Stability of explanations in software-trace classification
Contribution in briefBecause models that correctly classify the same programs may rely on different cues, the work examines the stability of explanations in behavioural-trace classification, considering data representations and the regularities learned by classifiers.
Full bibliographic reference
Estimating shortcut learning and inductive bias in multi-view behavioural trace classification
Artificial Neural Networks in Pattern Recognition, Lecture Notes in Computer Science · Springer, 2027, pp. 89–101 (ANNPR, Milan 2026)
Problem, method and findings
A ransomware-recognition dataset is used to compare different descriptions of execution: system calls, libraries and paths, hardware-counter signals and combinations of these views. Information Concordance and Selector Adjusted Information Concordance measure agreement between explanations, also accounting for feature-selection effects. In this comparison, system calls yield more stable explanations across models; other representations are more sensitive to processing choices. The finding concerns the benchmark studied and encourages joint evaluation of accuracy and the stability of the reasons underlying predictions.
The work was presented at ANNPR in October 2026 and published online in September 2026; AIR UniMI assigns 2027 to the bibliographic edition of the proceedings volume.
