SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The default approach of using the SC performance metric introduced in Equation 4 free from its bias towards accuracy is to align different SC approaches/models at the same accuracy. However, accuracy-alignment can have unintended consequences on SC performance, especially under DP. If we are considering SC performance across models trained for multiple  $\varepsilon$  levels, accuracy-alignment would require lowering the performance of the less private models. One seemingly suitable approach to do this is by early-stopping model training at a desired accuracy level. However, early-stopping a DP training algorithm in fact gives a model with greater privacy than the privacy level targeted by the optimization process. This is a direct consequence of privacy loss accumulation via privacy accounting during training, and so training for less leads to expending less privacy budget. Hence, instead of comparing models with different privacy guarantees at the same baseline utility, early-stopping yields models with potentially very similar privacy guarantees.
To address this limitation, we propose to measure SC performance by how close the observed trade-off is to an upper bound on the achievable SC performance at a given baseline utility level (at  $100\%$  coverage). To compute this metric, we first derive an upper bound on selective classification performance (as a function of coverage) for a given baseline accuracy. We obtain this characterization by identifying the optimal acceptance ordering under a particular full-coverage accuracy constraint.
Definition 3.1. The upper bound on the selective classification performance for a fixed full-coverage accuracy  $a_{full} \in [0,1]$  and a variable coverage level  $c \in [0,1]$  is given by
$$
\overline {{a c c}} \left(a _ {\text {f u l l}}, c\right) = \left\{ \begin{array}{l l} 1 & 0 <   c \leq a _ {\text {f u l l}} \\ \frac {a _ {\text {f u l l}}}{c} & a _ {\text {f u l l}} <   c <   1 \end{array} . \right. \tag {5}
$$
Measuring the area enclosed between the bound  $\overline{\mathrm{acc}}(a_{\mathrm{full}}, c)$  and an SC method's achieved accuracy/coverage trade-off  $\mathrm{acc}_c(f, g)$  yields our accuracy-normalized selective classification score.
Definition 3.2. The accuracy-normalized selective classification score  $s_{a_{full}}(f, g)$  for a selective classifier  $(f, g)$  with full-coverage accuracy  $a_{full}$  is given by
$$
s _ {a _ {\text {f u l l}}} (f, g) = \int_ {0} ^ {1} (\overline {{a c c}} (a _ {\text {f u l l}}, c) - a c c _ {c} (f, g)) d c \approx \sum_ {c} (\overline {{a c c}} (a _ {\text {f u l l}}, c) - a c c _ {c} (f, g)). \tag {6}
$$
We provide additional intuition for both the proposed upper bound and our score as part of Figure 2.
Bound justification. To understand the upper bound given in Equation 5, note that a full-coverage accuracy level of  $a_{\mathrm{full}}$  means that a fraction  $a_{\mathrm{full}}$  of points are correctly classified. An ideal selective classification method for this model would, by increasing the coverage  $c$  from 0 to 1, first accept all points that the model classifies correctly: this gives the optimal selective classification accuracy for coverage  $c \leq a_{\mathrm{full}}$  of  $100\%$ . For any coverage level  $c > a_{\mathrm{full}}$ , note that the accuracy at the coverage is
Figure 2: Selective classification upper bound and accuracy-normalized score visualization. We present an example of a selective classifier with full-coverage accuracy  $a_{\mathrm{full}} = 0.4$  and show how (a) the corresponding upper bound; and how (b) the accuracy-normalized score can be obtained.
the number of correct points accepted divided by the total number of points accepted. The largest value this can take is by maximizing the numerator, and the maximum value for this (as a fraction of all points) is  $a_{\mathrm{full}}$ . Plugging this into the previous statement for accuracy at coverage  $c$ , we have the best selective accuracy at a coverage  $c$  is  $\frac{a_{\mathrm{full}}}{c}$ . This derives the upper bound stated above as a function of coverage. We remark that this bound is in fact achievable if a selective classifier separates correct and incorrect points perfectly, i.e., it accepts all correct points first and then accepts and increasing amount of incorrect points as we increase the coverage of the selective classification method. See Appendix B.3 for an experiment that matches the bound exactly.
We now present a detailed experimental evaluation of the interplay between differential privacy and selective classification. All of our experiments are implemented using PyTorch [Paszke et al., 2019] and Opacus [Yousefpour et al., 2021]. We publish our full code-base at the following URL: https://github.com/cleverhans-lab/selective-classification.
Setup. Our evaluation is based on the following experimental panel. In particular, we conduct experiments for each dataset/SC-method/ $\varepsilon$  combination:
- Datasets: FashionMNIST [Xiao et al., 2017], CIFAR-10 [Krizhevsky et al., 2009], SVHN [Netzer et al., 2011], GTSRB [Houben et al., 2013].
- Selective Classification Methods: Softmax Response (SR) [Geifman and El-Yaniv, 2017], SelectiveNet (SN) [Geifman and El-Yaniv, 2019], Self-Adaptive Training (SAT) [Huang et al., 2020], Monte-Carlo Dropout (MCD0) [Gal and Ghahramani, 2016], Deep Ensembles (DE) [Lakshminarayanan et al., 2017], Selective Classification Training Dynamics (SCTD) [Rabanser et al., 2022].
- Privacy levels:  $\varepsilon \in \{\infty, 7, 3, 1\}$ .
Based on recent results from Feng et al. [2023], we (i) apply additional entropy regularization to all methods; and (ii) derive the selective classification scores for SN and SAT by applying Softmax Response (SR) to the underlying classifier (instead of relying on model-specific abstention mechanisms). Across all private experiments, we set  $\delta = 10^{-(N + 1)}$  for datasets consisting of training samples on the order of  $10^{N}$ . For each combination of SC method, dataset, and privacy level, we train a model following the ResNet-18 [He et al., 2016] model architecture using either the SGD optimizer (for  $\varepsilon = \infty$ ) or the DP-SGD optimizer (for all  $\varepsilon < \infty$ ). All models are trained for 200 epochs using a
Figure 3: Accuracy-coverage trade-off across datasets &  $\varepsilon$  levels. We highlight noteworthy results for SCTD, DE, and SN with bold lines and further show that SN only provides results at coarse-grained coverage levels. SCTD performs best while DE and SN performance is compromised at any  $\varepsilon < \infty$ .
Table 1: Coverage required for non-private full-coverage accuracy. We observe that differential privacy considerably lowers the allowable coverage to achieve a utility level consistent with the non-private model. Across our experiments, SCTD yields the highest coverage across  $\varepsilon$  levels.
FashionMNIST	CIFAR-10	SVHN	GTSRB
ε = 7	ε = 3	ε = 1	ε = 7	ε = 3	ε = 1	ε = 7	ε = 3	ε = 1	ε = 7	ε = 3	ε = 1
MSP	0.83 (±0.01)	0.80 (±0.01)	0.65 (±0.03)	0.29 (±0.02)	0.14 (±0.04)	0.00 (±0.00)	0.74 (±0.00)	0.67 (±0.01)	0.49 (±0.02)	0.90 (±0.01)	0.71 (±0.03)	0.13 (±0.00)
SAT	0.86 (±0.00)	0.81 (±0.01)	0.67 (±0.02)	0.25 (±0.01)	0.19 (±0.02)	0.00 (±0.00)	0.72 (±0.00)	0.67 (±0.01)	0.45 (±0.02)	0.86 (±0.00)	0.74 (±0.00)	0.20 (±0.03)
MCDO	0.84 (±0.02)	0.79 (±0.00)	0.56 (±0.02)	0.25 (±0.01)	0.12 (±0.02)	0.00 (±0.00)	0.74 (±0.00)	0.64 (±0.00)	0.23 (±0.03)	0.90 (±0.01)	0.69 (±0.01)	0.14 (±0.01)
DE	0.75 (±0.00)	0.75 (±0.01)	0.61 (±0.01)	0.22 (±0.01)	0.09 (±0.00)	0.00 (±0.00)	0.69 (±0.01)	0.62 (±0.01)	0.22 (±0.00)	0.93 (±0.00)	0.57 (±0.08)	0.10 (±0.04)
SCTD	0.86 (±0.01)	0.84 (±0.02)	0.73 (±0.01)	0.26 (±0.03)	0.20 (±0.03)	0.04 (±0.04)	0.78 (±0.01)	0.72 (±0.00)	0.59 (±0.02)	0.93 (±0.01)	0.83 (±0.03)	0.30 (±0.02)
mini-batch size of 128. For all DP training runs, we set the clipping norm to  $c = 10$  and choose the noise multiplier adaptively to reach the overall privacy budget at the end of training. Note that, since we want to consider a consistent value of  $\varepsilon$  across all SC methods, we restrict the overall  $\varepsilon$  in both SN and DE. As explained in Section 3.2, this effectively enforces a reduction in  $\varepsilon$  for each individual training run due to sequential composition. Concretely, we train DE with 5 ensemble members and SN with target coverage levels  $c_{\mathrm{target}} \in \{0.1, 0.25, 0.5, 0.75, 1.0\}$ . This leads to a reduction of  $\approx \frac{\varepsilon}{\sqrt{5}}$  for each trained sub-model in both cases. We account for the precise reduction in the privacy parameter by increasing by the number steps of DP-SGD as measured by a Rényi DP accountant [Mironov, 2017, Yousefpour et al., 2021]. All experiments are repeated over 5 random seeds to determine the statistical significance of our findings. We document additional hyper-parameters in Appendix B.1.
Evaluation of selective classification techniques across privacy levels. We report our main results in Figure 3 where we display the accuracy-coverage trade-off for our full experimental panel. Overall, we observe that Selective Classification Training Dynamics (SCTD) delivers the best accuracy-coverage trade-offs. While this is consistent with non-private [Rabanser et al., 2022], we find that SCTD delivers especially strong performance at lower  $\varepsilon$  levels. This suggests that leveraging training dynamics information is useful for performative selective classification under DP. As expected, based off of the discussion in Section 3.2, Figure 3 also shows that the performance of both Deep Ensembles (DE) and SelectiveNet (SN) suffers under DP, showing increasing utility degradation as  $\varepsilon$  decreases.
Table 2: Accuracy-normalized selective classification performance. Across our panel of experiments, we find that decreasing  $\varepsilon$  leads to a worse (i.e., higher) score, meaning that as  $\varepsilon$  decreases the selective classification approaches all move away from the upper bound.
FashionMNIST	CIFAR-10
ε = ∞	ε = 7	ε = 3	ε = 1	ε = ∞	ε = 7	ε = 3	ε = 1
MSP	0.019 (±0.000)	0.023 (±0.000)	0.027 (±0.002)	0.041 (±0.001)	0.019 (±0.000)	0.105 (±0.002)	0.133 (±0.002)	0.205 (±0.001)
SAT	0.014 (±0.000)	0.020 (±0.001)	0.026 (±0.002)	0.043 (±0.002)	0.010 (±0.000)	0.107 (±0.000)	0.128 (±0.000)	0.214 (±0.002)
MCDO	0.020 (±0.002)	0.023 (±0.001)	0.030 (±0.003)	0.053 (±0.001)	0.021 (±0.001)	0.110 (±0.000)	0.142 (±0.000)	0.201 (±0.000)
DE	0.010 (±0.003)	0.027 (±0.002)	0.027 (±0.002)	0.039 (±0.000)	0.007 (±0.001)	0.099 (±0.002)	0.138 (±0.000)	0.222 (±0.000)
NNTD	0.007 (±0.001)	0.021 (±0.001)	0.023 (±0.003)	0.032 (±0.002)	0.009 (±0.002)	0.098 (±0.001)	0.107 (±0.001)	0.152 (±0.001)
SN	0.008 (±0.002)	0.058 (±0.001)	0.056 (±0.001)	0.064 (±0.002)	0.015 (±0.000)	0.155 (±0.003)	0.154 (±0.002)	0.173 (±0.001)
SVHN	GTSRB
MSP	0.008 (±0.001)	0.020 (±0.001)	0.024 (±0.001)	0.040 (±0.001)	0.001 (±0.001)	0.006 (±0.002)	0.017 (±0.000)	0.109 (±0.002)
SAT	0.004 (±0.000)	0.019 (±0.000)	0.021 (±0.002)	0.044 (±0.002)	0.001 (±0.001)	0.008 (±0.001)	0.014 (±0.000)	0.089 (±0.000)
MCDO	0.009 (±0.000)	0.019 (±0.001)	0.027 (±0.002)	0.069 (±0.001)	0.002 (±0.001)	0.007 (±0.001)	0.023 (±0.001)	0.110 (±0.001)
DE	0.004 (±0.001)	0.018 (±0.001)	0.022 (±0.002)	0.067 (±0.003)	0.001 (±0.000)	0.003 (±0.002)	0.027 (±0.004)	0.127 (±0.002)
NNTD	0.003 (±0.001)	0.016 (±0.001)	0.018 (±0.002)	0.027 (±0.001)	0.011 (±0.002)	0.005 (±0.000)	0.009 (±0.000)	0.062 (±0.001)
SN	0.004 (±0.000)	0.055 (±0.001)	0.052 (±0.000)	0.096 (±0.000)	0.001 (±0.001)	0.050 (±0.004)	0.044 (±0.001)	0.091 (±0.004)
Coverage
Figure 4: Distance to accuracy-dependent upper bound for the SCTD method. We plot both the accuracy-coverage trade-off of SCTD, i.e.,  $\mathrm{acc}_c(f,g)$ , with a solid line and the upper bound  $\overline{\mathrm{acc}}(a_{\mathrm{full}},c)$  with a dashed line. The shaded region enclosed between the two curves corresponds to the accuracy-normalized SC score  $s_{a_{\mathrm{full}}}(f,g)$ . We observe that the score grows with stronger DP levels (shown by brighter colors), i.e., selective classification becomes harder at low  $\varepsilon$ s.
Recovering non-private utility by reducing coverage. Recall that one key motivation for applying selective classification to a DP model is to recover non-private model utility at the expense of coverage. We investigate this coverage cost in detail by examining how many samples a DP model can produce decisions for while maintaining the utility level of the respective non-private model (i.e., a model trained on the same dataset without DP). The results are outlined in Table 1. For high (i.e.,  $\varepsilon = 7$ ) and moderate (i.e.,  $\varepsilon = 3$ ) privacy budgets, we observe that a reduction of  $20\% - 30\%$  in data coverage recovers non-private utility. However, at low (i.e.,  $\varepsilon = 1$ ) privacy budget we observe that dataset coverage degrades strongly on most datasets. In particular, we find that for CIFAR-10 (across all  $\varepsilon$  values) and GTSRB (at  $\varepsilon = 1$ ), the coverage reduces to below  $30\%$ . This result showcases that, depending on the particular choice of  $\varepsilon$ , recovering non-private model performance from a DP model can come at a considerable coverage cost. Moreover, this coverage cost varies widely across SC methods with SCTD leading to the lowest incurred loss in coverage by far.
Figure 5: Sequential composition (DE) vs parallel composition (DE-PART) for deep ensembles. We observe that DE-PART (orange) under-performs DE (blue) for selective classification across all  $\varepsilon$ .
Disentangling selective prediction performance from base accuracy. Recall from Section 3.4 that the standard evaluation pipeline for selective classification is not suitable for comparing DP models across varying privacy guarantees. To overcome this issue, we compute the accuracy-dependent upper bound (Equation 5) for each experiment and measure how closely the achieved accuracy/coverage trade-off aligns with this bound as per Equation 6. We document these results computed over all datasets, SC methods, and  $\varepsilon$  levels in Table 2. We find that, as  $\varepsilon$  decreases, all methods perform progressively worse. That is, for stronger privacy, all methods increasingly struggle to identify points they predict correctly on. Recall that this behavior is expected based on our discussion in Section 3.3. Again, we observe SCTD offering the strongest results, leading to the smallest bound deviation. To graphically showcase closeness to the upper bound, we further plot the accuracy-coverage trade-off and the corresponding upper bound for each experiment with the SCTD method in Figure 4.
Parallel composition with partitioned ensembles. As previously stated, Deep Ensembles underperform under DP due to composition. One potential mitigation strategy is to partition the data and train isolated models with no data overlap. This circumvents composition but also limits the utility of individual ensemble members as less data is available for training. We experiment with both setups and report results in Figure 5. Overall, these experimental results indicate that (i) partitioned deep ensembles lead to lower full-coverage accuracy when compared to non-partitioned deep ensembles while (ii) at the same time being less performant in terms of selective classification performance.
In this work we have studied methods for performing selective classification under a differential privacy constraint. To that end, we have highlighted the fundamental difficulty of performing selective prediction under differential privacy, both via a synthetic example and empirical studies. To enable this analysis, we introduced a novel score that disentangles selective classification performance from baseline utility. While we establish that SC under DP is indeed challenging, our study finds that a specific method (SCTD) achieves the best trade-offs between SC performance and privacy budget.
Limitations. This work presents insights drawn from empirical results and we acknowledge that a more thorough theoretical analysis is needed for a deeper understanding of the interplay between SC and DP. Also, we did not carefully investigate fairness implications beyond class imbalance. This connection to fairness requires special attention with past works showing that both DP and SC can negatively affect sensitive subgroups [Jones et al., 2020, Bagdasaryan et al., 2019].
Future work. We believe that this work initiates a fruitful line of research. In particular, future work can expand on the intuition provided here to obtain fundamental bounds on selective classification performance in a DP setting. Although we did not focus on this here, we believe that the ideas developed in this paper could help mitigate the trade-offs between privacy and subgroup fairness.
We would like to acknowledge our sponsors, who support our research with financial and in-kind contributions: CIFAR through the Canada CIFAR AI Chair, DARPA through the GARD project, NSERC through the COHESA Strategic Alliance and a Discovery Grant, and the Sloan Foundation. Anvith Thudi is supported by a Vanier Fellowship from the Natural Sciences and Engineering Research Council of Canada. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute. We would further like to thank Relu Patrascu at the University of Toronto for the provided compute infrastructure needed to perform the experimentation outlined in this work. Stephan Rabanser additionally wants to thank Mohammad Yaghini, David Glukhov, Patty Liu, and Mahdi Haghifam for fruitful discussions.
M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308-318, 2016.
E. Bagdasaryan, O. Poursaeed, and V. Shmatikov. Differential privacy has disparate impact on model accuracy. Advances in neural information processing systems, 32, 2019.
R. Bassily, A. Smith, and A. Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, pages 464-473. IEEE, 2014.
T. Brawner and J. Honaker. Bootstrap inference and differential privacy: Standard errors for free. Unpublished Manuscript, 2018.
R. Challen, J. Denny, M. Pitt, L. Gompels, T. Edwards, and K. Tsaneva-Atanasova. Artificial intelligence, bias and clinical safety. BMJ Quality & Safety, 28(3):231-237, 2019.
C. Covington, X. He, J. Honaker, and G. Kamath. Unbiased statistical estimation and valid confidence intervals under differential privacy. arXiv preprint arXiv:2110.14465, 2021.
C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pages 265-284. Springer, 2006.
C. Dwork, A. Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3-4):211-407, 2014.
R. El-Yaniv and Y. Wiener. On the foundations of noise-free selective classification. Journal of Machine Learning Research, 11(53):1605-1641, 2010. URL http://jmlr.org/papers/v11/el-yaniv10a.html.
G. Evans, G. King, M. Schwenzfeier, and A. Thakurta. Statistically valid inferences from privacy protected data. American Political Science Review, 2019.
L. Feng, M. O. Ahmed, H. Hajimirsadeghi, and A. H. Abdi. Towards better selective classification. In The Eleventh International Conference on Learning Representations, 2023.
C. Ferrando, S. Wang, and D. Sheldon. Parametric bootstrap for differentially private confidence intervals. In International Conference on Artificial Intelligence and Statistics, pages 1598-1618. PMLR, 2022.
Y. Gal and Z. Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In international conference on machine learning, pages 1050-1059. PMLR, 2016.
Y. Geifman and R. El-Yaniv. Selective classification for deep neural networks. Advances in neural information processing systems, 30, 2017.
L. N. Vieira, M. O'Hagan, and C. O'Sullivan. Understanding the societal impacts of machine translation: a critical review of the literature on medical and legal use cases. Information, Communication & Society, 24(11):1515-1532, 2021.
M. Vijh, D. Chandola, V. A. Tikkiwal, and A. Kumar. Stock closing price prediction using machine learning techniques. Procedia computer science, 167:599-606, 2020.
O. Williams and F. McSherry. Probabilistic inference and differential privacy. Advances in neural information processing systems, 23, 2010.
H. Xiao, K. Rasul, and R. Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017.
A. Yousefpour, I. Shilov, A. Sablayrolles, D. Testuggine, K. Prasad, M. Malek, J. Nguyen, S. Ghosh, A. Bharadwaj, J. Zhao, G. Cormode, and I. Mironov. Opacus: User-friendly differential privacy library in PyTorch. arXiv preprint arXiv:2109.12298, 2021.
A. Zaoui, C. Denis, and M. Hebiri. Regression with reject option and application to knn. Advances in Neural Information Processing Systems, 33:20073-20082, 2020.
A Additional Method Details
A.1 DP-SGD Algorithm
We provide a detailed definition of DP-SGD in Algorithm 2.
Algorithm 2: DP-SGD [Abadi et al., 2016]
Require: Training dataset  $D$  loss function  $\ell$  , learning rate  $\eta$  noise multiplier  $\sigma$  sampling rate  $q$  clipping norm  $c_{i}$  iterations  $T$  1: Initialize  $\theta_0$    
2: for  $t\in [T]$  do   
3: 1. Per-Sample Gradient Computation   
4: Sample  $B_{t}$  with per-point prob.  $q$  from  $D$    
5: for  $i\in B_t$  do   
6:  $g_{t}(\pmb {x}_{i})\gets \nabla_{\theta_{t}}\ell (\theta_{t},\pmb {x}_{i})$    
7: end for   
8: 2. Gradient Clipping   
9:  $\bar{g}_t(x_i)\gets g_t(x_i) / \max \left(1,\frac{\|g_t(x_i)\|_2}{c}\right)$    
10: 3. Noise Addition   
11:  $\tilde{g}_t\gets \frac{1}{|B_t|}\left(\sum_i\bar{g}_t(\pmb {x}_i) + \mathcal{N}(0,(\sigma c)^2\mathbf{I})\right)$    
12:  $\theta_{t + 1}\gets \theta_t - \eta \tilde{g}_t$    
13: end for   
14: Output  $\theta_T$  , privacy cost  $(\varepsilon ,\delta)$  computed via a privacy accounting procedure
A.2 Selective Classification Method Details
Softmax Response (SR) The traditional baseline methods for selective prediction is the Softmax Response (SR) method [Hendrycks and Gimpel, 2016, Geifman and El-Yaniv, 2017]. This method uses the confidence of the final prediction model  $f$  as the selection score:
$$
g _ {\mathrm {S R}} (\boldsymbol {x}, f) = \max  _ {c \in C} f (\boldsymbol {x}) \tag {7}
$$
While this method is easy to implement and does not incur any additional cost, SR has been found to be overconfident on ambiguous, hard-to-classify, or unrecognizable inputs.
SelectiveNet (SN) A variety of SC methods have been proposed that leverage explicit architecture and loss function adaptations. For example, SelectiveNet (SN) [Geifman and El-Yaniv, 2019] modifies the model architecture to jointly optimize  $(f,g)$  while targeting the model at a desired coverage level  $c_{\mathrm{target}}$ . The augmented model consists of a representation function  $r:\mathcal{X}\to \mathbb{R}^L$  mapping inputs to latent codes and three additional functions: (i) the prediction function  $f:\mathbb{R}^{L}\rightarrow \mathbb{R}^{C}$  for the classification task targeted at  $c_{\mathrm{target}}$ ; (ii) the selection function  $g:\mathbb{R}^L\to [0,1]$  representing a continuous approximation of the accept/reject decision for  $x$ ; and (iii) an additional auxiliary function  $h:\mathbb{R}^L\to \mathbb{R}^C$  trained for the unconstrained classification tasks. This yields the following losses:
$$
\mathcal {L} = \alpha \mathcal {L} _ {f, g} + (1 - \alpha) \mathcal {L} _ {h} \tag {8}
$$
$$
\mathcal {L} _ {f, g} = \frac {\frac {1}{M} \sum_ {m = 1} ^ {M} \ell \left(f \circ r \left(\boldsymbol {x} _ {m}\right) , y _ {m}\right)}{\operatorname {c o v} (f , g)} + \lambda \max  (0, c - \operatorname {c o v} (f, g)) ^ {2} \tag {9}
$$