Explaining the predictions of sophisticated machine-learning algorithms is an important issue for the foundations of AI. Recent efforts [Ribeiro et al.2016, Ribeiro et al.2018, Wachter et al.2017, Ignatiev et al.2019, Bachoc et al.2018] have shown various methods for providing explanations. These approaches can be broadly divided into two schools: those that provide a local and human interpretable approximation of a machine learning algorithm, and logical approaches that completely characterise one aspect of the decision. In this paper we investigate a comparison between complete explanations and partial, epistemically accessible ones.
There is an epistemological problem with these complete methods. While they can furnish complete explanations, such explanations may be too complex for humans to understand or even to write down in human readable form. Interpretability requires epistemically accessible explanations, explanations humans can grasp. Yet what is a sufficiently complete or adequate epistemically accessible explanation still needs analysis. We provide such an analysis in terms of counterfactuals, following [Wachter et al.2017].
With counterfactual explanations, many of the assumptions needed to provide a complete explanation are left implicit. To do so, counterfactual explanations exploit the properties of a particular data point or sample, and as such are also local as well as partial explanations. We explore how to move from local partial explanations to what we call complete local explanations and then to global ones. But to preserve accessibility we argue for the need for partiality. This partiality makes it possible to hide explicit biases present in the algorithm that may be injurious or unfair. We investigate how easy it is to uncover these biases in providing complete and fair explanations by exploiting the structure of the set of counterfactuals providing a complete local explanation.
To make the point about biases in counterfactual explanations concrete, consider the following scenario. An ML program judges ’s application for a loan. is turned down. When asks the bank for an explanation of the decision, the bank returns with the following.
. Your income is 50K euro per year.
. If your income had been 100K euro per year, you would have gotten the loan.
The counterfactual in (2) might be true but it also might be misleading, hiding a bias that one might find unfair. Suppose that (1)-(2) is the explanation the bank gives . But suppose also that there is another more morally repugnant explanation: black. If had been white he would have gotten the loan with your current income of 50K per year. There’s also a question of features that indirectly code bias. For example, tying the loan availability to the postal code of ’s residence could be a way of encoding racial bias.
The problem of dissimulating a bias when giving an explanation is a direct outcome of the partiality of epistemically accessible explanations.
2 Background on explanations
Suppose that is the “ideal” function taking data encoded in an n-dimensional space of features into the representations in and that is the function that the algorithm has encoded. For this paper, we’ll assume that
is some sort of classifier and thus we can assumeto be a set of classes. We want to have an explanation of why outputs the predictions it does. We might want to know its behavior over the total space ; this would be a complete explanation. But for many purposes, we might only need to know how behaves on a data point of interest or focal point, like ’s profile that was submitted to the loan program. Note that, we are implicitly assuming that is too complex or opaque for its behaviour to be analyzed statically. For instance,
might be a neural network with multiple layers/parameters/variables etc. Or, it might be be case that we have access only to the binaries of, from which the actual algorithm cannot be reverse-engineered.
There are two sorts of explanations of program behavior. Internal explanations involve the internal states of the program—if these are linked by logic then we can have a deductive explanation for a particular response in to input data from . However, there are also external explanations that involve linking features of with output
(we can also have a deductive link or something else). These are initially attractive because they do not involve unpacking the algorithms’ internal states and assigning them a meaning, which in the case of deep learning networks with multiple hidden layers can be a very complicated affair. Even partial explanations that exploit internal states of a complex neural architecture may be epistemically inaccessible.
[Ignatiev et al.2019] provide a definition of complete explanations. They assume a classifier can be represented as a set of logic formulas, which we assume here too. In addition, we will assume that has a constant set of features with binary values making the encoding into logic transparent.111By increasing the number of literals we can simulate nonbinary values, so this is not really a limitation as long as the features are finite. For [Ignatiev et al.2019], an explanation, or what we call and MS explanation, of a prediction of a classifier given a feature space is a subset minimal set of literals (each one describing a value of a feature in the problem space) such that
where ranges over the set of formulas encoding . means that we can prove in the logic representation that predicts given any instance with features as described in . A complete explanation of the behavior of in our sense would be the set of all possible MS explanations.
An instance in such a set up is a set of literals that assigns values to every feature in the feature space. The underlying logical form of explanations discussed in [Ignatiev et al.2019] thus exploit universal generalizations and a deductive consequence relation. The explanations in [Ignatiev et al.2019] thus explain in principle sets of instances, and they are known as global explanations and are a version of a deductive nomological explanation, where a relation of entailment holds between the explanans and the explanandum.222Note however, such global generalizations may not offer a mathematical function or rule based reconstruction of ’s behavior. Thus, global explanations may be extensional as in the case [Ignatiev et al.2019] or intensional in the form of a rule reconstruction of .
Counterfactuals offer a natural way to provide epistemically accessible, partial explanations geared toward properties of individuals or focal points. Such explanations directed to a particular case are often called local explanations in contrast to global ones [Ribeiro et al.2016, Ribeiro et al.2018]. One reason for using counterfactuals in explanations is that counterfactuals lend themselves to an attractive analysis of causation, as [Lewis1973] proposed.
The reason why counterfactual explanations furnish natural candidates for partial epistemically accessible explanations is that they single out properties or features that would make a difference to a decision about an individual as in 1, other things being as equal as they can be given that the individual has the property described by the counterfactual’s antecedent. This ceteris paribus property of counterfactuals means that many factors that would be mentioned in a complete explanation can remain implicit. They are thus more partial than MS explanations.
The canonical semantics for counterfactuals symbolised via as outlined in [Lewis1973] exploits a possible worlds model for propositional logic and crucially a similarity relation: is true at world just in case for all worlds in which is true and that are the closest worlds to in which is true, is true.
The similarity relation in Lewis’s semantics is used to model the complicated nature of causal laws, which are themselves often formulated with ceteris paribus assumptions. In particular, allows us to have consistent laws with conflicting consequents and antecedents ordered by entailment as in the following set of cascading counterfactuals: . . If I were making 100K euro or more, I would have gotten the loan. .̱ If I were making 100K euro or more but were convicted of a serious financial fraud, I would not get the loan. .̧ If If I were making 100K euro or more and were convicted of a serious financial fraud but then the conviction was overturned and I was awarded a medal, I would get the loan.
In a cascading set of counterfactuals we can count how many times the value of the consequent changes as we move from one antecedent to a logically more specific one (e.g., does the prediction flip from to or from to ). We will call the number of flips the degree of the cascading set. The counterfactual semantics with weak centering333Weak centering requires that for all . permits the counterfactuals in 2 to be satisfiable at a world without forcing the antecedents of 2b or 2c to be inconsistent. The reason for this is that strengthening of the antecedent fails for counterfactuals; the closest worlds in which I make 100k euro do not include a world in which I make 100k euro but am also convicted of fraud. Counterfactuals share this property with other conditionals that have been used as the basis for nonmonotonic reasoning [Ginsberg1986, Pearl1990]. However, if the actual world turns out to be like , then by weak centering 2a turns out to be false, because the ceteris paribus assumption in 2a is that the actual world is one in which I’m not convicted of fraud.
In adapting counterfactuals to provide explanations of a learning algorithm’s behavior around a focal point, it is natural to interpret the similarity relation appealed to in the semantics of counterfactuals as a distance function over the feature space used to describe data points—in effect identifying the latter as the relevant “ worlds” for the semantics of the counterfactuals to be defined over. To find the relevant counterfactuals to explain the behavior of around a focal point where has dimensions, we exploit a linear map where is defined such that there is a subset such that (i) for any , differs from only concerning values for dimensions in , (ii) ; (iii) , with two incompatible predictions in and (iv) such that and differs from only on the values of dimensions , , where is a natural norm on like the Euclidean norm. Thus, represents a minimal change in the features of (values of in the dimensions ) needed to shift the predictions of to from the unwanted prediction . Exploiting the translation from feature values to literals, the antecedents of our target counterfactuals will express these features a conjunction of literals.
As discussed in [Kusner et al.2017], these linear maps can be generated via techniques of adversarial perturbations.444[Kusner et al.2017] explore how to uncover these biased explanations and reveal the ones that are damaging. He uses a Pearl causal system to generate counterfactuals, where the causal variables are exogenous descriptions of input data for the ML algorithm. A typical definition of an adversarial perturbation of an image x, given a classifier, is that it is a smallest change to such that the classification changes. Essentially, this is a counterfactual by a different name. Finding a closest possible world to x such that the classification changes is, under the right choice of distance function, the same as finding the smallest change to x to get the classifier to make a different prediction. Adversarial perturbation has been the locus of a lot of recent research activity and can be computed quite efficiently [Dube2018]. Proofs for minimal perturbations can be found using optimal transport theory [Bachoc et al.2018].
The fact that counterfactuals are closely tied to adversarial examples relative to some focal point invites a comparison to recent work by [Ignatiev et al.2019] on explanations and adversarial examples in a deductive framework. The discussion in [Ignatiev et al.2019] of counterexamples and adversarial examples
builds a bridge between deductive nomological explanations and local counterfactual explanations based on a particular focal point. A counterexample to a prediction is a subset minimal set of literals such that
[Ignatiev et al.2019] show that counterexamples and explanations are incompatible in that every explanation and every counterexample to a prediction contain literals and such that is inconsistent with . An adversarial example to a predication for is then an instance that has all the features of a counterexample to and otherwise has the features of the instance . An adversarial example for a learning model thus is a closest element in to a focal point , in which certain features are shifted so that is a different prediction from . An adversarial example then can be defined in terms of a linear map on , and this map links the adversarial example with a counterfactual.
Counterexamples can also serve as the basis of explanations of properties of a focal element.
Why not for x?
x has features of and is a counterexample to ().
Note that this deductive explanation is distinct from counterfactual explanations. When a counterfactual is used to give an explanation, the relationship between the explanans and the explanandum is not logical consequnce but a more pragmatic relation based on a Lewisian analysis of causation. The counterfactual in 1 gives a sufficient reason for ’s getting the loan, all other factors of my situation being equal or being as equal as possible given the assumption of a different salary for me. Deductive explanations specify those ceteris paribus conditions; this makes them more complex but also invariant with respect to the choice of focal point. Counterfactual explanations depend on the nature of the focal point.
This (relative) simplicity comes at a cost. Counterfactuals may offer only a partial explanation in some cases [Wachter et al.2017]. In fact there are two sorts of partiality in a counterfactual explanation. First a counterfactual explanation doesn’t specify the ceteris paribus conditions and so doesn’t specify what is necessary for the prediction—call this partiality. On the other hand counterfactual explanations are also partial in the sense that they don’t specify all the sufficient conditions for the prediction; they are hence what are called local explanations. A given counterfactual might give only a partial picture of the behavior of the program or agent. It might not give a complete local explanation of a decision, as such a decision might be over determined for the given point at hand. A prediction is over determined for a focal point iff the following set of linear maps contains at least two elements
Many real world applications like our bank loan example will have this feature.
3 From partial to complete explanations
In principle, we can move from a partial picture of the behavior of to a more complete one. The linear maps associated with counterfactuals permit us to plot the local behavior of around a focal point . If we look at all possible using all the possible combinations of dimensions of , we can plot a neighborhood around , , where for all points in the interior , and for points on the boundary of , . We call the collection of such linear maps a complete local explanation of the decision at .
captures the fact that there may be several distinct conditions the lack of which would be causally responsible for a particular prediction, like my not getting the loan in our motivating example. Let us call the set of counterfactuals corresponding to , . may contain many cascading counterfactuals, and its cascading degree may be high.
There are some cases in which the geometry of the prediction space allow us to move from complete local to global explanations of the behavior of . Suppose changes values only once for each feature/dimension moving out from a focal point .555 In such a case forms a convex subspace of and a complete local explanation provides a full global explanation.
There is an important connection between the cascading degree of and the geometry of on the feature space. If changes values only once for each feature/dimension , , has cascading degree 1. In addition, , has cascading degree 1 iff the feature/dimensions are pairwise independant of each other with respect to ’s predictions.
Suppose that the feature space is Boolean valued. Then , has a cascading degree iff is convex.
Proof: Note that a cascading set of counterfactuals exhibits an entailment relation between antecedents. Thus, if and are counterfactuals of degrees n and n-1, entails . This means that if we have a set of cascading counterfactuals of degree or more, we will have antecedents , , which are conjunctions of feature values, such that if that in the Manhattan space of Boolean features puts the points in the feature space corresponding to , , are all on a same line. But if has degree 3 or greater, this forcibly means that one of the points will not be in the space of predictions made at the other two points. So is non convex. Conversely, suppose is non convex. Using the construction of counterfactuals from will immediately yield a cascading set of degree 3 or higher.
The cascading degree of for nonconvex thus gives a measure of the degree of non-convexity of , and a measure of the complexity of an explanation.
: Suppose gives rise to a set of cascading counterfactuals of degree 2. In this case two complete local explanations can determine a full global explanation (and determine the behavior of ).
The problem with complete local explanation is that they may be still too complex for any human to understand. It is not unusual for AI applications to encode data via hundreds even thousands of features. The complete local explanation would involve too many counterfactuals for humans to grasp.
4 Pragmatic constraints on explanations
Because the set of causal factors can be so complex, it becomes apparent that explanations must have an important pragmatic component. All explanations have an “explainee” who asks for the explanation, and an explanation for an explainee must respond to the particular conundrum that brought the explainee to ask for one [Bromberger1962, Achinstein1980].666A more contemporary view aligned with this is [Miller2019]. For instance, our loan seeker may wonder why the bank refused her a loan when she has what she thinks is an adequate qualifying income and other qualities. An appropriate explanation for would then explain which of his assumptions was faulty or incomplete, thus solving the conundrum. In essence, what is going on here is that has in mind the “ideal” function and is confused about why the value of on her data is not that of ; i.e. her conundrum is that . The conundrum can come about for two reasons: either is simply mistaken about the nature of (perhaps she is also mistaken about or if not, she is mistaken about how differs from ), or her understanding of is incomplete.
For the incompleteness sense, suppose is decomposed into ; for only pays attention to the values of dimensions in the sense that for her , for any values . An adequate explanation will then point out that for some where , while
So we have, simplifying, conundra resulting from incompleteness and conundra resulting from mistaken information. We then stipulate:
Suppose we have a conundrum based on incompleteness. An adequate explanation for explainee who requests an explanation why must resolve ’s conundrum arising from attending only to some dimensions of . More precisely, the explanation must provide a such that and while
Suppose ’s conundrum is based on error. An adequate explanation for explainee who requests an explanation why must resolve ’s conundrum by providing the values for the dimensions of on which is mistaken. More precisely, supposing a decomposition of , the explanation must provide a such that such that while
5 The fairness / bias problem
Partial explanations seem good epistemologically, but they can also be dangerous. We remarked that several counterfactuals that point to a difference in behavior may be simultaneously true. But this means that without the complete local explanation, may act in ways unknown to the agent or the public that is biased or unfair. Worse, the constructor or owner of will be able to conceal this fact if the decision for is overdetermined, by offering counterfactual explanations using maps that don’t mention the biased feature.
So we need another constraint on satisfactory explanations: a satisfactory explanation must make clear the biases of the system which may account for ’s incomplete understanding of or . To be more precise, we say that exhibits a biased dependency on particular preducial factor , which we can also take to be a map on , just in case for some , and for some incompatible predictions and
Note that the incompleteness condition for a conundrum mirrors the notion of a biased dependency. As a person with data might reasonably want to know whether such biases were the result of a particular decision, we put one additional constraint on appropriate explanations:
an appropriate explanation for explainee must lay bare any prejudicial factors that affect . That is, where , and are defined as above, the explanation must provide and
In our loan example, explanations that obey (CB) might not be in the interest of the bank that owns the ML algorithm. For instance, the bias of the bank against loans to people of color is unfair to . But the bank might not want to have this bias exposed. This is the ethical problem for explanations.
To attain an appropriate explanation meeting CB, we cannot simply rely on the bank’s proferred explanation, as the bank may have something to hide. In similar fashion, even if we have access to all of , we cannot rest content with just one counterfactual explanation that satisfies CM and CI. We have to ensure that CB is met as well. We will say that a set of counterfactuals provides an adequate local explanation just in case it obeys CM, CI and CB.
Let us suppose that we do not have access to . To find an appropriate explanation, we imagine a game played between the bank and the would be loan taker, in which the loan taker can ask questions of the bank (or owner/ developer of the algorithm) about the algorithm’s decisions. More particularly, we propose to use a two player game, an explanation game to get at appropriate explanations for .
To define an explanation game, we first fix a set of two players . denotes the opponent of .
The moves or actions in the game for , denoted , are to request an explanation from about the behavior of at , which means requesting a particular linear map . may accept an explanation provided by or reject ’s explanation and request an explanation different from explanations previously offered by ; that is request a where and are different sets of dimensions of (this move is known as restriction. Alternatively, may force to provide a counterfactual explanation generating linear map for a particular set of dimensions. If is allowed to use forcing, then she can name which dimensions she wants varied to find a boundary point of .
’s moves consists of the following: may offer a generating a counterfactual explanation; may also claim that a particular map for dimensions does generate a counterfactual explanation—that is, for no values in dimensions do we get the requested prediction; may also insist that a previously given solve ’s conundra. The game terminates when (a) 0 is convinced that her conundra are resolved or (b) when all possible have been examined or (c) 0 does not want to continue anymore.
We assume that in an explanation game it is common knowledge among the players that one can check the truth of ’s responses and whether ’s counterfactuals address the constraints we have mentioned. Thus, we do not address issues of deceit here.
We can now specify an explanation game and its winning condition for player .
An Explanation game, , concerning a polynomially computable function , where is a space of data and a set of predictions, is a tuple where:
, but not has access to the behavior of .
is the starting position, and 0 opens with a request for an explanation.
responds to ’s requests (forcing or restriction) or claims an adequate explanation is already provided.
is a local minimum of with respect to the neighbourhood , where is the current position in the game. Every resolves one or more of 0’s conundra CM or CI.
We say that wins just in case in she acquires a set of counterfactuals about the behavior of concerning features that answer her conundrum.
If the dimensions encoding data in are common knowledge, then always has a winning strategy in an explanation game. We will assume this, and so the real question is how quickly can achieve her winning condition. This depends on three parameters. The first has to do with whether knows which are the prejudicial dimensions for ’s behavior. In general this is not known; an algorithm may be shown to be insensitive say to an explicit gender dimension in the data in the sense that it makes the same predictions whether this feature is taken into account or not. Nevertheless, might still be gender sensitive, because other dimensions of encode gender information, making the gender dimension itself superfluous. In general we do not assume that knows which dimensions are prejudicial—i.e., which dimensions encode prejudicial factors.
The second parameter governing complexity is the degree of the set of cascading counterfactuals associated with . The third has to do whether is allowed forcing moves or only restriction moves.777The complexity of the winning condition is important in a realistic model where finding an explanation is time sensitive. If takes too long to find the explanation, she loses. The standard way to do this is to exploit discounting [Shapley1953]. See also [Asher and Paul2016] for a setting more similar to this one. If we assume that has already calculated the boundary of , then the following results are in order.
Suppose in an explanation game involving and where has focal point and the cascading degree of . If knows which dimensions encode prejudicial factors, she has an at worst linear time winning strategy using forcing. If she does not know know which dimensions encode prejudicial factors, has an worst time winning strategy.
To see that this, note that needs only to force to provide the counterfactuals that vary the known prejudicial factors together with at most one other feature value. The set of counterfactuals uncovered is a linear function of .
If we do not assume 0 knows the prejudicial factors, then:
Suppose in an explanation game involving with ’s data as focal point and the cascading degree of . Then has a winning strategy using forcing in that is in the complexity class Polynomial Local Search (PLS) in the worst case [Johnson et al.1988].
Given that is polynomial and the cascading degree of is fixed, finding the neighbors of a boundary point of is poly-time. Thus, ’s winning strategy for the game meets the conditions for a PLS problem.
What happens when cannot force to provide certain counterfactuals, but can restrict to shift a single dimension in his explanation?
Suppose that for in an explanation game , with and with focal point and the cascading degree of . Then has a worst case linear time with respect to winning strategy in .
Given that can only ask for a single dimension to be shifted, her strategy is just to go through all the dimensions by continuing to ask for a new explanation. Eventually will have gone through all of the dimensions of . As the cascading degree of , she will have determined .
Once the cascading degree associated with , Player can hide, if he wishes, prejudicial factors for exponential time.
Suppose that for in an explanation game , with and with focal point and the cascading degree of . Then has a worst case exponential time with respect to winning strategy in .
Player in this case is free to provide counterfactuals that satisfy constraint (CI) and (CM) but possibly not (CB) and can provide counterfactuals with arbitrarily complex antecedents. Without forcing, cannot make provide counterfactuals that take satisfy (CB). However, given that the boundary is computable, still has a winning strategy with restriction in an explanation game. She will eventually compute the boundary of in exponential time wrt to in the worst case .
We draw from this the moral that in order to be effective an explanation game must allow to force to vary certain dimensions that picks and must have a fixed cascading degree. We also claim that having such a fixed cascading degree might be an important aspect of good explanations, as there is an important connection between cascading degrees and the generality of laws. A low cascading degree means a general set of laws, which a priori is preferable scientifically.
6 Conclusions and outlook
We have used the semantics and logic of counterfactuals to explore epistemically accessible and adequate but partial explanations. Counterfactual explanations are promising vehicles for epistemic accessibility, and we have shown that they can algorithmically provide adequate explanations where all biases are made clear if certain conditions (forcing) obtain and the cascading degree of the set of counterfactuals describing the local neighborhood around the focal point is fixed. However, we have not explored here another important parameter for epistemic adequacy. Adequacy also depends on the characterization of the input data for a learning algorithm . If the dimensionality of is too high or if the dimensions don’t correspond to intuitive concepts, then even partial explanations may not be satisfactory. So to get fully explanatory counterfactuals for the behavior of , it will be important in such cases to find the right representation of the data for the explainee.
Counterfactual explanations may also express adversarial examples. These typically aren’t good explanations of the phenomenon is trying to model. Nevertheless such counterfactuals explain the behavior of and can be as such very valuable.
- [Achinstein1980] P. Achinstein. The Nature of Explanation. Oxford University Press, 1980.
- [Asher and Paul2016] N. Asher and S. Paul. Evaluating conversational success: Weighted message exchange games. In J. Hunter, M. Simons, and M. Stone, editors, 20th workshop on the semantics and pragmatics of dialogue (SEMDIAL), New Jersey, USA, July 2016.
- [Bachoc et al.2018] François Bachoc, Fabrice Gamboa, Max Halford, Jean-Michel Loubes, and Laurent Risser. Entropic variable projection for explainability and intepretability. arXiv preprint arXiv:1810.07924, 2018.
- [Bromberger1962] S. Bromberger. An approach to explanation. In R. Butler, editor, Analytical Philsophy, pages 72–105. Oxford University Press, 1962.
- [Dube2018] Simant Dube. High dimensional spaces, deep learning and adversarial examples. arXiv preprint arXiv:1801.00634, 2018.
- [Ginsberg1986] Matthew L Ginsberg. Counterfactuals. Artificial intelligence, 30(1):35–79, 1986.
- [Ignatiev et al.2019] A. Ignatiev, J. Narodytska, and J. Marques-Silva. On relating explanations and adversarial examples. In Advances in Neural Information Processing Systems, 2019.
- [Johnson et al.1988] David S Johnson, Christos H Papadimitriou, and Mihalis Yannakakis. How easy is local search? Journal of computer and system sciences, 37(1):79–100, 1988.
- [Kusner et al.2017] Matt J Kusner, Joshua Loftus, Chris Russell, and Ricardo Silva. Counterfactual fairness. In Advances in Neural Information Processing Systems, pages 4066–4076, 2017.
- [Lewis1973] David Lewis. Counterfactuals. Basil Blackwell, Oxford, 1973.
- [Miller2019] Tim Miller. Explanation in artificial intelligence: Insights from the social sciences. Artificial Intelligence, pages 1–38, 2019.
- [Pearl1990] Judea Pearl. System z: A natural ordering of defaults with tractable applications to nonmonotonic reasoning. In Proceedings of the 3rd Conference on Theoretical Aspects of Reasoning about Knowledge, pages 121–135. Morgan Kaufmann Publishers Inc., 1990.
- [Ribeiro et al.2016] Marco Túlio Ribeiro, Sameer Singh, and Carlos Guestrin. ”why should I trust you?”: Explaining the predictions of any classifier. In KDD, pages 1135–1144, 2016.
- [Ribeiro et al.2018] Marco Túlio Ribeiro, Sameer Singh, and Carlos Guestrin. Anchors: High-precision model-agnostic explanations. In AAAI, pages 1527–1535, 2018.
- [Shapley1953] Lloyd S. Shapley. Stochastic games. Proceedings of the National Academy of Sciences of the United States of America, 39(10):1095–1100, 1953.
- [Wachter et al.2017] Sandra Wachter, Brent Mittelstadt, and Chris Russell. Counterfactual explanations without opening the black box: Automated decisions and the gpdr. Harv. JL & Tech., 31:841, 2017.