How to apply SHAP explanations to a CNN+BiLSTM model trained on severely imbalanced network intrusion detection data?

Question

I am building an explainable Intrusion Detection System for IoT networks using a hybrid CNN+BiLSTM+Multi-Head Self-Attention architecture in Keras/TensorFlow. My dataset is CIC-BoT-IoT which has extreme class imbalance — 99.82% attack traffic and 0.18% benign traffic.

I applied hybrid sampling (SMOTE + RandomUnderSampler) before training:

python

from imblearn.combine import SMOTETomek
from imblearn.under_sampling import RandomUnderSampler
from imblearn.pipeline import Pipeline

resample = Pipeline([
    ('under', RandomUnderSampler(random_state=42)),
    ('over', SMOTE(random_state=42))
])

X_resampled, y_resampled = resample.fit_resample(X_train, y_train)

I now want to apply SHAP to explain individual predictions. My questions are:

Which SHAP explainer is most appropriate for a sequential Keras model — DeepExplainer or GradientExplainer?
Does the extreme class imbalance in the original data affect the reliability of SHAP values even after resampling?
How should I select the background dataset for the explainer given the imbalance — should it reflect the resampled distribution or the original?

This question might be better suited to the AI Stackexchange — mqqz
– mqqz, Commented Mar 19 at 12:17

mqqz · Accepted Answer · 2026-03-19 12:41:42Z

Which SHAP explainer is most appropriate for a sequential Keras model — DeepExplainer or GradientExplainer?

Both are fine, the safer default is usually GradientExplainer since it's more general, with DeepExplainer worth trying if it works cleanly on your exact graph or if the other option is too slow.

Does the extreme class imbalance in the original data affect the reliability of SHAP values even after resampling?

Yes, the original data skew can still affect SHAP reliability, even if trained on resampled data. SHAP values are always relative to a background distribution, because the explanation is about how a prediction differs from the model’s expected output over that background set. SHAP’s documentation is explicit that the expected value depends on the passed background samples.

There is also empirical evidence that imbalanced background/explanation data can make SHAP explanations noisier or biased toward the majority class, and that balancing the background/explanation sets can improve reliability.

How should I select the background dataset for the explainer given the imbalance — should it reflect the resampled distribution or the original?

The choice of background dataset depends on the problem you're investigating and what sort of explanation you want.

If you want an operational explainer, to answer questions like: "Why did the model classify this flow malicious instead of benign, under the operating data distribution I expect in deployment?". Then use a background set that reflects the real deployment distribution, not the artificially resampled one.

If you want a diagnostic explainer, to answer questions like: “What features distinguish this sample relative to a class-balanced reference population?��. Then a balanced background set is often much better for comparing feature contributions across classes and for avoiding majority-class dominance in explanations.

For your case, I would avoid using the full resampled training set as the default background. That can distort the baseline because SMOTE creates synthetic minority samples and undersampling changes prevalence. For SHAP you generally only need about 100–1000 background samples, and that the expected value is defined by those samples

Collectives™ on Stack Overflow

How to apply SHAP explanations to a CNN+BiLSTM model trained on severely imbalanced network intrusion detection data?

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related