When Does Perturbation Consistency Add Information Beyond Softmax Confidence? Theory and Evidence for the Decision Consistency Framework
Authors: Amit Kalitaa, Moirangthem Tiken Singh
Organizations: Department of Computer Science and Engineering, Dibrugarh University Institute of Engineering and Technology, Dibrugarh University, Dibrugarh, Assam, India
Perturbation consistency scores judge whether a prediction survives small input changes. The Decision Consistency Framework (DCF) scores each image by label stability (LS) and confidence deviation (CD) under six mild operators, combines them into a consistency score (CS), and summarises a model by the gap between accuracy and mean consistency (CAG). We ask when these scores carry information that the clean softmax output lacks. Across 201 evaluations with three seeds per configuration, CS detected misclassifications on clean data less well than the maximum softmax probability (MSP) in every model family. For frozen CNNs, the deficit was 0.057 in area under the ROC curve (AUROC; 95% CI 0.043 to 0.073), at 8 to 15 times the compute. A label flip requires the logit margin to be at most the square root of two times the logit displacement, and at a fixed margin, the displacement predicted errors at AUROC 0.515. The same inequality gives a label-free split-conformal no-flip certificate, never violated in 84 runs. Consistency did add information where confidence is misled: under noise corruptions of CIFAR-10-C, it beat the margin, and under projected gradient attacks, it separated clean from attacked inputs with AUROC 0.83 against 0.37 for MSP at a budget of 2/255, as pre-specified. The gain under noise did not transfer to unseen shift families. The large negative CAG on OCTMNIST persists under full fine-tuning and in-domain training and is partly a class-prior effect: correcting the prior recovers about 40% of the gap.
Figures & tables
Figure 1: Evaluation pipeline and where the theory enters. The left column computes the DCF quantities from K+1 forward passes per image. The right column shows the three results of Section 3 : the exact flip implication (Proposition 1 ), the conformal certificate that needs only the clean margin of a test image and an unlabelled calibration set (Proposition 2 ), and the condition under which LS and CD can carry information beyond the clean logits (Proposition 3 ).
Dataset
Resolution
Classes
Split used for evaluation / calibration
CIFAR-10
32×32
10
test / test (disjoint)
STL-10
96×96
10
test / test (disjoint)
Intel-Scene
150×150
6
test / test (disjoint)
OCTMNIST
28×28
4
test (balanced) / validation, prior (0.344, 0.105, 0.080, 0.472)
Table 1: Datasets. Images are resized to 224×224 for the ImageNet backbones after the perturbation is applied at native resolution. OCTMNIST class priors are given as (choroidal neovascularization, diabetic macular edema, drusen, normal).
Operator
CIFAR-10
STL-10
Intel-Scene
OCTMNIST
Rotation 2∘
15.2 / 9.8
39.0 / 3.6
50.9 / 5.2
0.0 / 0.0
Brightness ×1.1
19.1 / 2.8
18.0 / 0.9
18.1 / 1.2
8.3 / 3.7
Gaussian noise σ=0.01
2.6 / 6.1
2.6 / 1.8
2.6 / 2.0
2.6 / 21.9
Contrast ×1.1
7.6 / 2.5
7.7 / 0.7
8.0 / 1.1
5.4 / 3.6
Blur 3×3 , σ=0.5
5.5 / 9.1
5.3 / 2.2
7.6 / 2.5
6.1 / 14.9
JPEG q=75
9.3 / 21.7
8.5 / 5.1
7.5 / 3.2
0.6 / 2.3
Table 2: Operator audit. Each cell gives the mean ℓ2 distance between clean and perturbed images at the 224×224 network input (pixel values in [0,1] ), followed by the flip rate in percent for frozen CNNs (mean over four models and three seeds).
Dataset
Model
Acc
ECE
LS
CD
CS
CAG
Regime
Convolutional networks, frozen backbone and linear head
CIFAR-10
ResNet-18
0.864
0.009
0.912
0.067
0.922 ± 0.005
−0.058
consistency-dom.
CIFAR-10
ResNet-50
0.883
0.009
0.929
0.057
0.936 ± 0.002
−0.053
consistency-dom.
CIFAR-10
VGG-16
0.841
0.008
0.896
0.075
0.911 ± 0.001
−0.070
consistency-dom.
CIFAR-10
MobileNetV2
0.865
0.017
0.913
0.064
0.924 ± 0.003
−0.059
consistency-dom.
STL-10
ResNet-18
0.948
0.048
0.974
0.028
0.973 ± 0.002
−0.025
balanced
Table 3: Reference values of the DCF quantities (mean over three seeds; ± is the standard deviation of mean CS across seeds). Acc and ECE are computed on the full test split; LS, CD and CS on N=1,000 evaluation images. Regime labels use δ=0.05 and are descriptive only.
Score
CIFAR-10
STL-10
Intel-Scene
OCTMNIST
All
MSP
0.883 / 0.029
0.950 / 0.004
0.892 / 0.014
0.778 / 0.174
0.876 / 0.055
MSP, temperature-scaled
0.883 / 0.029
0.951 / 0.004
0.892 / 0.014
0.778 / 0.174
0.876 / 0.055
Logit margin
0.883 / 0.029
0.950 / 0.004
0.891 / 0.014
0.773 / 0.175
0.874 / 0.056
Negative entropy
0.873 / 0.031
0.940 / 0.004
0.884 / 0.015
0.782 / 0.173
0.870 / 0.056
Max logit
0.813 / 0.044
0.910 / 0.006
0.722 / 0.040
0.773 / 0.182
0.804 / 0.068
Energy
0.794 / 0.048
0.890 / 0.008
0.686 / 0.045
0.767 / 0.185
0.784 / 0.071
Table 4: Misclassification detection for the 16 frozen CNN configurations (48 runs). Each cell gives AUROC / AURC, averaged over models and seeds. Higher AUROC and lower AURC are better.
Figure 2: Misclassification-detection AUROC on clean data for four model families. Bars are means over runs; whiskers span the 10th to 90th percentiles across runs. CS (Eq. ( 5 )) is below MSP and the margin in every family.
Family (runs)
MSP
Margin
Best other
CS
LS
CS > MSP
Transformers (36)
0.891
0.895
entropy 0.878
0.855
0.707
6/36 (all STL-10)
Native CIFAR-10 (42)
0.920
0.921
TTA mean conf. 0.939
0.904
0.781
3/42
13-model zoo (39)
0.865
0.870
TTA mean conf. 0.865
0.778
0.704
0/39
Last-layer ensembles (36)
0.851
n/a
ensemble MSP 0.854
0.786
0.678
0/36 vs ens. MSP
Table 5: Clean misclassification-detection AUROC beyond the frozen CNNs (means over runs). “CS > MSP” counts the runs in which CS had the higher AUROC.
CD definition
α=0.5
α from calibration
α=0.5 chosen
Eq. ( 4 ), max-probability
0.819
0.819
58% of runs
Rescaled to [0,1] on calibration
0.833
0.833
21%
Clean-class probability
0.817
0.817
44%
Total variation
0.828
0.828
46%
Head
Acc
Mean conf.
LS
CS, Eq. ( 5 )
CS, total variation
Fully trained
0.921
0.963
0.943
0.955
0.942
Table 6: Upper part: error-detection AUROC of CS with four definitions of CD, with α=0.5 and with α chosen on the calibration split (48 frozen-CNN runs; MSP reaches 0.876). Lower part: ResNet-20 features with retrained heads on CIFAR-10 (mean of three seeds).
β
Share certified
P(cert.∧flip)
Worst run
Runs violating
Acc. certified / not
0.01
12.6%
0.0000
0.001
0/84
0.977 / 0.841
0.05
23.2%
0.0002
0.003
0/84
0.989 / 0.826
0.10
29.5%
0.0005
0.005
0/84
0.992 / 0.814
Table 7: Conformal no-flip certificate (Proposition 2 ) on 84 frozen runs. The guarantee is P(certified∧flip)≤β .
Figure 3: Conformal no-flip certificate. (a) Share of evaluation images certified at β=0.05 , by dataset and model family. (b) Realised P(certified∧flip) against the guarantee β (dashed), as the mean over 84 runs and for the worst run.
Figure 4: Official CIFAR-10-C, 14 natively trained models, one point per corruption (mean over models, seeds and severities). (a) AUROC of CS minus AUROC of the margin. (b) Gain in cross-validated AUROC from adding DCF features to confidence features when the combiner is fitted on labelled data from the same corruption. Both grow with MSP over-confidence; noise corruptions are the only family where CS beats the margin outright.
Score
PGD 2/255
PGD 4/255
PGD 8/255
SVHN
CIFAR-100
MSP
0.370
0.105
0.023
0.890
0.853
Energy
0.366
0.106
0.022
0.889
0.853
Mahalanobis
0.723
0.800
0.875
0.889
0.801
CS, all six operators
0.829
0.800
0.726
0.841
0.844
CS, noise operator only
0.583
0.224
0.061
0.910
0.846
LS
0.761
0.774
0.709
0.684
0.725
Table 8: Pre-specified adversarial and OOD tests on 14 natively trained CIFAR-10 models (42 runs). AUROC for separating clean from attacked or OOD images (higher is better). The attack is non-adaptive ℓ∞ PGD.
ϵ∞
λ
Attack success
CS detection
CS error det.
MSP error det.
4/255
0
0.98
0.81
0.85
0.10
4/255
1
0.70
0.67
0.87
0.23
4/255
5
0.06
0.09
0.86
0.50
8/255
0
1.00
0.76
0.80
0.06
8/255
1
0.86
0.67
0.79
0.11
8/255
5
0.09
0.05
0.82
0.43
Table 9: Adaptive PGD against DCF (Eq. ( 10 )) on four natively trained models, three seeds each. Detection: clean versus attacked. Error detection: correct versus incorrect predictions on attacked images.
Figure 5: Adversarial inputs. (a) Clean-versus-attacked AUROC under non-adaptive PGD; MSP falls below chance because the attack raises confidence. (b) Adaptive PGD (Eq. ( 10 )): as the weight λ on stability grows, CS detection collapses, but so does the attack success rate.
Dataset
Model, adaptation
Acc
LS
CS
CAG (test)
CAG (val)
OCTMNIST
ResNet-18, frozen, 5 epochs
0.629
0.913
0.930
−0.301
−0.128
ResNet-18, frozen, ≤ 30 epochs + ES
0.622
0.917
0.931
−0.310
−0.124
ResNet-18, full fine-tuning
0.742
0.877
0.898
−0.156
−0.021
ResNet-18, from scratch (in-domain)
0.753
0.953
0.959
−0.206
−0.078
MobileNetV2, frozen, 5 epochs
0.651
0.918
0.932
−0.281
−0.098
MobileNetV2, full fine-tuning
0.739
0.813
0.862
−0.123
+0.002
Table 10: Adaptation controls (mean of three seeds). Frozen: ImageNet backbone with a linear head. ES: early stopping. The scratch model sees no ImageNet data. Validation-split CAG uses the official OCTMNIST validation split, which has the training prior.
Kept
Acc
Rare recall
Rare LS
CAG
CAG, prior corrected
CAG, re-weighted
100%
0.863
0.77
0.87
−0.060
−0.060
−0.060
10%
0.821
0.48
0.81
−0.101
−0.070
−0.040
2%
0.749
0.09
0.82
−0.175
−0.083
−0.031
Table 11: Induced label shift on CIFAR-10 (ResNet-18, frozen, three seeds). Two classes are kept at the given fraction of their training images; the test set is balanced. The 100% row is a separate run and differs slightly from the value in Table 3 .
Figure 6: Stable but wrong. (a) CAG of ResNet-18 on OCTMNIST under four adaptation modes, on the balanced test split and on the validation split that shares the training prior. (b) Induced label shift on CIFAR-10: CAG worsens as two classes become rare, and prior correction or re-weighting removes most of the effect. The dotted line marks CAG =−0.05 , the boundary for δ=0.05 .
Label-free evaluation methods, such as self-consistency filtering, majority-vote aggregation, and agreement-based reliability scoring, rely on an implicit assumption that consistency can serve as a proxy for correctness when ground-truth labels are unavailable or expensive to obtain. In this paper, we test this assumption directly. Using four financial QA datasets (multiple-choice and free-form), ten consistency dimensions, and two frontier model families, we measure the joint distribution of consistency and accuracy at the level of individual examples rather than in aggregate. We find that 60% of all incorrect answers fall in the high-consistency region (consistency ≥ 0.8), and that 77.7% of these show complete answer collapse, i.e. identical wrong answers across all perturbation variants. This high-consistency/incorrect quadrant cannot be detected by any evaluation signal that is built on agreement alone, as the model appears maximally reliable while being wrong. We show that the phenomenon is robust to the choice of consistency threshold t (it persists from t=0.50 to t=1.00), is shared across model families, and is concentrated in specific intersections of perturbation dimension and domain. We map where this quadrant occurs, analyze its stability properties, and discuss the implications for evaluation pipelines that use agreement-based signals in place of human labels.
Deep vision classifiers often achieve high accuracy while remaining poorly calibrated and fragile under small distribution shifts. We present Margin and Consistency Supervision (MaCS), a simple, architecture-agnostic regularization framework that jointly enforces logit-space separation and local prediction stability. MaCS augments cross-entropy with (i) a hinge-squared margin penalty that enforces a target logit gap between the correct class and the strongest competitor, and (ii) a consistency regularizer that minimizes the KL divergence between predictions on clean inputs and mildly perturbed views. We provide a unifying theoretical analysis showing that increasing classification margin while reducing local sensitivity formalized via a Lipschitz-type stability proxy yields improved generalization guarantees and a provable robustness radius bound scaling with the margin-to-sensitivity ratio. Across several image classification benchmarks and several backbones spanning CNNs and Vision Transformers, MaCS consistently improves calibration (lower ECE and NLL) and robustness to common corruptions while preserving or improving top-1 accuracy. Our approach requires no additional data, no architectural changes, and negligible inference overhead, making it an effective drop-in replacement for standard training objectives.
The merit of Conformal Prediction (CP), as a distribution-free framework for uncertainty quantification, depends on generating prediction sets that are efficient, reflected in small average set sizes, while adaptive, meaning they signal uncertainty by varying in size according to input difficulty. A central limitation for deep conformal classifiers is that the nonconformity scores are derived from softmax outputs, which can be unreliable indicators of how certain the model truly is about a given input, sometimes leading to overconfident misclassifications or undue hesitation. In this work, we argue that this unreliability can be inherited by the prediction sets generated by CP, limiting their capacity for adaptiveness. We propose a new approach that leverages information from the pre-softmax logit space, using the Helmholtz Free Energy as a measure of model uncertainty and sample difficulty. By reweighting nonconformity scores with a monotonic transformation of the energy score of each sample, we improve their sensitivity to input difficulty. Our experiments with four state-of-the-art score functions on multiple datasets and deep architectures show that this energy-based enhancement improves the adaptiveness of the prediction sets, leading to a notable increase in both efficiency and adaptiveness compared to baseline nonconformity scores, without introducing any post-hoc complexity.
Navid Akhavan Attar, Hesam Asadollahzadeh, Ling Luo +1
School of Computing and Information Systems, Faculty of Engineering and IT The University of Melbourne, Victoria, Australia