SNAP-UQ: Self-supervised Next-Activation Prediction for Single-Pass Uncertainty in TinyML
Authors: Ismail Lamaakal
Chaymae Yahyati
Khalid El Makkaoui
Ibrahim Ouahbi
Yassine Maleh
Venue: ICLR 2026 Poster (2026)
Keywords: TinyML
uncertainty quantification
single-pass inference
depth-wise next-activation prediction
selective prediction
on-device monitoring
Primary area: probabilistic methods (Bayesian methods, variational inference, sampling, UQ, etc.)
TL;DR: We propose a novel single-pass, label-free TinyML uncertainty method that predicts next-layer activations with tiny int8 heads and turns prediction error into a calibrated confidence score.

Abstract: Reliable uncertainty estimation is a key missing piece for on-device monitoring in TinyML: microcontrollers must detect failures, distribution shift, or accuracy drops under strict flash/latency budgets, yet common uncertainty approaches (deep ensembles, MC dropout, early exits, temporal buffering) typically require multiple passes, extra branches, or state that is impractical on milliwatt hardware. This paper proposes a novel and practical method, SNAP-UQ, for single-pass, label-free uncertainty estimation based on depth-wise next-activation prediction. SNAP-UQ taps a small set of backbone layers and uses tiny int8 heads to predict the mean and scale of the next activation from a low-rank projection of the previous one; the resulting standardized prediction error forms a depth-wise surprisal signal that is aggregated and mapped through a lightweight monotone calibrator into an actionable uncertainty score. The design introduces no temporal buffers or auxiliary exits and preserves state-free inference, while increasing deployment footprint by only a few tens of kilobytes. Across vision and audio backbones, SNAP-UQ reduces flash and latency relative to early-exit and deep-ensemble baselines (typically $\sim$40--60% smaller and $\sim$25--35% faster), with several competing methods at similar accuracy often exceeding MCU memory limits. On corrupted streams, it improves accuracy-drop event detection by multiple AUPRC points and maintains strong failure detection (AUROC $\approx 0.9$) in a single forward pass. By grounding uncertainty in layer-to-layer dynamics rather than solely in output confidence, SNAP-UQ offers a novel, resource-efficient basis for robust TinyML monitoring. Our code is available at: https://github.com/Ism-ail11/SNAP-UQ

Published as a conference paper at ICLR 2026
SNAP-UQ: SELF-SUPERVISED NEXT-ACTIVATION PRE- DICTION FOR SINGLE-PASS UNCERTAINTY IN TINYML
Ismail Lamaakal', Chayymae Yahyati', Khalid EI Makkaoui', IIbrahim Ouahbi', Yassine Maleh²
Muuliiisscpplinayy Faculty of Nador, Mohammed First University, Oujda 60000, Morocco
2 Laboratory LaSTI, ENSAK, Sultan Moulay Slimane University, Khouribga 54000, Morocco
{i smail. lamaakal, chaymae, yahyati, k. elmakkaoui, i. ouahbi } @ump. ac ma y r.maleh3usme ma
ABSTRACT
Reliable uncertainty estimation is a key missing piece for on-device monitoring in TinyML: microcontrollers must detect failures, distribution shift, or accuracy drops under strict flash/latency budgets, yet common uncertainty approaches (deep ensembles, MC dropout, early exits, temporal buffering) typically require multiple passes, extra branches, or state that is impractical on milliwatt hardware. This paper proposes novel and practical method, SNAP-UQ. for single-pass, label-free uncertainty estimation based on depth-wise next-activation prediction. SNAP-UQ taps small set of backbone layers and uses tiny int 8 heads to predict the mean and scale of the next activation from a low-rank projection of the previous one; the resulting standardized prediction error forms depth-wise surprisal signal that is aggregated and mapped through a lightweight monotone calibrator into an actionable uncertainty score. The design introduces no temporal buffers or auxiliary exits and preserves state-free inference. while increasing deployment footprint by only few tens of kilobytes. Across vision and audio backbones, SNAP- UQ reduces flash and latency relative to early-exit and deep-ensemble baselines (typically ~-00-60 60% smaller and ~25-355 -355 faster), with several competing methods at similar accuracy often exceeding MCU memory limits. On corrupted streams, it improves accuracy-drop event detection by multiple AUPRC points and maintains strong failure detection (AUROC 0.9) in single forward pass. By grounding uncertainty in toyer-to-layer dynamics rather than solely in output confidence, SNAP-UQ offers novel, resource-efficient basis for robust TinyML monitoring. Our code is available at: htttps://ggt thub. com Ism- awt.:/mmmmmaal/aaaaaaaaa
INTRODUCTION
TinyML models increasingly ship on battery-powered microcontrollers (MCUs) DDavid et al. 102T to deliver private, low-latency perception for vision and audio (Banbury et al. 2021). Once deployed, inputs seldom match the training distribution: sensors drift, lighting and acoustics vary, and streams interleave in-distribution (ID), cearupted-inddistribite
(CID), and dui----distoiittion (OOD) samples (Hendrycks & Dietterich 2019). Under such shifts, modern networks are notoriously overcon fudent when they appear calibrated held-out ID) data (Guo et al. 2017 Ovadia et al. 2019), complicating on-device monitoring and safe fallback (Lai et al. 2018 Chen
(Minderer et al.) 2021
al.) 2018 Addressing this MCUs is challenging: memory and compute budgets preclude multi-pase inference, large ensembles Lakshminarayanan et al. 2017), or heavy feature stores.
This work:
We introduce SNAP-UQ (Self-supervised Next-Activation Prediction for single-pass Uncertainty] a label-free uncertainty mechanism tailored MCU deployments. Instead of sampling- based uncertainty (e.g., MC Dropout (Gal & Ghahramani 2016)) branching with auxiliary exits
Equally contributed and led the project.
'Trroughou,, we use 'self superviede to mean a label-free auxiliary regression that predicts next-layer acti- vation statistics solely from the network's 's own features (for uncertainty estimation), rather than self-supervised representation learning of the backhone.

---

Published as a conference paper at ICLR 2026
(Teraapitayyaonn al. 2017). SNAP-UQ attaches two or three tiny heads at chosen depths. Each head predicts the next-layer activation statistics from a low-rank projection of the previous layer; the mismatch between the realized and predicted activation yields depth-wise surprisal score (Sensoy et al. 2018). Aggregating these per-layer surprisals produces a single-pass uncertainty proxy that (optionally ly) blends with an instantaneous confidence term. The approach requires no extra forward passes, no temporal buffers, and no architectural changes to the backbone. All arithmetic is integer-frieet frieer--fiendly: the heads are quantized to int8, covariance is diagonal (with an optional low-rank correction), and exponentials are replaced by a small look-up table for exp( 2 log
Why depth-wise surprisal? Confidence at the softmax often degrades late and can remain peaky under CIID, whereas inter-layer dynamics shift earlier: features become atypical relative to the network's 's own transformation even before class posteriors flatten. SNAP-UQ explicitly models this conditional evolution de-1 + ag and scores how surprising ag under the head's predictive distribution. The resulting score acts as an early, label-fire indicator of trouble while preserving MCU budgets. Unlike classwise Mahalanobis (Lee et al.) 2018) or energy-based OOD methods (Liu et al., 2021), which compare against unconditional feature statistics or log-sum-exp energies, SNAP-UQ is conditional-on- and thus sensitive to distortions that break the mapping between layers.
Relation to prior work: Post-hoc calibration improves IDD confidence but generally fails under shift (Guo et al., 2017; Ovadia et al.] (019)). Early-exit ensembles and TinyML variants reduce cost by reusing backbone (Qendro et al.) 202T Ghanathe & Willton 2024), yet still add inference- time heads and memory bandwidth, and depend on softmax-deriver signals that are brittle under CID. Sampling- Sampling-based based uncertainty (MC Dropout, Deep Ensembles) increases compute and flash substantially (Gal & Ghahramani, 2016, Lakshminarayanan et al.) (017). Classical OOD detectors such as ODINIG-ODIN (Liang et al.] [220 Hsu et al. (020) can be strong on larger backbones but transfer less reliably to ultra-compact models typical of TinyML. Beyond ensembles and stochastic sampling, several single-pass deterministic UQ methods have been proposed, c.g., DUQ. DDU, evidential/posteerirr/pooo networks, and recent fixes for early-exit overconfidence, but many rely on architectural changes, specialized output layers, OOD exposure during training, or heavier heads
that clash with MCU constraints (Van Amersfoort et al. 2020 Mukhoti et al. [022] Sensoy et al.)
2018 Malinin & Gales] 2018 Charpentier et al. 2020: Deng et al. Meronen et al. (023). Tiny Deep Ensemble (Ahmed et al. 2022): forms a lightweight ensemble by sharing the entire backbone and duplicating only normalization layers (with different running stats/affine params), so multiple "members" are produced with minimal extra flash/RAM. This yields ensemble-style uncertainty (better ID/CID eтror and OOD separation than single heads) while keeping single-pass compute close to a vanilla model, well-suited for microcontrollers and edge accelerators. In contrast, SNAP-UQ occupies a different point: single pass, no state, tiny heads, with score derived from the network's ss own depth-wise dynamics rather than auxiliary classifiers or repeated sampling.
Contributions: SNAP-UQ introduces a supervieer,. depth-wise surprisal signal from tiny predictors attached to few layers and trained with a lightweight auxiliary loss, yielding single-pass uncertainty at inference with no temporal buffers, auxiliary exits, or ensembles (see Figure TT. The aggregate surprisal is an affine transform of a depth-wise negative log-likelihoon (equivalently conditional Mahalanobis energy) and is invariant to BN-like per-channel rescaling; we also derive robust (Student-t/Huber) and low-rank+diag variants (Appx. H. D. We provide an MCU-ready implementation using 1x1 projectors with global average pooling, int8 heads, LUT-based scales for lo and tiny monotone mapper, adding only a few-tens of KB of flash and S 2% extra MACs. Empirically, across MNIST, CIFAR-10, Tiny ImageNet, and SpeechCommands on two MCU tiers, SNAP-UQ improves accuracy-drop detection under CID), is competitive or better ID> -Ix and ID - OOD failure detection, and strengthens ID calibration, while fitting on the Small-MCU where heavier baselines are out-of-memoyy.
SNAP-UQ EXPLAINED
We consider depth-D DD backbone that maps an input x to activations {at ]2 with dg x, final features f(x) OD, and class posteriors Poly z) softmax(g(ap)) E A.1 Let 9 arg max; (y = f x) be the predicted class, Ca(æ) = max, ( = l x) the maximum
confidence, and (xx) = p (1) (x) pe (xx) the probability margin where pa
(1) (x) 2 p 2
are sorted class probabilities. Unlike temporal uncertainty methods that rely repeated evaluations,
2

---

Published as a conference paper at ICLR 2026
buffering, or online aggregation, SNAP-UQ constructs label-free uncertainty signal from the network's 's internal depth-wise dynamics in a single forward pass. The core intuition is that in- distribution inputs tend to induce predictable, smooth transitions from one layer to the next, while corrupted or shifted inputs often cause atypical intermediate transformations even when the final softmax remains overconfident. SNAP-UQ operationalizes this by tapping small set of layers, predicting each tapped activation from the previous one using lightweight conditional model, and measuring the surprisal (negative fog-likelihood) of the realized activation under that model. Because all quantities are computed during the standard forward pass, SNAP-UQ does not introduce auxiliary exits, multiple passes, or temporal state, and remains compatible with constant- memory MCU inference.
f>
Caseifer g
Optional with urr
go(Ps - eg)
In log
Boll's log
wbitd
Logistic
Train (gr) offline
Figure 1: SNAP-UQ pipeline. A standard backbone fi...., fo is tapped at a small set of layers to expose activations ag. For each tap, lightweight projector P.ay-1 feeds a tiny predictor dr that outputs next-activation statistics (ne, log of). The per-layer surprisal ey is a standardized squared error between the realized aę and jeg (diagonal scale ot), and the single-pass uncertainty proxy aggregates these as S(z) = Σ, ez. A monotone logistic head maps S(x) to calibrated score (((z){[0 [0, 1]; optionally, the head can blend instantaneous classifier confidence signals (maximum probability C and margin m m=)) for added separabiliity. Dashed boxes indicate training-oni steps where }ge} } are fitted offlin;; inference remains one forward pass, state-free, and MCU-friendly,
SNAP-UQ is designed for milliwatt-scale devices where the uncertainty computation must be single- pass, constant-memory, and compatible with integer inference (Appx. M). We assume the backhone fixed deployment, intermediate activations dg are naturally available during the forward pass, and the device can afford small number of additional linear operations per tapped layer together with simple elementwise arithmetic. We also assume no online labels and no long temporal histories are available, so uncertainty must come from instantaneous signals. Under these constraints, SNAP-UQ focuses on measuring whether the network's s internal computation follows the ceature-transitien patterns it learned on in-distribution data, which provides complementary failure signal to softmax confidence and margin.
2.1 DEPTH- WISE NEXT- ACTIVATIIOA MODEL
We model representation evolution along depth by predicting each tapped activation from its prede- cessor. Let de E Rd, denote the post-activation tensor after block fe (flattened when convenient), and choose a small tap set S (2..... D); in practice, two or three taps suffice, typically mid network block and the penultimate block. This choice reflects the observation that shifts can manifest differently across the hierarchy: earlier layers may show atypical low-level statistics under corrup- tions, while later layers may exhibit class-conditional mismatches or feature entanglement under domain shift. By aggregating surprisal from multiple depths, SNAP-UQ captures both effects while remaining lightweight.
For each f E S, SNAP-UQ first compresses the previous activation using low-rank projector, producing こい = P E R" with r. & dz-1- For convolutional backbones, Pe is implemented as 1 x1 pointwise convolution followed by global average pooling, which keeps computation and memory low while preserving the channel-wise "state" that best predicts the next block's 's behavior. For MIP-like backbones, Pe is skinny linear layer. The role of ze is not to reconstruct az- 1, but
3

---

Published as a conference paper at ICLR 2026
to retain the predietive summary needed to forecast ag; this makes the next-activation model both compact and robust to nuisance variability, which is important for on-device stability.
Conditioned on 2g. a tiny head ge outputs per-channel mean and log- varvaarae written as (Ne, log of) = ge (Zx) with μle og E Rd. This defines a simple conditional density po(a, at-1) = Niue, diag(o The diagonal form is deliberate: it yields closed-fore scoring rule, avoids expen- sive matrix operations, and supports freegr-frrienli inference via per-channel scales. Intuitively, fe captures the most likely next activation under typical in-distribution feature flow, while org represents expected variability per channel; under distribution shift, either the residual grows (unexpected mean behavior) or the residual becomes inconsistent with the learned scale (unexpected variability), both of which increase surprisal.
When additional expressivity is helpful and resources allow, we optionally refine the diagonal covariance with low-rank correction Σ₁ = diag(oo) + B, where B, E Rdexk and kę & de- This captures small subspace of cross-channel correlations (e.g., coupled channel groups in later layers) without paying the cost of a full covariance. The required log-determinant and quadratic form can be computed efficiently using the matrix determinant lemma and the Woodbury identity, so inference reduces to solving a kg x ki system per example (Appx. I setting kg 0 recovers the diagonal model.
Given (Mi, o , the per-tap surprisal is computed from standardized residual uz(x) (ar me) @ of and the quadratic standardized error (zr) [])e(=)) with width- normalizedd ge(x)) d, ge()). Under the Gaussian model, the conditional NLL equals (e() + + log of up to an additive constant, so qe is the energy term that increases when the realized activation is unlikely given the preceding layer. The standardization is essential for stable deployment: it makes the score insensitive to channel-wise scaling effects (for example, due to batch normalization, calibration drift, or quantization scale choices), because the head learns f4y and ag in the same units as the activation. This yields an invariance property formalized in Prop. 2.3 and empirically reduces the need for architecture-speciff tuning.
To form a single uncertainty proxy, we aggregate across taps as )(z)=Eed we (e(r) with wy 2 and Σ, wy 1. Uniform weights work well default, while inverse-variance weighting (estimated from a small development split) can down-weight taps whose surprisals are intrinsically noisy. This aggregation produces a scalar that summarizes whether the internal feature evolution is typical across the chosen depths; large values generally indicate that the model's computation is deviating from its learned in-distribution dynamics, which is strongly correlated with error under corruptions and OOD shifts.
The computational overhead small because ge is tiny and evaluated only at a few taps. For linear ge producing both μe and log o?. the parameter count is approximately 2 derz + 2dg (biases included) and the MAC cost Oddrz)). With [S] S 3 and re E [32, 128). the extra FLOPs are typically below few percent of tiny backbones, and the quantized footprint adds only tens of KB in flash. For integer deployment, we store projector and head weights as int8 (with per-tensor or per-channel scales) and use int32 accumulators; exp(-- log of) with small lookup table, clamping log of to [log oum log x to bound dynamic range and preserve monotonicity. These design choices keep inference single-pass and state-free while making the score computation numerically stable under quantization.
avoid exponentials by keeping log of and approximating
When robustness to heavy-tailed deviations is needed, the Gaussian channel penalty can be re- utt1
placed without changing the tap interface. A Student-t drop-in uses nlll") - 2 log (1 (p))=)p,))? ) + 2 log o²,,- while Huberized variant uses mll(" -i ps( (r.)) + log oï, 1s o
dd
de,s 8|u| 48² otherwise. For multi-modality small diagonal mixture p(ael aa-1)= = Σx my (u,,, diag () with mixture logits from ze is a drop-in modest extra cost, requiring only small log-sum-exp in float16.
with pb(u)= 2u² for |u| S 8 and ps
2.2 TRAINING OBJECTIVE AND REGULARIZATION
Training attaches the projectors and heads at the tapped layers and learns them using a label-free auxiliary objective that encourages predictable depth-wise transitions in-distribution data. For
4

---

Published as a conference paper at ICLR 2026
minibatch B and tap E S, define the standardized residual de (ae- (ee) o and the quadratic term qe = |lue Interpreting the head output diagonal Gaussian, the per-tap NI.L can be written as nll, = _ + 1 log of. Averaging over examples and taps yiclds Lss = [ Ener Eies nlle, and the total objective is L = Lat + Ass Las + Årog R. Although the classifier is trained with labels via Leis, the SNAP-UQ heads are trained to model feature transitions in self-supervised manner; the learned transition model then provides an uncertainty signal at test time without any online supervision.
To avoid degenerate scale predictions and keep the heads well-conditioned, we enforce a variance floor using of = softplus(Ee) + e² with a small constant c > O. We additionally penalize extreme or unstable scales and control head capacity via R Eies || log of lla + X LisS ( ||W,,&13 (12), where Wy. p.t and Wa. are the weight matrices producing f4 and log o The scale term discourages pathological behavior where the model hides errors by inflating og or produces overly sharp scales that make the score hypersensitive to quantization noise, which is particularly important for stable int8 inference.
On small datasets or sensitive backbones, we optionally block gradients from the self-supervised term into the backbone by detaching the tapped activation in the residual, using alldetach {(((sopgrad((a)) pe) @ - $11 log logo7. This avoids tug-of-war between improving classification loss and improving transition predictability, while still fitting the tiny heads to the backbone's 's induced feature dynamics (see Appx. N To prevent wide layers from dominating the auxiliary loss purely by dimensionality, we balance tap contributions using nil,- = àz nlly and com- pute Las architectures.
[B] EnEB Eies nilly, which makes each tap contribute on a comparable scale across
In practice, tune only small number of scalars. We sweep single auxiliary weight Àss (10-3, 5 10-3, : 10-2} on an in-distribution validation split and keep Au small and fixed. The heads are linear and quantized to int computing functions of log 0² uses small LUT so the implementation remains MCU-friendly. At test time, we do not compute Lss: we only evaluate the standardized residuals (equivalently, (x))) and aggregate them into the surprisal score used for uncertainty mapping (Appx. papx.Jannd and N.3
2.3 SINGLE-PASE SURPRISAL AND MAPPING
At inference, the backbone forward pass produces the activations {az) and each tapped head outputs (pe:a?) from zg. We compute the standardized error per tap as eς(x) = [1 -ee 3 of |12 and normalize it as (x() = 1 ee (x), then aggregate across taps using S(x) = Etes we ēz(2) with wy 2 0 and Σg we = 1. This scalar S(x)) can be interpreted as a depth-wise energy: it is small when the feature evolution is consistent with the learned in-distribution transition model, and it grows when intermediate transformations become unlikely. Because the computation is local to the forward pass and does not require storing histories, it is naturally state-free and constant-memory.
de
To translate surprisal into a decision-oriented uncertainty score, fit monotone mapping offline using a small labeled development mix (ID plus CID/ÓOD). We use a logistic map (Platt 1999) that can optionally incorporate simple instantancous confidence proxy. The proxy defined as m(x) = a(1 Cs(z)) + (1 (1-a)(1- - m (z)) with E [0, 1]. and the final uncertainty is U(x) = oBu + 3,5(2) + 32m(x)). Setting B2 = 0 yields a purely label-free mapping from S(x) to uncertainty, while including m(z) often improves separability because it injects complementary information from the classifier's 's output layer without requiring any additional passes. All parameters (Bo, B1, (2) are fit once offline, inference only requires evaluating S(x) and a tiny scalar map.
Once U(x) is available, decisions can be made using a fixed threshold Uxx) 2 r, by selecting to target a desired risk-coverage operating point on the dev set, or via a budgeted controller that caps the long-run abstention rate at b by choosing the largest 7 such that [E[[((()) 2 r] < under the dev distribution (Appx. K. When budgets are tight or calibration must be especially accurate, isotonic regression (Zadrozny & Elkan 2002) can replace the logistic map, providing a nonparametrie monotone transform from S(æ) (or from the pair (S(r), m(x)) to estimated error probability (Appx. D) In all cases, calibration is performed offline and does not rely on online labels, preserving the deployment assumptions.
5

---

Published as a conference paper at ICLR 2026
Overall, training attaches lightweight per-layer predictors and optimizes self-supervised surprisal loss, then fits a monotone map from aggregated surprisal to eπror probability (Alg. [T. At inference, a single pass computes standardized errors at the taps, aggregates them into S(x)., maps to (x)), and thresholds, without extra passes, buffers, or online labels (Alg. 2
2.4 COMPLEXITY, FOOTPRINT, AND MCU IMPLEMENTATION
Let de = (am( and ry- = dim For linear ge with two heads (predicting μ and log o²), the parameter count is #02, Rs 2 dery + 2d, (biases included) and the compute is FLOPs; = (dgrr). 2% of tiny
With |S| taps, ry E [32, 128). and de [128, 512]. the extra FLOPs are typically backbones (e.g.. DS-CNN/ResNet-8) and the flash footprint is a few tens of KB at 8-bit weights. Runtime memory stores {Pt, w,,e, Wa,t) plus per-channel scales; there is no (W) temporal buffer (Appx. D. and all computation is streaming-friee friendly because it runs at the moment the tapped activation is produced.
We store Pr, W,,e, Wo. as int8 with per-tensor scales, compute projections and heads with int32 accumulators, and then compute the standardized residual using integer-friendly arithmetic. To avoid exponentials, we operate on log of and approximate exp(- _/2 log oς) with small LUT (per-channel or shared), clamping log of for stability and applying small floor when forming or This implementation preserves monotonicity of the score with respect to activation deviations, which critical for reliable thresholding, while keeping the end-to-end pipeline compatible with MCU toolchains.
Taps are chosen at the end of a mid block (capturing shifts in local statistics and mid-level structure) and at the penultimate block (capturing shifts in class-specific abstraction). We set ranks so that each tap's compute stays within a small budget (e.g.. S 1% of backbone FLOPss, and either keep weights uniform or set we x 1/Var(Ez) on dev data to reduce the influence of noisy taps.
2.5 THEORY: LINKS TO LIKELIHOOD AND MAHALANOBIS
Proposition 2.1 (Surprisal (Surprisal-likelioors likelihood equivalence under diagonal-Gaussiane Gaussian). If po (at at-1)) =
ex(x) (ue, diag(o?)) as above, then - log pe (ag at-1)== = ex + is (up to additive/muiiilicatiie constants and layer weighting) ) the depth-wise negative log-likelihood. Higher S(x) implies lower conditional likelihood of the observed activations.
E logož, + const, so S(x)
Proposition 2.2 (Relation to Mahalanobis scores). Let the usual Mahalanobis score use unconditional, classwise feature Gaussians at layer f. If the true feature dynamics are approximately linear, ag 2s WW by + Eg with Eg ~ (O, Eee), then the conditional energy e equals the squared Mahalanobis distance of ag the conditional mean Wgat-1 + be under covariance E.. Hence SNAP-UQ measures deviations from depth-wise dynamics rather than unconditional, class-averaged statistics, improving sensitivity to distribution shift that alters inter Inter-layer transformations.
Proposition 2.3 (Affine invariance (scale)). Suppose harchnnormd activations admit per-channel affine transforms dg + @ ae + If Pt and gi are trained jointly, the standardized error e, is invariant to such rescalings at optimum because phe and de co-adapt; formally eg is unchanged under s when μ4d H> O pe + and 0e H |s| 2 dz.
Proof sketches are given in Appx. Proposition 2.1 follows by expanding the Gaussian NLL; Proposition 2.2 follows by conditioning linear-Gaussial transition model and relating the quadratic form to a conditional Mahalanobis energy; Proposition 2.3 follows directly from the standardized residual under reparameterization.
2.6 VARIANTS AND ABLATIONS
Using Σg = diag(o?) + BJ with small he E (4,8) often tightens the conditional model with negligible extra cost, since inference requires only matrix-vector products with B3 and a small system solve. A small K K-component diagonal mixture can handle multi-modality in depth-wise transitions by letting different modes specialize to distinct feature regimes; logits from žς select mixture weights, and the main additional operation is log-sum-exp (done in float16). Detaching as inside Les can improve stability on small datasets by preventing the auxiliary loss from perturbing the backbone, and we report both attached and detached variants in ablations (Appx. N).

---

Published as a conference paper at ICLR 2026
For mapping, isotonic regression can replace logistic when the operating point is budgeted and cali- bration tightness matters, yielding improved risk- coverage behavior (Kull et al. 2019). Quantization- aware training (QAT) can further reduce int8 drift by inserting fake quantization on Pe and the heads, and by explicitly quantizing log o² to 8-bit with shared scale (Choi et al. 2018). Across these variants, the main conceptual role of (ar) remains the same: it is conditional, layer-aware energy computed along depth that flags shifts in feature dynamics that plain confidence or margin can miss. SNAP-UQ complementary to ensembles, MC dropout, and TTA (which increase compute) and temporal methods (which require buffering); when resources allow, Sz) can also be used as an input feature to richer controllers, while preserving the single-pass MCU-friendly baseline.
EVALUATION METHODOLOGY
Our objective is to test whether depth-wise surprisal, the core of SNAP-UQ, provides a practical, on-device uncertainty signal under TinyML constraints.
Hardware and toolchain. We target two common MCU envelopes: a higher-capacity microcon- troller with a few MB of flash and several hundred KB of SRAM (Big-MCU) and an ultra-low-pont low-power part with sub-MB flash and tens of KB SRAM (Small-MCU) (STMicroelectronncc 2019; 2018). Builds use the vendor toolchain with -03 (Chen et al. 2018); CMSIS-NN kernels are enabled where available (Lai et al. 2018: David et al. 2021). The clock is fixed at the datasheet nominal to avoid DVFS confounds.
Cost and runtime accounting, Flash is reported from the final ELF after link-time garbage collection. Peak RAM comes from the linker map plus the incremental buffers for SNAP-UQ's projectors/heads. Latency is end-to-end time per inference measured by the on-chip cycle counter with interrupts masked; each figure averages 1,000 runs (std. dev. shown). Energy (selected runs) integrates current over time using shunt on the board rail.
Backbones and datasets. Vision: MNIST, CIFAR-IO, TinyImageNet (Lecun et al.
1998
Krizhevsky 2009. Le & Yang 2015). Audio: SpeechCommands v2 (Warden 2018). Backbones: a
layer DSCNN for SpeechCommands (Zhang et al. 2018), compact residual net for CIFAR-10 10
(Banbury et al. 2021), and a MobileNetV2-sty/ model for TinylmageNet (Howard et al. 2017 Cal
et al.2 Standard augmentation is used; temperature scaling is applied on the ID validation split
(Hendrycks et al. 2020). Full dataset and schedule details appear in Appx. A and B
We attach two taps (end of a mid block and the penultimate block). Each tap uses 1 1x1 projector Pa with global average pooling and two int8 heads that output (n,, lo).?). We set ranks ry E (32, 64, 128} and auxiliary weight Ass E (10-3,10-3) To avoid exponentials on-device, log a is clamped and mapped to per-channel multipliers via 256-entry LUT. A 3-parameter logistic map converts (S, m) to U; an isotonic alternative is reported
SNAP-UQ configuration (inference-friendly))
in Appx. T
Baselines and tuning. We compare against single-pass confidence (max-prou coaabbbbbbbbllty, entropy)
(Hendrycks & Gimpel| 2018), temperature scaling, classwise Mahalanobis at tapped layers, energy- based scoring (Liu et al. (202T), evidential posteriors when they fit, and, on Big- Big-MCU only. MC Dropout (Gal & Ghahramani (216)) and Deep Ensembles "Lakshminarayanan et al. 2017) and (Tack) al. 2020 Du et [d.[[22)]] Wang al. 2022), QUTE (Ghanathe & Wilton| (204) All methods share
backbones and input pipelines; thresholds and any temperature/isotonie parameters are tuned on common development split. Implementation details and grids appear in Appx.
CID/OOD protocols and streaming setup. We use MNIST-C, CIFAR-10-C, TinylmageNet-C C
(Mu & Gilmer 2019 Hendrycks & Dietterich 2019). For SpeechCommands we synthesize CID using impulse responses, background noise, reverberation, and time/pitch perturbations (Appx. D OOD sets are Fashion-MNIST (for MNIST), SVHN (for CIFAR-10), audio (for SpeechCommands), and disjoint TinyImageNet classes. For streaming evaluation, we concatenate clean ID segments with CID segments of rising severity and short OOD bursts (Gama et al., 2014). Events are labeled offline via sliding-window accuracy (window m=100) falling below an ID band estimated from a held-out run (MiD + 30 The monitor never sees labels online. We score event detection by AUPRC and report thresholded detection delay; thresholds are selected offline on the dev split (Appx. Eb.
mnn-kyyoordbbcckroome
7

---

Published as a conference paper at ICLR 2026
4 RESULTS
We evaluate SNAP-UQ on four axes: deployability on MCUs, monitoring under corrupted streams, failure detection (ID/CID and OOD), and probabilistic quality ID. Unless noted, results averaged over three seeds; 95% confidence intervals (CIs) are obtained via 1,000x bootstrap over examples. Ablations (tap placement/rank, quantization variants, mapping alternatives, risk-coverage surfaces, reliability diagrams, and error clusters) are deferred to Appx N and O for single-pass head-to head-to-head and decision-centie risk coverage analyses.
4.1 ON-DEVICE FIT AND RUNTIME
Setup. All methods share the same backbones, preprocessing, and integer kernels. Builds use vendor toolchains with -33 and CMSIS-NN where available; input I/O is excluded and timing spans from first byte in SRAM to posterior//ncertaing, out. Flash is read from the final ELF (post link-time GC), Peak RAM is computed from the linker map plus scratch buffers required by the method. Latency is measured with the MCU cycle counter datasheet nominal clock (interrupts masked), averaged over 1,000 runs. Energy integrates current over time via a calibrated shunt at 20 kHz. All baselines are compiled with the quantization scheme; when method does not fit, report OOM and omit latency/energy.
Findings. Table I summarizes deployability. On Big-MCU, SNAP-UQ reduces latency by 35 % (SpeechCmd) and 24% (CIFAR-10) vs. EE-ens, and by 26-34% vs. DEEP, with 49-46% and 37-57% flash savings, respectively. On Small-MCU, both ensembles are OOM for CIFAR-10: for SpeechCmd, SNAP-UQ is 33 % faster and 16-24% smaller, and uses 1.6-2.0x less peak RAM than EE-ens due absent exit maps and int8 heads. These trends hold across seeds; CIs are narrow (typically 1-33% of the mean).
Table I: MCU deployability. Flash (KB) / Peak RAM (KB) / Latency (ms) Energy (mJ). OOM: method does fit.
Big-MCU (SpeechCmd)
BASE
EE-ens
DEEP
SNAP-UQ
Flash 1
220
360
290
182
Peak RAM 4 Latency
132
108
70
60
85
70
52
Energy
2.1
3.0
2.5
1.7
Big-MCU (CIFAR-10)
Flash J.
280
540
680
292
Peak RAM 4
128
190
176
120
Latency
95
110
125
83
Energy
3.7
4.1
4.6
3.3
Small-MCU (SpeechCmd)
Flash
320
210
118
Peak RAM 1
60
104
86
51
Latency Energy
170
240
200
113
6.0
8.6
7.3
4.7
Small-MCU (CIFAR-10)
Flash J
180
OOM
OOM
158
Peak RAM 4
OOM
OOM
85
Latency
260
OOM
OOM
178
Energy
9.5
OOM
OOM
Note. BASE includes on-device softmax+entroop and small stats buffer: SNAP-UQ replaces this with a single scalar surprisal S(z) and is compiled INT8 with kernel fusion.
4.2 MONITORING CORRUPTED STREAMS
Protocol. We construct unlabeled streams by concatenating ID segments, CID segments (severities 1-5 from MNIST-C/CIFAR- 10- D-CC/TnnllmageNe bursts. Ground falls below ID band estimated from separate held-out ID run (MnD 35DD). Thresholds for each method are fixed on a development stream to maximize the Fl score and then held constant for evaluation.
or our SpeechCmd-C generator), and short OOD events are labeled offline when a
window accuracy (window m=100)
8

---

Published as a conference paper at ICLR 2026
CIFAR-IO-CO -O-RR-I--CCAA (AUPRC vs. severity)
0.8
AUPRC
0.6
EE-ens
DEEP
SNAP-UQ
0.2
Severity
Figure 2: CIEAR-10-C: AUPRC corruption severity. SNAP-UQ scales fastest with severity.
Findings. SNAP-UQ yields the best average AUPRC and shortest delays on MNIST-C and SpeechCmd-C (Table 2) and its AUPRC grows fastest with severity CIFAR-IO-C (Fig. 2 Qualitatively, depth-wise surprisal reacts earlier than softmax entropy as distortions accumulate, reducing late alarms. False positives clean ID segments remain low at matched recall (Appx
Table 2: Accuracy-dry drop defection on CID streams. AUPRC (higher is better) and median detection delay (frames) at a single dev-chosen threshold.
MNIST-C
SpeechCmd-C
Context (accuracy)
Clean: 99.0%
CID:
90.8% (-8.2 pp)
Clean: 95.2%
CID:
86.0% (-9.2 pp)
Method
AUPRC1 f
Delay 4
AUPRC 1
Delay
BASE
0.54
42
0.52
67
EE-ens
0.63
31
0.59
55
DEEP
0.56
35
0.58
57
SNAP-UQ
0.66
24
0.65
41
4.3 FAILURE DETECTION (ID, CID, OOD)
Tasks. We report AUROC two threshold-fret discriminations: ID -IDx (correct vs. incorrect among ID CID) and ID -ev--O0 OOD (ID vs. OOD). For operational relevance, we further compare selective risk at fixed coverage and selective NLL in Appx F
-DV-IDDA IDx for MNIST and SpeechCmd and remains competitive on CIFAR-10; on ID - OOD, it ties the best on SpeechCmd and is close to the strongest semantic OOD detector CIFAR-10 (Table 3). These gains mirror the monitoring results: when corruptions are label preserrre,,,,ng depth-wise surprisal provides sharper separation than confidence-only scores.
Findings. With single forward pass, SNAP-UQ leads
Table 3: Failure detection. AUROC for IDx and OOD.
ID- IDx
ID 0OD
Method
MNIST
SpCmd
CIFAR-10
MNIST
SpCmd CIFAR-10
Context (clean ace.)
99.0%
95.2%
83.7%
N/A (OOD sets)
BASE
0.90
0.84
0.90
MCD
DEEP
0.85
0.91
0.86
0.78
EF-ensemble
0.85
0.90
0.85
0.85
0.90
0.90
G-ODIN
0.72
0.74
0.83
0.40
0.74
0.95
HYDRA
0.81
0.90
0.83
0.71
0.90
0.90
QUTE
0.87
0.91
0.86
0.84
0.91
0.91
SNAP-UO
0.90
0.94
0.87
0.86
0.92
0.94

---

Published as a conference paper at ICLR 2026
4.4 CALIBRATION ON ID
Findings. SNAP-UQ improves proper scores MNIST and SpeechCmd, lowering both NLL and BS while reducing ECE relative to BASE. On C-FAR-10, a capacity-matched variant (SNAP- UQ+) matches DEEP BS with comparable NLL,, while preserving single-pass inference (Table 4). Reliability curves and selective-calibratoo analyses appear in Appx N.5 Raw vs. calibrated. We also evaluate using the raw surprisal (x)) (no calibration) the uncertainty signal; rankings remain strong. but decision metrics improve with tiny logistic/isotonic map. See Appx. N.6 for numbers.
Table ID calibration. Lower is better. SNAP-UQ increases projector rank and adds low-rank covariance correction.
MNIST
NLL 4
4
ECE
BASE
0.285
0.012
0.028
Temp. scaled
0.242
0.010
0.022
SNAP-UQ
0.202
0.008
0.016
SpeechCmd
NLL
BS
ECE
BASE
0.306
0.012
0.024
Temp. scaled
0.228
0.009
0.021
SNAP-UQ
0.197
0.008
0.016
CIFAR-10
NLL
BS
ECE
BASE
0.415
0.021
0.031
DEEP
0.365
0.017
0.015
SNAP-UQ
0.363
0.017
0.021
Mapping recipe
We convert surprisal S to a calibrated uncertainty with a tiny monotone link.
b Isotonic (recommended for fixed coverage monitoring): nonparametric, preserves ordering, adapts nonlinearities; thresholds remain stable under CID/OOD shifts.
> Logistic (recommended for in distribution calibration): use U (B B1S + 32m), where m may be a confidence cue (e.g., 2 logit margin or max softmax).
b Default include m: adding m consistently lowers selective risk at a given coverage with negligible cost; when is unavailable, set 33=00.
> Practical recipe: for robust event detection or fixed coverage, fit isotonic on small dev stream and threshold U; for best ID scores (NLL/BS/ECE), fit the logistic map on an ID dev split (logit temperature optional). Because both maps are monotone, AUROC/AUPRC stay nearly unchanged; the choice mostly affects decision centric metrics (selective risk, fixed coverage error) and can swapped without retraining.
CONCLUSION AND DISCUSSION
SNAP-UQ converts desth-wise next-activation prediction into single-pass, frienddy uncer- tainty signal that drops neatly into CMSIS-NN pipelines and fits within kilobyte-scale MCU budgets. Empirically it improves accuracy-drop monitoring corrupted streams, remains competitive on ID -Dx and ID- -OD failure detection, and strengthens ID calibration without temporal buffers, auxiliary exits, or extra passes. Limitations include reliance access to intermediate ac- tivations, diagonal/low-ree to tap placement and projector rank. Future work targets hardware- tap/rank selection, richer yet cheap heads Low-rankkdiag, mixtures, Student-t), self-tuning calibration under budgets, and lightweight fusion with semantic OOD eue.
IDx
covariance that may miss fine cross-channel structure, and sensitivity
10

---

Published as a conference paper at ICLR 2026
LLM USAGE
We used a large language model (LLM; ChatGPT) solely as a general-purpose assist tool to improve clarity and presentation (e.g., grammar/typo fixes, tighter phrasing and transitions, light ЕTІX tips, and reference style cleanup). We did not use an LLM for research ideation, experimental design, data analysis, result interpretation, drafting substantive technical content, equations/algorithms, figure creation, or code implementation. All scientific ideas, methods, results, and conclusions are solely those of the authors; every LLM -uggeeee edit was reviewed and manually accepted, and no confidential or sensitive data were shared with the LLM.
REFERENCES
Soyed Tuhin Ahmed, Michael Hefenbrock, and Mehdi B. Tahoori. Tiny deep ensemble: Uncertainty estimation in edge ai accelerators via ensembling normalization layers with shared weights, 2024.
05286
Anastasios Angelopoulos, Stephen Bates, Jitendra Malik, and Michael I. Jordan. Uncertainty sets for image classifiers using conformal prediction, 2022. URL https::/aaxxx...... wttp://rggg/aa////////
14193
Colby Banbury, Vijay Janapa Reddi, Peter Torelli, Jeremy Holleman, Nat Jeffries, Csaba Kiraly, Pietro Montino, David Kanter, Sebastian Ahmed, Danilo Pau, Urmish Thakker, Antonio Torrini, Peter Warden, Jay Cordaro, Giuseppe Di Guglielmo, Javier Duarte, Stephen Gibellini, Videet Parekh, Honson Tran, Nhan Tran, Niu Wenxu, and Xu Xuesong. Miperf tiny benchmark, 2021. URL https:///aatttiii org/ httgg//b//2206.0 07597
Han Cai, Chuang Gan, Tianzhe Wang, Zhekai Zhang, and Song Han. Once-for-all: Train one network and specialize it for efficient deployment, 2020. URL http:/ts////xxx..o////////
09791]
Bertrand Charpentier, Daniel Zügner, and Stephan Günnemann. Posterior network: Uncertainty estimation without ood samples via density-based pseudo-counts, 2020. httth:tt///aae
orq/abs/2005 09239
Tianqi Chen, Thierry Moreau, Ziheng Jiang, Lianmin Zheng, Eddie Yan, Meghan Cowan, Haichen Shen, Leyuan Wang, Yuwei Hu, Luis Ceze, Carlos Guestrin, and Arvind Krishnamurthy. Tvm: An automated end-to-end optimizing compiler for deep learning, 2018. URL htthhttps:
org/abs/1802 04799
Jungwook Choi, Zhuo Wang, Swagath Venkataramani, Pierce I-Jen Chuang, Vijayalakshmi Srinivasan, and Kailash Gopalakrishnan. Pact: Parameterized clipping activation for quantized neural networks, 2018. URL /ttttttss//artttit http:////aaxii.oooaa//////////// www./orgggaaba/eeeee..eeeeeeae/t /1805. 06085
Robert David, Jared Duke, Advait Jain, Vijay Janapa Reddi, Nat Jeffries, Jian Li, Nick Kreeger, Ian Nappier, Meghna Natraj, Shlomi Regev, Rocky Rhodes, Tiezhen Wang, and Pete Warden. Tensorflow lite micro: Embedded machine learning on tinyml systems, 2021. URL https
//arxiv.orq///a/aa.llaea abs 20000.2200... 08678
Danruo Deng, Guangyong Chen, Yang Yu, Furui Liu, and Pheng-Ann Heng. Uncertainty estimation by fisher information-bar evidential deep learning, 2023. URL httpp:://axiiv.og////a 0303.02043
Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for out-of-distribution detection, 2023. URL httpps///aax...oogr//b////// 09858
Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't 't know by virtual outlier synthesis, 2022. URL htttts://aratti wttp://wwwgpbbbb......../
Steven K. Esser, Jeffrey L. McKinstry, Deepika Bablani. Rathinakumar Appuswamy, and Dharmen- dra S. Modha. Learned step size quantization, 2020. URL/bttss://axxii www.aiiii..i.rra..oo hwtp/b//////. abs /9002
08 153
11

---

Published as a conference paper at ICLR 2026
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In Maria Florina Balcan and Kilian Q. Weinberger (eds.), Proceedings of The 33rd International Conference on Machine Learning, volume 48 of Proceedings of Machine Learning Research, pp. 1050-1059, New York, New York, USA, 20-22 Jun 2016. PMLR. URL https::/proceedingg: ml www.s/ressseee. wttpe////////a/aaeaeeaa http://nn.........re/eeeeee..e
João Gama, Indré Zliobaité, Albert Bifet, Mykola Pechenizkiy, and Abdelhamid Bouchachia. A survey on concept drift adaptation. ACM Computing Surveys, 46(4):1-37, 2014.
Nikhil P Ghanathe and Steven J E Wilton. Qute: Quantifying uncertainty in tinyml with early-exit- assisted ensembles for model-monitoring. 2024. URL htRp::tt////xii.orrrg
/
12599
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks, 2017.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations, 2019. URL/sttpss//aazz3..crr/////////2
Dan Hendrycks and Kevin Gimpel. baseline for m misclassiffedd and duitof-diittibutiin examples in neural networks, 2018.
02136
Dan Hendrycks, Norman Mu, Ekin D. Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: simple data processing method to improve robustness and uncertainty, 2020. TRLtttts:
wtt./orggga/aaaeeeeeeeee org at///b////9/ 02781
Andrew G. Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications, 2017. URL URL https:::////.... http:///wwwwww...aaa//aoa///
04861
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of- distribution image without learning from out-of-distributio data, 2020. URL https://aa/:
org/ arq/abs//0000 200.bb/2002.129999
Alex Krizhevsky, Learning multiple layers of features from tiny images. Technical Report TR-2009, University of Toronto, 2009. Department of Computer Science.
Meelis Kull, Miquel Perello-Nieto Markus Kängsepp. Telmo Silva Filho, Hao Song, and Peter Flach. Beyond temperature scaling: Obtaining well-calibrated multiclass probabilities with dirichlet calibration, 2019. http:ttts/////xiv.ooom
1910. 12656
Liangzhen Lai, Naveen Suda, and Vikas Chandra. Cmsis-nn: Efficient neural network kernels for arm cortex-m cpus, 2018. URL http:::://axxiv.ooc/p.oo abs .06601
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles, 2017. URL URt.h/tppee///rr....rrr//a/b/b/s
01474
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. http://cs23.. edd// 2015. CS231N, 7(7):3.
Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 (6(11):22782232, 1998. doi: 10.1109/..22791
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks, 2018. URL httpp/////xxxvooo///a/b/ 2807.03883
Yuhang Li, Ruíhao Gong, Xu Tan, Yang Yang, Peng Hu, Qi Zhang, Fengwei Yu, Wei Wang, and Shi Gu. Breeq: Pushing the limit of post-training quantization by block reconstruction, 2021. URL httpps:/
org/ abs/ 2102.05422 05426
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of -fitt---ditti image detection in neural networks, 2020. URL URLbttps:: //wrx/aavvvvva//a wwwpass..r..//oooo..oo..o..o..s 1006 00t.//16666609009 02690
12

---

Published as a conference paper at ICLR 2026
Weitang Liu, Xiaoyun Wang. John D. Owens, and Yixuan Li. Energy- basedd out-of-distribution detection, 2021. URL htttttttt//:aiiiii org/ abs/ 2010/0001003759
Andrey Malinin and Mark Gales, Predictive uncertainty estimation via prior networks, 2018. URL
wwt..oorgggai////2.111122 10500
Lassi Meronen, Martin Trapp. Andrea Pilzer, Le Yang, and Amo Solin. Fixing overconfidence in dynamic neural networks, 2023.
06359
Matthias Minderer, Josip Djolonga, Rob Romijnders, Frances Hubis, Xiaohua Zhai, Neil Houlsby, Dustin Tran, and Mario Lucic, 2021. URL [RLtttts://rxxi>> wwt.://gg/aaaaaae.. http:////aaaaaa..oooaa/a///2//// 07998
Norman Mu and Justin Gilmer. Mnist-c: A robustness benchmark for computer vision, 2019. URL
http://aaxivvvvv.. https:///axxv..or///////// wwtp://p//bbb/....ooooo 02337
Jishnu Mukhoti, Andreas Kirsch, Joost van Amersfoort, Philip H. S. Torr, and Yarin Gal. Deep deterministic uncertainty: simple baseline, 2022. URL htt.:: http:/:://xxvvvvrreeeee wwtp:/iwww.//////12....3
11582
Markus Nagel, Rana Ali Amjad, Mart van Baalen, Christos Louizos, and Tijmen Blankevoort. Up down? adaptive rounding for post-training quantization, 2020. URL http:ttt///aaxi..orrr
abs abs/2004 10568
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, al. Reading digits natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, pp. 7. Granada, 2011.
Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, Sculley, Sebastian Nowozin, Joshua V. Dillon, Balaji Lakshminarayanan, and Jasper Snoek. Can you trust your model's uncertainty? evaluating predictive uncertainty under dataset shift, 2019. URL https: http///axvvvv.. wwt. /996
02530
John Platt. Probabilistic outputs for support vector machines and comparisons to regularized likeli- hood methods. Advances in large margin classifiers, 10(3):61-74, 1999.
Lorena Qendro, Alexander Campbell, Pietro Lio, and Cecilia Mascolo. Early exit ensembles for uncertainty quantification. In Subhrajit Roy, Stephen Pfohl, Emma Rocheteau, Girmaw Abebe Tadesse, Luis Oala, Fabian Falck, Yuyin Zhou, Liyue Shen, Ghada Zamzmi, Purity Mugambi, Ayah Zirikly, Matthew B. A. McDermott, and Emily Alsentzer (eds.), Proceedings of Machine Learning for Health, volume 158 of Proceedings of Machine Learning Research, pp. 181-195. PMLR, 04 /ttp:cc://cocceeeeeeeeeee
Dec 2021.
mwr. www.pppesssseeec vttesss/118//// /tt.:////endol......m html
Murat Sensoy, Lance Kaplan, and Melih Kandemir. Evidential deep learning to quantify classification uncertainty, 2018. /tt.///tpss///aaa......////////. 01768
STMiccoelectromics. S7M32L432KC Datasheet: Ultra-low-power Arm Cortex-M4 32-bit MCU+FPU, 100 DMIPS, up 256 KB Flash, 64 KB SRAM, USB FS, analog, audio, 2018. URL https // h/www. www.sst.coomressuurcce httpa/urreeeeeetttttseeer/r//aa/ 08.
.pdf Accessed: 2025-08-
STMicroclectronies. STM32F767ZI Datasheet: ARM Cortex-M7 Microcontroller with 512 KB
Flash, 216 MHz CPU, ART Accelerator, FPU, and Chrom-ART Accelerator, 2019. | https // www. com http://.w.....eeeeee//////aaaa/a
påf Accessed: 2025-08-
08.
Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distributiin detection with rectified activations, 2021.
Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin, Csi: Novelty detection via contrastive
learning distributionally shifted instances, 2020.
76
Surat Teerapittayanon, Bradley McDanel, and H. T. Kung. Branchynet: Fast inference via early exiting from deep neural networks, 2017. URL http:/tttss//axxi..oo///////////
13

---

Published as a conference paper at ICLR 2026
Joost Van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using single deep deterministic neural network. Hal Daumé and Aarti Singh (eds.). Proceedings of the 37th International Conference Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 9690-9700. PMIR, 13-18 Jul 2020. URL http:tttts//ppoeeeeeee i ngg foort.00e.0 2ttmll
mlr. alr.press/ve 9/van-
Haoqi Wang. Zhizhong Li, Litong Feng. and Wayne Zhang. Vim: Out-of-distribution with virtual-logit matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), 2022. URL. _ut_oOttttffff -f cattiiionnnhthhhho Virtual--oooot Matching__oo CVPR 2022 paper. pdf
thecvf com/ content/
CVPR2022/pape Wang
Pete Warden, Speech commands: A dataset for limite--vocabllryy speech recognition, 2018. URL 804 03209
https::/arxiv..rrg/
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms, 2017. URL /tL.at/pe//aax....oooo//////////
Bianca Zadrozny and Charles Elkan. Transforming classifier scores into accurate multiclass prob-
ability estimates. In Proceedings of the Eighth ACM SIGKDD International Conference on
Knowledge Discovery and Data Mining, KDD '02, pp. 694-699, New York, NY, USA, 2002. Association for Computing Machinery, ISBN 158113567X. doi: 00.1145/775047.775555 URL /ttp////...1/07550111111 775151
Yundong Zhang, Naveen Suda, Liangzhen Lai, and Vikas Chandra. Hello edge: Keyword spotting on microcontrollers, 2018. URL //ar:::///xxvv wttp://wwwwr//a///11...11....
14

---

Published as a conference paper at ICLR 2026
APPENDIX
A DATASETS AND PREPROCESSING
For every dataset, we follow the official train/test split and create additional development split from the training portion for calibration, threshold selection, and any dev-tuned hyperparameters, ensuring that the test set is never used during model selection. Unless stated otherwise, reserve 10% of the training set as dev, using stratified sampling by class and keeping the split fixed across seeds make comparisons stable and to avoid accidental dev/test mixing. All reported test results use the untouched official test split, while any calibration (e.g., temperature or uncertainty mapping) fit only on the dev split.
A.1 VISION
MNIST contains 60k training and 10k test grayscale images 28x We keep the native spatial resolution (no interpolation), normalize inputs with ja 0.1307 and a = 0.3081, and apply light geometric augmentation to reduce sensitivity to small pose changes: random affine rotation within 110 and translation of up to 2 pixels. These augmentations are intentionally mild so the classifier remains aligned with the standard MNIST setting while still improving robustness small nuisance shifts. Unless otherwise specified, we use batch size of 256.
CIFAR-10 consists of 50k training and 10k test RGB images 32x32. We adopt the standard augmentation recipe used for small-image classification, including random crop after 4- 4-pixel reflection padding and random horizontal flipping with probability p = 0.5. We optionally apply Cutout with a 16x mask (disabled in Small-MCU ablations to keep preprocessing minimal and comparable across constrained deployments) and light color jitter with wrightnes/coonrrastsstuaatt of +0.2 to encourage invariance to illumination and mild color shifts. Inputs are normalized using per-channel means (0.4914, 0.4822, 0.4465) and standard deviations (0.2023, 0.1994, 0.2010).
ranges
Tet contains 200 classes with 100k training images (500 per class) and 10k validation set (50 per class), all at 64 64. We keep the native resolution and use a random resized crop to 64 x 64 with scale range [0.8, 1.0] to inject mild scale variability while preserving most content. We also apply horizontal flip with probability p = 0.5, color jitter (0.2/0.2/0.2), and random grayscale with color cues. Normalization uses ImageNet statistics (0.485, 0.456, 0.406) and a = (0.229, 0.224, 0.225).
probability p 0.1 to reduce over-reliance
A.2 AUDIO
For SpeechCommands v2 we use the standard 12-class keyword-spotting setup with classes {yes, no, up, down, left, right, on, off, stop, go, unknown, silence). Audio is mono at 16 kHz and we extract log-Mel features from I s clips using 25 ms analysis window, 10 ms hop, 512-point FFT, and 40 Mel bands. We apply per-utterance mean/variance normalization (MVN) to reduce sensitivity to channel gain and recording conditions. To avoid introducing artificial silence patterns when utterances shorter than 1 s, reflect-pad the waveform to 1 before feature extraction. Training- time augmentation includes random time shift within = 100 ms, background noise mixing (from the dataset's provided noise clips and, where noted, external noise subsets) with SNR uniformly sampled from [5, 20) dB, light time/frequency masking (Sgeenug with up to time masks of width 20 frames and 2 frequency masks of width 5 bins, and random gain within + dB to improve robustness to amplitude variation.
A.3 CORRUPTIONS (CID) AND OOD
For vision, we evaluate corruption-induced distribution shift using MNIST-C, CIFAR-10-C, and TinyImageNet-C. We include all available corruption types, excluding snow for MNIST-C (not defined), and evaluate severities (1....,5) 5) individually before averaging to obtain a single CID summary per corruption family. The corruptions span noise (Gaussian, shot, impulse), blur (defocus, glass, motion, zoom), weather (snow, frost. fog), and digital artifacts (contrast, brightness, pixelate, JPEG), providing broad stress test of both low-level and mid-level invariances.
15

---

Published as a conference paper at ICLR 2026
Algorithm 1 SNAP-UQ training (offline, label-free auxiliary)
Require: Backbone blocks fD. classifier head g, tap set S, projectors {Pt), predictor heads
{gr): weights Äss, Areg
1: for epochs do
2:
for minibatch B do
3:
Forward pass through the backbone to obtain activations C1.....a a and logits for classi-
fication
4:
for l E
5:
28 +- P:ac-1: (ue, oo) ge(ze)
6:
end for
7:
Lelf t cross-entropy over (x, B
8:
Cas |8] EzEB Ees 2 p4) of 1
loggoo
9: R + regularization terms (variance floor/scale control and weight decay on projector
and head parameters)
10:
Update backbone and head parameters by descending L - Lett + Ass + Areg? R. end for
12: end for
13: Fit a monotone calibration map offline (logistic with parameters (So, 31 32) or isotonic regres-
sion) to predict error probability from the surprisal score S and the optional confidence proxy
m
For SpeechCommands, we construct SpeechCmd-C as a of label-preserving degradations that reflect realistic acoustic variability. We apply room impulse responses with RT60 sampled in [0.2. 1.0] background noise mixing (from the dataset's noise clips and selected subsets of UrbanSound8K and ESC-50) with SNR in [0. 20] dB, and hand-limiting using Butterworth Now/high/band-pae filters with random cutoffs. We additionally apply pitch shifts within +2 semitones, time stretching by factors in [0.9, 1.1], and reverberation pre-delay in [0, 20] ms. These transformations are mapped to five severities by systematically increasing difficulty (e.g., lowering SNR and increasing perturbation magnitude) while keeping labels unchanged.
For OOD evaluation, we use standard cross-dataset transfers that preserve the input modality but differ in content distribution. For MNIST use SVHN; for SpecchCommands we use non-keyword speech and background noise segments; and for ImnyemageNett experiments, we treat the official validation set as ID and use a curated 200-class slice from ImageNet- Ik as OOD when computing IDV-001 OOD; all OOD images are resized 64x64 with bicubic interpolation and normalized identically to ID to ensure that differences reflect semantic shift rather than preprocessing mismatch.
Fashion-MNIST as OOD; for CIFAR-10
disjoint 200-class subset present in training. In TinylmageNet
A.4 REPRODUCIBILITY AND BOOKKEEPING
We run three random seeds [13, 17, 23} and generate all splits and corruption streams deterministi- cally per seed. Dev/test leakage prevented by performing any threshold selection, calibration, or operating-pon ppint tuning exclusively on the dev split (or dev streams), while the official test split is used only for final reporting. We store per-example metrics and uncertainty scores to enable nonparametric uncertainty estimates, reporting 1,000x bootstrap confidence intervals where appropriate.
B TRAINING, CALIBRATION, AND BUILD DETAILS
B.1 BACKBONES AND HEADS
For keyword spotting we use DSCNN with four depthwiis-separrable convolution blocks at constant width 64, each followed by BN+ReLU6, then global average pooling and linear classifier. The input feature map is x0x98 98 (Mel time) and the parameter budget is approximately 130k. We tap SNAP-UQ at the end block (mid-depth) and block 4 (penultimate) so that the surprisal captures both mid-level acoustic patterns and late class-specift structure. Projector ranks are chosen from
16

---

Published as a conference paper at ICLR 2026
Algorithm 2 SNAP-UQ inference (single pass, state-free)
Require: Frozen backbone fI.....fD with classifier head, tap set S, projectors (Pt), predictor
heads {ge). tap weights {we}. mapping parameters (3o, (1,,31,33 82), threshold r
1: Forward pass through the backbone to obtain activations a1...., ap and class posteriors po
z)
2: g f max, Pa = c c|
3: Cp(x) & max. Py c x)
4: mm + -p (z) - P6 (x)
D Pp 1 (x)
p (x) 2 ... are sorted class probabilities
5: m(x) aa(1 Ca(x)) + +(1 (1-a) a)
(x))
a [0, [0,1] is fixed from offline tuning
6: for lorLES do
7: zt t P:ac-1; (ug, o?) + ge((z)
E 8: Ee - de i=
dess
9: end for
10: S + Eies We Ee
U t a(6 318 82m(z))
o+)) is the logistic sigmoid
12: if 2 and budget controller allows then
ABSTAIN
14: else
Output ş
16: end if
re E {32, 64] to keep the extra compute small, and the heads are linear maps producing μi and log o from 22-
For CIFAR-IO we use a compact ResNet (ResNett&/ResNett -----e----t with three stages of widths 16/32/64, stride-2 downsampling at the first convolution in each stage, followed by GAP and linear classifier. The parameter count is roughly 0.3-0.5M depending on the exact variant. We tap at the end of stage 2 and at the penultimate stage that the transition model covers both intermediate spatial abstractions and late features near the classifier. Projector ranks are chosen from rz. E {64, 128) based on MCU budget.
For ImageNtt we use a small MobileNetV2 with width multiplier 0.5 and input 64 x64, using inverted residual blocks with expansion factor and strides [2.2,2] across spatial downsampling, followed by GAP and a linear classifier. The parameter count is approximately 1.3M. We tap at the end of a mid inverted-residunn block and the penultimate ressiuu-residual block, and choose ranks E {64, 128} for Small-MCU and ra {128, 160) for Big-MCU to trade off footprint and separability.
B.2 OPTIMIZATION AND SCHEDULES
On MNIST we train with Adam (betas 0.9/0.999) using learning rate 1e-3 with cosine decay to 1e-5 over 50 epochs, batch size 256, and weight decay 1e-4. We set Ass 5e-3 and warm up over the first 5 epochs to avoid destabilizing early classifier learning, and we use Areg = 1e-4. When noted, we optionally detach ag after epoch 10 if the dev NLL for the auxiliary heads stalls.
On CIFAR-10 we train with SGD (momentum 0.9, weight decay 5c-4) and cosine learning rate from 0.2 to 5e-4 over 200 epochs with batch size 128. use label smoothing 0. and enable MixUp with 0.2 Big-MCU only, disabling it for Small-MCU reproducibility runs. We set Ass = le-2 and linearly ramp it during the first 20 epochs, and apply global gradient clipping at L2 norm 1.0 to stabilize training under stronger augmentation.
On TinyImageNe we use SGD (momentum 0.9, weight decay 1e-4) with cosine learning rate from 0.15 to 1c-4 over 220 epochs and batch size 128. We set Àss 5e-3 with 20-epoch ramp to gradually introduce the transition modeling loss. When specified, we apply EMA of model weights with 0.999 for final evaluation reduce variance in the late training regime.
On Speech we train with Adam W (weight decay 1e-3) using learning rate 2e-3 with cosine decay 1e-5 over 80 epochs and batch size 256. SpecAugment is enabled described in
17

---

Published as a conference paper at ICLR 2026
Sec. A
We set Ags = 3 and keep detach disabled, this configuration is empirically stable for KWS with the chosen backbone.
B.3 SNAP-UQ-SPECIFIC SETTINGS
We parameterize log-va Dog-variance using o² softplus(g) + 2² with 10 and clamp log o² to [log 10-4, log 102] to avoid extreme dynamic range that can amplify quantization error or lead to vanishing standardized residuals. We regularize scale predictions with small coefficient vvar le-4 and apply head weight decay Owd 5e-4 to keep auxiliary heads compact and prevent overfitting of transition statistics.
To prevent wider taps from dominating the auxiliary objective, we normalize per-tap losses by 1 1/d and set tap weights wy inversely proportional the dev-set variance of ěg, then rescale so that Ee we = |S]. This weighting tends to down-weight taps whose standardized residuals are inherently noisy (e.g.. due to highly variable intermediate representations) while preserving contributions from more stable layers.
To improve int8 deployability, we optionally run short QAT phase during the final 20% of epochs by inserting fake quantization on P: and head weights using symmetric per-tensor int8 scales, while keeping the loss computation in float32 (Esser et al. 2020). We export int8 weights and 256-entry LUT for exp( _ log o²), following standard post-training quantization refinements (Nagel et al.
2020
Li al. 2021
B.4 CALIBRATION AND THRESHOLDS
For in-distribution calibration we fit temperature T on the ID dev split by minimizing NLL, then report ID calibration metrics (NLL/BS/ECE) using the temperature-scales logits (Kull et al. 2019).
This step is applied uniformly across boftmax-based methods to avoid attributing calibration gains to a particular uncertainty score.
For SNAP-UQ fit either three- prrempparemtte logistic map U = o + 8,5 32m) using class- balanced logistic regression, or isotonic regression on the scalar 3b = y + (1 7mm with y tuned on the dev split. Unless stated otherwise, the main Thresholds r are selected on the dev split to match target coverage (e.g.. 90%) or, in streaming experiments, to maximize Fl on event frames; the chosen threshold is then held fixed for all test evaluations.
the logistic map and we report isotonic
variants in Appx. |
B.5 BUILD AND MEASUREMENT ON MCUs
We compile with vendor GCC using -03 and link-time optimization, relying on CMSIS-NN kernels for int8 convolution and linear operations when available. For Big-MCU builds we optionally enable -ffast-math for the auxiliary heads only, verifying that numerical differences remain negligible (RMSE < 10-+) relative to the float reference in our checks.
Quantized export stores Pt. Wi,, and Wlog o² as int8 with per-tensor scaling, aligned with the backbone's s activation quantization scheme. The standardized residual uses LUT on clamped log g² values and accumulates in int32 before single dequantization to float16 (or fxed-point with shared scale) for final aggregation. This design keeps persistent memory minimal and avoids any temporal buffering beyond the activations already produced by the backbone.
Latency measured using the on-chip DWT cycle counter with interrupts masked, assuming the input is already in SRAM; the timed region spans from the first layer call through posterior computation and final U (z). Energy is measured for selected runs via shunt integration at 20 20z with temperature- compensated calibration, and report std over 1,000 inferences.
For reproducibility, we store dataset splits and corruption RNG seeds, per-epoch summaries of E[ey] and its variance, fitted mapping parameters (3u, 31 (22) (or the isotonic step function), MCU build flags and commit hash, per-layer operation counts and timings, and raw per-example scores used to compute bootstrap confidence intervals.
18

---

Published as a conference paper at ICLR 2026
C BASELINES AND TUNING DETAILS
All baselines are trained and evaluated under the same constraints as SNAP-UQ, sharing the same training data, backbones, input pipelines, and integer kernels. Unless otherwise noted, calibration and any threshold selection use the ID development split (10% of training) and are kept fixed across seeds. For streaming experiments, each method selects its threshold once on a dev stream and then holds it fixed for all test streams; for AUROC/AUPRC we report threshoid-free performance.
C.I SCORE DEFINITIONS AND MCU CONSIDERATIONS
Max-proban nix-probabilityy scoring (Conf) uses (1)) = max; Po = x). On-device, this adds no extra cost beyond the classifier because the softmax probabilities are already computed for classification, and it requires no additional persistent memory.
E x)) log po E| x). On-device, the additional cost is negligible relative to the backbone, and the log can be implemented via a small LUT or float16 without affecting the overall MCU budget.
Entropy scoring uses (=) - El=1 Po
Temperature scaling (Temp) computes calibrated probabilities ply | .) = softmax(2/77 with a scalar >> 0 fitted on the ID dev split by minimizing NLL. We apply this calibration uniformly to BASE/Con//Entropp when reporting ID calibration metrics, and on-device it reduces to dividing logits by T (typically in float16) without increasing model size.
Classwise Mahalanobis scoring (Maha) uses the same tap set S as SNAP-UQ, fitting class means {ur.c} and shared diagonal covariance Σn = diag(a?) on the ID training set (to avoid dev leakage).
The score is Smaha = min. Etes We _े (ae(x)) - me,e)) " (a<(z) - -He.e) Using a diagonal inverse avoids matrix-vector products and keeps runtime small, but memory grows with L. D, de because class means must be stored; this is feasible for MNIST/SpeechCCmmann borderline for Tiny letge,,,,,,, in which case we keep only the penultimate tap for both Mahalanobis and SNAP-UQ to maintain parity.
and can be
Energy- based scoring (EBM) uses logit energy (x) = = log Σe exp(ze/Teuu with Tong tuned on dev, where higher energy indicates greater uncertainty. On-device, we compute LSE in float16 using the standard max-shift trick; this adds small constant overhead and no persistent state.
Evidential posteriors (Evid) replace the softmax with nonnegative evidence e E R/. define a e 1. and use Elp] = a/ E, aj. The model is trained with Dirichlet-based objective (NLL plus regularizer that discourages high evidence errors). We report uncertainty via Szp(z) 1 max; E[p,] and the untal-uncertainty proxy Σ, aj head and ReLU) and can be out- out-of-memory on the smallest devices for CIFAR- CIFAR-10/TinylmageNet, when this happens we report it only where fits.
I_. This baseline adds parameters (an evidence
MC Dropout (MCD) enables dropout at inference and averages over N stochastic forward passes, with uncertainty computed as predictive entropy H p] mutual information H [p] [p.. We use
N E (5, 10} and the dropout rate from training. Because latency and energy scale roughly linearly with N. we restrict MCD to Big-MCU settings and omit it on Small-MCU.
Deep ensembles (DEEP) train M independently initialized replicas (M E 5)) and compute uncertainty as H 35 Em p(m)). This baseline typically yields strong uncertainty but multiplies either runtime (if evaluated on-device sequentially) or flash footprint (if multiple models are stored), deploy it only on Big-MCU and mark cases that exceed memory as out-of-memory.
C.2 HYPERPARAMETER GRIDS AND SELECTION
All scalar hyperparameters are tuned on the ID dev split (or a dev stream for streaming tasks) and then frozen. For temperature scaling we search 7 E [0.5, 0.75, 1.0, 1.25, 1.5, 2.0, 3.0) and select the value with lowest dev NLL. For energy scoring we tune Teng E {0.5, 1.0, 2.0) and select by best dev AUROC on IDv IDx. For Mahalanobis we sweep Stagonal-varianee shrinkage E {0, 10 9,10-3) 33 and, for two taps, weights We E {(1,0), (0, 1), (0.5, 0.5)), selecting by dev AUROC on IDV xDx, For evidential training we tune evidence scale 7) E (0.1, (0.1,0.5, 1.0) and
19

---

Published as a conference paper at ICLR 2026
regularizer Awii {10-<, 10-3, 10 20- choosing by combination of dev NLL and AUROC. For MCD (Big-MCU only) we tune N E {3, 10] and the score type (predictive entropy vs. mutual information), selecting by dev AUROC subject to device latency budget. For ensembles (Big-MCU only) we select M ε {3, 5 by dev AUROC under a flash cap; if the model is out-of-memory, we omit the runtime results and report the limitation explicitly.
C.3 THRESHOLDDING AND OPERATING POINTS
In streaming accuracy-drop detection, each method outputs scalar score (14)) that increases with uncertainty. On a dev stream that transitions ID ID-CCID-OOO, we select a single threshold T* to maximize Fl for event frames, where events are labeled from sliding-window accuracy dips (Appx. E We then freeze r" and report AUPRC and median detection delay on test streams.
For selective prediction, we scan thresholds the dev split (ID dev CID dev when evaluating corrupted selective risk) to reach target coverage levels in (50, .......99... and report the error rate among accepted samples. For methods that yield calibrated probabilities (Temp, Evid), we additionally report selective NLL on accepted samples to quantify confidence quality under abstention.
For failure detection tasks (IDV IDx and ID - OOD), we report AUROC/AUPRC without selecting a single threshold. When we visualize confusion matrices, we also include dev-tuned operating point (Youden's J) for completeness (Appx.
C.4 FAIRNESS CONTROLS AND IMPLEMENTATION PARITY
To avoid confounds, all methods use identical backbones, preprocessing, augmentation, and quantiza- tion settings. Under strict Small-MCU constraints restrict comparisons to single-pass methods and exclude multi-pass baselines such as MCD and ensembles due to their linear scaling in latency and energy. Temperature scaling is applied uniformly to softmax-baset basclines for ID calibration, while energy and evidential methods use their own calibrated parameters. Mahalanobis uses the same tap set S SNAP-UQ. and when memory is tight both methods evaluated with the same reduced tap configuration (typically the penultimate tap only). All inference runs use the same int8 CMSIS-NN backends, and any 6 LUTT-based components (log, exp, LSE) reuse the same shared implementations.
C.5 MEMORY AND LATENCY ACCOUNTING ON MCUS
We attribute incremental cost beyond the baseline backbone. Conf/Entropy/Temp add negligible flash and typically under 0.1 ms latency for L S 200. Energy adds LSE kernel (float16) and remains under roughly 0.2 ms for L < 200 with no persistent state. Mahalanobis requires storing class means and diagonal variances, with flash scaling as E, Ldg for means plus de for variances; for CIFAR- 10 with two taps of size de s 256 and L = 10, this is approximately 2 x 10 x 256 bytes = 5 KB for int8 means (plus scales), with latency typically below ms. Evidential adds an evidence head of size dp x T. plus ReLU, often under 10 KB flash on KWS/CIFAR-II 10 and under 1 ms latency, but it can be mumoo-- on Small-MCU for larger-class settings. MCD and ensembles scale linearly in the number of passes (N M), increasing both latency and energy proportionally; ensembles also scale flash with if models are stored locally.
C.6 REPRODUCIBILITY
We release the hyperparameter grids and selected values per seed, dev-set thresholds 7* for thresh- olded tasks, fitted feature statistics for Mahalanobis (including int8 means and scales), evidence-head checkpoints when applicable, and MCU build flags with per-layer timing. When a method is out-of-memory report the largest variant that fits and clearly state the shortfall.
C.7 LIMITATIONS OF BASELINES UNDER TINYML CONSTRAINTS
Seftmax-shappee baselines such as entropy and temperature scaling can remain overconfident under CID because they do not observe internal feature dynamics. Mahalanobis with diagonal covariance is memory-light and fast but ignores cross-channel structure and can underperform under shifts that
20

---

Published as a conference paper at ICLR 2026
affect feature correlations. Energy-based scoring depends logit scale (partially mitigated by tuning Tong). Evidential methods add parameters and can be sensitive to regularization and optimization, especially under quantization. Multi-per pass baselines (MCD/ensembles) typically provide stronger uncertainty estimates but are often incompatible with strict single-pass, flash, and energy budgets on Small-MCU deployments.
D CID/OOD PROTOCOLS AND STREAMING SETUP
We use the same corruption sources, OOD sets, and a single ttream-constructt protocol for every method that comparisons reflect scoring quality rather than differences in data exposure or tuning. In particular, each method chooses its operating threshold exactly once on a development stream and then keeps that threshold fixed when reporting detection delay and other operating-poiie metrics held-out evaluation streams. This design prevents "threshold chasing" on test streams and mirrors the intended deployment setting, where labels are unavailable online and operating points must be set offline.
D.1 CORRUPTION SOURCES (CID)
For image classification, we use MNIST-C, CIFAR-1O-C, and TinylmageNet-C (Mu & Gilmer 2019; Hendrryks Dietterich] 2019). Each benchmark provides 15 corruption types at five discrete severities, where severity I corresponds to light perturbation and severity 5 corresponds to strong perturbation. For TinyImage ImageNet-C, if a model uses a different input size we resize the corrupted images to the model input resolution while preserving the benchmark's 's severity labels so that "severity" remains comparable across methods. Metrics for corrupted data are always computed by evaluating severities 1-5 separately and then aggregating, which avoids hiding failure modes that emerge only at higher severities.
For audio, construct SpeechCommands using label-preserving degradations that reflect common nuisance factors in far-field and noisy recordings. We generate reverberation by convolving wave- forms with randomly sampled room impulse responses, with reverberation time 1T7oo sampled from [0.2, 0.8) We generate additive noise conditions by mixing each clip with background noise at an SNR sampled uniformly from [0, 20] dB, drawing noise from the dataset's _background.nolt directory as well as a small pool of external ambient recordings. We apply rate and pitch per- turbations via time stretching with factor in [0.90, 1.10) and pitch shifting in {-2, -1, -1,0, +1, +2] semitones using standard phase-vocoder processing. We additionally apply mild spectral shaping and compression through second-order bandpass filter (300-3400 Hz) and light dynamic-range compression with a soft knee. Severity levels 1-5 are implemented by jointly increasing distortion magnitude (e.g., decreasing SNR and increasing RT60 and perturbation ranges) while preserving the label by construction. All exact severity ranges and random seeds released to ensure that SpeechCommands- streams are reproducible.
D.2 OUT-OF-DISTRIBUTION (OOD) SETS
For OOD evaluation we choose standard cross-dataset transfers that preserve modality and basic input format but shift the semantic distribution. For MNIST, et al., 2017). For CIFAR-10, 100 we use the SVHN test split (Netzer et al. 201T). For SpeechCommands, we treat non-keyword utterances and background noise segments as OOD inputs. For Imagen,,eet, we use set of classes that is disjoint from the training label set; specifically, we construct held-out 100-class subset with no class overlap so that OOD inputs differ the label-space level rather than merely through perturbations of the same classes.
the Fashion-MNIST test split (Xiao)
D.3 STREAMING CONSTRUCTION
We construct long, unlabeled streams that interleave stable ID segments, progressively harder CID segments, and short OOD bursts. This structure is intended to stress-test monitors in a setting closer to deployment, where distribution shift occurs over time and the system must respond online using only the model outputs and uncertainty scores. Unless noted otherwise, an ID segment contains 2,000 frames, each CID severity segment contains 1,000 frames, and each OOD burst contains 100 frames
21

---

8: end for Published as a conference paper at ICLR 2026
inserted between CID severities. The stream order is ID +CID(s=5), producing a monotone increase in corruption strength punctuated by abrupt semantic shifts.. Within each CID severity segment, we cycle corruption types every 200 frames that performance and detection are not dominated by a single corruption family and so that the stream contains mixture of perturbation mechanisms any fixed severity. Each dataset uses fixed seed to generate streams, and we report results over three independent stream seeds to obtain mean and confidence intervals. Development and evaluation streams are built from disjoint underlying data indices so that no example appearing in the dev stream can reappear in a test stream.
D.4 EVENT LABELING (OFFLINE, NEVER SEEN ONLINE)
To evaluate event detection while keeping the online protocol label-free, we construct event labels on an offline labeled copy of each stream. We first estimate an ID performance band by running the model on a separate long ID-only sequence and computing sliding-window window accuracy with window size m = 100 frames, yielding an empirical baseline mean μmD and standard deviation om. On each labeled stream, we then compute sliding-windor accuracy with the same window size and declare an event active whenever the windowed accuracy drops below jiD 301D The onset of an event is the first frame at which the window crosses below this threshold, and the offset is the first frame after recovery above the band. To reduce label noise and avoid counting transient fluctuations separate events, we merge adjacent events separated by fewer than m. frames and discard events shorter than m frames. These labels are used only for scoring; the device-side online monitor never receives them.
D.5 THRESHOLD SELECTION AND SCORING
To measure detection delay single operating point, each method selects threshold 7* on the development stream by maximizing frame-wise Fl on event frames, and then freezes this threshold for all delay measurements on evaluation streams. A detection is defined as the first threshold crossing that occurs while an event is active, and detection delay is measured as the number of frames between event onset and the first such crossing. Additional threshold crossings during the same event are ignored so that delay reflects time-to-first-leet rather than repeated alarms. In parallel, we report threshold-free metries by computing AUPRC over all thresholds, treating event frames as positives and non-event frames negatives; this summarizes ranking quality without committing to a particular operating point. To characterize false alarms under clean conditions, we also measure false positive behavior on ID segments, reporting false positive rate at matched recall (c.g., 90%) by interpolating the precision-ree recall curve and applying the corresponding recall-matched threshold. Confidence intervals are computed with nonparametric bootstrap using 1,000 resamples, resampling frames for AUPRC and resampling events for delay, and we report median delay with the 2.5/97.5th //t percentiles as 95% CI.
D.6 STREAM BUILDER
Algorithm 3 BuildStream (Dio, DEID DOOD, m, seed)
Set RNG with seed; initialize empty list stream
2: Append ID segment of length 2000 sampled from DID
3: for 6- 1 to 5 do
4: Append CID segment of length 1000 at severity (cycle corruption types every 200 frames)
5: if' < 5 then
6: Append OOD burst of length 100 from DOOD
7: end
9: Return stream
On-device playback either preloads the stream into flash or streams it from host over UART, and timestamps are recorded using the on-chip cycle counter. We mask interrupts during model invocation to stabilize latency and re-enable them during I/O to avoid distorting timing measurements. No labels, event markers, or wreeshod-selectiin signals are transmitted to the device during playback, keeping the on-device protocol strictly label-free and consistent with deployment constraints.
22

---

Published as a conference paper at ICLR 2026
E EVENT-DETECTION SCORING: AUPRC AND DELAY
We evaluate streaming event detection using two complementary measures that capture different aspects of monitor quality. AUPRC provides a threshold-free summary of how well the score ranks event non-event frames across the full operating range, while thresholded detection delay measures time-to-alert at a single operating point chosen on a development stream and held fixed on evaluation streams. In all cases, methods operate online without labels; scoring is performed offline labeled copy of the same streams.
E.1 NOTATION
Consider stream with frames t 1...., and binary event labels 3/+ E {0, 1} defined by the accuracy-dryy rule in Sec. D. method outputs a scalar score & E [0, 1] at each frame, where larger values indicate higher likelihood that the stream is currently in event. Let & {(t2 k ) ) denote the set of disjoint event intervals, that Yr 1 for t [tg goff].
E.2 AUPRC (FRAME-BASED) THRESHOLD-FREES
To compute frame-based precision-recall curves, we sweep thresholds over the unique scores observed in the stream, θ = { ,,',, T', and form binary predictions (T) 1[se 2 7]. For each threshold we count true positives, false positives, and false negatives over frames, then compute precision and recall from these counts. We integrate the resulting pecision-recall curve using stepwise-in-reett integration (consistent with common toolkits) so that AUPRC reflects the best attainable precision each recall level under thresholding. Because frame-based scoring can be dominated by long events, we also report an event-weighted AUPRC variant in Appx F where each event is assigned equal total weight and the background is weighted match, implemented by per-frame weights that sum to one within each region.
E.3 THRESHOLD SELECTION ON THE DEVELOPMENT STREAM
For each method, select single threshold 7" development stream by maximizing the frame-wise Fl score computed over the development stream's 's frames. The search is performed over the unique development scores ensure that r* corresponds an attainable operating point for that method. This threshold is then frozen and used only for delay computation on held-out test streams, ensuring that delay metries reflect generalization of the chosen operating point rather than re-tuning on the evaluation data. We also record the recall achieved by r* on the dev stream so that false-positive accounting on clean ID segments can be reported at matched recall.
E.4 THRESHOLDED DETECTION DELAY (TEST ONLY)
Given the frozen threshold r*, we define a detection for event & as the first frame within the event interval at which the score crosses threshold, f min(f [yon zoff] 8, 2 r*), if such a crossing exists. The detection delay is then fx t measured frames. If no crossing occurs before the event ends, the event is counted as missed and contributes a NaN delay; we report both the median delay over detected events and the miss rate (fraction missed events). Crossings that occur before event onset do not count toward delay (they treated false positives elsewhere), and multiple crossings during the same event are collapsed to the first so that delay measures time-to-fin to--tooffist-leetttt stream ends while an event is active and no crossing has occurred, treat the event missed; sensitivity to this censoring choice is analyzed in Appx F We compute 95% confidence intervals for delay by bootstrapping events (1,000 resamples) and reporting the 2.5/97.5th percentiles.
E.5 FALSE POSITIVES ON CLEAN SEGMENTS
To quantify false alarms during stable ID periods, we evaluate false positive rate on ID-only segments matched recall determined from the development stream. Concretely, we identify the threshold that achieves the target recall on the development PR curve (c.g.. 90%), apply that threshold to the test streams, and compute the fraction of non-event frames in ID segments that are flagged as events. This
23

---

Published as a conference paper at ICLR 2026
evaluation isolates spurious triggering during clean operation while keeping the operating sensitivity comparable across methods.
E.6 COMPLEXITY AND NUMERICAL DETAILS
Computing AUPRC requires sorting the 7 scores once, which costs O(T log T) time and ( memory, while delay computation at the single fixed threshold r* is single linear scan with (T)) time and constant additional memory. To stabilize behavior under tied scores, we use a stable sort and break ties in manner that favors higher recall first, which yields right-continuous step functions for PR curves and prevents numerical artifacts AUPRC when many frames share identical quantized scores.
E.7 PSEUDOCODE
Algorithm 4 Delay {(tg") f** )==)) {811=11
1: Initialize empty list delays
2: for k == to K do
3: + first [ ff with 8, 7*
4: if exists then
5: append (t - )
to delays
6: else
append NaN to delays 8: end
7:
9: end for
10:
return median(delays days without NaN), miss fraction of NaN
F METRICS AND STATISTICAL PROCEDURES
This appendix defines all metrics reported in the paper and specifies the aggregation and uncertainty- estimation procedures used produce confidence intervals. Unless stated otherwise, compute metrics by that larger values correspond higher likelihood of the positive condition (error, OOD, or event), which simplifies comparisons across methods and prevents sign mistakes when computing ROC/PR curves.
over examples within each dataset or split, and we orient every score so
F.1 NOTATION AND SHARED CONVENTIONS
Let dataset (or stream) contain examples indexed by 1,..., The model outputs a probability vector p; E A L-11, predicted label 0: arg max Pi,t. and an uncertainty score u; E [0, 1] for SNAP-UQ uncertainty after applying any required sign flips. We define correctness indicator e; [[[ yi]. In OOD experiments we also have an indicator o; {0, with o, for OOD samples. For streaming event detection operate the frame level with t 1, ..... T and use the event-label definitions from Sec. D the remaining definitions in this section focus on non-streanee non-streaming evaluation unless explicitly stated.
baseline score s; IR for other methods, where larger values indicate greater
F.2
FAILURE DETECTION: ROC/AUROC AND PR/AUPRC
For IDV -D/-IDD IDx, positives incorrect ID or CID predictions (c: 0) and negatives correct ID or CID predictions (c; = 1). For IDV OOD, positives are OOD examples (o, 1) and negatives correct ID examples (o; = 0 and G; 1), excluding incorrect ID examples that the task isolates semantic shift from inherently hard ID inputs. In both settings we rank examples by the uncertainty score and evaluate performance sweeping threshold.
For ROC evaluation, for any threshold 7 we form predictions (T) = I[score; 2 -], where score, is uy for SNAP-UQ the appropriately oriented baseline score. We compute TPR(7) the fraction
24

---

Published as a conference paper at ICLR 2026
of positives predicted positive and FPR(T) as the fraction of negatives predicted positive, then compute AUROC by trapezoidal integration over the ROC curve obtained by sweeping thresholds in descending score order. Ties are handled by stable sorting and the standard averaging conventions used in widely adopted libraries so that AUROC deterministic under quantized scores.
For PR evaluation, precision and recall at threshold are computed from TP(r), FP(r). and (T with a small = 10-12 in denominators to avoid division by zero. We compute AUPRC using stepwise integration recall, using the standard non-increasing precision envelope that the reported area corresponds to the best achievable precision at each recall. This definition yields curves and areas consistent with common implementations and is stable under tied scores.
For corrupted benchmarks such as CIFAR-IO-C and TinylmageNet-C. we compute each metric separately for every corruption type and severity, then report the mean over types and severities. When plotting severity curves, we average over corruption types at each fixed severity, which makes severity trends interpretable without conflating them with the mix of corruption families.
F.3 SELECTIVE PREDICTION: RISK-COVERAGE AND SELECTIVE NLL
Selective prediction uses an acceptance rule (.(r) = 1/uu < T]. where lower uncertainty implies acceptance. For each threshold coverage is Cov(T) 1 E, Ai(T) and risk is the error rate among accepted samples, computed as the fraction of accepted examples with i + yı (again using an e the denominator for stability). Risk-coverage curves are obtained by sweeping т. and when report single operating point (e.g., 90% coverage) we choose the threshold that achieves the closest coverage from above to avoid artificially inflating coverage. When method provides calibrated probabilities, we also compute selective NLL on the accepted subset by averaging - log Pt.y; over accepted samples, which evaluates probabilistic quality conditioned on acceptance rather than unconditional calibration.
F.4 ID CALIBRATION METRICS
Calibration computed on held-out ID splits using posteriors pt, optionally after temperature scaling. We compute NLL by averaging - log Pi.gs across examples. We compute the multi-class Brier score by averaging 1 lp; cy. 11 where ey, is the one-hot target. We compute ECE by binning confidences 9: max Pt.e into B 15 adaptive bins of approximately equal mass, then summing the absolute gap between empirical accuracy and mean confidence in each bin weighted by bin frequency. Reliability diagrams plot bin accuracy against bin confidence with widths proportional to bin mass. When evaluating calibration NLL/BS/ECE on the subset rather than reusing unconditional bins, which prevents acceptance from distorting bin occupancy.
accepted subset at fixed coverage, we recompute
F.5 CONFIDENCE INTERVALS AND PAIRED COMPARISONS
For each dataset and seed, form 95% confidence intervals using nonparametric bootstrap with 1,000 resamples. For scalar metrics such as AUROC/AUPRC, NLL, BS, ECE, and selective metrics, we resample examples with replacement. For severity curves, we bootstrap within each severity and then average across corruption types to obtain a curve-level CI. For streaming event detection we use the procedures in Sec. E bootstrapping frames for AUPRC and bootstrapping events for delay. We report point estimates as the mean over seeds, and we compute bootstrap CIs per seed and then average those intervals across seeds to avoid overly narrow intervals that can arise from pooling examples across seeds. When comparing two methods, we use paired bootstrap on the difference by resampling the same indices for both methods, yielding CI directly on the performance gap.
F.6 IMPLEMENTATION DETAILS AND NUMERICS
All scores are oriented so that higher values correspond to the positive label for the task; if baseline yields confidence-like quantity, negate invert it before evaluation. We handle tied scores using stable sorting and right-continuous step functions for PR curves, which important when scores quantized or when many frames share identical values. We use 10- to avoid division by zero; this does not change reported values at the displayed precision. For delay reporting, delays measured in frames, and when converting to milliseconds for MCU plots multiply by the
25

---

Published as a conference paper at ICLR 2026
measured per-inference latency the same board and backbone, ensuring that time units reflect actual device behavior.
F.7 EVENT-WEIGHTED PR
Because long events can dominate frame-based PR, we also report event-weighted AUPRC when indicated, Let & denote the set of events and let B denote background frames. We assign each event total weight 1/ 1/|E| distributed uniformly across its frames, and assign the background total weight 1/|8| distributed uniformly across background frames, then renormalize weights sum to one. We then compute weighted (T))). FP(T), and FN(r) and proceed with same PR integration as in the frame-based case. This variant evaluates whether method consistently detects events rather than merely performing well on a small number of long segments.
F.8 DATASET-LEVEL AGGREGATION
When reporting a single number averaged over multiple datasets, we macro-average dataset metrics by taking the simple mean of per-dataset scores rather than pooling all examples, which prevents large datasets long streams from dominating. For CIFAR-IO-C and TinylmageNet-C, we macro- macro-average across corruption types and severities described above, every corruption family contributes equally to the final summary.
F,9 CALIBRATION UNDER SHIFT (CID/OOD)
Beyond in-distribution calibration, we also evaluate calibration under shift using corrupted (CID) and OOD data. Following the standard CIFAR-IO-C protocol, we compute calibration error on corrupted inputs (ECE-OOD), negative log- likelihood on corrupted inputs (NLL-OOD), and selective risk at fixed coverage. We compare three settings that differ only in what data are used to fit the calibrator: temperature scaling fit on ID dev only; a monotone logistic SNAP-UQ mapping fit on ID dev only; and monotone isotonic SNAP-UQ mapping fit small development mixture of ID and corrupted samples. The key constraint is that all calibrations remain offline and require no online labels, and the monotonicity of logistic isotonic mappings preserves the ordering induced by the underlying score, so improvements reflect better probability calibration rather than arbitrary re-ranking.
Table 5: Calibration under CIFAR-10-C (avg severities 1-5). Lower is better. Selective risk is error rate among the retained set at fixed coverage.
Method
ECE-OOD
NLL-OOD
Risk@90% |
Risk @95% J
Temp. scaled (ID)
0.124
1.42
0.124
0.112
SNAP-UQ (logistic, ID)
0.108
1.31
0.109
0.098
SNAP-UQ (isotonic, ID+CID-dev)
0.096
1.27
0.104
0.096
Two practical observations align with the desth-wise surprisal interpretation. First, because S(x) behaves like conditional negative log-likelihood up affine transform, it remains informative under many corruptions that change feature dynamics rather than only logit scale; fitting a monotone calibrator therefore improves decision-centric metrics while preserving the ranking induced by the score. Second, including a small ID+CID development mix when fitting a monotone calibrator reduces overconfidence on corrupted inputs without requiring any online access OOD labels, making it compatible with the same deployment constraints as the rest of the system.
G TRAINING OBJECTIVE AND REGULARIZATION: EXTENDED DETAILS
This appendix expands Sec. 2.2 by restating the auxiliary objective in its layer-weighted, dimension- normalized form, providing stable derivative expressions under positive-varianee variaace parameterization, and discussing common failure modes and practical stabilization strategies. Throughout, the goal is to preserve the tiny-head and MCU-friendly constraints while ensuring that optimization remains stable across architectures and datasets.
26

---

Published as a conference paper at ICLR 2026
G.1 OBJECTIVE, LAYER WEIGHTING, AND NORMALIZATION
For each tapped layer & E S, we model the next activation with diagonal Gaussian and define per-layer negative log-likel rggliiklihood. Writing dg E TR for the realized activation and (Me, for the predicted mean and variance, the diagonal-Gaussen Gaussian NLL for sample z is Lz(z) = (Il(az
(re ④ 0 1|3 1 log af). To prevent wide taps from dominating purely due dimensionality, normalize by de to obtain (x(x)) fe(x)/dz and aggregate across taps with nonnegative weights we that sum to (S), giving Lss 1 EBEB Etes we (z).. In practice, uniform weights = 1 work
reliably, while variaace weighting We x 1 1/Varlee] (estimated on dev) improve stability by down-weighting taps whose standardized residuals are intrinsically noisy. The full training objective combines classification, auxiliary surprisal learning, and regularization as L. Lett + Ass Las Areg R. where Ass controls the strength of transition modeling and R. enforces well-behaved scales and small head weights.
G.2 STABLE PARAMETERIZATION AND EXACT GRADIENTS
To keep gradients stable and to ensure strictly positive variances, we parameterize each per-channel variance using softplus with floor, setting of, softplus(fe.)) + e² with e E [10-4,10 10100%3 3]. Writing Se, = log o.. is convenient for analysis and for quantized inference, but optimizing &e.; avoids numerical issues that can occur if sg,; is driven toward large negative values. For a single channel i, the NLL contribution can be written l,, 1 ((ac.; 142,))2e-5 + se,)). giving closed-form derivatives with respect to fe, and sy, that are simple and efficient to implement. Under the softplus parameterization, the derivative with respect to εe., additionally includes the factor sigmoid((e..). which naturally damps gradients when É is very negative and therefore reduces the risk of instability from near-zero variance predictions. Because our heads are linear, backpropagation to head weights and projectors is also straightforward: gradients flow through (Mr, &v) = (et)) and ze = Pzaę-1 1 using standard matrix products, and the computational overhead is dominated by the same low-rank projections already used at inference.
G.3 FAILURE MODES AND STABILIZATION
common failure mode is variance collapse, where the head overfits and drives o² toward zero on the training set. This makes the standardized residual explode and can destabilize both the auxiliary heads and the shared representation when gradients propagate into the backbone. The variance floor e? prevents true collapse, and clamping s; = log of to a fixed interval further bounds dynamic range so that standardized residuals cannot become arbitrarily large due to scale alone. The opposite failure mode is overdispersion, where the head inflates o² to reduce the quadratic penalty, effectively washing out residual information. The Σ log o² term in the NLL counters this tendency, and an additional light penalty on log o discourages drifting to extreme scales that can be fragile under quantization. third issue is gradient -ug-of-war between Lei and Las on tiny backbones, where the auxiliary objective may temporarily push intermediate activations in direction that harms classification. Two practical mitigations work well: detaching ag inside Lss so that the heads learn to predict the existing backbone dynamics without altering them, and ramping Àss from small initial value so that classification learns a stable representation before the transition model is emphasized.
G.4 CHOOSING Ass AND Areg.
simple and robust approach to sweep Àss E (10-3,5 5 10-3, 10-3,10-2) 10-2) and select the value that maximizes dev AUPRC on CID streams, since this directly targets the intended monitoring behavior. Regularization strength can be set so that the regularizer contributes only a small fraction of total loss early in training (roughly 1-5% is useful guideline), which prevents regularization from dominating optimization while still keeping scales and weights well-conditioned. When more control is needed, an adaptive strategy balance gradient magnitudes by monitoring the ratio with an exponential moving average and adjusting Ass to keep P in a target band (c.g., 0.05-0.2). This stabilizes training across datasets without requiring per-dataset manual tuning.
|/ Lss |l/ L
27

---

Published as a conference paper at ICLR 2026
G.5 ROBUST VARIANTS AND THEIR GRADIENTS
When corruptions induce heavy-tailed deviations, replacing the quadratic penalty with robust alternative can improve stability and preserve ranking quality under rare but large residuals. diagonal Student-/ likelihood introduces heavier tails controlled by degrees of freedom ve, down- weighting extreme residuals automatically and reducing sensitivity to outliers without changing the interface of the heads. A Huberized loss similarly limits the influence of large standardized residuals by transitioning from quadratic to linear growth beyond a threshold 6, while keeping the same per-channel scale term. Both alternatives retain simple, elementwise computations that remain compatible with tiny heads and with the same quantized inference path, and they can be evaluated as drop-in ablations without modifying the streaming protocol.
G.6 SCHEDULES, CLIPPING, AND QAT
Across datasets, cosine learning-rate schedules with a short warm-up are effective, and ramping Ass the first 10% of training avoids destabilizing early representation learning. Global gradient clipping at norm 1.0 provides a simple safeguard, and clipping the variance pre-activations & to bounded interval (e.g., =) can further reduce rare spikes from extreme scale updates. For MCU deployment, inserting fake quantization on projectors and head weights in the final portion of training reduces mismatch between float training and int8 inference, and quantizing log o² to 8-bit with shared scale per head improves LUT stability while keeping the mapping monotone.
G.7 IMPLEMENTATION NOTES
Algorithm Stable SNAP-UQ step (training)
Require: batch B, taps S, projectors Pt, heads gr, weights wr, Ass, Arog Forward backbone - {ae]. ) logits + Pe
2: Lelr +- cross-entropy
3: for E S do
4: Zg < Pras-1; Ec) + ge(ze)
5:
of t softplus(Ee) + c²: 81 + log o?
6:
let I (I1(ae me) @ oF -1 1/3 2d
7: end for
8: Lss [8 EmEB Ereswir wolk
9: R + Ovar Σe ||se|1 + arwd 11
10: if detach: treat as constants for Las end if
11: L + Lolt + Ass + RregR R
Backprop: apply gradient clipping: optimizer step
13: (Optional) Update Ass by gradient-now norm balancing (Sec. G.4
In practice, two lightweight diagnostics help detect instability early. First, monitoring E[ey] on clean ID validation split provides a sanity check: values far above 1 typically indicate underfit heads or overly small predicted scales, while values far below can indicate overdispersion. Second, measuring the correlation between é, and menfidence-derived proxy such as Co should yield a positive but not near-perfect correlation, suggesting that surprisal provides complementary information rather than merely re-encoding softmax confidence.
G.8 FROM TRAINING TO DEPLOYMENT
After training, we retain the projectors P: and the heads that produce μe and log of. quantize their weights to int8, and export the associated scales and zero-points. We also export compact LUT to approximate exp(-5 log o²) on clamped log-variance values so that standardized residuals can be computed without expensive transcendental operations. Finally, we fit a monotone mapping (logistic or isotonic) offline small development set that can include representative shifts, and store the mapping parameters or a small lookup representation. At inference, the device computes standardized residuals the tapped layers, aggregates them into scalar score, applies the stored
28

---

Published as a conference paper at ICLR 2026
monotone mapping, and thresholds the result, without requiring any online labels or additional state beyond the single forward pass.
H PROOFS AND ADDITIONAL DERIVATIONS
This appendix provides detailed proofs for the propositions stated in Sec. 2 and includes auxiliary derivations that are used implicitly in the main text.
H.1 NOTATION
Fix tapped layer e E S with activation dimension de The backbone produces dg-1 and dg, the projector produces 2ạ = Pray-1. and the predictor outputs (Me, log oî) = ge(ze). We write the diagonal covariance as Eg diag(o}) (r)) and the residual V2 ag Mgg The standardized error used
(or,)-pe.) and its coanension-normalizee version is of (z)) ce(2)/de /dz. The aggregated depth- wise score is S(x) Etes wt (z(2)) with weights wy 0
by SNAP-UQ is (x) = 11 ① or >
and Σe We 1.
H.2 PROOF OF PROPOSITION 2.1 (SURPRISAL-LIKELIII
EQUIVALENCE)
Assume the diagonal- Gaussiin conditional model at tap f, namely po(ar at-1) N(ug Me) with Σe diag(o?). By the multivariate Gaussian density, pa(ar ag-1) (2T) de/2 det(Ee)-1/2 1/2 exp( 2 (at pe) E (ar pe)). Taking the negative logarithm yields - Moggo((ae (4-1)) = 1/2 (a pe) Σg (ar pe) + 1 log det Eg + d, log(2x).
2
2
We now relate each term to the SNAP quantities. Because E3 is diagonal, Di1 = diag(o, and the quadratic form expands as (ar me) 2; (az - pc) = Eee (aews-me,d) es(x). Similarly,
of
log det Eg = Eie log o..5. Substituting these identities gives the exact decomposition - log po ar-1) = (ex + Σ log oř,, + de log(2.t)
Dividing by de isolates the dimension-normalee normalized form: - lo aa-1)) = Ex(x) + 1 d, Ede log o7,, + log(2r). Therefore, up to the additive constant log(2T)) and the per-layer scale term 2/ E, log oÊ the normalized negative log-likelihood is affine transform of (1)) Aggregating across taps with weights wy gives Eres Wi de log ac-1)) = S(x) +
2
Eies We गे Σie log o²,, + log(2r). This shows that S(x) is (up to affine terms) the depth-wise negative log-likelihood, and thus higher S(x) corresponds to lower conditional likelihood of the observed activations.
H.3 PROOF OF PROPOSITION 2.2 (RELATION TO MAHALANOBIS)
Assume the linearGGaussian depth-wise evolution model ag Wpag-1 + + with eg ~N Eg). Conditioned on aę-1, the distribution of a is Gaussian with conditional mean μ4 = WWaa- + by and covariance Dg. The SNAP residual vy ag - pez, and the standardized error (in matrix form) is ce(x) Ug Σg vg. By definition, the squared Mahalanobis distance between point u and mean m under covariance Σ is MDs(u, m)² = (u m) T (u (u- Taking u = and m = Wear + by yields (z) Mae, Weae-1 be)2 2 which precisely the squared Mahalanobis distance to the conditional mean.
To contrast with classwise Mahalanobis, recall that classwise approaches typically fit an unconditional Gaussian per class at fixed layer, approximating p(at c) Rs N Ex) (often with shared covariance). The resulting score mina(ar : Σn (ar ja,e) measures proximity to class centroids feature space and does not condition on a4-1- Unless the sumple-specife conditional mean WeRt-1 + be coincides with some class centroid fi,,c (which would require extremely low within-class variation at the previous layer), the unconditional score conflates within-class variability and dynamics-induced shift. In contrast, SNAP-UQ compares at to what the network's 's own dynamics
29

---

Published as a conference paper at ICLR 2026
predict from dg-1, shifts that perturb inter-layer transformations directly increase 2/ Eg U2 dg remains near a centroid.
H.4 PROOF OF PROPOSITION 2.3 (AFFINE INVARIANCE FOR BN-LIKE RESCALING)
Consider a per-channel affine transformation of the tapped activation of the form de + as + t. where s Ed has strictly positive entries and E I an offset. Suppose the predictor co-adapts so that its outputs transform consistently, namely μú = C f + f and of = @ de (if s can be negative, replace s by |s] in the scale transformation). The standardized residual under the transformed
variables is (a. - (1)) @ (o')=1_ Substituting the transformation rules gives (a'- 14)) + (o))===
(8 @ + Ø pM 1) @ 0o,) (s C (uz me)) @ (s- 0 (az (a) ①
Taking squared lg norms yields (z(2) = ee(z), and therefore (x) = (((x) and ('))) = S(x)
under the same aggregation weights. This establishes invariance of the standardized error to BN-like
per-channel affine transformations when the predictor outputs co- co-transform accordingly, which is the natural co-adaptation induced by joint training.
H.5 DISTRIBUTIONAL CALIBRATION UNDER THE MODEL
Assume the conditional model at layer l is correctly specified: conditioned on ag-1, the residual satisfies U/ ag- - #t ~ (O, Σe) with Σ. diag(o?). Define the whitened residual r' Σ, 1/22 UE. which is well defined because Σς is positive diagonal. By Gaussian whitening, Te ~ NO Idi) conditioned dę-1- The standardized error can be written as C₁ = 2. Σ 2 U/ = [ >x r2,
Since each Тτ, (O,0 1) and the coordinates are independent under the diagonal model, ez ~ Xde which implies [ = 1 and Var[es] = 2/de-
This yields practical sanity check: on clean ID data, should concentrate near 1; persistent elevation indicates that the observed activations are less predictable from the previous layer than they were during training, consistent with either distribution shift or conditional-mode mismatch. For now-rank-plus plus-diagonal covariance (Appx. [ the same whitening argument shows that eg becomes a generalized quadratic form whose distribution can be bounded via the eigenvalues of the effective precision matrix.
6.6 STUDENT-t AND HUBERIZED VARIANTS
This subsection justifies the robust drop-ins described the main text (Sec. 2.2 where the Gaussian data-fit term is replaced while keeping the same interface (predicting μl and per-channel scales).
For the diagonal Student-t alternative, one convenient route is the standard heavy-tail likelihood pe,e)/ /z.i. A Student-t with degrees of freedom Me has on the standardized residual Ue = (at,i (we 11/2 Applying this channelwise and accounting for the density proportional to (1 + vvi
scale factor oe, gives per-channel negative likelihol of the form tc+1 log + (ac.s-Mta =M,,)
2
log of + (v:) and summing over i = 1,..., de recovers the Student-l loss stated in Sec. 2.2
The Gaussian case is recovered as + oo since log(1 + u2 /vv)) Re u²/vz and the heavy-tail penalty approaches quadratic.
For the Huberized variant, the objective is to behave like the Gaussian model for typical residuals but reduce sensitivity to rare, large standardized deviations. Starting from the Gaussian data-fit term proportional to u², with u = (a 11)/ we replace ju² by the Huber penalty (s(u), which equals fuu² when |u] < 8 and equals 6/u, 1 otherwise. We retain the same 1 log a² contribution so that predicted per-channel scales remain meaningful and comparable across channels, matching the Huberized loss described in Sec. 2.2 This preserves the single-pass computation path while preventing a small number of heavy-tailed channels from dominating the layer score under certain corruptions.
30

---

Published as a conference paper at ICLR 2026
1 LOW-RANK-PLUS--IACCON COVARIANCE; WOODBURY IDENTITIES
Let Σ, = DE + B3 with D2 = diag(o?) > 0 and Bg E Rdexke ke & de. Using the matrix determinant lemma and Woodbury identity:
Log-determinant.
log det Σ₁ = log (D) + logdet(Ta, + B₁ Dj Bt)
Quadratic form.
For U2 U1 p4a.
E = Di² -D Br
D + +B ( B7 Di
(2)
T 01 28 = Ei
T Ditm 11THe + BB DE B2) 112 -1/B,
-1/2 Be DE mell
A
Thus the low-rank correction subtracts a nonnegative term A. tightening the diagonal model.
Computationally: (i) form M2 B3 Dj Be R (ii) solve (T M2) M " for a few right- hand sides using Cholesky; cost is Oddeke k2) per example. Both equation and equation are integer-friendly if D is implemented via per-channel scales.
NLL expression. Putting terms together,
loggpaa a = 1 ding Dr + log Dr + log det + M1) + de log(2z)
(4)
When fg- 0 recover the diagonal case.
J ISOTONIC CALIBRATION DETAILS
We optionally replace the logistic mapping described in Sec. 2.3 with isotonic regression to obtain nonparametric, monotone calibration from single scalar feature derived from (S, m) to an estimated error probability. This choice is most useful when operating points tight (e.g.. strict abstention budgets or high-coverage selective prediction), where a flexible monotone map can better match empirical error rates without introducing non-monotone artifacts.
We first construct a oie-dimensional calibration feature (xx) so that isotonic regression remains lightweight and easy to deploy. The simplest choice is rbxx:) S(x), which yields fully label-free score prior to calibration. When we also include an instantaneous confidence proxy, we instead use convex blend (xx) = >5()) + (1 (3) with 7 [0, tuned the development split. The blend retains the depth-wise signal while allowing the calibrator to exploit complementary information from the classifier when it improves separability.
Given a development set of pairs {(vs, 34) ) we fit a monotone function ff that maps 3ó to an estimated probability of error. Here y; E {0, 1] is the binary target indicating whether the prediction wrong (so 1/1 means error and y; = 0 means correct); this convention matches the intended interpretation of (zx) as an error probability. Isotonic regression solves the least-squares problem f E arg miny nondecreasing Σx= (y4 f():))² after sorting examples by th. and the solution is violators (PAV) algorithm. The resulting f is a right- computed efficiently by the nondecreasing function with most steps; in practice typically continuous, piecewise-constan has far fewer steps due to pooling. To avoid pathological extremes that can make thresholding brittle, we clamp the outputs to [e, E] (c.g.. e 10-4), which preserves monotonicity while preventing exact zeros or ones.
At inference time we set U(x) f()()) and the same thresholding rules in the main text: fixed thresholds, risk-coverage selection, or budgeted control. Because monotone, increasing S (or the blended vi) can never decrease the estimated error probability, which often yields sharper risk coverage curves and more stable control under drift. For deployment, f can be stored either as a small list of breakpoints and values (supporting binary search over breakpoints) or as a compact fixed range; both retain constant memory and low compute.
lookup table after quantizing
31

---

Published as a conference paper at ICLR 2026
K BUDGETED ABSTENTION CONTROLLER
For applications that impose an abstention budget b E (0, 1), we implement a lightweight controller that adjusts the operating threshold online to keep the long-run abstention rate near b without using labels. Let (xx;) E [O, 1 be the calibrated uncertainty at time i and let A. (Ir 2 Ti] denote the abstention decision under the current threshold Tr. We track an exponentially-weighhe
moving average (EWMA) of abstentions. A, nd, + (1 A1-1 with A O and smoothing factor 77 E (0, 1]. so that recent decisions are emphasized while still averaging over a meaningful window.
We update the threshold by simple proportional rule, T--1 Tt + x(A, b) with step size >> 0. When recent abstentions exceed the budget (A, > b), the update increases т. making abstention harder and pushing the rate down; when abstentions allowing more abstentions when uncertainty rises. In practice we clamp T. to [0, 1J to keep it valid, and we choose ?) and small enough to avoid oscillations while still reacting to short OOD bursts. This controller is scalar, state-light, label-free, and adds negligible overhead beyond one EWMA update and one addition per frame, making compatible with MCU deployment.
below budget, the update decreases т,
L ADDITIONAL COMPLEXITY ACCOUNTING
We give a compact accounting of the incremental compute introduced by SNAP-UQ relative to the backbone. Consider a tapped convolutional block whose input activation has shape Cin x x W and whose tapped output has de Cout channels. If the projector P: is implemented as 1 x 1 convolution that maps Cj + ry followed by global average pooling, then the dominant cost comes from the pointwise convolution, which performs approximately HW Cin Ty multilly-accmmulates (MACs), and the pooling adds a comparatively small O(HW rz) reduction cost. The predictor consists of two linear heads mapping re de (one for μ and one for log of), contributing about 2 rydg MACs plus biases.
Summing over taps é S, the relative overhead can be summarized by the ratio R Ce. where we emphasize that the numerator counts only the additional pro- FLOPs(hackbone)
jector and head operations. In TinyML settings with |S| < 3 and [32, 128]. this ratio is typically below 2%. and the flash cost is dominated by the int8 parameters of the two small heads per tap.
M IMPLEMENTATION NOTES FOR INTEGER INFERENCE
We store projector and head weights in int8 with appropriate quantization scales (per-tensor, or per-channel when supported), and use int32 accumulators for dot products and convolutions. Let ž denote the quantized projector output and let the heads produce quantized μy and quantized log of (or quantized proxy that can be mapped to inverse scale). The standardized error for tap é is computed by accumulating a caaneensionnooomlliin
sum of squared, scaled residuals, namely & - Ede ((ar,- pr,:) (ure;:-r,;) Bo,;) where s., approximates the inverse standard deviation associated with channel i. To avoid runtime exponentials, we implement $ R cxp( log o²..) using a small 256-entry lookup table addressed by quantized log of.-- This preserves monotonicity (larger predicted variance yields smaller inverse scale) and makes the computation deterministic and efficient.
To bound dynamic range and prevent overflow in fixed-point arithmetic, we clamp log o²,, to log o2 ] before table lookup, with o chosen to avoid division-by-zew behavior and o may chosen to limit extreme down down-weighte weighting. Accumulating the squared terms in int32 and applying the di normalization with a fixed-point reciprocal (or a single dequantization to f6 on larger MCUs) yields a stable εg that matches the ordering needed for reliable thresholding and calibration.
[log oiinn
Summary. Propositions 2.1 2.3 establish that SNAP-UQ's depth-wise score is an affine transform of
conditional negative log- likeliho kihoo under simple diagonal model, corresponds to Mahalanobis energy to the conditional mean under Smear-Gaussiee dynamics, and is invariant to BN-like rescalings under co-adaptation. Isotonic calibration provides monotone, nonparametric mapping from scalar
32

---

Published as a conference paper at ICLR 2026
feature derived from (S, m) to estimated error probability, and the budgeted controller maintains target abstention rate online using only (xxe) and lightweight state.
N ABLATIONS AND SENSITIVITY ANALYSES
This section expands design choices for SNAP-UQ: tap placement, projector rank, quantization of heads, uncertainty mapping, coveraee behavior, calibration reliability, and corruption/eroor clusters. Unless noted, results are averaged over three seeds; enror bars denote 95% Cls from 1,000 bootstrap.
Table 6 summarizes in-distribution quality across four benchmarks. On MNIST and SpeechCmd, SNAP-UQ achieves the best or tied-best scores on all proper metrics, improving NLL and BS versus single-pass baselines and matching or exceeding the strongest competitors Fl and ECE. On CIFAR- 10, the mraccee variant (row "SNAPUQ' matches the best BS (0.017), improves NLL to 0.363 (better than DEEP and QUTE+), and attains the top (0.879). while keeping single pass. On Tiny Iet SNAP-UQ delivers the best BS and ECE and the highest FI (0.436), approaching the strongest multi-head/ensemble alternatives NLL despite their larger compute/memory budgets. Overall, SNAP-UQ consistently tightens proper scoring rules (NLL/BS) and calibration (ECE) while maintaining competitive or superior accuracy (FI), validating that depth-wise surprisal can improve ID probabilistic quality without auxiliary exits repeated evaluations.
N.1 TAP PLACEMENT AND PROJECTOR RANK
We vary (i) the set of tapped layers S and (ii) projector rank Ty. Taps are chosen at the end of a mid block (M) and/or the penultimate block (P), As shown in Table 7 two taps (M+P) consistently provide the best accuracy-latency trade-off on both CIFAR- (Big-MCU) and SpeechCmd (Small-MCU), where AUPRC improves increases while latency
The trend with rank is visualized in Figure 3 remains nearly flat.
0.75
AUPRC (CIFAR- 10-C)
0.7
0.65
0.6
32
64
96
128
Projector rank r (M+P)
90
Latency (ans, Big-MCU)
86
84
80
32
128
Projector rank (M+P)
Figure 3: Rank sensitivity. Accuracy-drop improves with rank; latency impact is small (CIFAR- 10/Big-MCU).
Takeaway. Two taps (mid+penultimatt) provide the best accuracy-latency trade-off Table 7): increasing rank beyond 64 yields diminishing returns with small latency changes (Figure
33

---

Published as a conference paper at ICLR 2026
Table ID metries. Higher Fl is better; lower Brier Score (BS), Negative Log- Likelihood (NLL),
and Expected Calibration Error (ECE) are better. Mcan over 3 seeds.
Model
F1f f
BS
NLL 4
ECE 1
MNIST
BASE
0.910:1.0022
0.0131100000
0.292.10.006
0.0141100001
MCD
0.886=0..004
0.018+0.000
0.382=0.004
0.071+0.006
DEEP
0.931110.005
0.010110.000
0.227=0.002
0.034110000
RE-ensemble
0.939=00.02
0.011+:0.000
0.266=0.005
0.108=+0.002
HYDRA
0,932:10.006
0.0101100000
0.230
0.01410.005
QUTE
0.941=00.004 0.009+00000
100
0.026+000003
SNAP-UQ
0.946-10.033
0.0081100000
0.202
0.01611.002
SpeechCmd
BASE
0.9231100007
0.010:10.000
0.0261100011 0.233
MCD
0.917+00.006
0.011+0.000
0.279+0.013
0.048+0.002
DEEP
0.934110.088
0.00811.000
0.205
0.034110006
ER-ensemble
0.926+000002
0.009++0000
0.226+0.009
0.029+00001
HYDRA
0.932++0.005
0.000
0.203
0.018+000004
QUTE
0.9331100006
0.008110.000
0.202=00016
0.018:100001
SNAP-UQ
0.908
0.000
0.197+0.008
0.016++0.002
CIFAR-10
BASE
0.834
0.023++0.000
0.523
0.049+0.003
MCD
0.867:100002
0.01910.000
0.396=0.003
0.01710.005
DEEP
0.807+00003
0.017+00000
0.365
0.015+00.033
En-enmemble
0.854:20.001
0.021
0.446=0.011
0.033100000
HYDRA
0.818+10.004
0.026+00.000
0.632+00017
0.069++0.001
QUTE
0.808110.001
0.020=00000
0.428=0.019
0.025+0.003
QUTE+
0.808+00.003
0.017+0.000
0.369
0.026+:0001
SNAP-UQ'
0.879=100003
0.017=00000
0.363=0.010
0.021
Tiny ImageNet
BASE
0.051
0.004=00000
5.337=0.084
0,416:200003
MCD
0.332+10.004
0.003
2.844
0.06110.005
DEEP
0.4144000006
0.0031:0000
3.440=0.049
0.115+00003
EE-ensemble
0.430-10.005
0.003+10.000
2.544
0.032-100006
HYDRA
0.376+10.004
0.00410.000
3.964=0.036
0.328
QUTE
0.305110.014
0.004110.000
3.700-10.13
0.282-10.009
QUTE+ 0.301 0.003
2.757=0.044
0.122=#0.00
SNAP-UQ
0.436
0.003
2.610.100500
0.030-10.004
N.2 QUANTIZATION OF SNAP HEADS
We compare float32, float16, and int8 for the projector and predictor heads while keeping the backbone unchanged. Table shows that int8 preserves AUPRC within the CI while reducing flash and improving latency.
Takeaway. 7-9%.
INT8 preserves performance while cutting flash by 1.6-2.1x and lowering latency by
N.3 MAPPING ALTERNATIVES: LOGISTIC VS. ISOTONIC
We compare the 3-parameter logistic map with isotonic regression. As summarized in Table 9 isotonic yields consistently lower risk at fixed coverage; the full covercoerege curves in Figure show the gap across operating points.
34

---

Published as a conference paper at ICLR 2026
Table 7: Taps and projector rank. CIFAR-10/Big-N (top) and SpeechCmd/Small-Mee (bottom).
Latency in ms. AUROC is IDv - IDx; AUPRC is accuracy-drop (avg over -C).
CIFAR-10 (Big-MCU)
Config
Flash (KB)
Lat. (ms)
AUROC1
AUPRC
only, r=
0.83
0.62
P only, r=64
284
86
0.84
0.64
M+P, r=64
292
83
0.86
0.70
M+P, r=
86
0.72
M+P+early, r-
315
90
0.86
0.71
SpeechCmd (Small-MCU)
Config
Flash (KB)
Lat. (ms)
AUROC1 1 AUPRC
P onlly r=32
114
118
0.92
0,62
P only, r=64
116
116
0.93
0.63
M+P, r-64
118
113
0,94
0.65
M+P, r=96
121
115
0.94
0.66
Table 8: Quantization variants. Heads only (projectors + (p, log o)))
CIFAR-IO/Big-MCU and
SpeechCnd/Small-MMCU.
CIFAR-10 (Big-MCU)
SpeechCmd (Small-MCU)
Precision
Flash (KB)
AUPRC 1
Flash (KB)
AUPRC 1
FP32
324
0.71
128
0.66
FP16
306
0.71
122
0.66
INTS
292
0.70
0.65
N.4 RISK-COVERAGE ACROSS DATASETS
The advantage of SNAP holds beyond CIFAR-10; Figure shows lower risk matched coverage MNIST-C and SpeechCmd-C.
N.5 RELIABILITY DIAGRAMS (ID)
We plot accuracy confidence using 15 adaptive bins. Points in Figure 6 close to the diagonal on MNIST and CIFAR-1O, indicating well-behaved calibration on ID data (see also Table 4
N.6 CALIBRATION ABLATIONS: RAW S(x) VS. LOGISTIC VS. ISOTONIC
Setup. We compare raw S(x) Etes we (x)) with fixed threshold, 3-parameter logistic map U == ( + 3 + 32m), and isotonic regression (monotone table). All use the same dev split and backbone; heads are int8. Datasets: MNIST-C, SpeechCmd-C. CIFAR-10- and TinyImageNet-C.
Findings. Ranking metrics (AUROC/AUPRC) are similar across all three because monotone maps preserve order: e.g.. CIFAR-IO-C AUPRC raw 0.69 vs. logistic 0.70 vs. isotonic 0. 0.71; SpeechCmd-C 0.63/0.65 /0//6.6600666 MNIST-C 0.64/0.66 0.66//067; Tiny FinylmaeNNet-G 0.58 60.600606.... Decision-centrie metrics benefit from calibration: selective risk 90% coverage improves (CIFAR- 0.111 -
- and LinylmmaeNNet-C) 0.185 08100 + 0..16,, while median detection delay drops by 1-3 frames on average. Proper scoring on ID requires calibration: NLL/BS/ECE match Table 4 with logistic/isotonic but degrade with raw S (not probability). Overhead is negligible (3 params a 16-32 entry table, both int//LUT-frrendlly..
Recommendation. If single threshold must generalize across shifts report decision metrics, keep logistic or isotonic; if labels or space are extremely limited, raw S is acceptable with percentile threshold on the ID dev set.
35

---

Published as a conference paper at ICLR 2026
Table 9: Risk fixed coverage. Lower is better (CIFAR-1O-C) 10-C).
Method
Risk @ 80%
Risk @ 90%
Risk @ 95%
Logistic (SNAP)
0.136
0.109
0.098
Isotonic (SNAP)
0.127
0.104
0.096
Entropy (bascline)
0.154
0.124
0.112
0.2
SNAP (logistic
SNAP (isotonic)
Entropy
Risk
0.1
0.5
0.6
0.7
0.9
Coverage
Figure 4: Risk-coverage (CIFAR-10-C), Isotonic improves budgeted operation (Angelopoulos et al. 2022
N.7 ERROR/CORRUPTION CLUSTERS AND ABSTENTION
We analyze the most frequent CID failures and report abstention rates at a tuned operating point (90% recall event frames). Table 11 lists the top clusters CIFAR-IO-C (sev. 4-5), and Figure 7 visualizes the gap to baselines.
N.8 How MANY TAPS? (2, 3, 4, AND 5 TAPS)
We extend the tap-count study beyond penulimmtme (M+P, 2 taps) and early+mid+ (E+M+P, taps) to and taps. For CIFAR-10/Big-MCT tap at block boundaries:
mid+ penultimate
E MI M2 M3 + P
(5)
where E (early) is the end of the first downsampling stage, M1/M2/M3 successive mid-depth blocks, and is penultimate. Unless stated, projector rank is r-64 and per-layer errors are width- normalized.
Takeaways. Moving from 2-+3 taps yields consistent but modest AUPRC gain (+0.011) with small latency/flash increase. Adding a fourth mid-depth tap (E+MI+M2+P) improves both AUPRC and AUROC slightly, but a fifth tap (E+MI+M2+M3+P) no longer helps CID and only adds cost. In short, M+P the best accuracy- cost point; E+M+P is a safe upgrade under loose budgets; a carefully placed fourth mid tap help harder corruptions, while five taps shows saturation (see
Table 12
The two mid taps (M1/M2) are the most informative for CID monitoring (largest AUPRC drops if removed). The penultimate primarily stabilizes IDv IDx (AUROC), while the early tap adds small but repeatable gain for difficult corruptions at negligible accuracy cost. Practically, 2 taps (M+P) remain recommended for tight MCU budgets; 3 taps (E+M+P) offer low-risk bump; taps are worthwhile only if the additional few KB and ~~6 ms are acceptable (see Table 13
Interpretation.
Cross-layer correlation and simple placement heuristic. To make tap placement less ad-hoc, we measured the Pearson correlation between each layer's 's standardized surprisal (z(2) and the final score S(x) over held-out streams. Correlation peaks around mid blocks and the penultimate block
36

---

Published as a conference paper at ICLR 2026
MNIST-C
SpeechCmd C
0.2
SNAP Entropy
0.2
Risk
0.15
Risk
0.15
0.1
0.1
0.5
01.6
0.7
0.8
0.9
0.5
0.6
0.7
0.8
0.9
Coverage
Coverage
Figure 5: Risk-coverage on two datasets (lower better). SNAP dominates at moderate to high coverage.
(T)
CIFAR-IO (ID)
0.8
Accuracy
0.6
0.4
0.4
0.2
0.2
0
0
0.2
0.4
0.6
0.8
0.2
0.4
0.6
0.8
Conlidence
Confidence
Figure 6: Reliability diagrams (SNAP-UQ). Points near the diagonal indicate good calibration; overconfidence would fall below the dashed line.
across backhones, which explains why M+P works well and why extra early taps add limited unique signal.
Heuristic (budget-aware). Start by placing tap at the penultimate block (highest r in Table then add the mid tap that maximizes AUPRC gain per KB (or per ms). This greedy two-step recovers the best trade-off M+P. Under slightly looser budget, add early second-mid tap only if the marginal gain-per-cost remains positive on the development stream (see Table 12 Table 13).
ISNAP-UQ I FF
DEEP
Abstention (%0) among arnass
80
Figure 7: Abstention on hard clusters (CIFAR-10-C, sev. 4-5). SNAP-UQ defers more often on the most failure-prone corruptions.
37

---

Published as a conference paper at ICLR 2026
Table 10: Raw vs. calibrated. AUPRC (CID) Selective risk @90% (lower better) / Median delay (frames).
MNIST-C
SpeechCmd-C
CIFAR-IO-C
TinyImage
Raw S(x)
0.64 0.072 / 26
0.63 / 0,061 / 44
0.69
0.111
29
0.58 / 0.185 / 52
Logistic
0.66
0,070 / 24
0.65 / 0,058 / 41
0.70
0.109
27
0,60 / 0,180 / 49
Isotonic
0.67 0.069
23
0,66 / 0,057
40
0.71
0.104
26
0.61 / 0.176 / 47
Table 11: Top failure clusters (CIFAR-10-C, severity 4-5). Abstention rate among misclassified frames.
Cluster
SNAP-UQ (%)
EE-ens (%)
DEEP (%)
Motion blur
72.4
61.2
Contrast
68.1
53.4
56.7
JPEG
63.9
49.2
51.6
Snow
59.7
47.1
50.3
Frost
58.3
45.0
47.6
To make tap placement less ad-hoc and easier to port across backbones, we provide two lightweight diagnostics: (i) surprisal correlation heatmap that reveals redundancy across depth, and (ii) diminishing-returrss curve that summarizes the benefit of adding taps under fixed budget.
Surprisal correlation (see Figure 8). Across candidate layers E, MI, M2, P. pairwise standardized- surprisal correlations concentrate in the mid-late depth: MM1,2 0.63-0.72 and FM2,P 0.62, while very-early to penultimate is much lower (TE.P R 0.35), indicating limited redundancy between shallow and late taps. Correlation of each layer's surprisal with the aggregated score S(x) increases monotonically with depth, r(Er, S) Rs 0.41, r(ÊMI, S) R 0.63, r(Em2, S) 2 0.68, r(Ep, S) R 0.74, showing that mid and penultimate layers are both highly informative about S(x).. These numbers justify the default mid+penultimate placement: the two taps are strongly aligned with S(x) yet not fully redundant, whereas adding very-early tap yields smaller marginal gain per cost.
Diminishing returns with more taps. We sort candidate layers by marginal gain-per-cost dev stream (gain: AUPRCC on CID; cost: A flash or latency) and add taps greedily. Fig. shows that gains saturate after 3-4 taps, aligning with Table 12, the best trade-off remains M+P, with E+M+P as safe upgrade.
Placement recipe (practical). Compute rée,, S(x)) on short dev stream; pick the highest- correlation penultimate layer and the best mid layer (M+P). If budget allows, add the early or second-mid tap only if AAUPRC per KB (or per ms) is positive. This reproduces the trade-offss in Tables 12 and 13 and makes porting to new backbones one pass of correlation a small greedy sweep.
N.9 ROBUST DISTRIBUTIONAL VARIANTS: STUDENT- AND HUBER
The Hiagonal-Gaussinn head used by SNAP-UQ is intentionally lightweight and fnteger-friendly. which makes a good default for TinyML deployments. Under strong corruptions, however, the
Table 12:
AUPRC CID accuracy-drop detection (avg over CIFAR-10-C); AUROC ID IDx. Diminishing returns after 3-4 taps.
Tap-count sweep (CIFAR-I0/Bi-MCU,,))
Config (taps)
Flash (KB)
Lat. (ms)
AUROC
AUPRC (C)
M+P (2)
292
83
0.86
0.70
E+M+P (3)
305
86
0.86
0.71
E+M1+M2+P (4)
318
89
0.87
0.72
E+MI+M2+M3+P (5)
93
0.87
0.72
38

---

Published as a conference paper at ICLR 2026
Table 13: Leave-one-out (4 taps) on CIFAR-IO/Big 1EAAR-OO/Bi-MMUU baseline E+M1++M2+P. Mid-depth taps
contribute most to CID detection.
Variant (remove -)
Lat. (ms)
AUROC 1 AUPRC(C) 1
E+MI+M2+P (none)
89
0.87
0.72
w/o E
88
0,87
0.71
w/ MI
88
0.86
0.70
w/o M2
88
0.86
0.70
w/o P
0.85
0.71
Table 14:
Correlation of per-layer surprisal with the aggregated score S(x) (Pearson r). Layers: Early (E), successive mid blocks (MI/M2), Penultimate (P). Higher is better.
Dataset / Backbone
E
M1
M2
P
CIFAR-10/ ResNet-8 (Big-MCU) 0.41
0.63
0.68
0.74
SpeechCmd DSCNN (Small-MCU)
0.38
0.61
0.59
0.66
TinylmageNet/ MobileNetV2-tiny
0.35
0.57
0.62
0.69
Surprisal correlation heatmap (r:y)
Correlation to S(x)
0.8
0.35
0.58
0.62
0.78
.75
0.4
0.63
0.72
0.62
.65
M2
S(z))
0.6
.58
0.45
0.7
0.63
0.58
M1
.45
0.6
0.45
0.35
.35
E
M1
M2
M1
M2
Layer index (E - M1 M2
Layer
Figure 8: Redundancy vs. informativeness. Left: pairwise correlation of per-layer standardized surprisal Ex(x). Right: each layer's correlation with the aggregated score S(x).
depth-wise residuals (ar - me) can become heavy-tailed: small number channels may exhibit unusually large standardized deviations that dominate the squared-error surprisal and reduce the stability of downstream calibration. To improve robustness without changing the single-pass, state- free design, we consider two drop-in alternatives that only modify the per-tap energy while leaving the tap set, projector, and mapping pipeline unchanged. The first replaces the Gaussian energy with Student-/. negative logllikelihood, which attenuates the influence of large residuals by growing only logarithmically in the squared standardized error. Concretely, for each tapped layer l and channel the Gaussian quadratic term 1 (".,)""(.)** )² is replaced by - log + ( -Pe,)² (oe,s-me.,)" (up Naद,
to additive constants), while retaining the same per-channel scale term 2 log a,,;- The second uses Huberized energy in standardized units: letting Fr,; -r.--r. replace the quadratic penalty de, by ps(r,.)), where px(r) = 1 when |r| < 8 and ps(r) = 0|rl 602 otherwise, again keeping the same 1 log of, scale term. Both variants preserve the interpretation of surprisal per-layer, depth-wise "energy" that increases with atypical activations, and they remain compatible with the same monotone mapping from aggregated surprisal to an error- proo-pprbbbbilty proxy. Importantly, these changes do not require additional exits, extra passes, temporal buffering: inference still consists of one backbone pass, per-tap prediction (Me, oz), computation robust per-tap energy, and aggregation into S(x:) before applying the chosen calibration map.
39

---

Published as a conference paper at ICLR 2026
0.74
AUPRC CIFAR I0C
0.72
0.7
0.08
0.60
2
Number taps
Figure Diminishing returns. Average AUPRC vs. tap count under matched quantivation/backkone. Saturation after 3-4 taps supports the use of two to three taps MCUs.
We evaluate these robust heads on MNIST, Speech Commands (SpeechCmd), CIFAR-10, and TinyImageNet, using corrupted (CID) streams constructed from the corresponding "-C" benchmarks. For Student-/ we sweep the degrees of freedom v E {3,5, 7, 10), and for Huber we sweep the transition point å E {0.8, 1.0, 1.2, 1.5] measured in standardized units. Hyperparameter selection uses the same development stream employed to choose the single operating threshold for streaming experiments, ensuring that tuning does not benefit from any test-stream information. Our primary selection criterion selective risk at 90% coverage (lower is better), since this directly reflects decision quality under fixed acceptance budget; we AUPRC on CID streams and AÚROC for IDV OOD as secondary criteria to break ties and to verify that gains are not confined to a single metric. Unless otherwise stated, we report results with shared settings across taps, fixing v 5 for Student-t and d = 1.0 for Huber, which provided stable trade-off across datasets while keeping the implementation simple and MCU-friendly (Table 15
Table 15: Tuning grids and selection rule (development stream).
Dataset
Dev split
P grid (Student-t)
grid (Huber)
Selection (primary
MNIST
10% ID + CID
(3.5,7,10}
(...,1.
risk 90%% > AUPRC, AUROC
SpeechCmd
10% ID + CID
3,5,7,10
risk@900% >> AUPRC, AUROC 1..8......221.555
CIFAR-10
10% ID + CID
(,,,,7110]
risk@9095 >> AUPRC, AUROC (0.811.0,12211555)
1..8.....
TinyImageNet
10% ID + CID
{3,5,7,10}
risk@90%% + AUPRC, AUROC
Setup and implementation. We use two taps (mid+penultimate), projector rank r= 64, int8 heads, and the same training schedules the Gaussian default. Mapping from surprisal to risk uses the same dev-split logistic fit (or isotonic in Appx. J and N.3). For Student-f, we replace the quadratic with log(1 + u² /v) and evaluate log(1 x) with 256-entry LUT plus linear interpolation; 1/v is precomputed. Huber uses only comparisons (no transcendentals), As in the Gaussian head, log o² uses LUT and all weights are INT8.
Findings. On CIFAR-10 and Tiny TinylmageNet. Student-t consistently reduces NLL/BS (Table 17) and yields small, repeatable gains failure detection and CID AUPRC (Table T6). suggesting robustness to heavy-tailed residuals higher corruption severities. On MNIST and SpeechCmd, all three heads perform within confidence intervals; Huber closely tracks Gaussian while offering better outlier stability and the simplest MCU path (no log LUT). Overall, Gaussian remains a strong default; enable Student-/ when high-severity corruptions are expected or selective risk at high coverage is critical, and prefer Huber when LUT's for log(1+)r) are undesirable.
Actionable guidance: when and how to use the robust heads? Use the Gaussian head by default; switch to Student-t when corruptions are heavy-tailed or high severity (e.g.. CIFAR-10-C or TinylmageNet-CC severities > 3) when selective risk at high coverage is critical; use Huber when you want extra outlier stability without transcendental ops (e.g., impulsive audio artifacts) or when LUTSs for log( (1+)) undesirable.
40

---

Published as a conference paper at ICLR 2026
Table 16: Comparison across heads (single pass, taps, r 64. INT8 heads). AUROC:
IDV -OOD. AUPRC: CID accuracy-drop. Lower is better for risk @ 90%, AURC. FPR @95%.
MNIST
AUROC (OOD)
AUPRC (CID)
Risk@ & AURC
FPR P9R095% +
Gaussian
0.94
0.66
0.070
0.094
0.24
Student-t
0.95
0.67
0.069
0.092
0.23
Huber
0.94
0.66
0.069
0.093
0.24
SpeechCmd
AUROC (OOD)
AUPRC (CID)
Risk 90%%
AURC
FPR @95%
Gaussian
0.94
0,65
0,058
0.110
0.26
Student-t
0.95
0,66
0.057
0.108
0.25
Huber
0.94
0.66
0.057
0.109
0.25
CIFAR-10
AUROC (OOD)
AUPRC (CID)
Risk@90%
AURC
FPR @95%
Gaussian
0.94
0.70
0.109
0.189
0.44
Student-t
0,95
0.71
0.104
0.183
0.41
Huber
0.94
0.70
0.107
0.186
0.43
Tiny NeageNet
AUROC (OOD)
AUPRC (CID)
Risk@90%
AURC
FPR @95%
Gaussian
0.92
0.60
0.180
0.242
0.51
Student-t 0.94
0.61
0.176
0.236
0.48
Huber
0.93
0.59
0.179
0.240
0.50
Table 17: ID calibration (lower is better). Robust heads slightly improve NLL/BS CIFAR-10 and match Gaussian elsewhere; ECE remains stable.
MNIST
SpeechCmd
CIFAR-10
Method
NLL
BS J
ECE
NLL
BS
ECE
NLL
BS
ECE
SNAP-UQ (Gauss)
0.202
0.008
0.016
0.197
0.008
0.016
0.377
0.018
0.022
SNAP-UQ (Student-r)
0.205
0.008
0.016
0.199
0.008
0.017
0.369
0.017
0.021
ANAP-UQ (Huber)
0.204
0.008
0.016
0.198
0.008
0.016
0.372
0.017
0.021
ThyylmageNet (ResNet-50, single-pass, taps)
Method
NLL 4
BS
BCE L
SNAP-UQ (Gauss)
0.982
0.060
0.018
SNAP-UQ (Student-f)
0.956
0.058
0.017
SNAP-UQ (Huber)
0.968
0.059
0.018
Sensible defaults (drop-in). Student-(: fix v = 5 (shared across taps). This down-weights large standardized residuals while keeping gradients stable; sweeping [3, 7] typically changes NLL/BS by < 0.2 pp in our runs. Huber: set = 1.0 in standardized units (also shared across taps); 8 E [0.8, 1.2] behaves similarly and requires no LUTs.
A tiny selection rule (one dev pass). On small development stream (ID compute: (I) selective risk 90% coverage, and (2) AUPRC for accuracy-drop. If Student-t improves either by 2 0.01 absolute over Gaussian, keep it; otherwise use Gaussian. Prefer Huber when Student-t shows no gain and you want the simplest integer path. This rule matched the tables we report across MNIST, SpeechCmd, CIFAR-10, and TinyImageNet (Tables 17
Stability and what not to tune. Learning v per tap brings tiny gains and adds sensitivity; if desired, learn single v shared across taps with softplus reparam clipped to [3, 30), but recommendation is to fix v. For Huber, keep fixed; per-tap 8 did not help within Cls. Share 1/8 across taps to reduce variance and code paths.
INTS/LUT implications. Both variants remain INT8-friendly. Student-t needs log(1+=)); a 256- entry LUT with linear interpolation adds z 1 KB flash and no extra RAM. Huber uses only com- parisons and adds zero transcendentals. As with the Gaussian head, we keep log o² in a LUT and quantize all weights to int8: latency differences vs. Gaussian were 2%.
41

---

Published as a conference paper at ICLR 2026
Images audio (quick summary). On images (CIFAR-10, TinylmageNet), Student-t consis- tently lowers NLL/BS and improves failure detection/AUPRS under severe corruptions; on audio (SpeechCmd), all three heads are within Cls, with Huber providing the simplest robust choice.
Calibration interplay. Because logistic/isotonic maps are monotone, AUROC/AUPRC remain similar across heads; the robust choices primarily help decision-centric metrics (lower selective risk at fixed coverage) and shorten median detection delay by 1-3 frames in high-severity regimes.
N.10 OPTIONAL CONRIDENCE BLEND
Adding the blend term m(x) (from max- paa--obabiitty/mariinn to the logistic improves separation on hard ID/CID cases with no runtime cost. Table 18 reports SpeechCmd gains.
Table 18: Blend ablation (SpeechCmd).
Config
AUROC (IDV IDx) AUPRC(C)
U (Bo + (2 (no blend)
0.93
0.64
+ m()), B2 > 0 (default)
0.94
0.65
N.11 RUNTIME BREAKDOWN AND MEASUREMENT PROTOCOL
Measurement conditions. We profile wall-clock inference single core) using CMSIS-NN kernels (int8), fixed clock and DVFS disabled. Binaries are compiled with -03 and linker-time optimization; all methods reuse the same backbone, input pipeline, and quantization settings. Each number is the mean of 10x forward passes after 100-pass warmup; inputs are cached SRAM to avoid SD/flash stalls. Latency is reported as end-to-end time from input tensor present in SRAM to logits/risk produced. Power is sampled at kS/s from a shunt; energy is inte-rater over the same window.
ARM Cortex-M7 (600 MHz,
Where the speedup comes from. SNAP-UQ is single pasee- and state-free. Compared to early- exit ensembles (multiple heads, controller) or deep ensembles (multiple passes), it (i) removes repeated classifier/softmax work, (ii) replaces softmax+entropp and running stats with single scalar surprisal, and (iii) keeps head math in int8 with kernel fusion (pointwise x GAP and tiny linear heads fused with scale/LUT). Backbone cost is identical across methods; gains come from the tail (head+classiferr-tO)) (see Table 19 and Figure 10).
Interpretation. Across both MCUs, the backbone compute is identical for all methods, so any end-to-end speedup must arise in the tail. The stacked bars show that SNAP-UQ shifts a larger share of time into the shared backbone (Big-MCU: 84% vs. 74-81% %;; Small-MCU: 86% vs. 77-81 %) while shrinking the tail to 6- 6-12% compared to 10-26% for early-exit and deep ensembles. Concretely: (i) the classifier block drops from 12% (BASE) or 16% 194% (DEEP) to 3% 5%/2% with SNAP-UQ because repeated softmmx and entropy/stats are removed and replaced by a single surprisal scalar; (ii) early-exit ensembles incur an extra 11-12% in exit heads and controller logic that SNAP-UQ avoids (single pass, no controller); and (iii) memory I/O remains modest and similar (Big-MCU 6% vs. 4-10%; Small-MCU 6% vs. 4-10%) due to kernel fusion and INT8 heads. The net effect, eliminating repeated heads/softmax and reducing tail compute, explains the observed end-to-end gains in the tens-of-percent, despite identical backbones.
Minimal configuration. When SRAM is extremely tight or intermediate activations cannot be exposed, a single tap at pre-logits with low projector rank (e.g., r=32) provides a workable "minimal SNAP-UQ". Table 20 summarizes the cost/quality trade-off's versus our default two-tap setup (M+P, 6=64), Mcasurements follow the same protocol as Sec. N.II (Cortex-M7 @ 600 MHz, CMSIS-NN int8, fixed clock, 103 passes avg.).
Recommendation. Use Minimal (P-only, r=32) when hook access is limited or memory/latency budgets strict: expect ~2-5 KB flash and ~2 4 KB SRAM savings and ~4-5 ms latency reduction, at the cost a modest FPR increase (~22-5 pp) and slightly lower CID AUPRC (~0.01-0.02). When feasible, Default (M+P, r=64) remains the best accuracy-cost point both MCUs.
42

---

Published as a conference paper at ICLR 2026
Table 19: Latency share by stage (percentage of end-to-end). Big-MCU: CIFAR-IO/ResNer:
Small-MCU: SpecchCmd/DSCNN, Percentages sum to 100.
Big-MCU (CIFAR-10)
Backbone convs
Tap proj./head
Classifier (FC+softmax)
Mem.
BASE
78%
12%
10%
EE-ensemble
74%
12%
10%
4%
DEEP (M=4)
76%
16%
8%
SNAP-UQ
84%
7%
3%
6%
Small-MCU (SpeechCmd)
Backbone
Tap proj./head
Classifier (FC+softmax)
Mem. I/O
BASE
81%
9%
10%
EE-ensemble
77%
11%
8%
DEEP (M=4)
79%
14%
7%
SNAP-UQ
86
6%
2%
6%
Big-MCU (CIFAR-10/ ReaNet-8)
Small-MCU (SpochhCud DSCNN)
100
100
80
80
Latency share
20
20
0
0
BASE
ens.ns
DEEP
SNAP-UQ
BASE
EEE-nn
DEEP
SNAP-UQ
Backbone
Tap proj./bead
Classifier
Mem DO
Figure 10: Where the speedup comes from. Stacked latency shares (sum to 100%). SNAP-UQ reduces the tail (classifier, extra exits/controller, softmax/entropy, and I/O), pushing a larger fraction of time into the shared backbone and yielding end-to-end savings even though the backbone is identical across methods.
Table 20: Minimal SNAP-UQ default. Flash (KB) / Peak RAM (KB) Latency (ms) /
FPR @95%TPR (IDV - OOD, lower is better) AUPRC on CID (higher is better).
MCg (CIFAR-10/ ResNet-8)
Config
Flash
Peak RAM +
Latency FPR@95%
AUPRC(CID)
Minimal (P-only, r=32)
276
112
79
39.8%
0.68
Default (M+P, 6-)
292
120
34.6%
0.70
MMCUl-MCU (SpeechCmd/ DSCNN)
Config
Flash 4
Peak RAM 4.
Latency +
FPR@955; 4
AUPRC(CID) 1
Minimal (P- (P-only. r=32)
112
48
108
21.5%
0,63
Defoult (M+P, r=64)
118
51
113
18.9%
0.65
O EXTENDED COMPARATIVE SCOPE AND SINGLE-PASS HEAD-TO-HEAD
This appendix expands the comparative scope for single-pass uncertainty/OOO baselines and reports tead-to-head results under the same MCU deployment and tuning protocol as SNAP-UQ. We focus methods that (i) need extra forward passes, (ii) keep temporal state, and (iii) fit the same INTS budget. Summary results appear in Tables 21 and 25 with coverage curves in Figs. II
and 12 and clean-ID FPR in Tables 22 and 24
43

---

Published as a conference paper at ICLR 2026
O.1 METHODS CONSIDERED AND DEPLOYMENT PARITY
MSP/Entropy (max posterior, predictive entropy): Temperature scaling (ID dev only); Energy (essumepp(g(e))///e with T' tuned dev; Mahalanobis taps (classwise means + diagonal covariances at the same tapped layers as SNAP-UQ: score min diagonal Mahalanobis); ReAct (Sun et al. (021) (percentile clipping of tapped activations with per-channel thresholds fixed on dev); ASH (Djurssic et al., 2023) (activation shaping via percentile shrinkage at one tap). On Big-MCU only, additionally report ODIN-lite (temperature scaling without input perturbation) and MC Dropout/ Deep Ensembles when they fit; non-fitting methods are marked 0OM and excluded from runtime summaries. All baselines evaluated under identical quantization//untine conditions; the head-to-heat head results in Tables 21 and 23 and the corresponding curves in Figs. and 12
O.2 DECISION-CENTRIC PROTOCOL AND METRICS
Beyond AUROC/AUPRC, surface decision metries useful on-device: (i) Risk at fixed coverage
(80/90/95%) on CID streams (lower is better; reported in Tables 21 and [23] and visualized in
Figs. 11 and 12 (ii) AURC (area under the risk-coverage curve; Tables 21 23); (iii) Selective NLL conditioned on accepted samples at 90% coverage (Table 25); (iv) Clean-ID FPR at matched 90%
recall on event frames (Tables 22 24 For each method, the operating threshold chosen once on dev stream and then held fixed for test streams.
O.3 HEAD-TO-HEAD: CIFAR-10-6 10-C (STREAMING)
SNAP-UQ yields the lowest risk 80/90/95% coverage and the smallest AURC in the single-pass family (Table 21: the full risk-coverage traces are shown in Fig. []] At matched 90% event recall,
SNAP-UQ also achieves the lowest clean-ID FPR (Table 22
Table 21: Single-pass head-to-head on CIFAR-10-C streams. Risk at fixed coverage (lower is
better) and AURC. Thresholds fixed on dev and reused for test.
Method
Risk @8% J
Risk@90% +
Risk@95%
AURC
MSP / Entropy
0.154
0.124
0,112
0.118
Energy (T)
0.148
0.117
0.106
0.112
Mahalanobis @taps
0.141
0.113
0.102
0.109
ReAct
0.139
0.111
0.101
0.107
ASH
0.138
0.110
0.100
0.106
SNAP-UQ
0.127
0.104
0.096
0.099
SNAP-UQ
ReAct
Mahaattape
Energy
0.15
Eatropy
0.1
0.5
0.6
0.7
0.9
Coverage
Figure 11: Risk-coverage on CIFAR-10-C, Lower is better; compare with Table 21 for numeric points.
44

---

Published as a conference paper at ICLR 2026
Table 22: Clean-ID false-positive rate matched 90% recall on event frames (CIFAR-IO-C streams).
Method
FPR on clean ID +
Notes
MSP / Entropy
0.079
threshold fixed on dev
DEEP (Big-MCU)
0.065
single-pass comparison applicable Small-MCU
EE-ens (Big-MCU)
0.079
single-pass comparison not applicable on Small-MCC MCU same dev threshold. one pass
SNAP-UQ
0.042
O.4 HEAD-TO-HEAD SPEECHCOMMANDS (STREAMING)
On SpeechCmd-C. SNAP-UQ again achieves the best risk 80/90/95% coverage and the lowest AURC (Table 23): the fisk-coverage curves are shown in Fig. 12 Clean-ID FPR at matched recall is summarized in Table 24
Table 23: Single-pass head-to-head on SpeechCmd-C streams. Risk at fixed coverage and AURC.
Method
Risk 80% |
Risk@90% |
Risk@95%
AURC
MSP / Entropy
0.118
0.072
0.063
0.091
Energy (T)
0.112
0,067
0.059
0.087
Mahalanobis tapss
0.106
0.064
0.056
0.084
ReAct
0.104
0.062
0.055
0.083
ASH
0.103
0.061
0.054
0.082
SNAP-UQ
0.100
0.058
0.051
0.081
0.14
SNAP-UQ
0.12
ReAct
0.1
Maha
Risk
Entropy
8-10-
6-10-2
4 10
0.5
0.6
0.7
0.8
0.9
Coverage
Figure 12: Kisk-coverage SpeechCmd-C. Lower is better; the numeric points at 80/90/95% correspond to Table 23
O.5 REPRODUCIBILITY CHECKLIST
For completeness, we summarize the exact protocol that underlies Tables 21 25 and Figs.
Dev/test split: a single dev stream per dataset (ID - CID - OOD) for thrssholdhhemperrauu//eerr centile selection; test streams share the same composition but disjoint seeds.
Quantization: INTS weights per tensor; FP16 accumulators as needed: identical to section
Runtime: cycle-counter timing, 1,000 inferences averaged; interrupts masked; datasheet nominal clock.
Risk-coverage: coverage levels computed on test streams with the dev-fixed threshold; AURC by trapezoidal rule (as in Tables 21 23 and Figs. 12
FPR matched recall: event recall target 90% dev; FPR measured clean ID segments of test streams (Tables 22
24).
45

---

Published as a conference paper at ICLR 2026
Table 24: Clean-ID false-positive rate matched 90% recall on event frames (SpeechCmd-6 streams).
Method
FPR on clean
Notes
MSP/ Entropy
0.064
threshold fixed dev
Energy (T')
0.060
Mahalanobis@nan @taps
0.057
SNAP-UQ
0.031
one pass, same dev threshold
Table 25: Selective NLL conditioned accepted samples at 90% coverage (lower is better).
Method
CIFAR-IO-C4
SpeechCmd-C4
MSP / Entropy
0.368
0.226
Energy (T)
0.357
0.214
Mahalanobis @taps
0,349
0.208
ReAct
0.346
0.206
ASH
0.344
0,205
SNAP-UQ
0.339
0.182
P FROM THEORY TO PRACTICE: IMPLICATIONS AND EMPIRICAL VALIDATION
This appendix connects theoretical results deployable practice and provides targeted experi- ments that verify the predictions. We focus on three propositions from 2 (i) ceaprisal-likelhhen equivalence (Prop- 2.1 (ii) relation conditional Mahalanobis energies (Prop. 2.2 and (iii) affine (BN-like) invariance (Prop. 2.3 this corresponds to "Proposition 2.3" in the reviewer's s comment). For each, we (a) interpret the result operationally, (b) state a falsifiable hypothesis for deployment, and (c) validate with controlled measurements on MNIST, CIFAR-10, TinylmageNet, and SpeechCommands across aiig//Small-Mee backbones.
P.1 PROP 2.1 SURPRISAL (AFFINE TO) DEPTH-WISH NEGATIVE LOG-LIKEI.IHOOM
Implication for practice. The aggregate SNAP score S(x) is affine transform of the depth-wise NLL under the conditional model pa (1-1). Thus S(x) is calibrated ordering of per-example difficulty without requiring labels online. Two direct consequences: (1) threshold selection on small development split transfers across operating points, and (2) selective-prediction risk should be monotone in coverage when ranking by ((z).
Hypotheses. (HI) S(x) has high rank correlation with the true per-example negative lig-likelihood (NLL) measured offline ID and CID. (H2) Sorting by S(x) yields near-convex covercove curves and dominates entropy/MSP at moderate-to-high coverage.
Verification. We compute per-example NLL on held-out sets and compare S(x)) via Spearman's we also report the area under the risk-coverage curve (AURC; lower is better).
Table 27: Prop 2.1
verification: rank correlation and AURC. Spearman p between S(x) and per-example NLL on ID/CID, and AURC (lower is better).
Spearman (ID CID)
AURC (ID CID)
Dataset
SNAP-UQ
Entropy
SNAP-UQ
Entropy
MNIST
0.93 0.90
0.78/ 0.74
0.102 0.128
0.121 149
CIFAR-10
0.89 0.86
0.75 0.70
0.134 / 0.172
0.154/ 0. 0.196
TinyemageNet
0.86 0.82
0.71 2711/0.00
0.181 0.219
0.204 0.244
SpeechCmd
0,91 0.88
0.79 0.73
0.118 0.147
0.136 0.165
46

---

Published as a conference paper at ICLR 2026
Table 26: Notation & acronyms used in the paper. We define all symbols at first use and repeat the most common here for quick reference.
Term
Definition
ID
In-distribution data (same distribution as training).
CID
Corruted-in-diitrbbur
corruptions of ID).
OOD
Out-of-distribution (semantically different from ID).
ID -Ix
Binary task: correct vs. incorrect predictions on ID+ CID.
ID -DV-
Binary task: ID vs. OOD (semantic shift).
Tap (layer)
selected intermediate layer where attach small head. Low-rank map from 0y-1 to 2z. (e-g.. 1x1 conv or skinny linear).
Projector Ps.
Head gr
Tiny predictor outputting (He, log of for az. Standardized error [I( jue) @ og 112.
Surprisal et
S(z).U(a)
Aggregate surprisal: mapped uncertainty Batch Normalization.
BN
LUT
Lookup table (we use a 256-entry LUT for exponentials/scales). Microcontroller unit (TinyML. target). OOM: does fit in flash/RAM. Area under PR / ROC curve.
MCU
AUPRC/ / AUROC
Risk-coverage
Selective prediction trade-off:: error among accepted acceptance rate.
CMSIS-NN
ARM kernels used integer inference on MCUs.
Takeaway. The strong correlations and lower AURC confirm that SNAP's S(x) behaves like likelihood-base difficulty ordering, supporting threshold transfer and stable selective operation.
P.2 PROP 2.2 RELATION CONDITIONAL MAHALANOBIS ENERGIES
Implication for practice. Classical Mahalanobis uses unconditional, classwise centroids and shared covariance single layer. 2rop shows S(z) aggregates conditional layer-wise energies to the predicted next activation, making it sensitive to dynamics changes (e.g.. corruptions that disrupt layer-to-layer mappings) rather than only distances class means. We therefore expect larger gains on CID monitoring and IDV -IDx failure detection than on far-OOD that separable by marginal feature statistics.
Hypotheses. (H3) On CID streams, S(x) detects accuracy-drop events earlier (lower delay at matched precision/recall) than unconditional Mahalanobis at tapped layers. (H4) On far-OOD with clean low-level statistics (e.g., SVHN vs. CIFAR-10), Mahalanobis may match/exceed SNAP on IDV OOD AUROC, while SNAP remains competitive.
Verification. We compare event AUPRC and median detection delay on CID streams; and AUROC on ID/ OOD.
Table 28: 2rop verification; CID monitoring and IDV IDV-00M OOD.
CID monitoring (AUPRC + Delay 4)
ID- OOD (AUROC 1)
Dataset
SNAP-UQ
Maha @taps
SNAP-UQ
Maha@taps
MNIST MNIST-C
0.66
0.60
0.86
0.87
CIFAR-I0 10-C
0.70 27
0.64 / 36
0.94
0.95
TinylmageNer/ TIN-CC
0.62 / 31
0.57 / 39
0.90
0.90
SpecchCmd SpCmd-C
0.65 41
0.57 58
0.92
0.90
Takeaway. SNAP's condition-on-deple energy excels at process drift (CID), while unconditional Mahalanobis can remain strong on specific far-OOD settings, exactly as Prop 2.2 suggests.
47

---

Published as a conference paper at ICLR 2026
P.3 PROP 2.3
AFFINE (BN-LIKE) INVARIANCE AND ITS LIMITS
Implication for practice. If intermediate features undergo per-channel afline transforms (e.g.. BN scale/shift or fixed quantization rescaling). the standardized errors es and hence S(x) are invariant when the predictor co-adapts. Practically, this means SNAP is robust to (i) post-training BN folding and (ii) int8 per-tensor/per-caamie scaling, provided the head parameters are quantization-awe or re-fit with a brief calibration.
Hypotheses. (H5) Applying synthetic per-channel rescalings a' - @ dg + / (with realistic 8, I drawn from BN statistics) leaves 5(x)) -based rankings almost unchanged (Spearman p 1). (H6) Post-training BN folding and int8 quantization (heads) do not materially change CID AUPRC or IDV OOD AUROC after short calibration of the logistic/isotonic map.
Verification. We inject controlled rescalings at tapped layers and measure the delta in S(x) ranking; we then evaluate end-to-end with BN-folded and int8 heads.
Table 29: Prop 2.3 verification: invariance to BN-like rescaling and deployment transforms.
S(z) rank Spearman p
End to end metries (CID AUPRC OOD AUROC)
Dataset
BN-rescale
Int8 rescale
FP32
Int8 (recal)
MNIST
0.997
0.994
0.66 / 0.86
0.66 0.86
CIFAR-10
0.995
0.992
0.70 / 0.94
0.70 / 0.94
TinyImageNet
0.993
0.990
0.62 / 0.90
0.62 0.90
SpeechCmd
0.996
0.993
0.65 / 0.92
0.65 / 0.92
Takeaway. Rankings are essentially invariant, and end-to-end performance is unchanged after a brief map recalibration, supporting Prop 2.3 and explaining why SNAP ports cleanly to int8 MCU pipelines.
P.4 PRACTICAL DESIGN RULES INDUCED BY THE THEORY
The propositions produce concrete knobs for embedded deployments: (R1) Threshold portability. Because S(x) tracks NLL (Prop 2.1. calibrate single threshold small dev set and reuse it across similar conditions; for budgeted abstention, isotonic mapping preserves ordering and improves risk under tight budgets. (R2) Prefer taps that sense dynamics. Since conditional energies target layer-to-layer mappings (Prop[.22) favor a mid-block and the penultimate block; this maximizes sensitivity to CID while keeping cost low (see Appx. N.I. (R3) Quantize heads confidently. Affine invariance (Prop 2.3) and the observed stability in Table 29 justify int8 heads; use a short recalibration pass (few minutes dev data) refit the logistic/isotonic map if scales change. (R4) When semantics dominate OOD, consider hybrid. For far-OOD cases where unconditional separability is strong, combine S(x) with semantic OOD score (e.g., energy or Mahalanobis) in the tiny mapping; this preserves single-pass latency.
P.5 SUMMARY
Across four datasets and two MCU tiers, the empirical checks align with the theoretical predictions: S(x) behaves like a likelihood-derive difficulty measure, conditional energies excel at corruptedIDD monitoring versus unconditional baselines, and the score is stable to BN folding and int8 rescaling. These links clarify why SNAP-UQ performs well in the main results and provide concrete, low- overhead recipes for deployment.
Q TRAINING OVERHEAD AND STATISTICAL ROBUSTNESS
This appendix quantifies the incremental training cost of SNAP-UG relative to a baseline cross- entropy (CE) training loop and reports variance across multiple seeds.
48

---

Published as a conference paper at ICLR 2026
Q.1 COMPUTE AND MEMORY OVERHEAD
Let S be the tapped layers, de = dim((a)) and Ty the projector rank. For linear heads predicting (ne, log of) from žạ P 1, the additional parameters and per-step multiply-adds
#0, = 2dgre + 2dg (biases included).
(6)
FLOPs ~ (HeWe)re
2red (1x1+GAP projector).
(7)
With taps and re {64, 96), the total training FLOOPs overhead is typically 12% of the backbone for our TinyML. backbones, and the peak activation memory rises by 3-5% due to the extra ze and head activations. Quantized INT8 weights reduce parameter memory even during float training when fake-quantization is used.
Q.2 TWO TRAINING MODES
We provide two options:
(J) Joint training (default). Optimize L - Lott + Ass Css + Areg R end-to-end. We use Ass E [10 3 1.5100 3|; this preserves the CE convergence epoch while learning heads.
(P) Post-hoc heads. First train the classifier with CE only; then freeze the backbone and train the heads with stop-gradient on ag. This lowers overhead to ~ 2-33% compute and recovers 2 95% of the monitoring gains we observe with (J).
Q.3 STABILITY AND REGULARIZATION
To avoid variance collapse in log 2 we use a variance floor of 4 softplus(Ee) +c² and a scale penalty Ryar = =2, || log of Small Àss (10-3 ---1x1003 keeps gradients well conditioned. Detaching ag
within Lss (option "detach") halves across-seed variance with no significant change in means (see
Table 31
Q.4 RESOURCE ACCOUNTING (WALL-CLOCK, MEMORY, PARAMS)
We measured overheads on identical hardware, batch sizes, and optimizers.
Table 30: Training resource overhead vs. CE baseline. Mean over 5 runs; lower better.
Setting
Extra wall-time/epoch Extra peak mem.
Extra params
Notes
(I) Joint, r-64 (2 taps)
+8.3%
+3.6%
28 KB (INT8)
default
(J) Joint, r=96 (2 taps)
+11.7%
+4.8%
+42 KB (INT8)
higher rank
(P) Post-hoc, r- (2 taps)
+2.4%
+1.1%
+ KB (INT8)
frozen backbone
Q.5 STATISTICAL ROBUSTNESS ACROSS SEEDS
We expanded from to 10 seeds and report mean + standard error (SE) in the paper; full 95% bootstrap confidence intervals (1,000x) are provided here.
Table 31: Seed robustness. Mean + SE over 10 seeds; 95% Cls in brackets.
Datnee/MMatie
Reseline
QUTTR
Tay-DEFP
SNAP-11Q
CIEAR JO.C AUPRC1
0000 (0 (0.65.0.67
0.881100077 (0.67,0.69]
0.67-00008 (0.66.0.9)
0.70 006 (0.69
SpeechCard
39,0.91]
0.9110.004 [0.90.0.2]
0.9010..00
(0.93.095)
MNIST ECE (ID)
0.2200000 [0.020.0.034]
0.00::0.000 [0.01800022]
0.021:0.001 [0.019.0023]
0.01::0.0 [0.015
Q.6 LEARNING DYNAMICS AND CONVERGENCE
Learning curves show that CE convergence (epoch of validation- accuracy plateau) is unchanged by adding Ass 55x while the cwwdddrddzed-suuprrisie term stabilizes within 5-10 epochs with the variance floor. Figures of train/val losses and calibration traces are provided in Appendix
49


Reviews:
[{"review_id": "idHUvSe7Nu", "reviewer": "Reviewer_E8zC", "summary": "This paper addresses the problem of estimating prediction uncertainty in neural networks, with a particular focus on TinyML applications. The topic is especially relevant for edge-device deployment, where input distributions may shift after training. The authors propose a novel lightweight architecture that attaches to selected layers of a backbone network to estimate uncertainty for each prediction. This tiny module predicts the next activation in a layer-wise manner, enabling the computation of a surprisal score. The method is evaluated on both vision and audio tasks using several baseline models. Experimental results show that the proposed approach preserves task accuracy while substantially reducing flash memory usage and inference latency, demonstrating its strong practical value.", "questions": "- What are fundamental advantages of the proposed method over QUTE in paper [1] before? This question concerns both theoretial and empirical aspects.\n- How significant does the projector type effect the performance of SNAP-UQ?", "limitations": "", "rating": 4, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The concept of next-activation applied in a layer-wise manner is interesting and demonstrates strong empirical performance.\n- The proposed lightweight architecture achieves impressive results despite its extremely compact size (on the order of kilobytes).\n- The effectiveness of the approach is validated across multiple tasks using practical evaluation metrics and reasonable baselines, yielding consistently encouraging results.", "weaknesses": "- Despite its potential significance, the paper’s writing quality is problematic. It appears to have been heavily compressed—possibly with assistance from LLMs—resulting in missing definitions for key terms and notations (e.g., LUT, BN, ID$\\surd$-ID$\\times$, ID$\\surd$-OOD, $1\\times 1$ projector, ...). Some paragraphs even consist of a single sentence, making the paper difficult to follow.\n- Although a theoretical analysis is included, it lacks sufficient discussion of its implications. The authors should provide interpretations that link their theoretical results to practical insights, and possibly include experiments to verify the claims, such as empirically testing Proposition 2.3.\n- The comparative baselines appear outdated, raising concerns about the competitiveness of the proposed method. More recent approaches (e.g., [1]) should be discussed and included in the comparisons to strengthen the evaluation.\n\nReference:\n\n[1] Ghanathe, N. P., & Wilton, S. J. QUTE: Quantifying Uncertainty in TinyML models with Early-exit-assisted ensembles for model-monitoring. In Forty-second International Conference on Machine Learning, 2025.\n\n[2] Ahmed, S. T., Hefenbrock, M., & Tahoori, M. B. (2024). Tiny Deep Ensemble: Uncertainty Estimation in Edge AI Accelerators via Ensembling Normalization Layers with Shared Weights. The 43rd IEEE/ACM International Conference on Computer-Aided Design.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cLW5GjvN35", "reviewer": "Reviewer_E2rF", "summary": "This paper is about uncertainty estimation in the context of Tiny ML, in particular this paper proposes an uncertainty estimation method based on predicting activations of some intermediate layers, from where an uncertainty score can be produced and transformed into a probability via platt scaling. This method is particularly designed for TinyML setups such as microcontrollers.\n\nThe contributions are:\n- The SNAP-UQ method for uncertainty estimation in a TinyML context using a depth-wise surprisal signal.\n- An MCU-ready implementation of the proposed method.\n- Results for both ID and OOD detection performance on MNIST, CIFAR10, and SpeechCommands datasets showing the advantages of the proposed method.", "questions": "- The proposed pipeline has a lot of steps, one being probability calibration with platt scaling, did you test if this step is necessary? What about using the raw score in Eq 9 as an uncertainty metric (I know its not a probability).", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "- The paper is mostly well written and clear.\n- Uncertainty in TinyML is an important open problem, there are not many papers in this area, so a new method and new state of the art are welcome.\n- I believe the idea of predicting layer activations to produce uncertainty makes sense, this connects with previous ideas in the field like depth uncertainty and early exit ensembles. And the proposed method is specifically designed for TinyMl applications, which I believe is novel and significant.\n- The evaluation is mostly good, there is a good selection of datasets, baselines, metrics, and microcontrollers platforms,\n- Overall the conclusions are robust, that SNAP-UQ works best or is very competitive in terms of calibration, OOD detection and misclassification detection, producing a new state of the art for uncertainty estimation in TinyML.\n- There is a good amount of appendices with relevant details and proofs of the proposed method being similar to existing methods, strengthening the proposed method and its usability.", "weaknesses": "- Some parts of the paper are hard to follow due to lots of mathematical notation, this is mostly in Sec 2.2 specifically at Eq 10 where the notation breaks. Overall I would recommend to the authors to try to minimize the necessary notation and to repeat the definitions of key notation in the paper, and try to explain concepts together with the math, this will make the paper much easier to understand and to implement.\n- The paper claims results on TinyImageNet but the results are nowhere in the paper or the appendix, this weakens the claims slightly.\n- The interesting ablation results are weak, by this I mean the hyperparameters that are relevant to the proposed method, which are presented in Appendix N, the authors showing the effect of the number of taps and the projector rank, but specifically for the number of taps only two taps are made, and I believe it would be interesting to try more taps and see if uncertainty improves.\n- It would also have been interesting to try the huber and student's t-distributed variants, these are not explored in the experiments of this paper.\n- In Table 1, to me it is not clear which model/method is denoted as \"BASE\", if its the baseline model without uncertainty estimation, I do not see how it could have higher latency and storage/RAM usage than when using SNAP-UQ, since SNAP-UQ slightly adds computation and memory use. Please clarify.\n- In Figure 1, the definition of S(x) in the figure differs from Eq 9, the weights are missing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8kHni9Kekv", "reviewer": "Reviewer_Kkbw", "summary": "This paper proposes SNAP-UQ, a single pass uncertainty estimation method for TinyML. The approach taps a small number of intermediate layers, predicts the mean and (diagonal or low rank + diagonal) variance of the next layer’s activations with a small INT8 head, and computes the standardized squared error (surprisal) between the prediction and the actual activation. Summing per layer surprisal yields a single pass uncertainty score $S(x)$, which is then converted to $U(x)\\in[0,1]$ via a monotone mapper (logistic or isotonic) for monitoring and selective prediction. The authors argue that $S(x)$ is an affine transform of the depthwise negative log likelihood (a conditional Mahalanobis energy) and is invariant to batch normalization like channel rescalings. On real MCUs (Big and Small configurations), SNAP-UQ reduces latency, flash, RAM, and energy while improving corrupted stream detection (AUPRC and detection delay), failure detection (ID correct versus ID error, and ID correct versus OOD), and risk coverage. It is roughly 25 to 35% faster and 40 to 60% smaller than lightweight ensemble baselines, and continues to run where others run out of memory on Small MCU. The paper includes ablations on tap placement and rank, INT8 quantization, mapping choices, and head to head comparisons among single pass methods.", "questions": "1. **Could you provide reusable visualizations for tap selection?**: \n   Specifically, a surprisal correlation matrix among candidate layers (to show redundancy vs. distance), diminishing-return curves of performance versus the number of taps, and a leave-one-tap-out table. This would substantiate why two to three taps suffice and facilitate porting to new backbones.\n\n2. **Could you report the datasets and tuning rules for Student-t and Huber?**: \n   Please specify the evaluated datasets, the grids for \\nu and \\delta, and the selection metrics. Include a comparison table (Gaussian vs. t vs. Huber) with AUROC/AUPRC, risk@coverage, AURC, FPR, recommended defaults (e.g., \\nu=5, \\delta=1.5), notes on stability (\\nu fixed or learned; shared or per tap), and implications for INT8 implementation.\n\n3. **Could you visualize the sources of the speedups?**: \n   Please add a stacked-bar breakdown of per-layer time, bandwidth, and temporary buffers for SNAP-UQ and the lightweight early-exit ensemble, with measurement conditions clearly stated, to clarify where the 25–35% latency difference arises.\n\n4. **Could you promote the mapping choice to the main text and include a brief recipe?**: \n   For example, recommend isotonic for fixed-coverage monitoring and logistic when in-distribution calibration is the priority, and indicate whether combining S with a margin or confidence feature, m, is recommended by default.\n\n5. **(Optional) Could you provide minimal-configuration guidance?**: \n   For extremely tight SRAM budgets or when intermediate activations are inaccessible, please include a small table for a minimal setup (e.g., pre-logits only, low rank such as r=32) showing latency, flash, and FPR trade-offs.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The main strength is the shift from output layer confidence to violations of conditional layer to layer dynamics as the basis for uncertainty, captured in a single forward pass without labels, with only tens of kilobytes of added memory and about $2%$ extra MACs, making it suitable for MCUs. Light theoretical support, namely the equivalence to depthwise negative log likelihood and conditional Mahalanobis energy and scale invariance under batch normalization like rescaling, grounds the intuition that softmax confidence tends to degrade later, whereas inter layer dynamics deteriorate earlier. Empirically, the work is careful on deployment metrics (latency, flash, peak RAM, energy on device) and on decision centric metrics (AUPRC and detection delay under stream corruption, AUROC for ID correct versus ID error and ID correct versus OOD, risk coverage curves, FPR). The ablations, including leave one tap out, rank sensitivity with diminishing returns around $r\\approx 64$, INT8 quantization, and logistic versus isotonic mapping, are directly useful to practitioners. Overall, while the theory is intentionally lightweight, the design is coherent and the practical benefits for TinyML monitoring are clear.", "weaknesses": "1. **Tap placement feels ad-hoc.**:\nTwo taps (mid / pre-logits) seem to work—but moving to a new backbone still feels like guesswork. A tiny, illustrative check would help: a quick cross-layer correlation sketch to show how signal fades with distance, plus a short “one-tap-removed” table that makes redundancy visible.\n\n2. **Where the latency gains come from is not entirely clear.**\nWhile fairness is addressed, the source of the speedup is less so. Could you add a single stacked-bar breakdown—*backbone convolutions | tap projection/head | classifier | memory I/O*—and report the measurement conditions (fixed clock, CMSIS-NN, averaging protocol)? This would make the narrative clearer and explain why the advantage typically falls in the tens-of-percent range.\n\n3. **Distributional variants (Student-t / Huber) aren’t yet actionable.**:\nThe math is there; the “when and how” is not. A small, concrete aid would do: a compact comparison on images and audio; a brief note on sensible defaults (e.g., workable (\\nu) and (\\delta) and the selection rule); and a line on stability (fix vs. learn (\\nu), share across taps, INT8/LUT implications). With that, these variants become tools rather than curios.\n\n**(Minor)** “Self-supervised” here refers to label-free auxiliary regression for uncertainty, not representation learning; a one-sentence clarification in the introduction would avoid confusion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8hdf5eUGqG", "reviewer": "Reviewer_PNa3", "summary": "This work introduces SNAP-UQ, a single-pass, label-free uncertainty method for TinyML. SNAP-UQ maps a single forward pass depth-wise next-activation prediction, int8 heads uncertainty forecaster that drops neatly into CMSIS-NN pipelines and fits within kilobyte-scale MCU budgets. Results show SNAP-UQ improves accuracy-drop monitoring on corrupted streams, remains competitive on OOD failure detection, and strengthens ID calibration without temporal buffers, auxiliary exits, or extra passes.", "questions": "- Can the proposed method be applied for larger-scale ML settings, such as ResNet-50 with ImageNet?\n- In part 4.4, have the authors tried calibration on OOD data, such as on CIFAR-10-corrupted?\n- In the experiments, the authors only show the accuracy drop or failure **detection** performance, but haven't shown what the actual accuracy drop or failure level actually is. Could the authors add accuracy results to Table 2 and Table 3?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper is well-written and solid, with a new method, theoretical, and empirical contributions.\n- The proposed method is empirically deployed across audio and vision tasks, with significant improvement over early-exit and deep ensembles baselines in reducing flash and latency. \n- Beyond memory and latency improvement, it also improves accuracy-drop detection in corrupted streams by AUPRC and maintains strong failure detection with AUROC in a single pass.", "weaknesses": "- There is a computational limitation in training when compared to the standard cross-entropy loss. Specifically, the training objective requires jointly training with additional terms. It requires back-propagating with an additional label-free auxiliary loss and either a variance floor, scale control, or detach option loss.\n- The experiments are reported with only three fixed seeds. The results are reported without variance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)