Learning to Defer with an Uncertain Rejector via Conformal Prediction
Authors: Yizirui Fang
Eric Nalisnick
Venue: Accepted by TMLR ()

Abstract: Learning to defer (L2D) aims to optimize human-AI collaboration by allocating prediction tasks to either a machine learning model or a human expert, depending on which is most likely to be correct. This allocation decision is governed by a rejector: a meta-model that routes inputs based on estimated success probabilities. In practice, a poorly fit or otherwise misspecified rejector can jeopardize the entire L2D workflow due to its crucial role in allocating prediction tasks. In this work, we perform uncertainty quantification for the rejector. We use conformal prediction to allow the rejector to output prediction sets or intervals instead of just the binary outcome of ‘defer’ or not. On tasks ranging from image to hate speech classification, we demonstrate that the uncertainty in the rejector translates to safer decisions via two forms of selective prediction.

Published in Transactions on Machine Learning Research (02/2026)
Learning to Defer with an Uncertain Rejector via Conformal Prediction
Yizirui Fang
yfong520jhu..d edu
Deportment of Computer Science
Johns Hopkins Universily
Eric Nalisnick
malismick Gaik. edu
Deportment of Computer Science
Johns Hopkins University
Reviewed on OpenReview: openrevvee... net/ net/forum? id= SZQUBK20Ue
Abstract
Learning to defer (L2D) aims to optimize human-AI collaboration by allocating prodiction lasks to either a machine learning model or human expert, depending on which is most likely to be correct. This allocation decision is governed by rejector: a meta-model that routes inputs based on estimated success probabilities. In practice, a poorly fit or htheewise misspecified rejector can jeopardize the entire L2D workflow due to its crucial role in allo- cating prediction tasks. In this work, we perform uncertainty quantification for the rejector. We use conformal prediction allow the rejector to output prediction sets or intervals in- stead of just the binary outcome of 'defer' not. On lasks ranging from image to hate speech classification, demonstrate that the uncertainty in the rejector translates to safer decisions via two forms of selective prediction.
1 Introduction
is framework for human-Al col- laboration that divides responsibility between machine and hunan decision makers. For every test instance, 'rejector' function decides if the case should be passed to either human model (but not both). The rejector can be seen as a meta-classifier that determines how to assign responsibility based on which decision maker (human or machine) is more likely to make the correct prediction. L2D systems offer the promise of improved safety and robustness by having a human available for support. Yet this promise critically depends on the rejector's performance. Being a predictive model itself, the rejector is susceptible to the usual failure modes, such as distribution shift between training and test data and label noise. Yet, unlike with traditional predictive models, there is extra point of failure in that the distribution of the human's predictions also shift (Tailor et al. 2024).
Leareing-to-Defer (L2D) (Madras et al. 2018 Mozannar & Sontag 2020
In this paper, we perform principled uncertainty quantification (UQ) for the rejector sub-component of L2D systems. Specifically, we use the framework of conformal prediction (CP) (Vovk et al. 2022 to allow the rejector to output sets or intervals, instead of just a binary outcome (defer or not). This allows the rejector to express its uncertainty about whether the human or machine should be assigned make the decision. In turn, this unlocks new abilities for the L2D system. For example, if the rejector is unsure about to whom responsibility should be assigned, the system can simply abstain from making any prediction. As concrete example, consider automated diagnosis of skin lesions. For cach dermoscopic image, our L2D system cither oulputs a prediction or abstains, depending on the allocation decision was sufficiently certain. In the latter case, a clinician could request further information such as running additional lab tests or biopsies before making the final decision. Alternatively, an uncertain rejector could mcan that we should query both the human and model for their prodictions. If the human and model agree on their prediction, then this is good indication that that prediction is reliable (à. la ensembling).

---

Published in Transactions on Machine Learning Research (02/2026)
We explore these novel L2D workflows in experiments on tasks ranging from image to hate speech classifica- tion. We find that introduiing UQ into L.2D) allows sale alternative behaviors (e.g. abstention or consensus checking, as mentioned above) that prevent the L2D system from otherwise returning the wrong prediction. We also study varions L2D learning objectives, parameterizations, and CP formulations, finding that the one-vs-all parameterization tends to result in better downstream performance (e.g. accuracy) but at the cost of sometimes having too small of uncertainty sets and turn under-covering the true label. In summary, we make the following contributions
We are the first to formulate a UQ problem for the L2D deferral decision. Moreover, we are the first to apply conformal prediction to the rejector sub-model of L2D, providing distribution-free coverage guarantees on expert correctness.
Distribution-Free UQ for L2D Allocation (Sections 3 3.1
Novel L2D Workflows (Section 3.2 3.3
We propose four novel, alternative workflows for L2D that operate via (i) abstention, (ti) checking for consensus between expert and model predictions, (iii) preferring to query the model when the human is uncertain (for cost saving), and (iv) preferring to query the human under distribution shift.
2
Background
We first review the necessary background information on L2D and conformal prediction.
2.1 Learning to Defer
Setting, Data, and Model We focus on multiclass L2D (with one expert) (Madras et al. 2018 Mozannar
& Sontag b, though the ideas presented can straightforwardly generalize to L2D-based regression (Zaoui et al. 2020). Let X' denote the feature space and y the label space, categorical encoding of K E N classes. Let x,, X' denote feature vector, and yn E y denotes the associated class index. L2D assumes that we have access to human predictions, denoted m, E y for the associated feature vector X,, The training data then includes the features, the true label, and the human's prediction: D = {In. Vn, mn m JY The human is assumed to be skilled at the prediction task but is not an oracle. For example, the feature vector could be a medical image, m, is the expert's diagnosis from looking at the image, and yo is a true label that can only be obtained from a biopsy. L2D also assumee that the human has access to background knowledge that the classifier does not, such as years of medical training the aforementioned example. The L2D framework requires two sub-models: a classifier and a rejector (Cortes et al. 2016b a). We denote the classifier as h X + y and the rejector as r X - {0, 1}. When r(x)= = 0, the classifier makes the decision, and when r(x) = 1, the classifier abstains and defers the decision to the human. Thus the rejector can be thought of as a class-classiffer; predicting which predictor would most likely be correct in its prediction.
Learning Learning in L2D requires us to fit both the rejector and classifier. We assume that whoever makes the prediction-moon or human coman--nncuss a loss of zero (correct) or one (incorrect). Using the rejector to toggle between the human and model, have the overall classifierrreecctor loss:
rh, = Ex.y. (1 (1- r(x)) 1 [h(x) * yy++ + r(x) I1mm + x]]
(1)
where I [x((x) # y] denotes an indicator function that the model prediction does not match the label and I|m A y] denotes another indicator function that the human prediction does not match the label. Minimizing this loss results in the Bayes optimal classifier and rejector:
h" (x))) = arg max P(y = y)æ), NEY
(#))
I P(mm y/w) max Ply =)/x)]
VEy
where P(y|æ) is the probability of the label under the data generating process and IP(m y/æ) is the probability that the expert is correct. The assumption that the expert has additional knowledge is what allows them to possibly outperform the Bayes optimal classifier.
1 An abbreviated version of this paper appeared in the non-archival proceedings of the NeurIPS 2024 Workshop on Bayesian Decksion Making and Uncertainty.
2

---

Published in Transactions on Machine Learning Research (02/2026)
Mozannar & Sontag, 2020 Verma & Nalisnick, 2022 Mao et al. 2024c Cao et al. 2023 Charusaie et al. 2022 For our implementation, we focus on the two surrogates that have demonstrated the ability to learn calibrated prodictors in practice since the more calibrated the prodictor, the better the conformal prediction results will be. Specifically, we use Verma & Nalisnick (2022) one-vs-all (OvA) parameterization and Cao el al. (2023)'s asymmetric softmax (A-SM) parameterization. These parameterizations assume the classifier and rejector are unified via an augmented label space: y = (1)), where denotes the rejection option. Then let 9k X + R for & [1, K] where l denotes the class index, and let 9K+1 X + I denote the rejection (1) option. The functions are analogous to the logits of neural-network- classifier. The OvA surrogate loss is given as (Verma & Nalisnick 2022]:
Surrogate Losses Several consistent surrogate losses have been proposed for Equation
NorA(gi, Vo.. v. = ([),(=))+ +
Σ
g1- + + 01-9k+1
of W'EW
(3)
+ +1mm = y] (0(gk+1 bl-9x+1(x)]
where Φ- {=1} x R + R, is a binary surrogate loss. For instance, when & is the logistic loss, we have ([f(x)] log(1 + fx)))
The A-SM surrogate loss is defined as follows (Coo et al. 2023
(A.SM(g)..... ................................ -:,........... -ol AA-MM (g(a), v) [[ + y) log (s)sM((( K +1) [m y) log a sM (g(()))))))))())) K 1)
(4)
exp(gg(x²)
if yナ
Σ - exp(gr (x))
where (AA.)M((()),8))
expl9k+1(x))
otherwisc.
Σø expley (m)) max (x)l)(()))
Here, the 'asymmetry' is due to the softmax having different terms in the denominator for the class and rejec- tor terms. The symmetric softmax parameterization (Mozannar & Sontag, 2020) has the same denominator for both terms, which leads to issucs for estimating the expert's correctness probability in practice (Verma & Nalisnick] 2022 Cao el al. 2023). For both paramelerizations, at Lest time, the classifier is obtained by taking the maximum over functions: Ū = h(x)) = arg max yEl.K] By (x)) The rejector is implemented as: r(x) = [[] (x) Z max My (x)).
Expert Correctness Both the OvA and A-SM parameterizations compute the probability that the expert is correct. For the OvA parameterization, this probability is directly parameterized by the (K + 1)th binary classifier:
p(m = y/x) = 4ovA [x)+1(x)] 1 expl-9x+1
A-SM similarly uses the deferral score, but here the parameterization requires evaluating all K + functions:
cxp(0x+1(z))
f(m = y/x) ( +) K+1)
(6)
Σø exp(gg maxyeyy explgy
Both estimators have been shown be competitively calibrated when trained by empirical risk minimization and without relying upon post-hoc procedures such lemperature scaling (though they could be employed well) Cao et al. 2023
2.2 Conformal Prediction
Conformal prediction (CP) a model-agnostic, distribution-free approach uncertainty quantification with finite-sample guarantees (Shafer & Vovk 2008 Angelopoulos & Bates 2023). Given a test-time feature vector XN+1, CP seeks to construct prediction set C(xN+1; T)
such that the true label y 1 is included with
3

---

Published in Transactions on Machine Learning Research (02/2026)
probability 1 1- P (yN+1 E C (xx++1+)) 2 21 111a, a, for a [0,1]. T is parameter that controls the set size, as will be described below. This statement is a marginal guarantee, meaning that it will hold, on average, over test samples but will not necessarily hold for any particular sample. CP's aforementioned guarantee is built off the crucial assumption that the test data is drawn exchangeably with a calibration set.
To compute the parameter that controls the prediction sets, the split-CP (a.k.a. inductive CP) algorithm [Papadopoulos et al., (002) is popular choice due to its computational and sample efficiency (Fang & Bellotti, 2024) and resemblance to the traditional workflow of hyperparameter tuning. Sp requires be fit to a held-out calibration set D2, which must be drawn exchangeably with the test set for the CP coverage guarantee to hold. Given a classifier already trained on the training set D1, its estimated class probabilities are denoted [xx = [fi (x),..., ,x)),..,,(((( [x(x)]] CP then requires & score function be chosen that quantifies how well the model's prediction conforms to the true label's. Using the softmax confidence associated with the true label is a reasonable choice: 8 (x f) = - fx(x), where f, (x) is the estimated score for the true label. Others exist that incorporate all dimensions that have higher confidence than the true label (Romano et al., 2020). Split-CP then proceeds by evaluating xx f) on all points in the held-out set and setting f to be the (1 - a) quantile (with sinite-sample correction) of the empirical distribution of scores. For test time
point x,+1: the prediction set is constructed as:
C(xN+1) = {j fx( 2 1- }..
which represents the softmax dimensions that outscore the threshold 1- CP is commonly evaluated by checking that the desired coverage level is achieved in practice while also having efficient set sizes. The latter is crucial since the CP guarantee is trivially met by choosing C(xN+1; = y for (1 a3% of test cases.
3 Uncertain Deferral via Conformal Prediction
We will now apply the CP framework quantify the uncertainty in the rejector sub-component of an L2D system. Concretely, instcad of just outputting 0 (model) or (human), we want the CP-based rejector to output set C, (x; T), which is element of the superset {{0), [0, C, (x;T) {0, means that the rejector is unsure if the decision should be allocated to the human or model. Thus, instead of prediction sets, we call the uncertainty set of the rejector a deferral set. In Section 3.2 we will discuss how to incorporate these sets into downstream decision making.
Ideal Construction Recalling the Bayes optimal decision rule for the rejector (Equation 2 it would be ideal C, (x:T) could satisfy the guarantee:
P (r" (XN+1) E C, (xN+15T) 2 1
which mcans that, marginally, the probability that the output of the Bayes optimal rejector is in the set is at least 1 - a. Constructing an adaptive set via validation statistics, unfortunately, requires that we be able to compare Pmmm = y|æ) vs P(ylæ) to compute a non-conformity score. This comparison requires high-fidelity estimates of two conditional probabilities, and obtaining estimates of such one-off events known to be impossible (Roth al., 2023). The only work-around is if we observe multiple samples of both the label y and expert. prediction (Johnson et al.] 2024), which would only drastically increase the already high supervision burden of L2D, Thus, we leave this construction open problem and turn to more practical alternative below.
Practical Construction We instead consider constructing the set to capture an alternative quantity: [mN+1 YN+1l, an indicator function representing if the human will make the correct prediction. Similarly, we wish to construct prediction sets such that this binary variable will have a coverage guarantee:
P (1 MN = YN+1] E C, (xN+1TT) 2 21a a.
(7)
This statement is not equivalent to the one above since the expert could be correct (i.e. I [mN+1 = =N41l= 1) but P((|)) still be better predictive model (i.e. r (x) 0). In other words, this formulation is considering
4

---

Published in Transactions on Machine Learning Research (02/2026)
the expert's performance in isolation of the classifier's. However, the high-level semantics retained since C, (x)+1; = (0} means that the expert will likely be wrong and so using the classifier is either a good decision or not an inferior one (if the model would also be wrong). Conversely, C, (X)+1:T) = {1} means that the expert will likely make the correction prediction. If Cr (X++1;T) = f0, 1]. then the prodiction set is unsure the expert will be correct and still suggests uncertainty in the deferral decision. This relaxation, importantly, allows us to define a practical conformity statistic. Prior work has demonstrated that this practical construction estimating expert correctness can be properly calibrated and effectively correlates with the expert's 's superiority over the classifier |Verma & Nalisnick 2022.
3.1 Constructing Deferral Sets
We can construct deferral sets that follow the guarantee in Equation 7 by treating the deferral decision as a binary classification problem: whether the expert will make the correct prediction or not. Following CP it is usually applied to binary classification, we construct the conformity score using the binary probabilities given in Equation ion 5 for OvA and Equation G for A-SM. To obtain the threshold f, we follow the slandard procedure of split-CP CP by computing these non-conformitt scores on a held-out calibration set (Angelopoulos
& Bates 2023 obtaining the (1 1--a) empirical quantile, and applying the threshold at test time as follows:
{0}
if 1 1- = y/x) 2 1
Cr (x: = {1}
if p(m=ylx) 2 -
(8)
{0,1} otherwise.
The set C, (x; f) should satisfy the coverage guarantee given in Equation 7 assuming the usual assumptions of CP hold, such as exchangeability between calibration and test data.
3.2 Using Deferral Sets in Decision Making
Now that we have detailed how to construct CP deferral sets, we next address how to use them to improve decision making within the L2D framework. While there are surely alternative uses, below we detail three that we believe will be practical and useful in a variety of applications.
Abstention The use that likely first comes to mind is prediction with the option to abstain (Chow 1957
Cordella et al. 1995 Herbei & Wegkamp 2006 Hellman 1970 Geifman & El- Yaniv 2017). In the traditional case, the classifier only makes a prediction it is confident; otherwise, it abstains since the consequences of being wrong outweigh the consequences of providing no prediction. This is often appropriate for applications in healthcare: it is better wait and perform more tests, seek out more opinions, etc. than to give patient wrong diagnosis. Our CP deferral sets allow for a similar workflow, but instead of abstaining because the prediction is uncertain, the L2D system will abstain because it is uncertain about to whom to allocate responsibilityy the machine or human. Specifically, if C, (#)+1: = {0, I,, then the L2D system will abstain. Otherwise, the system will defer (z) = 1. A visualization of this workflow is shown in Figure la As is typically the case with abstention methods, we expect this workflow to improve the system accuracy at the cost of reducing coverage.
Consensus Prediction We next consider how to make a prediction even if C, (IN+1: = (0, 1}. If the rejector is uncertain to defer not, we propose querying both the model and human for their predictions. If they agree, then that consensus prediction is output as the L2D system's final prediction. If they do not agree, then the system abstains from making any prediction. This workflow has the same appeal to safety as the abstention-oniy option, but it will have higher coverage since it will make predictions when the abstention-only workflow would not. This workflow is diagrammed in Figure 1b. We expect this workflow to perform similarly as abstention but with increased coverage, since it can still make predictions even when the deferral set is of maximum size.
Human-Preff Prediction under Distribution Shift We consider cases in which intuition leads
to believe the human more robust. predictor than the model. Consider the task of image classifier under
5

---

Published in Transactions on Machine Learning Research (02/2026)
features
features
y i = m
C(x) = [0, }
C(x) =
classifier
X
[0, 1]
if
abstain
human
(a) Abstention
(b) Comsensus Prediction
Figure L2D Decision Making Workflows. Subfigure (a) shows that the L2D system will abstain if the rejector is uncertain. Subfigure (b) shows the alternative workflow in which, if the rejector is uncertain, the system will check for consensus between the expert and model predictions and abstain otherwise.
covariate shift caused by corruption noise (Ovadia et al. 2019). Even low-levels of noise can cause modern classifiers to start to fail, but a human can often be robust to similar noise. Another example of such human superiority is the case of adversarial examples, which by definition do not fool humans but fool a classifier. To cover such cases which safely concerns dictale that the human should have priority, we call our third workflow thuman-preferred prediction. This means that if C, (#N+1: query and return the human's prediction the final output, despite the uncertainty. In this case; we are not using the deferral set in the same way the previous two workflows since covariate shift is assumed to be happening. This shift violates the core assumptions of CP, invalidating the coverage guarantee.
{0,1}, the L2D system will still
3.3 Constructing and Using Deferral Intervals
Rather than producing prediction set for the binary classifier (Section 2.2 we can instead consider uncertainty interval for the rejector's confidence itself. This would result in the uncertainty interval of the form (x such that the conditional endpoints satisfy (x() E [0,1), b, (x) E (0, 1], and bx(x) S b, (x). The coverage guarantee would then be IP (IP(m= = ylx) E [x) (x)]) 2 1-aa, where a E [o, 1] again controls the nominal coverage. Barber (2020) provides an algorithm to compute this interval in practice. Their
algorithm can be applied straightforwardly to this case.
Moving on to decision-making, the deferral interval can be used the same way the deferral set, as outlined in Section 3.2 The only change is that instead of, for example, abstaining when the set is of size two, here we need to specify certain width that, when exceeded, triggers abstention. One possibility is to simply abstain if the interval is on both sides of 50% (i.e. 0.5 E (bx(x), b, (x))) and to not abstain when the interval is contained on one side (i.e. 0.5 < (x) or 0.5 > (x)).
Yet unlike with deferral sets, this interval allows for a deferral decision that is close to traditional L2D but can be made more robust. Instead of just comparing the point estimates of the rejector and classifier confidences,
use the interval and only defer when we are very sure that the human is more likely to be correct than the classifier: defer if br(x) > max ply ylx). Doing so will ostensibly save in expert queries since the system will only call the expert when they clearly improves upon the classifier.
Prefe-ede Prediction for Cost Saving While the abstention and consensus prediction work- flows in Section 3.2 apply likewise to deferral intervals, we propose an additional workflow, model-preferred prediction. When the uncertainty interval is [0, 1], we are unsure the expert will be correct, and since experts usually require some expense to query, then we may want to query the expert only when we are sure they will be correct. Otherwise, the L2D system may have just an acceptable outcome querying the model, which often requires negligible cost to query. We expect this workflow to increase the classifier's coverage while not substantially decreasing overall system accuracy.
In preliminary experiments, we found deferral intervals improved allocation calibration (ECE 5.86 + 5.17). However, the intervals were often too wide support informative routing decisions at the desired coverage level. This reflects known cilibration-ffficienn trade-off in conformal inference: marginal coverage is enforced by inflating interval size (Angelopoulos & Bates 2023: Barber al. 2023 especially with split

---

Published in Transactions on Machine Learning Research (02/2026)
calibration and limited signal, which can yield intervals that are decision-agnostic (e.g. near [0, 1J) and thus uninformative for cost-aware thresholds. We therefore defer these results to Appendix C
4 Related Work
The L2D framework (Madras al., 2018 along with its precursors (Chow 1957
Bartlett & Wegkamp 2008
Yuan & Wegkamp 2010; Cortes al.
2016b) have received much altention of late due to their potential
to improve safety via semi-automation (Raghu et al. 2019 The majority of such attention has focused
on I.2''s learning objective (Mozannar & Sontag] 2020 Verma & Nalisnick] 2022 Mao et al. 2024c b
Cao et al. 2023 Charusaie et al. 2022) and its extension to multiple experts (Verma et al.) 2023 Mao
et al. 2024a Keswani et al., 2021 Hemmer et al. 2022 Only two works have previously considered the
uncertainty estimation abilities of the rejector sub-component, with Verma & Nalismick (2022) first observing
the aforementioned pathologics of the symmetric softmax parameterization and and[Cao al. (2023) proposing
the asymmetric softmax a remedy. Liu et al.
(2022) employed ensembling to estimate the classifier's
uncertainty and used this to inform the deferral decision, but their approach does not model the expert's 's abilities nor represent the expert's uncertainty.
Conformal Prediction for L2D CP has previously been incorporated into L2D and related frameworks. Straitouri et al. (022)) and Babbar et al. (2022) both proposed performing CP for classifier and then passing the set to a human to choose the label that will be the final prediction. Yet. like the aforementioned approach by Liu et al. 2022), the classifier's 's uncertainty is being quantified, not the human's, which is the focus of our methodology. The work of Verma et al. (2023) more related: they apply CP to multi-expert L2D to quantify the uncertainty in who the best expert of the multiple available. Their coverage guarantee is formulated with the goal of including this best expert in the set. Our approach could be applied to multi-expert L2D, but it would construct a deferral set per expert, not across experts as they do.
Large Language Models using Conformal Prediction for Deferral With the rapid adoption of Large Language Models (LLMs), conformal prediction has become vital tool for safety, aligument and model routing. Several concurrent approaches design conformal prediction with LLMs to mitigate hallucinations on various tasks (Quach et al.) 2024 Cherian et al.) 2024 Huang et al., 2025). Su et al. (2025) introduced an uncertainty-awaro router that defers hard samples from a weak LLM to a strong reasoning model basod
on conformal set sizes. However, this work is not done for the L,2 framework.
5 Experiments
We now experimentally demonstrate that incorporating uncertainty via CP into the deferral decision can have tangible benefits to the safety and robustness of L2D systems. Our experiments follow closely the setup
in previous works on L2D MMoannarr et al. 2023 Verma et al. 2023 Cao et al.) 2023) while introducing uncertainty quantification for the rejector. We trained L,D models using the OvA and A-SM surrogate losses.
Taking this base L2D model, we then apply the CP procedure described in Section 3 Our implementations are publicly available at htttp:://giiae for additional details, including training hyperparameters and backbone architectures.
com.yyiiirr/cooooooooooooooo [_t See the supplementary materials
Datasets We utilize three datasets tailored to different tasks: CIFAR-10 (Krizhevsky 2009 for image classification, HAM10000 (Tschandl et al. 2018) for skin lesion diagnosis, and Hate Speech (Davidson et al. 2017) for hate speech detection. The CIFAR-10 dataset comprises 60,000 instances, divided into training, calibration, and test sets at 70%, 10%, and 20%, respectively. Similarly, Hate Speech contains 25,000 instances, split into the same proportions. The HAM10000 with 10,015 dermatoscopic images, is divided into 60% training. 20% calibration, and 20% test splits.
Models and Exports We follow previous work's L2D experimental scttings Mozannar et al. 2023; Verma Nalisnick 2022 Verma et al.) 2023), including their choice of base model backbones and expert simulations. We apply lhyee-layer convolutional neural network (CNN) for CIFAR-10, a 34-layer residual
7

---

Published in Transactions on Machine Learning Research (02/2026)
network (ResNet34) for HAM10000, and linear network and SBERT embedding RReimers & Gurevych 2019) for Hate Speech. Expert simulations mirror Mozannar et al. (023): on CIFAR-10, an oracle predicts perfectly on the first k=6 classes and uniformly at random on the remaining (10-k); on Hate Speech, we use a stochastic "random-annotator" bascline; on HAM10000, an MLP-Mixer trained on meta-data emulates an expert with canlextual information beyond pixels (Tolstikhin el al. 2021
Table 1:
Coverage and Efficiency. We report mean and standard deviation of the empirical coverage and the average size of the deferral set for confidence level of 1 = 90%.
Dataset
Parameterization
Coverage (%)
Average Set Size
OvA
86.94
0.86
1.07
0.03
CIFAR-10
A-SM
90.53
= 0.56
1.37
+ 0.01
OvA
90.65
0.63
1.25
0.01
HAM10000
A-SM
91.13
+ 0.58
1.28
+ 0.03
OvA
90.35
0.53
1.03
0.03
HateSpeech
A-SM
90.67
0.52
1.01
+ 0.01
5.1 Coverage and Efficiency
We first experimentally verify that the target coverage is met, validating CP's guarantee (Equation 7 In
Table [ we report the empirical coverage and average set size for the three aforementioned datasets. Both parameterizations meet the target coverage level (90%) for all datasets except for OvA on CIFAR-10 (~ 87%). In all cases, the sets are quite efficient, with the average size always being less than 1.3. The exceptionally small set size of 1.07 for OvA on CIFAR-10 leads to its mis-coverage. We suspect the mis-coverage is due (natural) train-test distribution shift.
5.2 Learning to Defer with Abstention and Consensus Prediction
We next investigate the ellicacy of the abstention and consensus decision-making workflows presented Section 3.2 Table 2 reports the system accuracy, ratio of test points deferred, and the coverage of the system (i.c. the fraction of points for which the system does not abstain) again for CIFAR-10, Hate Speech, and HAM10000. We see that both OvA and A-SM improve upon the system accuracy of the base L2D model for CIFAR-10 and HAM10000, with improvements ranging from 2 to 5 percentage points (in absolute terms). However, the coverage reduction is variable, ranging from modest (-8 percentage points) to substantial (-38 percentage points), meaning that the system accuracy improvement would be practical in some cases (e.g. OvA for CIFAR-10) and not in others (e.g. A-SM for CIFAR-10). On Hate Speech, abstention occurred for very few points, leading uninteresting system accuracy results. We do not see a clear superiority between the parameterizations.
Table 2 highlights the isafety-vvailabiiity" trade-off inherent to conformal L2D. This drop implies a 'routing ambiguity' where the rejector cannot confidently distinguish between expert and model capability. The consensus prediction workflow demonstrates how we can recover some of this lost coverage. By querying both model and human when the rejector is uncertain, we increase coverage significantly (e.g., 67.57% for CIFAR-10 A-SM) while maintaining comparable system accuracy.
5.3 Learning to Defer under Covariate Shift
To evaluate three workflows under covariate shift, we induce out-of-distribution (OOD) shift with a six-level severity index (1 (1- where levels 1-5 increase smoothly. We then define level 6 as the extreme-shift condition across all datasets. The transition from level to 6 represents a markedly larger distributional change than the preceding increments. On CIFAR-10, we utilized the brightness corruption subset of CIFAR-10-C for severity levels to and use SVHN at level to induce a semantic shift. For HAM10000, we compose two image corruptions with reyelie parameters: (i) masking with fraction p growing from 10% to
8

---

Published in Transactions on Machine Learning Research (02/2026)
Table 2: Abstention and Consensus Prediction, We report mean and standard deviation of system accuracy, fraction of points deferred, and test-set coverage.
Paramesarizatin
Method
System Accuracy
Fraction Deferred
System Coverage
Base Model
84.71
1: 0.46
55.26
1.76
100
CIFAR-10
OvA
Abstention
1.02
2.30
92.14
0.48
Cousersus
86.79 1 1.07
56.38
2.31
93.32
0.52
Base Model
81011 = 0.45
56.63
E 3.13
100
A-SM
Ahetention
87.05
0.76
84.13
4.56
62.53
0.75
Cousensus
87.58 + 0.61
79.62
4.31
67.37
0.75
Base Model
82.1 + 0.49
33.71
2.39
100
HAM1000
OvA
Alstention
2.84
75.23
1.40
Consersus
85.72
0,63
34.27
2.52
88.39
1.85
Base Model
78.92 = 0.29
26,68
1 3.07
100
A-SM
Alstention
87.05 1 0.87
28.11
1. 3.45
72.82
1.19
Cousensus
81.76
0.44
3.16
81.48
0.95
Base Model
92.09 + 0.07
42.41
+ 0.99
100
Hate ppeech
OvA
Abstention
92.28 + 0.14
42.48
+ 0.96
99.38
0.48
Consersus
92.25
0.13
42.42
0.96
99.78
0.22
Base Model
01.82 = 0.32
67.91
+ 1.76
100
A-SM
Abstention
91.88
1 0.15
67.79
1 1.74
99.16
0.75
Consersuus
91.88
0.12
1.73
99.65
0.28
50% at level 5 and 80% at level 6, and (ii) Gaussian blur with kernel size increasing from 3x3 to 13x13 and their standard deviation a from 0 to 4 at level 5 then 6 at level 6. For HateSpeech, we perturb embeddinns
with adversarial noise injection (Wei & Zou 2019 Donahue et al.) 2017): progressively from level 1 to 5 (i) dimension masking with ratio r E (5%. 25%]. (ii) additive jitter with standard deviation increasing from 2 2% to 2s 10,, and (iii) simple token-inspired edits with rales up to 25%. Level 6 constitutes an extreme step: r 40%, jitter 15,, and edit rates R 40%. Here, we include additional baselines that test other uncertainty methods (deep ensembblnng and if the held-out data we use for split-CP could be better used for finetuning. We detail these additional method variants below.
Original & Original A-SM We built our original models with OvA surrogate (Verma et al. 2023 and with A-SM surrogate (Cao et al. 2023) on dataset without shift.
Conformal Following Section we calibrate the rejector with split-CP CP on calibration set from the non- shifted dataset to compute the threshold f.
Conformal + Shifted Deal While the above conformal method does not fit to the target distribution, a subset from the target distribution is expected to calibrate the system to target distribution in computing T in Section
Finetuned on Shift (Baseline) We perform a finetuning to see how L2D framework could take the most advantage of the limited and invaluable data from target distribution. Rejectors were trained on the source distribution will apply on the same subset in the Conformal Shifted Deal method to finetune.
Selective Prediction (Baseline) To disentangle the benefits of the L2D rejector from simple uncertainty thresholding, we compare against a Selective Prediction bascline (Mozannar et al.] 2023 Geifman & El- Yaniv 2017 This method relies solely on the base classifier's vanilla confidence, defined as the maximum softmax probability. A threshold т is tuned on the calibration set to maximize system accuracy: prediction is deferred the classifier's confidence is below T, and retained otherwise.
Ensemble (Baseline) We approached the uncertainty ensemble by Liu al. (0022) in computationally efficient way by taking advantage of the already trained L2D functions. An uncertainty ensemble can be constructed by reinitializing and trivially retraining m rejector layer functions based on above trained L2D functions. To align with the size of the conformal set C, (x:f) in this study, we set m = 2.
Prediction Figure reports the system accuracy and ratios of deferred instances in the population of the abstention, consensus, preferedef methods shown in Figs. 2d 2h and [ respectively for OOD data. In this scenario, it is notable that under non-extreme distribution shift, both proposed conformal hot
9

---

Published in Transactions on Machine Learning Research (02/2026)
Pat
Real
goui Orighe
80.0
Abetention Anamay (56)
67.5
Abstention Accunsey (96)
66.0
62.5
80.0
Alstention
73.0
72.5
55
Severity Levels
Severity
Soverity
100
Abstantion Ratio Deforrod (%)
Alstoncion Ratlo Duforred (95)
643
Alddention Ratio Deforre (96)
90
50
60
30
30
20
30
3
4
5
Severity Lovels
Sewarity Lavela
Secority Levols
(a) CIFAR-10-C
(b) HAM10000
(c) Hate Speech
(d) Abstention Prediction.
Comsanens Accaracy (96)
87.0
90
Comeraat Arcuracy (8%)
Avcuncy
80
82.5
27.6
88.0
75.0
60
22.5
70.0
75.0
67.5
Severity Levels
Severity Levels
Severity Levele
Consenas Ratio Delerred (%6)
Consmans Batio Deforved (16)
Doforved (36)
60
60
30
20
20
10
Severity Levell
Severity Lovels
Severity Levels
(e) CIFAR-10-C
(f) HAM10000 hh) Consensus Prediction
(g) Hate Speech
10

---

Published in Transactions on Machine Learning Research (02/2026)
Paa
Human Preforred Accuraty (9)
Hunaa Preferrol Acctrnay (9%)
$2.5
Hamnr Preferrdd 1%6)
75.0
78
67.6
72
Severity Levels
Severity Levels
Severity Levela
Homan Preferred Ratio Deferred (%)
1000
Haman Preforred Ratio Dedorrod (%)
Hatoo Proferrel Ralio Dedorredd (%6
90
80
20
30
80
30
20
40
00
10
20
0
5
Severity Levells
Sesarity Lavela
Sevvrity Lesels
(i) CIEAR-10-C
(i) HAM10000
(k) Hate Speech
Human Preferred Prediction
Figure 2: L2D via Conformal Prediction OOD. Figures above report the mean and standard deviation of system accuracy and ratio of deferred instances for methods stated in this section via abstention, consensus,, and human- preferred prediction under different levels of distribution shift for CIFAR-10C, HAM10000, and Hate Speech. The proposed L2D framework, employing both OvA and A-SM surrogate losses, exhibits less fluctuation and greater robustness against covariate shift compared to most listed methods, although model deterioration remains evident.
outperform the original L2D framework and selective prediction. In particular, Conformal OvA + Shifted Dent and Conformal A-SM + Shifted Dent methods demonstrate effective deferral behavior by recognizing uncertainty in the test data, thereby maintaining the overall robustness and accuracy of the system. This approach limits performance degradation across shifts from levels to 5 in CIFAR-10 and HAM10000 from level to On the Hate Speech, the performance decline was mitigated, showing slower rate of deterioration.
Discussion The divergent behaviors observed in Figure 2 underscore the necessity of uncertainty quan- tification in the deferral decision under shift. As evidenced by the rising deferral ratios in Figure 2 the Conformal Shifted Dew methods dynamically adapt to the shift intensity. For instance, in HAM10000 levels 4-6, Conformal OvA + Shifted Deat move from 75.91% to 74.97% while Original OnA move from 69.01% to 67.00%. This suggests That recalibrating the rejector on even a small sample, for example 10% calibration compared with 70% of training or 20% of testing, from the target distribution allows the system effectively detect when the modcl's competence region has been exitod. Consequently, the system pre- serves overall reliability by routing ambiguous instances the consensus or the human expert or abstaining entirely.
11

---

Published in Transactions on Machine Learning Research (02/2026)
5.4 Evaluation of Rejector Uncertainty
In Section 3.3
incorporate uncertainty interval to defer and abstain conservatively. Specifically, L2D system should not defer when human expert is not believed to predict correctly under confidence level - a. We introduce two metries that jointly characterize the performance of the rejector when deferring; uncertainly rejector accuracy ado(m = y) and uncertainty classifier accuracy accly = y) as follows:
Σ T( -mm==y,r(a) y,r(a) 11
E v.r(m) =0]
aCCm=y
accy
Σ [(( 1|
E [ =0
Here, r(x) indicates deferral, and r(x) = 0 indicates acceptance of the classifier's prediction. The metric 8CCm=y measures the correctness of deferred predictions assuming the original model m approximates the human expert, and acCy=y quantifies the accuracy of predictions made autonomously. Together, these metrics summarize a L,2 system's 's decision-making performance under uncertainty. We observed improvements in both metrics under L2D with deferral interval, particularly large in gains acCy=y; detailed results appear in Appendix These gains indicate that uncertain instances are predominantly deferred.
6 Conclusions, Limitations, and Future Work
We applied conformal prediction to the rejector component of the learning-to-deff framework with both one-vs-all and asymmetric softmax paramotorizations. This approach offers finito-sample, distribution-fros guarantees for quantifying uncertainly in the expert's predictions. Our experiments demonstrate that not only does our method achieve the targeted coverage guarantees with compact prediction sets, but the re- sulting deferral sets or intervals also enable alternative decision-making workflows, such as abstention expert-mode consensus. In particular, we advocate an abstention workflow that empowers the system to respond "I don't know who knows" when its confidence is insufficient, thereby enhancing the safety and robustness of human Al collaboration. Such a system alerts users to gather additional information before making a confident decision.
The primary limitation of work is that deferral sets constructed based expert correctness, not on the comparison that truly dictates the deferral decision. They reflect but do not perfectly align with the Bayes optimal rejector that compares the expert's s correctness probability with the classifier's confidence. Thus extending our CP procedure to somehow fuse and compare the uncertainty in the classifier and rejector is an exciting and impactful direction for future work that would address this limitation. Another dircction is to apply distribution-fres risk control (Angelopoulos et al.) 2024) ensure the deferral decision respects certain constraints, such bounding the deferral rate.
References
Anastasios N. Angelopoulos and Stephen Bates. Conformal Prediction: A Gentle Introduction. Foundations and Trends in Machine Learning, March 2023.
Anastasios N Angelopoulos, Stephen Bates, Adam Fisch, Lihua Lei, and Tal Schuster. Conformal risk control. The Twelfth International Conference Learning Representations, 2024.
Anastasios Nikolas Angelopoulos, Stephen Bates, Michael Jordan, and Jitendra Malik. Uncertainty for image classifiers using conformal prediction. In International Conference on Learning Representations, 2021.
Varun Babbar, Umang Bhatt, and Adrian Weller. On the Utility of Prediction Sets in Human-Al Teams. In Proceedings of the Thirby-First International Joint Conference on Artificial Intelligence, IJCA IJCAT-22, July 2022.
Rina Foygel Barber. Is distribution-free inference possible for binary regression? Slatistics, 2020.
Electronic Journal of
12

---

Published in Transactions on Machine Learning Research (02/2026)
Rina Foygel Barber, Emmanuel J. Candès, Aaditya. Ramdas, and Ryan J. Tibshirani. Conformal prediction beyond exchangeability. The Annals of Stalistics, 2023.
Peter L. Bartlett and Marten H. Wegkamp. Classification with Reject Option using a Hinge Loss. Journal of Machine Learning Research, 2008.
Yuzhou Cao, Hussein Mozannar, Lei Feng, Hongxin Wei, and Bo An. In Defense of Softmax Parametrization for Calibrated and Consistent Learning to Defer. In Advances Neural Information Processing Systems, 2023.
Mohammad-Amin Charusaie, Hussein Mozannar, David Sontag, and Samira Samadi. Sample Efficient Learn- ing of Predictors that Complement Humans. In Proceedings of the 39th International Conference Machine Learning, Proceedings of Machine Learning Research, July 2022.
John J. Cherian, Isaac Gibbs, and Emmanuel J. Candès. Large language model validity via enhanced conformal prediction methods. In Advances in Neural Information Processing Systems, 2024.
C. K. Chow. An optimum character recognition system using decision functions. IRE Transactions on Electronic Compulers, December 1957.
L.P. Cordella, C. De Stefano, F. Tortorella, and M. Vento. A method for improving classification reliability of multilayer perceptrons. IEEF Transactions Newral Networks, September 1995.
Corinna Cortes, Giulia DeSalvo, and Mchryar Mohri. Boosting with Abstention. In Advances in Neural Information Processing Systems, 2016a.
Corinna Cortes, Giulia DeSalvo, and Mehryar Mohri. Learning with rejection. In Algorithmic Learning Theory, 2016b.
Thomas Davidson, Dana Warmsley, Michael Macy, and Ingmar Weber. Automated Hate Speech Detection and the Problem of Offensive Language. Proceedings of the International AAAI Conference on Web and Social Media, May 2017.
Samuel Dodge and Lina Karam. A Study and Comparison of Human and Deep Learning Recognition Per- formance under Visual Distortions. In 2017 26th International Conference on Computer Commanication and Networks (ICCCN), 2017.
Jeff Donahue, Philipp Krähenbühh, and Trevor Darrell. Adversarial Feature Learning. February 2017.
Yizirui Fang and Anthony Bellotti. Investigating Data Usage for Inductive Conformal Predictors, June 2024.
Yonatan Geifman and Ran El-Yaniv Selective classification for deep neural networks. In Advances in Neural Information Processing Systems, 2017.
Robert Geirhos, Patricia Rubisch, Claudio Michaclis, Matthias Bethge, Felix A. Wichmann, and Wicland Brendel. Imagenet-trann trainedrrrndddddeee CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference Learning Representations, 2019.
Martin E. Hellman. The Nearest Neighbor Classification Rule with Reject Option. IEEE Transactions
Systems Science and Cybernetics, 1970.
Patrick Hemmer, Sebastian Schellhammer, Michael Vössing, Johannes Jakubik, and Gerhard Satzger. Form- ing Effective Human-AT Teams: Building Machine Learning Models that Complement the Capabilities of Multiple Experts. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelli- gence, IJCAI-22, July 2022.
Radu Herbei and Marten H. Wegkamp. Classification with Reject Option. The Canadian Journal of Statistics / La Reme Canadienne de Slatistique, 2006.
13

---

Published in Transactions on Machine Learning Research (02/2026)
Lei Huang, Xiaocheng Feng, Weitao Ma, Yuchun Fan, Xiachong Feng, Yuxuan Gu, Yangfan Ye, Liang Zhao, Weihong Zhong, Baoxin Wang, Dayong Wu, Guoping Hu, Lingpeng Kong, Tong Xiao, Ting Liu, and Bing Qin. Alleviating hallucinations from knowledge misalignment in large language models via selective abstention learning. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguislies (oriisssooiii (Volume 1: Long Pupers), July 2025.
Daniel D. Johnson, Daniel Tarlow, David Duvenaud, and Chris J. Maddison. Experts don't cheat: Learning what you don't know by predicting pairs. In Proceedings of the 4 1st International Conference on Machine Learning, Proceedings of Machine Learning Research, 21 27 Jul 2024.
Vijay Keswani, Matthew Lease, and Krishnaram Kenthapadi. Towards Unbiased and Accurate Deferral to Multiple Experts. In Proceedings of the 2021 AAAT/ACM Conference on AI, Ethics, and Society, AIES 221, 2021.
Alex Krizhevsky. Learning Multiple Layers of Features from Tiny Images. 2009.
Jessie Liu, Blanca Gallego, and Sebastiano Barbieri. Incorporating uncertainty in learning to defer algorithms for safe computer-aided diagnosis. Scientific Reports, February 2022.
David Madras, Toni Pitassi, and Richard Zemel. Predict Responsibly: Improving Fairness and Accuracy by Learning to Defer. In Advances in Neural Information Processing Systems, 2018.
Anqi Mao, Mchryar Mohri, and Yutao Zhong. Principled Approaches for Learning to Defer with Multiple Experts. In Artificial Intelligence and Image Analysis, 2024a.
Anqi Mao, Mehryar Mohri, and Yutao Zhong, Predictor-rejector multi-class abstention: Theoretical analysis and algorithms. In Proceedings of The 35th International Conference on Algorithmic Learning Theory, Proceedings of Machine Learning Research, 25-28 Feb 2024b.
Anqi Mao, Mehryar Mohri, and Yutao Zhong. Theoretically grounded loss functions and algorithms for score- based multi-class abstention. In Proceedings of The 27th International Conference on Artificial Intelligence and Statistics, Proceedings of Machine Learning Research, 02 04 May 2024c.
Hussein Mozannar and David Sontag, Consistent Estimators for Learning to Defer to an Expert. In Pro- aeedings of the 37th International Conference on Machine Learning, Proceedings of Machine Learning Research, July 2020.
Hussein Mozannar, Hunter Lang, Dennis Wei, Prasanna Sattigeri, Subhro Das, and David Sontag. Who Should Predict? Exact Algorithms For Learning to Defer to Humans. In Proceedings of The 26th Inter- national Conference on Artificial Intelligence and Statistics, Proceedings of Machine Learning Research, April 2023.
Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, Sebastian Nowozin, Joshua Dillon, Balaji Lakshmi- narayanan, and Jasper Snoek. Can you trust your model's uncertaint?? evaluating predictive uncertainty under datasct shift. In Advances in Neural Information Processing Systems, 2019.
Harris Papadopoulos, Kostas Proedrou, Volodya Vovk, and Alex Gammerman. Inductive Confidence Ma- chines for Regression. In Machine Learning: ECML, 2002.
Victor Quach, Adam Fisch, Tal Schuster, Adam Yala, Jac Ho Sohn, Tommi S. Jaakkola, and Regina Barzilay. Conformal language modeling. In The Twelfth International Conference on Learning Representations, 2024.
Maithra Raghu, Katy Blumer, Greg Corrado, Jon Kleinberg, Ziad Obermeyer, and Sendhil Mullainathan. The Algorithmic Automation Problem: Prediction, Triage, and Human Effort, March 2019.
Nils Reimers and Iryna Gurevych. Mantenco-BERTT Sentence Embeddings using Siamese BERT-Networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Longuage Processing and the 9th International Joint Conference on Natural Language Processing (EMNLPP-ICCNLP) November 2019.
14

---

Published in Transactions on Machine Learning Research (02/2026)
Yaniv Romano, Matteo Sesia, and Emmannel Candes. Classification with Valid and Adaptive Coverage. In Advances in Newral Information Processing Systems, 2020.
Aaron Roth, Alexander Tolbert, and Scott Weinstein. Reconciling Individual Probability Forecasts, May 2023.
Glenn Shafer and Vladimir Vovk. A Tutorial on Conformal Prediction. Journal of Machine Learning Research, 2008.
Eleni Straitouri, Lequn Wang, Nastaran Okati, and Manuel Gomez Rodriguez. Improving Expert Predictions with Conformal Prediction. In Proceedings of the 40th International Conference on Machine Learning, Proceedings of Machine Learning Research, July 2023.
Jiayuan Su, Fulin Lin, Zhaopeng Feng, Han Zheng, Teng Wang, Zhenyu Xiao, Xinlong Zhao, Zuozhu Liu, Lu Cheng, and Hongwei Wang. CP-Router: An Uncertainty-Awar Router Bet LLM and LRM, May 2025.
Dharmesh Tailor, Aditya Patra, Rajeev Verma, Putra Manggala, and Eric Nalisnick. Learning Defer to a Population: A Mota-Learning Approach. In Proceedings of The 27th International Conference Arlificial Intelligence and Statistics, Proceedings of Machine Learning Research, May 2024.
llya Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jessica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, Mario Lucic, and Alexey Dosovitskiy, MT.--Mxxer: An all-MLP Architecture for Vision. In Advances in Neural Information. Processing Systems, 2021.
Philipp Tschandl, Cliff Rosendahl, and Harald Kittler. The HAM10000 dataset, a large collection of multi- source dermatoscopic images of common pigmented skin lesions. Scientific Data, August 2018.
Rajeev Verma and Eric Nalisnick. Calibrated learning to defer with one-vs-all classifiers. In Proceedings of the 39th International Conference on Machine Learning, Proceedings Machine Learning Research, 17-23 Jul 2022.
Rajeev Verma, Daniel Barrejon, and Fric Nalisnick. Learning to Defer to Multiple Experts: Consistent Surrogate Losses, Confidence Calibration, and Conformal Ensembles, In Proceedings of The 26th Inter- national Conference on Artificial Intelligence and Statistics, Procoedings of Machine Learning Research, April 2023.
Vladimir Vovk, Alexander Gammerman, and Glean Shafer. Algorithmic Learning in a Random World. 2022.
Jason Wei and Kai Zou. EDA: Easy Data Augmentation Techniques for Boosting Performance on Text Clas- sification Tasks. In Proceedings of the 2019 Conference on Empirioat Methods in Natural Language Pro- cessing and the 9th International Joint Conference on Natural Language Processing (EMNL.P-JCCNP)), November 2019.
Ming Yuan and Marten Wegkamp. Classification Methods with Reject Option Based on Convex Risk Minimization. Journal of Machine Learning Reseurch, 2010.
Ahmed Zaoui, Christophe Denis, and Mohamed Hebiri. Regression with reject option and application to KNN. In Advances in Neural Information Processing Systems, 2020.
Zhenglong Zhou and Chaz Firestone. Humans can decipher adversarial images. Nature Communications, March 2019.
15

---

Published in Transactions on Machine Learning Research (02/2026)
A Theoretical Supplement
A.1 Expected size of the deferral set under covariate shift
The widening of deferral sets under covariate shift acts as functional safety mechanism. This behavior arises from the specific construction of our deferral set (z; f) in Eq. S The rejector outputs the uncertain set {0.1} and only the expert correctness probability satisfies: p(m = y|x) E U. On in-distribution data, the boundarics (0, 1), minimizing
the rejector confident, and the density of p(m = y/x) concentrates the rejector faces out-of-distribution inputs, its predictive
the frequency of uncertain sets. However, performance degrades thus tends to produce less distinguishable probabilities on 0 and 1, i.e. moving p(m y x) closer to 0.5, where the system is roughly 50 50 about whether the expert will be correct. As the score distribution concentrates within U, the threshold 1 - f is more often not satisfied to produce a singleton deferral set,, so deferral sets of size two become more frequent precisely those regions.
This phenomenon is formalized the below section. To simplify, let p(x) = f(m = |x) be the rejector's estimate of the expert-correctuess probability, and let C, Cx f) be the conformal deferral set defined in Eq. The conformal deferral set satisfies (x; E {1,2).
We can have
1, ((x) S or pxx) 2 21-1 7,
(x; =
2, A < f(x) 7-
and hence
[C,(x; (=(xx)]==100 I(f < p(x) <1-
Therefore, for any covariate distribution Qx
Bx-Q. B = =1 E().
This identity shows that deferral sets become wider precisely when a larger fraction of test points fall into the cindle-confidence region U. To express this more symmetrically around the decision boundary 0.5, define a probability margin
(x(x)) == [2p(x) 1 E [0, 1].
Assuning f S 0.5, the event p(x) E (f, +) is equivalent lo (x) < - 2F. Hence,
Ex~Q= (x: +)]] = (x(% < 1 -
A sufficient condition for wider deferral sets under a shifted covariate distribution Qx with relative to the source distribution Px is that more shifted points have small margin, i.e.,
Qx(%((x 1--277 27) 2 Px(1p(x) < -2).
Under this condition, the expectation follows that
Ex~Qx [x;+ 2 Ex-Pr [1x,;(x))xx;
This presents, when distribution shift makes the rejector less separable between = and m + y (equiv- alently, p(x) is closer to 0.5, so (x) shrinks), more points fall into U, increasing the expected deferral set size. We emphasize that this is a conditional explanation of the empirical widening behavior, and does not by itself provide a coverage guarantee under arbitrary distribution shift.
A.2 Theoretical Formalization of Human-Preferred and Model-Preferred Prediction
Human-Preferred Workflow The Human-Preferred Workflow is designed for scenarios where the test. distribution (xest(x.y) differs from training Ptrain (x,y). y).
Assumption (Human Robustness): While machine classifiers suffer significant performance degrada- tion under distribution shifts (e.g., image corruptions, adversarial attacks),it is well-established that human
16

---

Published in Transactions on Machine Learning Research (02/2026)
perception remains comparatively invariant. Geirhos et al. (2019) demonstrate that CNNs rely on texture bias which is fragile to shift, while humans rely on shape bias which is robust. Dodge & Karam (017 show human vision significantly outperforms DNNs on distorted images. Humans are also robust to adversarial
perturbations that fool models (Zhou & Firestone 2019
In addition, the human expert can access privileged metadata that unavailable the model. For example, in our HAM10000 experiments, the expert utilizes metadata beyond pixel information. When the conformal set is (x) = 1) the rejector indicates high uncertainty about the standard inductive relationship between input and correctness. Under distribution shift, this uncertainty signal is correlated with the model entering failure mode. Let R(h) and R(m) be the risk of the classifier and human, respectively. Under shift. we assume the inequality (h) >> Ranasa(m). Therefore, the Human-Preferree workflow is formalized as a robust fallback policy.
0,
[0,1] A ÿ = m, (Consensus while Uncertainty detected) I, if Cx; (0, A y + m, (Uncertainty detected)
if =x
r*(x)
r(x), otherwise.
This minimizes the expected risk upper bound by deferring to the agent with the lower variance in per- formance across distributions (the human), utilizing the size of the conformal set as a proxy for detecting out-of-distribution (OOD) samples.
Model-Preferred Workflow This workflow can be motivated through cost-sensitive objective, where querying the human expert incurs a non-negligible cost while using the model is essentially free. Let Cą > 0 the cost of consulting the human expert per query. A standard cost-sensitive system loss to minimize is:
Lo mooe--oode-prefeereedl (h, = E E - r(x)) T[h(x) + y) + r(x) I[m + yl xxx) en).
When the conformal deferral set is (x; (0. 1], the rejector does not provide directional evidence at confidence level 1 a a that deferring is beneficial to justify paying the query cost. Since the cost с₁ is incurred whenever r(x) = 1, a budget-aware policy is to defer only when there a confidently certified benefit, and otherwise default to the model. In particular, under the preefreref workflow we set r(x) = 0 whenever C,(x; (0, 1} to avoid paying O₁ when uncertain.
B
Experimental Details
B.1 Accuracy vs Deferred Ratio
Figure 3 summarizes the accuracy-coveraag comparison across all datasets (CIFAR-10, HAM10000, and HateSpeech) and deferral workflow (abstention, consensus, and human-preferred)
B.2 Datasets in Experiments
Table summarizes the datasets used in this work. The CIFAR-10 dataset consists of 60,000 32x32 color images, evenly distributed across 10 distinct classes (Krizhevsky 2009). It is divided into 50,000 training images and 10,000 test images. The CIFAR10-C dataset introduces 15 common real-world corruptions, along with 4 additional types of corruption, applied to the Lest images from CIFAR-10. The HAM10000 dataset Tschandl et al. 2018) contains 10,015 dermatoscopic images, categorized into seven types of skin lesions: melanocytic nevi, melanoma, benign keratosis-like lesions, basal cell carcinoma, actinic keratoses, vascular Jesions, and dermatofibroma. The HateSpeech dataset (Davidson et al. 2017) includes 24,802 labeled tweets, sampled from total of 85.4 million tweets across 33,458 users, with labels divided into 3 categories.
17

---

Published in Transactions on Machine Learning Research (02/2026)
Pla
Apadl Orighet
86
90
90
80
90
85
86
85
Accuracy (%)
80
Accuracy (96)
80
75
25
75
70
70
70
05
65
65
60
60
60
55
66
55
100
50
60
100
Ratio Deferred (36)
Ratio Deferred (%6
Ratio Deferred (%)
Abstention
(b) Consensus
(c) Human-preffrred
67.5
82.5
80.0
Accuracy (96)
77.0
76-
Accuracy
Avcuracy
73.0
-0
25.0
10.0
67.5
67.5
30
10
50
60
Ratio Deferred (%6
Ratio Deferved
(%)
Ratio Deferred (%)
(d) Abstention
(e) Consensus
(f) Human-preferred
Accuracy (96)
60
60
Anmuray
40
20-
10
10
20
40
60
10
30
30
40
50
10
20
30
40
50
Ratio Deferred (%)
Ratio Deferved (%)
Ratio Deferred (%)
(g) Abstention
(h) Consensus
(i) Human-preferred
Figure 3: Accuracy Accuracy-coverage for all datasets and deferral workflows. Each panel plots non-abstention accuracy versus the fraction of examples deferred to the human (ratio deferred). The top corresponds to CIFAR-10, the middle row to HAM10000, and the bottom row to HateSpeech; within each row, the three columns show the abstention, consensus, and human-preferred deferral workflows, respectively.
B.3 Distribution Shift Simulation
To simulate covariate shift in the HAM10000 dataset, we applied Gaussian blur and noise corruption to the images. Table g outlines the Gaussian blur parameters for varying levels of severity, with increasing kernel sizes and values to progressively enhance the blurriness the shift intensifies. To introduce covariate
18

---

Published in Transactions on Machine Learning Research (02/2026)
Dataset
K Human Expert
Base Model
Optimizer
Epochs
Learning Rate
CIFAR-10
synthetic
CNN with Conv layers (width 50)
Adam
100
1 10-a
HAM10000
10015
MLP Mixer
ResNet34 Linear Network with SBERT
SGD
150
1 10-3
HateSpeech
25k
3
random annotator
Adam
50
1 10
Table 3: Summary of datasets and model configurations used in this work. Here, refers to the total number of samples in each dataset, K represents the number of classes, epochs refers to the total training epochs for the T.2D framework with a rejector, and base model indicates the foundational model used within the L.2D framework.
Severity Level
Kernel Size
(3, 3)
0.5
2
(5, 5)
1.0
3
(7, 7)
2.0
4
(9, 9)
3.0
5
(11, 11)
4.0
6
(13, 13)
5.0
Table 4: Gaussian Blur Kernel Sizes and a Values for Different Severity Levels
shift in the Hate Speech dataset, adversarial noise was applied. This transformation was constructed using techniques such as synonym replacement, random insertion, random deletion, and character swapping on the text embeddings.
B.4 Additional Detail of Conformal Prediction
For the split-conformal prediction procodure described in Section 3
Score Function : We utilize the probability of the expert correctness f(m = y/x) as defined in Eq. 5 (OvA) and Eq. (A-SM).
Quantile Calculation The threshold is computed as the [[Neat + 1)(1 a)]/Neat empirical quantile of the calibration scores, with finite-sample correction.
B.5
Rejector Entropy
B.6 Coverage and Efficiency Higher Target Coverage Levels
In the main paper Table J we reported coverage and efficiency results for the OvA rejector at target coverage level of a a = 90%. This level is standard in conformal prediction and uncertainty quantification, where prediction sets are often calibrated contain the true label with probability around 90% in order balance statistical validity with the size of the output sets (Angclopoulos Bates 2023: Angelopoulos al., 2021).
To demonstrate that method is not tied to single confidence level, additionally evaluate the OvA rejector at higher target coverage levels 1-a E (95%, (9%) on CIFAR-10. HAM10000, and HateSpecch. The empirical coverage and average deferral-set size for these settings are summarized in Table As discussed in the main paper, all empirical coverage are slightly above the corresponding target levels, except a few cases falling slightly below, which consistent with the coverage guarantecs. The results exhibit the expected coverage-efficience trade-off and confirm that our framework can be tuned stricter coverage requirements without changing the conclusions.
19

---

Published in Transactions on Machine Learning Research (02/2026)
Table 5: Mean entropy of the rejector's estimated expert correctness P(m y/x) under increasing
distribution shn-s severity.
Shift severity
Dataset
1
2
3
5
CIFAR-10
0.3122
0.3394
0.3691
0.3988
0.4185
0.4227
0.3204
HAM10000
0.1280
0.1063
0.1374
0.1457
0.1944
0.2645
0.2736
Hate Speech
0.3078
0.3487
0.3650
0.3714
0.3776
0.3834
0.3896
Table 6: Coverage and Efficiency of OcA Rejector at Higher Confidence Levels. We report the empirical coverage and the average size of the deferral set for confidence levels 1 - a = 95% and 1 - = 99%.
- 95%
99%
Dataset
Coverage (%)
Average Set Size
Coverage (%)
Average Set Size
CIFAR-10
93.08
1.46
98.41
1.76
НAM10000
95.72
98.59
1.77
HateSpeech
95.14
1.32
99.09
1.80
B.7 Evaluation on Uncertainty of Rejector r(x) with Deferral Set
Section 5.4 introduced evaluation metries for the rejector under uncertainty in addition to system accuracy: uncertainty rejector accuracy acCm=yy and uncertainty classifier accuracy accy=y- While the main paper focuses on overall system accuracy and ratio deferred Figure here we report. these metrics across severity levels for the same methods considered in Section 5.3.
In particular, Original denotes the original OvA L2D model without conformal calibration, rows without the "+ Shifted Deat" suffix (Abstention, Consensus, Human Preferred) correspond to the Conformal OvA rejector calibrated on the source distribution, and rows with "+ Shifted Deat" correspond to Conformal OvA recalibrated on a small subset of the shifted target distribution.
C Experiment: L2D with Deferral Intervals
This section documents the experiment evaluating L2D workflow with conformal deferral intervals, both without and with Conformal + Shifted Deat (i.e., recalibrating on a small (arget-domain subset under shift).
Reliability Diagram We perform evaluation of calibration and examine the validity of conformal predic- tion by plotting reliability diagram and computing expected calibration error (ECE). We define the expected accuracy and ECE as
= (c) Pm ylp(m=ylx) c), E.CE ECEp(m=y) Ex PP(m = y p(mm y = - cl.
where e is the confidence level. From the prediction interval [x), by (x)], the uncertainty bar of the expected accuracy could calculated as A_ = (xx) I[m = yl, A bx) [[m = y]. Figure 4 presents the reliability diagram and constructs the crror bar by distributing the prodiction interval across the accuracy.
Uncertainty Rejector Evaluation we evaluate the performance of the uncertainty rejector r(x) by accuracy metrics acCmmy and accymy on CIFAR-10 datasets. Table 10 shows a significant. increase in L2D with the prediction interval in acCm=y and accy=y. while the deferral interval too large. This confirms that the binary regression would adjust the rejector make deferral decision and abstention with care of uncertainty. It also reports that with abstention, the system accuracy increases from 83.87% 93.75%, Table 10 evaluated the acCm=y and accy=y in T.2D with deferral interval.
20

---

Published in Transactions on Machine Learning Research (02/2026)
OvA abil ty (a-0 1) with Prediction Interval
OvA Reliability [a-0.1] with Predictian interval Abstention
2.6
rapertbo
Eiperted
014
214
0.2
0.2
Arrumryy
Preciinterval (LR)
Predintercal [LM)
010
1000
1000
Accunicy
Accunicy
... sug to roniidence
... AVg confiience
0.6
0.0
0.8
3.0
Confidence
Canfidercce
(a) Reliability Diagram
(b) Reliability Diagram with Abstention
Figure 4: Evaluation of Calibration on CIFAR-10: Subfigure (a) reports reliability diagram w/o abstention and the expected calibration (ECE) is 5.86. Subfigure (b) reports reliability diagram w/ abstention and the ECE is 5.17
Additional Experiment
D.1 Dual CP: Conformal Prediction on Both Classifier and Expert Model
While Section 3 approaches optimal rejector with human expert correctness [m = yn In this section, we present our exploration to compare the calibrated uncertainty of both the classifier and the expert model to make the deferral decision explicitly. To this end, we fit. a weak classifier human( to simulate the human expert predictions m from features x, yielding probabilistic predictor Phamenn (y) x). One may explicitly construct classifier prediction sets C₁ (x; TT)) for classifier (x) and annotator prediction sets Chuman (x; fhuman) for human expert human" (x) following the split conformal prediction construction in Section 2.2
We then defer when the classifier is more uncertain by comparing the sizes of the two prediction sets under the same confidence level 1 --: a:
rx(x) = (x; Chaman (x; thaman))
otherwise.
We reuse the experimental setup and one-vs-all (OvA) parameterization from Section 5 We then apply the dual conformal-prediiciion (CP) procedure described above to the CIFAR-10, HAM10000, and Hate Speech datasets without shift. The resulting coverage and deferral-rate metrics are reported in Table 11
D.2 Finetuning on Uncertain Instances
To broaden coverage, one may finetune the L2D system on instances that CP flags as uncertain. The initial threshold & could be again computed over initial calibration set D2 as Section 3.1 Building on the dual-CP CP on the training set D2 and form prediction set C, (x; f).
deferral setup in Appendix D.1.
21

---

Published in Transactions on Machine Learning Research (02/2026)
We could then define the uncertain subset by cardinality ("width") threshold tabs
D unnertain fx D1 (2; 2 tabs).
We reweight the OvA surrogate loss by prediction set width [<C;(x;;) and perform fine-tuning to explicitly emphasize these uncertain inputs:
Φ 9k++)((
VRR-OVA (...ovall.....999111111 y, = (11g((x)) Chhmmnn (x;; Thaman))
followed by re-running the dual CP to compute updated thresholds F' and f human on D2. Resulting coverage metrics are reported in Table 12 Finctuning on uncertain instances can raise system accuracy relative to dual CP without finetuning, but does not surpass the original L2D baseline our runs: suggesting that the OvA parameterivation may capture rejector uncertainty and that post-hoc CP calibration remains a strong, distribution- free control for deferral decisions.
22

---

Published in Transactions on Machine Learning Research (02/2026)
Table 7: Performance under uncertainty rejection across severity levels on CIFAR-10, reporting standard accuracy (aōc), uncertainty rejector accuracy (aCCm=y), and uncertainly classifier accuracy (aCCy-y)-
Severity Method
ace (%)
a06m (%)
accy-y y (%)
Original
85.02
86.55
85.02
Abstention
86.56
87.84
71.74
Consensus
86.63
87.83
85.15
Human Preferred
84.27
86.77
82.68
Original
85.25
86.23
85.25
Abstention
86.72
86.91
71.27
Consensus
86.78
86.92
86.60
1
Human Preferred
84.95
86.27
83.93
Abstention + Shifted Deal
89.63
89.63
72.86
Consensus Shifted Deat
89.77
89.61
89.99
Human Preferred + Shifted Deat
83.05
86.21
83.99
Original
84.05
86.03
84.05
Abstention
85.52
87.02
71.53
Consensus
85.57
87.02
83.79
2
Human Preferred
83.60
86.07
81.44
Abstention + Shifted Deal
87.84
88.89
73.11
Consensus + Shifted Dent
88.01
88.93
86.77
Human Preferred + Shifted Deat
81.70
86.00
81.62
Original
83.35
86.45
83.35
Abstention
84.83
87.22
69.71
Consensus
84.91
87.27
81.76
3 Human Preferred
82.75
86.64
79.26
Abstention + Shifted Deat
87.54
89.44
71.32
Consensus + Shifted Deat
87.53
89.37
84.84
Human Preferred + Shifted Deat
81.25
86.51
79.39
Original
83.60
86.32
83.60
Abstention
85.54
87.61
71.18
Consensus
85.65
87.70
83.09
4 Human Preferred
83.30
86.49
79.98
Abstention + Shifted Deal
87.82
89.17
72.83
Consensus Shifted Deat
88.07
89.37
86.32
Human Preferred + Shifted Deat
81.90
86.28
80.09
Original
79.90
83.29
79.90
Abstention
81.83
84.64
64.58
Consensus
81.82
84.59
78.15
5 Human Preferred
79.45
83.62
75.03
Abstention + Shifted Deal
86.85
87.71
67.86
Consensus + Shifted Deat
86.79
87.40
85.85
Human Preferred + Shifted Deat
78.20
83.36
75.62
Original
60.58
74.84
60.58
Abstention
73.66
74.64
12.67
Consensus
73.63
74.62
7.49
6
Human Preferred Abstention + Shifted Deal
73.81
74.63
6.15
73.08
73.07
13.63
Consensus + Shifted Deat
74.48
74.52
58.82
Human Preferred + Shifted Deat
74.90
74.63
6.19
23

---

Published in Transactions on Machine Learning Research (02/2026)
Performance of deferral-set workflows on HAM10000 under distribution shift. We report system accuracy (aéc), uncertainty rejector accuracy (@CCm=y), and uncertainty classifier accuracy (accs=y).
Table 8:
Severity Method
acc (%)
000m=y (%)
acco=y (%)
Original
80.86
82.81
80.86
Abstention
86.00
88.22
85.55
Consensus
84.86
84.98
84.79
Human Preferred
78.45
81.25
80.75
Original
75. 17
71.99
75.17
Abstention
79.73
72.71
76.34
Consensus
80.12
73.08
86.17
1
Human Preferred
76.71
70.42
82.49
Abstention + Shifted Deat
82.92
76.09
80.35
Consensus Shifted Deat
82.07
73.79
88.36
Human Preferred + Shifted Deat
76.77
69.79
82.81
Original
72.69
62.68
72.69
Abstention
77.99
67.31
74.09
Consensus
78.91
67.78
81.02
2
Human Preferred
75.37
63.64
77.40
Abstention + Shifted Deal
78.26
68.12
73.78
Consensus Shifted Deat
80.56
67.50
82.39
Human Preferred + Shifted Deal
75.70
62.31
76.92
Original
69.21
63.64
69.21
Abstention
74.26
68.13
72.35
Consensus
75.56
65.74
76.18
3 Human Preferred Abstention + Shifted D Deat
72.69
67.46
70.39
76.56
74.60
75.56
Consensus + Shifted Deal
78.78
69.74
78.77
Human Preferred + Shifted Deal
74.97
66.35
69.93
Original
68.61
68.49
68.61
Abstention
72.21
74.44
70.87
Consensus
75.66
71.56
76.19
4 Human Preferred Abstention + Shifted Deal
73.29
68.66
69.63
72.62
74.39
71.23
Consensus + Shifted Deat
78.57
65.79
79.93
Human Preferred + Shifted Deat
73.96
61.97
70.49
Original
68.01
60.61
68.01
Abstention
69.72
66.52
66.67
Consonsus
78.06
65.38
80.22
5 Human Preferred
74.10
61.59
71.25
Abstention + Shifted Deal
68.48
69.59
66.81
Consensus + Shilted Deat
79.28
67.87
81.47
Human Preferred + Shilted Deat
75.17
65.47
69.92
Original
70.88
69.59
70.88
Abstention
68.99
68.27
56.74
Consensus
79.74
71.68
89.91
6
Human Preferred Abstention + Shifted Deal
75.84
68.35
83.93
67.24
67.11
55.88
Consensus + Shifted Deat
80.64
72.30
90.64
Human Preferred + Shifted Deat
76.17
68.59
84.71
24

---

Published in Transactions on Machine Learning Research (02/2026)
Table 9: Performance of deferral-set. workflows on Hate Speech under distribution shift. We report system accuracy (aéc), uncertainty rejector accuracy (ACCm=y), and uncertainty classifier accuracy (accg=y).
Severity Method
(%)
a00m=y (%)
acco=y (%)
Original
92.
86.88
92.11
Abstention
92.16
86.88
87.58
Consensus
92.17
86.88
95.90
Human Preferred
92.15
86.88
95.80
Original
86.28
90.14
86.28
Abstention
86.57
90.15
77.80
Consensus
86.71
90.18
84.35
1
Human Preferred
86.48
90.12
83.60
Abstention + Shifted Deat
87.97
90.18
78.82
Consensus Shifted Deat
88.41
90.21
87.15
Human Preferred + Shifted Dent
87.71
90.14
83.67
Original
79.98
89.48
79.98
Abstention
80.51
89.42
72.36
Consensus
80.90
89.46
75.88
2
Human Preferred
80.89
89.45
74.44
Abstention + Shifted Deal
84.07
89.83
74.67
Consensus Shifted Deat
85.98
89.93
83.46
Human Preferred + Shifted Deal
85.25
89.48
74.49
Original
76.49
89.71
76.49
Abstention
76.91
89.78
67.26
Consensus
77.34
89.79
71.24
3 Human Preferred Abstention + Shifted D Deat
77.42
89.75
70.08
81.01
90.38
68.85
Consensus + Shifted Deal
84.00
90.56
80.42
Human Preferred + Shifted Deal
83.35
89.71
70.12
Original
73.18
89.93
73.18
Abstention
73.85
89.81
64.78
Consensus
74.37
89.85
67.11
4 Human Preferred Abstention + Shifted Deal
74.66
89.90
65.40
78.49
90,23
66.74
Consensus + Shifted Deat
82.59
90.28
78.50
Human Preferred + Shifted Deat
82.69
89.93
65.50
Original
69.61
90.56
69.61
Abstention
70.09
90.49
59.92
Consonsus
70.66
90.52
62.24
5 Human Preferred
70.92
90.55
60.91
Abstention + Shifted Deal
76.75
90.75
62.50
Consensus + Shilted Deat
82.23
90.70
77.87
Human Preferred + Shilted Deat
82.67
90.56
60.93
Original
66.59
89.05
66.59
Abstention
67.30
89.00
57.37
Consensus
67.90
89.03
59.25
6
Human Preferred Abstention + Shifted Deal
68.38
89.02
57.59
71.40
89.05
57.52
Consensus + Shifted Deat
77.99
89.29
72.53
Human Preferred + Shifted Deat
79.52
89.05
57.60
25

---

Published in Transactions on Machine Learning Research (02/2026)
Table 10: Performance under uncertainty rejection across severity levels, reporting standard accuracy, uncertainty-based rejector accuracy (aCCm=y), classifier accuracy (acCy=y); non-abstention rejector accu- racy, and model preferred accuracy.
Severity Method
aèc (%)
a0Cm= (%)
accy=y (%)
Baseline
83.87
84.44
32.75
Deferral Interval
72.57
92.77
70.06
0
Abstention
93.75
92.77
74.14
Model Preferred
92.77
92.77
70.06
Baseline
83.10
84.64
35.27
Deferral Interval
71.90
92.88
67.65
Abstention
93.36
92.88
74.95
1
Model Preferred
92.88
92.88
67.65
Deferral Interval + Shifted Deal
69.75
90.76
67.62
Abstention + Shifted Deal
93.18
90.76
72.83
Model Preferred + Shifted Deal
90.76
90.76
67.62
Baseline
80.65
83.21
35.35
Deferral Interval
68.80
91.96
65.88
Abstention
91.95
91.96
73.93
2 Model Preferred
91.96
91.96
65.88
Deferral Interval + Shifted Deal
70.00
89.56
66.59
Abstention + Shifted Deal
92.27
89.56
72.91
Model Preferred + Shifted Deal
89.56
89.56
66.59
Baseline
77.20
83.62
40.53
Deferral Interval
62.40
94.55
58.79
Abstention
91.75
94.55
72.58
3 Model Preferred
94.55
94.55
58.79
Deferral Interval + Shifted Deal
63.00
90.09
59.79
A Abstention + Shifted Deat
92.47
90.09
70.45
Model Preferred + Shifted Deat
90.09
90.09
59.79
Baseline
76.90
83.78
42.53
Deferral Interval
63.10
94.32
59.06
Abstention
91.75
94.32
72.75
4 Model Preferred
94.32
94.32
59.06
Deferral Interval + Shifted Deat
64.80
92.19
59.33
Abstention + Shifted Deal
92.78
92.19
71.33
Model Preferred + Shifted Deal
92.19
92.19
59.33
Baseline
73.75
84.05
46.40
Deferral Interval
59.80
90.06
56.97
Abstention
90.62
90.06
72.80
5 Model Preferred
90.06
90.06
56.97
Deferral Interval + Shifted Deat
59.85
90.96
57.03
Abstention + Shifted Deat
91.83
90.96
72.03
Model Preferred + Shifted Dent
90.96
90.96
57.03
26

---

Published in Transactions on Machine Learning Research (02/2026)
Table 11: Dual CP Experiment. We report system accuracy on dual CP on the same three datasets but do not notice performance improvement.
Dataset
Method
Sys. Acc.(%)
Fraction Deferred (%)
CTFAR-10
Base Model
84.74
53.18
Dual CP
74.36
14.04
HAM10000
Base Model
82.10
19.34
Dual CP
80.72
11.18
Hate Speech
Base Model
91.44
33.61
Dual CP
91.24
42.82
Table 12:
Dual CP Finetuning.
We report system accuracy on top of the previous dual CP experiment
where labs
Dataset
Method
Sys. Acc. (%)
Fraction Deferred (%)
HAM10000
PT Dual CP
81.46
11.12
Hate Speech
FT Dual CP
91.42
42.05
27


Reviews:
[{"review_id": "C15UdTcUyX", "reviewer": "Reviewer_gQn7", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates uncertainty estimation within the Learning-to-Defer (L2D) paradigm, which allocates prediction tasks between human and machine decision-makers. The authors highlight that the performance of L2D critically depends on the quality of the rejector function, which may be misspecified or poorly fitted in practice. To address this, they propose applying conformal prediction to the rejector, allowing it to produce prediction sets or intervals with user-specified confidence levels, rather than a simple binary defer decision. Experimental results on diverse tasks, including image classification and hate speech detection, suggest that quantifying rejector uncertainty can lead to safer decision-making through two forms of selective prediction.\n\nThe strengths are that they deal with an important topic and demonstrate various applications. The weaknesses are that the paper does not explain certain points well enough or go into sufficient detail, and the experiments reveal weaknesses.", "claims_and_evidence_yn": "No", "claims_explanation": "- Human-preferred prediction under distribution shift is mentioned as a method for making decisions, but how do I even know when I have distribution shifts, or is it just an example of a more passive approach where humans are more likely to be consulted? \n- Uncertainty information could also be retrieved directly from the classifier; the authors use CP as a meta model which already uses CP as uncertainty quantifier. As a final step, they consider an uncertainty interval for the rejector, i.e., uncertainty from the meta model. I don't see the reasoning behind this step. \nMoreover, the authors state: \"We expect this workflow to increase the classifier’s coverage while not substantially decreasing overall system accuracy.\" The experiments from section 5.4 are in the appendix, and I don't see any coverage rates.\n- The Conformal Prediction for L2D in the related work section is described very briefly, and comparisons are only made with Liu et al. 2022 in the experiments. Why could no comparisons be made with the other baselines, or are they missing from the experiments? \n- For each of the three use cases, one dataset is utilized. I think it is beneficial that there are different applications, but for the generalization of the method, two datasets per application would be helpful. \n- When coverage decreases, accuracy improves. This suggests that the authors' method works, but at the same time, it also happens as soon as I do not classify these samples due to some uncertainty function. In order to demonstrate the improvements of the method compared to other baselines, I am missing other evaluations that show that higher accuracy can be achieved with greater coverage.\n- I find the discussion lacking in the numerical results, i.e., a result is usually explained in 1-2 sentences, but there is no further discussion of what it means.", "audience_yn": "Yes", "audience_explanation": "Yes, I think other researchers are interested in this work because it is an interesting topic and, as it seems, the authors present different methodological approaches. However, I find the experimental design to be still too incomplete and insufficiently discussed.", "requested_changes": "critical changes:\n- The abstract is very concise and difficult to understand if you are not researching this topic.\n- The authors write: \"See the supplementary materials for additional details about more algorithm detail, training hyperparameters and backbone architectures\" I couldn't find the information. \n- The authors express their improvements in percentages, but these are percentage points.\n- I am missing a decisive baseline, namely to use the uncertainty of the classifier directly (i.e., without a rejector meta model) and to set a threshold on the sigmoid function in the range where no decision is made.\n- I find it really difficult to compare accuracy vs. ratio deferred, as accuracy often increases when fewer decisions are made. Perhaps a plot directly comparing the two would be useful for identifying differences in the methods. \n- Table 3 compares different methods than those in the main paper, which I find somewhat confusing.\n- The authors write: \"Resulting coverage and deferral-rate metrics are reported in Table 5.\" I see only accuracy. \n\n\nminor changes:\n- At the beginning of the introduction, it would be helpful to mention specific examples of L2D applications. \n- In figures and tables, sometimes very large font size, then very small again - should be consistent and match the text size.\n- Mean and standard deviation are given, but not how many splits (cross validation) were used to obtain the results.\n- Sometimes it is written as “system accuracy,” then only “accuracy,” or “standard accuracy,” which all describe the same thing (as I understand it), so it should be kept consistent.\n- I find it unusual that Fig. 2 is divided by text and across pages - somewhat confusing; I would prefer it as single figures.\n- Why were no experiments performed for Cifar10 in Table 5?", "broader_impact_concerns": "NA", "additional_comments": "- I think the background section is good in terms of length and provides explanations of the basics at an appropriate level.\n- I think the various approaches to covariate shift are well chosen.", "extra_scores": {}, "extra_text": {}}, {"review_id": "WJY11n2q1m", "reviewer": "Reviewer_QR8o", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "I think the main contribution of this paper is introducing conformal prediction into the rejector of L2D and constructing deferral sets with statistical coverage guarantees. \n\nThe paper estimates the probability of expert correctness, applying conformal prediction yields deferral sets {0}, {1}, {0, 1}, this leads to novel three alternative L2D workflows: abstention, consensus prediction, and human-preferred routing. \n\nThe theoretical innovation is limited, but the work fills a gap in uncertainty quantification within the L2D studies and identifies a real limitation: the deferral mechanism can fail silently under distribution shift. Introducing distribution-free UQ to this component is sensible and fills a gap in the literature. Moreover, the workflows make use of uncertainty in routing, not classification. I think it conceptually expands the L2D design space. \n\nI think it is a shame that the CP target is only expert correctness, not the Bayes-optimal deferral rule, the proposed CP construction only calibrates the expert side.", "claims_and_evidence_yn": "No", "claims_explanation": "The core claims about achieving nominal coverage, constructing compact deferral sets, and improving robustnessvia abstention and consensus workflows are backed by clear experiments across three datasets, with appropriate reporting of coverage, set size, accuracy, and deferral rates. Meanwhile, the OOD experiments systematically vary shift severity and include reasonable baselines, this demonstrates that conformalized rejectors can yield more stable performance under moderate shift. \n\nHowever, as to safety or being closer to the Bayes-optimal rejector, I think the method calibrates expert correctness, not the full deferral decision, and there is no theoretical guarantee under distribution shift, there are only empirical results.", "audience_yn": "Yes", "audience_explanation": "I previously read a paper titled “CP-Router: An Uncertainty-Aware Router Between LLM and LRM,” and I feel it follows a somewhat similar paradigm. I think, especially for researchers studying decision routing, deferral systems, or uncertainty in human-AI teams, there is clear audience interest. \n\nI believe that UQ does not have to be applied only to predicting the answer itself, it can also be applied to predicting who should provide the answer. This is precisely what the paper addresses, and introducing uncertainty into the system’s decision-routing layer can indeed be combined with risk control to improve the safety of the entire pipeline. \n\nThe work demonstrates that the rejector itself requires credibility assessment. By using conformal prediction to generate deferral sets or uncertainty intervals, the system can explicitly express I don’t know whom to assign this instance to, which makes abstention, consensus prediction, or human-preferred strategies natural and justified. \n\nIn other words, it proposes a new safety paradigm: when the system is uncertain about which source is more trustworthy, it can defer the decision rather than proceeding blindly.", "requested_changes": "1. Please clarify \"an indicator function that checks if the prediction and label are equal\" in Eq.(1).\n\n2. I think what truly needs calibration is not expert correctness alone, but the comparison between expert correctness and model correctness. Instead, the paper applies CP to expert correctness as a single variable. As a result, the coverage guarantee obtained by the method does not correspond to the optimal deferral decision in any meaningful sense. In other words, the paper addresses a proxy for the rejector but not the rejector itself. \n\n3. The deferral set tends to become wider under distribution shift, showing some degree of shift-awareness, but this behavior is entirely empirical. While the experiments show seemingly reasonable behavior, the paper offers no explanation for why the rejector score becomes less confident under shift, nor whether certain data properties or model parameters influence this phenomenon. Just OOD robustness is observed but not understood.", "broader_impact_concerns": "N/A", "additional_comments": "N/A", "extra_scores": {}, "extra_text": {}}, {"review_id": "oCMrPf4gaZ", "reviewer": "Reviewer_cVVm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "1. The paper proposes to quantify uncertainty in the rejector of Learning-to-Defer (L2D) systems using conformal prediction (CP). \n2. Instead of a binary ``defer/not-defer'' output, the rejector produces a deferral set $(0), (1), (0,1)$ or an interval over the probability that the human is correct. The motivation is that rejector uncertainty should translate into safer downstream behaviors such as abstention, consensus checking, or human-preferred routing under distribution shift.\n3. The novelty of the contribution is incremental tweak on split conformal prediction applied to the rejector’s scalar probability estimate.", "claims_and_evidence_yn": "No", "claims_explanation": "1. The framing of the paper’s contributions is misleading. The introduction motivates the problem by claiming that an uncertain rejector can help in cases of distribution shift, since the system “cannot be sure who should handle the shifted data.” This is conceptually incorrect. Uninformative or wide conformal deferral sets arise even without any distribution shift, for example, in inherently ambiguous or borderline instances, under high variance of the rejector’s estimates, due to calibration-set scarcity, or because of noise in the human simulator. These are standard and expected behaviors of conformal prediction. They are not indicators of shift, and the paper’s narrative conflates these fundamentally different causes of uncertainty.\n\n2. The behavior of the four L2D frameworks proposed is simply heuristics without any theoretical justification. For instance, in case of model-preferred prediction for cost saving framework, the authors say 'We expect this workflow to increase the classifier’s coverage while not substantially decreasing overall system accuracy.', without any theoretical justification. \n\n3. Model-preferred prediction for cost saving framework is presented only qualitatively. There is no model or workflow to show how to achieve it in practice.\n\n4. Human-Preferred Prediction under Distribution Shift framework seems distractive. Since, distribution shift is assumed, no coverage guarantees presented hold. It says 'we consider cases in which intuition leads us to believe the human is a more robust predictor than the model.' If this knowledge is available, why authors use the $C_r(x_{N+1}:\\hat{\\tau})$ constructed assuming exchangeability? \n\n5. The decision rule for deferral intervals in Section 3.3, para 2, seems wrong: One possibility is to simply\nabstain if the interval is on both sides of 50%. Shouldn't this be opposite?", "audience_yn": "Yes", "audience_explanation": "The paper touches on an emerging direction, uncertainty quantification for deferral mechanisms, and complements ongoing work in selective prediction and conformal inference. This topic is relevant to both theoretical and applied ML researchers concerned with trustworthy human-AI collaboration. But, in the current form, the paper needs to clarify claims.", "requested_changes": "1. Equation 1 seems wrong. It should have indicator comparing classifier's output with the true label. (critical change)\n2. In all experiments, the target coverage level seems to be set to 90%. What is the reasoning for this choice? Can you provide or discuss the results at higher target levels? (critical change)\n3. The authors should clarify and discuss the multiple independent reasons why conformal prediction may output uninformative sets, rather than implying that such uncertainty primarily signals distribution shift. (critical change)\n4. Can authors describe how are they measuring coverage under abstention? I couldn't find it in the paper and thinks it is essential to add. (strengthen the work)\n5. Provide detailed outline, beyond current heuristics, for Model-preferred prediction for cost saving framework as well as Human-Preferred Prediction under Distribution Shift framework. (critical change)\n6. Update the decision rule for deferral intervals in Section 3.3, para 2. (critical change)", "broader_impact_concerns": "NA", "additional_comments": "NA", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)