SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\begin{array}{l} \mathrm {D} _ {\mathrm {K L}} \left(p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w}) \| p (\boldsymbol {y} \mid \boldsymbol {x}, \tilde {\boldsymbol {w}})\right) \tag {42} \\ = \sum p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w}) \log \left(\frac {p (\boldsymbol {y} \mid \boldsymbol {x} , \boldsymbol {w})}{p (\boldsymbol {y} \mid \boldsymbol {x} , \tilde {\boldsymbol {w}})}\right) \\ = \sum p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w}) \log (p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w})) - \sum p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w}) \log (p (\boldsymbol {y} \mid \boldsymbol {x}, \tilde {\boldsymbol {w}})) \\ = - \mathrm {H} [ p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w}) ] + \mathrm {C E} [ p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w}), p (\boldsymbol {y} \mid \boldsymbol {x}, \tilde {\boldsymbol {w}}) ]. \\ \end{array}
$$
Only the cross-entropy between the predictive distributions of the reference model parameterized by  $\boldsymbol{w}$  and the adversarial model parameterized by  $\tilde{\boldsymbol{w}}$  plays a role in the optimization, since the entropy of  $p_w$  stays constant during the adversarial model search. Thus, the optimization target is equivalent to the cross-entropy loss, except that  $p_w$  is generally not one-hot encoded but an arbitrary categorical distribution. This also relates to targeted / untargeted adversarial attacks on the input. Targeted attacks try to maximize the output probability of a specific class. Untargeted attacks try to minimize the probability of the originally predicted class, by maximizing all other classes. We found that attacking individual classes works better empirically, while directly maximizing the KL divergence always leads to similar solutions for different searches. The result often is a further increase of the probability associated with the most likely class. Therefore, we conducted as many adversarial model searches for a new test point, as there are classes in the classification task. Thereby, we optimize the cross-entropy loss for one specific class in each search.
Figure C.1: Illustrative example of QUAM. We illustrate quantifying the predictive uncertainty of a given, pre-selected model (blue), a classifier for images of cats and dogs. For each of the input images, we search for adversarial models (orange) that make different predictions than the given, pre-selected model while explaining the training data equally well (having a high likelihood). The adversarial models found for an image of a dog or a cat still make similar predictions (low epistemic uncertainty), while the adversarial model found for an image of a lion makes a highly different prediction (high epistemic uncertainty), as features present in images of both cats and dogs can be utilized to classify the image of a lion.
For regression, we add a small perturbation to the bias of the output linear layer. This is necessary to ensure a gradient in the first update step, as the model to optimize is initialized with the reference model. For regression, we perform the adversarial model search two times, as the output of an adversarial model could be higher or lower than the reference model if we assume a scalar output. We force, that the two adversarial model searches get higher or lower outputs than the reference model respectively. While the loss of the reference model on the training dataset  $\mathrm{L}_{\mathrm{ref}}$  is calculated on the full training dataset (as it has to be done only once), we approximate  $\mathrm{L}_{\mathrm{pen}}$  by randomly drawn mini-batches for each update step. Therefore, the boundary condition might not be satisfied on the full training set, even if the boundary condition is satisfied for the mini-batch estimate.
As described in the main paper, the resulting model of each adversarial model search is used to define the location of a mixture component of a sampling distribution  $q(\tilde{w})$  (Eq. (6)). The epistemic uncertainty is estimated by Eq. (4), using models sampled from this mixture distribution. The simplest choice of distributions for each mixture distribution is a delta distribution at the location of the adversarial model  $\breve{w}_k$ . While this performs well empirically, we discard a lot of information by not utilizing predictions of models obtained throughout the adversarial model search. The intermediate solutions of the adversarial model search allow to assess how easily models with highly divergent predictive distributions to the reference model can be found. Furthermore, the expected mean squared error (Eq. (5)) decreases with  $\frac{1}{N}$  with the number of samples  $N$  and the expected variance of the estimator (Eq. (38)) decreases with  $\frac{1}{\sqrt{N}}$ . Therefore, using more samples is beneficial empirically, even though we potentially introduce a bias to the estimator.
Consequently, we utilize all sampled models during the adversarial model search as an empirical sampling distribution for our experiments. This is the same as how members of an ensemble can be seen as an empirical sampling distribution [Gustafsson et al., 2020] and conceptually similar to Snapshot ensembling [Huang et al., 2017]. To compute Eq. (4), we use the negative exponential training loss of each model to approximate its posterior probability  $p(\tilde{w} \mid \mathcal{D})$ . Note that the training loss is the negative log-likelihood, which in turn is proportional to the posterior probability. Note we temperature-scale the approximate posterior probability by  $p(\tilde{w} \mid \mathcal{D})^{\frac{1}{T}}$ , with the temperature parameter  $T$  set as a hyperparameter.
C.2 Simplex Example
We sample the training dataset  $\mathcal{D} = \{(x_k, y_k)\}_{k=1}^K$  from three Gaussian distributions (21 datapoints from each Gaussian) at locations  $\pmb{\mu}_1 = (-4, -2)^T$ ,  $\pmb{\mu}_2 = (4, -2)^T$ ,  $\pmb{\mu}_3 = (0, 2\sqrt{2})^T$  and the same two-dimensional covariance with  $\sigma^2 = 1.5$  on both entries of the diagonal and zero on the off-diagonals. The labels  $\pmb{y}_k$  are one-hot encoded vectors, signifying which Gaussian the input  $\pmb{x}_k$  was sampled from. The new test point  $\pmb{x}$  we evaluate for is located at  $(-6, 2)$ . To attain the likelihood
(a) HMC
Figure C.2: Softmax outputs (black) of individual models of HMC (a) as well as their average output (red) on a probability simplex. Softmax outputs of models found throughout the adversarial model search (b), colored by the attacked class. Left, right and top corners denote  $100\%$  probability mass at the blue, orange and green class in (c) respectively. Models were selected on the training data, and evaluated on the new test point (red) depicted in (c). The background color denotes the maximum likelihood of the training data that is achievable by a model having equal softmax output as the respective location on the simplex.
(b) Adversarial Model Search
(c) Training data + new test point
for each position on the probability simplex, we train a two-layer fully connected neural network (with parameters  $w$ ) with hidden size of 10 on this dataset. We minimize the combined loss
$$
\mathrm {L} = \frac {1}{K} \sum_ {k = 1} ^ {K} l \left(p (\boldsymbol {y} \mid \boldsymbol {x} _ {k}, \boldsymbol {w}), \boldsymbol {y} _ {k}\right) + l \left(p (\boldsymbol {y} \mid \boldsymbol {x}, \boldsymbol {w}), \check {\boldsymbol {y}}\right), \tag {43}
$$
where  $l$  is the cross-entropy loss function and  $\check{y}$  is the desired categorical distribution for the output of the network. We report the likelihood on the training dataset upon convergence of the training procedure for  $\check{y}$  on the probability simplex. To average over different initializations of  $w$  and alleviate the influence of potentially bad local minima, we use the median over 20 independent runs to calculate the maximum.
For all methods, we utilize the same two-layer fully connected neural network with hidden size of 10; for MC dropout we additionally added dropout with dropout probability 0.2 after every intermediate layer. We trained 50 networks for the Deep Ensemble results. For MC dropout we sampled predictive distributions using 1000 forward passes.
Fig. C.2 (a) shows models sampled using HMC, which is widely regarded as the best approximation to the ground truth for predictive uncertainty estimation. Furthermore, Fig. C.2 (b) shows models obtained by executing the adversarial model search for the given training dataset and test point depicted in Fig. C.2 (c). HMC also provides models that put more probability mass on the orange class. Those are missed by Deep Ensembles and MC dropout (see Fig. 2 (a) and (b)). The adversarial model search used by QUAM helps to identify those regions.
C.3 Epistemic Uncertainty on Synthetic Dataset
We create the two-moons dataset using the implementation of Pedregosa et al. [2011]. All experiments were performed on a three-layer fully connected neural network with hidden size 100 and ReLU activations. For MC dropout, dropout with dropout probability of 0.2 was applied after the intermediate layers. We assume to have a trained reference model  $w$  of this architecture. Results of the same runs as in the main paper, but calculated for the epistemic uncertainty in setting (b) (see Eq. (2)) are depicted in Fig. C.3. Again, QUAM matches the ground truth best.
Furthermore, we conducted experiments on a synthetic regression dataset, where the input feature  $x$  is drawn randomly between  $[-\pi, \pi]$  and the target is  $y = \sin(x) + \epsilon$ , with  $\epsilon \sim \mathcal{N}(0, 0.1)$ . The results are depicted in Fig. C.4. As for the classification results, the estimate of QUAM is closest to the ground truth provided by HMC.
The HMC implementation of Cobb and Jalaian [2021] was used to obtain the ground truth epistemic uncertainties. For the Laplace approximation, we used the implementation of Daxberger et al. [2021]. For SG-MCMC we used the python package of Kapoor [2023].
C.4 Epistemic Uncertainty on Vision Datasets
Several vision datasets and their corresponding OOD datasets are commonly used for benchmarking predictive uncertainty quantification in the literature, e.g. in Blundell et al. [2015], Gal and Ghahramani [2016], Malinin and Gales [2018], Ovadia et al. [2019], van Amersfoort et al. [2020], Mukhoti et al. [2021], Postels et al. [2021], Band et al. [2022]. Our experiments focused on two of those: MNIST [LeCun et al., 1998] and its OOD derivatives as the most basic benchmark and ImageNet1K [Deng et al., 2009] to demonstrate our method's ability to perform on a larger scale. Four types of experiments were performed: (i) OOD detection (ii) adversarial example detection, (iii) misclassification detection and (iv) selective prediction. Our experiments on adversarial example detection did not utilize a specific adversarial attack on the input images, but natural adversarial examples [Hendrycks et al., 2021], which are images from the ID classes, but wrongly classified by standard ImageNet classifiers. Misclassification detection and selective prediction was only performed for Imagenet1K, since MNIST classifiers easily reach accuracies of  $99\%$  on the test set, thus hardly misclassifying any samples. In all cases except selective prediciton, we measured AUROC, FPR at TPR of  $95\%$  and AUPR of classifying ID vs. OOD, non-adversarial vs. adversarial and correctly classified vs. misclassified samples (on ID test set), using the epistemic uncertainty estimate provided by the different methods. For selective prediction, we utilized the epistemic uncertainty estimate to select a subset of samples on the ID test set.
(f) Our Method - QUAM
Figure C.3: Epistemic uncertainty as in Eq. (2). Yellow denotes high epistemic uncertainty. Purple denotes low epistemic uncertainty. The black lines show the decision boundary of the reference model  $\boldsymbol{w}$ . HMC is considered to be the ground truth epistemic uncertainty. The estimate of QUAM is closest to the ground truth. All other methods underestimate the epistemic uncertainty in the top left and bottom right corner, as all models sampled by those predict the same class with high confidence for those regions.
(a) Ground Truth - HMC
(d) MC dropout
Figure C.4: Variance between different models found by different methods on synthetic sine dataset. Orange line denotes the empirical mean of the averaged models, shades denote one, two and three standard deviations respectively. HMC is considered to be the ground truth epistemic uncertainty. The estimate of QUAM is closest to the ground truth. All other methods fail to capture the variance between points as well as the variance left outside the region  $([-\pi, \pi])$  datapoints are sampled from.
(c) Laplace
(f) Our Method - QUAM
Table C.1: Additional baseline MoLA: AUROC using the epistemic uncertainty of a given, pre-selected model as a score to distinguish between ID (MNIST) and OOD samples. Results for additional baseline method MoLA, comparing to Laplace approximation, Deep Ensembles (DE) and QUAM. Results are averaged over three independent runs.
Dood	Laplace	MoLA	DE	QUAM
FMNIST	.978±.004	.986±.002	.988±.001	.994±.001
KMNIST	.959±.006	.984±.000	.990±.001	.994±.001
EMNIST	.877±.011	.920±.002	.924±.003	.937±.008
OMNIGLOT	.963±.003	.979±.000	.983±.001	.992±.001
C.4.1 MNIST
OOD detection experiments were performed on MNIST with FashionMNIST (FMNIST) [Xiao et al., 2017], EMNIST [Cohen et al., 2017], KMNIST [Clanuwat et al., 2018] and OMNIGLOT [Lake et al., 2015] as OOD datasets. In case of EMNIST, we only used the "letters" subset, thus excluding classes overlapping with MNIST (digits). We used the MNIST (test set) vs FMNIST (train set) OOD detection task to tune hyperparameters for all methods. The evaluation was performed using the complete test sets of the above-mentioned datasets ( $n = 10000$ ).
For each seed, a separate set of Deep Ensembles was trained. Ensembles with the size of 10 were found to perform best. MC dropout was used with a number of samples set to 2048. This hyperparameter setting was found to perform well. A higher sampling size would increase the performance marginally while increasing the computational load. Noteworthy is the fact, that with these settings the computational requirements of MC dropout surpassed those of QUAM. Laplace approximation was performed only for the last layer, due to the computational demand making it infeasible on the full network with our computational capacities. Mixture of Laplace approximations Eschenhagen et al. [2021] was evaluated as well using the parameters provided in the original work. Notably, the results from the original work suggesting improved performance compared to the Deep Ensembles on these tasks could not be reproduced. Comparison is provided in Table C.1. SG-HMC was performed on the full network using the Python package from Kapoor [2023]. Parameters were set in accordance with those of the original authors [Zhang et al., 2020]. For QUAM, the initial penalty parameter found by tuning was  $c_{0} = 6$ , which was exponentially increased ( $c_{t+1} = \eta c_{t}$ ) with  $\eta = 2$  every 14 gradient steps for a total of two epochs through the training dataset. Gradient steps were performed using Adam [Kingma and Ba, 2014] with a learning rate of 5.e-3 and weight decay of 1.e-3, chosen equivalent to the original training parameters of the model. A temperature of 1.e-3 was used for scaling the cross-entropy loss, an approximation for the posterior probabilities when calculating Eq. (4). Detailed results and additional metrics and replicates of the experiments can be found in Tab. C.2. Experiments were performed three times with seeds: {42, 142, 242} to provide confidence intervals. Histograms of the scores on the ID dataset and the OOD datasets for different methods are depicted in Fig. C.5.
C.4.2 ImageNet
For ImageNet1K [Deng et al., 2009], OOD detection experiments were performed with ImageNet-O [Hendrycks et al., 2021], adversarial example detection experiments with ImageNet-A [Hendrycks et al., 2021], and misclassification detection as well as selective prediction experiments on the official validation set of ImageNet1K. For each experiment, we utilized a pre-trained EfficientNet [Tan and Le, 2019] architecture with 21.5 million trainable weights available through PyTorch [Paszke et al., 2019], achieving a top-1 accuracy of  $84.2\%$  as well as a top-5 accuracy of  $96.9\%$ .
cSG-HMC was performed on the last layer using the best hyperparameters that resulted from a hyperparameter search around the ones suggested by the original authors [Zhang et al., 2020]. The Laplace approximation with the implementation of [Daxberger et al., 2021] was not feasible to compute for this problem on our hardware, even only for the last layer. Similarly to the experiments in section C.4.1, we compare against a Deep Ensemble consisting of 10 pre-trained EfficientNet architectures ranging from 5.3 million to 66.3 million trainable weights (DE (all)). Also, we retrained the last layer of 10 ensemble members (DE (LL)) given the same base network. We also compare
Table C.2: Detailed results of MNIST OOD detection experiments, reporting AUROC, AUPR and FPR@TPR=95% for individual seeds.
OOD dataset	Method	Seed	↑ AUPR	↑ AUROC	↓ FPR@TPR=95%
EMNIST	cSG-HMC	42	0.8859	0.8823	0.5449
142	0.8714	0.8568	0.8543
242	0.8797	0.8673	0.7293
42	0.8901	0.8861	0.5273
Laplace	142	0.8762	0.8642	0.7062
242	0.8903	0.8794	0.6812
42	0.9344	0.9239	0.4604
Deep Ensembles	142	0.9325	0.9236	0.4581
242	0.9354	0.9267	0.4239
42	0.8854	0.8787	0.5636
MC dropout	142	0.8769	0.8630	0.6718
242	0.8881	0.8751	0.6855
42	0.9519	0.9454	0.3405
QUAM	142	0.9449	0.9327	0.4538
242	0.9437	0.9317	0.4325
FMNIST	cSG-HMC	42	0.9532	0.9759	0.0654
142	0.9610	0.9731	0.0893
242	0.9635	0.9827	0.0463
42	0.9524	0.9754	0.0679
Laplace	142	0.9565	0.9739	0.0788
242	0.9613	0.9824	0.0410
42	0.9846	0.9894	0.0319
Deep Ensembles	142	0.9776	0.9865	0.0325
242	0.9815	0.9881	0.0338
42	0.9595	0.9776	0.0644
MC dropout	142	0.9641	0.9748	0.0809
242	0.9696	0.9848	0.0393
42	0.9896	0.9932	0.0188
QUAM	142	0.9909	0.9937	0.0210
242	0.9925	0.9952	0.0132
KMNIST	cSG-HMC	42	0.9412	0.9501	0.2092
142	0.9489	0.9591	0.1551
242	0.9505	0.9613	0.1390
42	0.9420	0.9520	0.1915
Laplace	142	0.9485	0.9617	0.1378
242	0.9526	0.9640	0.1165
42	0.9885	0.9899	0.0417
Deep Ensembles	142	0.9875	0.9891	0.0458
242	0.9884	0.9896	0.0473
42	0.9424	0.9506	0.2109
MC dropout	142	0.9531	0.9618	0.1494
242	0.9565	0.9651	0.1293
42	0.9928	0.9932	0.0250
QUAM	142	0.9945	0.9952	0.0194
242	0.9925	0.9932	0.0260
OMNIGLOT	cSG-HMC	42	0.9499	0.9658	0.1242
142	0.9459	0.9591	0.1498
242	0.9511	0.9637	0.1222
42	0.9485	0.9647	0.1238
Laplace	142	0.9451	0.9597	0.1345
242	0.9526	0.9656	0.1077
42	0.9771	0.9822	0.0621
Deep Ensembles	142	0.9765	0.9821	0.0659
242	0.9797	0.9840	0.0581
42	0.9534	0.9663	0.1248
MC dropout	142	0.9520	0.9619	0.1322
242	0.9574	0.9677	0.1063
42	0.9920	0.9930	0.0274
QUAM	142	0.9900	0.9909	0.0348
242	0.9906	0.9915	0.0306
Figure C.5: MNIST: Histograms of uncertainty scores calculated for test set samples of the specified datasets.
Table C.3: Calibration: expected calibration error (ECE) based on the weighted average predictive distribution. Reference refers to the predictive distribution of the given, pre-selected model. Experiment was performed on three distinct splits, each containing 7000 ImageNet-1K validation samples.
Reference	cSG-HMC	MCD	DE	QUAM
.159±.004	.364±.001	.166±.004	.194±.004	.096±.006
(a) Reference	(b) cSG-HMC	(c) MCD	(d) DE	(e) QUAM
Figure C.6: Calibration: confidence vs. accuracy based on (weighted) average predictive distribution of different uncertainty quantification methods. Point size indicates number of samples in the bin.
against MC dropout used with 2048 samples with a dropout probability of  $20\%$ . The EfficientNet architectures utilize dropout only before the last layer. The adversarial model search for QUAM was performed on the last layer of the EfficientNet, which has 1.3 million trainable parameters. To enhance the computational efficiency, the output of the second-to-last layer was computed once for all samples, and this output was subsequently used as input for the final layer when performing the adversarial model search. We fixed  $c_{0}$  to 1 and exponentially updated it at every of the 256 update steps. Also, weight decay was fixed to 1.e-4 for the Adam optimizer [Kingma and Ba, 2014].
Two hyperparameters have jointly been optimized on ImageNet-O and ImageNet-A using a small grid search, with learning rate  $\alpha \in \{5.e-3, 1.e-3, 5.e-4, 1.e-4\}$  and the exponential schedule update constant  $\eta \in \{1.15, 1.01, 1.005, 1.001\}$ . The hyperparameters  $\alpha = 1.e-3$  and  $\eta = 1.01$  resulted in the overall highest performance and have thus jointly been used for each of the three experiments. This implies that  $c_0$  increases by  $1\%$  after each update step. We additionally searched for the best temperature and the best number of update steps for each experiment separately. The best temperature for scaling the cross-entropy loss when calculating Eq. (4) was identified as 0.05, 0.005, and 0.0005, while the best number of update steps was identified as 50, 100, and 100 for ImageNet-O OOD detection, ImageNet-A adversarial example detection, and ImageNet1K misclassification detection, respectively. Selective prediction was performed using the same hyperparameters as misclassification detection. We observed that the adversarial model search is relatively stable with respect to these hyperparameters.
The detailed results on various metrics and replicates of the experiments can be found in C.4. Histograms of the scores on the ID dataset and the OOD dataset, the adversarial example dataset and the correctly and incorrectly classified samples are depicted in Fig. C.7 for all methods. ROC curves, as well as accuracy over retained sample curves, are depicted in Fig. C.8. To provide confidence intervals, we performed all experiments on three distinct dataset splits of the ID datasets, matching the number of OOD samples. Therefore we used three times 2000 ID samples forImagenet-O and three times 7000 ID samples forImagenet-A and misclassification detection as well as selective prediction.
**Calibration.** Additionally, we analyze the calibration of QUAM compared to other baseline methods. Therefore, we compute the expected calibration error (ECE) [Guo et al., 2017] on the ImageNet-1K validation dataset using the expected predictive distribution. Regarding QUAM, the predictive distribution was obtained using the same hyperparameters as for misclassification detection reported above. We find that QUAM improves upon the other considered baseline methods, although it was not directly designed to improve the calibration of the predictive distribution. Tab. C.3 states the ECE of considered uncertainty quantification methods and in Fig. C.6 the accuracy and number of samples (depicted by the size) for specific confidence bins is depicted.