Reliability Diagnostics for Post-hoc Explanations in Network Intrusion Detection

High classification performance does not establish the reliability of post-hoc explanations in network intrusion detection. This study evaluates SHAP and LIME by separating agreement between methods from within-method repeatability and prediction changes under feature replacement. Four classifiers are compared on CIC-IDS2017, UNSW-NB15, and NSL-KDD using five training seeds per task. Local explanation analyses focus on five fitted Transformers, with an additional NSL-KDD checkpoint to examine model-seed sensitivity. Shared-reference comparisons, sampling-budget tests, global and different-flow ranking controls, and matched random-feature replacements are used to assess the results. Mean top-five Jaccard agreement ranges from 0.15 to 0.40, while rank-biased overlap ranges from 0.24 to 0.55. However, much of this overlap also occurs between different flows with the same predicted class, limiting evidence of flow-specific agreement. Larger SHAP budgets improve within-method repeatability but do not ensure closer agreement with LIME. Under conditional-donor replacement, removing top-ranked features does not consistently reduce predicted-class probabilities more than random removal. Retaining these features better preserves the probabilities, although weak or unchanged replacements limit the interpretation. These findings show that agreement alone is insufficient to establish explanation reliability. For practical use, feature rankings should be evaluated alongside within-method repeatability and perturbation controls that measure actual input changes.

Explainable artificial intelligence, explanation agreement, Lime, Network intrusion detection, Perturbation Evaluation, repeatability, Shap

*Correspondence: BURAK AĞGÜL

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article or claim that may be made by its manufacturer is not guaranteed or endorsed by the publisher.