Reliable Post hoc Explanations: Modeling Uncertainty in Explainability

As black box explanations are increasingly being employed to establish model credibility in high-stakes settings, it is important to ensure that these explanations are accurate and reliable. However, prior work demonstrates that explanations generated by state-of-the-art techniques are inconsistent, unstable, and provide very little insight into their correctness and reliability. In addition, these methods are also computationally inefficient, and require significant hyper-parameter tuning. In this paper, we address the aforementioned challenges by developing a novel Bayesian framework for generating local explanations along with their associated uncertainty. We instantiate this framework to obtain Bayesian versions of LIME and KernelSHAP which output credible intervals for the feature importances, capturing the associated uncertainty. The resulting explanations not only enable us to make concrete inferences about their quality (e.g., there is a 95% chance that the feature importance lies within the given range), but are also highly consistent and stable. We carry out a detailed theoretical analysis that leverages the aforementioned uncertainty to estimate how many perturbations to sample, and how to sample for faster convergence. This work makes the first attempt at addressing several critical issues with popular explanation methods in one shot, thereby generating consistent, stable, and reliable explanations with guarantees in a computationally efficient manner. Experimental evaluation with multiple real world datasets and user studies demonstrate that the efficacy of the proposed framework.


Introduction
As machine learning (ML) models get increasingly deployed in domains such as healthcare and criminal justice, it is important to ensure that decision makers have a clear understanding of the behavior of these models. However, ML models that achieve state-of-the-art accuracy are typically complex black boxes that are hard to understand. As a consequence, there has been a surge in post hoc techniques for explaining black box models [1][2][3][4][5][6][7][8][9][10]. Most popular among these techniques are local explanation methods which explain complex black box models by constructing interpretable local approximations (e.g., LIME [2], SHAP [4], MAPLE [11], Anchors [1]). Due to their generality, these methods are being leveraged to explain a number of classifiers including deep neural networks and ensemble models in a variety of domains such as law, medicine, and finance [12,13].
Existing local explanation methods, however, suffer from several drawbacks. Explanations generated using these methods may be unstable [14][15][16][17][18], i.e., negligibly small perturbations to an instance can result in substantially different explanations. These methods are also inconsistent [19] i.e., multiple runs on the same input instance with the same parameter settings may result in vastly different explanations. There are also no reliable metrics to ascertain the quality of the explanations  Figure 1: Example explanations on for an instance from the COMPAS dataset, where vertical lines indicate the feature importance by LIME (red is negative effect, green is positive) and the shaded region visualizes the uncertainty estimated by BayesLIME. While LIME produces very different and contradictory feature importance for different number of perturbations (1a and 1b), BayesLIME provides more context. The overlapping uncertainty intervals in the explanation computed with 100 perturbations (1a) indicate that it is unclear which feature is the most important. However, the tighter uncertainty intervals in the explanation computed with 2K perturbations (1b) clearly indicates that Female is the most important. output by these methods. Commonly used metrics such as explanation fidelity rely heavily on the implementation details of the explanation method (e.g., the perturbation function used in LIME) and do not provide a true picture of the explanation quality [20]. Furthermore, there exists little to no guidance on determining the values of certain hyperparameters that are critical to the quality of the resulting local explanations (e.g., number of perturbations in case of LIME). Local explanation methods are also computationally inefficient i.e., they typically require a large number of black box model queries to construct local approximations [21]. This can be prohibitively slow especially in case of complex neural models.
In this paper, we identify that modeling uncertainty in black box explanations is the key to addressing all the aforementioned challenges. To this end, we propose a novel Bayesian framework for generating local explanations along with their associated uncertainty. We instantiate this framework to obtain Bayesian versions of LIME and KernelSHAP, namely BayesLIME and BayesSHAP, that not only output point-wise estimates of feature importance but also their associated uncertainty in the form of credible intervals (See Figure 1). We derive closed form expressions for the posteriors of the explanations thereby eliminating the need for any additional computational complexity. The credible intervals produced by our framework not only allow us to make concrete inferences about the quality of the resulting explanations but also produce explanations that satisfy user specified levels of uncertainty (e.g., an end user may request for explanations that satisfy a certain 95% confidence level). In addition, the resulting explanations are also highly consistent and stable. To the best of our knowledge, this work makes the first attempt at addressing several critical challenges in popular explanation methods in one-shots, thereby generating consistent, stable, and reliable explanations with guarantees in a computationally efficient manner.
We carry out theoretical analysis that leverages the measures of uncertainty (credible intervals) produced by our framework to estimate the values of critical hyperparameters. More specifically, we derive a closed form expression for the number of perturbations required to generate explanations that satisfy desired levels of confidence. We also propose a novel sampling technique called focused sampling that leverages uncertainty to determine how to sample perturbations for faster convergence, thereby enabling our framework to generate explanations in a computationally efficient manner.
We evaluate the efficacy of the proposed framework on a variety of datasets including COMPAS, German Credit, ImageNet, and MNIST. Our results demonstrate that the explanations output by our framework are not only highly reliable, but also very consistent and stable (53% more stable than LIME/SHAP on an average). Our experimental results also confirm that we can accurately estimate the number of perturbations needed to generate explanations with a desired level of uncertainty, and that our uncertainty sampling technique speeds up the process of generating explanations by up to a factor of 2 relative to random sampling of perturbations. Lastly, we carry out a user study with 31 human subjects to evaluate the quality of the explanations generated by our framework, demonstrating that our explanations accurately capture the importance of the most influential features.

Notation & Background
Here we introduce notation and discuss two relevant prior approaches, LIME and KernelSHAP.
Notation Let f : R d → [0, 1] denote a black box classifier that takes a data point x with d features, and returns the probability that x belongs to a certain class. Our goal is to explain individual predictions of f . Let φ ∈ R d denote the explanation in terms of feature importances for the prediction f (x), i.e. coefficients φ are treated as the feature contributions to the black box prediction. Note that φ captures the coefficients of a linear model. Let Z be a set of N randomly sampled instances (perturbations) around x. The proximity between x and any z ∈ Z is given by π x (z) ∈ R. We denote the vector of these distances over the N perturbations in Z as Π x (Z) ∈ R N . Let Y ∈ [0, 1] be the vector of the black box predictions f (z) corresponding to each of the N instances in Z. LIME [2] and KernelSHAP [4] are popular model-agnostic local explanation approaches that explain predictions of a classifier f by learning a linear model φ locally around each prediction (i.e. y ∼ φ T z). The objective function for both LIME and KernelSHAP constructs an explanation that approximates the behavior of the black box accurately in the vicinity (neighborhood) of x.
The above objective function has the following closed form solution: The main difference between LIME and KernelSHAP lies in how π x (z) is chosen. In LIME, it is chosen heuristically: π x (z) is computed as the cosine or l 2 distance. KernelSHAP leverages game theoretic principles to compute π x (z), guaranteeing that explanations satisfy certain properties.

Our Framework: Bayesian Local Explanations
In this section, we introduce our Bayesian framework which is designed to capture the uncertainty associated with local explanations of black box models. First, we discuss the generative process and inference procedure for the framework. Then, we highlight how our framework can be instantiated to obtain Bayesian versions of LIME and SHAP. Lastly, we present detailed theoretical analysis for estimating the values of critical hyperparameters, and discuss how to efficiently construct highly accurate explanations with uncertainty guarantees using our framework.

Constructing Bayesian Local Explanations
Our goal here is to explain the behavior of a given black box model f in the vicinity of an instance x while also capturing the uncertainty associated with the explanation. To this end, we propose a Bayesian framework for constructing local linear model based explanations and capturing their associated uncertainty. We model the black box prediction of each perturbation z as a linear combination of the corresponding feature values (φ T z) plus an error term ( ) as shown in Eqn (4). While the weights of the linear combination φ capture the feature importances and thereby constitute our explanation, captures the error that arises due to the mismatch between our explanation φ and the local decision surface of the black box model f . Our complete generative process is shown below: The error term is modeled as a Gaussian whose variance relies on the proximity function π x (z) i.e., ∼ N (0, σ 2 πx(z) ). This proximity function ensures that perturbations closer to the data point x are modeled accurately, while allowing more room for error in case of perturbations that are farther away. π x (z) can be computed using cosine or l 2 distance or other game theoretic principles similar to that of LIME and KernelSHAP (see Section 2). The conjugate priors on φ and σ 2 are shown in Eqn (4). Note that, the distributions on error and feature importance φ both consider the parameter σ 2 . The fact that the prior on the feature importances considers σ 2 has an intuitive interpretation: if we have prior knowledge that the error of the explanation is small, we expect to be more confident about the feature importances. Similarly, if we have prior knowledge the error is large, we expect to be less confident about the feature importances.
Thus, our generative process corresponds to the Bayesian version of the weighted least squares formulation of LIME and KernelSHAP outlined in Eqn. (1), with additional terms to model uncertainty. As in Eqns. (4), the process captures two sources of uncertainty in local explanations: 1) feature importance uncertainty: the uncertainty associated with the feature importances φ, and (2) error uncertainty: the uncertainty associated with the error term which captures how well our explanation φ models the local decision surface of the underlying black box.
Inference Our inference process involves estimating the values of two key parameters: φ and σ 2 . By doing so, we can compute the local explanation as well as the uncertainties associated with feature importances and the error term. Posterior distributions on φ and σ 2 are normal and scaled Inv-χ 2 , respectively, due to the corresponding conjugate priors [22]: Further,φ, V φ , and s 2 can be directly computed: Details of the complete inference procedure including derivations of Eqns. (5)(6)(7) are provided in the Appendix A. Note that our estimate of the posterior mean feature importancesφ (Eqn. (6)) is the same as that of the feature importances computed in case of LIME and KernelSHAP (Eqn. (2)). Remark 3.1. If we use the same proximity function π x (z) in our framework as in LIME or Ker-nelSHAP, the posterior mean of the feature importanceφ output by our framework (Eq (6)) will be equivalent to the feature importances output by LIME or KernelSHAP, respectively.
Feature Importance Uncertainty To obtain the local feature importances and their associated uncertainty, we first compute the posterior mean of the local feature importancesφ using the closed form expression in Eqn. (7). We then estimate the credible interval (measure of uncertainty) around the mean feature importances by repeatedly sampling from the posterior distribution of φ (Eq (5)).

Error Uncertainty
The error term can serve as a proxy for explanation quality because it captures the mismatch between the constructed explanation and the local decision surface of the underlying black box. We first calculate the marginal posterior distribution of by leveraging Eqn (4) and integrating out σ 2 . This results in a three parameter Student's t distribution (derivation in appendix A): We then evaluate the probability density function (PDF) of the above posterior at 0, i.e., P ( = 0) by substituting the value of s 2 computed using Eqn. (7) into the Student's t distribution above (Eqn. (8)). The resulting expression gives us the probability density that the explanation output by our framework perfectly captures the local decision surface underlying the black box. This operation is performed in constant time, adding minimal overhead to non-Bayesian LIME and SHAP. We illustrate how these computed intervals capture the variance in the explanations in Figure 9. BayesLIME and BayesSHAP Our framework can be instantiated to obtain the Bayesian version of LIME by setting the proximity function to π x (z) = exp(−D(x, z) 2 /σ 2 ) where D is a distance metric (e.g. cosine or l 2 distance), and n 0 and σ 2 0 to small values (10 −6 ) so that the prior is uninformative. We compute feature importance uncertainty and error uncertainty for LIME's feature importances.
Our framework can also be instantiated to obtain the Bayesian version of KernelSHAP by setting uninformative prior on σ 2 and π x (z) = where |z| denotes the number of the variables in the variable combination represented by the data point z i.e., the number of non-zero valued features in the vector representation of z. Note that the original SHAP method views the problem of constructing a local linear model as estimating the Shapley values corresponding to each of the features [4]. These Shapley values represent the contribution of each of the features to the black box prediction i.e., f (x) = φ 0 + φ i . Therefore, the measures of uncertainty output by our method BayesSHAP capture the reliability of the estimated variable contributions.
To encourage BayesLIME and BayesSHAP explanations to be sparse, we can use dimensionality reduction or feature selection techniques as used by LIME and SHAP to obtain the top K features [2,4,23]. We can then construct our explanations using the data corresponding to these top K features.

Estimating the Number of Perturbations
One of the major drawbacks of approaches such as LIME and KernelSHAP is that they do not provide any guidance on how to choose the number of perturbations, a key factor in obtaining reliable explanations in an efficient manner. To address this, we leverage the uncertainty estimates output by our framework to compute perturbations-to-go (G), an estimate of how many more perturbations are required to obtain explanations that satisfy a desired level of certainty. This estimate thus predicts the computational cost of generating an explanation with a desired level of certainty and can help determine whether it is even worthwhile to do so. The user specifies the confidence level of the credible interval (denoted as α) and the maximum width of the credible interval (W ), e.g. "width of 95% credible interval should be less than 0.1" corresponds to α = 0.95 and W = 0.1. To estimate G for the local explanation of a data point x, we first generate S perturbations around x (where S is small and chosen by the user) and fit a local linear model using our method 2 . This provides initial estimates of various parameters shown in Eqns (5)-(7) which can then be used to compute G. Theorem 3.3. Given S seed perturbations, the number of additional perturbations required (G) to achieve a credible interval width W of feature importance for a data point x at user-specified confidence level α can be computed as: whereπ S is the average proximity π x (z) for the S perturbations, s 2 S is the empirical sum of squared errors (SSE) between the black box and local linear model predictions, weighted by π x (z), as in (7), and Φ −1 (α) is the two-tailed inverse normal CDF at confidence level α.
Proof (Sketch). To estimate G, we first relate W and α to Var(φ i ), the marginal variance of the feature importance 3 for any feature i, obtained by integrating out σ 2 . Because Student's t can be approximated by a Normal distribution for large degrees of freedom (here, S should be large enough), we use the inverse normal CDF to calculate credible interval width at level α. We compute V φ from (6) using Z, treating its entries as Bernoulli distributed with probability 0.5. Due to the covariance structure of this sampling procedure, the resulting variance estimate after N samples is the sample SSE s 2 S scaled by ≈ 4 π S N (derivation in appendix B). If we assume SSE scales linearly with S, we can take this to be a reasonable estimate of s 2 N at any N . We can then estimate G as

Focused Sampling of Perturbations
Perturbations-to-go (G) provides us with an estimate of how many samples are required to achieve reliable explanations. However, if G is large, querying the black-box model for its predictions on a large number of perturbations can be computationally expensive for larger models [24,25]. To reduce this cost, we develop an alternative sampling procedure called focused sampling which leverages uncertainty estimates to query the black box in a more targeted fashion (instead of querying randomly), thereby reducing the computational cost associated with generating reliable explanations. Inspired by active learning [26], focused sampling strategically prioritizes perturbations whose predictions the explanation is most uncertain about, when querying the black box. This enables the focused sampling procedure to query the black box only for the predictions of the most informative perturbations and thereby learn an accurate explanation with far fewer queries to the black box.
To determine how uncertain our explanation φ is about the black box label for any given instance z, we first compute the posterior predictive distribution for z (derivation in Appendix A), given We refer to this variance as the predictive variance var(ŷ(z)), and it captures how uncertain our explanation φ is about the black box prediction.
The focus sampling procedure first fits the explanation with an initial S perturbations (where S is a small number). We then iterate the following procedure until the desired explanation certainty level is reached. We draw a batch of A candidate perturbations, compute their predictive variance with the Bayesian explanation, and induce a distribution over the perturbations by running softmax on the variances with tempurature parameter τ . We draw a batch of B perturbations from this distribution and query the black box model for their labels. Finally, we refit the Bayesian explanation on all the labeled perturbations collected so far. We provide pseudocode for the uncertainty sampling procedure in Algorithm 1.

Algorithm 1 Focused sampling for local explanations
Require Initialize Z with S seed perturbations.

Experiments
We evaluate the proposed framework by first analyzing the quality of our uncertainty estimates i.e., feature importance uncertainty and error uncertainty. We also assess our estimates of required perturbations (G), and evaluate the computational efficiency of focused sampling. Last, we describe a user study with 31 subjects to assess the informativeness of the explanations output by our framework.
Setup We experiment with a variety of real world datasets spanning multiple applications (e.g., criminal justice, credit scoring) as well as modalities (e.g., structured data, images). Our first structured dataset is COMPAS [27], containing criminal history, jail and prison time, and demographic attributes of 6172 defendants, with class labels that represent whether each defendant was rearrested  [2,4]. For images, we construct super pixels as described in [2] and use them as features (number of super pixels is fixed to 20 per image). For our framework, the desired level of certainty is expressed as the width of the 95% credible interval.
Quality of Uncertainty Estimates A critical component of our explanations is the feature importance uncertainty. To evaluate the correctness of these estimates, we compute how often true feature importances lie within the 95% credible intervals estimated by BayesLIME and BayesSHAP. Note, that by true feature importance, we refer to the best fit linear model output using either the LIME or SHAP kernels. We evaluate the quality of our credible interval estimates by running our methods with 100 perturbations to estimate feature importances and taking the corresponding 95% credible intervals for each test instance. We compute what fraction of the true feature importances fall within our 95% credible intervals. Note, because there are no methods to provide uncertainty estimates for LIME and SHAP, we do not provide further baselines. Since we do not have access to the true feature importances of the complex black box models, following Prop 3.2, we use feature importances computed using a large value of N (N = 10, 000), and treat the resulting estimates as ground truth.
Results for BayesLIME in Table 1 indicate that the true feature importances are close to ideal and indicate the estimates are well calibrated. While the estimates by BayesSHAP are somewhat less calibrated (true feature importances fall within our estimated 95% credible intervals about 89.2 to 98.4% of the time), they still are quite close to ideal. All in all, these results confirm that the credible intervals learned by our methods are well calibrated and therefore highly reliable in capturing the uncertainty of the feature importances. Lastly, though we set our priors to be uninformative in general, we also investigate how sensitive our uncertainty estimates are to hyperparameter choices in Figure 5 in the Appendix. We find that the explanation uncertainty becomes uncalibrated with strong priors. However, our explanations seem to be robust to hyperparameter choices in general.

Correctness of Estimated Number of Perturbations
We assess whether our estimate of perturbations-to-go (G; Section 3.2) is an accurate estimate of the additional number of perturbations needed to reach a desired level of feature importance certainty. We carry out this experiment on MNIST data for the digit "4" (additional datasets explored in Appendix C) and use S = 200 as the initial number of perturbations to obtain a preliminary explanation and its associated uncertainty estimates. We then leverage these estimates to compute G for 6 different certainty levels. First, we observe significant differences in G estimates across instances (details in appendix C) i.e. number of perturbations needed to obtain a particular level of certainty varied significantly across instances-5e-3 6e-3 7e-3 8e-3 9e-3 1e-2 Desired W   Figure 2 show that the observed and desired levels of certainty are well calibrated, demonstrating that G estimates are reliable approximations of the additional number of perturbations needed.
Efficiency of Focused Sampling Focused sampling uses the predictive variance to strategically choose perturbations that will reduce uncertainty in order to be labeled by the black box (section 3.3).
Here, we will evaluate the efficiency of the focused sampling procedure. First, we assess whether focused sampling converges (as measured by error uncertainty (P ( = 0))) more efficiently than random sampling. To this end, we experiment with BayesLIME on Imagenet data for the "French bulldog" class to carry out this analysis. This setting replicates scenarios where LIME is applied to a computationally expensive black box model, making it highly desirable to limit the number of perturbations to reduce total running time. We run each sampling strategy for 2,000 perturbations and plot the number of model queries versus error uncertainty. During focused sampling, we set the batch size B to 50. The results in Figure 3 show that focused sampling results in faster convergence to reliable and high quality explanations; focused sampling stabilizes within a couple hundred model queries while random sampling takes over 1,000. Note, as the inefficiency of querying the black box model increases, the advantages of focused sampling decreasing total running time of the explanations will only become more pronounced. These results clearly demonstrate that focused sampling can significantly speed up the process of generating high quality local explanations. Additionally, in Appendix C, we also check if focused sampling causes any bias (due to sampling based on uncertainty estimates) that results in convergence to a different/wrong explanation, however our results clearly indicate that this is not the case.

Stability of BayesLIME & BayesSHAP
Recall that LIME & SHAP are not stable: small changes to instances can produce substantially different explanations. We consider whether BayesLIME & BayesSHAP produce more stable explanations than their LIME & SHAP counterparts. To perform this analysis, we use the local Lipschitz metric for explanation stability [18]: where x i refers to an instance, N (x i ) is the -ball centered at x i , and φ i and φ j are the explanation parameters for x i and x j . Lower values indicate more stable explanations. We follow the setup outline by Alvarez-Melis and Jaakkola [18] and compute the local Lipschitz values, comparing both LIME & BayesLIME and SHAP & BayesSHAP across Compas, German Credit, MNIST digit "4", and Imagenet "French Bulldog." We perform the comparison using the default number of perturbations in Focused Sampling Random Sampling Figure 3: Efficiency of focused sampling for 100 Imagenet "French bulldog" images, with random sampling as a baseline. We provide mean and standard error. We assess the efficiency of focused sampling by comparing error uncertainty over model queries and show quicker convergence than random sampling.  Figure 4: Assessing the % increase in stability of BayesLIME and BayesSHAP over LIME and SHAP respectively. Our Bayesian methods are significant more stable (ρ < 1e-2 according to Wilcoxon signed-rank test) except for BayesSHAP on German Credit, where there is not a significant difference between the methods (ρ > 0.05).
both LIME & SHAP, and use this same number in the respective Bayesian variants and set the batch size B to half this value. We use focused sampling for BayesLIME and BayesSHAP, and report the % increase in stability of these approaches over LIME and SHAP for 40 test points. The results given in Figure 4 show a clear improvement (on average 53%) in stability in all cases except German Credit for BayesSHAP. Further, we run a Wilcoxon signed-rank test and find our results are statistically significant in all cases (ρ < 1e-2) except for BayesSHAP for German Credit, where there is not a significant difference between the methods (ρ > 0.05). These results demonstrate BayesLIME and BayesSHAP are more stable than previous methods.

User Study
We perform a user study with 31 subjects to compare BayesLIME and LIME explanations on MNIST. We evaluate the following: are explanations with low levels of uncertainty (i.e., most confident explanations) more meaningful to humans? To answer this question, we follow prior work and mask the most important features selected by BayesLIME and LIME [32,4]. We ask users to guess the digit of the masked images. The better the explanation, the more difficult it should be for the users to get it right. Further, the choice to mask the important features is motivated by its success in prior work. We randomly select 15 correctly predicted test images, generate explanations by sweeping over a range of perturbation amounts [10 .5 , ..., 10 3.5 ] incremented by 0.5. We choose the top explanation for each image based on either fidelity (for LIME) or P ( = 0) (for BayesLIME). We sent the user study out to students and researchers with background in computer science. A screen shot of the task is shown in Figure 7 in the Appendix. We find that the explanations output by our methods focus on more informative parts of the image, since hiding them makes it difficult for humans to guess the digit. Users had an error rate of 25.7% for LIME, while it was 30.7% for BayesLIME, both with standard error 0.003 (ρ = 0.028 through a one-tailed two sample t-test). This result indicates that our method BayesLIME and the associated measure of explanation uncertainty result in more high quality and reliable explanations compared to LIME and its associated fidelity metric.

Related Work
Interpretability Methods A variety of interpretability methods have been proposed. Some methods that are inherently interpretable include additive models [33,34], decision lists and sets [35,36], and instance-based explanations [37]. However, black-box models are often more flexible, accurate, and easier to use; thus, there has been a lot of interest in constructing post hoc explanations [38]. These include LIME [2] and SHAP [4,39], which are among the most popular due to their broad applicability and code availability, but saliency maps [5][6][7][8], permutation feature importance [40], and partial dependency plots [41] also follow this paradigm. Other approaches to post hoc explanations focus on rule-based models [1,3], counterfactuals [42,43], and influence functions [9].

Vulnerabilities of Post hoc Explanations
Recent work has shed light on the downsides of post hoc explanation techniques. These methods are often highly sensitive to small changes in inputs [14], are susceptible to manipulation [15,16,44,45], and are not faithful to the underlying black boxes [46]. Perturbation-based explanation methods such as LIME and SHAP are subject to additional criticisms: results vary between runs of the algorithms [18-20, 47, 21], and hyperparameters used to select the perturbations can greatly influence the resulting explanation [20]. Prior work has attempted to tackle the problem of instability in perturbation-based explanations by averaging over several explanations [48,19], however, this is computationally expensive. Other works related to creating more trustworthy explanations include development of sanity checks for explainers [49,17,50]. These techniques represent an important step towards improved usability, given experimental evidence that humans are often too eager to accept inaccurate machine explanations [51][52][53][54]. Recent works theoretically analyze the sources of non-robustness in black box explanations [55][56][57].
Logical and Formal Reasoning Additional related works have considered explaining classifiers through identifying a subset of features that are "sufficient" to explain a prediction [58][59][60][61][62]. Though these methods offer strong guarantees surrounding which features ensure a prediction is achieved, they are not model agnostic. Further, they do not define feature importances associated with the local explanations nor consider ways to improve locally weighted explanations, such as LIME and SHAP.
Bayesian Methods in Explainable ML Few recent works have adopted Bayesian formulations to explain black box models [63][64][65]. Guo et al. [63] introduce a Bayesian non-parametric approach to fit a global surrogate model. Their formulation seeks to fit a mixture of generalizable explanations across instances. Zhao et al. [64] study whether incorporating informative priors improves the stability of the resulting explanations. However, neither of these works focus on modeling the uncertainty of local explanations. Further, these approaches also do not tackle the critical problems of estimating key hyperparameters or improving efficiency of computing explanations.

Conclusion
We developed a Bayesian framework for generating local explanations along with their associated uncertainty. We instantiated this framework to obtain Bayesian versions of LIME and SHAP that output pointwise estimates of feature importances as well as their associated credible intervals. These intervals enabled us to infer the quality of the explanations and output explanations that satisfied user specified levels of uncertainty. We carried out theoretical analysis that leverages these uncertainty measures (credible intervals) to estimate the values of critical hyperparameters (e.g., the number of perturbations). We also proposed a novel sampling technique called focused sampling that leverages uncertainty estimates to determine how to sample perturbations for faster convergence.
While the Bayesian framework addresses several critical challenges (i.e., consistency, stability, modeling uncertainty) associated with LIME and SHAP, there are still certain aspects where it would exhibit the same shortcomings as LIME and SHAP [4,66]. For instance, if the local decision surface of a given black box classifier is highly non-linear, our framework, which relies on local linear approximations, may not be able to capture this non-linear decision surface accurately. In addition, if the perturbation sampling procedures used in LIME and SHAP are used in BayesLIME and BayesSHAP, they will likely be vulnerable to the attacks proposed by Slack et al. [15]. In the future, it would be interesting to extend our framework to produce global explanations with uncertainty guarantees and explore how uncertainty quantification can help calibrate user trust in model explanations.

Acknowledgments
We would like to thank the anonymous reviewers for their insightful feedback. This work is supported in part by the NSF awards #IIS

A Derivations
Model Derivation We write the joint posterior as Lettingφ = (Z T diag(Π x (Z))Z + I) −1 Z T diag(Π x (Z))Y , we group terms in the exponentials according to φ. The intermediate steps can be found in [67]. Supressing dependence on Y and Z, we can write down the conditional posterior of φ as So, we can see that our estimates for the mean and variance of ρ(φ|σ 2 , Y, Z) areφ and σ 2 (Z T diag(Π x (Z))Z + I) −1 . Next, we derive the conditional posterior for σ 2 . We identify the form of the scaled inverse-χ 2 distribution in the joint posterior as in [22] and write where s 2 is defined as in equation 7.

B Proof of Theorems
In these derivations, the perturbation matrices Z have elements Z ij ∈ {0, 1} where each Z ij ∼ Bernoulli(0.5). Note, in these proofs, we take take the priors to be set as in BayesLIME and BayesSHAP, i.e., they have hyperparameter values close to 0.

B.1 Proof of Theorem 3.3
Note that we use N to denote the total perturbations while S denotes the perturabtions collected so far. We use three assumptions stated as follows. First,π N 2 is sufficiently large such atπ N 2 + 1 is equivalent toπ N 2 . Second, N is sufficiently large such that N + 1 is equivalent to N and N N −2 is equivalent to 1. Third, the product of Z T diag(Π x (Z))Z within V φ can be taken at its expected value. First, we state the marginal distribution over feature importance φ i where i is an arbitrary feature importance i ∈ d. This given as where V φ = (Z T diag(Π x (Z))Z + I) −1 . Recall each Z ij is given ∼ Bern(.5) we use the third assumption to write V φ isπ N 2 + 1 for the on diagonal elements andπ N 4 for the off diagonal elements.
We can see this is the case considering that each element in Z is a Bern(.5) draw. We drop the 1 s due to the first assumption.
Let k =π N 2 . It follows directly from Sherman Morrison that the i-th and j-th entries of V φ are given as We see that the diagonals are the same. Thus, we take the P T G estimate in terms of a single marginal φ i . Substituting in the s 2 estimate s 2 S and using the second assumption, we write the variance of marginal φ i as Because feature importance uncertainty is in the form of a credible interval, we use the normal approximation of Var(φ i ) and write where W is the desired width, α is the desired confidence level, and Φ −1 (α) is the two-tailed inverse normal CDF. Finally, we subtract the initial S samples.

B.2 Proposition 3.2
Before providing a proof for proposition 3.2, we note to readers that the claims are related to well known results in bayesian inference (e.g. similar results are proved in [68]). We provide the proofs here to lend formal clarity to the properties of our explanations. Consistency ofφ Recall the mean of φ, denotedφ given in equation 6. To establish consistency, we must show thatφ converges in probability to the trueφ as N → ∞. To avoid confusing trueφ with the distribution over φ, we denote the trueφ as φ * . Thus, we must showφ → p φ * as N → ∞. We writeφ Considering mean of is 0 and using law of large numbers, Convergence of Var( ) Assume we have N → ∞ soφ converges to φ * . The uncertainty over the error term is given as the variance of the distribution in equation 8. The variance of this generalized student's t distribution is given as converges to s 2 for large N . Recalling its definition, s 2 reduces to the local error of the model as N → ∞. which is equivalent to the squared bias of the local model.

C Detailed Results
In this appendix, we provide extended experimental results.

C.1 Explanation Uncertainty Hyperparameter Sensitivity
In the main paper, we assume the priors are set to be uninformative. Though this is the advised configuration for BayesLIME and BayesSHAP because prior information about the local surface is not likely available, we assess the calibration sensitivity of BayesLIME to different choices in the hyperparameters. In figure 5, we perform a grid search over the uncertainty hyperparameters n 0 and σ 2 0 for the MNIST digit "4" class. We find the explanation uncertainty is robust to the choice of hyperparameters. These results indicate BayesLIME calibration is not very sensitive to choices in the hyperparameter values.

C.2 PTG Estimate Results
In the main paper, we provided PTG results for BayesLIME on MNIST. In this appendix, we show the number of perturbations estimated by PTG and additional PTG results on the Imagenet "French bulldog" class.

Number of Perturbations Estimated by PTG
In section 4, we assessed if G produces good estimates of the number of additional samples needed to reach the desired level of feature importance certainty. In figure 6, we show the desired level of certainty (desired width of credible interval W ) versus the actual G estimate (i.e. the estimated number of perturbations) for figure 2 in the main paper. We see the estimated number of perturbations is highly variable depending on desired W .

Further PTG Estimate Results
We provide results for the PTG estimate on Imagenet in Figure 8. We limit the range of uncertainty values compared to MNIST because the Imagenet data is more complex and consequently the required number of perturbations becomes very high. These results further indicate the effectiveness of the PTG estimate.

C.3 User Study
Participate Consent We sent out an email to students and researchers with a background in computer science inviting them to take our user study. At the beginning of the user study, we stated that no Figure 6: Desired CI w versus the actual number of perturbations estimated by P T G in figure 2 of the main paper. We plot mean and standard deviation of G.
personal information would be asked during the study, their answers would be used in a research project, and whether they consented to take the study.

Image of interface
We give an example screen shot from the user study in Figure 7. BayesLIME Toy Example To show how our bayesian methods capture the uncertainty of local explanations, we provide an illustrative example in Figure 9. Rerunning LIME explanations on a toy decision surface (blue lines in the figure), we see LIME has high variance and produces many different explanations. This behavior is particularly sever in the nonlinear surfaces. With a single explanation, BayesLIME captures the uncertainty associated with generating local explanations (black lines in the figure).

C.4 Focused Sampling Results
In this appendix, we provide additional focused sampling results. We include a comparison of focused sampling to random sampling in terms of wall clock time. We also provide results demonstrating the focused sampling procedure is not biased.
Wall Clock Time of Focused Sampling In figure 10, we plot wall clock time versus P ( = 0). This experiment is analogous to figure 3 Figure 9: Rerunning LIME local explanations 1000 times and BayesLIME once for linear and nonlinear toy surfaces using few (25) and many (250) perturbations. The linear surface is given as p(y) ∝ x 1 and the non linear surface is defined as p(y) ∝ sin(x 1 /2) * 10 + cos(10 + (x 1 * x 2 )/2) * cos(x 1 ). We plot each run of LIME in blue and the BayesLIME 95% credible region of the feature importance φ in black. We see that LIME variance is higher with fewer samples and a less linear surface. BayesLIME captures the relative difficulty of explaining each surface through the width the credible region. For instance, BayesLIME is most uncertain in the nonlinear, few samples case because this surface is the most difficult to explain. Uncertainty Sampling Random Sampling Figure 10: Wall clock time needed to converge to a high quality explanation by BayesLIME (analogous to figure 3 in the paper). We use both random sampling and focused sampling over 100 Imagenet images. We provide the mean and standard error for binned estimates of these values. This result demonstrates that focused sampling leads to improved convergence over random sampling in terms of wall clock time.
model queries on the x-axis. We see that uncertainty sampling is more time efficient than random sampling for BayesLIME.

Bias of Focused Sampling
In the main text, we saw that focused sampling converges faster than random sampling. However, it is possible that focused sampling introduces bias into the process due to sampling based on uncertainty estimates, leading to convergence to a different/wrong explanation. To assess whether this occurs in practice, we evaluate the convergence of both focused sampling and random sampling to the "true" explanation on Imagenet (computed with the number of perturbations N = 10, 000 using random sampling). To measure convergence, we compare the L 1 distance of the explanation with the ground truth explanation. The result provided in Figure 11 demonstrates that focused sampling converges to the ground truth explanation with significantly fewer model queries than random sampling. Focused sampling reaches a L 1 distance of 0.1 at 300 queries while it takes upwards of 450 queries for random sampling, indicating improved query efficiency of 30 − 40%. Lastly, as the number of model queries increases (∼1000), we observe an L 1 distance of around 0.06 which is extremely small and the explanations are practically the same as the ground truth. Overall, these results show that focused sampling does not suffer from biases in practice and further demonstrate that focused sampling can lead to significant speedups. Figure 11: Convergence of both focused sampling and random sampling to the ground truth explanation. We see that uncertainty sampling converges more quickly to the ground truth than random sampling, demonstrating that there is minimal bias in the focused sampling procedure and focused sampling converges more efficiently.

C.5 Benchmarking
We also benchmark the efficiency of BayesLIME and BayesSHAP against Guo et al. [63], a related Bayesian explanation method that uses a Bayesian non parametric mixture regression and MCMC for parameter inference. Fixing their mixture regression to a single component results in a similar model to ours and thus is a useful point of comparison. To explain a single instance on ImageNet using VGG16, their approach takes 139.2 seconds, while BayesLIME and BayesSHAP take 20.3 seconds and 21.1 seconds respectively, under the same conditions, demonstrating that the closed form solution is very efficient.

D Explaining a Ground Truth Function
We consider a synthetic experiment in which we observe an underlying ground truth function and verify that lower values of feature importance uncertainty indicate higher proximity between the feature importance estimates and the underlying ground truth function. To this end, we constructed a piecewise linear function of two variables, where each quadrant in the x,y-plane corresponds to a different linear model. We consider the regression coefficients of the quadrant as the ground truth explanation. The piecewise function is given as: f (x, y) = 0.3x + 0.2y if x > 0, y > 0 (26) 0.2x − 0.1y if x > 0, y ≤ 0 − x − 0.05y if x ≤ 0, y ≤ 0 − .8x + 0.2y if x ≤ 0, y > 0 We plot the 1 distance between the BayesLIME feature importance mean and ground truth explanation versus the maximum credible interval width of the BayesLIME explanation. The results given in Figure 12 indicate that tighter credible intervals lead to explanations that are closer to the ground truth, demonstrating that the feature importance uncertainties are meaningful in regards to a ground truth function.

E Compute Used
In this work, we ran all experiments on a single NVIDIA 2080TI & a single NVIDIA Titan RTX GPU.

F Dataset licenses
German Credit is in the public domain, COMPAS uses the MIT license, MNIST uses the Creative Commons Attribution-Share Alike 3.0 license, and Imagenet does not hold copyright of images. Figure 12: Assessing whether tighter credible intervals lead to convergence with ground truth, on an example where the ground truth feature importances are known. Here, we plot The 1 distance between the feature importances menas for BayesLIME and ground truth explanation versus the maximum credible interval width across the explanation.