Robust Evidential Learning Through Latent Consistency

Charmaine Barker; Daniel Bethell; Simos Gerasimou

cs.LGOct 1, 2026

Robust Evidential Learning Through Latent Consistency

Authors: Charmaine Barker, Daniel Bethell, Simos Gerasimou

Organizations: Department of Computer Science, University of York, UK · Department of Elect. Eng., and Computer Science and Eng., Cyprus University of Technology, Cyprus

Abstract

Reliable uncertainty quantification is essential for deploying deep learning models in high-stakes settings, where out-of-distribution and adversarial inputs can induce confident but unreliable predictions. Evidential Deep Learning provides efficient uncertainty estimates in a single forward pass, but can still assign high evidential strength to inputs that are poorly supported by the learned representation, such as adversarial inputs. We introduce CLEAR, a lightweight, task-agnostic post-hoc method that improves evidential robustness without retraining or altering the base prediction. Using held-out calibration data, CLEAR characterises the group-conditioned geometry of the model's latent space. At inference, it efficiently generates perturbation views directly in the latent space and measures their conflict relative to the calibrated geometry of the predicted group. High latent conflict indicates unsupported evidence, which CLEAR uses to selectively reduce evidential strength while retaining evidence for latent-consistent inputs. On ImageNet $\rightarrow$ CUB, CLEAR improves OOD and adversarial AUROC by $+8.29$ and $+5.01$ while running 17.4 $\times$ faster than competing post-hoc methods while preserving predictive performance across classification, regression, and object detection benchmarks.

Figures & tables

Figure 1: CLEAR architecture overview. A pretrained evidential model produces a latent representation and evidential output. CLEAR uses calibration-derived latent geometry to generate perturbed views, computes pairwise latent conflict, and aggregates this into the final conflict score $C(x)$ . This score is used to down-weight unsupported evidential strength post-hoc while preserving the original prediction. The illustrative ID and OOD examples are drawn from Oxford Flowers and DeepWeeds.

Figure 2: Comparison of nine uncertainty-estimation methods across MNIST→FashionMNIST, CIFAR10→CIFAR100, Oxford Flowers→Deep Weeds, and ImageNet→CUB. Rows show ID–OOD vs ID–Adv. AUROC (top) and ID vs Adv. coverage (bottom). Marker size denotes mean inference time, and the black star marks the ideal operating point.

	PostNet	EDL	I-EDL	H-EDL	R-EDL	RED	S-EDL	C-EDL	CLEAR
Type	In-Training						Post-Hoc
MNIST $\rightarrow$ FashionMNIST
ID Acc ( $\%$ ) $\uparrow$	$98.96\pm 0.11$	$99.26\pm 0.07$	$99.20\pm 0.07$	$98.33\pm 0.38$	$99.18\pm 0.08$	$99.01\pm 0.12$	$99.26\pm 0.07$	$99.28\pm 0.04$	$99.26\pm 0.07$
ID Cov ( $\%$ ) $\uparrow$	$91.93\pm 1.89$	$89.16\pm 2.73$	$89.49\pm 3.06$	$85.63\pm 5.84$	$92.33\pm 2.10$	$92.15\pm 1.48$	$89.19\pm 2.67$	$88.29\pm 3.54$	$94.83\pm 0.85$
OOD Cov ( $\%$ ) $\downarrow$	$5.14\pm 2.63$	$12.57\pm 8.80$	$13.20\pm 10.46$	$21.84\pm 16.94$	$7.83\pm 5.99$	$3.64\pm 1.03$	$12.68\pm 8.93$	$16.60\pm 9.68$	$1.84\pm 0.91$
Adv Cov ( $\%$ ) $\downarrow$	$86.16\pm 10.82$	$26.73\pm 13.70$	$31.36\pm 16.33$	$19.44\pm 14.92$	$64.58\pm 12.73$	$28.79\pm 9.32$	$23.05\pm 13.12$	$9.20\pm 7.30$	$7.21\pm 3.90$

Table 1: Mean accuracy, OOD detection, and adversarial attack detection performance with standard deviation (sd) of the comparative approaches with a variety of ID and OOD datasets in order of dataset difficulty. The adversarial attack is an

L_{2}

-PGD attack. For compactness, we denote adversarial AUROC as AAUROC. Highlighted cells denote the best performance for each metric. * indicates datasets classed as Near-OOD. Isolated best values arising from degenerate behaviour, such as near-universal acceptance/rejection or severely degraded ID accuracy, are not highlighted.

	DER	UR-ERN	CLEAR
California Housing $\rightarrow$ California Housing (Price Extremes)*
ID MAE $\downarrow$	$\$ 25.26k\pm 0.61$	$\$ 25.33k\pm 0.56$	$\$ 25.26k\pm 0.61$
ID RMSE $\downarrow$	$\$ 32.84k\pm 0.60$	$\$ 32.95k\pm 0.66$	$\$ 32.84k\pm 0.60$
ID Cov ( $\%$ ) $\uparrow$	$93.01\pm 5.53$	$85.05\pm 28.54$	$57.18\pm 2.98$
OOD Cov ( $\%$ ) $\downarrow$	$91.60\pm 5.57$	$85.05\pm 28.54$	$26.34\pm 4.11$
Adv Cov ( $\%$ ) $\downarrow$	$99.90\pm 0.19$	$89.89\pm 29.96$	$1.05\pm 1.26$

Table 2: Mean accuracy, OOD and Adv. detection performance with standard deviation on ID and OOD regression datasets. Attacks use

L_{\infty}

-PGD; AAUROC denotes adversarial AUROC. Highlighted cells indicate the best result per metric, and * marks Near-OOD datasets.

Figure 3: Qualitative object detection comparison of EMM and CLEAR uncertainty under a covariate Gaussian noise on CelebA.

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

	PostNet	EDL	I-EDL	H-EDL	R-EDL	RED	S-EDL	C-EDL	CLEAR
Type	In-Training						Post-Hoc
MNIST $\rightarrow$ MNIST-C*
ID Acc ( $\%$ ) $\uparrow$	$98.96\pm 0.11$	$99.26\pm 0.07$	$99.20\pm 0.07$	$98.33\pm 0.38$	$99.18\pm 0.08$	$99.01\pm 0.12$	$99.26\pm 0.07$	$99.28\pm 0.04$	$99.26\pm 0.07$
ID Cov ( $\%$ ) $\uparrow$	$84.57\pm 2.09$	$83.08\pm 1.15$	$81.24\pm 2.21$	$77.86\pm 3.37$	$82.33\pm 2.21$	$86.52\pm 2.64$	$81.77\pm 2.61$	$81.38\pm 1.93$	$84.14\pm 1.46$
OOD Cov ( $\%$ ) $\downarrow$	$29.15\pm 2.49$	$27.46\pm 4.19$	$26.24\pm 6.49$	$35.50\pm 5.17$	$25.75\pm 3.15$	$29.34\pm 2.66$	$26.27\pm 4.47$	$30.35\pm 3.92$	$19.26\pm 1.97$
Adv Cov ( $\%$ ) $\downarrow$	$49.64\pm 6.84$	$12.85\pm 3.91$	$13.44\pm 5.42$	$19.44\pm 6.08$	$23.38\pm 4.62$	$47.47\pm 6.96$	$10.23\pm 4.10$	$5.88\pm 3.45$	$3.34\pm 0.92$

Appendix

Table 3: Mean accuracy, OOD detection, and adversarial attack detection performance with standard deviation of the comparative approaches with a variety of ID and OOD datasets in order of dataset difficulty. The adversarial attack is an

L_{2}

-PGD attack. For compactness, we denote adversarial AUROC as AAUROC. Highlighted cells denote the best performance for each metric. * indicates datasets classed as Near-OOD.

	PostNet	EDL	I-EDL	H-EDL	R-EDL	RED	S-EDL	C-EDL	CLEAR
Type	In-Training						Post-Hoc
MNIST $\rightarrow$ FashionMNIST
NLL $\downarrow$	$0.04\pm 0.00$	$0.11\pm 0.00$	$0.16\pm 0.00$	$1.15\pm 0.12$	$0.06\pm 0.00$	$0.06\pm 0.01$	$0.11\pm 0.00$	$0.15\pm 0.00$	$0.58\pm 0.01$
ECE ( $\%$ ) $\downarrow$	$0.40\pm 0.06$	$8.58\pm 0.13$	$12.80\pm 0.17$	$66.05\pm 3.34$	$3.27\pm 0.06$	$0.74\pm 0.11$	$8.59\pm 0.13$	$11.97\pm 0.12$	$30.38\pm 0.33$
$\Delta$ Conf. ID-OOD ( $\%$ ) $\uparrow$	$26.31\pm 4.68$	$24.72\pm 4.72$	$25.87\pm 5.65$	$7.14\pm 2.11$	$24.94\pm 4.51$	$35.12\pm 10.01$	$24.72\pm 4.73$	$29.43\pm 5.73$	$58.84\pm 0.33$
$\Delta$ Conf. ID-Adv. ( $\%$ ) $\uparrow$	$0.30\pm 1.36$	$18.13\pm 4.73$	$16.76\pm 2.78$	$8.64\pm 1.85$	$5.61\pm 2.38$	$7.20\pm 4.53$	$18.85\pm 4.73$	$33.27\pm 3.59$	$58.76\pm 0.36$

Appendix

Table 4: Mean calibration, confidence-drop, and inference-time performance with standard deviation of the comparative approaches across a variety of ID and OOD datasets in order of dataset difficulty. The adversarial attack is an

L_{2}

-PGD attack, and

\Delta

Conf. denotes the mean confidence drop from ID to OOD or adversarial inputs. Highlighted cells denote the best performance for each metric. * indicates datasets classed as Near-OOD. Isolated best values arising from degenerate behaviour or severely degraded ID accuracy are not highlighted.

Figure 4: Hyperparameter sensitivity of CLEAR to the perturbation magnitude $\tau$ . Each line denotes a dataset. From left to right, panels report ID coverage, OOD coverage, adversarial coverage, ID–OOD AUROC, and ID–adversarial AUROC. All other CLEAR hyperparameters are held fixed at their default values.

Figure 5: Hyperparameter sensitivity of CLEAR to the number of latent views $V$ . Each line denotes a dataset. From left to right, panels report ID coverage, OOD coverage, adversarial coverage, ID–OOD AUROC, and ID–adversarial AUROC. All other CLEAR hyperparameters are held fixed at their default values.

Figure 6: Hyperparameter sensitivity of CLEAR to the evidence down-weighting strength $\delta$ . Each line denotes a dataset. From left to right, panels report ID coverage, OOD coverage, adversarial coverage, ID–OOD AUROC, and ID–adversarial AUROC. All other CLEAR hyperparameters are held fixed at their default values.

Figure 7: Hyperparameter sensitivity of CLEAR to the reference conflict quantile $q$ . Each line denotes a dataset. From left to right, panels report ID coverage, OOD coverage, adversarial coverage, ID–OOD AUROC, and ID–adversarial AUROC. All other CLEAR hyperparameters are held fixed at their default values.

Figure 8: Hyperparameter sensitivity of CLEAR for regression to the number of bins $B$ . Each line denotes a dataset. From left to right, panels report ID coverage, OOD coverage, adversarial coverage, ID–OOD AUROC, and ID–adversarial AUROC. All other CLEAR hyperparameters are held fixed at their default values.

	PostNet	EDL	I-EDL	H-EDL	R-EDL	RED	S-EDL	C-EDL	CLEAR
Type	In-Training						Post-Hoc
Differential Entropy (Default)
ID Acc ( $\%$ ) $\uparrow$	$98.96\pm 0.11$	$99.26\pm 0.07$	$99.20\pm 0.07$	$98.33\pm 0.38$	$99.18\pm 0.08$	$99.01\pm 0.12$	$99.26\pm 0.07$	$99.28\pm 0.04$	$99.26\pm 0.07$
ID Cov ( $\%$ ) $\uparrow$	$91.93\pm 1.89$	$89.16\pm 2.73$	$89.49\pm 3.06$	$85.63\pm 5.84$	$92.33\pm 2.10$	$92.15\pm 1.48$	$89.19\pm 2.67$	$88.29\pm 3.54$	$94.83\pm 0.85$
OOD Cov ( $\%$ ) $\downarrow$	$5.14\pm 2.63$	$12.57\pm 8.80$	$13.20\pm 10.46$	$21.84\pm 16.94$	$7.83\pm 5.99$	$3.64\pm 1.03$	$12.68\pm 8.93$	$16.60\pm 9.68$	$1.84\pm 0.91$
Adv Cov ( $\%$ ) $\downarrow$	$86.16\pm 10.82$	$26.73\pm 13.70$	$31.36\pm 16.33$	$19.44\pm 14.92$	$64.58\pm 12.73$	$28.79\pm 9.32$	$23.05\pm 13.12$	$9.20\pm 7.30$	$7.21\pm 3.90$

Appendix

Table 5: Mean accuracy, OOD detection, and adversarial attack detection performance with standard deviation of the comparative approaches across a variety of uncertainty thresholding types for the MNIST

\rightarrow

FashionMNIST setting. For compactness, we denote adversarial AUROC as AAUROC. Highlighted cells denote the best performance for each metric.

		PostNet	EDL	I-EDL	H-EDL	R-EDL	RED	S-EDL	C-EDL	CLEAR
		In-Training						Post-Hoc
Adversarial Coverage ( $\%$ ) $\downarrow$
$L_{2}$ -PGD	0.1	$0.80\pm 0.64$	$8.12\pm 7.34$	$8.58\pm 9.30$	$20.21\pm 16.57$	$3.38\pm 3.69$	$1.54\pm 0.81$	$8.59\pm 7.64$	$13.27\pm 9.31$	$0.65\pm 0.45$
	0.5	$53.91\pm 16.17$	$7.07\pm 6.38$	$9.60\pm 6.35$	$17.66\pm 15.24$	$28.46\pm 15.85$	$19.03\pm 4.72$	$5.77\pm 5.75$	$6.21\pm 5.89$	$1.16\pm 0.87$
	1.0	$86.16\pm 10.82$	$26.73\pm 13.70$	$31.36\pm 16.33$	$19.44\pm 14.92$	$64.58\pm 12.73$	$28.79\pm 9.32$	$23.05\pm 13.12$	$9.20\pm 7.30$	$7.21\pm 3.90$
FGSM	0.1	$9.59\pm 1.92$	$29.87\pm 5.88$	$18.31\pm 7.79$	$26.51\pm 16.57$	$24.28\pm 7.80$	$8.22\pm 4.64$	$29.88\pm 6.31$	$11.23\pm 3.10$	$4.23\pm 3.70$

Appendix

Table 6: Mean adversarial coverage and AUROC performance with standard deviation of the comparative approaches across a variety of adversarial attack types and perturbation strengths for the MNIST

\rightarrow

FashionMNIST setting. Highlighted cells denote the best performance for each attack and strength.

Method	AUROC ( $\%$ ) $\uparrow$	AUPRC ( $\%$ ) $\uparrow$	FPR95 ( $\%$ ) $\downarrow$	ECE ( $\%$ ) $\downarrow$	Pearson $r\uparrow$
EMM	$0.503\pm 0.030$	$0.125\pm 0.028$	$0.907\pm 0.030$	$0.844\pm 0.023$	$0.003\pm 0.084$
CLEAR	$\pagecolor{lightblue}\bm{0.585\pm 0.042}$	$\pagecolor{lightblue}\bm{0.211\pm 0.087}$	$\pagecolor{lightblue}\bm{0.824\pm 0.095}$	$\pagecolor{lightblue}\bm{0.750\pm 0.160}$	$\pagecolor{lightblue}\bm{0.168\pm 0.099}$

Appendix

Table 7: Uncertainty quality on clean CelebA detections. Pearson’s

r

is reported between predictive uncertainty and localisation error (

1-\mathrm{IoU}

), such that higher correlation indicates that poorly localised detections receive greater uncertainty.

Corruption	EMM $r\uparrow$	CLEAR $r\uparrow$	$\Delta r$
Brightness	$0.009\pm 0.017$	$\pagecolor{lightblue}\bm{0.046\pm 0.028}$	$+0.037$
Blur	$0.008\pm 0.025$	$\pagecolor{lightblue}\bm{0.052\pm 0.035}$	$+0.045$
Noise	$0.022\pm 0.027$	$\pagecolor{lightblue}\bm{0.060\pm 0.022}$	$+0.039$
Compression	$0.002\pm 0.022$	$\pagecolor{lightblue}\bm{0.048\pm 0.024}$	$+0.046$
Resize/Crop	$0.009\pm 0.013$	$\pagecolor{lightblue}\bm{0.037\pm 0.024}$	$+0.027$
Overall	$0.010\pm 0.019$	$\pagecolor{lightblue}\bm{0.049\pm 0.023}$	$+0.039$

Appendix

Table 8: Linear association between predictive uncertainty and localisation error under covariate corruption on CelebA. Pearson’s

r

is reported, where higher is better.

Figure 9: Pearson correlation between predictive uncertainty and localisation error under covariate corruption on CelebA. Higher correlation indicates that detections with larger localisation error receive greater uncertainty.

Panel of Figure 10 — Figure 10: Held-out validation of the CLEAR latent geometry on MNIST. Left: PCA projection of held-out latent representations together with class-conditional covariance contours estimated from the training set. Right: Distribution of held-out latent coordinates after class-conditional whitening. The whitened coordinates are centred and approximately bell-shaped, but exhibit heavier tails than the standard normal.

Diagnostic	Ideal	Result
Whitened mean norm / $\sqrt{d}$	$0$	$0.072$
Mean absolute off-diagonal covariance	$0$	$0.071$
Mean diagonal covariance	$1$	$1.286$
Empirical coverage of $50\%$ Gaussian region	$0.50$	$0.529$
Empirical coverage of $95\%$ Gaussian region	$0.95$	$0.634$
Radial KS statistic	$0$	$0.358$

Appendix

Table 9: Latent-geometry diagnostics for CLEAR on MNIST. Whitening statistics are computed per class on held-out ID representations using geometry estimated from the training set.

	Layer 1	Layer 2	Layer 3	Penultimate
Latent Dim.	$64$	$128$	$256$	$512$
ID Acc ( $\%$ ) $\uparrow$	$99.25\pm 0.06$	$99.25\pm 0.06$	$99.25\pm 0.06$	$99.25\pm 0.06$
ID Cov ( $\%$ ) $\uparrow$	$98.98\pm 0.22$	$98.82\pm 0.27$	$97.90\pm 0.55$	$93.81\pm 1.44$
OOD Cov ( $\%$ ) $\downarrow$	$0.41\pm 0.22$	$0.53\pm 0.16$	$0.85\pm 0.40$	$1.82\pm 0.81$
AUROC ( $\%$ ) $\uparrow$	$99.88\pm 0.04$	$99.91\pm 0.02$	$99.80\pm 0.05$	$98.42\pm 0.45$
AAUROC ( $\%$ ) $\uparrow$	$99.88\pm 0.02$	$99.93\pm 0.02$	$99.83\pm 0.04$	$98.29\pm 0.13$

Appendix

Table 10: Sensitivity of CLEAR to the latent representation used for conflict estimation on MNIST

\rightarrow

FashionMNIST over 10 runs. The same trained evidential model is shared across all representations within each run, with only the CLEAR latent geometry recalibrated. AAUROC denotes mean ID-Adv. AUROC across the evaluated

L_{2}

-PGD attack strengths.

Figure 11: Qualitative visualisation of CLEAR’s latent perturbation views for representative Oxford Flowers ID and DeepWeeds OOD inputs. For each input $x$ , two covariance-shaped latent views $h_{1}$ and $h_{2}$ are visualised through feature inversion. The reconstructed views preserve the dominant semantic content of the input, while the corresponding raw conflict scores are substantially larger for the shown OOD examples than for the ID examples.

Panel of Figure 12 — Figure 12: Example images and tables from the datasets used in our experimental evaluation.

Explore similar work

Robustness Meets Uncertainty: Evidential Adversarial Training for Robust Selective Classification
Jul 3, 2026Nicolas Sournac, Ahmed Baha Ben Jmaa, Bertrand BraeckeveldtAdversarial Training Input Uncertainties
Multitel Research & Innovation Center, Artificial Intelligence Department, Belgium · TRAIL – Trusted AI Labs, Belgium
Generalized Evidential Deep Learning: From a Bayesian Perspective
May 25, 2026Yuanye Liu, Yibo Gao, Yuanyang Chen +1Evidential Uncertainty Uncertainty-Aware Classification
School of Data Science, Fudan University, Shanghai, China.
Variational Inference for Evidential Deep Learning
May 26, 2026Jiawei Tang, Xinyan Du, Hui Liu +2Evidential Uncertainty Variational Inference
School of Computer Science and Engineering Southeast University Nanjing 210096, China · School of Computing Information Sciences Saint Francis University2026 Hong Kong SAR, China · CityDepartmentUniversityof Computerof Hong KongScience Hong Kong SAR, China

Jul 3, 2026, cs.LGJ/K move · Enter open · S save

Robustness Meets Uncertainty: Evidential Adversarial Training for Robust Selective Classification

Nicolas Sournac, Ahmed Baha Ben Jmaa, Bertrand Braeckeveldt

Multitel Research & Innovation Center, Artificial Intelligence Department, Belgium · TRAIL – Trusted AI Labs, Belgium

Adversarial Training Input Uncertainties

Open paper AskPDF arXiv

Safety-critical applications require classifiers that are both robust and reliable. Adversarial training is a widely adopted defense for improving robustness in deep neural networks; however, its effect on the reliability of predictive uncertainty remains underexplored. We investigate this gap through the lens of selective classification, which has rarely been systematically analyzed alongside adversarial robustness. We introduce a unified benchmark for the robustness-uncertainty trade-off. It standardizes architectures, augmentations, threat models, and evaluation metrics across clean, adversarial, and common-corruption settings. Across a wide range of state-of-the-art adversarial training methods, we uncover a recurring failure mode: several approaches improve robust accuracy while degrading uncertainty ranking, leading to poorer selective behavior. To address this, we propose Evidential Adversarial Training (EV-AT), which models uncertainty through a Dirichlet distribution and combines (i) an evidence-based loss promoting clean accuracy and reliable uncertainty with (ii) a robust evidence-alignment loss matching clean and adversarial predictions in log Dirichlet-parameter space. Extensive experiments show that EV-AT shifts the Pareto frontier of robustness-uncertainty trade-offs beyond prior state-of-the-art adversarial training methods. Our source code is publicly available at https://github.com/NicolasSournac/Robustness_Meets_Uncertainty.EV-AT.

Abstract

Explore similar work

Robustness Meets Uncertainty: Evidential Adversarial Training for Robust Selective Classification

Generalized Evidential Deep Learning: From a Bayesian Perspective

Variational Inference for Evidential Deep Learning