Baseline Input

A baseline input is the reference point used by some explanation methods, especially Integrated Gradients, to represent the absence of signal. It should produce a near-zero prediction and be meaningful for the model, because the baseline strongly affects the resulting feature attributions and their interpretability.

Expanded Definition

A baseline input is the comparison point used by gradient-based explanation methods to estimate how much each feature contributes to a model output. In practice, it stands for an input state that approximates the absence of relevant signal, so the attribution method can measure change relative to that reference rather than relative to raw values alone. This matters most in techniques such as Integrated Gradients, where the choice of baseline can materially change the explanation, even when the underlying model prediction stays the same.

Definitions vary across vendors and research implementations because no single standard governs how a baseline must be selected. Some systems use an all-zero input, while others use a domain-specific neutral example, a masked token, or an empty embedding. The right choice depends on whether the baseline is actually close to a meaningful “no signal” condition for the model and data distribution. NIST’s NIST Cybersecurity Framework 2.0 is useful here as a governance anchor because it reinforces that trustworthy use of analytical tooling depends on understanding inputs, assumptions, and operational context.

The most common misapplication is treating a convenient default, such as zero or blank text, as a universal baseline when that value is outside the model’s training reality and distorts the attribution results.

Examples and Use Cases

Implementing baseline inputs rigorously often introduces a modelling tradeoff, requiring organisations to weigh explanation consistency against the difficulty of finding a reference point that is both neutral and realistic.

• In image classification, a black image may be used as a baseline for Integrated Gradients, but only if black is a meaningful absence state for the model rather than an artificial artifact.
• In natural language processing, an empty string or special mask token may serve as the baseline, although the choice can shift token-level attributions significantly.
• In fraud or risk models, a domain-specific “normal” record may be preferable to zeros because the model may never have learned from zero-valued feature vectors.
• In security analytics, baseline selection can affect how analysts interpret feature importance in models that support alert triage or anomaly scoring, especially when the model is used as part of a broader control workflow aligned with NIST CSF style governance.

Researchers also use multiple baselines and average the results to reduce sensitivity to any single reference point. That approach can improve stability, but it adds complexity and may obscure how a specific baseline influences the explanation.

Why It Matters for Security Teams

For security teams, baseline input quality affects whether model explanations are credible enough to support triage, oversight, and incident review. If the baseline is poorly chosen, attribution outputs can make a model appear to rely on the wrong features, which weakens trust in detection logic, misleads reviewers, and can create false confidence in automated decision support. This is especially relevant when models are used in AI-assisted security operations, where explainability may influence escalation, tuning, or governance decisions.

The issue also intersects with identity and access workflows when explanation methods are applied to authentication risk scoring, entity resolution, or user behaviour analytics. In those settings, the baseline should reflect a defensible “no relevant activity” condition rather than an arbitrary placeholder, because the explanation may be used to justify access decisions or review outcomes. Guidance in the broader AI governance literature, including the NIST Cybersecurity Framework 2.0, supports the need for accountable assumptions and repeatable analytical methods.

Organisations typically encounter the cost of a bad baseline only after an explanation is challenged in a review, at which point baseline input selection becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between application input validation and identity control?
• What is the difference between LDAP injection and ordinary input validation bugs?
• What is the difference between input sanitization and blast-radius control?
• Why does leaving Linux outside the passwordless baseline increase identity risk?