Training for Trustworthy Saliency Maps: Adversarial Training Meets Feature-Map Smoothing

TL;DR

The results demonstrate that explanation quality is critically shaped by training, and that simple smoothing with robust training provides a practical path toward saliency maps that are both sparse and stable.

Abstract

Gradient-based saliency methods such as Vanilla Gradient (VG) and Integrated Gradients (IG) are widely used to explain image classifiers, yet the resulting maps are often noisy and unstable, limiting their usefulness in high-stakes settings. Most prior work improves explanations by modifying the attribution algorithm, leaving open how the training procedure shapes explanation quality. We take a training-centered view and first provide a curvature-based analysis linking attribution stability to how smoothly the input-gradient field varies locally. Guided by this connection, we study adversarial training and identify a consistent trade-off: it yields sparser and more input-stable saliency maps, but can degrade output-side stability, causing explanations to change even when predictions remain unchanged and logits vary only slightly. To mitigate this, we propose augmenting adversarial training with a lightweight feature-map smoothing block that applies a differentiable Gaussian filter in an intermediate layer. Across FMNIST, CIFAR-10, and ImageNette, our method preserves the sparsity benefits of adversarial training while improving both input-side stability and output-side stability. A human study with 65 participants further shows that smoothed adversarial saliency maps are perceived as more sufficient and trustworthy. Overall, our results demonstrate that explanation quality is critically shaped by training, and that simple smoothing with robust training provides a practical path toward saliency maps that are both sparse and stable.

Figures (11)

• Figure 1: Saliency maps (Vanilla Gradient) for the same correctly classified input under three training regimes. (a) Natural training: noisy and diffuse maps that obscure the decision rationale. (b) Adversarial training: sparser maps but with reduced stability, sometimes discarding structurally relevant regions. (c) Adversarial + Gaussian feature-map smoothing: restores stability while retaining sparsity, producing explanations that are more coherent.
• Figure 2: Effect of training regimes on intermediate feature maps (channel= {7, 21, 127}, after first residual block) and saliency maps: (a) naturally trained, (b) adversarially trained, (c) adversarially trained with feature-map smoothing, and (d) corresponding VG saliency maps.
• Figure 3: Feature-map smoothing block. A spatial filter is followed by a $1\times1$ convolution and a residual connection.
• Figure 4: Structural similarity (SSIM) evaluation of saliency maps for naturally trained (N), adversarially trained (A), and adversarially trained with Gaussian smoothing (G).
• Figure 5: Ablation: Structural similarity evaluation of saliency maps on various ImageNette models: naturally trained (N), adversarially trained (A), and adversarial trained with smoothing filters (M1: mean filter, M2: median filter and (G): Gaussian filter).