The perturbation model largely determines what counts as a robust explanation. A major line of work rejects arbitrary or adversarially optimized noise and instead emphasizes realistic, structure-preserving perturbations.

For tabular neural networks, “When Can You Trust Your Explanations? A Robustness Analysis on Feature Importances” generates non-adversarial, manifold-respecting neighborhoods by clustering data with k-medoids, selecting neighboring medoids, perturbing numerical and categorical variables toward those medoids, and filtering the generated points so that the model prediction remains unchanged [2406.14349]. Hyperparameters are tuned so that about 97% of generated points pass the label-preserving filter, and the resulting neighborhoods are used to evaluate attribution ranking stability [2406.14349]. The same work also reverse-encodes one-hot categorical variables so that robustness is measured at the variable level rather than across sparse dummy coordinates [2406.14349].

In LLM-based recommendation explanation, RobustExplain uses five realistic user behavior perturbations—Noise Injection, Temporal Shuffle, Behavior Dilution, Category Drift, and Missing Values—each evaluated at five severity levels [2601.19120]. The explanation agent is formalized as
\[
e = E(H_u, r, \mathbf{X}),
\]
and robustness with respect to perturbation \(\delta\) is
\[
\rho(E, \delta) =
\mathbb{E}_{H_u, r}
\left[
\text{sim}\big(E(H_u, r, \mathbf{X}),\, E(\delta(H_u), r, \mathbf{X})\big)
\right].
\]
Similarity is decomposed into semantic, keyword, structural, and length consistency, then aggregated into an overall robustness score [2601.19120].

In explainable recommendation with feature-aware recommenders, robustness is evaluated under both adversarial perturbations of the item-feature matrix \(Y\) and white-box parameter attacks on \(\theta\) [2405.01855]. There, explanatory quality is measured by feature-level precision, recall, and \(F_1\) against review-derived ground-truth aspects, and robustness is operationalized as retaining explanation quality under attack [2405.01855].

A different perturbation logic appears in robustness analysis for explanations through adversarial subsets. “Evaluations and Methods for Explanation through Robustness Analysis” defines the minimum perturbation norm restricted to a feature subset \(S\) as [2006.00442]
\[
g(f, \boldsymbol{x}, S) =
\min_{\boldsymbol{\delta}}
\left\{
\|\boldsymbol{\delta}\|_p
\;:\;
f(\boldsymbol{x} + \boldsymbol{\delta}) \neq y,\;
\boldsymbol{\delta}_{\overline{S}} = 0
\right\},
\]
then uses low robustness on the selected set and high robustness on its complement to characterize “loosely necessary and sufficient” explanations [2006.00442].

For saliency-based methods, robustness can also be framed as stability of the top-\(k\) ranking rather than global \(\ell_p\) similarity. “Provable Robust Saliency-based Explanations” introduces local pairwise ranking thickness and local top-\(k\) ranking thickness, explicitly targeting preservation of the relative ordering between salient and non-salient features under bounded perturbations [2212.14106]. This suggests that the perturbation model and the explanation similarity metric must be aligned with the intended explanatory use.

## 4. Methods for improving explanatory robustness

One strategy is explanation aggregation. In tabular neural networks, an ensemble explanation is built from Integrated Gradients, DeepLIFT, and LRP-\(\gamma\), operating on rank positions rather than raw attribution magnitudes and penalizing sign disagreement across methods [2406.14349]. The ensemble ranking is then evaluated with the same manifold-based robustness test as the individual explainers [2406.14349]. In Random Forests, “Combination of Weak Learners eXplanations to Improve Random Forest eXplicability Robustness” proposes AXOM, which averages SHAP explanations only from weak learners whose predictions agree with the ensemble prediction for the current instance [2402.19025]. Robustness is quantified via an averaged local Lipschitz ratio, and AXOM yields significantly lower mean robustness values than standard Random Forest SHAP across the evaluated datasets [2402.19025].

A second strategy is robustness-aware training. In “Robust Explainable Recommendation,” adversarial training is performed on the item-feature matrix \(Y\) using
\[
L_{\text{total}}(X, Y \mid \theta)
=
(1 - \lambda)\, L(X, Y \mid \theta)
+
\lambda\, L(X, Y + \Delta Y \mid \theta),
\]
with \(\Delta Y = \epsilon_D \cdot \operatorname{sign}(G)\) and \(G = \frac{\partial L_{\text{total}}}{\partial Y}\) [2405.01855]. This yields smaller drops in explanation \(F_1\) under white-box attacks on model parameters [2405.01855].

A third strategy is direct regularization of ranking stability. “Robust Ranking Explanations” and “Provable Robust Saliency-based Explanations” introduce R2ET, which replaces \(\ell_p\)-distance stability with stability of top-\(k\) feature rankings [2307.04024][2212.14106]. The training objective combines classification loss, enlarged ranking gaps between top-\(k\) and non-salient features, and a Hessian-based smoothness penalty [2212.14106]:
\[
\mathcal{L}_{total}(f)
=
\mathcal{L}_{cls}(f)
-
\lambda_1 \mathbb{E}_{\mathbf{x}}
\left[
\sum_{i=1}^k \sum_{j=k+1}^n h(\mathbf{x}, i,j)
\right]
+
\lambda_2 \mathbb{E}_{\mathbf{x}}
\left[
\| H(\mathbf{x}) \|_2
\right].
\]
Theoretical analysis connects this surrogate to ranking explanation thickness and to adversarial-training-style robustness objectives [2212.14106][2307.04024].

A fourth strategy is formal certification. “Robust Explanation Constraints for Neural Networks” propagates compact input or parameter sets as symbolic intervals through forward and backward passes to bound the range of gradient-based explanations under bounded perturbations [2212.08507]. Explanation robustness is then certified by upper-bounding the componentwise change in the explanation vector, and the resulting bounds are differentiable enough to be included in training [2212.08507].

A fifth strategy uses robustness queries as explanation engines. “From Robustness to Explainability and Back Again” shows that \((\epsilon,p)\)-abductive and contrastive explanations can be computed with at most linear numbers of robustness queries in the number of features, thereby reducing formal explanation search to repeated local robustness verification [2306.03048].

## 5. Empirical patterns across domains

Across tabular neural networks, robust points are the majority but non-robust points are not negligible. With \(th = 0.80\) and Model 1, robust points account for 78.1% on adult, 92.9% on bank, and 79.2% on ocean, while non-robust points reach 18.2% on adult and 28.0% on HELOC; uncertain points average around 7.3% at \(th=0.80\) and 13.2% at \(th=0.85\) [2406.14349]. The same study reports that discordant predictions across three neural architectures are systematically more frequent among non-robust points than robust ones on the non-trivial datasets, supporting the idea that explanation robustness is local and concentrated in easier regions of the data manifold [2406.14349].

In LLM-based recommendation explanations, RobustExplain reports overall mean robustness of approximately 0.509 across models and perturbations, with LLaMA 3.1-70B reaching 0.532 and larger models achieving up to 8% higher stability than 7B–8B models [2601.19120]. Semantic similarity is about 0.603 on average, keyword stability about 0.480, structural consistency about 0.378, and length stability about 0.714 [2601.19120]. Missing values and noise injection yield the highest robustness, behavior dilution the lowest, and degradation from mild to severe perturbations is only about 1.7%, with a slight rebound at the most severe level due to more generic explanations [2601.19120].

In explanation reliability benchmarks, widespread failures are reported for popular methods. “Reliable Explanations or Random Noise? A Reliability Metric for XAI” finds that local explainers such as IG, SHAP, DeepLIFT, and permutation can be unstable under redundancy, temporal evolution, or model updates, whereas MCIR achieves identically zero drift by construction and therefore ERI equal to 1 across the reported axes [2602.05082]. The same work reports high ERI-S and ERI-M for IG on CIFAR-10, but also shows that high reliability can coexist with imperfect semantic faithfulness, as indicated by non-monotone deletion curves [2602.05082]. A plausible implication is that robustness and faithfulness can coincide, but need not.

For saliency-based explanations under stealthy attacks, R2ET improves top-\(k\) overlap under ranking-based attacks across tabular, image, and graph settings, and sample-level explanation thickness is strongly correlated with the number of attack iterations needed to flip the first salient/non-salient pair [2212.14106]. In Random Forest explanation, AXOM significantly improves robustness over standard Random Forest SHAP across Wine, Glass, Seeds, and Banknote, with all RF-versus-AXOM comparisons reported as statistically significant at \(p < 0.05\) [2402.19025].

## 6. Trustworthiness, adjacent concepts, and unresolved issues

ER is repeatedly treated as necessary but not sufficient for trustworthy explanation. The cross-method framework explicitly argues that high ER alone can still be misleading, because multiple methods may converge on the same but wrong explanation, and because a single method can satisfy EMR while remaining systematically unfaithful to the model’s actual decision process [2508.12623]. In the tabular feature-importance setting, the same point is made in a different vocabulary: high-fidelity explanations that change wildly under tiny on-manifold perturbations are not trustworthy, but robust explanations with low fidelity can also be misleading [2406.14349].

This connects ER to, but does not collapse it into, fidelity, fairness, and accountability. “Robust Explainable Recommendation” ties explanation robustness to protection against malicious manipulation in high-stakes recommendation scenarios [2405.01855]. “When Can You Trust Your Explanations?” links unstable explanations to difficulties in auditing fairness, because unstable explanations can mask biases or create unreliable audit regions [2406.14349]. “Reliable Explanations or Random Noise?” treats reliability under redundancy, model evolution, and mild shift as a deployment requirement in energy systems, healthcare, finance, and autonomous systems [2602.05082].

A related but distinct literature asks whether explanation-guided training improves generalization. ER-Test reports that explanation regularization has little impact on in-distribution performance but can yield large out-of-distribution gains across unseen dataset tests, contrast set tests, and functional tests [2205.12542]. By contrast, “Explanation Regularisation through the Lens of Attributions” finds that the connection between explanation regularization and stronger reliance on plausible tokens “has been overstated,” and that stronger reliance on plausible tokens does not seem to be the cause for the observed OOD improvements [2407.16693]. This suggests that robustness of explanations, robustness of predictive behavior, and explanation-guided training should be analytically separated even when they interact.

Several limitations recur. Manifold-based methods depend on the manifold hypothesis and on dataset-specific hyperparameter tuning [2406.14349]. Formal and certified methods inherit the scalability limits of robustness verification tools [2306.03048][2212.08507]. Reliability axioms require context-dependent choices of metrics, tolerances, and transformation families [2508.12623][2602.05082]. Natural-language explanation robustness benchmarks remain early-stage and moderate in scale [2601.19120]. More conceptually, “Detecting Explanatory Insufficiency in Learned Representations: A Framework for Representational Vigilance” argues that even operationally successful models can accumulate persistent residual structures that conventional metrics do not capture, and proposes vigilance signaling as a complementary diagnostic of representational adequacy [2606.13172]. A plausible implication is that future ER research may increasingly shift from explanation stability alone toward broader monitoring of explanatory sufficiency in learned representations.

Source: https://www.emergentmind.com/topics/explanatory-robustness-er