Source-linked AI summary

Reconsidering LLM Uncertainty Estimation Methods in the Wild

Yavuz Bakman, Duygu Nur Yaldiz, Sungmin Kang, Tuo Zhang, Baturalp Buyukates, Salman Avestimehr, Sai Praneeth Karimireddy

arXiv:2506.01114v1cs.LGcs.AI

TL;DR

UE methods are often evaluated in isolated short-form QA, leaving questions about real-world deployment unresolved. This paper examines calibration shifts, prompt robustness, and score ensembling. It finds that distribution shifts and adversarial prompts can reduce reliability, while ensembling can improve PRR.

  • Problem

    UE methods have mostly been evaluated in short-form, open-ended QA, leaving their behavior under deployment conditions such as calibration shifts and prompt changes less established.

    Source: §3.3 · p. 4, §4.1 · p. 5, §5.1 · p. 6
  • Method

    The paper evaluates UE scoring of response reliability and examines calibration shifts, adversarial prompt injection, and normalized or calibrated score ensembles.

    Source: §2.1 · p. 2, §3.3 · p. 4, §4.1 · p. 5
  • Results

    Distribution shifts raise UE error, adversarial prompts reduce performance, and ensembling gains up to 0.06 average PRR over the best individual method with 100 calibration samples.

    Source: §3.3 · p. 4, §4.3 · p. 6, §6.3 · p. 9
  • Takeaways & Limitations

    Reliable binary UE decisions call for calibration data aligned with deployment distributions, while normalization or calibration can improve simple score averaging.

    Source: §3.3 · p. 4, §6.3 · p. 9

    The experiments cover only LLaMA-3-8B and GPT-4o-mini, so findings need verification on other state-of-the-art models.

    Source: §9 · pp. 9–10

Abstract

from arXiv · show

Large Language Model (LLM) Uncertainty Estimation (UE) methods have become a crucial tool for detecting hallucinations in recent years. While numerous UE methods have been proposed, most existing studies evaluate them in isolated short-form QA settings using threshold-independent metrics such as AUROC or PRR. However, real-world deployment of UE methods introduces several challenges. In this work, we systematically examine four key aspects of deploying UE methods in practical settings. Specifically, we assess (1) the sensitivity of UE methods to decision threshold selection, (2) their robustness to query transformations such as typos, adversarial prompts, and prior chat history, (3) their applicability to long-form generation, and (4) strategies for handling multiple UE scores for a single query. Our evaluations on 19 UE methods reveal that most of them are highly sensitive to threshold selection when there is a distribution shift in the calibration dataset. While these methods generally exhibit robustness against previous chat history and typos, they are significantly vulnerable to adversarial prompts. Additionally, while existing UE methods can be adapted for long-form generation through various strategies, there remains considerable room for improvement. Lastly, ensembling multiple UE scores at test time provides a notable performance boost, which highlights its potential as a practical improvement strategy. Code is available at: https://github.com/duygunuryldz/uncertainty_in_the_wild.

1 Introduction

Hallucinations remain a reliability concern, while UE research has largely tested methods in isolated short-form QA rather than real-world deployment settings. This paper examines deployment challenges spanning threshold choice, input changes, long-form generation, and combining UE scores.

1 Introduction

  • Existing UE evaluations typically use isolated short-form QA, simple prompts, and threshold-free metrics, leaving practical deployment challenges largely unexplored.UE methods rely on the model itself and have shown promising performance across datasets.Source: §1 · p. 1
  • The study examines threshold stability across distributions and robustness to prior chat context, typos, and adversarial prompts.The figure contrasts the existing short-form, threshold-free evaluation pipeline with the paper’s deployment-focused questions.Source: §1 · p. 1, Figure 1 · p. 2
  • The paper also asks whether short-form UE methods can be adapted to extended answers and whether combining their differing scores can improve performance.Real-world questions may require answers containing multiple claims, and ensembling may surpass individual methods.Source: §1 · p. 2
  • Most UE methods are threshold-sensitive under calibration/test distribution shifts; they often resist prior context and typos but degrade under adversarial prompts, and long-form performance remains below short-form performance.The authors also report that simple score ensembling can improve performance, including with a small calibration set.Source: §1 · p. 2

2 Preliminaries

The preliminaries adopt a practical account of UE, describe its common evaluation metrics, and group the investigated methods by their primary approach.

2.1 Uncertainty Estimation of LLMs

  • The paper notes that LLM UE has no universally accepted definition, and many heuristic methods do not fit theoretical decompositions into aleatoric and epistemic uncertainty.The cited decompositions use LLM sampling distributions.Source: §2.1 · p. 2
  • UE is treated as a practical function that scores a query and generated response, with lower uncertainty indicating greater confidence when the response is reliable in context.For factual QA and mathematical reasoning, reliability concerns correctness against the ground truth.Source: §2.1 · p. 2

2.2 Evaluation of UE Methods

  • UE scores are commonly evaluated against binary correctness labels using threshold-free AUROC, AUPRC, and PRR; this study primarily uses PRR.PRR measures retained-sample precision across rejection thresholds and is normalized against oracle and random strategies.Source: §2.2 · pp. 2–3

2.3 Investigated UE Methods

  • The investigated methods are grouped by primary approach, including probability-based and internal-state methods, with examples such as LNS, MARS, Entropy, and INSIDE.Probability methods use token probabilities; internal-state methods use model activations and are limited to white-box models.Source: §2.3 · p. 3
  • Other method groups use pairwise similarity across sampled outputs or ask the LLM itself to assess confidence, including Self-Detection, P(true), and Verbalized Confidence.Output-consistency methods can be used with black-box models.Source: §2.3 · p. 3

3 Sensitivity of Decision Threshold

The section tests whether thresholds calibrated to reach target performance preserve that performance at test time, especially when calibration and test distributions differ. Across most methods, greater distribution shift increases recall error.

3.1 Problem Statement

  • Because UE scores are continuous, deployment requires a threshold for binary decisions; the study asks whether calibration-set performance is maintained at test time across shifts.The evaluation examines 19 UE methods across two tasks and varying calibration-test distribution shifts.Source: §3.1 · pp. 3–4

3.2 Experimental Design

  • ARE averages the absolute gap between target recall and test recall across recall targets, evaluated under in-domain, same-task-shift, and out-of-domain calibration settings.Experiments use Llama-3-8B and GPT-4o-mini, with 1,000 test samples and 500 calibration samples across the listed QA and reasoning datasets.Source: §3.2 · p. 4

3.3 Results and Discussion

  • Most methods have ARE below 0.05 with TriviaQA calibration, except Verbalized Confidence and Self-Detection; GSM8K calibration produces the greatest error when testing on TriviaQA.Probability-based and output consistency-based methods generally outperform internal state-based and self-checking methods, but only MARS, Semantic Entropy, and Eccentricity consistently maintain low error across calibration datasets.Source: Table 1 · p. 4, §3.3 · p. 4

4 Robustness to Input Transformations

The section evaluates UE robustness to prior chat history, typos, and adversarial prompts. Most methods are resilient to context and typos, but adversarial prompts reduce performance, with output-consistency methods showing greater resilience.

4.1 Problem Statement

  • Earlier evaluations use isolated questions and benign prompts, whereas this section tests transformations that preserve query meaning but may alter model computations used by UE methods.The authors expect robust UE performance to remain similar across such input forms.Source: §4.1 · pp. 4–5

4.3 Results and Discussion

  • Most methods show little performance loss from chat history and typos, including two-typo queries, while adversarial prompts reduce performance, especially for GPT-4o-mini probability-based methods.Output-consistency methods are more resilient to adversarial prompts than other approaches.Source: Figure 2 · p. 5, Figure 3 · p. 6, §4.3 · p. 6

4.2 Experimental Design

  • The experiments prepend prior chat, perturb query characters with typos, and prepend confidence-boosting adversarial prompts intended to confuse UE methods.Context tests include similar- and different-domain prior question-response pairs; typo tests include single-character changes and two-character perturbations.Source: §4.1 · p. 5, §4.2 · pp. 5–6

5 Applicability to Long-Form Generations

Existing UE methods can be adapted to assess uncertainty claim by claim in long-form generations, but their effectiveness remains below short-form QA. Claim-specific questions—especially model-generated answers and averaging across multiple questions—improve performance over simpler strategies.

5.3 Results and Discussion

  • QAG outperforms other strategies, while Naive Application is least effective; claim-specific questions improve uncertainty estimation, and model-generated answers generally outperform direct claim assessment.The comparison covers long-form generation with Llama-3-8B and GPT-4o-mini.Source: Figure 4 · p. 7, §5.3 · p. 8

5.1 Problem Statement

  • The paper adapts existing UE methods to long-form outputs by assigning uncertainty scores to individual claims rather than scoring the entire generation.A strategy function takes the original query, a claim, and a UE method as inputs.Source: §5.1 · p. 7

5.2 Experimental Design

  • An LLM decomposes the full generation into claims, then further decomposes claims because an initial sentence may contain multiple claims.This approach decomposes the entire generation rather than first segmenting it into paragraphs or sentences.Source: §5.2 · p. 7
  • Naive Application evaluates the claim against the original query, while QG generates a claim-specific question and evaluates the claim as its answer.QAG instead generates a response to the claim-specific question for assessment.Source: §5.2 · pp. 7–8
  • Under QAG, a model-generated answer is assessed only if it is semantically equivalent to the claim; otherwise, the claim receives a high uncertainty score.Multiple questions can be used and their scores aggregated by minimum, maximum, or average.Source: §5.2 · p. 8
  • Experiments use 50 questions each from FactScore-Bio and LongFact-Objects, with claim-level UE scores evaluated against ground truths set using SAFE.GPT-4o-mini and Llama3-8B are the base models; GPT-4o-mini performs text decomposition across models.Source: §5.2 · p. 8

5.3 Results and Discussion

  • Multiple questions consistently improve QG and QAG performance with few exceptions, and averaging is the most effective evaluated aggregation method.The evaluated alternatives are minimum, maximum, and average aggregation.Source: §5.3 · p. 8
  • PRR scores are higher on FactScore-Bio than LongFact-Objects, and long-form generation shows a non-negligible performance drop compared with short-form QA such as TriviaQA.LongFact-Objects covers broader subjects, including chemistry, gaming, and geography.Source: §5.3 · p. 8

6 Reconcilability of Diverse UE Scores

The paper ensembles diverse UE scores after preprocessing them to address their differing numerical scales. With 100 calibration samples, ensembling can improve average PRR over the strongest individual method, while results depend on the preprocessing and ensemble strategy.

6.1 Problem Statement

  • The ensemble aggregates a vector of outputs from multiple UE methods, using a small supervised calibration dataset of 100 samples for score normalization.The paper considers 19 UE methods.Source: §6.1 · p. 8

6.2 Experimental Design

  • The evaluation compares all-method ensembles against the strongest individual method on TriviaQA and GSM8K using Llama-3-8B and GPT-4o-mini.The full set of possible ensemble combinations is not exhaustively evaluated because it is computationally infeasible.Source: §6.2 · p. 8
  • Score preprocessing includes raw scores, standard normalization using calibration-set statistics, and isotonic regression calibration to probabilities approximating correctness likelihood.Isotonic regression, unlike normalization, also requires calibration ground truths.Source: §6.2 · p. 9
  • The paper combines scores using minimum, maximum, averaging, voting, or supervised models trained on calibration data.The weighted average uses each estimator's PRR performance on the calibration set as its weight.Source: §6.2 · p. 9

6.3 Results and Discussion

  • Ensembling strategies gain up to 0.06 average PRR over the most performant individual UE method, even with 100 calibration samples.Table 2 reports PRR scores for ensembling strategies over 19 UE methods.Source: Table 2 · p. 9, §6.3 · p. 9
  • Combining raw UE scores without normalization or calibration is ineffective because methods produce scores on different scales.Normalization or calibration improves ensembling, including simple averaging of all scores.Source: §6.3 · p. 9
  • Linear models with normalized or calibrated inputs consistently outperform the best individual UE method, whereas decision trees generally do not provide competitive ensemble performance.Using only unsupervised UE methods also improves performance over the best unsupervised method.Source: §6.3 · p. 9

7 Conclusion

The paper evaluates 19 UE methods across four challenges in real-world deployment. It finds vulnerabilities to threshold shifts and adversarial prompts, limited long-form effectiveness, and performance gains from ensembling.

  • The evaluation examines 19 UE methods across four real-world deployment challenges.Source: §7 · p. 9
  • Most UE methods are highly sensitive to decision thresholds and remain vulnerable to adversarial prompts, despite resilience to typos and prior context.The paper calls for improving robustness to threshold selection and prompt variations.Source: §7 · p. 9
  • UE methods can be adapted for long-form generation, but their effectiveness remains limited.The paper identifies more effective long-form strategies as a future research direction.Source: §7 · p. 9
  • Ensembling multiple UE methods significantly enhances performance, even with simple strategies.The paper recommends exploring advanced ensembling techniques to maximize performance.Source: §7 · p. 9

9 Limitations

The paper limits its evaluation to two models, reviews related work on real-world UE, and adopts a broad definition of UE. It also describes probability-based methods, from token scoring to trainable reliability models.

9 Limitations

  • The experiments cover only LLaMA-3-8B and GPT-4o-mini; the authors call for testing other state-of-the-art models to assess broader applicability.The framework can also be extended to UE methods beyond the 19 investigated.Source: §9 · pp. 9–10

A Related Works

B Further Discussions on the Definition of Uncertainty Estimation of LLMs

  • UE relies on the model’s internals, probabilities, or outputs, excludes external-source detectors, and can score either a sampled generation or a query generally.The paper adopts a broad definition that includes query-level scores as proxies for uncertainty in sampled generations.Source: B Further Discussions on the… · p. 13

C.1 Probability-Based Methods

  • LNS averages generated-token log probabilities, while Entropy averages LNS across sampled generations and Semantic Entropy computes entropy over semantic clusters.Semantic Entropy groups semantically equivalent responses; the paper uses a DeBERTa-based NLI model to form clusters.Source: §C.1 · pp. 13–14
  • MARS and TokenSAR weight token probabilities by token contribution or semantic significance, SAR combines TokenSAR and SentSAR, and LARS predicts reliability with a trainable transformer.LARS takes the question, generated tokens, and their probabilities as input.Source: §C.1 · p. 14

C.2 Internal State-Based Methods

The paper describes UE methods based on internal states, output consistency, and self-assessed confidence. It also reports that calibration distribution shifts substantially increase ARE for most methods on GSM8K.

C.2 Internal State-Based Methods

  • EigenScore measures hidden-state semantic divergence across sampled generations, Attention Scores aggregate attention-kernel log determinants, and SAPLMA predicts truthfulness from last-token activations.The implementation adds the question to SAPLMA’s input and uses the last layer’s activations.Source: §C.2 · p. 14

C.3 Output Consistency-Based Methods

  • Output-consistency methods derive scores from relations among generations, including entailment graphs and Laplacian-based kernels, while Self Detection paraphrases questions and scores entailment clusters.Self Detection uses five paraphrased questions in the reported experiments.Source: §C.3 · p. 15

C.4 Self-Checking Methods

  • Self-checking methods ask the model to assess its response, using either the probability of “true” or a verbalized confidence score from 0 to 100.Source: §C.4 · pp. 15–16

D.1 Sensitivity of Decision Threshold

  • ARE increases significantly for most methods when calibration data have greater distributional shift, such as TriviaQA; only MARS, Semantic Entropy, and Eccentricity consistently maintain low ARE across both calibration datasets.The reported additional results use GSM8K as the test dataset.Source: §D.1 · p. 16

D.2 Robustness to Input Transformations

With two typos per sentence, most UE methods remain resilient. For long-form QA and QAG, averaging scores across five questions per claim performs best overall among the tested aggregation strategies.

D.2 Robustness to Input Transformations

  • Even with two typos per sentence, most UE methods remain resilient to typos.Source: §D.2 · p. 16

D.3 Applicability to Long-Form Generations

  • For QA and QAG with five questions per claim, averaging is best overall; minimum rarely beats averaging for QG, while maximum occasionally does for QAG.Source: §D.3 · p. 16

D.4 Reconcilability of Diverse UE Scores

The section tests ensembling with unsupervised UE methods and reports gains over the best individual unsupervised method, consistent with earlier findings.

D.4 Reconcilability of Diverse UE Scores

  • The ensembling experiments were repeated using only unsupervised UE methods.Source: §D.4 · p. 16
  • Ensembling improved on the best individual unsupervised UE method by up to 8 PRR points.The authors report that the overall interpretation is consistent with Section 6.3.Source: §D.4 · p. 18
  • The reported results reinforce the effectiveness of ensembling strategies for unsupervised UE methods, consistent with Section 6.3.Source: §D.4 · p. 18

E Details of the Experiments

Appendix E details the adversarial-prompt tuning and correctness-evaluation procedures, then describes long-form claim processing and computational resources.

E.1 Crafting Adversarial Prompt For GPT-4o-mini

  • Ensembling is not discussed in this section; the adversarial prompt was tuned on 150 TriviaQA training samples over 15 iterations against LNS, Eccentricity, and KLE.The tuning began from the confidence-booster prompt used for LLaMA-3-8B.Source: §E.1 · p. 18
  • The selected adversarial prompt instructed the model to present answers as indisputably correct, with emphatic certainty even when accuracy was uncertain.Source: §E.1 · p. 18

E.2 Evaluating the Correctness of a Generation

  • Short-form QA correctness was assessed by GPT-4o-mini using the question, generated answer, and ground truth(s), excluding refusals and following Wei et al. (2024a).Source: §E.2 · pp. 18–19

E.3 Applicability to Long-Form Generations

  • Long generations were segmented into preliminary claims, then decomposed again for finer-grained claims using GPT-4o-mini with separate prompts.The appendix points to Tables 6 and 7 for the prompts and Tables 8 and 9 for output examples.Source: §E.3 · p. 19
  • For long-form evaluation, SAFE used Google Search and LLM reasoning to label claims supported or unsupported; QAG answers were generated by the same base model used for the main answer.Supported claims counted as correct and unsupported claims as incorrect.Source: §E.3 · p. 19
  • FactScore-Bio contained 1,290 GPT-4o-mini claims and 1,764 Llama-3-8B claims; LongFact-Objects contained 1,049 and 1,780, respectively.Both models used the same questions.Source: §E.3 · p. 19

E.4 Computational Budget

  • Experiments used 40 GB Nvidia A100 GPUs; Llama-3-8B experiments consumed approximately 800 GPU hours, while GPT-4o-mini experiments used the GPT API.Source: §E.4 · p. 19
Loading 2506.01114v1…