PaperlayerView exact revision on arXiv

Source-linked AI summary

Counterfactual Fragility Certificates: Exposing High-Confidence Brittleness under Structured Evidence Failure

Filippo Cenacchi, Longbing Cao, Runze Yang

arXiv:2609.00366v1cs.LGcs.AI

TL;DR

High accuracy and aggregate calibration do not establish that an individual tabular prediction remains supported when feature groups fail. The paper introduces CFC, a model-agnostic audit trajectory, and finds that CFC-FDS identifies brittle high-confidence cases substantially better than non-certificate scores across diverse benchmarks and models.

  • Problem

    Existing reliability methods provide scalar confidence, uncertainty, calibration, or attribution measures but do not recomputably quantify how individual predictions lose support under structured evidence failure.

  • Method

    CFC maps each prediction to an ordered, protocol-relative evidence-failure trajectory using grouped features, controlled stress operators, flip budgets, margin-collapse area, degradation thresholds, and a ranking head.

  • Results

    0.915 AUROC: CFC-FDS identifies independently brittle high-confidence cases better than confidence, energy, perturbation, and attribution-style baselines across heterogeneous tabular benchmarks and model families.

  • Takeaways & Limitations

    CFC provides a concrete reliability framework for exposing high-confidence brittleness that ordinary score-centric evaluation can miss.

  • Takeaways & Limitations

    CFC is conditional on declared grouping, baseline, stress operators, severity grid, and audit depth, and its greedy flip budget is not a globally minimal failing subset.

Abstract

from arXiv · show

High test accuracy and good aggregate calibration do not show whether an individual prediction is structurally supported by its evidence. In tabular decision systems, failures often occur when a feature family becomes unavailable, delayed, noisy, stale, or low-trust while the model remains highly confident. Existing calibration, uncertainty, selective-prediction, explanation, and perturbation methods provide scalar scores or attribution maps, but not a recomputable audit object answering: under a declared evidence-failure protocol, what trajectory makes this prediction lose support? We introduce Counterfactual Fragility Certificates (CFC), a model-agnostic protocol-level audit certificate-not a formal robustness certificate-that maps each prediction into an ordered evidence-failure trajectory summarized by greedy flip budget, normalized margin-collapse area, degradation thresholds, and fragility dominance score. Across seven tabular benchmarks and strong linear, tree-based, boosting, and neural baselines, CFC-FDS identifies independently brittle high-confidence cases with 0.915 AUROC, improving over the strongest non-certificate score by +0.405. The advantage persists across perturbation, permutation-importance, group-SHAP, baseline-choice, seed-variance, budgeted-review, and naturalistic field-unavailability checks. Under a 20% review budget, CFC-FDS captures 88.9% of brittle high-confidence cases, compared with 31.8-37.4% for confidence and energy scores. We also evaluate fragility-aware regularization and brittleness-aware temperature correction as secondary uses. CFC provides a concrete reliability framework for exposing high-confidence brittleness missed by ordinary score-centric evaluation.

1 Introduction

The paper addresses high-confidence predictions whose evidence support can fail under structured feature-group degradation. It introduces CFC as a recomputable, model-agnostic audit object for tracing and ranking such brittleness.

  • Motivation: Average-case metrics can miss predictions that appear strong but rely on a dangerously narrow support set.This gap persists even when classifiers achieve high AUROC, macro-F1, and negative log-likelihood.
  • Motivation: Structured evidence failure in tabular systems includes feature groups becoming missing, delayed, stale, or low-quality.
  • Contribution: CFC produces a per-sample, model-agnostic audit object through controlled forward passes over grouped preprocessed features.It records ordered evidence states, prediction flips, margin collapse, and decision-changing degradation severity.
  • Contribution: CFC changes reliability analysis from scalar scoring to the operational question of which declared evidence-failure trajectory makes a prediction lose support.
  • Contribution: The paper formalizes structured evidence-failure fragility and evaluates certificate-derived rankings against confidence, attribution, perturbation, and related baselines.Its validation suite includes budgeted capture, baseline and seed sensitivity, naturalistic field unavailability, and calibration independence.

2 Related Work

Prior reliability methods improve probability semantics, abstention, or interpretability, but they generally do not measure whether a prediction remains supported under structured evidence degradation. CFC targets this missing case-level trajectory.

  • Calibration and selective prediction: Calibration methods address distorted probability semantics, while selective prediction uses confidence for abstention and coverage–risk control.
  • Calibration and selective prediction: These approaches do not directly quantify support fragility when a small feature-group subset carries most of a decision.
  • Tabular robustness and explanations: Tabular robustness research considers natural shifts and adversarial stress, but structured evidence failure remains under-specified.
  • Tabular robustness and explanations: Attribution, perturbation sensitivity, and fragility differ because feature importance does not necessarily predict the fastest decision collapse.
  • Tabular robustness and explanations: CFC extends ordered-removal analyses by examining whether support erodes abruptly, gradually, or only under partial degradation.

3 Method

CFC groups transformed features into evidence blocks, applies declared hard and graded failure operators, and constructs an inspectable trajectory of prediction support. Its components quantify flips, gradual margin erosion, and partial-degradation risk.

  • Structured Evidence-Failure Setup: CFC partitions preprocessed coordinates into semantically meaningful groups traced back to originating raw variables.Derived columns such as one-hot encodings remain one coherent evidence block; grouping is reproducible but not causally optimal by default.
  • Margin Construction: The method uses a standardized pseudo-logit margin between the predicted class and strongest competitor to measure decision support across model families.The margin is a quantity whose collapse is measured under structured evidence removal, not the final reliability score.
  • Certificate Design: CFC combines ordered hard-removal states with operator-specific partial evidence degradation states into a complete structured evidence-failure trajectory.
  • Hard Removal and Flip Budget: The greedy removal path ranks groups by immediate margin loss and replaces the top-k groups with baseline values.The resulting flip budget answers how many evidence blocks must fail before the prediction changes.
  • Margin-Collapse Area: RCMA averages clipped normalized nonnegative margin loss along the removal path, treating margin gains as zero.It measures gradual support erosion even when no prediction flip occurs within the audit depth.
  • Partial Degradation and Ranking: Partial degradation records the severity at which evidence failure becomes decision-changing, while the ranking head combines complementary brittleness signals.The components jointly capture abrupt flips, gradual erosion, and partial-degradation brittleness.
  • Certificate Design: The certificate is a protocol-relative, deterministic, inspectable audit object rather than a formal worst-case robustness guarantee.Its conclusions depend on declared grouping, baseline, stress operators, severity grid, and audit depth.
  • Secondary Uses: Fragility-aware training and brittleness-aware temperature correction are secondary probes rather than requirements for the main model-agnostic audit claims.The correction discounts confidence more strongly for fragile samples when supported by empirical calibration behavior.

4 Experimental Protocol

The evaluation spans seven diverse tabular benchmarks and strong linear, tree-based, boosting, and neural baselines. It tests certificate ranking, support stability, and optional mitigation or calibration uses.

  • Benchmarks: Seven a-priori-selected benchmarks cover diverse sizes, class balances, dimensionalities, and categorical structure.The datasets are Adult, Bank, Credit-G, Default, Electricity, HELOC, and Covertype.
  • Models: The baseline suite includes logistic regression, random forests, extra trees, XGBoost, LightGBM, CatBoost, MLP, and ResMLP.Fragility-regularized ResMLP is evaluated as the proposed neural variant.
  • Evaluation Questions: The experiments test whether certificate rankings identify held-out structured evidence-failure vulnerability better than confidence, entropy, margin, energy, perturbation, and attribution baselines.
  • Evaluation Questions: The protocol also examines nominal predictive quality versus support stability and evaluates training and calibration interventions as downstream uses.

5 Results and Discussion

Across heterogeneous tabular benchmarks, CFC-derived rankings identify held-out structured evidence-failure vulnerability beyond confidence-based scores, while case studies show nominal predictive winners can be less stable under feature-group removal. Naturalistic field-unavailability and threshold analyses support the auditing story, subject to protocol-dependent scope.

  • 5 Results and Discussion: CFC-derived rankings identify held-out structured evidence-failure vulnerability better than confidence, entropy, margin, energy, and direct perturbation or attribution baselines.The evaluation treats certificate-derived interventions as secondary uses and focuses the main claim on exposing a reliability axis across strong heterogeneous backbones.
  • 5 Results and Discussion: 0.915 AUROC: CFC-FDS improves by +0.405 and has no non-positive paired units against the strongest non-certificate baseline.Table 2 reports per-dataset AUROC and paired aggregate uncertainty; the final column measures paired-unit non-improvement rather than a bootstrap p-value.
  • 5 Results and Discussion: Fragility is structured across dataset–model combinations rather than behaving like diffuse confidence noise, with CFC-FDS strongest under naturalistic field-unavailability.The naturalistic proxy uses observed missing, unknown, special-code, or unavailable fields rather than uniformly random stress.
  • 5 Results and Discussion: Threshold-sensitivity diagnostics show the ranking advantage changes smoothly across confidence thresholds rather than depending on one brittle operating point.This supports stability of the ranking advantage across threshold choices within the reported diagnostics.
  • 5 Results and Discussion: Nominal winners can retain high initial confidence yet lose support rapidly after removing a small number of feature groups, whereas slightly weaker nominal models can degrade more smoothly.These trajectories make the distinction between best nominal model and most stable model operationally meaningful when evidence is incomplete, unreliable, or delayed.
  • 5 Results and Discussion: CFC can understate fragility when groups are redundant or poorly specified, and its greedy path is an audit trajectory rather than a minimal-subset proof.Baseline replacement is a transformed-space stress operation rather than a causal absence model, so the certificate is strongest for meaningful data-source or workflow-field groups.

6 Limitations and Future Work

CFC is a protocol-relative audit certificate whose conclusions depend on declared stress choices and whose approximations do not guarantee realism for every domain. It is intended as a pre-deployment stress-test object, while deployment claims require validation against observed data-quality incidents or acquisition logs.

  • 6 Limitations and Future Work: CFC is not a formal worst-case robustness guarantee; its conclusions are conditional on grouping, baseline, stress operators, severity grid, and audit depth.The greedy flip budget is a scalable audit-path statistic rather than a globally minimal adversarial subset.
  • 6 Limitations and Future Work: Baseline replacement, dropout, masking, and bounded noise approximate missing, stale, delayed, or low-trust fields but do not guarantee realism for every domain.Raw-origin grouping is reproducible but not uniquely correct, and redundant or poorly specified groups should be replaced by domain evidence blocks.
  • 6 Limitations and Future Work: CFC should be treated as a pre-deployment stress-test object, with deployment claims requiring validation against observed data-quality incidents, delayed measurements, sensor failures, or field-acquisition logs.The paper tests cross-operator brittleness, attribution and perturbation baselines, baseline sensitivity, seed variance, and naturalistic field-unavailability, but these checks do not replace deployment validation.

7 Conclusion

CFC reframes tabular reliability as an auditable, protocol-relative stress test of how predictions lose support, rather than a static confidence report. Its certificate components and standardized baselines support inspectable comparisons without retraining.

  • CFC records an ordered evidence-failure trajectory, greedy flip budget, margin-collapse area, degradation thresholds, and a ranking head for each prediction.
  • CFC computations are post-hoc and require only additional forward passes through already trained models.Table 3 reports cost in forward-pass units rather than hardware-specific wall-clock time.
  • All non-certificate confidence, margin, and energy baselines use a common clipped, renormalized probability interface across model families.This prevents energy comparisons from depending on whether models expose logits, probabilities, or decision-function values.
  • CFC-FDS substantially outperforms the strongest non-certificate baseline under a conservative, reproducible energy construction.

E Visual Summaries of Mitigation and Ranking Results

The visual summaries portray CFC as a trajectory-level audit object whose complementary components expose abrupt flips, gradual support collapse, and partial-degradation brittleness. They also delimit the result as protocol-relative rather than a universal robustness guarantee.

  • CFC represents structured brittleness as a tuple because flip depth, margin collapse, degradation thresholds, and ranking capture non-equivalent failure modes.
  • CFC-FDS combines abrupt flip risk, gradual support collapse, and partial-degradation sensitivity, whereas generic scores summarize only the original prediction state.
  • The certificate is recomputable for a fixed model, preprocessing map, grouping, baseline, audit depth, stress operators, and severity grid.
  • CFC does not prove invariance to all corruptions, feature subsets, causal interventions, or deployment shifts.
  • The empirical claim concerns held-out structured evidence failure, while validation against realized operational incidents remains a next step.

H Implementation Choices, Score Conversions, and Ordered-Removal Baselines

The implementation fixes score construction, brittle-label thresholds, and ordered-removal procedures to make comparisons reproducible. Greedy CFC remains scalable but is explicitly evaluated against stronger exact and beam-search diagnostics because group interactions need not be submodular.

  • Implementation choices: CFC uses fixed equal FDS weights and no dataset-specific ranking parameter is tuned.Operators that do not flip within the severity grid contribute zero to the degradation term.
  • Score conversions: All model families use clipped, renormalized probabilities for max-softmax, entropy, margin, and negative-energy baselines.
  • Brittle-label thresholds: High-confidence brittle labels require p̂(x) ≥ 0.90 and either a held-out label flip or normalized margin collapse κP(x) ≥ 0.50.
  • Ordered-removal baselines: CFC removes or degrades evidence groups to measure when support fails, unlike SIS, which identifies a sufficient retained subset.
  • Ordered-removal baselines: CFC-FDS remains stronger than one-step margin, random-ordering, permutation-importance, group-SHAP, and retrain-after-removal comparisons because it uses the full ordered stress trajectory.
  • Search diagnostics: Greedy selection is deterministic and scalable, but nonmonotone, non-submodular interactions can make its flip budget differ from stronger searches.
  • Search diagnostics: Exact and beam-search diagnostics measure greedy overestimation, average gaps, earlier alternative flips, and improvements from stronger scalable search.

J Non-Circular Brittle-Case Evaluation Protocol

The brittle-case evaluation separates CFC score construction from label construction using disjoint held-out stressors and fixed global thresholds. Sensitivity and naturalistic field-unavailability checks test whether the ranking remains informative beyond one synthetic operating point.

  • CFC-FDS is computed from a deterministic greedy removal path, while brittle labels use held-out degradation operators disjoint from the score channel.
  • The global thresholds τp = 0.90 and τκ = 0.50 are fixed before evaluation across all datasets, model families, and seeds.
  • The collapse threshold captures severe pre-flip erosion by labeling cases that lose at least half their normalized decision margin even without changing class.
  • The ranking advantage changes smoothly across τp ∈ {0.85, 0.90, 0.95} and τκ ∈ {0.25, 0.50, 0.75}.
  • RCMA measures one-sided support erosion from structured removal, not arbitrary margin movement or absolute sensitivity.
  • RCMA is nonnegative and can exceed one because severe post-flip collapse may exceed the original margin.
  • The naturalistic proxy uses observed missing, unknown, special-code, or unavailable field patterns rather than uniformly random masking.
  • The naturalistic proxy is stricter than purely synthetic stress but remains distinct from a deployment incident log.

N Targeted Certificate Ablations

Targeted ablations test whether CFC-FDS depends on individual components, audit settings, calibration, or a particular replacement convention. The results support the full trajectory-level certificate as the strongest and most stable design.

  • Component necessity: CFC-FDS combines abrupt flip risk, gradual support collapse, and partial-degradation sensitivity rather than relying on one certificate component.Flip budget is the strongest individual component, but the full certificate performs substantially better; RCMA and degradation thresholds are informative but incomplete.
  • Design stability: The design-stability checks test dependence on audit depth, weighting, and ordinary probability calibration.Global temperature scaling preserves the CFC ranking, supporting structural brittleness rather than ordinary probability miscalibration.
  • Evaluation protocol: Held-out brittle-case evaluation compares CFC-FDS with confidence, entropy, margin, energy, one-step perturbation, permutation, and group-SHAP rankings using AUROC.The label channel applies held-out stressors without reusing the CFC score-channel trajectory.
  • Evaluation protocol: Budgeted review evaluates Capture@q at q ∈ {5, 10, 20} and AURC while progressively escalating the highest-ranked samples.This tests whether ranking quality translates into review utility under constrained audit budgets.
  • Baseline sensitivity: CFC-FDS remains strong across baseline choices, with the analysis recomputing trajectories and evaluating brittle-case AUROC and ranking correlation.The baseline-sensitivity procedure varies the transformed-space replacement state and checks whether the ranking advantage persists.

P.1 Dataset–model–seed variance

Dataset–model–seed analysis checks whether CFC-FDS gains are concentrated in particular benchmarks, architectures, or random seeds. The reported results support a consistent improvement while defining the certificate as protocol-relative rather than globally robust.

  • Variance analysis: CFC-FDS improves over the strongest non-certificate baseline in every dataset–model–seed unit.Paired bootstrap intervals are computed over these units, and the fraction of winning units is reported.
  • Variance analysis: CFC-RCMA improves over the strongest non-certificate baseline in 68.8% of units, whereas the full certificate ranking head reaches a 100.0% win rate.The comparison identifies the full ranking head as more stable than RCMA alone.
  • Non-circular evaluation: CFC-FDS is computed from a deterministic greedy removal trajectory, while brittle labels use held-out stochastic masking, dropout, and noise stressors.Separating score and label channels tests vulnerability prediction across stress mechanisms rather than self-retrieval.
  • Operational utility: Under a 20% review budget, CFC-FDS recovers 88.9% of independently brittle high-confidence cases, compared with 31.8–37.4% for confidence and energy scores.The result supports CFC as a triage mechanism for review, escalation, and evidence reacquisition.
  • Scope: CFC is deterministic and exactly recomputable for fixed model, preprocessing, grouping, baseline, audit depth, operators, severity grid, and tie-breaking.Its guarantee concerns the observed support-collapse path under the declared protocol, not global minimality or worst-case robustness.
  • Scope: The certificate is intentionally protocol-relative to grouping, baseline replacement, stress operators, severity grid, and audit depth.A baseline represents a declared operational convention for simulating missing or low-trust evidence rather than a causal absence model.

S.2 Brittleness-aware temperature correction

Brittleness-aware temperature correction uses certificate-derived fragility to discount confidence selectively. It improves calibration most strongly for fragile cases while preserving predicted labels, making it a targeted secondary use rather than a replacement for global calibration.

  • Correction design: Brittleness-aware temperature correction applies stronger confidence discounting to structurally fragile samples than to stable samples.The global temperature is validation-fitted, while FDS normalization and the local discount parameter are also selected using validation data.
  • Calibration outcome: Brittleness-aware correction improves calibration most strongly on the fragile subset, where global temperature scaling applies the same discount to stable and fragile cases.Higher FDS increases the effective temperature and lowers overconfident probabilities for cases with narrow evidence support.
  • Correction design: The correction does not change the predicted label and only rescales confidence more strongly for samples with fragile support.This makes the procedure a confidence adjustment rather than a decision-rule change.
  • Calibration outcome: BATS improves fragile-subset calibration more strongly than global calibration, supporting its role as a targeted rather than universal calibrator.The correction is evaluated overall and on the top-20% most fragile cases.
Loading 2609.00366v1…