Robust Adversarial Quantification via Conflict-Aware Evidential Deep Learning
Authors: Charmaine Barker
Daniel Bethell
Simos Gerasimou
Venue: ICLR 2026 Poster (2026)
Keywords: Uncertainty Quantification
Adversarial Attack Detection
Evidential Deep Learning
Primary area: probabilistic methods (Bayesian methods, variational inference, sampling, UQ, etc.)
TL;DR: C-EDL boosts robustness in Evidential Deep Learning by detecting conflict from input transformations, improving OOD and adversarial detection without retraining, while keeping high accuracy and low overhead.

Abstract: Reliability of deep learning models is critical for deployment in high-stakes applications, where out-of-distribution or adversarial inputs may lead to detrimental outcomes. Evidential Deep Learning, an efficient paradigm for uncertainty quantification, models predictions as Dirichlet distributions of a single forward pass. However, EDL is particularly vulnerable to adversarially perturbed inputs, making overconfident errors. Conflict-aware Evidential Deep Learning (C-EDL) is a lightweight post-hoc uncertainty quantification approach that mitigates these issues, enhancing adversarial and OOD robustness without retraining. C-EDL generates diverse, task-preserving transformations per input and quantifies representational disagreement to calibrate uncertainty estimates when needed. C-EDL's conflict-aware prediction adjustment improves detection of OOD and adversarial inputs, maintaining high in-distribution accuracy and low computational overhead. Our experimental evaluation shows that C-EDL significantly outperforms state-of-the-art EDL variants and competitive baselines, achieving substantial reductions in coverage for OOD data (up to $\approx55\%$) and adversarial data (up to $\approx90\%$), across a range of datasets, attack types, and uncertainty metrics.

Published as a conference paper at ICLR 2026
ROBUST ADVERSARIAL QUANTIFICATION VIA CONFLICT- AWARE EVIDENTIAL DEEP LEARNING
Charmaine Barker ,, Daniel Bethell ' Simos Gerasimou 39
4 Department of Computer Science, University of York, UK S Department of Flect. Eng., and Computer Science and Eng., Cyprus University of Technology, Cyprus (cha rma meeiine.a baakke,,, Baniel.betheile bethell, s simos. gewasierrmmmmooo 8york. ac.uu
ABSTRACT
Reliability of deep learning models is critical for deployment in high-stakes ap- plications, where out-of fittoff-disributiinn or adversarial inputs may lead to detrimental outcomes. Evidential Deep Learning, an efficient paradigm for uncertainty quan- tification, models predictions as Dirichlet distributions of single forward pass. However, EDL is particularly vulnerable to adversarially perturbed inputs, mak- ing overconfident errors. Conflict-aware Evidential Deep Learning (C-EDL) is lightweight post-hoc uncertainty quantification approach that mitigates these issues, enhancing adversarial and OOD robustness without retraining. C-EDL generates diverse, task- pess-prrseriing transformations per input and quantifies representational disagreement to calibrate uncertainty estimates when needed. C-EDL's conflict- aware prediction adjustment improves detection of OOD and adversarial inputs, maintaining high in-distribution accuracy and low computational overhead. Our experimental evaluation shows that C-EDL significantly outperforms state-of-the- art EDL variants and competitive baselines, achieving substantial reductions coverage for OOD data (up to x 55%) and adversarial data (up to zs 90%), across a range of datasets, attack types, and uncertainty metrics.
INTRODUCTION
Advances in Artificial Intelligence (AI) have led to impressive performance in diverse domains such as computer vision (Dosovitskiy et al. 2020) and natural language processing (Achiam et al. 2023). Yet in high-stakes applications, such as healthcare (Seoni et al.) 2023 Loftus et al. (022) and autonomous driving (Wang et al. 2025 2023). ensuring AI model reliability is critical for trustworthy decision-making. In such settings, models must recognise when their predictions are uncertain, particularly in the presence of out-of oi-tt--distiibttion (OOD) inputs, which differ significantly from the training distribution, and adversarial input that are subtly perturbed to mislead the model.
Uncertainty Quantification (UQ) is core research area (Abdar et al., 2021) aimed at equipping models with the ability to recognise when their predictions may be unreliable. In particular, UQ seeks to capture two uncertainty types: aleatoric uncertainty, arising from inherent noise in the data, and epistemic uncertainty, stemming from limited or biased training data (Marco et al. 2025). Popular UQ approaches include Bayesian neural networks (Goan & Fookes 2020). variational inference (Blei ctt al. 2017), and Laplace approximations (Fortuin) 2022), which provide principled uncertainty estimates but often at significant computational cost. More scalable approaches. like Monte Carlo Dropout (Gal & Ghahramani 2016), deep ensembles (Lakshminarayanan et al.) (017). and test-timm time augmentation (Ayhan & Berens 2018), trade accuracy or interpretability for efficiency, while hybrid approaches capture both uncertainty types simultaneously and seek appropriate performance trade- off's (Pearce al.) 2018, Angelopoulos et al.) (003).. Despite their merits, these alternative approaches are too costly for use in dasource-constraine environments, demanding more lightweight solutions that can support the explicit efficiency and resiliency needs of edge Al-based systems (Moskalenko
et al. 2023
Evidential Deep Learning (EDL)(Sensoy et al. 2018) is an efficient altemattve UQ paradigm by modelling class probabilities with Dirichlet distribution, enabling simultaneous capture of epistemic
"Equal Contribution

---

Published as a conference paper at ICLR 2026
and aleatoric uncertainty in single deterministic pass. This unique EDL characteristic makes it well-suited for
detecting OOD imputs (Figurd and for deploy- ment real-time or resource- resource-constrained settings. However, its deterministic nature can lead over- confident predictions under adversarial perturba- tions. Recent extensions
ID Data
OOD Data
4
7
EDL (Deng al. Qu et al. 2024] Chen et al. 2024 Yoon & Kim 2024) aim to reduce overconfidence by en- couraging alternative uncertainty estimation strate- gies.
EDL
0.060
0.084
0.095
0.066
0.100
2023
0.081
0.096
0.201
Figure I: Uncertainty on ID (MNIST) vs. OOD (FashionMNIST), Both methods stay low on ID, C-EDL. assigns higher values OOD where EDL remains low.
While these improve OOD detection, gradient- based adversarial attacks can still mislead the model into treating inputs as in-distribution (ID), as illustrated in Figure 2 Post-hoc ap- proaches (Yang et al. 2022) offer a promising alternative by decoupling uncertainty estimation from model training, making them more robust to such attacks and easier to deploy. For instance, Smoothed EDL (Kopetzki al. (02I). regularises predictions against local perturbations to boost adversarial robustness. However, despite improve- ments, the approach continues exhibit significant overconfidence under adversarial perturbations, indicating a clear need for more effective post-hoc defences that maintain the efficiency advantages of EDL.
We introduce Conflict-aware Evidential Deep Learning (C-EDL), lightweight post-hoc ap- proach that enhances out-of-distribttion (OOD) and adversarial detection by operating on pre- trained EDL models. Inspired by the Dempster- Shafer theory (DST) principle that aggregating multiple sources of evidence yields more reliable beliefs (Shater) 1976), C-EDL generates diverse views of the input and quantifies distributional disagreement to increase predictive uncertainty when appropriate. This mechanism retains in- distribution (ID) accuracy while boosting robust- ness OOD inputs and adversarial perturbations. We conduct extensive experiments across vari- ous ID/OOD datasets, near- and far-OOD scenar- ios, and both gradient- and non non-gradient gradient-based attacks at multiple perturbation strengths. C-EDL achieves sate-of-theearr results across the board, reducing OOD coverage by up to 55% and adversarial coverage by up z 90%, while pre- serving ID accuracy with minimal reduction in ID coverage.
Figure 2: Evidence on a FashionMNIST OOD input under increasing L2PGD perturbations. Solid bars: EDL, gridded bars: C-EDL, dotted line: IDD threshold. C-EDL stays low un- der attack, while EDL misclassifies as ID.
Our key contributions are: (1) the C-EDL post- hoc approach for enhancing EDL-based uncertainty estimation; (2) theoretical guarantees the robustness of our conflict- awareness measure; and (3) comprehensive benchmarking across diverse datasets, decision thresholds, and adversarial attacks, demonstrating that C-EDL reduces coverage for OOD and adversarial data up to 55% and 90%, respectively, significantly outperforming state-of- the-art EDL variants and competitive approaches.
2 RELATED WORK
Uncertainty Quantification. Uncertainty quantification (UQ) is essential for improving the re- liability of deep learning models, particularly in safety-critical applications (He & Jiang (023). Epistemic uncertainty commonly addressed by estimating distributions over predictions, with
2

---

Published as a conference paper at ICLR 2026
Bayesian neural networks (Goan & Fookes 2020). variational inference (Bli et al. 2017). and
Laplace approximations (Fortuin [022] offering principled but computationally expensive solutions. Scalable alternatives such as Monte Carlo Dropout (Gal & Ghahramani (016), deep ensembles (Lak)
shminarayanan et al. 2017). adversarial perturbations (Schweighofer et al. 2023), and distance-aware
models (Liu et al.) 2020 Van Amersfoort et al. 2020) come with trade-offs in expressiveness or efficiency. Alcatoric uncertainty is typically modelled through discriminative methods predicting input-dependent variability (Kendall & Gal 2017; Guo al. 2017), non-parametric prediction inter- vals (Khosravi et al. [2100] lagasovska & Lopez- Paz 2019), or generative models that reconstruct data distributions (Kingma et 2013; Goodfellow et al. 2014). Test-time augmentation (Ayhan & Berens 2018) offers a simple, model-agnostic alternative but does not explicitly separate uncertainty types. As both uncertainty types can coexist, often most effective to model them simultane-
ously (He & Jiang 2023). Hybrid approaches, like ensembles with prediction intervals (Pearce et al., 2018) or conformal prediction (Angclopoulos et al., [023 Bethell et al. 2024), albeit modelling both uncertainty types, they often incur high computational cost require additional calibration.
Evidential Deep Learning. Evidential deep learning (EDL) leverages Dempster-Shafer theory (DST) (Dempster 1968) quantify uncertainty in single forward pass. EDL models class probabil- ities using a Dirichlet distribution, where the model produces non-negative evidence for each class. The approach uses single forward pass estimate both epistemic and aleatoric uncertainty, making it computationally efficient. The full mathematical formulation of EDL is provided in Section 3 EDL effective for out-of-distribution (OOD) detection, as learns to avoid overconfident predictions on uncertain inputs, typically by thresholding uncertainty metrics such as mutual information or differential entropy. However, because it relies on a single deterministic forward pass, it cannot benefit from multiple stochastic perspectives of the same input as seen in methods like Monte Carlo Dropout or deep ensembles. As result, if the model makes an overconfident error, cannot correct for it, limiting its performance especially under adversarial perturbations where stronger uncertainty signals are often needed (Kopetzki et al. 202T). Figure exemplifies this effect, where higher levels of L2 perturbation sees the EDL model seeing the OOD input as in-distribution (ID).
Subsequent work has extended EDL to improve OOD detection, with methods primarily proposing refinements that enhance the model's ability to recognise unfamiliar inputs (Deng et al. 2023 Qu
et al. 2024 Chen et al., 2024, Yoon & Kim 2024). However, these approaches largely retain EDL's main limitation under adversarial perturbations, they do not address the deterministic nature of single-pase uncertainty estimation. Smoothed EDL (S-EDD)(Kopetkkt et al. 202T) is one of the few methods that explicitly targets adversarial robustness by regularising predictions against local input perturbations, but it does not fully resolve the issue, particularly against stronger attacks. There a clear need for an improvement to EDL that thoroughly addresses adversarial robustness while remaining lightweight and computationally efficient. Post-hoc approaches have also been shown to outperform approaches that modify the training process, offering developers easier integration into existing systems (Yang et al.) 2022] Barker et al. (205),, and additionally allowing uncertainty improvements to be applied flexibly across a wide range of pre-trained models without retraining. To this end, the C-EDL approach introduced in this paper is designed to meet all these requirements.
3 PRELIMINARIES
We consider the standard supervised classification setting, aiming to learn a predictive model over a finite set of class labels. Let X' C Rd denote the input space and y = (1,..., . K) the label space with K classes. Given a dataset D = {a;, y: ) where each pair (æz, y:) E X' x y is sampled i.i.d. from an underlying distribution p(æ., y) = p(x) ply w)), the objective is learn the class-conditional probabilities p(y z). In addition to making accurate predictions, we are interested in quantifying the model's predictive uncertainty. In this work, we focus exclusively on the classification case.
EDL models class probabilities using a Dirichlet distribution, parameterised by a = [a....., ak]
Given an input æ, a neural network produces Dirichlet parameters a% = c + 1, where e₁ 2 represents the evidence collected for class k. The belief mass and uncertainty are derived as
OAk S
K
by
u
S
where is the Dirichlet strength defined by S = k= 0g A higher S corresponds to stronger model confidence, leading sharper probability distributions. The Dirichlet distribution itself is
EK
3

---

Published as a conference paper at ICLR 2026
Input Data
Evidence
EDL Output
Impoit
0000 lngurt
Augment Input
Conflict Adjustment (Eq. 5-10)
1
Augmented Input Data
000
Evidence Sets
C-EDL Output
Figure 3: Overview of Conflict-aware Evidential Deep Learning (C-EDL) approach, with its key post-hoc steps that advance regular EDL highlighted in blue. For each new input, C-EDL performs metamorphic transformations, yielding a subel-preservingg evidence set, and then executes conflict adjustment on the accumulated evidence to calibrate the final prediction. When applied to in- distribution inputs, C-EDL closely matches the original EDL output, while given out-of-distributioo inputs, C-EDL amplifies uncertainty to better reflect model disagreement.
expressed
T(S)
K
Dir(p ()) =
II RL-
(2)
((as)
k=1
where (-)) is the gamma function. The expected class probability, corresponding to the mean of Dirichlet distribution, is
Elps]
S
While EDL allows for uncertainty estimation in a single forward pass, it struggles with out-of- distribution detection and adversarial robustness. The reliance on a single prediction can lead to overconfident outputs for unseen samples, as the method does not explicitly account for inconsisten- cies evidence when the input is perturbed or transformed.
4 C-EDL
Our Conflict-aware Evidential Deep Learning (C-EDL) approach, whose high-level workflow is shown in Figure improves robustness to OOD and adversarially attacked inputs. Motivated by the DST principle that multiple sources of evidence yield more reliable beliefs (Shafer) 1976). C- EDL generates diverse views of each input through label-preserving metamorphic transformations. coalesces the resulting evidence sets, and quantifies their discernment. When conflict detected across these views, C-EDL reduces the overall evidence to signify greater uncertainty. resulting in better detection of OOD and adversarially attacked inputs without affecting the ID data detection and accuracy.
4.1 INPUT AUGMENTATION AND EVIDENCE SET GENERATION
To generate diverse set of evidence for given input, C-EDL applies a set of metamorphic transfor- mations { Tr to an input instance where each transformation satisfies the label-preserving constraint f' (I)) f"
< S T. Each Tı (x: serves as a distinct but semantically equiv- alent view of the original input. Since each 7: is sabel-preserving a model that has learned robust decision features should produce consistent evidence across (x))) Since the EDL Dirichlet output already encodes both epistemic and aleatoric uncertainty, cross-view disagreement is used as a post-hoe stability check that primarily indicates instability in the epistemic component (i.e., brittle insufficient knowledge) while preserving the underlying uncertainty representation. Any transformation-induue induced stochasticity is kept small by bounding augmentation intensity, see Table [I] Although these transformations induce only small changes in input space, they yield substantially
4

---

Published as a conference paper at ICLR 2026
different responses in the model's 's internal feature representations due its sensitivity local struc- ture (Goodfellow et al., 2016). This property enables C-EDL to probe the stability of the model's beliefs under controlled, Inttumntteedeted perturbations, offering principled way elicit and assess representational discernment and disagreement. These transformations span an equívalence class of inputs that share the same label under the ground-truth function ,, but differ in their statistics at the input level; for instance, in the case of images, the difference would be at the pixel-level. Since the pretrained evidential model may be susceptible to spurious features or lack generalisability capabilitiies to transformation invariance, its outputs across (T) } can differ, providing signal of uncertainty that we later quantify through conflict analysis and adjustment.
Each transformed instance (2) is independently passed through pretrained evidential model, (t) which produces corresponding Dirichlet vector (*)) (a (t) ag where each d en- codes the strength of belief assigned to class k. This results in a set of T evidence sets A = {a(11, (2)),... (T)), which captures the model's output variability across representational shifts in the input data.
4.2 CONFLICT ADJUSTMENT
After collecting diverse evidence sets A, we quantify disagreement across these views through two complementary measures of conflict: intra-class variability and inter-class contradiction. Using disagreement across multiple views as reliability cue is conceptually aligned with prior work in multi-view learning (Xu al. 2024). However, the ECML approach is orthogonal as it assumes distinct input views (e.g., an image and its caption), trains a separate evidential model per view, and uses conffict among confident but divergent view-specific predictions during training. In contrast, C-EDL is post-hoc and needs single modality, inducing views at test time via label- prebeepregg transformations and measuring conflict in evidential space. Intra-class variability captures how much the evidence for each class fluctuates across the applied transformations. For each class k (t) the standard deviation and mean of the Dirichlet parameters O'k across the transformations T. The coefficient of this is then averaged across all classes:
K K
dla DE k= (1 (Z)) +
1
Cintra
where (-)) and p(-) denote the standard deviation and mean respectively. and is small positive constant used for numerical stability. In particular, c prevents division by zero by ensuring the denominator is strictly positive, which used Appendix when establishing boundedness and continuity of Cinta- The rationale underpinning Cintra that its value increases when the model assigns inconsistent beliefs to the same class across the performed transformations.
Inter-class conflict measures instances where the model supports competing classes (e.g., two or more classes have equally high probability/cciddneee) highlighting cases where the model is unsure about its prediction. For each set of Dirichlet parameters 0g
(1) the pairwise contradictions between classes
and j are computed, highlighting cases where both classes are supported with high evidence. This is formalised as:
Cinter T
Σ
Σ
c-cxp
exp
Σ 11
min(a aa)))
min(a ( x
.a
(1)
})) (5)
max(a (C) (0) Σx o (0)
where 3 > a scaling parameter that adjusts the sharpness of the penalty assigned to the contradiction, and the final multiplication by 2 ensures the combined term is bounded within [o, 1]. We design Cinter to symmetric, bounded, and to increase only when competing classes are both (i) similarly supported and (ii) supported with non-trivial evidence. The ratio term captures the relative balance between classes, while the strength normalisation penalises contradictions arising from uniformly low evidence. Simpler formulations overstate conflict under uniformly low evidence: Eq. ils is a minimal construction that avoids this edge case while remaining tractable for Theorem [
To obtain the final measurement of conflict, both terms are combined into single total score C:
C Cinter + Cintra Cinter CinterCimta
X(Cimer
Cintra
(6)
5

---

Published as a conference paper at ICLR 2026
using the neclusion-exclusionn principle, which ensures combined measure of conflict by accounting for overlap between Csntra and Cinerr where [o, 1] controls the penalisation of asymmetric disagreement. This formulation ensures C' (0, 1] tends towards 0 if and only if all transformations produce identical Dirichlet parameters concentrated on single class, and increases monotonically with either source of conflict.
Theorem The conflict measure C bounded between (0, tends towards 0 if and only if all transformations produce identical Dirichlet parameters concentrated on a single class, and monotonically non-decreasing with increasing intra and inter-class conflict with X [0, z).
See the corresponding proof in Appendix This conflict score C serves the basis for the post-hoc uncertainty augmentation and evidence reduction of C-EDL. Firstly, the Dirichlet parameters across all transformations aggregated:
T Σ t=1
0kk
4k: E (I,...K}.
C-EDL applies an exponential decay to each element of the aggregated Dirichlet parameters, specifi- cally, each parameter on is scaled to reduce overconfident predictions when high conflict is detected and preserve predictions when low conflict detected:
0g = āg x exp(-6C).
(8)
where 5 > 0 is tunable hyperparameter controlling the sensitivity of the adjustment. This decay operation ensures that the shape of the original distribution remains unchanged, while the magnitude of the evidence is reduced proportionally to the conflict. Doing so retains the model's most likely prediction but expresses reduced certainty. The remaining EDL calculations, specifically the Dirichlet strength, belief per class, uncertainty mass, and expected probabilities, are only modified to use the reduced Dirichlet parameters:
ā 1
K S
0% $
$
b
E
(9)
S
In cases where the conffict is high, the total Dirichlet strength Š is reduced and, consequently, the uncertainty mass ū is amplified. In contrast, when conflict is low, the total Dirichlet strength $ resembles the original strength S and uncertainty is therefore minimally affected.
5 EVALUATION
We evaluate C-EDL in a comprehensive series of experiments comparing it against state-of-the-an EDL-bbsed and other competitive UQ approaches over 10 independent runs. Our evaluation focuses on both performance and uncertainty estimates produced per approach for OOD and adversarially attacked data. The C-EDL code and replication package are available at our open-source repository
Comparative Approaches. We compare C-EDL against Posterior Networks (Charpentier et al. 2020), Evidential Deep Learning (EDL) (Sensoy et al., 2018), Fisher Information-based EDL (I- EDL) (Deng et al. (023), Smoothed EDL (D-EDL) (Kopetzki et al.) [222]). Hyper-Opinie EDL (H-EDL) (Qu et al. 2024 Relaxed EDL (R-EDL) (Chen et al.) 2024). 4). and Density-Awart EDL
(DA-EDL) Yoon & Kim 2024 represent range of approaches in EDL and UQ that allow for fair comparison.
Datasets. Adopting the procedure EDL-based evaluation from recent research (Dngg al. 2023 Chen et al., 2024), we evaluate all approaches on the MNIST (LeCun et al.) 1998). Fash-
ionMNIST (Xiao al. 2017). KMNIST (Clanuwat al. 2018), EMNIST (Cohen et al. 2017)
CIFAR10 (Krizhevsky et al. 2009), CIFAR100 (Krizheskyy et al. 2009). SVHN (Netzer et al. 2011
Oxford Flowers (Netzer et al. 2011)) Deep Weeds (Olsen al. (019). Tiny- -mageNett (Le Yang
2015), and CUB Welinder et al. 2010)) datasets which were selected to cover a diverse set of domains
Our open-source repository is available http://gituuh.com/aammdmiiii

---

Published as a conference paper at ICLR 2026
111
2441
F.Forciell briwy
p briway
Offereniaal Diirssy
Oetenettll Ehbrry
Figure 4: Visualised adversarial AUROC plots including the binary decision threshold for OOD/Adv rejection, for comparative methods where the IDD dataset is MNIST and the OOD dataset is Fashion- MNIST. Full plots are in Appendix B.1
and challenges. In the following experiments, near-OOD datasets are those that share some degree of class overlap with the ID dataset (Yang et al. 2022).
Alongside C-EDL,, we evaluate three variants isolate component effects: EDL++ which omits conflict adjustment and averages Dirichlet parameters after imput transformations: and MC versions of both EDL++ and C-EDL, denoted EDL++ (MC) and C-EDL (MC), which replace metamorphic transformations with Monte Carlo Dropout for diverse evidence. Full training, hyperparamettrss attack setups, and datasets are detailed in Appendix (Table E and assess
C We also compare C-EDL to other UQ methods with CUB few-shot on ResNet50 (Table [ Appendix [.II.
Training and inference time results are in Appendix B.4
5.1
CORE RESULTS
For our set of experiments, evaluate the accuracy, ID coverage, OOD detection, including both near- and far-OOD settings, and adversarial robustness of both C-EDL and its variants and comparative baselines across diverse suite of ID/OOD dataset pairs, in order to assess overall reliability under distributional shift and attack. These results are summarised in Table [ad further analysis can be found in Appendix [.I]] We report both coverage and AUROC: coverage gives the acceptance rate at fixed abstention threshold (a single operating point), while AUROC summarises separability across all thresholds (Figure
Firstly, across all datasets, every approach (including C-EDL and its variants) maintains near-ceiling accuracy across all datasets (e.g., 95.99%) showing that none of the UQ approaches compromise classification performance on clean ID data. This key outcome provides concrete evidence reassuring that any observed gains robustness through using C-EDL are not due to underlying degradation in classification performance in ID data.
In terms ID coverage (the proportion of ID inputs retained after abstention), approaches such as EDL, H-EDL, and R-EDL attain higher coverage (< 96% on MNIST - FashionMNISTT), but this comes at a cost of worse or only marginal improvement in OOD and adversarial coverage. This shows that there still remains large overconfidence in predictions. In contrast, C-EDL and its variants, offer a significantly better trade-off. More specifically, C-EDL achieves a substantially lower OOD and adversarial coverage, often halving, tripling or more compared to state-of-the-ard approaches, with only a marginal reduction in ID coverage. For example, on the MNIST - FashionMNIST datasets pair, EDL achieves an adversarial coverage of 52.21% + 9.49 whilst C-EDL (Meta) reduces this substantially to 15.5 55.11% + 6.09. On more complex datasets, such as the CIFARIO + SVHN pairing, EDL achieves an adversarial coverage of 20.00% 6.89 whilst C-EDL (Meta) reduces this substantially to 1.25% + 0.56. To better visualise the trade-off and the superior performance of the C-EDL variants, Figure provides adversarial AUROC plots for the adversarially attacked FashionMNIST dataset.
The EDL++ variants isolate the effect of the metamorphic and MC Dropout transformations with the conflict-aware adjustment. While the EDL.+ variants can reduce OOD and adversarial coverage to some degree, the C-EDL variants reduce them even further. For example, on the CIFARIO > SVHN pairing, EDL++ (Meta) achieves OOD coverage 6.59% + 1.17 and adversarial coverage 2.35% + 0.96 whilst C-EDL (Meta) achieves OOD coverage 6.9%% + 1.00 and adversarial coverage 1.25% + 0.56. The improved performance of C-EDL across nearly every setting corroborates that it
Details of the maximum L,PGG perturbation for each dataset are discussed in Appendix C.6
7

---

Published as a conference paper at ICLR 2026
Table 1: The accuracy, OOD detection, and adversarial attack detection performance of the com- parative approaches with a variety of ID and OOD datasets in order of dataset difficulty. The adversarial attack is an L2PGD attack Highlighted cells denote the best performance for each metric. indicates datasets classed Near-OOD.
Comparative Methods
AMland EDD Motheds
Proposed EDG. C-EEN (Mitt)
Poutanie Network
I-EDI
S-EIL
X-EDL
DA-EDL
Bi (MC)
CEEDL (MC)
EDIL (Mesa)
MINST
10 (5)
1933 202
TOUS 2012
10.06 = B.2
50.00 200
09.30 BUG
19096
0.02
S0LON 0.0
90.01
0:57
27
2.335
1.25
=
0:00
0.28
.Ml Cov (9)
64.14 9.25
12.21
9.40
5.79
$0.4
14,00
41.5
11.90
25.74 7.56
09.A1
21.62
10.
4: 3.25
15.01 0.09
KINIST
K.INIST
No0 [5)
10.00 2011
10.07 200
19366 200
10.00 2000
09:27 = 1001
10.10 20000
055.00
1.00
00.08 20
0.01
30018 = 1112
005.08 0.00
09.05 2.0.0
+33.0
2.0.5
90.30
Co
0.75
0.54
0.066
1.00
2.31 2:21=002
1.90
Ai Cw (4)
20.91 9.70
20.58 0.00
10.07
14.90
4.11
20:08
2.91
16.00
4.49
10.06
27.
2:66
13.40
=0 2.00
4.30 1.90
3.01 0.04
MINIS
IMNIST
17 [4)
0001
0001
20.00
0.00
TE
10100
02 1.00
00.00
0:01
00.10
0.00
05.00 0600
10TA 2000
B0.27
Co
18.05-1 107
10,07
10:31
5.55
5.00 4.90+-077 0.75
As Cie (9)
15.70 3.95
7:81 4-3.5
6.70 = 1.79
0.03 9:00
BI 611
6.40 2:06
10
50
10
97:03 2:71
7.14
1.47 0.50
1:41 0:440
CHFAR.O
SVEES
107 [8]
01:1
WITEI
10:33 1ON
18,,00
17
Cow
10.01 9.03
1.61
12:01
0.00 1:00
5.59
1 1.00
.Mdl Cos (1)
10.07
20.00
0.30
10:25
5.37
4.82
19:44
2 4.56
14.0
0.79
21.45 8.58
15:22 2.15
0.20 1.18
2.85 =: 0..0
1.26 0.50
CIROX:0
CIEXRTOO
10 Co
16:17
BKW 0020
WEBT
MENE
0:
10000
17
13.34
1.36
Ad Co (5)
12:20:2 277
14.00= 0.06
14.10 4.00
7:73
1.55
12.70 + 3.17
9.40
2:40
31.55
1.30
16:32
2:01
7.00 1.70
5.40
5:17 0.51
Orlerd Faewer thee
Shell
Steep
Weods
A0
1010 M00
16.00
20000
1010
16.0
10.15
1111
15.35
13
100,00
Co
3:97 0174-1133
1.500
5.17 1778
8.13
6:00
1:31
1.64
6:00-990
1.02
5:03
1.7% 1.00
AN Co (1)
15.57 5540
19:21 3.46
11
16
+
3.65
6.0 3
1:95 0.75
0.00 4.90
5.5 1.11
1.14 22 0.34
6.91 9.61
1.93 6-7.1
Adversarial Coverage vs
MNIST
Coverage
imean whreshhttttrrrrttoo shrechold)
MNIST
-3.88
NNIST ST
57
CIPA31 SWHN
CIFA30 OPARLOG
DeepWeeds
HEDL
RUDL
DA
cant (MG)
+ (Reea)
cans (Mtt)
Figure 5: Adversarial coverage (circle size) compared to mean difference between the computed abstention metric (A, circle colour; Table for all approaches on all evaluated datasets. Positive values indicate predictions tend to be above the threshold, while negative values indicate predictions fall below the threshold (as expected for adversarially attacked data). Smaller circle and more negative A values (darker green) are ideal, reflecting stronger confidence that the input is adversarial.
is not just the diversity of evidence that matters. Instead, the conflict-aware adjustment of C-EDL that quantifies the disagreement and uses this information to reduce the magnitude of belief is also highly important.
These core results also reinforce the strength of post-hoc uncertainty calibration strategies in compar- ison to in-training strategies. Among all evaluated approaches, post-hoe approaches (S-EDL and our C-EDL variants) outperform those that modify the training process (e.g., DA-EDL,, H-EDI., R-EDI,, highlighting the advantages of decoupling prediction and uncertainty estimation.
The comparison between C-EDL (MC) and C-EDL (Meta) shows that metamorphic transformations consistently outperform Monte Carlo sampling. While both generate diverse evidence to assess belief' stability, the structured and semantically controlled perturbations in C-EDL (Meta) yield better OOD and adversarial detection. This supports the intuition that task pesk-rresnr augmentations form more principled basis for detecting epistemic uncertainty, providing concrete evidence for the benefit of C-EDL's input augmentation and evidence set generation step (Section 4.1..
8

---

Published as a conference paper at ICLR 2026
C-EDL
Car
Uncertainty
Cat
Dog Cat
Dog
Figure 6: 3-class simplex visualisation for the CIFAR-10 dataset comparing EDL and C-EDL.
To further highlight the quality of abstention decisions, particularly in the adversarial context, we examine the computed scoring metrics (A) against the coverage for each approach (Figure and T)bleB). These metrics combined represent the mean difference between the model's s uncertainty scores and the ID-OOD decision threshold; positive for retained (ID) samples, negative for abstained (OOD or adversarial) samples. A large positive A for ID data and large negative A for adversarial or OOD inputs indicate well-separated and calibrated decisions. As shown in Figure C-EDL (Meta) consistently shows the most desirable profile. For instance, on MNIST + FashionMNIST. its adversarial A is 5.50 + 1.24, compared -3.55 + 1.46 and 2289 + 1.13 for Z-EDL and EDL, respectively, showing much stronger rejection on adversarial examples. These results yield strong evidence highlighting that C-EDL reliably confident when rejecting uncertain inputs. Extended analysis of the core results can be found in Appendix [.I and ablation results of the hyperparameters introduced by the C-EDL and its variants can be found in Appendix B.4
only effective reducing adversarial coverage, but also
To visualise how C-EDL improves upon quantifying uncertainty over the baseline, we also provide 3-class simplex in Figure 6 Whilst EDL produces strong uncertainty regions across the simplex, C-EDL further boost these uncertain regions and in the centre outputs uncertainty close to 1 (full uncertainty). We also observe that C-EDL has higher uncertainty when there is equal disagreement between classes (directly our Cinter conflict). However, C-EDL preserves the low uncertainty regions in the corners of the simplex. Evidently, C-EDL preserves low uncertainty in high-evidence and low-conflict regions just like EDL, but increases uncertainty in uncertain and high-conffict regions, unlike EDL. This insight provides intuitive illustration of how conflict-aware adjustment yields more faithful uncertainty estimates than the baseline.
5.2 ADVERSARIAL ATTACK ANALYSIS
We evaluate adversarial coverage for the investigated approaches with increasing perturbation strengths for three distinct gradient (L2PGD and FGSM) and non-gradient (Salt-and-Pepper noise) adversarial attack types in Figure Across all attack types and values, C-EDL (Meta) consistently achieves the lowest adversarial coverage, confirming robustness to multiple attacks and attack types.
For the most challenging gradient- attack (L2PGD left), adversarial coverage for EDL rises sharply to nearly 70% at = 1.0, while C-EDL (Meta) remains below 20%, signifying a considerable improvement. The gap is similarly large for C-EDL (MC). For a weaker gradient-basee attack (FGSM middle), adversarial coverage is lower on average and, as expected, multiple comparative approaches struggle as e increases. Both C-EDL variants remain very close to 0%. Finally, for non-gradient- based attack (Salt-and- Pepper noise right), all comparative approaches struggle smaller which to be expected with non- trr--rrddient--ee based attacks. All C-EDL variants maintain minimal coverage throughout. This result shows that C-EDL's conflict-wwart strategy generalises across fundamentally different types of adversarial attacks, not just those tailored for gradient manipulation. Detailed results for the performance of all approaches under each attack are provided in Appendix B.2

---

Published as a conference paper at ICLR 2026
F. Can SELL CEEL (N65S
C-SOL
L2PGD ArTack
FOSM ATTACK
LAndPapper Norse Attack
(56)
60-
-0-
10-
60-
50
Figure 7: Adversarial coverage (%) across varying perturbation strengths (c) for three attack types (L2PGD, FGSM, and Salt and Pepper noise), where the ID dataset is MNIST, and the OOD dataset is FaShionMNIST. Lower coverage indicates better robustness.
Offerendsi
Info
caox akc
ma.+ mees
ca (ett))
Figure 8: Adversarial coverage (%) for different ID-OOD threshold metrics where the ID dataset is MNIST, the OOD dataset is FashionMNIST, and the adversarial attack is L.2GGD (e 1.0).
5.3 THRESHOLD ANALYSIS
Similar to (Sensoy et al. 2018 Wang et al. 2024 Deng et al. 2023), ) evaluate the performance of the investigated approaches under varying ID-OOD decision threshold methods, i.e., differential en- tropy, total evidence and mutual information. Details on each threshold are provided Appendix C.2 The adversarial coverage per approach for each decision threshold is shown in Figure and the results obtained reveal interesting trends. Firstly, most of the majority (e-g., Posterior Network, EDL, I-ELL) have limited sensitivity to the decision threshold, and further perform poorly, consistently predicting on more than half of the adversarial data. contrast, C-EDL and its variants achieve a significantly lower coverage across all three thresholds. These results demonstrate that the performance of C-EDI robust to the choice of decision threshold methods. Further analysis can found in Appendix B33
CONCLUSION AND FUTURE WORK
We introduced Conflict-aware Evidential Deep Learning (C-EDL), a post-hoc uncertainty quantifi- cation method that augments any pre-trained EDL classifier with principled, transformation-drive conflict analysis. By generating aabee-preserving metamorphic variants of each input, quantifying intra- and inter-class disagreement, and scaling evidence accordingly, C-EDL reliably detects OOD and adversarial inputs, thereby improving robustness. Experiments on diverse datasets show that C-EDL reduces prediction coverage on adversarial inputs by up to six-fold over state-of-the-art methods. Despite the added transformations, inference overhead remains negligible, making C-EDL lightweight and practical for deployment. These findings highlight C-EDL as a generalisable and robust solution against OOD and adversarial data across a variety of attacks and decision thresholds, with future work aimed at extending it to detection tasks and minimising augmentation requirements.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This work was supported the European Union's 's Horizon Europe research and innovation programme under grant agreement 101168067 (GuardAI - Enhancing Robustness and Security of Edge AI Systems for Safety-Critical Applications).
REFERENCES
Moloud Abdar, Farhad Pourpanah, Sadiq Hussain, Dana Rezazadegan, Li Liu, Mohammad Ghavamzadeh, Paul Fieguth, Xiaochun Cao, Abhas Khosravi, U Rajendra Acharya, review of uncertainty quantification in deep learning: Techniques, applications and challenges. Information Fusion, 76:243-297, 2021.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Iige Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Alman,, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08772 2023.
Anastasios N Angelopoulos, Stephen Bates, et al. Conformal prediction: A gentle introduction. Foundations and Trends Machine Learning. 16(4):494 591, 2023.
Murat Seckin Ayhan and Philipp Berens. Test-time data augmentation for estimation of heteroscedas- tic aleatoric uncertainty in deep neural networks. In Medical Imaging with Deep Learning, 2018.
Charmaine Barker, Daniel Bethell, and Simos Gerasimou. Guided uncertainty learning using post-hoc evidential meta-model. arXiv preprint arXiv:2509.24492, 2025.
Daniel Bethell, Simos Gerasimou, and Radu Calinescu. Robust uncertainty quantification using conformalised monte carlo prediction. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pp. 20939-20944 2024.
David M Blei, Alp Kucukelbir, and Jon D McAuliffe. Variational inference: A review for statisticians. Journal of the American Statistical Association, 8155518):559-877, 2017.
Bertrand Charpentier, Daniel Zügner, and Stephan Günnemann. Posterior network: Uncertainty estimation without ood samples via density- based pseudo-counts. Advances in Neural Information Processing Systems, 33:1356-1367 2020.
Mengyuan Chen, Junyu Gao, and Changsheng Xu. R-edl: Relaxing nonessential settings of evidential deep learning. In The Twelfth International Conference Learning Representations, 2024.
Tarin Clanuwat, Mikel Irizar,rizar, Asanobu Kitamoto, Alex Lamb, Kazuaki Yamamoto, and David Ha. Deep learning for classical japanese literature. arXiv preprint arXiv:1812.01712 2018.
Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. 2017 International Coint Conference on Neural Networks (IJCN), pp. 2921-2926 IEEE, 2017.
Arthur P Dempster. A generalization of bayesian inference. Journal of the Royal Statistical Society: Series B (Methodological), 30(2):205 232, 1968.
Danruo Deng, Guangyong Chen, Yang Yu, Furui Liu, and Pheng-Ann Heng. Uncertainty estimation by fisher information-based evidential deep learning. In International Conference Machine Learning, pp. 7596-7616 PMLR, 2023.
Alexey Dosovitskiy. Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x 16 words: Transformers for image recognition scale. arXiv preprint arXiv:2010.11929, 2020.
Vincent Fortuin. Priors in bayesian deep learning: A review. International Statistical Review, 90(3): 563-591, 2022.
11

---

Published as a conference paper at ICLR 2026
Gianni Franchi, Olivier Laurent, Maxence Leguéry, Andrei Bursuc, Andrea Pilzer, and Angela Yao. Make me bnn: A simple strategy for estimating bayesian uncertainty from pre-trained models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 12194-12200 2024.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In international cCnference on Machine Learning. pp. 1050-1059.
PMLR, 2016.
Ethan Goan and Clinton Fookes. Bayesian neural networks: An introduction and survey. Case Studies in Applied Bayesian Data Science: CIRM Jean-Morlet Chair, Fall 2018, pp. 45 45-87, 2020.
Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, volume 1.
MIT press Cambridge, 2016.
lan J Goodfellow, Jean Pouget-Abaae Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in Neural Information Processing Systems, 27, 2014.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International Conference Machine Learning, pp. 1321-1330. PMLR, 2017.
Wenchong He and Jiang. A survey on uncertainty quantification methods for deep neural networks: An uncertainty source perspective. Perspective, 1:88, 2023.
Alex Kendall and Yarin Gal. What uncertainties do we need in bayesian deep learning for computer vision? Advances Neurul Information Processing Systems, 30, 2017.
Abbas Khosravi, Saeid Nahavandi, Doug Creighton, and Amir F Atiya. Lower upper bound estimation method for construction of neural network-based prediction intervals. IEEE Transactions on Neural Networks, 22(3)3337-346, 2010.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 1r1iv:1412.6998 69600, 2014.
Diederik Kingma, Max Welling, et al. Auto-cncoding variational bayes, 2013.
Anna-Kathrin Kopetzki, Bertrand Charpentier, Daniel Zügner,, Sandhya Giri, and Stephan Günnemann. Evaluating robustness of predictive uncertainty estimation: Are dirichlet-based models reliable? In International Conference on Machine Learning, pp. 5707-5718, PMLR, 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. Advances in Neural Information Processing Systems, 30, 2017.
Yann Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEF, (6(11):2278-2322 1998.
Jeremiah Liu, Zi Lin, Shreyas Padhy, Dustin Tran, Tania Bedrax Weiss, and Balaji Lakshminarayanan. Simple and principled uncertainty estimation with deterministic deep learning via distance aware- ness. Advances in Neural Information Processing Systems, 33:7498-755 75122, 2020.
Tyler Loftus, Benjamin Shickel, Matthew M Ruppert, Jeremy Balch, Tezcan Ozrazgat-Baatie Baslanti, Patrick Tighe, Philip A Efron, William R Hogan, Parisa Rashidi, Gilbert R Upchurch Jr, et al. Uncertainty-awar deep learning healthcare: a scoping review. PLOS Digital Health, 188): e0000085, 2022.
Adriel Sosa Marco, John Daniel Kirwan, Alexia Toumpa, and Simos Gerasimou. Uncertainty quantification for deep regression using contextualised normalizing flows. arXiv preprint 1wXiv:25/2.00835. 2025.
12

---

Published as a conference paper at ICLR 2026
Viacheslav Moskalenko, Vyacheslav Kharchenko, Alona Moskalenko, and Borys Kuzikov. Resilience and resilient systems artificial intelligence: taxonomy, models and methods. Algorithms, 16(3): 165, 2023.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng. al. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning, volume 2011, pp. Granada, 2011.
Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In Indian Conference on Computer Vision, Graphics and Image Processing, Dec 2008.
Alex Olsen, Dmitry A Konovalov, Bronson Philippa, Peter Ridd, Jake C Wood, Jamic Johns, Wesley Banks, Benjamin Girgenti, Owen Kenny, James Whinney, et al. Deepweeds: multiclass weed species image dataset for deep learning. Scientific Reports, 9(1):2058, 2019.
Deep Shankar Pandey and Qi Yu. Learn accumulate evidence from all training samples: theory and practice. In International Conference on Machine Learning, pp. 26963-26989. PMLR, 2023.
Tim Pearce, Alexandra Brintrup, Mohamed Zaki, and Andy Neely. High-quality prediction intervals for deep learning: distribution- ensembled approach. In International Conference on Machine Learning, pp. 4075-4084, PMLR, 2018.
Jingen Qu, Yufei Chen, Xiaodong Yue, Wei Fu, and Qiguang Huang. Hyper-opinion evidential deep learning for out-of-distribution detection. Advances in Neural Information Prucessing Systems, 37: 84645-84668. 2024.
Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox: A python toolbox benchmark the robustness of machine learning models. arXiv preprint arXiv:1707.04131 2017.
Kajetan Schweighofer, Lukas Aichberger, Mykyta lelanskyi, Günter Klambauer, and Sepp Hochreiter. Quantification of uncertainty with adversarial models. Advances in Neural Information Processing Systems, 36:19446-1999 19484, 2023.
Murat Sensoy, Lance Kaplan, and Melih Kandemir. Evidential deep learning to quantify classification uncertainty, Advances in Neural Information Processing Systems, 31, 2018
Silvia Sconi, Vicnesh Jahmunah, Massimo Salvi, Prabal Datta Barua, Filippo Molinari, and Rajen- dra Acharya. Application of uncertainty quantification to artificial intelligence in healthcare: A review last decade (2013-2023). Computers in Biology and Medicine, 165:107441, 2023.
Glenn Shafer. A mathematical theory of evidence, volume 42. Princeton University Press, 1976.
Maohao Shen, Yuheng Bu, Prasanna Sattigeri, Soumya Ghosh, Subhro Das, and Gregory Wornell. Post-hoc uncertainty learning using dirichlet mota-model. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 9772-9781, 2023.
Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: a simple way to prevent neural networks from overfitting. The Journal of Machine Learning Research, 15(1):1929-199)) 2014.
Natasa Tagasovska and David Lopez-Paz. Single-model uncertainties for deep learning. Advances in Neural Information Processing Systems, 32, 2019.
Joost Van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using a single deep deterministic neural network. In International Conference on Machine Learning, pp. 9690-9700. PMLR, 2020.
Ke Wang, Yong Wang, Bingjun Liu, and Junlan Chen. Quantification of uncertainty and its appli- cations to complex domain for autonomous vehicles perception system. IEEE Transactions on Instrumentation and Measurement, 72:1-17, 2023.
Ke Wang, Chongqiang Shen, Xingcan Li, and Jianbo Lu. Uncertainty quantification for safe and reliable autonomous vehicles: A review of methods and applications. IEEE Transactions on Intelligent Transportation Systems, 2025.
13

---

Published as a conference paper at ICLR 2026
Ruofan Wang, Rui-Wet Zhao, Xiaobo Zhang, and Rui Feng. Towards evidential and class separable open set object detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 2572-5580, 2024.
Peter Welinder, Steve Branson, Takeshi Mita, Catherine Wah, Florian Schroff, Serge Belongie, and Pietro Perona. Caltech-ucsd birds 200. 2010.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mmist: novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv: 077447 2017.
Cai Xu, Jiajun Si, Ziyu Guan, Wei Zhao, Yue Wu, and Xiyue Gao. Reliable conflictive multi- view learning. In Proceedings of the AAAI conference artificial intelligence, volume 38, pp. 16129-16137, 2024.
Jingkang Yang, Pengyun Wang. Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng, Haoqi Wang, Guangyao Chen, Bo Li, Yiyou Sun, al. Openood: Benehmarking generalized out-of- distribution detection. Advances in Neural Information Processing Systems, 35:32598-3261. 2022.
Taeseong Yoon and Heeyoung Kim. Uncertainty estimation by density aware evidential deep learning. arXiv preprint 4rXi::2409.08754 2024.
14

---

Published as a conference paper at ICLR 2026
A THEORETICAL ANALYSIS
This appendix provides the proofs to complement Theorem presented we provide proofs regarding the C, Cintra and Cinter bounds, and the quality of the conflict measurement C in terms of monotonicity and how it behaves in specific scenarios.
in Section presettedee
More specifically,
A.1 THEOREM
Theorem 1. The conflict measure C' is bounded between (0, 1]. tends towards if and only if all transformations produce identical Dirichlet parameters concentrated on single class, and is monotonically non-decreasing with increasing intra and inter-class conflict with À E [0, 2).
Proof. We prove this in three parts: (1) C' is bounded within (0, (2) C - 0 in the case of identical Dirichlet parameters; and (3) is monotonically non-decreasing with increasing Cintra and Center-
Firstly, to prove that C' is bound within (0, 1] we recall the Cintra and Cinter definitions from Equations equation and equation respectively:
K
o (Hak 1T
11=1)
Cintra
(10)
K
k= p(aak (1) 11 }T=1) +
K
min(a (1) ,
(8)
min(a
(1) (0)
21
Cinter T
Σ 1=1
1 1- exp
-B
x
x
(1I)
k=
j=
max ag
(8)
k= a
(1)
where B > O and
O''s (1) 0.
Concerning Cintras since by construction each Dirichlet parameter (1) is strictly positive and e small positive constant (used for numerical stability), the mean μ "((a)")) }/=1) is itself strictly positive. Thus, the denominator in Cintra always positive and bounded above 0. The numerator is
the standard deviation of the Dirichlet parameters ofaa (( thus, it is always non-negative ((...) exactly zero in the case of identical Dirichlet parameters. The ratio u(-.)+e represents normalised measure of dispersion. This ratio is well-known to lie between 0 (no variability) and 1, due to the nature of variance-to-me ratios of strictly positive distributions. As a result, we establish:
0 f Cintra I
(12)
Concerning Cinter which is comprised of exp(-z) and the argument:
K
(1) (t) min a a
min (1)
(1)
2
aa a
x
(13)
max(a
(t) (0)) Σ k== α
(1)
km
1++
Since by construction 0 2 1, therefore min (a a and max(a (1) , ) must be 2 1 and
((t) > K. Every squared factor inside the double sum us strictly positive, making the argument
0. Since 0 < exp(-x) < 1 for all x > 0, each term - exp(-x) lie strictly between 0 and 1. Thus, we establish:
0 < Cinter I
(14)
To quantify the tightness of the lower bound, we analyse the where nearly all evidence is placed single class (the case that will bring Cinter closest to O. Assume every transformation produces the same Dirichlet vector:
15

---

Published as a conference paper at ICLR 2026
a. = A>>1, 1, aj (( == -+
(15)
where class is the favoured class, A is the Dirichlet parameter assigned to class c, and all other class carry the implied prior constructed by the EDL process. Only the K pairs {c,j} contribute the Cinter- For any such pair:
min(ac: Q2) = 1, max(ae: a,) =
(16)
the squared factor becomes:
1
1 2)²
2)
A K -
(17)
2
=(K 1)(
A(A+
as there are K pairs. Substituting this into Cinter gives:
Center exp((33)) = - 1e1(-expp8(KK 1)( A(A+K -11)
(18)
assuming K = 2, the second term vanishes and O(A-)), hence in the case of dominating single class, Cinter = (AA +). Therefore, can be said that Canter is strictly positive but can be driven arbitrarily closer to 0 quartic rate.
Given that both Cintra is bounded [0, 1] and Cinter is bounded (0, 1], we can determine the bounds of C.
In the case of the lower bound (Cintra and Cinter = é) where E (0, 1]. the conflict measure C is:
C = E 0 0-)) A(E 0)
(19)
= <(1 - -ee)
Since have shown that -> 0+, it is strictly positive. In this of the upper bound (Cintra 1 and Cinter 1), the conflict measure C is:
C = 1 1=1+1-(1)))-
2 1-
(20)
=
Thus, C' is bounded on (0, 1]. satisfying the first part of the theorem.
Next, we prove that C + and only the Dirichlet parameters across transformations are identical and concentrated on single class. Given set of transformation t e {1..... TT and classes E {1...., K}. a set of identical Dirichlet parameters a (t) = ag for all are produced. We have shown above that this case Cintra - with the decay rate ((A-1) when K 2. Because the Dirichlet parameters are identical, the intra-class conflict vanishes, thus Cintra = 0. Hence, C' shares the same properties. In this case identical concentrated Dirichlet parameters, it tends towards with the same decay rate. As result, boosting methodology.
has little effect the final evidence reduction/unccerainnyy
Finally, prove that C' is monotonically non-decreasing with increasing Cintra and Cinter when E [0, 2. Since C is continuously differentiable, monotonicity is equivalent to non- noggnegatyy of its partial derivatives. This is:
16

---

Published as a conference paper at ICLR 2026
OC
Cintra
2X(Cinter
Cintra)
0Cinter
(21)
aC
=1 Cinter
2X(Cinter
Cintra)
dCinra
Each derivative affine, therefore. its minimum over the rectangle [0, 1]2 is attained at one of the four corners 0, 1 Given 8C evaluating the corners gives:
Winnerr
(0,0): 1, (1,0) 2X, (0,1): : 2X,
(1
(22)
with the smallest corner being (1,0) with the value 2X. Under thus:
[0, f). we get
2A 2
OC
for every (Cinter, Cintra) E (0, 1|2
(23)
0Cinter
Increasing Cynter while holding Cintra never decreases C when S Given W.etto the corners gives:
evaluating
00.0): 1, (1,0) :0, (0 :1:1111 11:1--2. 22, (1,1): 22
(24)
with the smallest corner being (0, 1) with the value 1 - 2A. Under E [o, }). we get 2A 2 0, thus:
aC
2
0
for every (Cinter; Cintra) E (0, 1)2
(25)
@Cintra
Increasing Cintra while holding Cinter never decreases C' when S }.- This proves that C is monotonic for X < 2. this qualitatively backed up with the C visualisation w.r. Cinters Cintra and À in Figure
It is to be noted that C' remains non-negative on [0, 1|2 for À E [0, 1]. yet monotonicity is lost when A 1. Looking Figure 16 the quadratic penalty -X(Cinzer- Cintra)² bends the surface down along the diagonal. Restricting À to at most 3 limits this curvature so that it does not overpower the linear ascent from Cinter + Cintra Cinter This proof is also part of the justification why we chose À= in our experimental evaluation.
B ADDITIONAL EXPERIMENTS
This appendix provides additional experimental insights and analyses to complement the results presented in Section Specifically, we include extended analysis of metrics, adversarial attacks, thresholds, and ablations of hyperparameters introduced in C-EDL.
B.1 EXTENDED ANALYSIS OF CORE RESULTS
Table 2 shows the difference in ID accuracy, ID, OOD, and adversarial coverage of all approaches from the baseline (EDL) across the different datasets to complement Table !
Analysing this table shows that EDL serves strong improvement to the Posterior Network, not only improving ID coverage but also OOD coverage. Thus, EDL learns to create a better uncertainty split between ID and OOD data across all datasets.
Notably, C-EDL (Meta) consistently achieves the largest reductions in OOD and adversarial coverage compared to EDL,, while retaining competitive IDD coverage across all dataset pairings. For instance,
17

---

Published as a conference paper at ICLR 2026
Table Difference from EDL baseline. Positive numbers improve 1 metries and worsen metries; negative numbers do the opposite. The adversarial attack is an L2PGD attack Highlighted cells denote the best performance for each metric. indicates datasets classed as Near- -ear-OOD.
Cnnroratie
Popeott
<001 11031
-210
1001
1001
1500 15000
+0.33
-3.00
-1.13
-1.31
+6.23
-2.13 +L.6
Co
10225 10.25
-3.11- -100
-1342 14.30
6188 1818
10:15 11351
0.70 0.08
10.12
MSBT K3NN111
10011 10030
001 10030
131033 1330
10025 10100
101 1000
100 1002
1000 10000
0003
0000
10,00 10:00
+4.35
+4.35
+0.31
-003
-310
-2.30
-0.35
-002 -8.31
+0.11 +1.00
+6.31
+0.0
01 -0335
-3.00 -5:0
-1.30 -0.1
Adr
11.51
3.50
16.11
+0033
18021
10000
-000
-5.00
1001
-206 9100
+3.00
22500
-100
-00 1016
10415
-11622
1192
000
14,22
3.01
10.5 14.25
1.22
3.91
10.00
4115
-0.27
-3.1
-175
-0.2
-73-31
+33.00
Add
0.41 11.70
0.775
00.32
166.5 0.43
14.35
-200
1,01 1.30
12/09
4.75
10.01 6.71
117.5
118755 6:35
11.22
1122
10.31
-22211-11 -1.6
-1.5
-175
-1122 1.00
03.03
0.35
8.43
1.05
10.31
2.04
-1200:2
20.10
128
Alr Cir
-1:7
10.99
-5 11:0--1-0 -315
-1.99
19
100 -2.0
-10 06 0.63
13:30-2
-5.55
-6 68
-5. 4.:00
10.45
Osked
Woec
16:99
-2315 0.43
-0.3 -018
+11l -190
-0.03 -6.02-44 +945
-1191
-0.3
16 -101
Cor
-100
-216
-1235-33
1 -5.4
-1.6 -111
-1.06--100
on the MNIST + EMNIST task, it reduces adversarial coverage by 40.40 + 2.96, and on CIFARIO + SVHN by -88.75 1.53, the most substantial improvement among all approaches. These differences reinforce the point that C-EDL's superior robustness is both due to the added diversity and the conflict-ave awarre adjustment. Furthermore, the consistently positive differences in ID accuracy and coverage for C-EDL (Meta) suggest that these gains do not come at the expense of model reliability on clean data.
Figure 9 shows a boxplot comparison of ID, OOD, and adversarial coverage across subset of representative ID/near- and far-OOI) dataset pairs, these result complement Figure 9a shown in Section 5
In the MNIST + KMNIST dataset pair (far-OOD), all comparative approaches achieve high ID coverage, with EDL-based approaches generally outperforming the Posterior Network, expected. C-EDL (Meta) also maintains competitive ID coverage, with only a modest drop of approximately 2% to 3%. In terms of OOD coverage, approaches that extend EDL, such as R-EDL and DA-EDL achieve moderate reductions. However, C-EDL (Meta) surpasses all baselines, achieving the lowest OOD coverage with 1. 1.90% + 0.32.
The most pronounced performance gain appears in adversarial coverage, where C-EDL offers a significant improvement over all comparative approaches. Most EDL-based models struggle abstain on adversarially perturbed data, predicting on approximately 20% of such inputs. For instance, EDL yields adversarial coverage of 20.88% + 5.95. In contrast, C-EDL (Meta) reduces this by more than factor of four, attaining superior coverage of only 3.01% = 0.94.
These trends persist in other far-OOD settings, such as CIFARIO - SVHN, where C-EDL sacrifices only a negligible amount of ID coverage but achieves the lowest OOD coverage and near-zero adversarial coverage. Similar results are observed in the MNIST - EMNIST pairing (near-OOD), where C-EDL (Meta) once again delivers the lowest OOD coverage and near-zero adversarial coverage, marking a substantial improvement over all comparative baselines.
These results provide strong empirical evidence into the reliability of C-EDI. across diverse settings. Despite only a negligible reduction ID coverage, C-EDI, consistently achieves the lowest OOD and adversarial coverage. This makes it particularly well-suited for deployment in environments where distributional shift or adversarial attacks are likely, offering a level of robustness unmatched by existing approaches.
To complement the adversarial coverage plots shown in the main paper (Figure 5 we present a detailed analysis of abstention margins (A) across all evaluated dataset pairs, with raw values shown in Table These plots visualise the mean difference between each sample's 's uncertainty score and the learned ID/OOD decision threshold, alongside the corresponding coverage rates. Positive values
18

---

Published as a conference paper at ICLR 2026
Coverage
Coverage
Cnowage
(N1
+
Proster
Ebc
Rutt
Bran (etC)
c-e (MC)
Cat (hete)
Poottet
EDL
HEGL
9-622
BXL IMC)
ceo (NO)
Eax. (Heel))
CaE reeta)
Rosttet
EaL (MC
ceex (M1)
cox. (Heta)
ca reeet)
(a) MNIST (ID) FMNIST (OOD).
1200
D Coverage
DOD Coverage
Adversarial Coverago 4
coveroge (N)
57.-
650
63.3-
05-
-1-
4
55.
Sam.
INDE
role+ (MC)
cez NNC)
esa, (Phcaa)
cato (less)
Pestbel
Retta
RoL (MC)
Catoa Her)
Riz (MMeaa)
curse (eetal
Pouttee
sam
Hezz
Avttt
soLe (MC)
can me)
ESL (Mtenal
D2
(b) MNIST (ID) KMNIST (OOD).
D Coverage
GOD Coverage
Adversarial iall Coverage
100
V
ESL
HEX
Weat
mise (MC)
C (MC)
EDL (Mesa)
C-03 Meroe
Perthet
EDK
REO
5dtt
REDE
Gk eot
mi (MC)
Casa (MC)
00 (Mesa)
C-08 (estal
Partted
Fext
suree
MEDE
REDI
04-534
BOK+ (MC)
Ceoa IMC)
Bak+ (ettal
Cama (erts
(c) MNIST (ID) + EMNIST (Near-OOD).
Figure 9: ID, OOD, and adversarial coverage (%) across comparative approaches for evaluated MNIST datasets from Table [ C-EDL and its variants are in blue and show significantly lower adversarial and OOD coverage than baselines.
of A (expected for ID data) indicate retained predictions lie confidently above the threshold, while negative values (expected for OOD or adversarial inputs) reflect confident abstention.
For ID coverage (Figure Taa we observe that C-EDL (Meta) achieves a high positive comparable to the EDL variants. For example, in MNIST FashionMNIST, EDL achieves A 3.2 whilst C-EDL (Meta) achieves A 2.7, which is competitive. does this with competitive ID coverage also, only dropping x 2%, reflecting confidence retention of ID examples. Interestingly note is DA-EDL, which achieves extremely high ID A values compared to other approaches, which indicates extreme confidence in the data being ID. However, the coverage does not improve much from EDL results. This result can be explained by looking at Figure [Tb] simultaneously, which shows the OOD coverage and A. DA-EDL shows similar OOD A to comparative approaches. This can explain the high confidence but no/marginal improvement in ID) and OOD coverage as the density-based scaling predominantly affects confidence estimates in dense IDD regions, rather than uniformly impacting all input regions.
For OOD coverage (Figure I1b), C-EDL (Meta) shows the most desirable behaviour: large negative A and the smallest OOD coverage across every dataset. For example, C-EDL (Meta) achieves = -13.3 on MNIST + FashionMNIST and = 7,8 on CIFARIO - CIFAR100, which is one of the smallest on these datasets. But unlike other approaches, C-EDL achieves tiny coverage and low A on all datasets equally instcad of on some. This means not only abstains effectively, but does so with high confidence and margin, which is essential for robust deployment.
These A results and visualisations provide analysis to understand the quality of abstentions made by the different models and how C-EDL provides consistent, robust, significant improvements.
Figure [2] presents exclusion- based attention overlays generated by the C-EDL model, comparing OOD inputs from FashionMNISS (left) to ID inputs from MNIST (right). These heatmaps highlight
19

---

Published as a conference paper at ICLR 2026
Coumage
Cavwrage
Coverage
12
Caveroge
18
18
Poopter
witos
Rooo
Baxs (MC)
C-EON (MC
ESX + reeea)
caR (ste1))
Pootter
Hir
RSG, (MQ
C-tot reco
un% (Meta)
CEE (e92)))
Pootter
Rett
ESLA nMC
c-m (MG)
etx. (Neta)
Ca reeet
10 (ID) SVHN (OOD).
ID Coverage
000 Coverage
Adversarial Coverage
3
Covarge 190)
33
8
Romiee
ESL + (MG)
capo (MC)
BTL + (ffea)
(Mlnn)
Poontel
HEDL
MNDL
ESL 9MC7
Crta (MC)
ESL + (Meta)
cieck (Mesa))
Poottet
Heme
ESt DMC
c-cox (uc)
BGL (Htta))
CEEA (Miea)
(b) CIFAR-10 (ID) CIFAR- (Near-OOD).
ID Coverage
000 Ceverage
Adversarial Coverago
1 2
Postiet
HE0.
fetrs
goL cara (MC)
(MC)
FoL+ (Mteal
CaDL (Maaa)
Pestivr
Her
seat
med
zoL (M6)
ceea INC)
RGA (Betaa)
Caok (teral
Hoytlet
Er%.
seat
Hert
tok++ (MC)
C-tza (MC)
E0L (Mteaa
C-tkk (Meral
(c) Oxford Flowers (ID) - Deep Weeds.
Figure 10: ID, OOD, and adversarial coverage (%) across comparative approaches for evaluated CIFAR-10, and Flowers datasets from Table D C-EDL and its variants are in blue and show significantly lower adversarial and OOD coverage than baselines.
Table 3: Mean difference between the computed abstention metric for each sample and the computed ID/OOD threshold for each approach from T Positive values indicate predictions tend to be above the threshold (expected for ID data), while negative values indicate predictions fall below the threshold (as expected for OOD and Adversarially attacked data). indicates datasets classed as Near-OOD.
Comparaio Matroh
AWansl C-EDI Melea:
Propeed C-EDI
Posterkar Nateork
BBC
2-E0L
S-EDX
HEDL
R.BLL
DAEELL
HDL-+
CEBL (MC) EDI (Mkea)
C-35L (Mano
MNSST
245
2207
11:522055 0156
Aalr
1.08 6 1.00
2 1.18
8.50 1,46
2,07 0 1.2
2.1 1.15
0.6 8.72
6.10 C.57
4.47 L22
0,50 1.24
KANNSST
233
100 10.
10.90
175
230
1.00
10.55 3.60
12.55-200.01
Auly
5,6 1.77
870 0.0
8.5
8.
0.50
6,37 0:37
0.2
7.50 0.40
MNIST
EMNSST
100
1020
171100
Air
7.84 1.41
5.00
0.54 0.58
0.22
6.00 0.70
22 27.00
332 031
7.2 0.42
7.54
0.18 0.54
SVINN
230
137 2333
113
1010
1110
1558.0
1000
-00
Adt 1.22.00.00
-310 1100
50000 3.16
-536
7 46 1.36
425.02
1655.20
-110 1050
-3241 1..5
-7.88 IMS
11
25241
0.1
2.50
Adr
4.39 0.10
-300 22 0.8
3.56 3.56
430 5:044
16 1.18 8.58
62.42 11.02
23 0.15
766 2:225-0.25
-5.00.2 0.47
1APp Wezde
5:0
-1.38 1.35
0130 6.58
-0. 1.80
1.10
-7.01 3:20
1310
Aar
4518 8.77
3.21
29105 7.87
81 04 7.06
12.40 10.35
05.07 8 7.94
0.54 0.50
61.10--9977
81.18 8.30
-4..9 7.56
6.574:77.45
spatial regions where the model's attention distributions differ across metamorphic transformations, providing an intuitive visual explanation/insight of to where conflict could potentially lead to an increase in the conflict score C.
20

---

Published as a conference paper at ICLR 2026
MIIST
Otwelage
MNIST KVBNST
26
KNIST EMINST
G0
WET
CIAR30 SUIN
imean
OIFRLOO
DeepWWeedss
Peettet
HERE
S-EOK
HEBE
(MC)
CBDL (MC)
EBK+ (Meza)
CEOL (Mleta)
DR
(a) ID coverage Vs A
OOD Coverage VS
323
415
IMNST
Cowinage
213
364
322
467
IONST
IMREST
CFAR10
SWHN
CIARSO
Finwers Dosp
Ronteet
HBBL
HEGL
DeEGE
EB BMQ
cap Me?
ESK (Mea))
cEL (Nteaa)
(b) OOD coverage 4
Figure 11: Coverage (bubble size) compared to mean difference between the computed abstention metric (bubble colour- Table for all approaches on all evaluated datasets.
C= 0.296
C 138
C= 0.341
C = 0.001
C= 0.001
C= 0.000
1.0
3
0.8
Aitter daaeen
0.4
0.0
Figure 12:
Exclusion- seccusion-bbasd attention overlays from the C-EDL model for OOD (FashionMNIST,, left) and ID (MNIST, right) inputs. The heatmaps highlight spatial regions where attention distribu- tions differ across metamorphic transformations. These overlays qualitatively highlight regions of disagreement that could potentially lead to increase in the conflict measure C.
For OOD samples (left three images), we can observe high regions of disagreement across the OOD images. For example, in the third image showing coat, the lower and upper regions show disagreement across the transformation T. which in turn leads to a high conflict score C' 0.341. In contrast, ID samples (right three images) exhibit little to areas of disagreement across the transformations. Correspondingly, the conflict scores are near-zers zero (c.g., C' = 0.000 to C' 0.001), confirming that the model's evidence remains stable and coherent for familiar inputs.
AUROC plots and adversarial AUROC plots for all comparative methods can be visualised in Figures 13 and 14 respectively.
C-EDL and its variants were also compared against broader UQ methods that comprise state-of-the-a in broader UQ sense; results shown in Table We compared C-EDL and its ablated variants
21

---

Published as a conference paper at ICLR 2026
ENNAT
Optirall Thomeaad
Erivayy
pelociia biiay
brinay
MAR
RCDL
D4-C0L
EBL (N
Cetrrwett Enirspp
Dawweraa Eroney
Ofterweis Entrape
Gesoreius Eriwaay
C-Da (90)
[BL..
C-OL
Ofterniall
Oeterertaa
Drtrentei
Figure 13: Visualised AUROC plots, including the binary decision threshold for OOD/Adv rejection, for comparative methods where the ID dataset is MNIST and the OOD dataset is FashionMNIST.
Thrastoi
Enerpp
Pivertui Eniopy
Difheertal Entrayy
HEDL
Dereron brises
Difirroiaa br/ups
COL*+ (Pata)
C-OL (ives)
Difocriit Entray
Extertal Evweer
Ofternria Extray
Figure 14: Visualised adversarial AUROC plots, including the binary decision threshold for OOD/Adv rejection, for comparative methods where the ID dataset MNIST and the OOD dataset is Fashion- MNIST.
against standard deterministic network, ABNN Franchi et al. 2024), a standard deterministic backbone that is then fine-tuned with EDL head (Sensy et al. 2018) and EMM (Shen al. 2023).
Table 4: The accuracy, OOD detection, and adversarial attack detection performance of the C-EDL and broader UQ methods on the MNIST to FashionMNIST pairing. The adversarial attack is an L2PGD attack. Highlighted cells denote the best performance for each metric.
Standaed Netwer
MC- Dn--Diooul
ABNN
EMM
EDL++ (MC)
(-EDL
10Lee Meso
20.00%
1000
10300 = 11113
35.19%
11.11
1.11
1.100
1.00
89.08%
0.00
00.5% 0.02
20.30% = 10.02
GD
70.20%
5.12
85. 16
2.51
74.8%%
5.41
77.44%
1.21
90.88%
2.78
51.51%
1.12
92.05%
1.72
95.08%
0.71
31.22%
1.05
00D Cov
21,00%
6.53
12.00
3.06
1822%
6.83
22.51%
3.76
91.67%
+ 17.98
35.78%
3.62
5.80%
1.42
1.92% + 0.93
1.88%
+ 0.80
Cov
25.84%
5.1
27.20
4.70
21353
1 6.98
19.66%
2.06
16%
1 15.51
51.12
20.00%
5.20
17.62% 1: 7.8.64
17.88%
4,81
22

---

Published as a conference paper at ICLR 2026
Table 5: The accuracy, OOD detection, AUROC, and adversarial attack detection performance EDL and C-EDL (meta) on few-shot Tmny-Im and CUB pairing using pretrained ResNet50- backbone. The adversarial attack is L2PGD (0.1 maximum perturbation). Highlighted cells denote the best performance for each metric.
5- 5-Way 1-Shot
5-Way 5-Shot
EDL
C-EDL (Meta)
EDL
C-EDL (Meta)
ID Acc t
51.63%
3.17
53.19% 4.67
77.90% 8.23
74.85% + 5.07
ID Cov
67.20% + 18.54
65.07% = 18.37
44.53% + 7.58
45.60% + 21.71
OOD Cov
50.13% + 16.67
34.67%
23.25
29.87% 8.77
16.14% + 10.84
AUROC
64.50% = 4.27
69.76%
5.00
62.94% 6.40
67.48% + 4.56
Adv Cov
43.33% + 19.41
31.11% 27.94
26.67% + 4.65
20.56% + 15.16
Table 6: The accuracy. OOD detection, and adversarial attack detection performance of the C- EDI compared to RED on the MNIST to FashionMNIST and CIFAR-10 to SVHN pairings. The adversarial attack is L,2GD attack.
EDL
RED
C-EDL (Meta)
MNIST
FMNIST
ID Ace f
99.96% 1 0.02 99.98% 0.02
99.96% 1 0.01
ID Cov
96.61% 1 0.57
92.17% 1: 1.77
94.18% + 1.03
OOD Cov
2.52%
+ 0.68
6.30% 1 9.44
2.00%
+ 0.80
Adv Cov
52.21% + 9.49
19.05%
9.03
15.51%
6.09
CIFAR-10 -> SVHN
ID Ace
95.88%
- 0.54
95.48%
1.26
97.98% = 0.42
ID Cov
67.34%
3.15
60.24% + 5.35
54.70% + 2.11
OOD Cov
10.91%
+ 2.23
11.68%
3.13
4.69% + 1.00
Ady Cov
20.00% + 6.89
1.39% + 2.96 1.25% + 0.56
C-EDL and it EDL were also tested against Imag-Im and CUB in a few-shot setting test their ability and robustness under a tiny training regime, a poorly trained classifier, and extremely difficult dataset pairing; results are shown in Table 5
Table 6 compares the proposed C-EDL (meta) against RED Pandey & Yu (2023). Across both dataset shifts, both methods preserve near-identical ID accuracy, while exhibiting clear separability between ID and non-ID inputs: the ID coverage remains high, whereas the corresponding OOD and adversarial coverages are substantially lower. This separation is particularly pronounced for C-EDL (Meta), which shows larger ID to OOD and ID to adversarial gap than RED on -0-A--OO-S,HN, indicating stronger discrimination between in-distribution samples and shifted or attacked inputs. On MNIST-FMMNIST, the two methods are closer, but still maintain a consistent ordering where ID remains highest and OOD/adversarial are markedly reduced, supporting the claim that both approaches meaningfully differentiate ID from non-ID regimes.
B.2 ADVERSARIAL ATTACK ANALYSIS
Table complements Figure 7 by providing results of adversarial coverage across the range of attacks and perturbation levels. These results further strengthen the case for C-EDL (Meta). Across all attack types and perturbation strengths, C-EDL (Meta) consistently achieves the lowest adversarial coverage, frequently by substantial margin. For the strongest gradient- based attack (L2PGD at = 1.0), C-EDL (Meta) attains a remarkably low adversarial coverage of 15.51% + 6.09. compared to 52.21% + 9.49 for EDI. Even S-EDI, a similar post-hoe EDI. approach designed specifically for adversarial robustness, only reaches 48.80% + 8.75, further underscoring the advantage of C-EDL's conflict-aware calibration.
Notably, C-EDL (Meta) also retains its superiority under the non-gradient-basee Salt-and-Pepper noise attack, where it achieves the lowest coverage at every tested perturbation. In non coon-gradeent-aaee attacks, smaller perturbations are typically harder to detect than greater ones and therefore have greater chance to fool the model; the inverse of gradient-based attacks. For instance, at e = 1.0, C-EDL (Meta) achieves 0.14% + 0.00, considerable reduction.
23

---

Published as a conference paper at ICLR 2026
Table 7: Adversarial attack detection the comparative approaches for a variety of adversarial attacks and maximum perturbations where the ID dataset is MNIST and the OOD dataset is MNSS.. Highlighted cells denote the best performance.
Compurtie Menlods
ARaist CHC Melois
Progioed EDE.
Network
KIA
0.5
3.54%
7.41
1.51%
6.0.7
1,55%
0.95
1.0%%
6.400
1.77%
0.96
1619
9.535
114455
5.76% 4 7:78
0.36% - 0.35
0.3355 0.20
1.0
01.14%
19.86
12.215
4:449
47
4 8.79
69,60%
8.75
90.406
a 1440
= 11.90
38.76W
47366
96.1%
421
21
16.43%
6.12
15.01%
2.70%
40885
8.07%
6.00
2.75%
1.0
2.72%
+
6.00%
5.00% 6.89
8.77 + 6.10
2,08% 0:008
8.35% 6.112
1.88% 0.30
1.00% + 0,00
0 0.807 + 0.00
5.10% 1.24
067% 0.00
SmiArnlleaerreee 2017
1010
2715%
101N 11:00
2000 10001
1303
1:26 1.000
1,34% 38 0.00
1:000
1.5
0.375 4:
0.22%
0.17%
0.806%
0.15%
0.84%
0.80%
0.145 0.00
Differendall
Mutuall
coverag (NL)
07.5
eutt
ko
Est (e
caou IMC
Ril (iMBa)
CEE (W6ta)
(a) ID coverage
Differencal
Evidence
Nutual Info
EDL
HoL
Heal
De EDL
RBL (MC
ER (Mtaa)
Can
(b) OOD coverage
Figure 15: Coverage (%) across comparative approaches for different ID-OOD threshold metrics where the dataset is MNIST, the OOD dataset FashionMNIST, and the adversarial attack an L2PGD attack (maximum 1.0).
B.3 THRESHOLD ANALYSIS
Table g complements Figure 8 from the main body by providing the full quantitative breakdown of how different thresholding strategies affect ID, OOD, and adversarial coverage across approaches. Figure 15 shows the ID and OOD coverage of all approaches under different decision thresholds.
In Figure I5a despite its conservative abstention strategy, C-EDL (Meta) preserves high ID coverage rate across all thresholds, indicating that it experiences little to conflict across transformations corroborating the results shown Figure 12 While EDL, I-EDL,, and R-EDI achieve slightly higher ID coverage, they do at the cost of worse OOD and adversarial rejection, often allowing 2 "3x more OOD examples through.
In Figure 15b OOD coverage for C-EDL (Meta) remains tightly clustered below 2% across Differ- ential Entropy. Total Evidence, and Mutual Information, with the lowest value being 1.80% = 0.89 under Mutual Information. In contrast, other approaches such as DA-EDL and EDL exhibit far greater variance (depending on the chosen metric), often with elevated OOD leakage above 3-4%, highlighting weaker separation between ID and OOD inputs.
24

---

Published as a conference paper at ICLR 2026
Table Accuracy, OOD detection, and adversarial attack detection performance of the comparative approaches with different threshold metrics. The adversarial attack is L2PGD (1.0 maximum perturbation), and the ID and OOD datasets are MNIST and FashionMNIST. Highlighted cells denote the best performance for each metric.
Compurativ Mecheck
CADL Nittod
Proposed CAID.
L.BI 1NL
331075
Coe
$47700 1106
96.81 0.50
16-00% 372
2.0.5
00.38X
2.0.7
12.105 2-1
SE3055 1.400
D4L1K6 3-10
Adr
01:145
47.56%
08.97%
54
08.53
13.90
16.70X
21,625
55.427
15:335 0.00
Bral Brozass
0.00 92:095
16:05--0000
Con
01,200
18:42%
3.0.00
1.155
$3.105 2.077
$15855 14.11
B4.21% LU0
000
8.30% = 8/00
105
2-472 5.8.6
2.555 9.03
5-000
2,363
58-225 2.16
2.500 1.28
1.323
1877 2:061
Metial
10
91000
5.000
01:005 0.00
0.92
00.00
MOUNRS 0001
MURNIG 9000
0:000
000
8.5.3 = 8/79
2 1.1
5-97% 2-800
2
1.20
699
5,005 2-0.5
56.055 9.860
6.885 = 1.42
1.225
0.00
Adr Con
01 1.35
09 1333
43.7%5
6.70
6656
43.99%
1.1
33.275
1.5
-7.955 1.644
17.42%
4.43
A 0.25
0.5
-
1.0
0.1
60
32
24
06
0/
10
00
02
86
36
1.0
62
64
66
60
10
62
04
0.
08
1.0
50
82
24
86
08
1.0
Coter
Cinder
Clnter
Cister
Ginter
Figure 16: Visualisation of the conffict score as a function of Cinma Cinter and As shown, C
increases smoothly with both Cintra and Cinter, with monotonicity preserved for À s 0.5.
B.4 ABLATION ANALYSIS
Since C-EDL introduces a small number of additional hyperparameters, we conduct an ablation study to understand their individual effects on model performance. This analysis helps assess the robustness of C-EDL, to hyperparameter choice and provides practical guidance for tuning in real-world deployments.
Figure [ojlluuttrtess the theoretical behaviour of the conflict score C formalised in Theorem | The surface plots confirm that C' remains bounded in the open interval (0, 1] and increases monotonically with both Cinm and Cimer when S 1. validating the theorem's 's conditions. As increases beyond this bound, the quadratic penalty term -A(Cinter Cinta)2 induces a curvature that distorts the surface and weakens monotonicity, especially along the diagonal. This justifies our design choice to set À = 0.5, balancing the influence of asymmetric disagreement while preserving the desirable theoretical properties of the conflict score.
Table presents an ablation study over the core hyperparameters introduced by C-EDL: the sharp- Cinter penalty B, the C penalty X, the scaling factor 6, and the number of metamorphic transformations T.
We observe that B [0.5, 2.5] increases, both C-EDL variants show more conservatism. Adversar- ial coverage reduces, but so does ID coverage. The C penalty X, as seen in Figure controls how increases in Cintra and Cinter affect the total measure C. We observe that as X increases up 0.5, ID coverage increases at the expense of adversarial coverage, showing that both Cintro and Canter need be higher have a greater effect on C. As X increases 0.5, the guarantee of monotonicity is non-existent, and therefore, results begin to vary. The scaling factor d controls how much evidence reduced under high conflict. As 8 increases, adversarial coverage drops for both C-EDL variants. For example, at 5 0.25, C-EDL (MC) has an adversarial coverage of 31.83% + 4.92, while at 2.00 it improves to 11.63% + 6.36. OOD coverage improves a similar trend, at the expense of small drops in ID coverage. Finally, the number of transformations T increases, the adversarial and OOD coverage decreases, again, at the expense of small drops in ID coverage. However, inference time also grows, highlighting the trade-off between performance and efficiency. For reference, EDL has an average inference time 1.15s 0010. This and the inference time results displayed in Table based on inferring on the dataset whole, not individual data.
25

---

Published as a conference paper at ICLR 2026
Table 9: The accuracy, OOD detection, and adversarial attack detection performance of C-EDL
variants under ablations of hyperparameters (5, X, 5, T) introduced. The adversarial attack is L2PGD (1.0 maximum perturbation), and the ID and OOD datasets are MNIST and FashionMNIST.
10
10
92.00%
1.58
90
12.14%
+
1.40
92.01%
1.50
57.77%
0.76
04,19%
1,00
50.574
92, 92.41%
1.00
0OD Cwn
1.00%
0.41
2,168
0.77
1.78
0.65
1.88%
0.65
1.58%
0.77
2,05%
4.0.5
2.00% 4 0.80
1,08 0.30
LAIS 2 0.94
Ndv Cov
52.305
: 4.00
26.0454
+ 5:21
21.02%
4.89
20.118
0.30
21 21.31%
= 4.31
10.01
4 281
1200% + 4.322
15,517
6.00
72.75%
+ 5.37
13099 7:45
Abbotion
0.00
0.25
0.30
0075
1.00
0220
0.25
0.30
L200 29377 E 20.2 BE00% BOIT
0.75
10 Nec
00.008
35 0.01
0.00
0.00
SOOTH
DEL0P9 3 D.D 10,50S 0.00
10 Go
50.0035
00.
10.118
1,0
92
1:25
0.50
0.82 92.11%
9155% 0.52
0OD
1.37%
0.007
1.77%
2-17%
6.000
0.54
1.11%
1.02
2.00%
L.708
1.706
21,000
8.96
0.25
0.50
1,00
0.50
1.50
2,00
10
10,07
S00ISN
10 Cin
80.55% n 1,51
90. A5S
1.77
92:145
1.45
0.01
10.S55 1.80
0E1E 6 0,80
94.20%
1.00
98
1 1.96
95855
087
0OD Con
4822%
1.00
1.503
# 1.00
1.77
1.22
0.0.0
0.80%
0.27
1,22% 0,56
4 5..44
200%
1 LIVS
0.00
1.34% = 0.64
Adv Cw
51.850
- 1.02
27.11%
6 4.90 01.0%%
17.00%
& 5.96
- 6.50
12.08% 4.089 17.00%
6.166
18.19
15.24%
6.005 10545 4 5.59
2.07
500
1000
2500
30000
500
1000
2500
10 Noc
mm
DIritt OOT
1D
01.228
10.949
51 00%
54.778
773115
BLBER
0.50
91
1.04
81.5575
13.42% 3.02
16,497
3.30
25.07%
4.50
20L19%
7.27
15.00%
5.22%
6,203
3.44
6.12%
Inference Time
1.51x 5
0.11
2.36x 4 0.12
3.90
8:32 0.01
10.90 0.16
2.3 3 0.14
5.10 à 0.10
9.38 e 0.31
21.52+
0.21
18.32 : 0.40
Table 10: The accuracy, OOD detection, and adversarial attack detection performance of dropout strength in the EDL++ (MC) and C-EDL (MC) models. The adversarial attack is L2PGD (1.0 maximum perturbation), and the ID and OOD datasets are MNIST and FashionMNIST.
EDL++ (MC)
C-EDL (MC)
Dropout Rate
0.10
0.25
0.50
0.10
0.25
0,50
ID Ace
99.97% + 0.00 99.97% + 0.01
99.99% + 0.01
99.97% + 0.01
99.98% + 0.02 99.99% + 0.0T
ID Cov
94.00% + 1.33
93.35% + 1.28
87.74% + 1.63
93.79%
1.37
92.14%
+ 1.43
85.60% + 1.88
OOD Cov
13.76% + 2.55
7.55%
1.33
4.82%
0.97
3.82%
+ 1.77
1.77%
+ 0.63
1.42%
Adv Cov
48.26% + 6.38
38.81%
+ 4.23
26.16%
3.78
33.83% + 7.85
21.62% + 4.89
14.59% 3.91
Table [0] investigaate the sensitivity of EDL++ (MC) and C-EDL (MC) to varying dropout strengths. Across both models, increasing the dropout strength from 0.1 to 0.50 induces consistent trend: OOD and adversarial coverage decrease rapidly, while ID coverage moderately decreases. For EDL++ (MC) that lacks the conflict reduction, the trend is less pronounced, once again showing that the conflict-aware reduction is necessary to improves robustness to anomalous data.
Following the investigation of the dropout strength in EDL+ (MC) and C-EDL (MC) (Table (0). Table IT investigates the impact of metamorphic transformations in the EDL++ (Meta) and C-EDL (Meta) variants. Across all transformation types and intensities, we observe that both EDL++ (Meta) and C-EDL (Meta) exhibit less OOD and adversarial coverage at the expense of ID coverage. For example, when only the rotation transformation is used and increases from + to +-30% adversarial coverage for EDL++ (Meta) reduces by -21003% 2.66 at the expense of -8.62% + -1.33 reduction in ID coverage.
The ablation of individual transformations shows that on their own, all transformation types aid in detecting anomalous data with different magnitudes in reduction of ID, OOD, and adversarial coverage. However, when combined, ID coverage remains moderately high, with a large prediction in OOD and adversarial coverage showing that the combination of transformations effectively balances all coverage types.
The inference time against the adversarial coverage of comparative methods can be seen in Table 12 C-EDL (MC T = 2) achieves an adversarial coverage of 31.95% with a total inference time of 1.5T seconds for the entire dataset, corresponding to approximately 0.11 seconds per input. In contrast, C-EDL (Meta T = 5) yields substantially lower adversarial coverage of 15.51% while requiring 5.12 seconds for full-dataset inference, or about 0.15 seconds per input. For reference, the baseline EDL method consumes roughly 0.103 seconds per input (equivalent to around ten inferences per second), whereas the alternative post-hoc approach S-EDL (with five perturbed samples to ensure comparability) requires about 0.49 seconds per input, amounting to only two inferences per second. These results indicate that while C-EDI. introduces some computational overhead, the increase is
26

---

Published as a conference paper at ICLR 2026
Table 1I:
The accuracy, OOD detection, and adversarial attack detection performance of augmentation types and strength in the EDL+ (Meta) and C-EDL (Meta) models. The adversarial attack is L2PGD (1.0 maximum perturbation), and the ID and OOD datasets are MNIST and FashionMNIST.
EDL++ (Meta)
C-EDL (Meta)
Rotate Only
15
115
-30
-5
#15
E30
ID Acc 99.95%
0.02
99.96%
99.97%
0.02
99.96%
0.02
99.96% + 0.02
99.97%
0.02
Cov
95.99%
0.60
94.84%
87.37%
1.93
95.72%
+ 0.94
94.28% + 0.67
84.04%
1.49
OOD Cov
2.12%
0.50
1.70% = 0.60
1.32%
0.71
2.33%
0.97
1.75%
0.68
0.78% = 0.37
Adv Cov
22.48% + 4.39
6.34%
4.55
1.45% + 1.73
18.55%
7.41
4.07%
2.00
0.97% 0.95
Shift Only
-2
-4
#4 99.99%
ID Acc
99.96% + 0.02
99.98%
0.01
99.99%
+ 0.01
99.97% E 0.01
99.98% + 0.02
0.02
ID Cov
95.63% + 0.77
92.84%
1.31
71.71%
2.42
95. 12% +: 0.86
91.80%
+: 0.92
62.58%
1 3.10
OOD Cov
2.19%
0.81
2.09%
+ 1.17
0.93%
+ 0.30
2.25%
0.73
1.46%
0.49
1.7%% = 0.44
Adv Cov
16.92%
5.88
11.68%
5.49
3.53%
+ 1.56
12.10% + 3.66
8.87% 3.88
2.06% 0.89
Noise Only
0.005
0.010
0.020
0.005
0.010
0.020
ID Acc
99.96% + 0.01
99.96%
0.02
99.96%
0.01
99.95% + 0.02
99.95% + 0.02
99.96% +: 0.01
ID Cov
95.88% + 1.02
96.43%
0.68
96.25%
0.47
96.03% 4: 0.79
96.46% 1 0.24
95.99%
0.64
OOD Cov
2.28% + 0.63
2.07%
+ 0.85
1.86% + 0.77
2.40% + 0.99
1.81% + 0.66
2.37%
= 1.12
Ady Cov
49.88% + 9.61
43.44%
9.52 31. 64% 7.10
45.59%
+: 7.03
42.20% + 12.14
34.28%
11.10
All Combined (Rotate 115".
1.5... Shift =2, Noise 0.010)
ID Acc
99.98% 0.02
99.96% + 0.01
ID Cov
92.14% 1.43
94.18% 1.03
OOD Cov
1.77% = 0.63
2.00% + 0.80
Adv Cov
21.62% 4.89
15.51% 6.09
Table 12: The adversarial attack detection performance and inference time comparative methods. The adversarial attack is L2PGD (1.0 maximum perturbation), and the ID and OOD datasets are MNIST and MaSHi
Pow
EDL
FEDL
S.DDL
HEDL
K.D.L
EDL
EDL CECOSSC 1-3 C.D DAC 1-35 C.B.L (M6 T-2) C.EE (Mna 1-37
Addersantal Covesage Inferme Time shiisn))
2215
4738%
4030
30.00
45005%
3135%
2102%
21.39%
1531%
1.1%
119
1.1%
relatively modest and remains significantly more efficient than S-EDL, the only other state-of-the-ar post-hoc method considered. This highlight clear trade-off between inference time and adversarial coverage, with practical balance emerging around T = 5. Nevertheless, the choice of should ultimately be guided by the anticipated real-time constraints of the deployment setting, allowing practitioners to adjust inference time per input while maintaining the best attainable coverage.
To show that inference time scales with model size and dataset size, measure inference time (seconds) for C-EDL (Meta) on the MNIST and CIFAR-10 datasets for various T values for both the large LeNet and SeNet models in Table [3
C EXPERIMENT DETAILS
This section provides comprehensive details our experimental setup to support reproducibility and clarify the evaluation procedures used throughout the paper. We begin by describing the datasets used across ID and OOD in the evaluation, followed by details of the threshold scoring metrics used for uncertainty-baase rejection. We then describe the comparative approaches included in evaluation
Table 13: Inference time (seconds) for C-EDL (Meta) the MNIST and CIFAR-10 datasets for various values for both the large LeNet and SeNet models.
params)
panimo)
10.00
25.00
10.00
25.00
(0.21 24,12
24s
2,35
021
27

---

Published as a conference paper at ICLR 2026
and provide detailed information about model training. Finally, we include task-specific experimental configurations and implementation details relevant to each setup.
C.I DATASETS
We evaluate our approaches across diverse collection of widely used computer vision benchmarks, spanning a range of domains and task difficulties. This enables a comprehensive evaluation of model robustness and uncertainty estimation under varying conditions. To rigorously test the ability of models to distinguish ID from OOD samples, we evaluate in both near-OOD and far-OOD settings. Near-OOD datasets exhibit some degree of class overlap with the ID data, while far-OOD datasets involve distinct visual domains. Dataset-specins details, including sample sizes, input resolutions, class labels, and split protocols, are provided below. Example images from each dataset can be found in Figure 17
MNIST (LeCun al., 1998): consists of 28x28 greyscale images of handwritten digits (0-9) spanning 10 classes. We utilise the widely used standard split of 60,000 training samples, 8000 test samples, and 2000 validation samples. Pixel normalisation was applied, bounded [o, 1]. In our experimental evaluation, MNIST serves one of the ID datasets. MNIST was paired with FashionMNIST and KMNIST as far-OOD datasets due to them sharing no overlapping classes, but exhibit similar visual characteristics, including greyscale appearance, low resolution, and hand-drawn style. MNIST was also paired with EMNIST as a near-OOD dataset due it sharing the same visual characteristics and sharing overlapping classes with EMNIST containing handwritten digits in addition to handwritten letters.
FashionMNIST (Xiao et al. 2017]: consists of 28x28 greyscale images of clothing items (e.g., coats, bags. I-shirts, etc.) spanning 10 classes. We utilise the widely used standard split of 60,000 training sample, 8000 test samples. and 2000 validation samples. Pixel normalisation was applied, bounded [0, 1]. In our experimental evaluation, we use this dataset as a far-OOD pairing with the ID MNIST dataset.
KMNIST (Clanuwat et al. 2018): consists of 28x28 greyscale images of handwritten Japanese characters (specifically Kuzushiji characters from classical Japanese literature) spanning 10 classes. We utilise the widely used standard split of 60,000 training samples, 8000 test samples, and 2000 validation samples. Pixel normalisation was applied, bounded [0, 1]. In our experimental evaluation, we use this dataset a far-OOD pairing with the ID MNIST dataset.
EMNIST (Cohen et al. 2017): consists of 28x28 greyscale images of both handwritten
letters (from the Latin alphabet) and digits (0-9) spanning 47 classes. We use a split of 112,800 training samples, 15,040 test samples, and 3760 validation samples. Pixel normalisation was applied, bounded [0, 1]. In our experimental evaluation, we use this dataset as a near-OOD pairing with the ID MNIST dataset due to it sharing the same visual characteristics and overlapping classes with MNIST (handwritten digits).
CIFARIO (Krizhevsky et al. 2009): consists of 32x32 RGB images of real-world objects (e.g, birds, trucks, airplanes, frogs, etc) spanning 10 classes. We utilise the widely used standard split of 50,000 training samples, 8000 test samples, and 2000 validation samples. Pixel normalisation was applied, bounded [0, across all three RGB channels. In our experimental evaluation, CIFAR1O serves as one of the ID datasets. CIFARIO was paired with FNshionMNIST and SVHN as a far-OOD dataset due to them sharing overlapping classes, but exhibiting similar visual characteristics, including coloured appearance, real- world pictures. CIFAR-10 was also paired with CIFAR-I00 as a near-OOD dataset, due to the datasets sharing the same visual characteristics and overlapping classes. Specifically, CIFAR- contains broad object categories (c.g., cat, dog, truck, ship), which correspond to finer- soer-grrined classes like (c.g.. house cat, beagle, pickup truck, cruise ship) in CIFAR- 100. CIFARI00 (Krizhevsky et al., 2009): consists of 32x32 RGB images of real-world objects spanning of 100 classes that are fine- finegrrained counterparts of the classes from CIFAR10. For example, CIFARIO 10 has the class truck, whilst CIFAR 100 has the classes pickup truck and train. We utilise the widely used standard split of 50,000 training samples, 8000 test samples, and 2000 validation samples. Pixel normalisation was applied, bounded [0, 1] across all three RGB channels. In our experimental evaluation, we use this dataset as a near-OOD pairing with the ID CIFAR10 dataset due to it sharing the same visual characteristics and overlapping classes.
28

---

Published as a conference paper at ICLR 2026
SVHN (Netzer et al., 2011): consists of 32x32 RGB images of house numbers collected from Google Street View spanning 10 classes (0-9). We use a split of 73,257 training samples. 10,832 test samples, and 5200 validation samples. Pixel normalisation
applied, bounded [0, 1] across all three RGB channels. In our experimental evaluation, we use this
dataset far-OOD pairing with the IDD CIFAR 10 dataset due to the substantial domain shift between street-level digit photographs and object-centric natural images.
Oxford Flowers (Nilsback & Zisserman, 2008): consists of 64x64 RGB images of flowers commonly found in the United Kingdom, spanning 102 (e.g,, Water Lily, Wild Pansy, etc) classes. We utilise a split of 9826 training samples, 1638 test samples, and 1638 validation samples. This is double the size of the original dataset, as each image has been duplicated with a random augmentation to aid generalisation within training. Pixel normalisation was applied, bounded [0, 1] across all three RGB channels. In our experimental evaluation, we use this dataset as an ID dataset. Oxford Flowers was paired with Deep Weeds because they share overlapping classes but exhibit similar visual characteristics, including features found in nature (leaves, flowers, etc.). Though smaller total images, this dataset offers higher class granularity and lower per-class shot count than IinyemageNet, making it compelling test for fine-grained UQ
Deep Weeds (Olsen et al.) 2019); consists of 64x64 RGB images of species of weeds found in Australia, spanning over 8 classes (e.g., Snake weed, Rubber vine, etc). We use the standard split of 10.505 training samples, 3502 test samples, and 3502 validation samples. Pixel normalisation was applied, bounded [0, 1] across all three RGB channels. In our experimental evaluation, Deep Weeds serves as far-OOD pairing with the ID Oxford Flowers dataset due to the substantial domain shift between photographs of flowers and photographs of weeds.
Imay-et (Le & Yang. 2015): consists of 64x64 RGB images across 200 object classes, each corresponding to a subset of ImageNet. The dataset contains 100,000 training samples (500 per class), 10,000 validation samples (50 per class), and 10,000 test samples without publicly available labels. Pixel values were normalised to the range [0, 1] across all RGB channels. In our experimental evaluation, Tmay-ImageNet is used as II) dataset. T'in--Imaen was paired with Caltech-UCSI Birds-200-2011 because they share very limited overlapping classes but exhibit similar visual characteristics.
Caltech- UCDD Birds-200-2011 (CUB) (Welinder et al. 2010): consists of 64x64 RGB images of 200 bird species, collected from various natural environments. The dataset contains a total of 11,788 images, with a standard split of 5,994 training samples and 5,794 test samples. Pixel values were normalised to the range [0, 1] across RGB channels. In our experimental evaluation, CUB is used as an OOD dataset paired with Tiny-ImageNet.
In some cases where the dataset splits were not already provided, manual splits were stratified to preserve class distribution within each subset. Additionally, for all experiments, validation splits from each dataset were used to determine the ID-OOD threshold for uncertainty- based abstention, which allowed ID and OOD coverage to be determined on the test splits.
C.2 ID-OOD THRESHOLDS
To enable abstention of uncertain predictions, an optimal ID-OOD threshold was calculated using the validation datasets associated with each experimental setting. We consider multiple ID-OOD scoring metrics in our experimental evaluation to allow for robust evaluation of C-EDL and the comparative approaches.
Differential Entropy: quantifies the spread or uncertainty of the Dirichlet distribution. is computed as:
EK In I In - (a ())) - (SS)
where B(x)) is the multivariate Beta function, S is the total concentration parameter, and (.) denotes the digamma function. higher differential entropy corresponds to greater uncertainty, and thus larger values are expected for OOD samples. This scoring metric only
works on Dirichlet-based models (e.g.. posterior networks, evidential networks).
Total Evidence: quantífies the sum of total Dirichlet parameters across all classes K.
It is computed Σk=1 Og- A higher total evidence corresponds to less uncertainty in
29

---

Published as a conference paper at ICLR 2026
S
4
(a) MNIST
(b) FMNIST
N
(c) KMNIST
(d) EMNIST
680
74
22
(e) CIFARIO
(I) SVHN
(g) CIFAR100
(h) Oxford Flowers
(i) Deep Weeds
(i) ImageNtt
(k) Caltech-UCSD Birds-200-2011 (CUB)
Figure 17: Example images from the datasets evaluated upon.
Dirichlet-basee models, and thus larger values are expected for ID samples. This scoring metric only works Dirichlet-based models (e.g., posterior networks, evidential networks). Mutual Information: quantifies epistemic uncertainty by measuring how much information the model parameters provide about the predictive distribution, computed the difference between the total predictive entropy and the expected conditional entropy under the posterior over parameters.
K
(In ~ (aa 1) (S 1))
where (-) denotes the digamma function.
Following prior work (Deng et al. [2033 Kopetzki al. 2021 Yoon & Kim 2024), calculate the optimal ID-OOD threshold, a scoring metric (chosen above) was used to derive scores for the ID and OOD validation datasets. Then, a receiver operating characteristic (ROC) curve based on these scores is constructed where ID samples are treated as positive instances, and OOD samples are treated as negative instances. This curve provides way to visualise the separation between the ID and OOD distributions based on the chosen scoring metric. We extend this analysis by computing the score threshold that maximises TPR FPR to provide This procedure ensures balanced trade-off between correctly retaining ID samples and correctly rejecting OOD samples without manual tuning and facilitates the reporting of and OOD coverage for deployment/realistic scenarios.
optimal ID-OOD separation point.
Once obtained, the optimal threshold is fixed and used during evaluation on the test datasets. Test samples are rejected if their score (based on the chosen scoring metric) exceeds the threshold, allowing for consistent evaluation of both ID retention and OOD rejection performance across all approaches and datasets.
30

---

Published as a conference paper at ICLR 2026
C.3 COMPARATIVE APPROACHES
To evaluate the effectiveness of C-EDL, compare it against range of recent EDL and uncertainty quantification approaches that are representative of the current state-of-the-art. Each approach is briefly described below, alongside any implementaaiion-spciiii details or hyperparameter choices used in our experiments:
Posterior Networks (Charpentier et al., 2020): represent a foundational approach to un- certainty estimation in classification that predates and informs the development of evidential deep learning. They avoid the need for OOD data during training by directly modelling form posterior over categorical distributions. Specifically, it predicts Dirichlet concentration parameters
Pprior + 3 for each input 2, where 3 are pseudo-counts derived from class-conditional density estimates a learned latent space, and Sprior is fixed symmetric prior. The resulting Dirichlet distribution encodes both aleatoric and epistemic uncertainty closed form.
Evidential Deep Learning (EDL) (Sensoy et al., 2018): proposes a deterministic alternative to Bayesian neural networks for uncertainty estimation by modelling class probabilities with Dirichlet distribution whose parameters are derived from the model's 's neganveee outputs. The model is trained to minimise a loss by combining squared prediction error, variance, and KL divergence with a uniform prior. This evidential formulation allows the model to quantify both aleatoric and epistemic uncertainty in closed form, without requiring sampling OOD examples during training. This approach serves as the base EDL approach for the following comparative approaches, including our proposed EDL++ and C-EDL approaches. Due this being the base approach, hyperparameters are shared across the remaining comparative approaches for fair comparison and are discussed in Section C.5 Fisher Information-Basee Evidential Deep Learning (I-EDL) (Deng et al. 2023): extends EDL by incorporating the Fisher Information Matrix (FIM) to adaptively weight the loss based on the informativeness of predicted evidence. The key idea is that classes with higher evidence carry less Fisher information and should be regularised less strictly. The approach introduces a regularisation term that penalises the log-determinant the FIM to prevent overconfident predictions:
2 = Σソー log (as)) + log (1 (Oci)) ΣR ((s5)
In our experiments, we set λ|y 0.001 and annealed it linearly over the first 10 epochs, following guidance in Appendix C.2 of the original paper and our manual tuning.
Smoothed Evidential Deep Learning (S-EDL.) (Kopetzki et al.) (02T]: enhances the robustness of standard evidential models by applying median smoothing to their uncertainty estimates. Given an input x, a set of noisy samples {I,} ~ NNx or) is generated. The final uncertainty estimate is obtained by taking the median over this set, which improves robustness to adversarial perturbations by mitigating the influence of outliers. In our experiments, followed the original setup and set the Gaussian noise scale to a 0.01, using 50 samples per input following guidance of the original paper and our manual tuning. S- EDL is purely post-hoc approach, similar to the proposed EDL++ and C-EDL approaches. Hyper-Opinion Evidential Deep Learning (H-EDL) (Qu et al. 2024):: augments classical EDL by incorporating exper-opinions a generalisation of multinomial opinions from Sub- jective Logic that can express uncertainty over both singleton classes and composite subsets. This enables H-EDL to extract not only sharp evidence (supporting one class) but also vague evidence (supporting multiple plausible classes), thereby improving robustness to ambigu- ous inputs. A novel opinion projection mechanism is introduced to convert hyper-opinions into standard Dirichlet-based predictions, enabling training within the conventional EDL framework. This projection addresses the vanishing gradient issue that limits traditional EDL fine- finengrained tasks. In experiments, we adopted the two-stage training procedure described in the original paper, without introducing additional hyperparameters.
Relaxed Evidential Deep Learning (R-EDL.) (Chen et al., 2024): addresses overconfi- dence in standard EDL by relaxing two nonessential assumptions. First, it replaces the fixed prior weight (typically set to the number of classes) with tunable scalar hyperparameter controlling the contribution of the base rate in the Dirichlet construction:
a (xx)
e(x) +
31

---

Published as a conference paper at ICLR 2026
Second, R-EDL removes the variance- peraniiiiggiiiii regularisation from the EDL loss, instead to match one-hot labels.
a(w) directly optimising the projected class probabilities P(x) S
This simplification better balances evidence magnitude and proportion, particularly in OOD
settings. In our experiments, we followed the guidance from Appendix C.2 and Figure 1(b) of the original paper and set À = 0.1 as fixed prior weight throughout training.
Density-Aware Evidential Deep Learning (DA-EDL) (Yoon & Kim 2024): extends EDL by incorporating feature space density into the uncertainty estimation process. thereby enabling distance-aware predictions. During training. DA-EDL follows the same loss function standard EDL. At test time, it estimates the feature space density s(x) [0, 1] of a test input using Gaussian Discriminant Analysis (GDA) fitted on the training features. This density is then used to scale the logits before applying the exponential activation, yielding concentration parameters:
axx) exp(eo(fo s(x)
where So is the feature extractor and go is the classifier. This adjustment ensures predictive uncertainty increases as the distance from the training data increases.
C.4 ADVERSARIAL ATTACKS
This section outlines the adversarial attacks evaluated in our study to assess the robustness of uncertainty-basee models. Adversarial attacks refer small, intentionally crafted perturbations that can cause a model to behave incorrectly while maintaining high prediction confidence. This poses a significant threat to uncertainty- awaare systems, such perturbations manipulate both aleatoric and epistemic uncertainty, making adversarial examples appear indistinguishable from ID samples or evading detection thresholds.
To comprchensively evaluate robustness, we consider both gradient- basedd and non- non-gradient-oo based attacks. Gradient-based attacks typically used in white-box scenarios and leverage access the model's gradients to construct targeted perturbations. Non-gradient-bont random structured noise inputs and are more commonly used in black-box threat models. We utilise Foolbox (Rauber et al. (0177) to implement the following attack strategies:
attacks, in contrast, apply
L2 Projected Gradient Descent (L2PGD): is an iterative, white-box adversarial attack that perturbs inputs within bounded Ln-norm ball to maximise the model's 's loss. At each iteration, the input is updated the direction of the gradient of the loss with respect to the input, followed by projection back onto the L-2bbali of radius e. This results in smooth, high-precision perturbations that remain less perceptible to humans:
r(41 Proj (x² + vzJ(z(.
where is the step size and J(x, y) is the loss function.
Fast Gradient Sign Method (FGSM)): is a single-step white-box adversarial attack that perturbs the input in the direction of the sign of the gradient of the loss:
= x + sign( (V. [x, v))
where controls the perturbation magnitude. FGSM generates perceptible but targeted perturbations with minimal computational overhead.
black-box perturbation that randomly sets a proportion of input pixels to their minimum or maximum value. This form of structured noise simulates impulsive corruption and tests the model's resilience to sparse, high-intensity artefacts. It does not rely model gradients and is agnostic to internal model parameters.
Salt & Pepper Noise: is non ten-gradient---a
C.5 TRAINING DETAILS
To ensure consistency and reproducibility across all experiments, adopt fixed training configura- tion and architectural setup for all evidential models, including our proposed C-EDL variants and baseline comparators.
All models were trained using a custom convolutional neural network architecture, very closely in design to LeNet architecture. The model consists of two convolutional blocks with 32 and 64 filters respectively, each using x 3 kernels with ReLU activations and L2 regularisation (A = le 4). Each block include batch normalisation layers, 2 2 max pooling layers, and dropout layers
32

---

Published as a conference paper at ICLR 2026
(A 0.25) (Srivastava al. 2014). The final feature maps are flattened and passed through two fully connected dense layers of 120 and 84 units, each followed by the same batch normalisation and dropout layers used earlier. The output layer consists of K units (one per class according to the respective ID dataset), with a Softplus activation to ensure non-negative evidence outputs for evidential modelling.
Each evidential model is trained using the evidential loss (Sensoy et al. 2018) (except where additional modifications are specified in Section C.3) based on the mean squared error between the target one-hot label and the expected class probabilities under the Dirichlet posterior, augmented with Kulbbeck-Leibler (KL) divergence regularisation term between the predicted Dirichlet distribution and non- -on-informative prior:
L Epir(a) [lly- - p|] Dir(a)) [Var(p)] +X KL (Di((a) Dir(1)
Prediction error
Uncertainty penalty
Regularisation
(26)
K (yk- m²)2+ my mx) S+1
++-KL((Diraa) || Dir(1))
where + 1 is the Dirichlet concentration, my ag./S is the expected probability, Dir(I) the non-informative prior (3 in Posterior Networks), and À is the annealed KL weight. The KL divergence term is weighted by scalar coefficient, which is annealed linearly from 0 to over the first 10 epochs to encourage stable training. The KI. formulation follows the standard evidence- Dirichlet variational regularisation commonly used in evidential deep learning:
r EK Ek=1 0ik)
K (ak - 1) ((xx)) - +
K Σ
KL(Dir(a) || Dir(1)) = log
(27)
K I P(ack)
where I(-) is the gamma function, (-) is the digamma function, and 1 is uniform Dirichlet prior.
Models are trained using the Adam optimiser (Kingma & Ba 2014) with an initial learning rate of 0.001. We apply a learning rate scheduling strategy via Reducel.ROnPlatee
which halves the learning rate upon stagnation validation loss (patience 5 epochs, min learning rate 1)-8). All models are trained for 250 epochs with a batch size of 64. A KL annealing callback is implemented to gradually scale the regularisation weight across early epochs, improving convergence.
All experiments were implemented in TensorFlow 2.15 and executed cluster using& a maximum of three Nvidia A40 GPUs, 32 CPU cores, 167GB of memory (per GPU). All models were trained from scratch, and no pretraining external data was used. All runs used random seeds.
large performance GPU
C.6 EXPERIMENTAL SETUPS
This subsection outlines additional implementation details and experimental choices that are specific to certain experiments that may help with reproducibility and transparency.
Firstly, for all experiments unless stated otherwise, EDL++ utilises the hyperparameter combination of 5. EDL++ (MC) has a dropout strength of 0.25, and EDL++ (Meta) uses the rotate (+15%), shift (+-2), and noise (0.01) transformations. Both C-EDI. variants use the same setup but with the additional hyperparameter combination
1.5, 0.5, and 1.0.
In Table I the adversarial attack used is a gradient-based L2PGD attack. For MNIST to Fash- ionMNIST, KMNIST, and EMNIST, a maximum perturbation of 1.0 was used. For CIFARIO to SVHN, CIFARIO to CIFAR 100, and Oxford Flowers to Deep Weeds, a maximum perturbation of 0.1 was used. This choice reflects the fact that adversarial examples on natural image datasets such CIFAR-10 10 require smaller perturbations significantly degrade model performance, due the increased complexity and lower inherent separability the visual features. In contrast, MNIST-like datasets typically require larger perturbations to achieve comparable adversarial effect.
33

---

Published as a conference paper at ICLR 2026
consider all data within the test dataset not just the data that falls above or below the abstention threshold.
For the A experiments (Table 3 and Figures 5 Ila and 1lb
34


Reviews:
[{"review_id": "4tbT9Eompn", "reviewer": "Reviewer_y7KH", "summary": "The paper, “Robust Adversarial Quantification via Conflict-Aware Evidential Deep Learning (C-EDL)”, introduces a new post-hoc uncertainty quantification (UQ) method that enhances the robustness of Evidential Deep Learning (EDL) models to out-of-distribution (OOD) and adversarial inputs.\n\nMotivation\nStandard EDL provides efficient uncertainty estimation by modeling class probabilities as Dirichlet distributions in a single forward pass. However, it remains vulnerable to adversarial perturbations, often producing overconfident predictions on corrupted or unfamiliar inputs. Prior extensions (e.g., S-EDL, R-EDL, H-EDL, DA-EDL) improve OOD detection but fail to adequately address adversarial overconfidence, and most require retraining.\n\nProposed Method: Conflict-aware EDL (C-EDL)\nC-EDL is a lightweight, post-hoc framework that can be applied to pretrained EDL models. It operates by:\n\t1.\tGenerating multiple label-preserving metamorphic transformations of each input to create diverse evidence sets.\n\t2.\tQuantifying intra-class variability (how much evidence for a class fluctuates) and inter-class contradiction (how much competing classes are equally supported).\n\t3.\tCombining these into a conflict score (C) that measures representational disagreement across transformations.\n\t4.\tUsing this score to downscale the Dirichlet evidence via an exponential decay rule, thereby increasing uncertainty when conflict is high and maintaining confidence when conflict is low.\n\nMathematically, the adjusted evidence is expressed as\n$$\\tilde{\\alpha}_k = \\bar{\\alpha}_k \\times \\exp(-\\delta C)$$\nwhere $\\bar{\\alpha}_k$ is the aggregated evidence and $\\delta$ is a sensitivity parameter.\n\nThe authors also provide a theoretical guarantee that the conflict measure C is bounded, monotonic, and consistent with Dempster–Shafer theory principles.\n\nResults\n\t•\tEvaluations across multiple ID/OOD dataset pairs (MNIST→FashionMNIST, CIFAR10→SVHN, Oxford Flowers→DeepWeeds, etc.) and attack types (L2PGD, FGSM, Salt-and-Pepper) show that C-EDL substantially improves robustness:\n\t•\tOOD coverage reduced by up to ≈55%\n\t•\tAdversarial coverage reduced by up to ≈90%\n\t•\tIn-distribution accuracy maintained (~99%)\n\t•\tC-EDL variants (Meta vs MC) demonstrate that metamorphic transformations outperform Monte Carlo sampling for generating meaningful uncertainty signals.\n\t•\tThe method is threshold-agnostic and retains negligible computational overhead.\n\nContributions\n\t1.\tA conflict-aware, post-hoc calibration method for EDL uncertainty estimation.\n\t2.\tTheoretical analysis of the conflict metric’s properties.\n\t3.\tComprehensive experimental validation across datasets, attack types, and decision thresholds showing consistent superiority over prior EDL methods.\n\nIn summary:\nC-EDL presents a principled and efficient approach to making evidential deep learning models more robust to adversarial and OOD conditions, achieving strong empirical results while maintaining efficiency and avoiding retraining.", "questions": "1.\tConflict Measure Definition and Theoretical Rationale\n\t•\tThe conflict score C is central to the method. Could the authors clarify whether it formally corresponds to a measure of epistemic uncertainty (i.e., model disagreement) or a combination of epistemic and aleatoric components?\n\t•\tHow does it relate to established evidential theory constructs such as conflict mass in Dempster–Shafer theory or belief/plausibility intervals? A clearer theoretical bridge would strengthen the conceptual contribution.\n2.\tChoice of Transformations\n\t•\tThe metamorphic transformations used (rotation, contrast, etc.) appear heuristic.\n\t•\tHow sensitive is the method to the type and strength of these transformations?\n\t•\tCould the authors provide an ablation showing how different transformation sets affect performance on adversarial and OOD benchmarks?\n3.\tComputational Cost and Efficiency\n\t•\tThe paper states that C-EDL is “lightweight” and post-hoc, but no explicit computational cost analysis is provided.\n\t•\tHow does inference time or memory footprint scale with the number of transformations?\n\t•\tCould the authors provide a table comparing wall-clock latency versus baseline EDL and Monte Carlo dropout methods?\n4.\tComparison with Recent Robust EDL Variants\n\t•\tHow does C-EDL compare to S-EDL (Shannon-EDL) and R-EDL (Regularized-EDL) on the same benchmarks?\n\t•\tThese methods also modify evidence to reduce overconfidence. Are there specific cases where C-EDL performs worse or complements them?\n5.\tImpact on Calibration Metrics\n\t•\tWhile OOD and adversarial coverage are reported, calibration metrics such as Expected Calibration Error (ECE) or Brier score are not shown.\n\t•\tCould the authors report these to confirm that C-EDL improves not just robustness but also calibration fidelity?\n6.\tApplicability Beyond Classification\n\t•\tThe approach is tailored for classification tasks. Could it extend to regression or structured prediction problems?\n\t•\tHow would the conflict term be redefined in a continuous-output evidential setting?\n7.\tSensitivity to δ (Scaling Parameter)\n\t•\tThe exponential scaling parameter \\delta plays a crucial role in modulating evidence.\n\t•\tHow was it chosen, and how sensitive is model performance to this hyperparameter?\n\t•\tWould a learnable δ (e.g., via validation loss optimization) yield more consistent improvements?\n8.\tInterpretability of Conflict Scores\n\t•\tHave the authors visualized conflict maps or examined which regions of an image contribute most to high conflict?\n\t•\tThis could enhance understanding of whether C-EDL is detecting semantic uncertainty or simply pixel-level perturbations.\n9.\tRobustness Under Distributional Shift\n\t•\tBeyond adversarial examples, have the authors tested on natural distribution shifts (e.g., CIFAR-10-C, ImageNet-C)?\n\t•\tThis would strengthen claims of general robustness rather than adversarial robustness alone.\n10.\tReproducibility and Implementation Availability\n\t•\tIs there a plan to release code or pretrained models?\n\t•\tGiven that the paper emphasizes post-hoc simplicity, open-source availability would allow the community to verify these promising results quickly.\n\nSummary:\nThe main clarifications concern the theoretical interpretation of conflict, robustness to transformation choices, and quantitative trade-offs between accuracy, calibration, and inference cost. Addressing these would substantially improve the paper’s completeness and strengthen its position for acceptance.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Originality:\nThe paper introduces a conflict-aware uncertainty adjustment mechanism for evidential deep learning (EDL), which is a meaningful extension to prior post-hoc calibration and OOD robustness methods. The idea of leveraging metamorphic transformations to measure evidence disagreement is both conceptually intuitive and novel within the EDL literature.\n\t•\tQuality:\nThe experimental evaluation is comprehensive, spanning multiple datasets (MNIST, CIFAR10, Flowers102, etc.) and adversarial settings (FGSM, PGD, Salt-and-Pepper). The results consistently support the central claim that C-EDL improves robustness without retraining, confirming the technical soundness of the method.\n\t•\tClarity:\nThe paper is clearly structured with a good balance between formalism and intuition. The figures effectively illustrate the mechanism and the results, particularly the conflict-based uncertainty scaling and comparative coverage plots.\n\t•\tSignificance:\nC-EDL contributes to an active and relevant research direction — trustworthy and uncertainty-aware deep learning. By improving EDL robustness in a post-hoc and computationally light manner, the method holds potential practical value for real-world AI reliability and safety-critical applications.\n\nOverall Strength:\nA well-motivated, well-executed, and clearly presented contribution that meaningfully extends evidential learning toward robustness and reliability.", "weaknesses": "Limited Theoretical Depth:\nWhile the paper provides an intuitive justification and basic boundedness proof for the conflict metric, the mathematical grounding of how conflict relates to epistemic and aleatoric uncertainty decomposition is underdeveloped. A stronger theoretical connection to Dempster–Shafer theory or Bayesian evidence accumulation would strengthen the claim of principled robustness.\n\t•\tOverlap with Prior Work:\nThe contribution, though practical, feels incremental relative to recent variants such as R-EDL (Robust EDL) and H-EDL (Hierarchical EDL). The manuscript could better differentiate its novelty beyond being a post-hoc fusion of metamorphic testing and EDL evidence scaling.\n\t•\tEvaluation Breadth:\nThe experiments are extensive but lacking in diversity of model architectures. Most results are presented on simple CNNs and small datasets (MNIST, CIFAR10). Including modern architectures (ResNet, ViT) would improve generalization credibility and relevance for the ICLR audience.\n\t•\tAblation Clarity:\nWhile several variants (C-EDL-MC, C-EDL-Meta) are tested, ablation on key hyperparameters (e.g., transformation count, conflict scaling δ) is minimal. It’s unclear how sensitive the method is to these design choices, limiting reproducibility and interpretability.\n\t•\tQualitative Analysis Missing:\nThe paper lacks visual or interpretive examples of how conflict behaves across inputs — e.g., how uncertainty distributions change for adversarial vs. OOD samples. Such qualitative insight could strengthen readers’ understanding of what the conflict term captures.\n\t•\tReproducibility Gaps:\nImplementation details are briefly described, but no code release or reproducibility checklist is mentioned. For a post-hoc method claiming simplicity, an open implementation would be essential to validate the reported improvements.\n\nOverall Weakness Summary:\nThe paper is technically solid but conceptually incremental. Strengthening theoretical justification, expanding experiments to more challenging datasets and architectures, and including detailed ablations would substantially increase its impact and readiness for top-tier publication.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wDjdXUlqxN", "reviewer": "Reviewer_odmc", "summary": "The paper introduces C-EDL, a post-hoc uncertainty quantification method that enhances the robustness of Evidential Deep Learning (EDL) models against out-of-distribution (OOD) and adversarial inputs. C-EDL generates multiple metamorphic transformations of each input, quantifies model disagreement (conflict) via intra- and inter-class evidence variability, and adjusts the Dirichlet parameters accordingly. Extensive experiments show that C-EDL significantly reduces OOD and adversarial coverage while maintaining in-distribution (ID) accuracy.", "questions": "See Weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. C-EDL is simple and clear, which achieves promising results.\n2. The conflict measure  $C$ is formally bounded, providing a principled basis for evidence adjustment.\n3. This work provides a comprehensive evaluation.", "weaknesses": "1. Standard EDL was originally used for the most basic classification tasks. Can the proposed C-EDL be directly applied to improve the level of uncertainty quantification and performance?\n2. The citation format needs to be modified to improve readability; for example, using \\citep.\n3. C-EDL essentially utilizes multiple views and improves the accuracy of uncertainty quantification by quantifying the conflict of these views. However, there is a lack of discussion regarding some related work, e.g., [1].\n4. In Table 8, the experimental results for the optimal parameters are recommended to be bolded.\n5. I found that the parameter $\\\\epsilon$ in Equation 4 seems to be quite important in the subsequent proof; however, the intuition and motivation behind it lack a clear discussion.\n6. I suggest providing some intuitive examples to demonstrate its advantages over the baseline in quantifying uncertainty. For example, using the simplest 3-dimensional simplex.\n\n> Ref:\n> [1] Reliable Conflictive Multi-View Learning, AAAI'24.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ALUF2VL4l9", "reviewer": "Reviewer_z85G", "summary": "The paper introduces a post-hoc calibration method for evidential deep learning (EDL) by adjusting the predicted total evidence based on output disagreement across augmented input variants. Specifically, the method estimates prediction conflicts between metamorphically transformed inputs and scales the evidence accordingly to improve robustness against adversarial and out-of-distribution (OOD) data. The authors claim that the proposed approach enhances uncertainty reliability while maintaining high in-distribution accuracy and without requiring model retraining.", "questions": "See Weaknesses.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The proposed method is post-hoc and architecture-agnostic. It can be directly applied to any trained EDL model without modifying the network structure or retraining, making it highly practical and easy to integrate.\n2. The approach is computationally efficient compared to full retraining or Bayesian ensemble methods, as it only involves a few forward passes with simple input transformations.", "weaknesses": "1. The paper lacks sufficient implementation details for reproducibility. For example, the specific metamorphic transformations applied to each dataset, the exact uncertainty metric used in Table 1, and the threshold definition for coverage reporting are not clearly specified. The choice and tuning process for hyperparameters (e.g., conflict weighting and decay factors) should also be explained.\n2. The motivation requires further clarification. EDL naturally distinguishes between aleatoric and epistemic uncertainty in a single forward pass, yet the proposed post-hoc calibration does not discuss how this property is affected. Input augmentations may alter aleatoric uncertainty due to increased noise, so the rationale behind interpreting disagreement among augmented predictions as a reliable proxy for epistemic uncertainty should be explicitly analyzed.\n3. Regarding efficiency, the method requires multiple forward passes during inference. Thus, comparisons with other multi-pass methods such as Monte Carlo Dropout or ensemble-based EDL variants would provide a more meaningful evaluation of trade-offs.\n4. For OOD detection, reporting AUROC and AUPR metrics in addition to coverage would provide a clearer and more comprehensive picture of the model’s uncertainty quality and detection capability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BEFoTaXPAY", "reviewer": "Reviewer_jVfx", "summary": "The authors propose Conflict-aware Evidential Deep Learning (C-EDL), a post-hoc method to improve the robustness of pre-trained EDL models against OOD and adversarial inputs. The core idea is to generate multiple, semantically equivalent views of an input using label-preserving transformations, pass them through the base EDL model to get a set of evidence vectors, and then quantify the conflict or disagreement among these evidence sets. This conflict score is then used to adjust (reduce) the aggregated evidence, thereby increasing the model's expressed uncertainty for contentious inputs.", "questions": "See above", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "*   The problem of improving the adversarial robustness of EDL models is significant, as the base method is known to be vulnerable despite its efficiency.\n*   The proposed post-hoc approach is a practical strength, as it can be applied to any pre-trained EDL model without requiring costly retraining, making it easier to deploy.\n*   The core idea of leveraging disagreement across multiple generated views to calibrate uncertainty is intuitive and simple.\n*   The experimental results presented are extensive and demonstrate large performance gains.", "weaknesses": "My main concerns are regarding the related work, the scale of the experimental evaluation, and the analysis of the method's scalability.\n\nIn terms of related work, the authors seem to have missed recent work on improving EDL robustness. Pandey et al. (ICML 2023) also addresses the shortcomings of EDL for OOD detection by introducing a novel regularizer, RED. A comparison to this closely related baseline is missing and would be necessary to properly situate C-EDL's contribution within the current state-of-the-art.\n\nWhile the experiments are comprehensive across many metrics, they are limited to small-scale vision datasets like MNIST, CIFAR-10, and their variants. The claims of robustness and the general applicability of the method would be much stronger if demonstrated on large-scale, more complex datasets such as ImageNet and ideally real world datasets. \n\nOn a related note, I would like to see a more thorough scalability analysis, investigating how runtime scales not just with the number of transformations, but also with model size and input dimensionality.\n\nThe formulation of the conflict score C, combining intra-class and inter-class measures, seems somewhat over-engineered. While the authors provide a theoretical analysis of its properties in the appendix, the paper would benefit from a clearer motivation for this specific formulation over other, perhaps simpler, measures of distributional disagreement (e.g., average Jensen-Shannon divergence). It is also unclear how a practitioner would select the set of \"metamorphic transformations\" for a new domain, which seems critical to the method's success but is not discussed in detail.\n\nFinally, the paper's relationship with Test-Time Augmentation (TTA) could be made more explicit. The core idea of generating multiple transformed views of a test input is functionally equivalent to TTA. While the authors acknowledge TTA, they could better frame their contribution in this context. C-EDL can be seen as a novel aggregation strategy for TTA applied specifically to EDL models. Whereas standard TTA involves a simple averaging of output predictions C-EDL's primary novelty is in its aggregation of intermediate evidence vectors and the subsequent use of a \"conflict score\" to modulate the final uncertainty. The authors'  ablation study on \"EDL++\" (which effectively performs TTA on EDL evidence vectors without conflict adjustment) demonstrates that this conflict-aware step is critical for the method's success. Clarifying this aspect would help to more precisely specify the paper's novelty.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JPoHyqf2ls", "reviewer": "Reviewer_g4uc", "summary": "The paper addresses the sensitivity of the evidential deep learning approach to input perturbations, particularly to the adversarial ones. The gist of the proposed solution is to apply a variant of self-supervised learning criterion to the adversarial robustness use case in the evidential learning context for post-hoc calibration. Inputs are augmented in diverse ways and repeatedly fed into an evidential network. The resulting Dirichlet parameters are calibrated after training with a conflict adjustment formula that promotes consistently low uncertainty scores among the perturbed versions of the same input for all classes (Eq 4) and high scores in other cases (Eq 5).", "questions": "Did the authors consider alternative criteria such as an adaptation of InfoNCE, Barlow Twins, or IMAX?\n\nEvidential learning is also being used in regression [1]. In that case, as we don't have a Dirichlet distribution, I understand that the suggested conflict adjustment criterion will not directly translate. Do the authors have any insight about which basic principles of the suggested contribution can be extended to the regression case?\n\n[1] Amini et al., Deep evidential regression, NeurIPS, 2020", "limitations": "", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "This is a very solid piece of work which makes a spot-on problem definition, provides a well-grounded solution to it no matter how simple, and demonstrates the efficacy of the solution on a comprehensive set of experiments where actually everything I can think of as necessary has been already considered. The C-EDL model clearly improves the state of the art in robust implementations of EDL as visible from the main results (Table 1) as well as all the downstream side analyses.", "weaknesses": "I can follow the rationale behind Eq 5 and it makes sense. I am only not sure that this is the simplest possible way the intended goal is achieved. Extending the related part of the paper (around Lines 239-256) will contribute to its readability. I do understand that Theorem 1 clearly demonstrates that the criterion behaves in the intended way. The question here is how close the proposed solution is the simplest possible one.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)