PaperlayerView exact revision on arXiv

Source-linked AI summary

Interpretable but Fragile? Robustness of Concept Bottlenecks under Geometric-Semantic Perturbations

Hanwei Zhang, Tianma Hu, Gaojie Jin, Xu Cheng, Ronghui Mu

arXiv:2609.38625v3cs.LGcs.AI

TL;DR

It remains unclear whether concept bottlenecks improve robustness, with prior findings depending on how robustness and perturbations are defined. This paper uses a generator-based framework to compare standard classifiers and CBMs under geometric and semantic perturbations, finding that bottlenecks redistribute sensitivity rather than uniformly improving robustness.

  • Problem

    Existing evidence on CBM robustness is mixed, and how an interpretable intermediate representation affects robustness across perturbation spaces and criteria remains unclear.

    Source: §1 · p. 2

  • Method

    A generator-based framework compares standard classifiers and CBMs under continuous latent-space geometric perturbations and discrete concept-space semantic interventions, using empirical metrics and randomized-smoothing certificates.

    Source: §1 · p. 3

  • Results

    Across CUB-200-2011 and RIVAL-10 variants, CBMs do not confer uniform robustness improvements; sensitivity depends on perturbation space, criterion, task structure, and concept vocabulary.

    Source: §1 · p. 3, §6 · p. 10

  • Takeaways & Limitations

    Interpretability and robustness are distinct objectives, so CBMs should not be treated as an implicit robustness mechanism.

    Source: §1 · p. 3, §6 · p. 10

    The analysis uses generator-native inputs and post-hoc CBMs with frozen backbones, so results may differ outside the generator manifold or for other CBM paradigms.

    Source: §6 · p. 10

Abstract

from arXiv · show

Concept Bottleneck Models (CBMs) are designed to provide interpretable intermediate representations, yet how such bottlenecks affect robustness remains unclear, with existing studies reporting mixed and sometimes contradictory findings. We argue that these discrepancies arise from conflating different robustness notions and perturbation regimes, rather than from fundamental disagreements about CBMs themselves. To disentangle these factors, we introduce a generator-based evaluation framework that enables controlled comparisons between standard classifiers and CBMs under two distinct perturbation types: continuous geometric perturbations in latent space and discrete semantic interventions in concept space. Within this framework, we evaluate robustness both empirically, via prediction and concept-level sensitivity metrics, and certifiably, using randomized smoothing in latent and concept spaces. Across experiments, we reconcile previously conflicting findings by clarifying when, and in what sense, concept bottlenecks do or do not improve robustness. By further analyzing robustness under varying task conditions, including class semantic similarity and concept vocabulary size, we show that interpretability does not inherently confer robustness. Instead, concept bottlenecks shift where and how sensitivity manifests, revealing a nuanced interpretability robustness trade off that depends critically on the perturbation regime and task structure. Together, our results show that interpretability and robustness are distinct objectives: interpretable intermediate representations do not uniformly improve robustness, but instead redistribute sensitivity across perturbation spaces and model families.

1 Introduction

Prior findings disagree on whether concept bottlenecks improve robustness, and the answer depends on the robustness criterion, perturbation regime, and task. This work introduces a controlled generator-based framework to distinguish those conditions and finds that bottlenecks reshape sensitivity rather than uniformly improving robustness.

1 Introduction

  • Prior studies report opposing robustness effects, and the same classifier comparison can reverse across task settings within one dataset.The paper attributes these differences to distinct robustness notions and perturbation regimes, not fundamental disagreement about CBMs.Source: §1 · p. 2
  • The central question is how an interpretable intermediate representation changes robustness relative to a standard classifier across perturbation spaces and robustness criteria.The paper notes that pixel-level perturbations often lack semantic meaning and do not reflect changes in underlying concepts.Source: §1 · p. 2
  • A shared, frozen concept bottleneck generator enables controlled geometric latent perturbations and semantic concept interventions, with empirical and randomized-smoothing evaluation.Standard models and CBMs share a backbone for fair comparison.Source: §1 · pp. 2–3
  • CBMs can suppress sensitivity in some settings while introducing vulnerabilities in others, so interpretability and robustness remain distinct objectives.The framework distinguishes prediction- and concept-level sensitivity under geometric and semantic perturbations, and empirical, certified, and adversarial robustness.Source: §1 · p. 3
  • Across CUB-200-2011 and RIVAL-10 variants, CBMs show no inherent robustness advantage; outcomes depend on perturbation regime, criterion, class similarity, and concept vocabulary.The evaluation pipeline also applies to PixPNet without requiring alignment between generator concepts and model-specific prototypes.Source: §1 · p. 3

2 Related Work

Prior work links interpretability and robustness in differing ways: studies of CBMs report both fragile concept interfaces and improved prediction-level robustness, while related methods expose other interpretable representations. The paper situates these mixed findings among structured-perturbation certification approaches and evaluation methods that do not require representation alignment.

Robustness of Concept Bottlenecks

  • CBM studies report both fragile concept representations and higher adversarial accuracy for some sequentially trained variants, with differing robustness definitions and settings contributing to conflicting conclusions.Sinha et al. [2023] describe added attack surfaces; Rasheed et al. [2024] report gains under weak to moderate attacks.Source: §2 · p. 3

Randomized Smoothing for Certified Robustness

  • Randomized smoothing certifies robustness against bounded perturbations, and this paper uses it mainly as a model-agnostic comparison tool rather than a defense objective.The paper notes that smoothing may also improve empirical robust accuracy in some adversarial settings.Source: §2 · pp. 3–4

Interpretable intermediate architectures beyond CBMs

  • Post-hoc concept methods and prototype-based models expose interpretable representations, while the generator provides a common perturbation interface without requiring representation alignment.PCBM uses CAV-style directions, whereas PixPNet grounds predictions in localized parts.Source: §2 · p. 4

3 Methodology

The methodology uses a generator’s concept representation to define distinct geometric and semantic perturbations, then compares standard classifiers and CBMs using empirical sensitivity metrics and randomized-smoothing certificates. This setup measures robustness at both concept and prediction levels.

3.1 Perturbation Models

  • A pretrained generator is decomposed into latent-to-feature and feature-to-image mappings, with an encoder–decoder pair defining K binary-state concepts at an intermediate layer.The concept representation contains K concepts, each represented by a pair of state coordinates.Source: §3.1 · p. 4
  • Geometric perturbations add bounded continuous noise to latent codes, while semantic perturbations swap selected concept states to change attributes while preserving geometric structure.The semantic intervention samples a subset of concepts and modifies their binary representations.Source: §3.1 · p. 4

3.2 Statistical Robustness Analysis

  • The comparison uses standard image classifiers and CBMs that predict concepts before mapping them to class labels.The setup compares their responses to both latent geometric perturbations and concept-space semantic perturbations.Source: §3.2 · p. 4
  • Concept Flip Rate and Decision Function Sensitivity capture concept-level changes, while Prediction Flip Rate measures changes in predicted labels.Together, the metrics examine how concept instability propagates to predictions.Source: §3.2 · pp. 4–5
  • Randomized smoothing certifies robustness in latent space for geometric perturbations and concept space for semantic perturbations.The method uses Gaussian smoothing for geometric robustness and Bernoulli concept flips for semantic robustness; the latter yields an ℓ0 certificate against a bounded number of concept flips.Source: §3.2 · p. 5

4 Experiments

Across the experiments, concept bottlenecks do not produce monotonic robustness improvements; instead, they shift where sensitivity appears. The comparisons span geometric and semantic perturbations, empirical and certified measures, and adversarial evaluation.

4 Experiments

  • Across controlled geometric and semantic perturbations, experiments empirically and certifiably evaluate fstd and fcbm, finding concept bottlenecks do not induce monotonic robustness improvements but shift where and how sensitivity manifests.Source: §4 · p. 5

4.1.1 Empirical robustness results

  • On CUB-200-2011, fcbm has higher prediction flip rates than fstd across geometric and semantic budgets, but only the difference at semantic budget τ = 5 remains significant after correction; on RIVAL-10 both are nearly perfectly robust.Figure 3 shows that decision function sensitivity relates more consistently to prediction flips than raw concept flip rates.Source: Figure 2 · p. 6, Figure 3 · p. 6, §4.1.1 · p. 7

4.1 Experimental Setup

  • CUB-200-2011 uses 15 frequency-selected concepts, while RIVAL-10 uses all 18 annotated attributes; both classifiers share a pretrained backbone.The evaluation also restricts inputs to those on which the two models agree and uses their shared prediction as the reference label.Source: §4.1 · p. 6

4.2 Randomised Smoothing Experiments

  • Under latent-space smoothing, fstd generally has higher smoothed accuracy and larger certified radii than fcbm on CUB-200-2011, while RIVAL-10 results are saturated; concept-space certificates also show no consistent fcbm improvement on CUB.For concept-space smoothing, increasing flip probability can lower smoothed accuracy while increasing the certified radius, showing these measures capture distinct aspects of stability.Source: Figure 4 · p. 7, §4.2 · p. 7

4.3 Adversarial Evaluation

  • Under APGD-CE attacks on generated CUB inputs, fcbm is more robust to latent-space attacks but less robust to concept-space attacks than fstd.Randomized smoothing improves robust accuracy under both attack types, with larger gains at higher attack strengths.Source: §4.3 · pp. 7–8, Figure 5 · p. 8

5 Robustness under Task Conditions

Controlled RIVAL-10 studies show that robustness varies with class semantic similarity and concept vocabulary size. Neither changing the task structure nor enlarging the vocabulary produces a uniform robustness advantage for concept bottlenecks.

5.1 Effect of Class Structure and Semantic Similarity

  • The class-structure study adds five or ten semantically similar or dissimilar classes to RIVAL-10 while retaining its original 18 concept attributes.This varies class count and semantic difficulty while holding the concept vocabulary fixed.Source: §5.1 · pp. 8–9
  • Class semantic similarity is the dominant factor shaping robustness differences: fcbm matches or slightly outperforms fstd under geometric and mild semantic perturbations but grows more sensitive under large semantic changes.Semantic dissimilarity generally improves robustness; randomized smoothing sometimes gives fcbm larger gains, but certified-radius differences depend on perturbation space and task configuration.Source: §5.1 · p. 9

5.2 Effect of Concept Vocabulary Size

  • The vocabulary study compares 18, 27, and 36 concepts on the original RIVAL-10 task, keeping the classification task fixed.The additional concepts are generated by a large language model and are semantically relevant to the classes.Source: §5.2 · p. 9
  • At the largest semantic-flip budget, 27 concepts yield 9.29 vs. 9.42 PFR for fcbm vs. fstd, while 36 concepts reverse the comparison to 3.11 vs. 2.65 PFR.Geometric perturbations are nearly saturated in the original RIVAL-10 setting; certified robustness varies by regime and configuration without a consistent fcbm advantage.Source: §5.2 · p. 9, Figure 7 · p. 10
  • Robustness differences are shaped by task structure, and concept-vocabulary changes can help or destabilize models depending on the perturbation and attributes involved.The authors recommend treating robustness as a design criterion when selecting concepts, since larger semantic interventions can expose vulnerabilities.Source: §5.2 · pp. 9–10

6 Limitation and Conclusion

The paper concludes that concept bottlenecks do not uniformly improve robustness, which depends on perturbation space, evaluation criterion, task structure, and concept design. Its controlled framework also has a defined scope: generator-native perturbations and post-hoc CBMs with frozen backbones.

6 Limitation and Conclusion

  • The evaluation relies on generator-native inputs and post-hoc CBMs with frozen backbones, and its structured-perturbation conclusions do not replace pixel-space adversarial evaluations.Results may differ for real-world inputs outside the generator manifold or for end-to-end CBMs and alternative concept-learning paradigms.Source: §6 · p. 10
  • Across CUB-200-2011 and RIVAL-10 variants, concept bottlenecks do not uniformly improve robustness; sensitivity instead depends on perturbation space, robustness criterion, task structure, and concept vocabulary.The authors conclude that interpretability should not be treated as an implicit robustness mechanism.Source: §6 · p. 10
  • The framework also applies to PixPNet, a prototype-based interpretable classifier, without requiring alignment between heterogeneous internal representations.The same generator-defined perturbation-to-prediction evaluation and randomized-smoothing certification pipeline can be used.Source: §6 · p. 10

A Background and Related Work

  • Prior CBM studies report both robustness gains and fragility, with differences attributed to robustness definitions, perturbation models, and task settings.Related work also notes that most robustness studies focus on pixel perturbations, leaving the effect of interpretable representations under semantic perturbations less explored.Source: A Background and Related Work · p. 14
  • The evaluation uses a concept bottleneck generator as an instrument for controlled geometric and semantic perturbations, not as the classifier under study.The background describes randomized smoothing as a comparative certification tool for these controlled perturbations, rather than a defense mechanism.Source: A Background and Related Work · pp. 14–15

B Methodology

The framework compares classifiers under continuous latent-space perturbations and discrete concept flips, then certifies robustness in each space with randomized smoothing. Its procedures define prediction gaps, concept-flip certificates, and practical experimental settings.

B.1 Empirical Robustness Characterization

  • The empirical framework generates images from latent-space geometric perturbations and concept-space semantic interventions to compare classifiers’ robustness.Geometric perturbations modify the latent vector; semantic interventions flip entries in the concept representation.Source: §B.1 · p. 15

B.2 Latent-Space Gaussian Smoothing

  • Latent-space Gaussian smoothing estimates class probabilities from Gaussian perturbations of z and uses simultaneous confidence bounds to compute a certified radius.The certificate holds with probability at least 1 − α over the sampling procedure.Source: §B.2 · pp. 15–16

B.3 Concept-Space Bernoulli Flip Smoothing

  • Concept-space smoothing applies independent Bernoulli flips to concepts and certifies the largest Hamming radius for which the smoothed prediction remains unchanged.Neyman–Pearson transfer bounds cover every intervention mask at the corresponding Hamming weight; the procedure abstains if its condition fails at distance zero.Source: §B.3 · pp. 16–17

B.4 Monte Carlo Estimation and Certification Algorithm

  • Monte Carlo certification samples Bernoulli-flipped concepts, counts predicted classes, applies simultaneous confidence bounds, and returns either abstention or a certified radius.The algorithm tests candidate radii using Neyman–Pearson transfer functions.Source: §B.4 · pp. 17–18

C.1 Computation of the robustness-gap heatmap.

  • Robustness-gap signs are oriented so positive values indicate greater CBM robustness, with PFR gaps in percentage points and certified-radius gaps in absolute units.PFR gaps use lower flip rates as better; certified gaps use larger radii as better.Source: §C.1 · p. 18

C.2 More Details on Experiments Setups

  • The experiments profile GPU memory at batch size 8 on one RTX 4090 with 24GB, recommending at least 8GB free, preferably 10–12GB.The reported experiments typically use one GPU each.Source: §C.2 · pp. 18–19

C.3 Empirical Robustness Results

Empirical results show that prediction-level robustness and concept-level stability can diverge, while perturbation strength and type shape their relationship. The findings also caution that concept-flip rates do not map monotonically to prediction instability.

C.3 Empirical Robustness Results

  • Although fcbm is less robust than fstd at the prediction level, its concept representation remains comparatively stable even when up to 10 concepts are semantically flipped.Table 1 covers geometric and semantic perturbations on CUB-200-2011 and RIVAL-10.Source: §C.3 · p. 19, Table 1 · p. 19
  • Stronger perturbations increase PFR for both classifiers and increase DFS, while repeated-subset statistics assess trend stability and paired tests identify significant PFR differences.The paired design uses five repeats, with Holm–Bonferroni-corrected p-values reported in Table 2.Source: §C.3 · p. 19, Table 2 · p. 20
  • PFR generally rises with CFR but not monotonically; at τ = 5 (CFR = 5) and ϵ = 0.5 (CFR = 3.15), the PFR values are similar.Figure 9 plots mean PFR against mean DFS and mean DFS against mean CFR, distinguishing geometric and semantic perturbations and fstd from fcbm.Source: §C.3 · pp. 19–20, Figure 9 · p. 19
  • At comparable CFR, geometric perturbations tend to induce larger DFS than semantic perturbations, suggesting stronger distortion of the CBM decision representation.The authors suggest the nonlinear CB-AE mapping may account for this pattern.Source: §C.3 · p. 20

C.4 Randomised Smoothing Experiments

Randomized-smoothing results vary with the perturbation space and task structure. The original RIVAL-10 split is saturated, while class structure and concept vocabulary offer additional settings for robustness comparisons.

C.4 Randomised Smoothing Experiments

  • On CUB-200-2011, latent-space smoothing generally gives the ResNet baseline higher SmAcc and larger certified radii than the PCBM, so the bottleneck does not improve certified robustness to continuous latent perturbations.On original RIVAL-10, both models have 100% SmAcc and nearly identical certified radii, consistent with strong class separability.Source: §C.4 · pp. 20–21

C.5.1 Effect of Class Structure and Semantic Similarity

  • The RIVAL-10 variants add ten semantically similar and ten dissimilar ImageNet classes, with similarity estimated from Euclidean distances between ResNet-50 class-centroid features.The class sets are selected using a large language model.Source: §C.5.1 · p. 21
  • Tables 4 and 5 present the complete set of empirical and certified robustness experiments; Table 4 reports RIVAL-10 results with 18 concepts and varying class count using ResNet50.Source: §C.5.1 · p. 21, Table 4 · p. 21

C.5.2 Effect of Concept Vocabulary Size

  • The supplied passage identifies Tables 6 and 7 as the complete empirical and certified results for concept-vocabulary-size experiments, without reporting their outcomes.Source: §C.5.2 · p. 21

C.5.3 Experiments on DenseNet-161.

DenseNet experiments extend the robustness evaluation to another backbone and report task-dependent patterns across RIVAL-10 class configurations. The section also describes an adversarial attack evaluation.

C.5.3 Experiments on DenseNet-161.

  • Across RIVAL-10 configurations, DenseNet and its concept-based counterpart vary in relative prediction stability, and Gaussian smoothing shows a similar task-dependent pattern.On the original 10-class setting both reach 100% SmAcc with nearly identical radii; in the 20-class similar setting DenseNet generally has higher SmAcc, while certified-radius ordering varies with noise. In the 20-class dissimilar setting both retain 100% SmAcc, with DenseNet slightly higher radii at higher noise.Source: §C.5.3 · p. 21
  • The DenseNet experiments indicate that robustness behavior associated with concept bottlenecks depends on task structure and perturbation conditions, rather than only on the ResNet-50 backbone.The section also reports that the models were tested on RIVAL-10 variants.Source: §C.5.3 · p. 21

C.5.4 Experiments on Attacks.

  • Adversarial robustness is evaluated by attacking the entire pipeline with APGD-CE, with results reported in Table 10.The supplied passage does not state the attack results.Source: §C.5.4 · p. 21

D Cross-Family Evaluation Beyond CBMs

The shared generator enables comparison of ResNet, PCBM, and PixPNet under latent geometric noise and generator-concept interventions. Across these evaluations, prediction stability and smoothing results vary by perturbation and metric.

D Cross-Family Evaluation Beyond CBMs

  • A fixed generator enables stability and smoothing comparisons across ResNet, PCBM, and PixPNet without aligning generator concepts to PixPNet prototypes.The detailed analysis of concept sensitivity and vocabulary design remains focused on CBMs.Source: D Cross-Family Evaluation Beyond CBMs · pp. 21, 23

D.1 Models and Evaluation Protocol

  • The protocol applies Gaussian latent noise or binary generator-concept flips to ResNet, PCBM, and PixPNet; cross-family Bernoulli results use K = 10 and 400 shared-agreement inputs.The Bernoulli evaluation differs from the main ResNet–PCBM experiment in concept dimensionality and sample aggregation, so their absolute SmAcc and certified radii should not be compared directly.Source: §D.1 · p. 23

D.2 Empirical Prediction Stability

  • PFR rises with perturbation strength for both models, and PixPNet exceeds ResNet in all four reported settings.These results show that prototype-based predictions can be analyzed under the same externally defined perturbations.Source: §D.2 · p. 24

D.3 Gaussian Randomized Smoothing

  • All three model families retain nonzero latent certificates; increasing σ generally reduces SmAcc while reported radii increase, and PixPNet has higher SmAcc but lower ACR than ResNet at σ = 0.05 and 0.10.The differing orderings show why predictive accuracy and certified radius should be reported separately.Source: §D.3 · pp. 24–25

D.4 Bernoulli Generator-Concept Smoothing

  • At ρ = 0.30, SmAcc falls to 12.50% for ResNet and 9.00% for PixPNet as generator concepts are randomized.At ρ = 0.05, smoothed predictions agree with reference labels for nearly every image.Source: §D.4 · p. 25

D.5 Certified Robustness to Concept Flips

Concept-flip certification remains limited in the reported settings, and its metrics distinguish certified radii among selected predictions from certified accuracy across all inputs.

D.5 Certified Robustness to Concept Flips

  • Bernoulli smoothing certifies additional adversarial generator-concept flips using Hamming-space radii; CA@1 counts all 400 inputs meeting the correctness, non-abstention, and radius-one criteria.ACR-H is averaged over correct, non-abstaining inputs.Source: §D.5 · pp. 25–26, Table 14 · p. 27
  • CA@1 remains between 1.00% and 1.75% in the reported settings; larger ACR-H values at higher ρ do not indicate stronger overall accuracy.ACR-H is conditioned on the shrinking set of correct, non-abstaining predictions, so CA@1 is reported alongside it.Source: §D.5 · p. 26, Table 14 · p. 27

D.6 Discussion

  • Across standard, concept-based, and prototype-based models, the fixed-generator procedure applies across classifier families but does not imply a uniform robustness advantage for interpretable models.Concept-sensitivity and vocabulary-design analyses remain focused on CBMs, whose intermediate concept representations are explicitly available.Source: §D.6 · p. 26

Related papers

Loading 2609.38625v3…