Transactions on Machine Learning Research, 2026
CLIP can tell you that a photo contains an umbrella. Ask it which pixels made it say so and the answer is noise. A paper at ICLR 2025 claimed that a short round of adversarial fine-tuning fixes this. We retrained the models and rebuilt every evaluation from scratch to check whether it does, and then added a loss that tells the model where to look.
A saliency map marks the pixels a model's answer is most sensitive to: nudge those pixels and the answer changes most. For the original CLIP image encoder the Simple Gradient map is a lattice of speckles spread over the whole picture, whatever the prompt. After adversarial fine-tuning (AFT), the same question gives a map that sits on the object the prompt names.
Pick a photo and a prompt. The AFT maps come from our retrained ViT-B/16 model.
AFT takes CLIP's image encoder and trains a copy of it on ImageNet with one rule. For each training image, find the small pixel perturbation that moves the copy's embedding the furthest (at most 4/255 per colour channel, found with ten steps of projected gradient descent), then train the copy so that its embedding of the perturbed image stays close to where the frozen original placed the clean image. No labels and no captions are involved; the text encoder is never touched.
Why would that clean up saliency maps? Expanding the objective to first order turns the worst-case perturbation into a penalty on the input gradient itself, and the Huber-type norm used for that penalty pushes most gradient entries to zero while sparing a few large ones. The input gradient is the Simple Gradient saliency map, so a sparser gradient is a cleaner map. The original authors derived this; the reproduction asks whether it shows up in practice.
The original repository ships the training code and the attack but none of the evaluations. We reimplemented the five localisation metrics, the adversarial evaluation, Network Dissection, cross-modal retrieval and remove-and-retrain from the paper's descriptions, and retrained the models ourselves. That gives two separate checks: does our retrained model behave like the checkpoint the authors released, and do our numbers match the ones printed in the paper?
The first check passes almost exactly. The second does not: the localisation scores and detector counts all land somewhere else, because choices such as the threshold for binarising a map or the hit radius of the pointing game are not written down. We swept those choices and found that they move every metric's level but never change the ordering of the models. That is why the verdicts below speak of direction and trend rather than of matching numbers.
The pointing game asks whether the hottest pixel of a map lands inside the object. For Simple Gradient maps on ImageNet-S it rises from 25.3 to 56.6 percent under AFT, and our retrained model agrees with the released checkpoint within 0.3 points on every Simple Gradient metric (on Grad-CAM the two sit a stable 2 points apart). Grad-CAM improves on paper too, but its maps on a vision transformer collapse into a few blocky patches that move from image to image; the identical code on a ResNet-50 gives ordinary maps, so we treat that half of the claim as open. A remove-and-retrain test backs the Simple Gradient result: deleting the pixels an AFT map calls important hurts a classifier trained from scratch more than deleting the pixels a CLIP map calls important, in all four settings we ran.
Network Dissection probes each of the 768 final-layer channels on the Broden dataset and counts those whose activations line up with one concept's segmentation masks. Detectors go from 160 to 390 of 768, and the retrained and released checkpoints give the same count. The original paper reports 42 to 159. The absolute count is set almost entirely by the IoU threshold (the baseline alone ranges from 572 detectors at 0.02 to 64 at 0.06), while the ordering never flips.
On dermoscopy images (ISIC), never seen in training, the Simple Gradient pointing game goes from 0.107 to 0.428; on a six-class linear probe trained on COCO features it goes from 0.140 to 0.333. On colonoscopy frames (Kvasir-SEG) every ImageNet-trained model stays near zero, because the polyps are too small for the test to say anything. The photos in the widget above show the qualitative side: melanoma, chest X-ray, lion, polyp.
The original paper reports a 2.84-point drop in zero-shot accuracy at ε = 1/255. On CIFAR-10, STL-10 and Imagenette we see at most 3 points, and where plain CLIP scores zero under an adversarial attack, the models trained at ε = 4/255 keep about two thirds of their average accuracy. EuroSAT is the exception: every AFT model falls to the ten-class chance level, which lifts the average drop to 7.1 points. Five evaluation seeds give confidence intervals within about 2.4 points, so the fixed-seed values below are stable.
AFT never says where the saliency should go; the sparsity is a side effect. We add a term that does say so. Take the Simple Gradient map of the agreement between the fine-tuned embedding and the original CLIP embedding, normalise it so it sums to one, and measure the share that falls inside the object's segmentation mask. The Energy Pointing Game loss is one minus that share, so it is zero when all of the attention sits on the object and one when none of it does.
Ŝi is the normalised saliency map of image i, Mi its object mask, ws the weight of the new term. Setting ws = 0 gives plain AFT back.
Two practical points. The loss needs masks, so we fine-tune on COCO, whose instance annotations supply them. And it needs the gradient of a gradient, which makes each step take 1.27 times as long. Applied from the start, training does not converge: early in AFT the input gradients are dense and the second-order signal has random sign. Applied for 2,000 steps on top of a converged AFT checkpoint, it works, and the weight becomes a dial.
What it costs: at ws = 0.2 the mean zero-shot accuracy across five benchmarks drops by 1.3 points clean and by 1.0 and 0.5 points under attack, against the matched control. At 0.6 the three drops are between 3.3 and 3.9 points.
Three things make us think the change is in the encoder rather than in one gradient path. Grad-ECLIP, a different saliency method that the loss never touches, improves at every step of the dial. The gain transfers: on the dermoscopy images the Simple Gradient pointing game goes from 0.428 with AFT to 0.820 at ws = 0.6. And the loss has a theoretical reading: to first order, minimising it is the same as making the encoder robust to perturbations confined to the background. A background-only attack confirms the shift in relative sensitivity. Plain AFT is 1.25 to 1.29 times more sensitive to background pixels than to object pixels; with the new term the ratio falls to 0.94, 0.79 and 0.68 as the weight rises.
What it does not do: deletion and insertion tests, and a test of whether the map follows the prompt when two objects are present, do not improve with the weight. The extension is a targeted gain in foreground alignment, not a general gain in faithfulness. The fourth panel in the widget at the top shows the maps at ws = 0.6 for the three COCO photos.
Adversarial fine-tuning does make CLIP's saliency maps sit on the object, make more neurons concept-specific, and buy adversarial robustness at a cost in clean accuracy; the retrained models match the released ones. The printed numbers do not reproduce until the evaluation protocol is written down, and a reproduction has to sweep the unwritten parts to know which conclusions survive. And when masks are available, a single extra term with one dial moves the saliency onto the object further than adversarial training alone.
The main training run used 28.7 kWh, about 7.7 kg CO₂e; the extension added 14.9 kWh.
@article{nuzhdin2026reboosting,
title = {[Re] Boosting the Visual Interpretability of CLIP via Adversarial Fine-Tuning},
author = {Nuzhdin, Anton and Gruzitski, Andrei and Egyed, Bal{\'a}zs and Raudvee, Aleksandr},
journal = {Transactions on Machine Learning Research},
year = {2026},
url = {https://openreview.net/forum?id=uPXRBZfkYy}
}