How Stable Are SHAP Explanations for Network Intrusion Detection? A Perturbation-Based Faithfulness Study

Explainable AI (XAI) methods such as SHAP are increasingly presented to security operations center (SOC) analysts as a way to justify machine-learning-based network intrusion detection system (NIDS) alerts, on the premise that a stated explanation increases trust and speeds triage. However, an explanation is only useful if it is stable: small, operationally realistic changes to a flow’s measured features should not produce a substantially different explanation for the same underlying event. In this work we quantify SHAP explanation stability for a gradient-boosted NIDS classifier trained on the UNSW-NB15 benchmark (82,332 training / 175,341 testing flows, 9 attack categories). Our classifier achieves 90.07% test accuracy and 0.986 ROC-AUC sing the dataset’s official, distribution-shifted train/test split. On a stratified 500-flow subsample, we apply a small (3% of feature standard deviation) Gaussian perturbation to continuous flow features — well within the range of ordinary measurement jitter — and find that 22.0% of predictions flip label entirely, and that the top-5 SHAP-attributed features overlap with the pre-perturbation explanation only 54.5% of the time on average (Jaccard index). Explanation stability is markedly higher for confidently and correctly classified flows (0.60 mean overlap) than for misclassified flows (0.46) or near-decision-boundary flows (0.44), and specific continuous byte-count and service features are disproportionately responsible for explanation churn. These results indicate that post-hoc explanations for tree-based NIDS models should be treated as confidence-dependent artifacts rather than fixed ground truth, with direct implications for how such explanations are surfaced to SOC analysts.