TITLE:
ARX-IoT: A Closed-Loop Framework for Resolving Explainability Conflicts and Enabling Actionable IoT Botnet Detection
AUTHORS:
Edja Olivier Tché, Amanvon Ferdinand Atta, Beman Hamidja Kamagaté, Souleymane Oumtanaga
KEYWORDS:
Actionability, Causally-Inspired Veto, Closed-Loop Control, Explainable Artificial Intelligence, Explanatory Conflicts
JOURNAL NAME:
Open Journal of Applied Sciences,
Vol.16 No.10,
October
27,
2026
ABSTRACT: Botnets are spreading fast across the Internet of Things, and that has pushed defenders toward intrusion detection systems built on deep learning. These models detect attacks well, but they work as black boxes, which makes it hard to automate a response in settings where a wrong move is costly. Explainable AI was supposed to solve the transparency problem, yet it introduced one of its own: the explanations don’t agree with each other. Run SHAP and Anchors on the same prediction and you can get two different stories about why the model flagged it. For an operator who has to act on that prediction, this is not a minor inconsistency; it is a real source of doubt. ARX-IoT (Adaptive Resolved XAI) was designed to close the gap between an explanation that merely describes and a decision that has to be made. Rather than treating disagreement between explanations as noise to be smoothed over, the framework reads it as a signal and feeds it back into a control loop. To do this, it puts two very different kinds of explanation on the same footing: TimeSHAP, which assigns each feature a real-valued weight, and Anchors, which produces a binary yes/no mask. Both are mapped into a shared probabilistic space, so they can actually be compared. From there, the framework computes an actionability score that folds together three things: how stable the explanation is over time, how confident the model is, and a probabilistic veto factor. That veto is the safeguard: when the two explanations contradict each other badly, it steps in and pulls back the system’s autonomy instead of letting it act on shaky ground. A feedback loop tunes how sensitive the system is to conflict, adjusting via gradient descent, so that the effect of intervening stays close to a chosen target. We tested ARX-IoT with an attention-based LSTM detector and ran it 103 times on two datasets, CICIoT2023 and TON_IoT. Detection held up throughout, with accuracy above 0.96 on both (see Table 1 for the full per-metric breakdown). The explanations, meanwhile, diverged in a consistent, structural way: the total variation distance reached 0.5382 on CICIoT2023. The ablation study is where the veto earns its place: switching it on cut the risk of a wrong mitigation decision by 26.7% on CICIoT2023 and 10.8% on TON_IoT compared with a system left unregulated, and the size of that improvement tracked how close the observed conflict sat to the critical veto threshold. In short, ARX-IoT works as a transparent safety filter: it catches the risky calls without touching the detection performance the underlying model already delivers.