When Does Perturbation Consistency Add Information Beyond Softmax Confidence? Theory and Evidence for the Decision Consistency Framework

Amit Kalitaa; Moirangthem Tiken Singh

cs.LGOct 27, 2026

When Does Perturbation Consistency Add Information Beyond Softmax Confidence? Theory and Evidence for the Decision Consistency Framework

Authors: Amit Kalitaa, Moirangthem Tiken Singh

Organizations: Department of Computer Science and Engineering, Dibrugarh University Institute of Engineering and Technology, Dibrugarh University, Dibrugarh, Assam, India

Abstract

Perturbation consistency scores judge whether a prediction survives small input changes. The Decision Consistency Framework (DCF) scores each image by label stability (LS) and confidence deviation (CD) under six mild operators, combines them into a consistency score (CS), and summarises a model by the gap between accuracy and mean consistency (CAG). We ask when these scores carry information that the clean softmax output lacks. Across 201 evaluations with three seeds per configuration, CS detected misclassifications on clean data less well than the maximum softmax probability (MSP) in every model family. For frozen CNNs, the deficit was 0.057 in area under the ROC curve (AUROC; 95% CI 0.043 to 0.073), at 8 to 15 times the compute. A label flip requires the logit margin to be at most the square root of two times the logit displacement, and at a fixed margin, the displacement predicted errors at AUROC 0.515. The same inequality gives a label-free split-conformal no-flip certificate, never violated in 84 runs. Consistency did add information where confidence is misled: under noise corruptions of CIFAR-10-C, it beat the margin, and under projected gradient attacks, it separated clean from attacked inputs with AUROC 0.83 against 0.37 for MSP at a budget of 2/255, as pre-specified. The gain under noise did not transfer to unseen shift families. The large negative CAG on OCTMNIST persists under full fine-tuning and in-domain training and is partly a class-prior effect: correcting the prior recovers about 40% of the gap.

Figures & tables

Panel of Figure 1 — Figure 1: Evaluation pipeline and where the theory enters. The left column computes the DCF quantities from $K+1$ forward passes per image. The right column shows the three results of Section 3 : the exact flip implication (Proposition 1 ), the conformal certificate that needs only the clean margin of a test image and an unlabelled calibration set (Proposition 2 ), and the condition under which LS and CD can carry information beyond the clean logits (Proposition 3 ).

Dataset	Resolution	Classes	Split used for evaluation / calibration
CIFAR-10	$32\times 32$	10	test / test (disjoint)
STL-10	$96\times 96$	10	test / test (disjoint)
Intel-Scene	$150\times 150$	6	test / test (disjoint)
OCTMNIST	$28\times 28$	4	test (balanced) / validation, prior (0.344, 0.105, 0.080, 0.472)

Table 1: Datasets. Images are resized to

224\times 224

for the ImageNet backbones after the perturbation is applied at native resolution. OCTMNIST class priors are given as (choroidal neovascularization, diabetic macular edema, drusen, normal).

Operator	CIFAR-10	STL-10	Intel-Scene	OCTMNIST
Rotation $2^{\circ}$	15.2 / 9.8	39.0 / 3.6	50.9 / 5.2	0.0 / 0.0
Brightness $\times 1.1$	19.1 / 2.8	18.0 / 0.9	18.1 / 1.2	8.3 / 3.7
Gaussian noise $\sigma=0.01$	2.6 / 6.1	2.6 / 1.8	2.6 / 2.0	2.6 / 21.9
Contrast $\times 1.1$	7.6 / 2.5	7.7 / 0.7	8.0 / 1.1	5.4 / 3.6
Blur $3\times 3$ , $\sigma=0.5$	5.5 / 9.1	5.3 / 2.2	7.6 / 2.5	6.1 / 14.9
JPEG $q=75$	9.3 / 21.7	8.5 / 5.1	7.5 / 3.2	0.6 / 2.3

Table 2: Operator audit. Each cell gives the mean

\ell_{2}

distance between clean and perturbed images at the

224\times 224

network input (pixel values in

[0,1]

), followed by the flip rate in percent for frozen CNNs (mean over four models and three seeds).

Dataset	Model	Acc	ECE	LS	CD	CS	CAG	Regime
Convolutional networks, frozen backbone and linear head
CIFAR-10	ResNet-18	0.864	0.009	0.912	0.067	0.922 $\pm$ 0.005	$-0.058$	consistency-dom.
CIFAR-10	ResNet-50	0.883	0.009	0.929	0.057	0.936 $\pm$ 0.002	$-0.053$	consistency-dom.
CIFAR-10	VGG-16	0.841	0.008	0.896	0.075	0.911 $\pm$ 0.001	$-0.070$	consistency-dom.
CIFAR-10	MobileNetV2	0.865	0.017	0.913	0.064	0.924 $\pm$ 0.003	$-0.059$	consistency-dom.
STL-10	ResNet-18	0.948	0.048	0.974	0.028	0.973 $\pm$ 0.002	$-0.025$	balanced

Table 3: Reference values of the DCF quantities (mean over three seeds;

\pm

is the standard deviation of mean CS across seeds). Acc and ECE are computed on the full test split; LS, CD and CS on

N=1{,}000

evaluation images. Regime labels use

\delta=0.05

and are descriptive only.

Score	CIFAR-10	STL-10	Intel-Scene	OCTMNIST	All
MSP	0.883 / 0.029	0.950 / 0.004	0.892 / 0.014	0.778 / 0.174	0.876 / 0.055
MSP, temperature-scaled	0.883 / 0.029	0.951 / 0.004	0.892 / 0.014	0.778 / 0.174	0.876 / 0.055
Logit margin	0.883 / 0.029	0.950 / 0.004	0.891 / 0.014	0.773 / 0.175	0.874 / 0.056
Negative entropy	0.873 / 0.031	0.940 / 0.004	0.884 / 0.015	0.782 / 0.173	0.870 / 0.056
Max logit	0.813 / 0.044	0.910 / 0.006	0.722 / 0.040	0.773 / 0.182	0.804 / 0.068
Energy	0.794 / 0.048	0.890 / 0.008	0.686 / 0.045	0.767 / 0.185	0.784 / 0.071

Table 4: Misclassification detection for the 16 frozen CNN configurations (48 runs). Each cell gives AUROC / AURC, averaged over models and seeds. Higher AUROC and lower AURC are better.

Figure 2: Misclassification-detection AUROC on clean data for four model families. Bars are means over runs; whiskers span the 10th to 90th percentiles across runs. CS (Eq. ( 5 )) is below MSP and the margin in every family.

Family (runs)	MSP	Margin	Best other	CS	LS	CS $>$ MSP
Transformers (36)	0.891	0.895	entropy 0.878	0.855	0.707	6/36 (all STL-10)
Native CIFAR-10 (42)	0.920	0.921	TTA mean conf. 0.939	0.904	0.781	3/42
13-model zoo (39)	0.865	0.870	TTA mean conf. 0.865	0.778	0.704	0/39
Last-layer ensembles (36)	0.851	n/a	ensemble MSP 0.854	0.786	0.678	0/36 vs ens. MSP

Table 5: Clean misclassification-detection AUROC beyond the frozen CNNs (means over runs). “CS

>

MSP” counts the runs in which CS had the higher AUROC.

CD definition	$\alpha=0.5$		$\alpha$ from calibration		$\alpha=0.5$ chosen
Eq. ( 4 ), max-probability	0.819		0.819		58% of runs
Rescaled to $[0,1]$ on calibration	0.833		0.833		21%
Clean-class probability	0.817		0.817		44%
Total variation	0.828		0.828		46%
Head	Acc	Mean conf.	LS	CS, Eq. ( 5 )	CS, total variation
Fully trained	0.921	0.963	0.943	0.955	0.942

Table 6: Upper part: error-detection AUROC of CS with four definitions of CD, with

\alpha=0.5

and with

\alpha

chosen on the calibration split (48 frozen-CNN runs; MSP reaches 0.876). Lower part: ResNet-20 features with retrained heads on CIFAR-10 (mean of three seeds).

$\beta$	Share certified	$P(\text{cert.}\wedge\text{flip})$	Worst run	Runs violating	Acc. certified / not
0.01	12.6%	0.0000	0.001	0/84	0.977 / 0.841
0.05	23.2%	0.0002	0.003	0/84	0.989 / 0.826
0.10	29.5%	0.0005	0.005	0/84	0.992 / 0.814

Table 7: Conformal no-flip certificate (Proposition 2 ) on 84 frozen runs. The guarantee is

P(\text{certified}\wedge\text{flip})\leq\beta

Figure 3: Conformal no-flip certificate. (a) Share of evaluation images certified at

\beta=0.05

, by dataset and model family. (b) Realised

P(\text{certified}\wedge\text{flip})

against the guarantee

\beta

(dashed), as the mean over 84 runs and for the worst run.

Figure 4: Official CIFAR-10-C, 14 natively trained models, one point per corruption (mean over models, seeds and severities). (a) AUROC of CS minus AUROC of the margin. (b) Gain in cross-validated AUROC from adding DCF features to confidence features when the combiner is fitted on labelled data from the same corruption. Both grow with MSP over-confidence; noise corruptions are the only family where CS beats the margin outright.

Score	PGD $2/255$	PGD $4/255$	PGD $8/255$	SVHN	CIFAR-100
MSP	0.370	0.105	0.023	0.890	0.853
Energy	0.366	0.106	0.022	0.889	0.853
Mahalanobis	0.723	0.800	0.875	0.889	0.801
CS, all six operators	0.829	0.800	0.726	0.841	0.844
CS, noise operator only	0.583	0.224	0.061	0.910	0.846
LS	0.761	0.774	0.709	0.684	0.725

Table 8: Pre-specified adversarial and OOD tests on 14 natively trained CIFAR-10 models (42 runs). AUROC for separating clean from attacked or OOD images (higher is better). The attack is non-adaptive

\ell_{\infty}

PGD.

$\epsilon_{\infty}$	$\lambda$	Attack success	CS detection	CS error det.	MSP error det.
4/255	0	0.98	0.81	0.85	0.10
4/255	1	0.70	0.67	0.87	0.23
4/255	5	0.06	0.09	0.86	0.50
8/255	0	1.00	0.76	0.80	0.06
8/255	1	0.86	0.67	0.79	0.11
8/255	5	0.09	0.05	0.82	0.43

Table 9: Adaptive PGD against DCF (Eq. ( 10 )) on four natively trained models, three seeds each. Detection: clean versus attacked. Error detection: correct versus incorrect predictions on attacked images.

Figure 5: Adversarial inputs. (a) Clean-versus-attacked AUROC under non-adaptive PGD; MSP falls below chance because the attack raises confidence. (b) Adaptive PGD (Eq. ( 10 )): as the weight

\lambda

on stability grows, CS detection collapses, but so does the attack success rate.

Dataset	Model, adaptation	Acc	LS	CS	CAG (test)	CAG (val)
OCTMNIST	ResNet-18, frozen, 5 epochs	0.629	0.913	0.930	$-0.301$	$-0.128$
	ResNet-18, frozen, $\leq$ 30 epochs + ES	0.622	0.917	0.931	$-0.310$	$-0.124$
	ResNet-18, full fine-tuning	0.742	0.877	0.898	$-0.156$	$-0.021$
	ResNet-18, from scratch (in-domain)	0.753	0.953	0.959	$-0.206$	$-0.078$
	MobileNetV2, frozen, 5 epochs	0.651	0.918	0.932	$-0.281$	$-0.098$
	MobileNetV2, full fine-tuning	0.739	0.813	0.862	$-0.123$	$+0.002$

Table 10: Adaptation controls (mean of three seeds). Frozen: ImageNet backbone with a linear head. ES: early stopping. The scratch model sees no ImageNet data. Validation-split CAG uses the official OCTMNIST validation split, which has the training prior.

Kept	Acc	Rare recall	Rare LS	CAG	CAG, prior corrected	CAG, re-weighted
100%	0.863	0.77	0.87	$-0.060$	$-0.060$	$-0.060$
10%	0.821	0.48	0.81	$-0.101$	$-0.070$	$-0.040$
2%	0.749	0.09	0.82	$-0.175$	$-0.083$	$-0.031$

Table 11: Induced label shift on CIFAR-10 (ResNet-18, frozen, three seeds). Two classes are kept at the given fraction of their training images; the test set is balanced. The 100% row is a separate run and differs slightly from the value in Table 3 .

Figure 6: Stable but wrong. (a) CAG of ResNet-18 on OCTMNIST under four adaptation modes, on the balanced test split and on the validation split that shares the training prior. (b) Induced label shift on CIFAR-10: CAG worsens as two classes become rare, and prior correction or re-weighting removes most of the effect. The dotted line marks CAG

=-0.05

, the boundary for

\delta=0.05

When Judges Agree and Are Wrong: Consistency-Accuracy Dissociation as a Blind Spot for Label-Free Evaluation
Oct 15, 2026Xiang Zhang, Lovedeep Gondara, Jekaterina NovikovaReference-Free Evaluation LLM Reliability
The Vanguard Group, Inc.
Margin and Consistency Supervision for Calibrated and Robust Vision Models
Mar 6, 2026Salim KhazemDistribution Shift Robustness Model Calibration
Talan Research Center, Paris, France.
Softmax is not Enough (for Adaptive Conformal Classification)
Feb 23, 2026Navid Akhavan Attar, Hesam Asadollahzadeh, Ling Luo +1Conformal Prediction Uncertainty Quantification
School of Computing and Information Systems, Faculty of Engineering and IT The University of Melbourne, Victoria, Australia

Oct 15, 2026J/K move · Enter open · S save

When Judges Agree and Are Wrong: Consistency-Accuracy Dissociation as a Blind Spot for Label-Free Evaluation

Xiang Zhang, Lovedeep Gondara, Jekaterina Novikova

The Vanguard Group, Inc.

Reference-Free Evaluation LLM Reliability Self-Consistency in Language Models

Open paper AskPDF arXiv

Label-free evaluation methods, such as self-consistency filtering, majority-vote aggregation, and agreement-based reliability scoring, rely on an implicit assumption that consistency can serve as a proxy for correctness when ground-truth labels are unavailable or expensive to obtain. In this paper, we test this assumption directly. Using four financial QA datasets (multiple-choice and free-form), ten consistency dimensions, and two frontier model families, we measure the joint distribution of consistency and accuracy at the level of individual examples rather than in aggregate. We find that 60% of all incorrect answers fall in the high-consistency region (consistency

\geq

0.8), and that 77.7% of these show complete answer collapse, i.e. identical wrong answers across all perturbation variants. This high-consistency/incorrect quadrant cannot be detected by any evaluation signal that is built on agreement alone, as the model appears maximally reliable while being wrong. We show that the phenomenon is robust to the choice of consistency threshold t (it persists from t=0.50 to t=1.00), is shared across model families, and is concentrated in specific intersections of perturbation dimension and domain. We map where this quadrant occurs, analyze its stability properties, and discuss the implications for evaluation pipelines that use agreement-based signals in place of human labels.

Abstract

Explore similar work

When Judges Agree and Are Wrong: Consistency-Accuracy Dissociation as a Blind Spot for Label-Free Evaluation

Margin and Consistency Supervision for Calibrated and Robust Vision Models

Softmax is not Enough (for Adaptive Conformal Classification)