Why Brightness Tweaks Lie to You: Counterfactual Stress Testing for Medical Image Classifiers

When a medical imaging model passes its validation set with flying colors, the temptation is to declare victory and move toward deployment. Anyone who has watched a model crumble on data from a new hospital knows how premature that celebration can be. A classifier trained on chest X-rays from one set of scanners can lose substantial accuracy when it encounters images from a different vendor, a different acquisition protocol, or a demographic group underrepresented in training. The unsettling part is that nothing in the validation metrics warns you this will happen.

The paper "Counterfactual Stress Testing for Image Classification Models" by Stammel, De Sousa Ribeiro, Mehta, Roschewitz, and Glocker from Imperial College London takes direct aim at this problem. Their central claim is that the standard toolkit for probing robustness, the perturbation-based stress test, is fundamentally misleading, and that causal generative models offer a more honest substitute.

The Underspecification Problem and Why Perturbations Fail

The conceptual backdrop here is underspecification, a term popularized in the machine learning literature to describe a situation where many distinct models achieve identical performance on in-distribution data while behaving completely differently out of distribution. Two models with the same validation AUC can encode very different inductive biases. One might have latched onto genuine pathology features; the other might have keyed on a scanner-specific artifact that happens to correlate with the label in the training set. On your held-out test data, drawn from the same distribution, you cannot tell them apart. In the clinic, the difference can be the difference between a reliable diagnostic aid and a liability.

Stress testing is supposed to expose this fragility before deployment. The conventional approach applies simple, hand-specified perturbations: brightness shifts, contrast adjustments, rotations, flips. The intuition is reasonable, but the execution is flawed in a way the paper articulates clearly. Many of these perturbations are the same operations used as data augmentation during training. A model trained with random contrast jitter has, by construction, been made invariant to contrast jitter. Testing it with contrast jitter therefore tells you almost nothing about its behavior under shifts it has never seen. The result is a systematic overestimation of robustness. The stress test flatters the model precisely because it probes the dimensions the model was trained to ignore, while leaving the dangerous dimensions untouched.

This is the key insight worth dwelling on. The failure of perturbation-based testing is not that the perturbations are too weak. It is that they are uninformed about the actual structure of real distribution shifts. A scanner change does not look like a uniform brightness offset. It introduces correlated, spatially structured changes in texture, noise characteristics, and contrast response that a single global transform cannot reproduce.

Counterfactual Twins via Deep Structural Causal Models

The proposed alternative is to generate counterfactual images that simulate the real shift while holding the patient's anatomy fixed. The machinery is a Deep Structural Causal Model (DSCM), implemented as a hierarchical beta-Variational Autoencoder (HVAE). The model is conditioned on causal parent attributes: for the PadChest chest X-ray data, on biological sex and scanner type; for the EMBED mammography data, on scanner type alone.

The crucial operation is intervention. Given a source image, the model can answer a counterfactual question: what would this exact patient's scan look like if it had been acquired on a different scanner, or if the patient were a different sex? The output is a "twin" image that differs only along the intervened attribute while preserving the anatomical content. This is a stronger guarantee than mere conditional generation. You are not sampling a new patient from a target distribution; you are transforming a specific patient into the counterfactual world, which means the comparison between original and counterfactual isolates the effect of the attribute change.

The authors note that HVAE-based counterfactual generation was found to outperform alternatives on axiomatic soundness tests in a prior benchmark. These axioms, drawn from the causal inference literature, check properties like composition (intervening with the observed value should return the original image) and reversibility. This matters because a counterfactual that does not satisfy these properties may introduce spurious artifacts that contaminate the stress test, reintroducing exactly the kind of uninformed perturbation the method is trying to avoid.

The validation design is appropriately broad: two modalities (chest X-ray and mammography), three architectures (ResNet-50, DenseNet-121, ViT-B/16), and two shift types (scanner and sex). The tasks are pneumonia detection on PadChest and four-category BI-RADS breast density classification on EMBED.

What the Results Actually Show

The headline finding is that counterfactual stress tests predict real out-of-distribution behavior far better than perturbation-based tests across three dimensions:

• The direction of performance change (does the model get better or worse under the shift)
• The relative magnitude of degradation
• The ranking of models (which architecture is most robust)

That last point deserves emphasis. Model ranking is the practically decisive question. A deployment team rarely cares about the absolute predicted drop in isolation; they care about which candidate model to ship. If a stress test reliably preserves the ranking of models under real shifts, it functions as a usable selection criterion. The paper's claim that counterfactual testing captures ranking while classical perturbation does not is, in my reading, the most operationally important result, even if it is stated almost in passing.

My Take

What I find compelling here is the reframing of stress testing as a simulation problem rather than a perturbation problem. The implicit model behind brightness-and-contrast testing is that robustness is a generic property, that a model robust to small input changes is robust in general. Counterfactual testing rejects that and insists on simulating named, mechanistically meaningful shifts. This is the right philosophy, and it connects naturally to the causal fairness literature, where counterfactual notions of fairness ask whether a decision would change had a protected attribute been different.

I would push on a few points, however. First, the framework inherits the validity of the generative model as its central dependency. If the DSCM cannot faithfully render the scanner shift, the stress test simply measures the model against a flawed simulator. The authors lean on axiomatic soundness tests to mitigate this, which is sensible, but soundness axioms test internal consistency, not external fidelity to the true target distribution. A counterfactual can be perfectly self-consistent and still not match real scanner B images.

Second, the method is bounded by the attributes you can name and condition on. Scanner type and sex are observable and labeled. The most dangerous shifts in practice are often the ones nobody anticipated, such as a new artifact from a firmware update or a subtle change in patient positioning protocol. Counterfactual stress testing cannot probe a shift it was never told about, whereas a broad perturbation suite, for all its flaws, at least casts a wide net.

Third, there is a quietly recursive risk. If teams begin using counterfactual twins for both augmentation (as in the Ktena et al. work the authors cite) and evaluation, the same generative model could end up on both sides of the train-test divide, recreating the very overestimation problem that doomed perturbation testing. Keeping the evaluation generator strictly separate from any training-time generative augmentation will be important hygiene.

Conclusion

The paper makes a clean and convincing argument: cosmetic perturbations measure robustness along the wrong axes, and causal counterfactuals measure it along the right ones. By preserving anatomy while intervening on scanner type or patient sex, the DSCM produces a synthetic but mechanistically faithful preview of how a model will degrade in the wild, capturing direction, magnitude, and ranking where classical methods fail.

The open questions I would most like to see addressed concern fidelity certification and unknown shifts. How do we quantify when a counterfactual simulator is trustworthy enough to gate a clinical deployment decision? And can causal generative models be combined with discovery methods that surface the shifts we did not think to test? If those gaps close, counterfactual stress testing has a real claim to becoming a standard pre-deployment check rather than a research curiosity.