PaperlayerView exact revision on arXiv

Source-linked AI summary

CalCErt: Bin-wise Certification of Confidence Calibration in Medical Image Classification

Leo Fillioux, Stergios Christodoulidis, Stergios Christodoulidis, Maria Vakalopoulou, Jose Dolz

arXiv:2610.03142v1cs.CV

TL;DR

Adversarial perturbations can affect both predictions and confidence, while existing certification largely guarantees predicted-class stability rather than calibration. CalCErt post-hoc certifies bin-wise calibration for pretrained differentiable classifiers; across evaluated settings it achieves the highest certified coverage with competitive tightness.

  • Problem

    Existing certification largely preserves predicted classes but does not guarantee how confidence calibration behaves under adversarial perturbations.

    Source: §1 · p. 1

  • Method

    CalCErt combines empirical calibration estimates and concentration inequalities with local Lipschitz bounds on confidence variation to certify bin-wise miscalibration post-hoc.

    Source: §1 · p. 2

  • Results

    Across ID and OOD scenarios, CalCErt achieves the highest certified coverage; in ID, coverage is 0.90–0.99, a 2–3× increase over baselines, with competitive tightness.

    Source: §4.2 · pp. 6–7

  • Takeaways & Limitations

    CalCErt certifies substantially more samples without costly per-noise or per-attack retraining.

    Source: §4.2 · p. 6

    The certificates address calibration robustness only and do not guarantee classification accuracy under adversarial perturbations.

    Source: §5 · p. 9

Abstract

from arXiv · show

Deep neural networks remain vulnerable to adversarial perturbations, which can distort not only predictions but also confidence scores, undermining uncertainty calibration. While existing certification methods focus on preserving the predicted category, providing guarantees on how calibration behaves under adversarial attacks remains overlooked. In this work, we introduce CalCErt, a simple and efficient post-hoc strategy that certifies bin-wise confidence calibration for any pretrained differentiable classifier. Our approach combines empirical calibration estimates, statistical concentration bounds, and local Lipschitz estimates of the confidence function to derive data-dependent upper bounds on worst-case miscalibration within an $ell_2$-ball of radius R. We evaluate CalCErt across 11 medical image classification tasks and multiple adversarial perturbations, demonstrating substantially higher certified coverage than baseline strategies while maintaining competitive tightness. Our code is available at https://github.com/leofillioux/calcert.

1 Introduction

The introduction identifies a gap in guarantees for confidence calibration under adversarial perturbations, despite existing certification focused on prediction stability. It presents CalCErt as a post-hoc approach to bin-wise calibration certification and reports evaluation across many medical-image settings.

1 Introduction

  • Confidence scores can be distorted alongside predictions by adversarial attacks, threatening uncertainty calibration in safety-critical medical image analysis.The introduction notes that confidence is important for downstream decision-making in these domains.Source: §1 · p. 1
  • Existing certification focuses on preserving predicted classes, but this does not guarantee calibration: confidence can become arbitrarily over- or under-confident even when predictions remain correct.The gap matters in healthcare, where confidence informs downstream actions.Source: §1 · p. 2
  • The authors frame calibration certification in medical imaging as unexplored and ask whether pretrained models can be certified under ℓ2-bounded perturbations without retraining or attack-specific fine-tuning.They describe this as a first step toward certification of uncertainty calibration under adversarial perturbations.Source: §1 · p. 2
  • CalCErt bounds worst-case confidence change within an ℓ2-ball using estimated local Lipschitz constants, then combines that control with empirical calibration estimates and concentration inequalities for bin-wise miscalibration bounds.The certificate is post-hoc, requires no adversarial training, and applies to differentiable pretrained models.Source: §1 · p. 2
  • Across 220 settings spanning medical imaging modalities, five perturbations, and four backbones, CalCErt yields usable, non-vacuous calibration-certification bounds.The settings are reported as part of the introduction’s evaluation scope.Source: §1 · p. 2

2 Related Work

Related work covers certification centered on robust accuracy, including randomized smoothing and Lipschitz-based approaches. CalCErt instead targets confidence calibration under adversarial perturbations in medical imaging.

2 Related Work

  • Randomized smoothing provides probabilistic guarantees on robust accuracy but certifies label invariance rather than confidence or calibration, and may require retraining or noise-specific tuning.The cited Lipschitz-based certification methods also require architectural or training modifications.Source: §2 · p. 3
  • In medical imaging, verifies segmentation robustness using randomized smoothing and diffusion models, while uses diffusion- and prompt-based smoothing to improve robustness to noise and distribution shift in medical vision systems.Separately, randomized smoothing certifies label invariance but provides no guarantees on confidence or calibration.Source: §2 · p. 3
  • CalCErt takes a first step toward extending certification beyond accuracy to confidence reliability, a problem the authors describe as unexplored in medical imaging.Source: §2 · p. 3

3 Methodology

The section defines bin-wise miscalibration and seeks to bound its change under ℓ2 perturbations. It builds a certificate from empirical calibration, statistical uncertainty, and confidence variation.

3.1 Problem setup

  • Calibration means confidence matches the likelihood of correctness; binning approximates it with accuracy, mean confidence, and their absolute difference, whose change under ℓ2 perturbations is the target.Source: §3.1 · p. 3

3.2 Proposed confidence certification

  • The method estimates local confidence sensitivity by gradient norm, then uses a bin-wise maximum and a trimmed robust sub-bin to keep samples from crossing bin boundaries.The robust sub-bin is formed by trimming each confidence bin by γk.Source: §3.2 · p. 4
  • Perturbed bin miscalibration decomposes into accuracy deviation, clean empirical miscalibration, and mean-confidence deviation; the latter is bounded by L_k R.The three terms are bounded separately, with the confidence deviation controlled by the bin-wise Lipschitz constant.Source: §3.2 · pp. 4–5
  • Because perturbed accuracy depends on predictions across the perturbation ball and cannot be computed directly, concentration inequalities bound it using per-bin sample count and α=0.05.The method uses Hoeffding’s inequality for the statistical term.Source: §3.2 · p. 5
  • For samples remaining inside a robust sub-bin, worst-case miscalibration is bounded by empirical error plus statistical uncertainty and a Lipschitz-controlled perturbation term.The guarantee applies to every admissible perturbation within the specified radius.Source: §3.2 · p. 5

4 Experiments

The experiments evaluate CalCErt against two calibration baselines on 11 MedMNIST datasets, across multiple attacks and model architectures. CalCErt achieves higher certified coverage, with competitive tightness, while performance weakens under distribution shift.

4.1 Experiment setup

  • The evaluation uses 11 two-dimensional MedMNIST datasets, three ViT sizes, four attacks plus Gaussian noise, and an ℓ2 radius of 0.1.ChestMNIST is excluded as a multi-label task; validation data are used for certification and test data for evaluation.Source: §4.1 · pp. 5–6
  • Coverage measures the fraction of bins whose bounds hold, while tightness measures mean distance between each bound and test calibration across bins.Source: §4.1 · p. 6

4.2 Results

  • Across ViT sizes and attacks, CalCErt achieves 0.90–0.99 ID coverage, a 2–3× increase over baselines, while maintaining competitive tightness.ASC sometimes yields tighter estimates but provides less useful coverage and requires retraining for each attack and noise level.Source: §4.2 · p. 6, Table 1 · p. 6
  • Under distribution shift, CalCErt often achieves mean coverage ≥0.6 and reaches 0.93, versus a baseline maximum of 0.43; its apparently tighter bounds reflect validation–test mismatch.The authors caution that this apparent tightness is not a genuine advantage because it violates the certificate’s i.i.d. assumption.Source: §4.2 · p. 7
  • Across the 11 datasets, CalCErt has strong coverage gains on ID datasets, with perfect coverage on five of eight; gains are more modest under shift.The figure reports dataset-wise coverage for L2–Cal, ASC, and CalCErt, averaged across three ViT sizes.Source: §4.2 · p. 7, Figure 1 · p. 7
  • When bounds are violated, CalCErt has much smaller overshoot magnitudes; overshoot is the mean positive gap over bins where the bound fails.Figure 2 compares overshoot across attack types, averaged across ViT backbones.Source: §4.2 · p. 7, Figure 2 · p. 7
  • With ResNet-18, CalCErt retains near-full ID coverage and outperforms baselines in ID, but degrades more under distribution shift and remains competitive in OOD.The authors associate ResNet-18’s greater OOD degradation with lower representational capacity, weaker calibration, and more sensitive confidence estimates.Source: §4.2 · p. 8, Table 2 · p. 8

5 Discussion and limitations

The authors identify sparse confidence-bin samples and local Lipschitz estimates as constraints on certificate tightness. Their certificates address confidence calibration, not classification accuracy under adversarial perturbations.

5 Discussion and limitations

  • Bins with few samples can produce loose statistical bounds and large certified miscalibration values.Adaptive binning may help balance counts, but near-overlapping bins can complicate robust sub-bin construction and violate certificate assumptions.Source: §5 · p. 8
  • Large local Lipschitz constants can make the perturbation term conservative or even render certificates vacuous.Tighter local or SDP-based bounds may be more accurate but scale poorly for modern architectures.Source: §5 · p. 8
  • The certificates do not guarantee classification accuracy under adversarial perturbations; joint guarantees are beyond this study’s scope.Source: §5 · p. 9

Related papers

Loading 2610.03142v1…