1 Introduction↩︎

Deep neural networks have become the backbone of modern vision systems, delivering remarkable performance across recognition tasks [1], [2]. In safety-critical deployments, recent efforts in trustworthy machine learning emphasize that reliable systems must be both robust to perturbations and uncertainty-aware [3], [4]. Yet their deployment in such settings remains constrained by two tightly coupled weaknesses: susceptibility to adversarial perturbations [5] and unreliable confidence estimates [6], [7]. Imperceptible input changes can induce incorrect predictions, often persisting in restricted-access and transfer settings, making adversarial robustness a central concern. Adversarial training has therefore emerged as the dominant paradigm to improve robustness [8]–[10]. However, robustness alone is insufficient for risk-sensitive decision making: when errors are costly, a system must also know when not to predict.

This requirement is naturally captured by selective classification, where the model can abstain on inputs it considers unreliable [11]. Selective prediction is a pragmatic interface for safety, deferring to a fallback policy when uncertain. Crucially, selective behavior depends not only on accuracy under attack, but on the integrity of uncertainty under perturbations: errors, especially adversarial ones, must be assigned high uncertainty so they can be rejected [4], [11]. Robustness evaluations [12], which primarily report robust accuracy, can hide a damaging failure mode: a method may become harder to fool while simultaneously degrading uncertainty ranking, producing confident adversarial mistakes that bypass rejection and manifest as silent failures at practically relevant operating points.

A second challenge is methodological. Both robustness and uncertainty are highly sensitive to experimental confounders, making it difficult to draw controlled conclusions about the robustness–uncertainty trade-off. To enable principled comparisons, we introduce a unified benchmark that standardizes these factors and evaluates models as selective systems across clean, adversarial, and common-corruption regimes. Across a broad set of state-of-the-art adversarial training methods, this benchmark reveals a consistent pattern: robustness gains do not reliably translate to robust uncertainty, and several strong defenses improve adversarial accuracy while worsening risk-coverage behavior due to degraded uncertainty ranking.

Motivated by these findings, we introduce Evidential Adversarial Training (EV-AT), a novel adversarial-training objective that explicitly targets predictive uncertainty and regularizes the predictive posterior under attack, without incurring additional computational overhead. EV-AT represents class predictions using a Dirichlet distribution, whose parameters jointly encode (i) the predictive mean used for classification and (ii) the total concentration governing evidential strength and confidence. Rather than aligning only the logits, EV-AT promotes distribution-level robustness by explicitly constraining adversarial drift in log-Dirichlet-parameter space.

Contributions. Our key contributions are summarized as follows:

1. We introduce a standardized benchmark for evaluating the trade-off between robustness and uncertainty in selective classification, using unified and reproducible protocols across training methods, architectures, and data augmentations.

2. We propose Evidential Adversarial Training (EV-AT), a new adversarial training objective that learns Dirichlet distributions to jointly improve robustness and uncertainty quality, thereby enabling more reliable selective classification under adversarial perturbations.

3. Extensive experiments across datasets and threat models show that EV-AT improves adversarial robustness while enhancing uncertainty quality over state-of-the-art adversarial training baselines.

Paper Organization.

2 reviews prior work, 3 introduces EV-AT and its underlying principles, 4 presents the benchmark and experimental evaluation, and 5 concludes the paper.

2 Related Work↩︎

Adversarial Attacks.

Adversarial attacks add small, \(\ell_p\)-bounded perturbations to induce misclassification [5]. Standard gradient-based attacks such as FGSM and projected gradient descent (PGD) [8], [13] generate such perturbations through single-step and iterative updates, respectively. Since robustness can be overestimated due to weak attack settings or gradient masking [14], [15], AutoAttack (AA) [16], a strong parameter-free ensemble evaluation framework, provides a reliable assessment. Benchmarks such as RobustBench [12] and AttackBench [17] promote consistent evaluation.

Adversarial Defenses.

Adversarial training (AT) minimizes the worst-case risk over bounded input perturbations, commonly approximated using PGD [8]–[10]. Although effective, AT often induces a trade-off between clean and robust accuracy. TRADES [18] addresses this trade-off by balancing clean classification performance with consistency between clean and adversarial predictions, while MART [19], AWP [20], SEAT [21], and Generalist[22] improve robust generalization through example-aware optimization, weight perturbation, self-ensembling, and decoupled learners, respectively. Complementary directions improve robustness through augmentation with synthetic data [23]–[25] and refined training objectives, including Improved KL divergence (IKL) [26] and Evidence-based Multi-Feature Fusion (EMFF) [27].

Uncertainty Estimation.

Uncertainty methods broadly fall into sampling-based and sampling-free paradigms [4]. Sampling-based approaches approximate a posterior over parameters or functions but often require multiple evaluations [28]–[32]. Sampling-free alternatives provide single-pass estimates through conformal prediction [33], [34], representation distances for out-of-distribution (OOD) detection [35], [36], or directly learned predictive distributions [37], [38].

Evidential Deep Learning (EDL).

EDL parameterizes a higher-order distribution (e.g., a Dirichlet) to represent evidence over class probabilities and has been applied beyond classification [37]–[39]. Recent theory highlights limitations of learning second-order distributions (e.g., absence of strictly proper scoring rules), implying potential unfaithful estimates [40], [41]. Nevertheless, EDL uncertainties are often well-ranked in practice, making them effective for selective prediction and OOD detection [41], [42].

Robustness–Uncertainty Interaction.

Robustness and uncertainty are often studied separately despite being closely related [3], [4]. Under adversarial perturbations, conformal and representation-distance methods may become unreliable, motivating robust variants and additional smoothness constraints [7], [35], [43]–[46]. Conventional and EDL classifiers can also produce overconfident adversarial errors [6]. Yet the effect of adversarial training on uncertainty ranking and selective performance remains comparatively underexplored [47], [48].

3 Proposed Approach: EV-AT↩︎

3.1 Problem formulation and overview↩︎

We consider supervised \(C\)-class classification with selective prediction under \(\ell_p\)/̄bounded adversarial perturbations. Let \(P\) be a distribution over the input-target space \(\mathcal{X} \times \mathcal{Y}\), where \(\mathcal{X} \subset \mathbb{R}^d\) and \(\mathcal{Y} = \{1, \dots, C\}\). We consider a parametric predictor \(f_\theta: \mathcal{X} \to \Delta^{C-1}\) that maps inputs to the probability simplex. This predictor induces a classification rule \(\hat{y} = \arg\max_{c \in \mathcal{Y}} f_c(\mathbf{x};\theta)\) and is equipped with an uncertainty estimator \(u: \mathcal{X} \to \mathbb{R}\). This score is compared against a threshold \(\tau \in \mathbb{R}\) to define the selective rule \(g_\tau(\mathbf{x}; u) = \mathbb{1}[u(\mathbf{x}) \leq \tau]\), which determines whether a prediction is accepted or rejected. Adversarial examples \(\mathbf{x}^\mathrm{adv}\) are generated by an explicit attack procedure and constrained to the \(\ell_p\=/\)ball \(\mathcal{B}_p(\mathbf{x};\varepsilon)=\{\mathbf{x}':\|\mathbf{x}'-\mathbf{x}\|_p\le\varepsilon\}\).

The objective is to learn the predictor parameters \(\theta\) that simultaneously maximize (i) accuracy on clean data, (ii) robustness of the predicted label within \(\mathcal{B}_p(\mathbf{x},\varepsilon)\), and (iii) integrity of uncertainty under perturbations. Specifically, label-preserving perturbations should remain confidently accepted, whereas perturbations that induce errors should not become confident errors that remain accepted and should instead be ranked as more uncertain. We achieve this objective by minimizing adversarial selective risk at a target adversarial coverage level \(\gamma_{\texttt{cov}}\in[0,1]\), i.e., \(\min_{\theta}\; \mathrm{risk}^{\mathrm{adv}}(\theta;\tau) \quad \text{s.t.}\quad \mathrm{cov}^{\mathrm{adv}}(\tau;\theta)\ge \gamma_{\texttt{cov}}.\)

Adversarial training addresses (i) and (ii) by minimizing a worst-case classification loss over the \(\ell_p\)-ball, but it does not explicitly enforce (iii). As a result, robust-accuracy gains can coincide with degraded uncertainty ranking, increasing selective risk at relevant coverages. EV-AT instead regularizes uncertainty under adversarial perturbations via posterior-level robustness. We model predictions with a Dirichlet posterior and penalize adversarial drift by aligning clean and adversarial evidential representations in log-parameter space. This jointly stabilizes the predictive mean (labels) and concentration (confidence/abstention). 2 illustrates the method, while the corresponding training procedure is detailed in 8 of the supplementary material.

3.2 Evidential classifier↩︎

To treat uncertainty as a primary learning objective, we utilize an evidential framework where the network outputs concentration parameters \(\boldsymbol{\alpha}\) of a Dirichlet distribution. This parameterization provides a structured representation that naturally decomposes into (i) a predictive mean for classification, and (ii) a total concentration, which serves as a principled confidence proxy for selective prediction.

Dirichlet parameterization. For a given input \(\mathbf{x} \in \mathcal{X}\), the network outputs a non-negative evidence vector \(\mathbf{e}_\theta(\mathbf{x})\). It parameterizes a Dirichlet distribution over the categorical probabilities \(\boldsymbol{\pi} \in \Delta^{C-1}\) via the concentration parameters \(\boldsymbol{\alpha} = \mathbf{e}_\theta(\mathbf{x}) + \mathbf{1}\). This formulation induces a posterior predictive distribution \(\mathrm{Cat}(\bar{\boldsymbol{\pi}})\), where the predictive mean \(\bar{\boldsymbol{\pi}} = \boldsymbol{\alpha} / S\) corresponds to the Dirichlet expectation. Here, \(S = \sum_{c=1}^C \alpha_c\) represents the total concentration (or strength), whose magnitude inversely quantifies the model uncertainty. The posterior mean \(\bar{\boldsymbol{\pi}}\) is the standard choice for prediction, with the predicted label given by \(\hat{y} = \arg\max_{c\in\mathcal{Y}} \bar{\pi}_{c}\).

Uncertainty and selective prediction.

The evidential framework treats the Dirichlet strength \(S\) as a principled proxy for epistemic uncertainty. A large strength \(S\) yields a concentrated, confident posterior over \(\boldsymbol{\pi}\), whereas a small \(S\) results in a diffuse distribution reflecting high uncertainty. Total predictive uncertainty is quantified by the entropy of the posterior predictive distribution as \[u(\mathbf{x}) = \mathrm{H}[\mathrm{Cat}(\bar{\boldsymbol{\pi}})] = - \sum_{c=1}^{C} \frac{\alpha_c}{S} \log \frac{\alpha_c}{S}. \label{eq:u95entropy}\tag{1}\] This score enables selective classification by rejecting predictions that exceed a predefined threshold \(\tau\). The resulting selective rule \(g_\tau(\mathbf{x};u) = \mathbb{1}[u(\mathbf{x}) \leq \tau]\) accepts a sample only if its uncertainty is sufficiently bounded.

3.3 Evidential Adversarial Training↩︎

EV-AT follows a min-max formulation: for each input \(\mathbf{x}\), we generate an adversarial example \(\mathbf{x}^{\mathrm{adv}}\) that maximally perturbs the evidential representation, then update the model to (i) fit clean labels with an evidential loss and (ii) minimize the resulting worst-case clean-adversarial drift. Following [sec:why95log95dirichlet], we operate in log-concentration space \(\boldsymbol{\eta}=\log(\boldsymbol{\alpha})\), which acts as a “pseudo-logit” parameterization: additive changes in \(\boldsymbol{\eta}\) correspond to multiplicative changes in \(\boldsymbol{\alpha}\). This provides a well-scaled notion of drift that captures shifts in both the predictive mean and the evidence strength.

Evidence Learning.

We first train an evidential predictor on clean data. Given \((\mathbf{x},y)\), we learn Dirichlet concentrations \(\boldsymbol{\alpha}\) so that the predictive mean \(\bar{\boldsymbol{\pi}}\) matches \(y\) while discouraging spurious evidence. Following EDL [37], we use the negative log marginal likelihood \[\mathcal{L} = -\log \int_{\Delta^{C-1}} p(y|\boldsymbol{\pi})\, p(\boldsymbol{\pi}|\boldsymbol{\alpha})\,\mathrm{d}\boldsymbol{\pi}, \label{eq:dirichlet95type2}\tag{2}\] and add a KL regularizer toward the uniform Dirichlet prior to encourage vacuity when evidence is weak: \[\mathcal{L}_{\mathrm{EV}} = \mathcal{L} + \lambda \cdot \mathrm{KL}\!\left[\mathrm{Dir}(\boldsymbol{\pi}\mid \tilde{\boldsymbol{\alpha}})\,\|\,\mathrm{Dir}(\boldsymbol{\pi}\mid \mathbf{1})\right],\] where \(\lambda>0\) and \(\tilde{\boldsymbol{\alpha}}\) removes ground-truth evidence as in [37].

Evidence-Targeted Adversary.

Standard adversarial training typically constructs \(\mathbf{x}^{\mathrm{adv}}\) by maximizing a classification loss (e.g., cross-entropy) within an \(\ell_p\)/̄ball. In contrast, EV-AT constructs adversarial examples that explicitly target the evidential representation: the attacker seeks perturbations that maximally distort the Dirichlet parameters induced by the network, thereby directly stress-testing uncertainty integrity. Given a clean input \(\mathbf{x}\), we define an evidence drift objective through a discrepancy \(D\) over log-Dirichlet parameters, \(\mathcal{L}\;\triangleq\; D\!\left(\boldsymbol{\eta}, \boldsymbol{\eta}^{adv}\right)\), with \(\boldsymbol{\eta}=\log \boldsymbol{\alpha}\), \(\boldsymbol{\eta}^{adv}=\log \boldsymbol{\alpha}^{adv}\). Starting from a random initialization \(\mathbf{x}^{(0)}=\mathbf{x}+\boldsymbol{\delta}\), \(\boldsymbol{\delta}\sim~\mathcal{U}(-\varepsilon,\varepsilon)^d\), we construct adversarial examples via \(K\)-step PGD [8] and set \(\mathbf{x}^{\mathrm{adv}}=\mathbf{x}^{(K)}\). This adversary is uncertainty-aware: it explicitly searches for perturbations that maximally corrupt the evidential posterior, rather than only flipping the argmax label.

Robust Evidence Alignment.

In the min-max game of EV-AT, the outer minimization aims to simultaneously (i) fit the clean labels with the evidential loss and (ii) reduce the worst-case evidence drift found by the evidence-targeted adversary. To that end, we define the robust evidence alignment term as \(\mathcal{L}_{\mathrm{REA}} \triangleq D(\boldsymbol{\eta},\boldsymbol{\eta}^\mathrm{adv}) \label{eq:rea95def}\) and optimize the EV-AT objective \[\min_{\theta}\; \mathbb{E}_{(\mathbf{x},y)\sim P}\Big[ \mathcal{L}_\mathrm{EV}\big(\boldsymbol{\alpha},y\big) +\beta\, \mathcal{L}_{\mathrm{REA}}(\boldsymbol{\eta},\boldsymbol{\eta}^\mathrm{adv}) \Big], \label{eq:evat95objective}\tag{3}\] where \(\beta>0\) trades off clean evidential fitting and robust alignment.

3.3.0.1 Instantiating the discrepancy \(D\).

EV-AT is compatible with any differentiable discrepancy on \(\boldsymbol{\eta}=\log \boldsymbol{\alpha}\). In our implementation, we use the Improved Kullback-Leibler (IKL) Divergence loss, \(D(\boldsymbol{\eta},\boldsymbol{\eta}^{adv}) \;=\; \mathrm{IKL}(\boldsymbol{\eta},\boldsymbol{\eta}^{adv})\), introduced in [26]. It measures drift directly in the log-parameter space and yields stable gradients for both the attack and the alignment objective. We discuss alternative divergences in the ablation study (4.4).

3.3.0.2 Relation to adversarial training.

Objective 3 parallels robust consistency training [18], [26], but enforces posterior-level (evidential) consistency rather than logit-level consistency. \(\mathcal{L}_{\mathrm{EV}}\) provides clean supervision, while \(\mathcal{L}_{\mathrm{REA}}\) penalizes worst-case discrepancies between clean and adversarial evidential representations. This directly discourages confident adversarial errors by limiting attack-induced changes in the predictive mean and evidence. ¿tbl:tab:loss-taxonomy? in the supplementary material summarizes the objective components of representative robustness methods and the proposed EV-AT formulation.

3.4 Theoretical Motivation & Analysis↩︎

We motivate two EV-AT design choices: (i) measuring adversarial drift at the Dirichlet-posterior level (rather than logits) and (ii) aligning in \(\boldsymbol{\eta}\)-space. Since selection thresholds the predictive entropy \(u(\mathbf{x})=\mathrm{H}[\bar{\boldsymbol{\pi}}]\), robust selective behavior requires limiting attack-induced changes in the predictive mean \(\bar{\boldsymbol{\pi}}\) and in confidence. We show that controlling drift in \(\boldsymbol{\eta}\) stabilizes both the predictive mean \(\bar{\boldsymbol{\pi}}\), which directly determines the entropy-based selection score, and the Dirichlet strength \(S\), which governs posterior concentration.

Posterior alignment.

Logits alignment is a common robustness heuristic, but it only indirectly constrains the quantities used for selective prediction. Logits are not identifiable (e.g., additive shifts leave \(\mathrm{softmax}\) unchanged, and scaling affects confidence implicitly), and standard alignment targets a single classification vector rather than the confidence structure needed for abstention. In an evidential model, the Dirichlet posterior separates these roles: the mean \(\bar{\boldsymbol{\pi}}\) determines the predicted class, while the strength \(S\) controls uncertainty. Aligning the (log-)posterior therefore directly stabilizes both the predictive distribution and its confidence, reducing overconfident errors under perturbation.

Log-concentration space.

Mapping concentrations to \(\boldsymbol{\eta}=\log\boldsymbol{\alpha}\) yields three useful properties.

3.4.0.1 (a) Log-parameters induce the predictive mean.

With \(\boldsymbol{\eta}=\log\boldsymbol{\alpha}\), \[\bar{\boldsymbol{\pi}} \triangleq \mathbb{E}_{\boldsymbol{\pi} \sim \mathrm{Dir}(\boldsymbol{\alpha)}} \left[\boldsymbol{\pi}\right] \;=\; \frac{\boldsymbol{\alpha}}{\sum_c \alpha_c} \;=\; \frac{\exp(\boldsymbol{\eta})}{\sum_c \exp(\eta_c)} \;=\; \mathrm{softmax}(\boldsymbol{\eta}). \label{eq:mean95softmax95eta}\tag{4}\] Consequently, constraining drift in \(\boldsymbol{\eta}\) directly constrains drift in \(\bar{\boldsymbol{\pi}}\). 1 formalizes why log-Dirichlet alignment is appropriate for posterior robustness: it simultaneously limits changes in the predictive mean (class probabilities) and in the evidence scale (strength), two levers that adversarial perturbations can exploit to produce confident errors.

3.4.0.2 (b) Log-drift gives multiplicative evidence stability.

Additive changes in \(\boldsymbol{\eta}\) correspond to multiplicative changes in \(\boldsymbol{\alpha}\): for \(\tilde{\boldsymbol{\eta}}=\boldsymbol{\eta}+\Delta\boldsymbol{\eta}\), \(\tilde{\boldsymbol{\alpha}}=\exp(\tilde{\boldsymbol{\eta}})=\boldsymbol{\alpha}\odot \exp(\Delta\boldsymbol{\eta})\), providing a well-scaled notion of evidence drift.

3.4.0.3 (c) Strength controls posterior precision.

For a fixed mean, the strength \(S=\sum_c \alpha_c\) controls posterior concentration. [lem:mult_stability_final,lem:strength_variance_bound_final] formalize that controlling \(\boldsymbol{\eta}\) jointly stabilizes the mean \(\bar{\boldsymbol{\pi}}\) and precision \(S\) (3).

Guarantees of alignment in entropy-based selection.

Our selector thresholds predictive entropy \(u(\mathbf{x})=\mathrm{H}[\mathrm{Cat}(\bar{\boldsymbol{\pi}})]\), so controlling adversarial drift of \(\bar{\boldsymbol{\pi}}\) stabilizes both uncertainty and the accept/reject decision.

3.4.0.4 (a) Entropy continuity.

If \(\bar{\boldsymbol{\pi}}^{\mathrm{adv}}\) remains close to \(\bar{\boldsymbol{\pi}}\), then \(u^{\mathrm{adv}}\) remains close to \(u\) by continuity of Shannon entropy (3).

3.4.0.5 (b) Stability of selection.

Let the selection margin be \(\tau-u\). If \(|u^{\mathrm{adv}}-u|\le\epsilon_H \quad\text{and}\quad |\tau-u|>\epsilon_H,\) then the decision is unchanged: \(g_{\tau}(\mathbf{x}^{\mathrm{adv}};u^{\mathrm{adv}})=g_{\tau}(\mathbf{x};u).\) Thus, alignment reduces brittleness except near the threshold boundary. Proofs of 2 1 3 and of the selection-stability consequence are provided in supplementary 6.4.

4 Experiments and Results↩︎

4.1 Benchmark Design and Protocol↩︎

We design a controlled benchmark for robustness–uncertainty trade-offs in selective classification. It comprises four layers: data, methods, evaluation, and reporting. See supplementary 9 and 7.1 for details.

Data Layer. We evaluate all methods on CIFAR-10/100 [49] under clean, adversarial, and common-corruption conditions (CIFAR-10/100-C [50]). For each setting, we consider four augmentation strategies: Basic [20], Cutout [51], [52], AutoAugment [53], and AugMix [54].

Method Layer. We compare EV-AT with AT [8], TRADES [18], AT-AWP, TRADES-AWP [20], IKL-AT [26], and TRADES-EMFF [27]. These baselines cover standard adversarial optimization, consistency-based regularization, adversarial weight perturbation, and recent uncertainty-aware robust-training objectives. We evaluate all methods using WideResNet-34-10 [1] and PreActResNet-18 [2], representing complementary high- and moderate-capacity regimes. For each comparison, we fix the architecture, augmentation regime, optimizer family, training budget, and threat model, while varying only the training objective and method-specific coefficients. All models are trained independently under identical experimental conditions using three shared random seeds, and we report the mean and standard deviation across runs.

Evaluation Layer. We evaluate robustness under \(\ell_\infty\) (\(\varepsilon=8/255\)) and \(\ell_2\) (\(\varepsilon=128/255\)) threat models, using AutoAttack (AA) [16] as the primary adversarial evaluation and PGD-20/PGD-100 [8] as diagnostic checks. We report accuracy under clean, adversarial, and corruption conditions, following standard robustness benchmarks [12]. For selective prediction, samples are rejected according to an uncertainty score \(u(x)\). We report retention and risk-coverage curves, with scalar summaries AURC [55], AUGRC [56] (primary), and AUROC for error detection [57]. Metrics are computed consistently across clean, adversarial, and corruption settings.

Reporting Layer. We report per-regime results and clean/AA aggregates. Following [58], we define \(\mathrm{Acc.}_{\mathrm{avg}} =\tfrac{1}{2}(\mathrm{Acc.}_{\mathrm{clean}}+\mathrm{Acc.}_{\mathrm{AA}})\) and compute AURC, AUGRC, and AUROC aggregates analogously.

Implementation and Reproducibility. All training and evaluation configurations are shared across methods through the same benchmark implementation. The complete hyperparameter specification is provided in supplementary ¿tbl:tab:training95hyperparameters?.

4.2 Benchmark Results & Findings↩︎

How do SOTA robust training methods perform as selective classifiers?

1pt

width=

¿tbl:tab:robustness95uncertainty-CIFAR-10? summarizes our benchmark on CIFAR-10/WRN-34-10 across four augmentation regimes, reporting accuracy and AUGRC on clean, adversarial (AA), and corruption (CIFAR-C) inputs, as well as the clean+AA aggregate (Clean/AA). 1 (b) provides a complementary multi-metric comparison. Additional metrics, datasets, and architectures are reported in supplementary 8. A key finding is that no SOTA baseline dominates as a selective system: higher AA accuracy does not reliably imply lower adversarial AUGRC. For example, under Basic, IKL-AT and TRADES-AWP achieve the strongest AA accuracies among baselines yet remain comparatively weak in AUGRC\(_{\mathrm{AA}}\), indicating degraded uncertainty ranking under attack. Conversely, AT-AWP attains the best Clean/AA AUGRC among baselines under Basic despite lower AA accuracy, revealing an internal robustness–uncertainty trade-off. Similar mismatches persist under shift (CIFAR-C), where TRADES-EMFF can achieve strong clean/corruption accuracy but poor adversarial AUGRC. Overall, baselines exhibit “spiky” profiles across robustness and selective metrics, motivating the analyses below.

Do robust-accuracy gains correlate with robust uncertainty, and which methods lie on the Pareto frontier?

[fig:teaser_tradeoff,fig:main_robustness_uncertainty] plot \(\mathrm{Acc.}_{\mathrm{avg}}\) versus \(\mathrm{AUGRC}_{\mathrm{avg}}\) to summarize the robustness–uncertainty trade-off. The correlation is weak: improved adversarial robustness does not reliably improve uncertainty for selective prediction. For instance, IKL-AT increases robustness over AT (\(69.90\) vs.\(68.05\)) but yields worse uncertainty (\(8.00\) vs.\(7.85\)), and AT-AWP matches AT in robustness (\(68.07\) vs.\(68.05\)) while degrading uncertainty (\(8.02\) vs.\(7.85\)). Among SOTA baselines on CIFAR-10/WRN-34-10, TRADES-AWP offers the strongest trade-off (e.g., \(\mathrm{Acc.}_{\mathrm{avg}}=70.29\), \(\mathrm{AUGRC}_{\mathrm{avg}}=7.68\)), illustrating a non-trivial Pareto structure.

Where does selective behavior fail under attack, and does it manifest as confident errors?

5 analyzes selective behavior under adversarial perturbations for AugMix-trained CIFAR-10/WRN-34-10 models, comparing strong baselines and EV-AT. AA perturbations cause the largest degradation in retention and generalized-risk curves, more severe than common corruptions. Failures concentrate at moderate-to-high coverage: many adversarial errors remain accepted, indicating overconfident mistakes. This is reflected by faster risk accumulation and by low coverage at fixed risk (baselines coverage@5% under AA: TRADES-AWP \(0.26\), IKL-AT \(0.23\), TRADES-EMFF \(0.18\)). Overall, under attack, uncertainty no longer separates correct from incorrect predictions, leading to silent failures at practical operating points.

Does EV-AT shift the robustness–uncertainty Pareto frontier beyond prior SOTA?

EV-AT improves robustness and selective performance simultaneously, moving beyond the Pareto frontier formed by prior objectives (1 (a)). Averaged over augmentations, EV-AT improves \(\mathrm{Acc.}_{\mathrm{avg}}\) from \(70.29\) for TRADES-AWP to \(71.84\) and reduces \(\mathrm{AUGRC}_{\mathrm{avg}}\) from \(7.68\) to \(6.52\). This is consistent across augmentation regimes in the Clean/AA summary (¿tbl:tab:robustness95uncertainty-CIFAR-10?) and extends to corruption shift, where EV-AT also yields the best Corr.accuracy and Corr.AUGRC. The improvement is reflected across metrics in the radar view (1 (b)) and in selective operating points: EV-AT reduces the clean-AA retention-gap and substantially increases coverage at fixed risk (5). Overall, EV-AT shifts the robustness–uncertainty frontier by improving robustness without degrading uncertainty ranking, strengthening end-to-end selective behavior under both adversarial and corruption shifts.

4.3 Generalization and Stress Tests↩︎

Diverse Attacks and Threat Models.

We test whether EV-AT’s robustness–uncertainty gains persist across stronger attacks and threat models. 6 reports accuracy and AUGRC averaged over clean and attacked inputs for CIFAR-10/WRN-34-10 and across augmentation regimes. Compared with the strongest baseline, IKL-AT, EV-AT consistently achieves higher accuracy and lower AUGRC under PGD-20, PGD-100, and AutoAttack (AA), for both \(\ell_\infty\) and \(\ell_2\) threat models. Under \(\ell_\infty\), it improves Clean/PGD-20, Clean/PGD-100, and Clean/AA accuracy from \(72.05\%\) to \(74.03\%\), \(71.95\%\) to \(73.90\%\), and \(69.89\%\) to \(71.83\%\), respectively, while reducing Clean/AA AUGRC from \(7.99\) to \(6.52\). The trend also holds under \(\ell_2\), where Clean/AA accuracy increases from \(81.37\%\) to \(82.96\%\) and AUGRC decreases from \(3.56\) to \(2.49\). The consistent gains under more PGD iterations and AA indicate that they are unlikely to result from insufficient attack optimization.

Perturbation Budgets.

We stress-test robustness by sweeping the \(\ell_\infty\) radius \(\varepsilon\in\{0,1,2,4,6,8\}/255\) on CIFAR-10/WRN-34-10, where \(\varepsilon=0\) corresponds to clean evaluation. [fig:eps95sweep] reports PGD-20 accuracy (AugMix). EV-AT is consistently best across the full range, with gains that persist at both small (\(\varepsilon\le 2/255\)) and large (\(\varepsilon\ge 6/255\)) budgets. This indicates improved robustness beyond the standard \(\varepsilon=8/255\) setting, rather than overfitting to a single evaluation radius.

Architectures and Augmentations.

We test generalization across architectures and augmentation pipelines, two major confounders in robust training. Across all four augmentations (Basic/Cutout/AutoAugment/AugMix), EV-AT achieves the best Clean/AA accuracy while also attaining the lowest Clean/AA AUGRC (¿tbl:tab:robustness95uncertainty-CIFAR-10?), whereas several baselines exhibit augmentation-dependent trade-offs. Across architectures and datasets (WRN-34-10 vs.PreActResNet-18; CIFAR-10/100), EV-AT remains on (or beyond) the Pareto frontier in the \(\mathrm{Acc.}_{\mathrm{avg}}\)-\(\mathrm{AUGRC}_{\mathrm{avg}}\) plane (4). Overall, EV-AT’s advantage is stable across both model family and augmentation regime, suggesting it is not an artifact of a specific capacity or pipeline choice.

4.4 Ablations and Analysis of EV-AT↩︎

Objective components.

7 ablates EV-AT on CIFAR-10/WRN-34-10 with AugMix under \(\ell_\infty\) AutoAttack (\(\varepsilon=8/255\)), reporting clean+AA averages. REA is essential: removing it (\(\beta=0\)) collapses performance (Acc.\(71.51\!\rightarrow\!20.11\), AUGRC \(6.67\!\rightarrow\!37.67\)), indicating that the clean evidential loss alone is not robust and that posterior alignment in log-Dirichlet space prevents pathological evidence mismatch under attack. AWP provides an additional but non-substitutable gain (w/o AWP: Acc.\(68.46\), AUGRC \(8.21\)). Replacing the evidential clean loss with cross-entropy also degrades the trade-off (Acc.\(69.56\), AUGRC \(7.88\)). Overall, EV-AT’s gains come from combining the evidential objective with REA, with AWP further improving optimization.

Design Choices.

6pt

¿tbl:tab:ablation95design? ablates key EV-AT design choices on CIFAR-10 using WRN-34-10 and AugMix. We report clean+AA averages under \(\ell_\infty\) AutoAttack with \(\varepsilon=8/255\). (a) Alignment space: aligning in log-Dirichlet space \(\boldsymbol{\eta}=\log\boldsymbol{\alpha}\) is crucial; aligning in \(\boldsymbol{\alpha}\) or in the Dirichlet mean \(\bar{\boldsymbol{\pi}}=\boldsymbol{\alpha}/S\) substantially degrades the trade-off (Acc.\(67.32/64.64\), AUGRC \(10.26/10.43\) vs.\(\boldsymbol{\eta}\): Acc.\(71.51\), AUGRC \(6.67\)). (b) Divergence for REA: IKL performs best; \(\ell_2\) or KL reduces performance (Acc.\(69.81/70.61\), AUGRC \(7.64/7.60\)). (c) Inner-max objective: CE achieves the lowest AUGRC, KL attains the marginally highest accuracy, and IKL provides a balanced operating point close to the best value on both metrics. Overall, robust selective prediction benefits most from posterior alignment in \(\boldsymbol{\eta}\), with IKL providing the most effective signal for both alignment and adversarial example generation.

Sensitivity & stability.

We study sensitivity to the REA weight \(\beta\) using a sweep on CIFAR-10/WRN-34-10 (AugMix) under \(\ell_\infty\) AutoAttack (\(\varepsilon=8/255\)); [fig:lambda95sweep] reports AA accuracy and AA AUGRC (dotted lines: best baseline, IKL-AT). Small \(\beta\) under-emphasizes alignment, yielding weaker robustness and selective performance. Increasing \(\beta\) improves AA accuracy and reduces AA AUGRC up to a moderate range, where EV-AT outperforms IKL-AT on both metrics. For overly large \(\beta\), over-regularization harms both AA accuracy and AUGRC. Overall, \(\beta\) controls the trade-off between clean evidential structure and adversarial posterior alignment, with an intermediate value giving the best joint robustness–uncertainty operating point.

5 Conclusion and Future Work↩︎

In this paper, we studied robustness–uncertainty interactions via robust selective classification. Under a unified benchmark, we show that robust-accuracy gains can degrade uncertainty ranking and risk-coverage behavior under attack. We then propose EV-AT, which learns Dirichlet posteriors and enforces posterior-level robustness via robust evidence alignment. Across datasets, architectures, augmentations, attacks, and threat models, EV-AT improves the robustness–uncertainty trade-off, shifting the Pareto frontier and strengthening selective performance. Despite these gains, several directions remain open. An immediate next step is to scale EV-AT to larger architectures and datasets and to extend the protocol to structured vision tasks (e.g., detection and segmentation), where selective decision-making is central. More broadly, evaluating robust selective classification in additional modalities (e.g., 3D point clouds) and spatiotemporal settings (e.g., video) may reveal new robustness–uncertainty failure modes.

Acknowledgements↩︎

This work was supported by the Walloon Public Service (Economy, Employment and Research) under Grant No. 2010235 (ARIAC – Applications and Research for Trusted Artificial Intelligence), within the DigitalWallonia4.ai program. The research also benefited from computational resources made available on Lucia, the Tier-1 supercomputer of the Walloon Region, infrastructure funded by the Walloon Region under the Grant Agreement No. 1910247.

6 Additional Details on EV-AT↩︎

6.1 Additional Pipeline Details↩︎

8 provides a detailed specification of the training algorithm and clarifies the working principles illustrated in 2 in the main paper.

6.2 Relation to Prior Adversarial Training Objectives↩︎

¿tbl:tab:loss-taxonomy? summarizes the objective components of representative adversarial training methods and our proposed EV-AT formulation. While prior approaches typically enforce robustness through adversarial supervision or consistency regularization in standard output spaces (e.g., logits or predictive probabilities), EV-AT instead operates on evidential representations and performs robust alignment in log-Dirichlet space.

6pt width=

6.3 Relation to Alternative Uncertainty Methods↩︎

Sampling-based methods such as ensembles or Bayesian approximations [28]–[32] can improve uncertainty but require multiple inference passes. Conformal [33], [34] and distance-based methods [35], [36] are complementary post-hoc mechanisms, but do not train uncertainty to remain reliable under attack. EV-AT focuses on this setting: a single-pass adversarial objective that regularizes the predictive posterior under attack, without additional computational overhead (¿tbl:tab:computational95overhead95cifar1095wrn3410?).

6.4 Proofs of the Theoretical Results↩︎

This section provides the proofs of the three lemmas stated in the theoretical analysis of the main paper, together with the selection-stability consequence.

6.4.0.1 Proof of the multiplicative-stability lemma.

Since \(\alpha'_c=\alpha_c\exp(\eta'_c-\eta_c)\), the first bound follows immediately from \(|\eta'_c-\eta_c|\le\rho\). For the strength, \[S'=\sum_c \alpha_c r_c, \qquad r_c\in[e^{-\rho},e^\rho],\] hence \(S'\in[e^{-\rho}S,e^\rho S]\). Finally, \[\bar{\pi}'_c=\frac{\alpha'_c}{S'}=\bar{\pi}_c\frac{r_c}{R}, \qquad R=\frac{S'}{S}\in[e^{-\rho},e^\rho],\] which yields the stated bound on \(\bar{\pi}'_c/\bar{\pi}_c\).

6.4.0.2 Proof of the strength–variance lemma.

For a Dirichlet distribution, \[\mathrm{Var}[\pi_c]=\frac{\alpha_c(S-\alpha_c)}{S^2(S+1)}.\] For fixed \(S\), the product \(\alpha_c(S-\alpha_c)\) is maximized at \(\alpha_c=S/2\), which gives \[\mathrm{Var}[\pi_c]\le \frac{(S/2)^2}{S^2(S+1)}=\frac{1}{4(S+1)}.\]

6.4.0.3 Proof of the entropy-continuity lemma.

Let \[\delta = \frac{1}{2}\|\mathbf{p}-\mathbf{q}\|_1.\] The Fannes–Audenaert continuity inequality for distributions over \(C\) outcomes gives \[\left| \mathrm{H}(\mathbf{p})-\mathrm{H}(\mathbf{q}) \right| \leq \delta\log(C-1)+h(\delta),\] where \[h(\delta) = -\delta\log\delta -(1-\delta)\log(1-\delta)\] is the binary entropy.

6.4.0.4 Proof of the selection-stability consequence.

If \(u(\mathbf{x})\le \tau-\epsilon_H\), then \[u(\mathbf{x}^{\mathrm{adv}})\le u(\mathbf{x})+\epsilon_H<\tau,\] so both samples are accepted. If instead \(u(\mathbf{x})\ge \tau+\epsilon_H\), then \[u(\mathbf{x}^{\mathrm{adv}})\ge u(\mathbf{x})-\epsilon_H>\tau,\] so both samples are rejected.

7 Benchmark Design and Protocol↩︎

7.1 Benchmark Overview↩︎

Our benchmark is designed to enable controlled and reproducible comparisons of the trade-off between robustness and uncertainty quality in selective classification. Both robustness and uncertainty estimates are highly sensitive to experimental confounders, including architecture capacity, augmentation regime, attack strength, and metric definitions. To isolate the effect of the training objective, we standardize (i) architectures, (ii) augmentation pipelines, (iii) threat models and attack budgets, and (iv) evaluation metrics. This yields a unified benchmark for fair cross-method comparison.

As illustrated in 9, the benchmark is organized into four modular layers. The data layer specifies the datasets, robustness settings, and augmentation regimes under which models are evaluated. The method layer comprises architectures, training methods, and uncertainty scorers under a unified model interface. The evaluation layer specifies threat models, protocols, and metrics for robustness, uncertainty, and selective classification. Finally, the reporting layer provides standardized logging, aggregation, and visualization of benchmark outputs.

These components are connected through unified interfaces and executed through a common evaluation pipeline. Starting from data loading and preprocessing, the pipeline evaluates each model under clean, corruption, and adversarial conditions, computes robustness, uncertainty, and selective-prediction metrics, and aggregates the resulting outputs into a unified benchmark report. This design ensures that all methods are compared under a consistent protocol and that robustness, uncertainty quality, and selective performance are evaluated within the same experimental framework.

7.2 Benchmark Setup↩︎

To match the modular design of the benchmark in 9, we organize the experimental setup according to the same four-layer structure. This decomposition clarifies which factors are standardized across methods and why each benchmark axis is necessary for a reliable assessment of robust selective classification.

7.2.1 Data Layer↩︎

Datasets.

We evaluate on CIFAR-10 and CIFAR-100 [49] using the standard train/test splits. These datasets provide two complementary regimes: CIFAR-10 offers a relatively low-class-complexity setting where strong robust baselines are well established, while CIFAR-100 introduces a substantially more challenging uncertainty-ranking problem due to its larger label space and finer-grained class structure. Evaluating both reduces the risk that conclusions are tied to a single task difficulty regime. To assess reliability under distribution shift, we additionally evaluate on CIFAR-10-C and CIFAR-100-C [50], which apply 15 common corruption types spanning noise, blur, weather, and digital artifacts, each at 5 severity levels. This setting is particularly relevant for selective classification, since uncertainty estimates are often most useful when the input departs from the clean training distribution. Unless otherwise stated, corruption results are averaged across all corruption types and severities to obtain a stable summary score rather than conclusions tied to a specific corruption instance.

Robustness Settings.

We evaluate each method under three complementary robustness settings: clean, adversarial, and common corruption. This triad is important because the central claim of the paper concerns not only predictive robustness, but also the preservation of uncertainty structure for selective decision-making. A method may improve adversarial accuracy yet still fail as a selective classifier if uncertainty ranking degrades under attack, or if reliability collapses under natural distribution shift. Evaluating all three settings therefore provides a more complete and deployment-relevant view of robustness–uncertainty behavior.

Augmentation Regimes.

We treat data augmentation as a first-class benchmark axis, since augmentation can substantially affect both robust accuracy and uncertainty ranking. We therefore report results under four standardized pipelines: Basic [20], Cutout [51], [52], AutoAugment [53], and AugMix [54]. These choices span conventional weak augmentation, regularization through masking, learned augmentation policies for improved generalization, and augmentation explicitly designed to improve corruption robustness and uncertainty under shift. Evaluating every method under the same set of augmentation regimes reduces the chance of over-claiming based on a single recipe and provides a broader view of robustness–uncertainty trade-offs.

7.2.2 Method Layer↩︎

Compared Methods.

We compare EV-AT against a deliberately broad suite of adversarial training baselines spanning complementary design choices. AT [8] and TRADES [18] serve as canonical references for, respectively, standard min-max robust optimization and consistency-regularized robustness with an explicit clean-robust trade-off. To disentangle the effect of objective design from optimization- and flatness-related improvements, we additionally include AT-AWP and TRADES-AWP [20], which augment training with adversarial weight perturbation and are known to yield strong robust accuracy. We further evaluate IKL-AT [26] as a recent strong robust training objective, and TRADES-EMFF [27] as a representative method that combines robust training with additional uncertainty-aware modeling components. This set of baselines is intentionally non-strawman: it covers standard robust optimization, consistency-based robust regularization, optimization-enhanced robust training, and recent methods with explicit uncertainty-aware elements.

Architectures.

We use two standard convolutional backbones: WideResNet-34-10 (WRN-34-10) [1] and PreActResNet-18 [2]. WRN-34-10 is a widely used high-capacity reference architecture in adversarial training benchmarks, whereas PreActResNet-18 provides a lower-capacity setting for assessing whether improvements in robustness and uncertainty persist across model scales. Evaluating both helps verify that the observed trends are not architecture-specific or driven solely by model capacity.

Training Protocol.

To ensure fair comparison, we adopt a uniform training protocol across methods. For a given experiment, we fix the backbone architecture, augmentation regime, optimizer family, and training budget, and vary only the training objective together with the method-specific coefficients. For each baseline, we follow the recommended settings whenever possible while enforcing the same threat model, attack budget, and overall compute envelope. All models are trained independently under identical experimental conditions using three shared random seeds, and we report the mean and standard deviation across runs. This protocol is designed to isolate the effect of the learning objective rather than incidental implementation choices.

Implementation and Reproducibility Details.

To facilitate reproducibility, full implementation details are summarized in ¿tbl:tab:training95hyperparameters?.

7.2.3 Evaluation Layer↩︎

Threat Models.

We evaluate robustness under both \(\ell_\infty\) and \(\ell_2\) threat models. These two perturbation geometries are the most widely studied in adversarial robustness and probe different notions of local invariance. Including both allows us to test whether the robustness–uncertainty behavior of a method generalizes beyond a single attack geometry.

Attack Budgets.

For each threat model, we adopt standard perturbation budgets commonly used in robust-training evaluations. Keeping the attack budget fixed across compared methods is essential for fair comparison, since both robust accuracy and uncertainty quality are highly sensitive to perturbation magnitude. The same budget is used consistently within each evaluation setting to avoid confounding objective quality with differences in adversarial difficulty.

Attack Types.

For adversarial evaluation, we report PGD-20 [8], PGD-100 [8], and AutoAttack (AA) [16]. PGD-20 serves as a strong standard first-order evaluation, while PGD-100 provides a stronger convergence check that helps detect under-optimized adversaries. We use AutoAttack as the primary adversarial benchmark because it is a standardized, parameter-free evaluation widely adopted in robust training comparisons. Using both stronger iterative PGD and AA reduces the likelihood that conclusions are driven by weak or attack-specific evaluations.

Metrics.

We evaluate each method using robustness metrics and uncertainty metrics for selective prediction, since robust selective classification requires both to be preserved jointly.
(a) Robustness metrics. Following prior robustness benchmarks [12], we report classification accuracy under clean, adversarial, and corruption settings. For adversarial robustness, AutoAttack is used as the primary metric, while PGD-20 and PGD-100 are reported as diagnostic checks on attack strength and convergence.
(b) Selective-classification and uncertainty metrics. Selective classification is instantiated by rejecting predictions with high uncertainty. We report retention curves (accuracy versus coverage) and risk-coverage curves, which summarize end-to-end selective behavior across operating points. As scalar summaries, we report AURC [55], AUGRC [56], and AUROC [57] for error detection. We emphasize AUGRC because it provides a more reliable benchmark summary than AURC: it is monotonic in both accuracy and uncertainty-ranking quality and is less sensitive to rare high-confidence failures [56]. Together, these metrics capture complementary aspects of selective performance: AURC/AUGRC summarize end-to-end selection quality across thresholds, while AUROC isolates uncertainty-ranking quality independently of a particular operating point.

7.2.4 Reporting Layer↩︎

To summarize robustness–uncertainty trade-offs without collapsing evaluation to a single regime, we report both per-regime metrics and aggregate benchmark scores. Unless otherwise stated, AutoAttack is used as the primary adversarial evaluation, and following [58], we define \(\mathrm{Acc.}_{\mathrm{avg}}=\frac{1}{2}\bigl(\mathrm{Acc.}_{\mathrm{clean}}+\mathrm{Acc.}_{\mathrm{AA}}\bigr),\) with analogous definitions for \(\mathrm{AURC}_{\mathrm{avg}}\), \(\mathrm{AUGRC}_{\mathrm{avg}}\), and \(\mathrm{AUROC}_{\mathrm{avg}}\). This clean+AA aggregation provides a concise summary of the robustness–uncertainty trade-off and supports Pareto-style comparisons between predictive robustness and uncertainty quality without committing to a single threshold. When emphasizing reliability under distribution shift, we additionally report aggregates that include common-corruption performance, providing a more deployment-oriented summary across clean, adversarial, and corrupted conditions. Overall, this dual reporting strategy mitigates over-interpretation of any single test setting and supports the goal of a uniform and exhaustive benchmark for robust selective classification.

max width=

8 Complete Benchmark Results↩︎

This section reports the complete benchmark results corresponding to the summaries presented in the main paper. We provide the full benchmark tables for both datasets (CIFAR-10 and CIFAR-100) and both backbone architectures (WRN-34-10 and PreActResNet-18), using the primary adversarial evaluation protocol described in 7.2. Specifically, ¿tbl:tab:robustness95uncertainty-cifar-10-wrn-34-10-aa? ¿tbl:tab:robustness95uncertainty-cifar-100-wrn-34-10-aa? report the complete results for WRN-34-10 on CIFAR-10 and CIFAR-100, respectively, while ¿tbl:tab:robustness95uncertainty-cifar-10-preactresnet18-aa? ¿tbl:tab:robustness95uncertainty-cifar-100-preactresnet18-aa? report the corresponding results for PreActResNet-18. In addition to these full tables, 19 provides a radar-style summary visualization to offer a compact view of the multi-metric trade-offs induced by the compared methods.

9 Extended Experimental Analyses↩︎

9.1 Extended Stress Tests↩︎

9.1.1 Generalization Across Attack Types↩︎

We further evaluate whether the robustness–uncertainty trade-offs observed in the main benchmark remain consistent across iterative adversarial evaluators of increasing strength. While the primary benchmark uses AutoAttack as the main adversarial protocol, here we additionally report complete results under PGD-20 and PGD-100. The goal of this analysis is to verify that the relative behavior of EV-AT and the compared baselines is not tied to a single evaluator, and that the conclusions remain stable under stronger first-order attacks. Specifically, ¿tbl:tab:robustness95uncertainty-cifar-10-wrn-34-10-pgd20? ¿tbl:tab:robustness95uncertainty-cifar-100-wrn-34-10-pgd20? ¿tbl:tab:robustness95uncertainty-cifar-10-preactresnet18-pgd20? ¿tbl:tab:robustness95uncertainty-cifar-100-preactresnet18-pgd20? report the complete PGD-20 results, while ¿tbl:tab:robustness95uncertainty-cifar-10-wrn-34-10-pgd100? ¿tbl:tab:robustness95uncertainty-cifar-100-wrn-34-10-pgd100? ¿tbl:tab:robustness95uncertainty-cifar-10-preactresnet18-pgd100? ¿tbl:tab:robustness95uncertainty-cifar-100-preactresnet18-pgd100? report the corresponding PGD-100 results.

9.1.2 Generalization Across Threat Models↩︎

We further evaluate whether the robustness–uncertainty trade-offs observed in the main benchmark generalize across threat models. While the primary benchmark focuses on the \(\ell_\infty\) setting, here we additionally report complete results under the \(\ell_2\) threat model. The goal of this analysis is to verify that the relative behavior of EV-AT and the compared baselines is not specific to a single perturbation geometry, and that the conclusions extend to a broader adversarial setting. Specifically, ¿tbl:tab:robustness95uncertainty-cifar-10-model-aa-l2? reports the \(\ell_2\) results.

9.1.3 Generalization Across Perturbation Budgets↩︎

We further evaluate how well the compared methods generalize across perturbation budgets. To complement the summary shown in [fig:eps95sweep] of the main paper, 10 11 report detailed results over a broader range of PGD perturbation strengths and across four augmentation regimes: Basic, Cutout, AutoAug, and AugMix.

9.1.4 Generalization Across Datasets↩︎

To assess whether the gains of EV-AT extend beyond the CIFAR benchmarks, we additionally evaluate it on Tiny-ImageNet with PreActResNet18 under Cutout and AugMix. As shown in ¿tbl:tab:tiny95imagenet95preactresnet18?, EV-AT consistently improves clean and AutoAttack (AA) accuracy while reducing AUGRC compared with IKL-AT across both augmentation regimes. These results indicate that the robustness–uncertainty gains of EV-AT are not confined to CIFAR-10 and CIFAR-100 and remain effective on a larger and more challenging dataset.

3.2pt max width=

9.2 Full Ablation Study↩︎

9.2.1 Objective Components↩︎

We next ablate the main components of EV-AT to understand their individual contributions. ¿tbl:tab:objective95component95ablation? provides the full objective-component ablation on CIFAR-10 with WRN-34-10 under AugMix, complementing the summary results reported in 7 of the main paper.

1pt

max width=

9.2.2 Design Choices↩︎

To complement ¿tbl:tab:ablation95design? in the main paper, ¿tbl:tab:supp95ablation95design? reports the complete ablation of the main design choices.

6pt

9.2.2.1 Shared scoring function.

To assess whether the gains of EV-AT arise from its learned representation or from a method-specific rejection score, we reevaluate all methods using predictive entropy. As shown in ¿tbl:tab:entropy95score95ablation95cifar1095wrn3410?, EV-AT still achieves the best robustness–uncertainty trade-off, indicating that the gains come from the learned evidential representation and posterior-level alignment, not from a method-specific scoring rule.

1pt

max width=

9.2.3 Sensitivity and Stability↩︎

We further analyze the sensitivity and stability of EV-AT with respect to its two main objective coefficients: the REA weight \(\beta\) and the evidential loss regularization coefficient \(\lambda\). [fig:rea_lambda_tradeoff,fig:rea_tradeoffs] show the effect of varying \(\beta\) on the joint robustness–uncertainty trade-off and on pairwise robustness trade-offs, while 15 14 provide the corresponding analysis for \(\lambda\).

14 indicates that the evidential regularization coefficient \(\lambda\) has a non-monotonic effect on the joint robustness–uncertainty trade-off: uncertainty metrics on clean and corrupted data improve as \(\lambda\) increases, whereas AA robustness is strongest at intermediate values of \(\lambda\). This highlights the role of \(\lambda\) as a balancing coefficient between uncertainty quality and adversarial robustness. 15 shows a consistent trade-off pattern across robustness regimes, where increasing \(\lambda\) tends to favor clean and corruption performance but does not monotonically improve adversarial accuracy. In practice, the best overall operating point is obtained for intermediate values of \(\lambda\), which provide the most balanced robustness profile.

9.3 Computational Efficiency↩︎

EV-AT retains single-pass inference and requires no additional test-time forward passes. ¿tbl:tab:computational95overhead95cifar1095wrn3410? reports training time per epoch and peak GPU memory on CIFAR-10/WRN-34-10. Compared with TRADES-AWP under the same augmentation, EV-AT requires approximately \(0.67\times\) the epoch time, corresponding to a reduction of about \(33\%\), while using comparable peak memory. Its training cost is also close to that of IKL-AT, showing that robust evidential alignment remains computationally practical.

2.2pt max width=

10 Robustness Trade-offs Analysis↩︎

To complement the scalar benchmark summaries, we provide in 16 17 18 pairwise trade-off views between the three robustness regimes considered in our evaluation: clean accuracy, adversarial accuracy under AutoAttack (AA), and corruption accuracy. Rather than collapsing performance into a single scalar score, these plots make it possible to assess whether a method remains competitive across operating regimes or improves one axis only at the expense of another. Taken together, 16 17 18 show that EV-AT consistently yields a more favorable robustness trade-off profile than prior adversarial-training baselines. Importantly, this behavior holds across two datasets with different class complexity and across two backbones with different capacity, indicating that the effect is not tied to a specific experimental regime. These pairwise trade-off views support the central claim of the paper: aligning clean and adversarial evidential representations improves robustness without inducing the sharp degradation in complementary regimes that is often observed in standard robust optimization objectives.

References↩︎