Paper deep dive

UNBOX: Unveiling Black-box visual models with Natural-language

Simone Carnemolla, Chiara Russo, Simone Palazzo, Quentin Bouniot, Daniela Giordano, Zeynep Akata, Matteo Pennisi, Concetto Spampinato

Year: 2026Venue: arXiv preprintArea: cs.CVType: PreprintEmbeddings: 63

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%

Last extracted: 3/13/2026, 12:52:46 AM

Summary

UNBOX is a data-free, gradient-free, and backpropagation-free framework for class-wise model dissection of black-box visual classifiers. It uses Large Language Models (LLMs) and text-to-image diffusion models to perform semantic optimization in text space, iteratively refining natural-language descriptors that maximally activate target output neurons. The method enables auditing, bias detection, and failure analysis without requiring access to model internals or training data.

Entities (5)

UNBOX · framework · 100%CelebA · dataset · 95%ImageNet-1K · dataset · 95%Large Language Models · technology · 95%Waterbirds · dataset · 95%

Relation Signals (3)

UNBOX → evaluatedon → ImageNet-1K

confidence 95% · We evaluate UNBOX on ImageNet-1K, Waterbirds, and CelebA through semantic fidelity tests.

UNBOX → leverages → Large Language Models

confidence 95% · UNBOX leverages Large Language Models and text-to-image diffusion models to recast activation maximization.

UNBOX → performs → Model Dissection

confidence 95% · UNBOX performs class-wise model dissection by searching directly in text space.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Ensuring trustworthiness in open-world visual recognition requires models that are interpretable, fair, and robust to distribution shifts. Yet modern vision systems are increasingly deployed as proprietary black-box APIs, exposing only output probabilities and hiding architecture, parameters, gradients, and training data. This opacity prevents meaningful auditing, bias detection, and failure analysis. Existing explanation methods assume white- or gray-box access or knowledge of the training distribution, making them unusable in these real-world settings. We introduce UNBOX, a framework for class-wise model dissection under fully data-free, gradient-free, and backpropagation-free constraints. UNBOX leverages Large Language Models and text-to-image diffusion models to recast activation maximization as a purely semantic search driven by output probabilities. The method produces human-interpretable text descriptors that maximally activate each class, revealing the concepts a model has implicitly learned, the training distribution it reflects, and potential sources of bias. We evaluate UNBOX on ImageNet-1K, Waterbirds, and CelebA through semantic fidelity tests, visual-feature correlation analyses and slice-discovery auditing. Despite operating under the strictest black-box constraints, UNBOX performs competitively with state-of-the-art white-box interpretability methods. This demonstrates that meaningful insight into a model's internal reasoning can be recovered without any internal access, enabling more trustworthy and accountable visual recognition systems.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

62,805 characters extracted from source content.

Expand or collapse full text

UNBOX: Unveiling Black-box visual models with Natural-language Simone Carnemolla 1* , Chiara Russo 1 , Simone Palazzo 1 , Quentin Bouniot 2,3 , Daniela Giordano 1 , Zeynep Akata 2,3 , Matteo Pennisi 1† , Concetto Spampinato 1† 1 University of Catania. 2 Technical University of Munich. 3 Helmholtz Munich. *Corresponding author(s). E-mail(s): simone.carnemolla@phd.unict.it; Contributing authors: chiara.russo1@phd.unict.it; simone.palazzo@unict.it; quentin.bouniot@tum.de; daniela.giordano@unict.it; zeynep.akata@tum.de; matteo.pennisi@unict.it; concetto.spampinato@unict.it; † Equal supervision. Abstract Ensuring trustworthiness in open-world visual recognition requires models that are interpretable, fair, and robust to distribution shifts. Yet modern vision systems are increasingly deployed as pro- prietary black-box APIs, exposing only output probabilities and hiding architecture, parameters, gradients, and training data. This opacity prevents meaningful auditing, bias detection, and failure analysis. Existing explanation methods assume white- or gray-box access or knowledge of the training distribution, making them unusable in these real-world settings. We introduce UNBOX, a framework for class-wise model dissection under fully data-free, gradient-free, and backpropagation-free constraints. UNBOX leverages Large Language Models and text-to-image diffusion models to recast activation maximization as a purely semantic search driven by output probabilities. The method produces human-interpretable text descriptors that maximally activate each class, revealing the concepts a model has implicitly learned, the training distribution it reflects, and potential sources of bias. We evaluate UNBOX on ImageNet-1K, Waterbirds, and CelebA through semantic fidelity tests, visual-feature correlation analyses and slice-discovery auditing. Despite operating under the strictest black-box constraints, UNBOX performs competitively with state-of-the-art white-box interpretabil- ity methods. This demonstrates that meaningful insight into a model’s internal reasoning can be recovered without any internal access, enabling more trustworthy and accountable visual recognition systems. Keywords: open-world, multimodal-agents, textual-optimization, explainability 1 Introduction Can the reasoning of a visual classifier be uncov- ered when the model is treated as a complete black box, with no access to its architecture, class defini- tions, training data, or learned weights? As visual recognition increasingly relies on large proprietary models offered exclusively as inference APIs, this 1 arXiv:2603.08639v1 [cs.CV] 9 Mar 2026 question has become central to trustworthy AI. In such deployments, users only observe output prob- abilities while all internal computations remain hidden, making it extremely difficult to under- stand why a classifier behaves the way it does, to diagnose failures, or to assess robustness and fairness in open-world settings. A substantial body of work has explored the dissection of visual recognition models, aiming to uncover the internal concepts and mechanisms that drive their predictions. Local explanation methods, particularly Natural Language Explana- tions (NLEs) [1–5], focus on per-sample reasoning and often rely on multimodal supervision or VQA- style pipelines. In contrast, global explanation and model-dissection approaches aim to charac- terize a model’s overall conceptual space or the semantic attributes encoded in its representa- tions. Recent methods such as DiffExplainer [6], DEXTER [7], and CLIPDissect [8] use LLMs, diffusion models, or vision-language embeddings to optimize class-level descriptors, expose spuri- ous features, or assign semantic labels to inter- nal units and neurons. While these approaches provide valuable insight, they rely on access to model internals (weights, gradients, activations) or probing datasets. Other explanation strategies assume knowledge of the training distribution or annotated data. Consequently, none of these tech- niques can be applied in a black box scenario, where a model is only available through an API with no visibility into its architecture, parameters, or training data. This gap emphasizes the need for a method that can perform global, class-wise model dissec- tion using only a model’s output probabilities. Meeting this requirement demands a conceptual shift: rather than optimizing in feature space through gradients, which is impossible in black- box settings, we propose explanation as a seman- tic search problem driven entirely by natural language. Recent advances in textual optimiza- tion, such as TextGrad [9], show that LLM- mediated feedback can approximate gradient sig- nals in non-differentiable systems, suggesting a promising direction for black-box interpretability. Motivated by this insight, we reformulate activa- tion maximization as a gradient-free optimization loop carried out purely in text space. Building on this idea, we introduce UNBOX, a class-wise explanation framework that is entirely data-free, gradient-free, and backpropagation-free. UNBOX discovers human-interpretable textual descriptors that strongly activate a target class using only the classifier’s output probabilities. The method combines a text-to-image diffusion model with an agentic, LLM-driven optimization mechanism that iteratively refines a natural-language descrip- tor for the target output neuron. A semantic guid- ance signal directs two cooperating LLM agents: one produces structured feedback and the other updates the descriptor. To ensure stability and prevent collapse onto narrow or transient descrip- tors, UNBOX maintains a lightweight global and local optimization context that accumulates con- sistently high-reward prompts and salient lexical units while also tracking recent refinement steps. Through this combination, activation maximiza- tion is reformulated as a semantic optimization problem, enabling global model dissection with- out access to model architecture, parameters, or training data. We evaluate UNBOX on ImageNet-1K [10], Waterbirds [11], and CelebA [12] through a com- prehensive set of complementary tasks designed to assess fidelity, grounding, and practical util- ity. To measure semantic faithfulness, we compare our recovered descriptors against ground-truth class names and against descriptors extracted from training images via automated captioning. To assess practical auditing capability, we use the descriptors to perform slice-discovery analysis on Waterbirds and CelebA, revealing spurious corre- lations and enabling debiasing despite having no access to training data or model internals. Across all tasks, UNBOX achieves performance com- petitive with, and in several cases approaching, methods that rely on weights, gradients, or full training datasets, demonstrating its effectiveness as a fully black-box model-dissection tool. To summarize, our main contributions are: • A fully data-free and gradient-free framework for global model dissection. UNBOX recon- structs class-level semantic concepts using only output probabilities, reformulating activation maximization as a text-space semantic opti- mization problem guided by diffusion-based evidence and agentic LLM reasoning. • A principled textual optimization mechanism that enables iterative refinement of descriptors through structured natural-language feedback 2 without access to model weights, gradients, or training data. • Extensive evaluation across semantic, visual, and fairness-oriented tasks, showing that UNBOX produces descriptors that are coher- ent, visually grounded, and effective for down- stream auditing, including slice discovery and debiasing, despite operating in the strictest black-box setting. • Human validation of interpretability, demon- strating that the recovered descriptors are accu- rate, meaningful, and competitive with those produced by leading white-box explainability methods. 2 Related work A large body of work seeks to interpret visual classifiers by uncovering the internal concepts and mechanisms driving their predictions. Approaches differ along two axes: intrinsic methods, which build interpretable models from the outset [13, 14], and post-hoc methods, which dissect pre- trained models to explain how they arrive at their decisions [7, 8, 15, 16]. Both types of meth- ods may provide local explanations for individual samples or global explanations describing the con- ceptual structure of the entire model. UNBOX belongs to the latter category: a global post-hoc method for model dissection and explainability. In this section, we review prior work based on the assumptions they make about model and data access. We first review attribution-based approaches, which offer local insights but no global semantic structure. We then cover concept- based methods, that provide richer explanations but require internal weights, activations, or anno- tated concepts. Next, we examine global language- driven explanatory methods that perform textual optimization without explicit annotated probes. Finally, we discuss slice-discovery and debiasing frameworks that rely on access to the underlying data. Attribution-based local explainability. Early explainability work focused on attribution meth- ods that highlight which regions of an input image influence a model’s prediction the most. These include feature visualization and saliency- map approaches [15, 17, 18], improved later by diffusion-based activation maximization tech- niques such as DiffExplainer [6]. Other refine- ments expanded feature attribution to gradient- based methods [15, 19, 20] and perturbation-based methods [21, 22]. While these methods provide fine-grained insights, they are inherently local, often noisy, and require human interpretation to infer the underly- ing semantic concepts [23]. Model-agnostic surro- gates such as LIME [24] and SHAP [25] attempt to explain predictions via simpler proxy models but inevitably suffer from information loss. These methods cannot perform global model dissection and cannot operate in black-box settings, as they require model queries beyond class probabilities, gradients, or feature maps. Concept-based methods aim to provide global explanations through human-interpretable semantic "concepts" (e.g., textures, colors, shapes, parts). Traditional approaches such as T-CAV [26], T-CAR [27], IBD [28], and CRAFT [29] require annotated examples or segmentation supervision to identify the relevance of concepts within internal layers. More advanced variants perform neuron- or filter-level concept assignment. NetworkDissec- tion [30] and Net2Vec [31] link feature maps to interpretable units; CAE [32], HINT [33], and MILAN [34] improve concept localization and reduce annotation dependency. Other methods exploit CLIP embeddings: CLIPDissect [8] labels neurons with open-ended concepts, CounTEX [35] generates counterfactual explanations, and W [16] combines Shapley scores and neuron activation maps to answer the what/where/why of a decision. Parallel to these, Natural Language Explanations (NLEs) [1–5] generate textual ratio- nales for predictions but are predominantly local, supervised, and task-dependent. All these methods require access to model internals (weights, activations, layers, features) or annotated concepts. None can operate with only output probabilities, nor can they fully reconstruct class-level conceptual structures of a black-box model. Global language-driven model dissection. Several recent methods have explored using textual optimization or generative models for 3 concept-based explanations without explicit anno- tated probes. TEXplain [36], GIFT [37], and DEXTER [7] generate class-level descriptors through textual or multimodal optimization. However, these methods still depend on gradi- ents, internal representations, or feature activa- tions, and thus remain incompatible with strict black-box settings. UNBOX advances beyond these approaches by performing global, class-wise textual opti- mization without any access to data, weights, gradients, or internal activations. Slice discovery and debiasing. Slice discov- ery seeks to identify coherent subsets of data where a model fails systematically, often as a result of spurious correlations or hidden stratifi- cation [38]. Modern approaches such as B2T [23] and LADDER [38] rely on vision–language models or retrieved text to infer slices that lack explicit annotations. Distributionally Robust Optimiza- tion (DRO) [11] and its refinements [39–42] are then used to mitigate worst-group errors. Although slice discovery and debiasing are not the primary objectives of UNBOX, we show that the descriptors our method uncovers can be effectively used in slice-sensitive analysis and debi- asing, performing competitively with approaches that require data access or model internals. 3 The UNBOX Method UNBOX performs class-wise model dissection by searching directly in text space for a natural- language prompt that maximally activates a tar- get output neuron of a black-box classifier. The method is organized into two complementary com- ponents. First, the semantic optimization mecha- nism interprets the temporal evolution of the clas- sifier’s output probabilities and translates this sig- nal into structured natural-language instructions that iteratively refine the prompt. Second, the global and local optimization context stabilizes this refinement process by accumulating high-reward semantic cues and by preserving short-range opti- mization history, thereby providing both global coverage and local consistency. Together, these components enable UNBOX to recover a coher- ent and comprehensive textual description of the concept encoded by the target class. The overall pipeline of UNBOX is shown in Alg.1 and Fig.1. Algorithm 1 Semantic optimization procedure used by UNBOX to recover class-level descriptors from a black-box classifier. Require: Classifier φ, generator G, target class j Require: Agents A f (Feedback), A u (Updater) Require: Global Context P best ,D best ←∅ 1: Initialize prompt p 0 2: for t = 0 to T do 3: Generate image x t ← G(p t ) 4: Score s t ← φ(x t ) j 5: Compute trend T t and intensity I t 6: Build semantic signal S t 7: if s t ≥ τ best then 8:Add (p t ,s t ) to P best 9:Extract lexical units and update D best 10: end if 11: e t ← A f (p t ,S t ,P best ,D best ) 12: p t+1 ← A u (p t ,e t ) 13: end for 14: Sort D best by activation score 15: return top-k descriptors from D best 3.1 Semantic Optimization Mechanism UNBOX performs class-wise model dissection by iteratively refining a textual description so that, when rendered by a generative model, it maxi- mally activates a chosen output neuron on a target classifier. The entire optimization takes place in semantic space, i.e., the space of natural-language descriptors, because the classifier exposes nei- ther gradients, architecture, nor training data. Formally, let φ :X → [0, 1] C be the classifier treated as a black box, and let j ∈ 1,...,C denote the target class. At itera- tion t, the method maintains a textual descriptor p t , which is converted into an image through a pretrained text-to-image diffusion model G: x t = G(p t ). The synthetic image is then evaluated by the clas- sifier, which returns the activation of the target output unit: s t = φ(x t ) j . This scalar represents the model’s confidence that the generated sample belongs to class j, and is the 4 Fig. 1 Overview of the UNBOX framework. Given a target class j and a black-box classifier φ, UNBOX reformulates activation maximization as a semantic optimization process carried out entirely in text space. The method iterates through three main components. (1) Prompt Evaluation (left): a natural-language prompt p t is rendered into an image x t = G(p t ) by a text-to-image diffusion model, which is then evaluated by the classifier to obtain the target-class score s t = φ(x t ) j . (2) Optimization Context (center): the scalar feedback s t is transformed into a semantic guidance signal through trend T t and intensity I t , which together define the textual loss S t . This module also maintains a Local Optimization Context C t capturing recent prompt–feedback pairs, and a Global Optimization Context (P best ,D best ) that accumulates high-scoring prompts and persistent lexical concepts. (3) Textual Optimization (right): two cooperating LLM agents perform prompt refinement: the Feedback Agent A f interprets the semantic signal and optimization context to generate structured feedback e t , which the Updater Agent A u applies to produce the next prompt p t+1 . The loop repeats until convergence, yielding a ranked set of human-interpretable descriptors that characterize the target class under strict black-box constraints. only numerical feedback available. The challenge is therefore to transform this single probability value into an optimization signal that can guide how the textual descriptor p t should be updated. UNBOX addresses this by interpreting the tempo- ral evolution of s t through two continuous quan- tities, trend and intensity, which summarize the direction and magnitude of progress, respectively. Trend captures whether the descriptor is improving with respect to the target class. It compares the current score s t to an exponential moving average of past scores, ̄s t−1 = αs t−1 + (1− α) ̄s t−2 , and defines the deviation T t = s t − ̄s t−1 . Positive values indicate upward progress, negative values indicate deterioration, and near-zero values indicate stagnation. We discretize this continuous quantity into a semantic category: trend_state(T t ) =        up, T t > ε, down, T t <−ε, flat, |T t |≤ ε, with a tolerance ε > 0. This categorical state acts as a symbolic cue for the language model, indicat- ing the direction in which the descriptor should evolve. Intensity measures how far the descriptor is from producing a high activation and determines how strong the next update should be. It is defined 5 as a margin-based proximity function: I t = max0, τ high − s t , with τ high being a hyperparameter. A large I t indi- cates the prompt is far from saturating the target unit, while small values indicate closeness to an optimal descriptor. As with trend, intensity is dis- cretized when communicating with the language model: intensity_state(I t )∈strong, moderate, micro, corresponding respectively to coarse, mid-scale, or fine-grained modifications to the current descrip- tor. These categories loosely resemble the effect of the learning rate in gradient-based methods, although all updates occur purely in linguistic form. The discretized trend and intensity values are used to index two lookup tables containing short natural-language templates, mapping each semantic state to a correspond- ing textual instruction. Selecting the appropriate entries from these tables and concatenating them yields the semantic guidance signal S t used by the LLM agents: S t =A trend_state(T t ) ∥B intensity_state(I t ) , whereA andB denote the trend and intensity lookup tables, respectively, and ∥ denotes string concatenation. Once the semantic signal S t is composed, it drives the update of the descriptor through two cooperating LLM agents that operate in sequence. The first is the Feedback Agent A f , which receives the current prompt p t together with S t and pro- duces a structured natural-language critique e t indicating how the descriptor should be modi- fied to better reflect the concept associated with the target output neuron j. The second is the Updater Agent A u , which integrates this critique and returns a refined prompt: p t+1 = A u p t , e t = A f (p t ,S t ) . Figure 2 illustrates the system prompts that govern A f and A u , together with the lookup table that converts the trend and intensity states into the textual components of S t . The prompt of A f specifies its objective (maximizing the acti- vation of class j), the inputs it receives (current descriptor, semantic signal, and contextual cues from high-scoring lexical units), and the strat- egy for producing concise and actionable edits. The prompt of A u defines how these edits must be applied, enforcing constraints on linguistic flu- ency, subject preservation, and prompt length. The lookup table provides short, standardized fragments encoding the direction and magnitude of semantic change, ensuring that S t is con- structed through a controlled and reproducible mapping rather than an unconstrained textual heuristic. Depending on the direction and magnitude encoded inS t , the update step may introduce new semantic attributes, suppress misleading or non- discriminative elements, adjust the global scene configuration, or apply fine-grained refinements to the existing description. In this way, S t modu- lates the scale and nature of the edit proposed by A f and executed by A u , ensuring that each itera- tion reflects a principled response to the classifier’s feedback. 3.2 Global and Local Optimization Context The optimization process described above oper- ates entirely in semantic space and is therefore highly non-convex: many intermediate prompts may yield transient spikes in class activation with- out representing stable or meaningful aspects of the underlying concept. We noticed that relying solely on the semantic signal S t leads to brit- tle behaviour: for instance, promising semantic attributes may be discarded and useful refine- ments overwritten. Most importantly, the absence of an explicit mechanism to leverage optimiza- tion history may cause the process to oscillate or stagnate. To counteract these effects, UNBOX maintains two complementary structures that summarize information across distinct temporal scales: (i) a Global Optimization Context, which aggregates high-scoring prompts and their most relevant lex- ical units, and (i) a Local Optimization Context, which stores the most recent prompt–feedback interactions. These structures provide high-level semantic cues to the LLM agents without modify- ing the mathematical optimization signals (trend 6 Fig. 2 Excerpts of the system prompts for A f and A u , along with the look-up table used to retrieve the text associated with T s t and I s t for the formulation of S t . and intensity). Global Optimization Context. This compo- nent stores all prompts that achieve an activation above a high-confidence threshold τ best . When- ever s t ≥ τ best , the corresponding prompt p t is added to a set P best . After optimization, this set is ranked by activation score, yielding a collection of the most effective prompts discovered for the target class. To uncover finer-grained semantic cues, each selected prompt p t is decomposed into its lex- ical units w i . After discarding items that do not constitute meaningful standalone semantic units (e.g., stop-words, conjunctions, determiners, auxiliary verbs), the remaining lexical items are treated as candidate semantic concepts. Each is independently evaluated by synthesizing an image from its single-word prompt: x w i = G(w i ), s w i = φ(x w i ) j . A concept set D best , of maximum size m, stores the w i terms with the largest classifier activation s j w i obtained up to the current iteration, result- ing in a list of atomic semantic cues that strongly correlate with the targeted class. These cues rep- resent persistent high-reward concepts that should continue to influence future refinements even if they do not appear in the current descriptor. This mechanism captures the multifaceted nature of class representations. For example, the class dog sled may be activated by huskies, snow, sled, or people in winter clothing. A purely 7 iterative update may converge to only one such attribute; the Global Optimization Context pre- serves the full semantic spectrum uncovered during exploration. Local Optimization Context. Alongside global structure, UNBOX maintains a short sliding record of the most recent prompt-feedback inter- actions. This local context makes the optimiza- tion trajectory explicit: it prevents reintroducing recently rejected prompts and highlights refine- ments that have consistently improved the activa- tion score over the last few steps. Formally, the context C t stores a fixed-length sequence of recent pairs (p t−k , e t−k ), where each p t−k is a past descriptor and each e t−k = A f (p t−k , S t−k ) is the critique generated by the Feedback Agent. By exposing C t to A f , the system can amplify promising semantic directions, avoid short-term oscillations, and achieve smoother progression through the high-dimensional semantic search space. Both the Global Optimization Context (P best ,D best ) and the Local Optimization Con- text C t are supplied to the LLM agents as auxiliary guidance. This yields a context-aware update rule of the form: p t+1 = A u p t , A f p t , S t , C t , P best , D best . Iterations continue until the score evolution indicates convergence or a fixed iteration budget is reached. At that point, the set of best lexical units (D best ) is ranked by activation score, pro- ducing a collection of the most effective prompts discovered for the target class. 4 Experiments We evaluate UNBOX along three complemen- tary dimensions that reflect the core objectives of black-box model dissection. First, we assess Semantic Fidelity, determining whether the tex- tual descriptors produced by UNBOX are suffi- ciently informative to identify the correct class using only the classifier’s output probabilities. Second, we examine Latent Training Semantics Recovery, measuring the extent to which the recovered descriptors reveal the semantic struc- ture implicitly encoded in the model’s training distribution and align with its visual decision cues. Third, we evaluate Bias Discovery, testing whether UNBOX can expose spurious correlations and support slice identification on established robustness benchmarks. Together, these evaluations address the central question of black-box dissection: starting solely from output probabilities, can we infer what the model recognizes, what latent semantics it has internalized, and what systematic biases it relies upon? 4.1 Experimental setup Our experiments are designed to answer three questions: (1) how accurately UNBOX can recover the concept associated with a target class using only output probabilities (Semantic Fidelity); (2) whether the recovered descriptors reflect the latent semantics encoded in the model’s training distribution (Latent Training Semantics Recov- ery); and (3) whether the method can reveal spurious correlations and coherent dataset slices (Bias Discovery). All evaluations use established vision benchmarks and compare UNBOX against the most recent state-of-the-art methods under standardized protocols. Datasets. For Semantic Fidelity and Latent Training Semantics Recovery, we use the ImageNet-1K validation set, restricted to the 30-class subset introduced by [7], following the 15 spurious / 15 non-spurious split defined by Salient ImageNet [43]. For Bias Discovery, we use the standard CelebA [12] and Waterbirds [11] benchmarks, as done in recent slice-discovery and debiasing work [7, 23, 38–42, 44]. CelebA contains over 200k face images annotated with 40 binary attributes, while Waterbirds introduces background-related spurious correlations by compositing bird images onto mismatched environments. Models investigated. We evaluate UNBOX on two representative and structurally divergent 8 classifiers: (1) ResNet50, a convolutional architec- ture with strong locality and hierarchical feature extraction, and (2) ViT-B/16, a transformer- based model that relies on global self-attention with markedly different inductive biases. These two models were selected not as a limitation of the approach, but to demonstrate that a purely output-driven semantic optimization procedure can generalize across fundamentally different visual processing mechanisms. Since UNBOX operates on the output probabilities of a classi- fier, it can be applied to any image classification model, regardless of architecture, modality of internal computation, or access to weights, while maintaining the same level of generality. Competitors. We compare against CLIPDis- sect [8] and W [16], both of which provide neuron-level explanations but rely on weights and data access, and DEXTER [7], a grey-box method requiring weights access. This posi- tions UNBOX—which operates solely from class probabilities—in a strictly more constrained setting. To ensure a fair comparison, we uti- lize the set of five class lexical units generated by UNBOX (Sec. 4.2). For the neuron-centric baselines (CLIPDissect and W), we con- struct an equivalent set by aggregating the top-4 penultimate-layer neuron lexical units and appending the descriptor from the classification head. We strictly adhere to their implementation guidelines, adopting the exact concept vocabu- laries: WordNet-20K for CLIPDissect and the 80,000 most frequent English words for W. As the probing dataset for both, we employ the same validation set used for the visual grounding evaluation (Tab. 3). Unlike competing deter- ministic methods, DEXTER and UNBOX are non-deterministic; therefore, we run the opti- mization three times and report the mean and standard deviation. For bias and slice-discovery experiments, we compare against the current state-of-the-art methods used in robustness liter- ature, including text-based methods such as B2T [23] and LADDER [38], and with the standard DRO baseline [11]. Metrics. Evaluation uses complementary seman- tic and visual metrics. Semantic Fidelity is mea- sured by embedding-based similarity between gen- erated descriptors and ground-truth labels using Sentence Transformers and CLIP. Latent Train- ing Semantics Recovery is evaluated through descriptor-to-caption similarity and descriptor-to- image alignment, quantifying how well the recov- ered semantics reflect the model’s implicit training distribution. Bias Discovery is assessed using the standard slice-level accuracy, worst-group accu- racy, and spurious-correlation detection metrics used in prior work. 4.2 Optimization setup For each class-wise dissection, we allocate a maximum of 1000 optimization steps, with early stopping triggered once the visual classi- fier predicts the target class for 10 consecutive generated images. Images are produced using black-forest-labs/FLUX.1-schnell [45] with a single diffusion step, while all agents (A f and A u ) operate on gpt-oss:120b [46]. On a system equipped with two H100 GPUs—one handling image synthesis and classifier queries, the other dedicated to LLM inference—each optimization step requires approximately 15 seconds. The trend–state tolerance is set to ε = 10 −4 , and the thresholds controlling intensity- state discretization (τ high ) and global-context accumulation (τ best ) are set to 10 −2 for stan- dard class-optimization experiments. For slice- discovery tasks, which require less sensitivity to small probability variations, both thresholds are set to 9× 10 −1 . The global context retains the top m = 5 lexical units extracted from high-scoring prompts, while the local optimization context stores the previous k = 10 prompt–feedback pairs. Prompt initialization follows the task setting: standard class dissection begins from the generic template “a picture of a random object”, whereas slice discovery uses a domain-aware ini- tialization, “a picture of a [DOMAIN]” (e.g., “a picture of a bird” for Waterbirds). 4.3 Results 4.3.1 Class Semantic Fidelity A fundamental question in model dissection is whether the recovered descriptors truly identify the intended concept associated with a target class. For a black-box setting such as ours, where no gradients, features, or training data are avail- able, this becomes particularly challenging: the 9 method must infer a class-level semantic descrip- tion using only the scalar probability returned by the model. An evaluation of semantic class fidelity therefore serves as the most direct test of whether UNBOX has successfully uncovered the core semantics that the classifier associates with each class. To assess this property, we compare the descriptors generated by UNBOX with the ground-truth ImageNet class labels. An effec- tive dissection method should produce descriptors whose meaning is significantly closer to the cor- rect class label than to unrelated alternatives. Concretely, we concatenate the top–5 descriptors produced for each class into a single prompt, encode both descriptor and label using T5-XL, and compute their class semantic similarity. Table 1 Class semantic fidelity evaluation: similarity between generated descriptors and ImageNet-1K class labels on three architectures. Columns W and D denote access to model weights and data, respectively. Higher values indicate stronger alignment with the ground-truth class concept. As DEXTER and UNBOX are non-deterministic, results are averaged over three runs. MethodWDRN50ViT W [16]✓0.600.40 CLIPDissect [8]✓0.770.27 DEXTER [7]✓✗0.47± 0.030.34± 0.01 UNBOX✗0.64± 0.090.49± 0.04 Random✗0.030.03 We evaluate against three baselines represen- tative of the current state of the art. W and CLIPDissect are white-box methods that require full access to model weights and a probing dataset; DEXTER is a grey-box method relying on activation maximization over model weights alone. A random-word baseline is reported as a lower-bound control. Results in Tab. 1 show that UNBOX achieves high semantic fidelity across all architectures despite operating under the strictest constraints. On ResNet50, UNBOX reaches an accuracy of 0.64 exceeding W while remaining compet- itive with CLIPDissect, that, however, requires Table 2 Alignment between generated descriptors and data-derived semantic attributes. Scores quantify the similarity between each method’s descriptors and keywords extracted from captioned training images, reflecting how well the recovered semantics match the distribution the classifier was trained on. Columns W and D denote access to model weights and data, respectively. Higher values indicate stronger data-grounded semantic recovery. As DEXTER and UNBOX are non-deterministic, results are averaged over three runs. MethodWDRN50ViT W [16]✓0.430.27 CLIPDissect [8]✓0.730.30 DEXTER [7]✓✗0.49± 0.010.34± 0.01 UNBOX✗0.63± 0.040.45± 0.03 Random✗0.030.03 access to data and models’ weights. The advan- tage becomes even more evident on ViT mod- els: UNBOX achieves the highest score (0.49), dramatically outperforming CLIPDissect and W. These results indicate that methods relying on internal activations or neuron probes may struggle to generalize across different architec- tural paradigms, while UNBOX—driven purely by output probabilities—maintains stable and robust interpretability performance. This demonstrates that semantic optimization in text space is not only feasible for black-box models but can match or surpass white-box competitors in recovering the core concept encoded by a class. 4.3.2 Latent Training Semantics Recovery While semantic fidelity assesses whether UNBOX can identify the correct class from output proba- bilities alone, a core objective of model dissection is to determine whether the explanations capture the semantics the classifier actually learned from its training distribution. A descriptor may sound plausible or natural-language–coherent without corresponding to attributes genuinely used by the model. To address this, we evaluate whether the descriptors recovered by UNBOX reflect (i) concepts present in the training data and (i) visual patterns that meaningfully influence the classifier’s predictions. 10 Table 3 Visual grounding evaluation on ImageNet-1K. Generated descriptors are used as textual queries over validation images to assess how strongly they correspond to concrete visual evidence. Columns W and D denote access to model weights and data, respectively. Ground-truth labels (GT) serve as an upper bound. As DEXTER and UNBOX are non-deterministic, results are averaged over three runs. MethodWDRN50ViT GT (Labels)--0.900.90 GT (Descr.)✗✓0.760.76 W [16]✓0.660.63 CLIPDissect [8]✓0.850.36 DEXTER [7]✓✗0.42± 0.010.36± 0.02 UNBOX✗0.56± 0.040.43± 0.04 Random✗0.030.03 Alignment with data-derived descriptors. A single class label is often insufficient to reveal the richness of the underlying data distribution: classes exhibit characteristic co-occurring fea- tures, contextual patterns and, in some cases, spu- rious cues. To evaluate whether UNBOX captures this broader semantic structure, we construct a set of data-derived descriptors by captioning 100 training images per class with LLaVA and extract- ing the most frequent informative keywords (after removing stop-words and non-semantic tokens). These keywords form a data-grounded description of what appears in the training samples. For each class, we concatenate the top-5 descriptors produced by UNBOX and by the data-derived process into two respective prompts, encode them using T5-XL embeddings, and mea- sure cosine similarity. We compare against DEX- TER, CLIPDissect, W, and a random-word baseline. As shown in Tab. 2, CLIPDissect performs strongly due to its direct access to model weights and data. However, UNBOX consistently ranks among the top performers despite operating under strict black-box constraints. On ResNet50 it out- performs W; and on ViT—where internal activation probing used by white-box methods becomes less reliable: UNBOX achieves the high- est score overall. These results indicate that UNBOX uncovers features that reflect the dis- tribution the classifier was trained on, rather than generating plausible but ungrounded expla- nations. Visual grounding on validation images. Textual similarity alone cannot guarantee that recovered descriptors correspond to visually grounded evidence in the data. Therefore, we treat each descriptor as a pseudo-label and mea- sure how well it aligns with ImageNet validation images of the corresponding class. This evaluates whether the descriptors encode features that are not only present in the training data but also con- sistently expressed in the model’s visual decision cues. An important distinction is that CLIPDis- sect and W both rely on the validation set as probing data for concept extraction, whereas UNBOX does not access any images during descriptor generation. Thus, this experiment con- stitutes a stricter test for our method. As shown in Tab. 3, UNBOX demonstrates strong grounding performance. On ResNet50, it nearly closes the gap with W; and on ViT, it substantially outperforms CLIPDissect, whose neuron-level probes degrade on transformer archi- tectures. These findings jointly indicate that UNBOX recovers descriptors that are both semantically aligned with the model’s training distribution and visually grounded in the data. Despite having no access to model weights, gradients, or train- ing images, the method uncovers latent semantic structure that white-box methods typically access only through internal activations. 4.3.3 Slice discovery and debiasing The final component of our evaluation concerns whether UNBOX can uncover systematic spuri- ous correlations and identify dataset slices where the classifier fails. Unlike class-level concept dis- covery, which targets stable defining features of a class, slice discovery requires isolating sub- tle, fine-grained cues—such as backgrounds or demographic attributes—that influence predic- tions only within specific subsets of samples. To focus the optimization on relevant varia- tions, we initialize the search with a lightweight 11 domain prior (e.g., “a picture of a bird” for Water- birds or “a picture of a celebrity” for CelebA). This assumption reflects realistic auditing scenar- ios where the model’s exact taxonomy may be unknown, but its application domain is typically evident. Because spurious cues may be averaged out during global optimization, we additionally extract instance-level descriptors. Whenever a generated image x t activates the target class with high confidence, we pass x t through a vision–language model (LLaVA) to obtain k = 5 fine-grained visual descriptors. Aggregating all descriptors collected throughout the optimiza- tion and ranking them by frequency reveals the dominant slice-defining attributes for each class. For Waterbirds, for example, this process natu- rally identifies “branch” for landbirds and “water” for waterbirds, corresponding to the well-known background bias. To validate that these descriptors accurately capture the spurious correlations affecting the classifier, we incorporate them into a debiasing pipeline following B2T [23]. Each descriptor is embedded using CLIP to build textual prototypes, which serve as pseudo-labelers of the training data. Images whose visual features align more strongly with the prototype of the opposite class are annotated as belonging to the conflict slice. These groups are then used to retrain a classi- fier with DRO [11], and the resulting worst-group accuracy provides a quantitative measure of the quality of our slice descriptors. Table 4 reports worst-group accuracy on Waterbirds and CelebA. On Waterbirds, UNBOX achieves 88.6 worst-group accuracy, performing competitively with white-box and data-dependent slice discovery methods, despite using only output probabilities. On CelebA, UNBOX attains 90.01 worst-group accuracy, matching Oracle DRO and closely approaching DEXTER. These results show that UNBOX not only recovers class-defining concepts and latent train- ing semantics but also exposes the subtle, system- atic biases that drive distribution shifts. Despite operating under strict black-box constraints, the discovered textual descriptors are sufficiently pre- cise to enable effective debiasing on standard robustness benchmarks. 4.3.4 Ablation A key question in understanding the behaviour of UNBOX is how much of its performance depends on the auxiliary components introduced in Sec. 3.1. While the semantic optimisation mech- anism can operate using only trend-based signals, the full method also incorporates two additional elements: (i) the Global Optimization Context (P best , D best ), which aggregates long-term seman- tic evidence; and (i) the intensity state I t , which modulates the strength of textual refinements. The ablation study in Table 5 evaluates the contri- bution of these components and clarifies whether they are necessary for stable and semantically meaningful convergence. The evaluation, ran on a subset of 10 classes, uses the same three criteria adopted in the main results: 1. descriptor–label similarity (DL), assessing Semantic Class Fidelity (Sec. 4.3.1); 2. descriptor–data similarity (D), assessing alignment with data-derived descriptors as defined in (Sec. 4.3.2); 3. descriptor–image similarity (DI), assessing visual grounding on validation images (Sec. 4.3.2). When both the Global Optimization Context and the intensity state are disabled, performance is consistently low across all three measures (0.50, 0.30, 0.42). This shows that trend-based optimi- sation alone is insufficient and leads to unstable or incoherent descriptors. Enabling only the intensity state yields partial gains, particularly in descriptor–data similarity (from 0.30 to 0.60). This indicates that control- ling the magnitude of semantic refinements helps reduce oscillations, but does not fully anchor the optimisation to the model’s learned concepts. When both components are active, perfor- mance improves substantially across all metrics (0.90 on descriptor–label and descriptor–data sim- ilarity, 0.87 on descriptor–image similarity). This demonstrates that the Global Optimization Con- text provides essential long-range semantic struc- ture: it accumulates stable cues, prevents semantic drift, and reinforces refinements that consistently increase the class activation. Combined with intensity-aware adjustment, these mechanisms 12 Table 4 Comparison of slice discovery and debiasing performance on the Waterbirds and CelebA benchmarks. Metrics include worst-group (Worst) and average (Avg) accuracy. WaterbirdsCelebA MethodWeightsDataGTWorstAvgWorstAvg ERM✓✗62.6±0.397.347.7±2.194.9 LfF [39]✓✗78.091.277.285.1 GEORGE [40]✓✗76.2±2.095.754.9±1.994.6 JTT [41]✓✗83.8±1.289.381.5±1.788.1 CNC [42]✓✗88.5±0.390.988.8±0.989.9 DRO [11]✓89.9±1.391.590.0±1.593.3 LADDER [38]✗✓✗92.4±0.893.189.2±0.489.8 DRO B2T [23]✗✓✗90.7±0.392.190.4±0.993.2 DEXTER [7]✓✗90.5±0.192.091.3±0.0191.7 UNBOX✗88.6±0.291.090.01±0.390.91 enable UNBOX to consistently recover descrip- tors that are semantically faithful, grounded in the training distribution, and visually aligned with the classifier’s behaviour under strict black-box constraints. Table 5 Ablation study evaluating the contributions of the Global Optimization Context (P best ,D best ) and the intensity state I t to the overall performance. P best , D best I t DLDDDI ✗0.500.300.42 ✗✓0.500.600.40 ✓0.900.900.87 4.3.5 Emergent Spurious Feature Attribution A central objective of model dissection is not only to recover the intended semantic concept associated with a class, but also to expose the unintended cues a classifier relies on when mak- ing its predictions. Deep models frequently learn to associate target labels with non-causal regular- ities in the training data, such as backgrounds, co-occurring objects, or simple geometric pat- terns. Identifying these spurious cues is especially important in a strict black-box setting, where the auditor has no access to training data or internal activations. UNBOX naturally reveals such behavior as a byproduct of its optimization process. Because the prompt is refined solely through feedback derived from output probabilities, the proce- dure gravitates toward whatever visual patterns most strongly activate the classifier. By inspect- ing the high-confidence generated images, their corresponding GradCAM maps, and the lexical descriptors accumulated in D best , we obtain a direct view of the non-causal features that the model treats as discriminative. Representative examples are shown in Fig. 3. For ResNet50, the snorkel class is often trig- gered by the presence of water, waves, or marine animals rather than by the snorkel apparatus itself. The baseball player class displays a simi- lar pattern: environmental cues associated with outdoor sports dominate over features specific to baseball, leading to confusion with classes such as soccer. A related issue arises in fine-grained cat- egories such as daisy, where the classifier focuses on background vegetation rather than flower mor- phology. For ViT models, the reliance on scene-level or geometric regularities is even more pronounced. The space bar class is activated by generic typ- ing scenarios regardless of whether the actual key is visible. The horizontal bar class frequently responds to straight-line structures; GradCAM often highlights the edge of an unrelated object whose geometry resembles the target class. Like- wise, library often activates in indoor educational 13 Fig. 3 Qualitative examples of spurious feature attribution revealed by UNBOX. For each class, we show generated images that activate the target neuron, the corresponding GradCAM visualizations, and the highest-scoring lexical units in D best . These examples illustrate how non-causal cues (e.g., contextual elements, co-occurring objects, or geometric patterns) can dominate the classifier’s decision process. environments such as classrooms or notice boards rather than canonical library scenes. These qualitative findings provide impor- tant context for the quantitative results in Sections 4.3.1 and 4.3.2. Since the purpose of UNBOX is to reveal the classifier’s actual rea- soning process, any dependence on spurious cues should be reflected in the extracted descriptors. When this occurs, the recovered descriptors may diverge from the human-defined class semantics, and such divergence is expected. Lower similarity scores in some tables may therefore indicate gen- uine model bias rather than a shortcoming of the method. If the classifier strongly associates “typ- ing at a keyboard” with the space bar class, a descriptor aligned with this association accurately reflects its decision process, even if it deviates from the intended concept. 5 Limitation and failure modes Despite its strong empirical performance, UNBOX exhibits several limitations inherent to semantic optimization in discrete text space. Sensitivity to low-level or non-semantic visual cues. Because the optimization operates over natural-language descriptors, it inherently favors high-level, nameable concepts. When a classifier’s decision depends mainly on low-level features—textures, fine-grained color patterns, or local shape primitives—the probability signal s t often responds only weakly to textual refine- ments. A representative failure case is howler monkey: in ImageNet, many images contain dense foliage backgrounds with subtle texture–shape configurations. These cues are difficult to express linguistically, so the optimization receives a weak or noisy trend signal, leading to oscillations and poor convergence. In such settings, the method may fail to recover the true visual evidence used by the classifier. Computational cost of iterative refinement. Each optimization step involves two LLM forward passes and one diffusion-model rendering. On a system equipped with two H100 GPUs, a sin- gle step takes approximately 15 seconds, implying that full dissection of a class requires non-trivial compute. Although runtime scales with available 14 hardware, this cost remains higher than that of single-pass attribution or gradient-based probing. These limitations arise from the discrete lin- guistic search space and the reliance on large gen- erative models for probing. Nonetheless, for the majority of classes, UNBOX successfully uncov- ers stable, human-interpretable descriptors under strict black-box constraints. 6 Conclusion We introduced UNBOX, a framework for class- wise model dissection that operates under the strictest black-box constraints: access is limited solely to output probabilities, with no gradi- ents, features, model weights, or training data. By reformulating activation maximization as a semantic optimization problem in text space, UNBOX combines a trend- and intensity–driven guidance mechanism with an LLM-based refine- ment process that iteratively constructs natural- language descriptors for a target class. A global and local optimization context further stabilizes the search, enabling the recovery of coherent and persistent semantic cues. Extensive experiments demonstrate that UNBOX achieves high semantic class fidelity, reliably identifying the concepts associated with a target class from output probabilities alone. The method also recovers latent training seman- tics, uncovering features genuinely grounded in the data distribution and reflected in the classi- fier’s visual decision patterns. Despite its strict black-box setting, UNBOX matches or surpasses state-of-the-art white-box and grey-box dissec- tion tools across multiple architectures, including CNNs and Vision Transformers. Beyond semantic recovery, UNBOX provides a principled mechanism for bias discovery. By extracting fine-grained contextual descriptors and using them to construct slice-aware pseudo-labels, the method supports effective debiasing through standard robust optimization techniques. On Waterbirds and CelebA, the discovered descrip- tors yield worst-group accuracies competitive with or approaching methods that require full access to model internals or training data, and in some cases rival the performance of oracle group labels. Taken together, these findings show that meaningful model dissection and auditing are possible even when models are accessible only through an inference API. UNBOX offers a gen- eral semantic lens for inspecting the behaviour, implicit training signals, and systematic biases of modern visual classifiers, opening the door to new forms of transparent, data-free, and architecture- agnostic model analysis. Data availability All datasets used in this study are publicly avail- able, widely recognised benchmark datasets that are maintained by their respective communities. These standard datasets can be accessed from the following repositories/links: ImageNet [10] at https://image-net.org/download.php, Water- Birds [11, 47] at https://github.com/kohpangwei/ group_DRO, https://w.vision.caltech.edu/ datasets/cub_200_2011/, CelebA [12] at https: //mmlab.ie.cuhk.edu.hk/projects/CelebA.html. No new data were generated in this study beyond the use of these existing open-source benchmark datasets. All data analysed during this study are therefore openly accessible to readers and researchers. References [1] Park, D.H., Hendricks, L.A., Akata, Z., Rohrbach, A., Schiele, B., Darrell, T., Rohrbach, M.: Multimodal explanations: Justifying decisions and pointing to the evi- dence. In: Proceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition, p. 8779–8788 (2018) [2] Sammani, F., Deligiannis, N.: Uni-nlx: Uni- fying textual explanations for vision and vision-language tasks. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 4634–4639 (2023) [3] Sammani, F., Mukherjee, T., Deligiannis, N.: Nlx-gpt: A model for natural language explanations in vision and vision-language tasks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 8322–8332 (2022) [4] Hendricks, L.A., Hu, R., Darrell, T., Akata, Z.: Grounding visual explanations. In: Pro- ceedings of the European Conference on 15 Computer Vision (ECCV), p. 264–279 (2018) [5] Zellers, R., Bisk, Y., Farhadi, A., Choi, Y.: From recognition to cognition: Visual com- monsense reasoning. 2019 ieee. In: CVF Con- ference on Computer Vision and Pattern Recognition (CVPR), p. 6713–6724 (2018) [6] Pennisi, M., Bellitto, G., Palazzo, S., Kava- sidis, I., Shah, M., Spampinato, C.: Diffex- plainer: Towards cross-modal global explana- tions with diffusion models. Computer Vision and Image Understanding 262, 104559 (2025) https://doi.org/10.1016/j.cviu.2025. 104559 [7] Carnemolla, S., Pennisi, M., Samarasinghe, S., Bellitto, G., Palazzo, S., Giordano, D., Shah, M., Spampinato, C.: Dexter: Diffusion- guided explanations with textual reasoning for vision models. Advances in Neural Infor- mation Processing Systems (2025) [8] Oikarinen, T., Weng, T.-W.: CLIP-dissect: Automatic description of neuron rep- resentations in deep vision networks. In: The Eleventh International Confer- ence on Learning Representations (2023). https://openreview.net/forum?id=iPWiwWHc1V [9] Yuksekgonul, M., Bianchi, F., Boen, J., Liu, S., Huang, Z., Guestrin, C., Zou, J.: Textgrad: Automatic" differentiation" via text. arXiv preprint arXiv:2406.07496 (2024) [10] Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., Fei-Fei, L.: Imagenet: A large-scale hierarchical image database. In: 2009 IEEE Conference on Computer Vision and Pattern Recognition, p. 248–255 (2009). IEEE [11] Sagawa, S., Koh, P.W., Hashimoto, T.B., Liang, P.: Distributionally robust neural net- works. In: International Conference on Learn- ing Representations (2020) [12] Liu, Z., Luo, P., Wang, X., Tang, X.: Deep Learning Face Attributes in the Wild (2015). https://arxiv.org/abs/1411.7766 [13] Elton, D.C.: Self-explaining ai as an alter- native to interpretable ai. In: International Conference on Artificial General Intelligence, p. 95–106 (2020). Springer [14] Yang, Y., Panagopoulou, A., Zhou, S., Jin, D., Callison-Burch, C., Yatskar, M.: Language in a bottle: Language model guided concept bottlenecks for interpretable image classification. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 19187–19197 (2023) [15] Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., Batra, D.: Grad- cam: Visual explanations from deep networks via gradient-based localization. In: Proceed- ings of the IEEE International Conference on Computer Vision, p. 618–626 (2017) [16] Ahn, Y.H., Kim, H.B., Kim, S.T.: Www: a unified framework for explaining what where and why of neural networks by interpretation of neuron concepts. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 10968–10977 (2024) [17] Simonyan, K., Vedaldi, A., Zisserman, A.: Deep inside convolutional networks: Visualis- ing image classification models and saliency maps. arXiv preprint arXiv:1312.6034 (2013) [18] Sundararajan, M., Taly, A., Yan, Q.: Axiomatic attribution for deep networks. In: International Conference on Machine Learn- ing, p. 3319–3328 (2017). PMLR [19] Zeiler, M.D., Fergus, R.: Visualizing and understanding convolutional networks. In: European Conference on Computer Vision, p. 818–833 (2014). Springer [20] Srinivas, S., Fleuret, F.: Full-gradient rep- resentation for neural network visualization. Advances in neural information processing systems 32 (2019) 16 [21] Fong, R.C., Vedaldi, A.: Interpretable expla- nations of black boxes by meaningful pertur- bation. In: Proceedings of the IEEE Interna- tional Conference on Computer Vision, p. 3429–3437 (2017) [22] Wagner, J., Kohler, J.M., Gindele, T., Hetzel, L., Wiedemer, J.T., Behnke, S.: Interpretable and fine-grained visual explanations for con- volutional neural networks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 9097– 9107 (2019) [23] Kim, Y., Mo, S., Kim, M., Lee, K., Lee, J., Shin, J.: Discovering and mitigating visual biases through keyword explanation. In: Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 11082–11092 (2024) [24] Ribeiro, M.T., Singh, S., Guestrin, C.: " why should i trust you?" explaining the predic- tions of any classifier. In: Proceedings of the 22nd ACM SIGKDD International Con- ference on Knowledge Discovery and Data Mining, p. 1135–1144 (2016) [25] Lundberg, S.M., Lee, S.-I.: A unified approach to interpreting model predictions. Advances in neural information processing systems 30 (2017) [26] Kim, B., Wattenberg, M., Gilmer, J., Cai, C., Wexler, J., Viegas, F., Sayres, R.: Inter- pretability beyond feature attribution: Quan- titative testing with concept activation vec- tors. arxiv e-prints (nov. arXiv preprint stat.ML/1711.11279 (2017) [27] Crabbé, J., Schaar, M.: Concept activa- tion regions: A generalized framework for concept-based explanations. Advances in Neural Information Processing Systems 35, 2590–2607 (2022) [28] Zhou, B., Sun, Y., Bau, D., Torralba, A.: Interpretable basis decomposition for visual explanation. In: Proceedings of the European Conference on Computer Vision (ECCV), p. 119–134 (2018) [29] Fel, T., Picard, A., Bethune, L., Boissin, T., Vigouroux, D., Colin, J., Cadène, R., Serre, T.: Craft: Concept recursive activation fac- torization for explainability. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 2711– 2721 (2023) [30] Bau, D., Zhou, B., Khosla, A., Oliva, A., Torralba, A.: Network dissection: Quantify- ing interpretability of deep visual represen- tations. In: Proceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition, p. 6541–6549 (2017) [31] Fong, R., Vedaldi, A.: Net2vec: Quantifying and explaining how concepts are encoded by filters in deep neural networks. In: Proceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition, p. 8730– 8738 (2018) [32] Gurkan, M.K., Arica, N., Yarman Vural, F.T.: A concept-aware explainability method for convolutional neural networks. Machine Vision and Applications 36(2), 33 (2025) [33] Wang, A., Lee, W.-N., Qi, X.: Hint: Hier- archical neuron concept explainer. In: Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 10254–10264 (2022) [34] Hernandez, E., Schwettmann, S., Bau, D., Bagashvili, T., Torralba, A., Andreas, J.: Natural language descriptions of deep visual features. In: International Conference on Learning Representations (2021) [35] Kim, S., Oh, J., Lee, S., Yu, S., Do, J., Taghavi, T.: Grounding counterfactual expla- nation of image classifiers to textual concept space. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 10942–10950 (2023) [36] Asgari, S., Khani, A., Khasahmadi, A.H., Sanghi, A., Willis, K.D., Amiri, A.M.: tex- plain: Post-hoc textual explanation of image classifiers with pre-trained language models. In: ICLR 2024 Workshop on Reliable and Responsible Foundation Models (2024) 17 [37] Zablocki, Ă., Gerard, V., Cardiel, A., Gaussier, E., Cord, M., Valle, E., et al.: Gift: A framework for global interpretable faith- ful textual explanations of vision classifiers. arXiv preprint arXiv:2411.15605 (2024) [38] Ghosh, S., Syed, R., Wang, C., Choudhary, V., Li, B., Poynton, C.B., Visweswaran, S., Batmanghelich, K.: Ladder: Language-driven slice discovery and error rectification in vision classifiers. In: Findings of the Association for Computational Linguistics: ACL 2025, p. 22935–22970 (2025) [39] Nam, J., Cha, H., Ahn, S., Lee, J., Shin, J.: Learning from failure: De-biasing classi- fier from biased classifier. Advances in Neural Information Processing Systems 33, 20673– 20684 (2020) [40] Sohoni, N., Dunnmon, J., Angus, G., Gu, A., Ré, C.: No subclass left behind: Fine- grained robustness in coarse-grained classifi- cation problems. Advances in Neural Infor- mation Processing Systems 33, 19339–19352 (2020) [41] Liu, E.Z., Haghgoo, B., Chen, A.S., Raghu- nathan, A., Koh, P.W., Sagawa, S., Liang, P., Finn, C.: Just train twice: Improving group robustness without training group information. In: International Conference on Machine Learning, p. 6781–6792 (2021). PMLR [42] Zhang, M., Sohoni, N.S., Zhang, H.R., Finn, C., Ré, C.: Correct-n-contrast: A contrastive approach for improving robust- ness to spurious correlations. arXiv preprint arXiv:2203.01517 (2022) [43] Singla, S., Feizi, S.: Salient imagenet: How to discover spurious features in deep learning? arXiv preprint arXiv:2110.04301 (2021) [44] Yu, H., Liu, J., Zou, H., Xu, R., He, Y., Zhang, X., Cui, P.: Error slice discovery via manifold compactness. arXiv preprint arXiv:2501.19032 (2025) [45] Labs, B.F.: FLUX. https://github.com/ black-forest-labs/flux (2024) [46] OpenAI: gpt-oss-120b & gpt-oss-20b Model Card (2025). https://arxiv.org/abs/2508. 10925 [47] Wah, C., Branson, S., Welinder, P., Perona, P., Belongie, S. Technical Report CNS-TR- 2011-001, California Institute of Technology (2011) 18

Instant research discovery