DEXTER: Diffusion-Guided EXplanations with TExtual Reasoning for Vision Models

We appreciate the reviewer’s careful reading of our paper and the insightful feedback. Below, we respond to the main questions (Q), aiming to clarify and strengthen our contribution.

[Q1 - Unorganized method illustration]

We acknowledge that Sections 3.1–3.3 involve several interdependent steps and notations, which may appear complex at first read. To improve clarity, we will revise the paper to include:

• A streamlined algorithm-style summary of the full pipeline;
• An updated illustration (Figure 1) that explicitly shows the data flow across components;
• A glossary clarifying key notations (e.g., M, K, V, agg, act). For clarity, here is a high-level overview of the pipeline:

1. Section 3.1 main paper
   • We begin with a visual classifier that we want to investigate if it is biased on a class (e.g. "bee")
   • We form the input for a BERT model as follows: [Soft Prompt] + ["A picture of a"] + [Masked Tokens]
   • The BERT model is tasked with predicting the masked tokens, in the initial steps, it will likely predict the most common words it is pretrained on (e.g. "man")
   • The predicted BERT token is translated into the corresponding CLIP token using the Gumbel Softmax and the translation matrix defined in Sec. 3.1 as $M$.
2. Section 3.2 main paper
   • This token is then encoded with the sentence "A picture of a" using a CLIP Text Encoder to form the encoded sentence "A picture of a [PREDICTED CLIP TOKEN]"
   • This encoded sentence is used to text-condition a Stable Diffusion model and generate a corresponding image
   • The generated image is then classified using the investigated visual classifier, and a cross-entropy (CE) loss is obtained.
3. Section 3.3 main paper
   • To update the soft prompt we sum the cross-entropy with the masked loss (w.r.t. the pseudo-label obtained in the previous iteration as described in 9-10) and backpropagate across the full pipeline
   • We update the dictionary where we store the historical CE losses for each token
   • To supplement the weak training signal, on successive iterations, we use the token having the lowest mean historical loss as a pseudo-label to supervise the future predicted BERT tokens with a masked loss. This allows us to boost the training signal when updating the soft prompt
   • Over many iterations, the soft prompt will condition the BERT encoder to predict the most relevant word to maximize the model's prediction of the investigated class. In the Figure 1 example, the model's most relevant word is "flower" when maximizing the class "bee". This indicates that the model is inherently biased on the "bee" class.

These clarifications and structural improvements will be included in the final version.

[Q2 - Insufficient details for some key steps]

We thank the reviewer for the observation. In the case of RobustResNet50, neural feature selection is guided by pseudo-ground truth from Salient ImageNet, which is precisely why we chose this model for our in-depth evaluation. For other classifiers lacking such annotations, the subset of reference neurons used to compute the aggregated activation loss $\mathcal{L}_{\text{agg}, i}$ is defined statically before optimization and remains fixed throughout. Specifically, we select the top-k neurons $\{n_1, …, n_k\}$ in the penultimate layer with the highest connection weights to the target class output. This ensures that optimization is consistently influenced by the most class-relevant neurons. We will clarify this detail more explicitly in the revised version. We will clarify this point more explicitly in the revised version.

We thank the reviewer for the careful evaluation of our work and the thoughtful comments. In the following, we provide clarifications and further insights in response to the weaknesses (W) and questions (Q) raised.

[W1 – Computational Demand]

We appreciate the reviewer’s observation. As noted in the limitations section, DEXTER’s optimization involves multiple frozen models, which can be resource-intensive. To mitigate this, we adopt half-precision arithmetic and latent-consistent diffusion, which significantly reduce runtime. While the prompt optimization step takes ∼10 minutes per class, the final explanation generation is very efficient (∼15 seconds), making the framework practical for offline, global interpretability tasks.

[W2 – Optimization Difficulty of Activation Objective]

We agree that the activation maximization loss alone can lead to slow convergence. The auxiliary pseudo-label loss was introduced specifically to address this issue, and as shown in our ablation (Table 4), it substantially improves performance, especially in multi-word scenarios. We see this not as a workaround, but as a targeted mechanism to improve convergence and interpretability.

[W3 – Spurious Object Generation by Diffusion Model]

We acknowledge that diffusion models may generate elements beyond the text prompt. However, our optimization loop includes feedback from the classifier, which gradually narrows the generation space to align with the desired activation patterns. As a result, off-topic generations tend to be rare and are filtered out over time. This is particularly effective in slice discovery, where consistency across images is critical.

[W4 – Vocabulary and Generative Constraints]

We agree that the intersection of vocabularies and model capabilities can limit the expressiveness of the generated explanations. However, the modular nature of our framework allows for straightforward integration of improved components, such as larger MLMs or more expressive diffusion models. We see this as a promising direction for future enhancement.

[Q1 – Activation Scores in Tables 3 and 4]

Tables 3 and 4 report the mean activation scores across the 30 classes analyzed by DEXTER. For each class, we generated 100 images using the optimized prompt (e.g., for the class “ski,” 77 out of 100 generations activated the target neuron). The reported scores reflect the average number of successful activations per class. As requested, we also provide the corresponding standard deviations. These may appear high due to the variation in activation strength across different classes, some classes are consistently activated, while others only partially so. For instance, while some classes were activated in 100 out of 100 generations, others only in 20 out of 100. As a result, this large variation across classes naturally leads to a high overall standard deviation. As requested by the reviewer, below we report the scores from Tables 3 and 4, followed by their corresponding standard deviations:

Tab. 3 main paper: Comparison between text-prompting strategies for maximizing the target class.

Tab. 4 main paper: Ablation results for single-word and multi-word prompt optimization, with/without the auxiliary task $\mathcal{L}_{mask}$.

Importantly, across all conditions, DEXTER achieves both higher average activation scores and lower standard deviations compared to previous methods, indicating more robust and consistent performance. We will include this clarification and full results in the final version.

[Questions 2 and 3 - Selection of top-k words from Table 7]

The top-k words in Table 7 (Appendix C) were obtained by running the DEXTER pipeline multiple times (specifically k=4 timeless). In each run, we recorded the final (only one) pseudo-token selected by the masked language model at the end of the optimization. To encourage diversity across runs, we excluded previously selected words from the candidate pool before each new run. We fully agree that using ranked words, rather than only one, would provide valuable insight into the optimization process and the identification of spurious correlations. Indeed, we adopted a similar ranking procedure in other parts of our framework (e.g., in the bias report and activation score evaluation), specifically:

• We track all candidate prompts (e.g., “a picture of a [WORD] with [WORD]…”) generated during optimization.
• For each, we compute an activation score by generating 100 images and measuring how many are classified as the target class.
• The prompt with the highest activation score is selected as the final output.

However, as suggested, we also evaluated how using sampling frequency ranking may affect slice discovery results. In particular, we computed results using word frequency–based ranking, evaluating performance with the top k = 5 and k = 10 most frequent words. We compare these results against our proposed sampling strategy and B2T for reference. As shown, our strategy with a single word yields superior performance.

We believe the above results can be explained with the fact that running multiple independent optimizations, each targeting a single word and discarding previously discovered ones, encourages exploration of diverse semantic directions. In contrast, a single optimization run using the top-k words tends to converge quickly and remains confined to a narrow neighborhood of semantically related tokens. This behavior limits the variety of the discovered words and, consequently, the coverage of distinct slices. Nonetheless, we agree that a more systematic analysis of the full distribution of sampled words, as well as the design of more efficient selection strategies, represents a promising direction for future work.

Regarding the analysis on how DEXTER compensates for bias propagation in Appendix G.1, we recorded the sequence of words selected as pseudotargets during optimization. This was done for both the biased setting (i.e., under the same conditions as those reported in Appendix G.1) and the standard setting, where the initial pseudotarget is chosen randomly. As shown in the table below, in both cases DEXTER consistently converges toward the most meaningful word, with the selection path gradually shifting from a random concept to the intended target. This trajectory suggests that the optimization process does not simply lock onto the first spurious or core concept it encounters, but instead explores a range of semantically plausible candidates before progressively refining the prompt toward a stable and interpretable solution, indicating a non-greedy and convergent behavior rather than an early commitment driven by the mask pseudo-label loss. Convergence analysis through keyword trajectory during the DEXTER optimization process. The table illustrates how DEXTER transitions from initially random concepts to progressively more semantically coherent and domain-specific words, demonstrating convergence toward a stable explanation.

We will include these details in the revised Appendix and clarify how it complements the simpler last-token strategy used for Table 7.

[Suggestions: The results in Section 4.2 are a bit hard to parse… / There are a few typos that should be fixed…]

We will revise the results and captions in Section 4.2 and Tables 3–4 to improve clarity. Specifically, we will add the following explanation:

“We generate 100 images per class and report the percentage of images that activate the target class.”

We also thank the reviewer for spotting the typos in the loss term $\mathcal{L}_{\text{mask}}$ (page 9, lines 319 and 322), which will be corrected.

We thank the reviewer for the careful evaluation of our work and the thoughtful comments. Below, we address the identified weaknesses (W) and limitations (L), providing clarifications and details to improve the manuscript’s clarity and rigor.

[W1 - Formalization of generating bias reasoning and slice discovery]

Appendices C and D already provide high-level explanations of the two methods. In the final version, we will include the following explicit formulations for bias reasoning and slice discovery, emphasizing that both are fully dataset-independent, relying only on model behavior without access to training data or labels.

Formalization of slice discovery

DEXTER performs slice discovery without using training data. Given a classifier f and a target class c, it optimizes a text prompt to extract a set of top-k class words $W_c = {w_{c1}, \ldots, w_{ck}}$. Each word $w_{ci}$ is encoded using CLIP’s text encoder to obtain an embedding $t_{ci}$, and the class prototype is defined as the average embedding: $\bar{t}c = \frac{1}{k} \sum t_{ci}$.

At inference time, each image $x_j$ is encoded into $v_j$ using CLIP’s image encoder. The similarity between the image and the class is then computed as: $\text{CLIPScore}(x_j, c) = \text{similarity}(v_j, \bar{t}_c)$. The predicted class $\hat{y}_j$ is the one with the highest similarity.

In binary classification settings, slices are defined by prediction outcomes:

• If $\hat{y}_j = y_j$, the image is assigned to the unbiased slice.
• Otherwise, it belongs to the biased slice.

Prompt optimization does not require access to the dataset, which is only used for scoring. This approach aligns with prior definitions of slices (e.g., Kim et al.) as input subgroups where the classifier exhibits systematic bias. While DEXTER performs slice discovery using class neurons, it also supports feature neurons, allowing broader applications (see Sec. 4.2.1).

Formalization of bias reasoning

Given a classifier f and class c, we optimize a prompt $t^*$ such that a diffusion model generates images ${x_1, \ldots, x_M}$ that maximize the classifier’s output for c. Each generated image is captioned using a vision-language model g, producing descriptions $d_i = g(x_i)$. A language model h then summarizes the captions into a single report $r_c = h(d_1, \ldots, d_M)$, describing the features associated with class c and possible biases. This process is fully data-free: both image generation and reasoning depend only on the model’s behavior. As shown in Appendix D, the resulting explanations align well with those derived from real data.

[W2 - Number of P in soft prompts]

We set P = 1 to keep the setup minimal and stable. In DEXTER, the soft prompt guides BERT in selecting hard tokens via masked language modeling, rather than encoding semantics directly. Expressiveness comes from composing multi-token prompts (typically 5–6; see Appendix A), not from prompt dimensionality. Experiments with P > 1 show that increasing P expands the parameter space and weakens the classifier’s gradient signal, destabilizing optimization in our data-free setting, as shown by these results:

[W3 – Determining key neural features]

We used RobustResNet50 for neural feature selection due to the availability of pseudo-ground truth from Salient ImageNet. For other classifiers (Appendix D.3), we ranked penultimate-layer neurons by their weights to each class and selected the top 5, mirroring the Salient ImageNet method but without any training data. This highlights DEXTER’s fully data-independent design.

[W4 - $n = f(d(e))$ --> diffusion model is applied once]

While the diffusion model is invoked once per optimization step, its diffusion process consists of 4 denoising steps. We will include this detail in Appendix A.

[W5 - Formula (2)]

Correct. For class neurons (bounded in $[0,1]$), we use $\log(n_i)$ to encourage confident predictions. For unbounded feature neurons, we use a linear objective ($–n_i$) to directly maximize activation.

[W6 - Randomness in diffusion's inference step]

This is an important point. To assess the stability of Stable Diffusion, we performed intra-class evaluation using DEXTER’s final prompt. Across three independent runs (100 images each), we measured activation scores with the target model. If generation were unstable, scores would vary significantly; instead, consistent results indicate stability. We report mean and standard deviation for 8 randomly selected classes (4 core, 4 spurious) across three independent runs:

[W7: $o_i^{(C)} = Mo_i$ incorrect]

Right. The formula is $o_i^{(C)} = o_i M$ and will be corrected in the final revision.

[W8 - Explanation for DEXTER preferring conceptual while DiffExplainer perceptual ones]

DEXTER conditions generation via text: it optimizes a BERT-based prompt decoded into a multi-token hard prompt for a text-to-image diffusion model, yielding semantically rich outputs. DiffExplainer instead optimizes a soft prompt in the diffusion latent space, without language supervision, often producing low-level patterns (e.g., texture, color) with less semantic coherence. This difference explains why DEXTER generates more conceptually grounded images, as shown in Figure 3 and confirmed by our user study (Appendices B.2, F).

[W9 - Formula (4)]

We have corrected the indices in the formula:

$$\mathcal{L} = \sum_{k=1}^K l_{\text{act}}(n_k) - \sum_{i=1}^N \log s_{i,y_i}$$

[W10 - Semantic CLIP-IQA vs CLIP-IQA scores]

The higher Semantic CLIP-IQA scores are not due to better image quality, but due to the use of class-specific prompts (e.g., “a good photo of a [CLASS]”), which enhance semantic alignment. In contrast, standard CLIP-IQA uses a generic prompt, lacking class-level grounding. As a result, the two metrics are not directly comparable, as prompt design influences the similarity evaluation.

[L1 - Dependence on foundation models]

While explanation quality depends on the underlying foundation models, DEXTER’s modular design supports easy adaptation to other domains. In medical imaging, for example, it can integrate models like PubMedBERT for prompts and diffusion models trained on X-rays or MRIs. This requires careful model selection to align medical terms with visual content, but does not alter DEXTER’s core architecture or functioning.

[L2 - DEXTER Generalization]

The reviewer raised three important issues: (1) generalization to other visual classifiers, (2) applicability to tasks beyond classification, and (3) scalability to instance-level explainability.

1. We chose RobustResNet50 for main experiments due to biased annotations in Salient ImageNet. However, as shown in Appendix D.3, we also applied DEXTER to AlexNet, ResNet50, and ViT. Results show consistent ability to investigate model-specific bias across both CNNs and transformers. For instance, Jeep shows bias in AlexNet/ResNet50 but not in ViT/RobustResNet, while Snorkel shows bias across all models.

2. DEXTER was designed for image classification, producing class-level global explanations. We acknowledge that tasks like detection or segmentation involve instance-level, spatial outputs. While not yet applied to these tasks, DEXTER’s modular design could support extensions—e.g., by conditioning on predicted regions or masks. Enabling such reasoning would require additional mechanisms and is a promising direction for future work.

3. DEXTER was designed to provide class-wise, global interpretable insights into the decision-making process of a visual classifier. By construction, it does not target per-sample (instance-level) explainability and may overlook fine-grained variations that are better captured by local methods (e.g., GradCAM, IG, LIME-X). However, while it doesn’t produce per-sample explanations, combining it with slice discovery enables subgroup-level conceptual explanations, thus offering a path toward multi-level interpretability.

[Minor comments]

Due to space constraints, we address minor comments 1–3 collectively.

1. The words generated by DEXTER indicate whether a class relies on spurious features. Core classes yield words closely aligned with the label, while spurious ones produce unrelated or contextual terms (e.g., “snow” or “trees” for dogsled). To capture this, we use multiple mask tokens, enabling richer, more informative prompts. Core classes show token convergence; spurious ones diverge. Recovering the class label suggests the classifier focuses on meaningful, non-spurious features.

2. We agree and will revise the statement. While DiffExplainer [31] briefly mentions text explanations (Sec. 4.4), DEXTER extends this with a full pipeline that optimizes prompts for both image generation and semantic explanation. We will clarify this connection in the final version.

3. We acknowledge the potential for LLM hallucinations. To address this, we implemented mitigation strategies and evaluated consistency in Appendix G.2. By linking visual activation cues to generated text and measuring alignment (Table 10), we show that DEXTER’s explanations are generally robust and reliable to LLM hallucinations.

Thank the authors for your detailed responses. They have addressed successfully most of my concerns. I hope the clarification and the additional important contents in the responses can be well integrated into revised version of the paper. Due to the limitations of the proposed framework included in my reviews, I couldn't increase my score.

Thanks