Rethinking Robustness in Machine Learning: A Posterior Agreement Approach
Authors: João B. S. Carvalho
Víctor Jiménez Rodríguez
Alessandro Torcinovich
Antonio Emanuele Cinà
Carlos Cotrini
Lea Schönherr
Joachim M. Buhmann
Venue: Accepted by TMLR ()

Abstract: The robustness of algorithms against covariate shifts is a fundamental problem with critical implications for the deployment of machine learning algorithms in the real world. Current evaluation methods predominantly measure robustness through the lens of standard generalization, relying on task performance metrics like accuracy. This approach lacks a theoretical justification and underscores the need for a principled foundation of robustness assessment under distribution shifts. In this work, we set the desiderata for a robustness metric, and we propose a novel principled framework for the robustness assessment problem that directly follows the Posterior Agreement (PA) theory of model validation. Specifically, we extend the PA framework to the covariate shift setting and propose a metric for robustness evaluation. We assess the soundness of our metric in controlled environments and through an empirical robustness analysis in two different covariate shift scenarios: adversarial learning and domain generalization. We illustrate the suitability of PA by evaluating several models under different nature and magnitudes of shift, and proportion of affected observations. The results show that PA offers a reliable analysis of the vulnerabilities in learning algorithms across different shift conditions and provides higher discriminability than accuracy-based metrics, while requiring no supervision.

Published in Transactions on Machine Learning Research (10/2025)
Rethinking Robustness in Machine Learning: A Posterior Agreement Approach
João B. S. Carvalho"
waoo.carvolho@iin.cco ethzz.c
Department of Computer Science, ETH Zurich
Victor Jiménez Rodríguez*
Department of Computer Science, ETH Zurich
Alessandro Torcinovich"
ailesandde.torrcnovvccho.ifffft
Paculty of Engineering, Free University of BalennBo Department Computer Science, ETH Zurich
Antonio E. Cinà
antonio. @unigge. it
Depariment of Computer Science, University of Genoa
Carlos Cotrini
ccarlos@öinf. ethaz....eehhhhh
Department of Computer Science, ETH Zurich
Lea Schönherr
schoenherr@ccispa.dd de
CISPA Helmhollz Center for Information Security
Joachim M. Buhmann
Wnuhmann@inf.ethh.ccm
Department of Computer Science, ETH Zurich
Reviewed on OpenReview: https: // opwnreveee... net/ formn? id= Bpc9u26kcg
Abstract
The robustness of algorithms against covariate shifts is a fundamental problem with critical implications for the deployment of machine learning algorithms in the real world. Cur- rent evaluation methods predominantly measure robustness through the lens of standard generalization, relying on task performance measures like accuracy. This approach lacks thcoretical justification and underscores the need for principled foundation of robustness assessment under distribution shifts. In this work, we set the desiderata for a robustness measure, and we propose a novel principled framework for the robustness assessment problem that directly follows the Posterior Agreement (PA) theory of model validation. Specifically, extend the PA framework to the covariate shift setting and propose measure for robust- evaluation. We assess the soundness of measure in controlled environments and through empirical robustness analysis in two different covariate shift scenarios: adver- sarial lcarning and domain generalization. We illustrate the suitability of PA by evaluating several models under different nature and magnitudes of shift, and proportion of affected observations. The results show that PA offers a reliable analysis of the vulnerabilities in learning algorithms across different shift conditions and provides higher discriminability than accuracy-baat based measures, while requiring no supervision.
"Equal contribution, authors listed in alphabetical order. i "Corresponding author.

---

Published in Transactions on Machine Learning Research (10/2025)
1 Introduction
Real-world data analysis problems are often formulated as (potentially intractable) combinatorial optimiza- tion lasks, e.9,, inferring data clusterings, segmentations, embeddings, parameter estimation, etc. The stochastic nature of the input data and the computational complexity of the involved information process- ing require resorting to approximated, probabilistic estimates. However, such solutions often suffer from instability when generalizing to new observations that contain the same signal but systematically different Sertionnro-Canndee et al. 2008).
noise perturbations, phenomenon often referred to as covoriate shift Covariate shift has gained increasing relevance, especially with the rise of deep learning and its astonishing improvements for wide variety of predictive tasks. The focus of the research community is progressively "shifting" towards novel models that cover different levels of heterogeneity in the data and their structure. Consoquently, new experimental settings have been implemented in order to test the robustness of machine learning models under nontrivial perturbations of the signal.
The focus of this work is on image classification tasks in two main categories of covariate shift:
adversarial (intentional) shift: data is crafted ad-hoc by an adversary with vicious intentions, to
hinder the output quality of the algorithm (Carlini Wagner 2017b Biggio & Roli 2018
ditto--ddittiibttinn (unintentional) shift: data is subject to different initial conditions during its
measurement (e.g., lighting conditions, orientation, and so on | Koh et al. 2021 Wang et al. 2023a
Under these settings, the usual standard robustness evaluation procedures consist of comparing the task performance of the model by computing a performance measure- f.e., the accuracy or a derived alternative under increasing levels of shift (Cinà et. al. 2025 Koh et al. 2021). Therefore, such an evaluation is the same commonly used to test the generalization capabilities of models in the absence of measurable/ messurabbe/ccoouutalll accountablee shift, that is, when data is subject to the randommess entailed by the sampling process only. In the following, we argue that the assessment of model robustness requires a paradigm shift in the way it is approached.
We first characterize the concept of robustness measure with two ideal properties that it should possess:
non-increasing: the measure should be non-increasing with respect to the response of the model against increasing levels of the shift power.
2. shift-sensitive: the mcasure should differentiate models only by their response against covariate shift.
In essence, Property 1 requires the mcasure not to increase the robustness score of a model if the shift in the data increases. In the best case, a model should be insensitive to shift, therefore scoring the same robustness as when it is absent. Property for instance, sensitive to in-distribution sampling randomness and its related task performance.
2 requires, instead, that the measure reacts only to covariate shift and is not,
Such properties serve as guiding principles for the evaluation process and are intentionally not formalized. This qualitative reasoning is due to the concept of robustness depending, case-by-case, the definition of shift power. For example, in adversarial learning (Madry et al., 2018), the shift power usually coincides with the norm of the difference between data observation and its perturbed counterpart. On the other hand, in domain generalization (Fulig et al., 2021), it usually encodes perceptual or semantic alterations that are specific to each datasct and that are hard or even impossible to characterize in a unified way. Furthermore, the shift power may also describe different aspects of the perturbation, such as the number of affected observations, which is often overlooked but equally relevant to time and performance efficiency, In both settings, a principled approach to measuring robustness is required and is currently missing. Another difficulty, related to Property 2 arises from the fact that it is not always possible to separate the covariate shift from the sampling noise, as this would require access to the often unknown data-generating process.
In general, accuracy-based measures decline with growing shift power, thereby satisfying Property I How- ever, as accuracy results from thresholding over the predictions, it is unable to encapsulate any information
In some cases, out-of-distribation used to define shift the target set. Fang al. 2022
2

---

Published in Transactions on Machine Learning Research (10/2025)
Perfect
Constant
Random
Accuracy
PA
1.00
0
0.75
-200
0.50
-400
0.25
-600
0.00
Bernoulli Probability
Bernoulli Probability
Figure 1: Comparison of accuracy and our proposed measure, Posterior Agreement (PA), to assess the robustness of three binary classifiers. We simulate a dataset of targets Dy = {yI...... ................................ :y)), |Dy N where each y1 ~ B(p) is sampled from Bernoulli distribution with p p(Y' 1) (displayed on the r-axis). We assume perfect classifier f(y:) Vs. constant classifier f(4) and random classifier whose outputs are permutation of Dy, so that the nunber of mismatched observations depends p. Accuracy does not comply with the desired properties of a robustness measure and provides an inconsistent assessment, which is exclusively driven by task performance. Instead, PA detects the robustness of constant classifier, discriminating it from the random, unrobust one.
regarding model confidence. In standard validation procedures, devising sures increases their discriminative power, especially when comparing models with similar predictive capabil- ities but different confidence in the predictions. In the covariate shift setting, this distinction is decisive, not only for characterizing model's robustness even in the presence of low shift power perturbations but also for providing a more consistent robustness assessment that does not heavily depend on the stochasticity of the dataset. Additionally, some accuracy measures involve a comparison with the target variables in the test set (e.g., the attack succoss rate in adversarial learning), thus not complying with Property 2 For example, constand clussifier oulputting the same prediction, regardless of the input, is robust by delinition, since its output is independent of any shift in the data, thus covariate shift too. Similarly, a perfect classifier that always outputs the target's 's input is also robust. An accuracy measure would, however, discriminate the two models as differently robust since their performance would differ (ef. Figure I left).
mea-
In this work, we address these weaknesses and propose a new measure that better complies with the aforemen- tioned propertics, from the principled perspective of the Postcrior Agreement (PA) framework (Buhmann) 2010 Buhmann al.) 2018a Gronskiy 2018 PA is an alternative model validation procedure rooted in information--heoretiic thinking, in particular the rate-distortion theory (Cover & Thomas 1999). In this setting, the learning algorithm is thought of as a lossy compression procedure with the aim of resolving the hypothesis class as precisely as possible, given the stochastic data source, a critical requirement for a measure aligned with the two proposed properties. The proposed PA measure provides a unique and unified framework for robustness assessment in the covariate shift setting, as it relics on a concept of robustness that stem from the consistency of the probabilistic response of the model under different data instances. PA model's classification performance, thus aligning
is confidence-basee measure that does not depend with the foundational properties outlined before. As an illustrative example, Figure [ depicts the difference between accuracy and PA in the robustness assessment of the constant /perfect classifiers described before. Since, the prediction confidence of a constant model is unaffected by the data, PA awards its robustness.
The original posterior agrcement framework was devised provide an opistemologically grounded methodol- ogy for finding robust solutions to optimization problems. In short, the method is given two dataset instances, used to fit two posterior distributions. The spread of such distributions is governed by a temperature pa-
3

---

Published in Transactions on Machine Learning Research (10/2025)
rameter that trades off their informativeness and stability, in order to reach agreement and reconcile their differences due to the sampling noise in the data. In this article, we focus on leveraging the PA framework for robustness evaluation. In particular, we assume that the shift between the two data realizations is covariate. By using the PA approach, we quantify the agreement between the related posteriors. The obtained measure estimales, thus, the robust ness of a tested model as its capability to treat. the shift as generalizable sampling noisc. In such a case, the posteriors strongly agroe, and our PA measure awards the model good score.
Our work proceeds follows. We first present the original PA framework and adapt it to covariate shift settings without modifying its fundamental principles. In particular, formulate PA without any require- ments of supervised information, making it a suitable mcasure for robustness evaluation in contexts where the supervision is very scarce or null (e.g., medical applications, or autonomous driving). We then conduct a robustness analysis on two current settings of interest, namely adversarial learning in the evasion attack sce- nario and domain shift. under targeted covariate shifts. In particular, we analyze the performance of several models in terms of PA under different natures and magnitudes of perturbation and proportion of affected observations. Not only does PA succeed in documenting the worsening of model performance in great detail, but it also detects an ongoing shift even when the number of targeted observations is low. Additionally, these findings were extended by leveraging PA for robust model selection with carly stopping. In particular, experiments included the perturbation of data with spurious factor co-occurrences. The results show that PA-based selection succeeds at mitigating the spurious correlations existing between shifted environments.
In summary, (i) we propose the PA measure to assess model robustness in covariate shift scenarios and to motivate it theoretically, (ti) we conduct a robustness analysis on several settings, illustrating the findings emerging from an evaluation with PA, (Mi summarize our findings and discuss new notion of model robustness in the PA sense arising from the presented results.
2 Related Work
Postcrior Agreement Since its inception, the PA framework has been adapted to several different settings and is present in the literature under different variants, reflecting its evolution over time. The earliest version is called Approximate Set Coding (ASC, Buhmannn 2010 2012), that interprets a model selection problem as an imaginary communication channel entailing a capacity optimization process. At the core of ASC lies the trade-off between informativeness and robustness of the selected solution. ASC works with approrimation sets, i.e. discrete subsets of hypotheses spanned by a cost. function of the problem. Such sets are controlled by tunable parameter determining optimal trade-off between informativeness and stability of the solutions, discussed in more detail later. A variant of the framework goes under the name of SIMILARITY approach [uhmmann et al.) 2018b), where approximation sets are tuned to maximize the ratio of solutions expected due to the similarity of the data instances. A recent version of the framework (Buhmann et al., 2018a) applies a relaxation of the ASC approach with posterior distributions that will be presented in this work. Here, approximation sets are replaced by Gibbs posteriors tunable through a temperature parameter. In the following, we will refer to this method as PA. In all its variants, PA has been applied to variety of different selection and validation problems, including clustering (Buhmann 2010), regression (Gorbach et al. 2017 Wegmayr & Buhmann, 2021), sorting (Busse et al. 2013), MAXCUT problems (Gronskiy & Buhmaann 2014
Bian et al. 2016), and assignment problems (Buhmann et al. 2014 2017 2018a).
Adversarial Learning Adversarial robustness is a fundamental research area in machine learning due to the susceptibility of deep neural networks to small perturbations, leading to erroneous predictions (Szegedy
et al.] 2014 Goodfellow et al.) 2015). A huge plethora of effective and efficient attacks such as FGSM
(Goodfellow et al. 2015| Yuan et al. 2019), PGD (Kurakin et al. 2018 Madry et al. 2018). BIM (Kurakin
et al. 2018), C&W (Carlini & Wagner 2017b). DeepFool Dezooovi-Dezfooli et al.) 2016).
FMN Pintor
ct al. 2021 and others (Carlini & Wagner [2017a Croce & Hein 2019 Modas et al. 2019
Zheng ct al.
2023). have been developed to evaluate the adversarial robustness of machine learning models. Adversarial
examples are often measured in terms of their distance from the original input, using é, norms (Carlini & Wagner] 20177b. Their use enables a consistent and well-defined way to mcasure the magnitude of the perturbation and compare different adversarial attacks (Carlini & Wagner] [017b]] Cinà et al., 2025). In this work, also include analyses on the ratio of perturbed observations in dataset. We believe that
4

---

Published in Transactions on Machine Learning Research (10/2025)
this aspect can help in better understanding the behavior of models against attacks, later shown in the experimental section.
Assessing model robustness proved to be necessary for developing more reliable machine learning systems and for ensuring their resilience before deployment. Typically, white-box models are employed to analyze a model's worst-case scenarios and avoid relying on security by obscurity (Carlini et al., 2019 Fisenhofer al. 2021 Däubener et al. 2020). The assessment is commonly performed in the literature by scoring models with accuracy- based measures such as attack success rate and adversarial accuracy. While the definition of these two scores is not consolidated, in general, they estimate the model performance over test set in terms of un/succossful attacks. Additionally, Weng et al. (2018) approach robustness evaluation constant estimation problem. The method is, however, susceptible to gradient masking (Goodfellow) 2018). causing the measure to overestimate the size of the perturbation needed to fool a model. In addition, the bound is obtained by exploiting the ReLU property of neural networks, therefore narrowing its scope to such models. Wang et al. (2023b) uses, instead, the converging time to an adversarial sample for estimating the robustness of a model. This approach requires the estimation of a Jacobian with respect to the input, which may be infeasible in the case of large-sized data, and is applicable only to differentiable models.
Lipschitz
field of paramount importance in machine learn- ing due to both the limitation of acquiring a diverse and large enough set of training samples (Wolpert & Macready 1997), and the nature of current methods to capture spurious correlations from training data that lead to catastrophic loss of performance in out-of-distribution settings (Wiles et al. 2022: Geirhos et al. 2020 Over the years, several benchmark datasets have been introduced specifically for domain generaliza- tion. The PACS dataset (Yu et al. 2022) represents shifts in visual styles between real photos and artistic media like paintings, cartoons, and sketches, reflecting variations in colour, texture, and abstractness. VLCS (Torralba & Efros 2011] captures object-centric and sceno-centric distribution shifts, with variations in object variability, scene context, and annotation styles across other previously established datasets. The WILDS benchmark (Koh et al. 2021 embodies real-world shifts, covering temporal and geographical changes, as well differences in image resolution and quality, which are typical in practical applications. Each benchmark encapsulates unique distribution shifts, providing diverse challenges for evaluating domain generalization methods. More recently, the DiagViB-6 dataset (Eulig et al., 2021 has also been suggested for the system- atic analysis of data distribution shifts over multiple generative factors, covering hue, position, lightness, scale, and texture, and allowing for the accumulation of multiple shifts. While several new benchmarks have been proposed to address growing requirements for both more realistic and challenging evaluation settings, accuracy on the unseen domains remains the fundamental measure for estimating model robustness.
Domain Generalization Domain generalization
3 Methodology
In this section, we devise a tractable version of the posterior agreement for the validation of classification models in covariate shift settings. We first introduce the original PA framework and then adapt it in the context of a classification task. Similar to Buhmmann (2010), we take our inspiration from simulated
annealing and its deterministic variants (Rose et al. 1992 Buhmann & Küihnel 1993 Rose 1998). Our notation follows Buhmann et al. (018a))
3.1 Background
In the original posterior agreement framework, we are given two datasets X', X" E X, derived from the same experimental settings, thus, with identical signal, but different noise realizations. In classic optimization settings, both data instances can be used separately to train a model, f.e., to select a solution from a hypothesis set C. Such solutions are, in general, distinct and often explain not only the signal but also part of the noise. To counter this overfitting, the PA approach (Figure 2 focuses on modelling two posteriors p(c X'), p(c X"). In particular, PA mitigates the effect of the sampling noise by modulating the dispersion of the distributions. Large dispersion of a flat postcrior can explain many different data samples and, therefore, they are less informative. On the other hand, small dispersion of peaked posterior is highly informative but does not generalize well over sampling noise, and is, thus, less stable. PA aims at balancing
5

---

Published in Transactions on Machine Learning Research (10/2025)
B= 0.5: Underfitting
8.0: Optimal
B 40.0: Overliting
Gibbs pastertors
Gibbs pesteriors
Gibbs postertors
pic (X))
pic (x*)
plc (X)
plc (X))
plc (X)
plc XX
solutions
solutions
solutions
8.0
Post. Age:
= 0.5
15
30
Figure The PA framework, applied in the estimation of real-valued parameter (e.g., a distribution's mean). Two posteriors p(c X'), p(e X"), E are fit to two different data realizations. The optimization over the inverse temperature parameter is required to make the two posteriors insensitive sampling noise, When B is too low (top left), the posteriors tend to be uniform and uninformative, f.c., they underfit. When 3 is Loo high (Lop right), the posteriors are too peaked and therefore sensitive to noise perturbation, i.e., they overfit. An optimal 3 (top center) maximizes the posterior agreement (bottom), ensuring informativeness and stability that can be then used for model selection or, in our case, for robustness assessment. Illustration based on Buhmann et al. (018a))
these two aspects, informativeness and stability, to achieve an optimal agreement between the posteriors that explains the selected solutions. The obtained distributions can then be combined and used to sample more robust. solution that betler generalizes over the two noisy data realizations.
Traditionally, posteriors have been designed by calculating approximating the respective Gibbs distribution defined by the score function S(c, X) used in the optimization problem. PA, both Gibbs distributions are parameterized by a shared inverse computational temperature controlling their dispersion and their agrecment. An optimal control of B3 renders the posteriors informative and insensitive to sampling noise perturbation (ef. Figure top).
In case, X', X" represent test set and its shifted instance, while the Gibbs posteriors stem from the model predictions of a trained model. The optimal agreement can then be quantified and used as measure to validate the robustness against covariate shift. A robust model will generate similar posteriors, thus a high agreement. In brittle model with lack of robustness, the posteriors will differ substantially.
3.2 Setting
2 of i.i.d. measurements (observations) drawn from random variable X with support X. A K-class classifier can be defined as the composition of two functions:
Let Dx = (xi) be datase
function F X' - K mapping observations to a tuple of class conditional score functions, i.e., x + F(x) = is fixed, as we are conducting an evaluation. The score term FR E R quantifies the membership degree of observation æ to class & (the higher, the more probable). Fx(x) can be, for example, the logit of a multi-class prediction model (e.g., a neural network).
(x)). These functions are parametrized by a set of parameters 0, which
Note that we do need specify the targets of Dx for assessing the rohustness of model.

---

Published in Transactions on Machine Learning Research (10/2025)
decision rule f R - f.....,KK K), applied to choose the class for each observation, based on the class conditional score functions. Usually, f is the Maximum A Posteriori (MAP) rule:
f(F(z)) = arg max (z(x)
(1)
A classifier is defined as fo
Note that, since F is fixed, the hypothesis set is spanned by all possible decision rules over X. Restricting the process to Dx, gives rise to a finite hypothesis set. C, containing all possible mappings from e Dx + {1....K) K), induced by specific classifier C CECP Therefore, |C|= K
Each classifier is associated with score evaluating its confidence in explaining the data:
S(e, x;0) = Σ (x;;))
(2)
Such score can be used to define a posterior p(c X) over the hypothesis set C. In particular, we aim find a probability distribution p such that Xx; > S(e2, <> p(ei X) > p(c2 X), Vei, 02 narrow the
property that will rewrite as Φc(p). As many distributions fulfill this requirement, possibilities by applying the Marimum Entropy Principle (MEP) (Jaynes 1957), which states to search for the maximally uninformative (í.e., antropy-maximizing distribution which best encodes the observed data.
The following optimization objective
maximize Hpp p(c| X) subject to
(3a)
Φc(p),
(3b)
plc |X) 2 0,
(3c)
Σ p(c |X) 1,
(3d)
E [e]x[S(c, X)]
(3e)
gives the required solution. Here, l is a hyperparameter ensuring that the expectation is finite. We set the Lagrangian without the inequality constraints
a(p,,,)) B) =[[p]
(4)
+a a
1 11- plc OEC
(5)
BBBB[S(c, [4)) -4)),
(6)
and verify that they hold for the found solution. The derivalive with respect to p(c) is
dc
0p(c| X) = -- -1 x) - a +
(7)
Equating it to and solving for p(c) gives
exp(3S(c,
p(c X) exp(1 + +a)
(8)
E cec (xS( X)) and 2 ensures that p(c X) is Gibbs distribution that satisfies the constraints 3b and 3e with the inverse temperature parameter B. The exact value of 3 depends μ,, and can be found by enforcing the posterior agreement principle, discussed in the next section.
Setting exp(1 + a))
The summation over the hypothesis set can pose drawback in the computation of the posterior. The following result provides an efficient. factorization for p(c X).
3Tee finiteness of C mathematical expedient efficiently deal with subsequent derivations. By restricting Dx. represents an index mapping finite set, which is less discriminative than fo F defined above. of. also Section

---

Published in Transactions on Machine Learning Research (10/2025)
Theorem 1.
plc x) II pi(cx))) X),
(9)
where
Pi(k x) exp(6FF is the probability that Ty is assigned to class k.
(10)
j=1 ( (2:))
Proof. cf. Appendix A.1
3.3 Posterior Agreement
We are given two i.i.d. datasets X', X" with realizations sampled from the same ideal (i.e., noiseless) process x; Given a classification model, we can estimate its agreement in the prediction results through the expected posterior agreement kernel
N and for i= (1...., .N) x and oa are two
p(c X')((e) x*)
k == Ex log Σ
(11)
p(c)
CEC
where the expectation is computed over the random variables of X' and X". A notable difference with the previous versions of the kernel is the addition of the term p(c). It is prior over C, used to account for the model complexily. In the following, prior information, that is p(c) = 1/[C), Ve E C. Often, the computation of the expected value over X' and X" is infeasible, therefore the empirical posterior agreement kernel is adopted as
will work under the assumption that do not have access to any
p(c X')p(c x")
MX',"") log
Σ CEE
(12)
p(c)
which estimates the overlap between the Gibbs posteriors defined as explained above.
The computation depends on the inverse temperature hyperparameter E Rzo- Similar the MEP, we search for the 3 that maximizes the overlap between the posteriors. The Posterior Agreement (PA) measure is then computed
1
PA(X', (A) maximize B
1(X', x*).
xx)
(13a)
N
subject to B20
(13b)
1/N is a scaling correction factor since PA increases proportionally with the size of the dataset..
Below, we propose and discuss operative formula to compute the empirical posterior agreement kernel. Theorem 2. With no prior information available, the empirical posterior agreement kernel k(X', can be reuritten as:
N
K p.Gi X')P:')
k(X'," logg CC|
II ==1==1
(14)
Proof. of. Appendix A.2
By optimizing Program 13 with this kernel, we can see the effect 3 in determining the optimal overlap between posteriors. An increment in 3 corresponds peaking the distributions P.(: X), X X', x" toward their MAP, awarding matching distributions that share the same MAP. On the contrary, decreasing 3 flattens the distributions, and mitigates penalizations due to mismalching distributions with different
8

---

Published in Transactions on Machine Learning Research (10/2025)
MAPs. Therefore, the optimization operates tradeoff between these opposite sub-objectives, searching for the best solution that explains the agreement between the two data sources.
We conclude by characterizing the posterior agreement measure as computed with the kernel of Theorem Theorem 3. Under no prior information available, the PA measure has the following properties:
Boundedness: 5 PA(X', S log K.
2. Symmetry: PA(X', ,x) PA(X",X))
Concavity; (0(X',") a concuve function 3 < +00.
Proof. cf. Appendix A.3
4 Experimental Results
In this section, present comprehensive analysis of the empirical results. In particular, study two covariate shift scenarios, adversarial learning and domain generalization, and set up a comparison of the scores obtained by different models, using PA and accuracy-based measures. Our main purpose is to highlight the differences between performance- and vobustness-basse evaluation criteria. Therefore, we compare several defences and learning techniques with different capabilities, to encompass, as much as possible, the variety of cases that can arise during an evaluation process. For further technical information, the reader is referred to our code implementation
For measuring model robustness, use the PA measure with prior information. In particular, use the original test set as X' and its perturbed version as X". For a better visualization of the results, we adopt a logarithmic scale, and we omit the |C] and the I/N constants in PA to increase its dynamic range, therefore PA E loglo K).
4.1 Adversarial Robustness
For the adversarial robustness scenarios, we carry out our experiments with the CIFAR-10 Krizhevsky et al. 2009) and the ImageNet (Deng et al. 2009 datasets, widely adopted in the machine learning security literalure as benchnarks for robust evaluation. The CIFAR-10 dataset contains 60 000 colour images of 32 x 32 pixels equally distributed in 10 classes. The analyzed models are trained on the training set (50000 000 images), and the PA evaluation performed on the test set (10000 images). The ImageNet datasot contains circa 1.5M colour images processed at 256 256 pixels, unequally distributed in 1000 classes. In this case, the evaluation is conducted the validation set, is usually done in the literature. A random subset of 10000 images is selected, so that finite-sample effects and PA values are comparable to those in CIFAR-10 experiments. In both cases, we perturb the test set using several evasion attack methods. We start from two simple attacks, Projected Gradient Descent. (PGD, Madry et al. 2018) and Fast. Minimum Norm (FMN, Pintor et al. 2021), and we proceed to more efficient benchmark attacks such as APGD and FAB from the AutoAttack library (Croce & Hein 2020b). The attack power specified in terms of the foo norm and is set in advance (exe = f/225, f E 2, 8, 16, 32)) for all attacks except for FMN, where the attack norm is automatically scarched for each observation. All attacks are versions for subsequent PA computation. PGD and FMN attacks are run for 1000 steps, while the number of steps in AutoAttack is determined automatically. In the following, we discuss the results for PGD and FMN in CIFAR-10, while we include the remaining AutoAttack experiments in Appendix
the evaluation set to produce perturbed
We consider several models with different robustness properties. In particular, we score an undefended WideRessNet-28-11 (Zagoruyko & Komodakis) (016) and five defended models: a ResNet18 (He et al. 2016a) defended by Addepalli et al. (2022), ResNet50 (He al.) 2016aa) defended by Engstrom et al. (2019), a WideRosNet-28-11 defended by Wang al. 2023c), ProAct (He et al. 2016b) defended according
4PA:

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS
Engstrom et al.
Wong et al.
Addepalli et al.
Wang et al.
x10
PGD, L- 8/255
PGD, La = 8 255
0.0
0.9
-0.2
AFRT
PA
-0.4-
0.8
-0.8
0.7
Adversarial Ratio
Adversarial Ratio
x10
PGD, t. = 255
PGD, to 16 255
0.0
-0.2
0.9
-0.5
AFRT
PA
-0.8-
0.8
-1.2
0.7
-1.5
Adversarial Ratio
Adversarial Ratio
x10
PGD, L. 32 255
PGD, t. /
0.0
-1.0
0.8
AFRr
PA
-2.0
0.6
-3.0
0.4
-4.0
1.0
1.0
Adversarial Ratio
Adversarial Ratio
Figure PA (left) and AFRT (right) scores against increasing AR and lxo for the PGD attack. The tendencies similar with the only exception of the undefended model, which is overperforming according to AFRT.
to Wong et al. (2020) and a 3-layer CNN LeCun et al. 2015) defended by a JPEG pre-processing Das et al. (201)) and Reverse Sigmoid post-processing Lee et al. 2018). All models except for the latter are implemented with the RobustBench library (Croce et al. 2021
We perform a comparison of PA with an accuracy-based measure, the Attack Failure Rate (AFRr = 1 ASRT) and evaluate the performance the models under investigation to verify the effectiveness of the PGD and FMN attacks. The evaluation performed over ten different adversarial ratios (ARs) of attacked examples in the set, ordered by increasing attack power. In particular, a dataset with AR p contains the attacked observations under the 10p-decile, ordered by loo, and the remaining unattacked ones. AR
10

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS
Engstrom et al.
Wong et al.
Addepalli et al.
Wang et al.
PGD,
1.0, l. 25
PGD, AR 1.0, L.
26/
PGD,
1.0,
255
1.0
1.0
1.0
pi
Predictive confidence
Predictive confidence
Predictive confidence
ply (
0.8
0.8
0.8
0.6
0.4
0.4
0.4
0.2
0.2
0.2
0.0
0.0
0.0
AR 1.0, 1.
255
AR 1.0, L.
16 255
255
AR 1.0, 1. 32 / 255
40
30
25
30
30
20
ca 20
20
15
10
10
10
5
0
0
0
Figure 4: (top) Distribution of the prodictive confidence for three example models. The robust one (Wang et al. 2023ch is significantly decreasing its confidence, while the weak ones (undefended and JPEG + RS) are not. (bottom) Final 3 values for AR = 1. Anomalous 3 values identify the weak models.
corresponds to an entirely attacked dataset. The parameter searched with an Adam Kingmaa Ba 2015) optimization procedure, run for 500 epochs. We attested relatively, fast optimization of the B parameter, usually in the order of tens of minutes in single GPU even for large dataset. (i.e., ImageNet).
PGD Attack As illustrated in Figure (left), PA consistently discriminates the undefended model, which significantly decreases its performance with increasing adversarial ratio and attack power. As expected, the rate at which the performance decreases is faster the more powerful the attack is. The JPEG + RS model also displays poor robustness scores, compared to the other models, especially for low-norm attacks, which is consistent with the JPEG compression defence employed.
The fundamental difference between PA and AFRT arises in the scoring of the undefended model, which overperforms according to AFRr, especially for low foo. To understand the causes of such difference, in Figure Z we display the distribution in prediction confidence of three example models. In particular, we compare the correctly predicted observations before the attack (p(0' X', = y). full colour) with the successfully attacked ones (p(ý" X", "" + f)) streaked colour). We look at two weak models (the undefended and JPEG + RS) and the most robust one (Wang et al. 2023c), in the case of AR = 1 (ef. Appendix
B for an analysis of all models). Standard errors (black bars) are also included. Additionally, we include the values of the optimized B paramcters after convergence for all the models. We analyze the behaviour of the three PGD plots:
The undefended model outputs, on average, high-confidence predictions. The standard errors over- lap, hinting that the model cannot detect that attack has happened, therefore not lowering enough
11

---

Published in Transactions on Machine Learning Research (10/2025)
its confidence. AFRT scores are high overall. The maximization of PA entails flat posteriors, to mitigate the effect of the mismatches between the pre- and post-altack distributions. Therefore, | converges to low value. Consequently, we obtain low PA scores overall.
The JPEG RS model provides low confidence predictions, due to the reverse sigmoid defense usod, and does not reduce its predictive confidence in the presence of misleading adversarial examples. As result, PA is maximized when posterior distributions are highly informative, to peak the matches (i.e., 3 converges to a high valuc). However, mismatching predictions induce a penalty on the robustness score that drives PA to low value, overall. AFRy scores are low, as well.
Wang al. (223c) is sensible to the attack and significantly lowers its overall confidence, as indicated by non-overlapping standard errors. Both AFRT and PA are high, overall.
In conclusion, while both measures report similar trends and rankings, AFR lends to overestimate the robustness of the undefended model, especially when a few number of samples have been attacked, while PA provides a more consistent assessment, unbiasod by the nature of the experiment (e.g., &or and AR).
Additionally, note that for AR = 0, PA scores do not converge to the theoretical result. of O. In the absence of shift, the optimal / tends toward infinity to peak all coinciding distributions over their MAPs (cf. proof of Theorem 3 Property 2). However, the Adam optimizer progressively scales down the lcarning rate, dampening, in turn, the convergence rate. The obtained PA scores then reffect the "peakedness" of the initial model predictions, that is, they provide information about the predictive confidence of each model before the attack, with the most confident models scoring better. The ranking of PA coincides with that of AFRT, hinting that in the absence of shift, the tested models yield higher confidence in positive predictions than in negative o This additional insight. is obtained thanks to the use of an adaptive optimization algorithm such as Adam, advocating for its use in the optimization of B.
FMN Attack FMN does not require an lo limit, and antomatically finds, for each observation, the minimum distance needed to evade the classification. We found that for AR 2 0.5, the observations are perturbed far over the shift power against which all models are robustified. We, therefore, focus on the cases with AR < 0.5, and report, for completenes, the exlended results in Appendix B In Figure 5 the PA and AFRT scores are presented. Again, the undefended model robustness overestinated by AFRr. For some ARs, the JPEG + RS model performs better than the other models overall, showing that the JPEG compression defensive mechanism effectively filters out the perturbations and reduces the attack transferability performance of FMN. In Figure G (right); we can note the increment. in the corresponding B, indicating that the two distributions contain more MAP matches. Wang et al. (022cc) results instead in being the weakest model and, therefore, less suitable against this attack. Accordingly, its B is low. For completenoss, in Appendix we include the predictive confidence distributions of all models for AR E {0.5, 1}.
Autoattack In Appendix F we present experiments conducted on CIFAR-10 and ImageNet with the Au- toattack library (Croce & Hein 2020b Specifically, we report robustness scores for APGD-CE/DD WEEE/DLR/TT DDR//LR. RDDRR,, and FAB atlacks on CIFAR-10. The results exhibit. trends consistent. with those discussed above: PA pro- vides a reliable assessment under increasing shift power, whereas AFRT yields inconsistent rankings and fails to discriminate effectively between models. Below, we shortly discuss the obtained results. The reader is referred to the appendix for more detailed discussion.
In the CIFAR-10 case, Autoattack is much more effective than the vanilla PGD attack discussed above. Evaluating a wider range of epsilon values reveals the full spectrum of AFRT scores and confirms the superior discriminability of PA even when all defenses fail. For example, PA ranks Addepalli et al. (2022) and Wang et al. (2023c) as the most robust defenses against APGD attacks across all Eoo and AR values, whercas AFR1 only reaches this conclusion in the high shift power regime.
However, this is not always necessarily true. We want to remark that task performance and predictive confidence are two distinct. aspects (ef. Appendix
12

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS
Engstrom et al.
Wong et al.
Addepalli et al.
Wang et al.
x10
FMN
FMN attack
0.0
0.8
-1.0
AFR1
PA
-2.0
0.4
-3.0
-4.0
0.2
Adversarial Ratio
Adversarial Ratio
Figure 5: PA (left) and AFRT (right) scores against increasing AR and foo, for the FMN attack. Again, the undefended model robustness overestimated, according to AFRT. For AR 0.6] JPEG + RS model is more robust than the others, with similar trend in performance.
AR 0.5
FMN. AR 0.5
1.0
AP 1XP1XPP-11
Predictive confidence
(X",
30
0.8
0.6
20
0.4
10
0.2
0.0
Figure 6: Predictive confidence distributions (left) and 3 plots (right) for the FMN attack. The results are related to AR 0.5 not to include perturbations against which the models are not robust. The models perform similarly to the PGD case, with a less marked difference in the standard error for Wang et al. (2023c) model.
In the ImageNet case, observe that PA and AFRr yield the same defense ranking. This is due to the high success of the attack, which makes performance degradation drive the PA score. Still, PA demonstrates greater consistency, ranking models correctly when AR > 0, whereas AFRT requires AR 2 0.8.
4.2 Domain Generalization
Following the analysis on adversarial robustness, we perform series of experiments on several domain generalization settings to assess both model discriminability and model selection when comparing PA to accuracy-based measures. Again, AFR, is taken as the comparison reference. In addition, Adam is run for 1000 epochs to search for the 3 parameter.
In this scenario, we conduct our experiments through a modified version the DiagViB-6 dataset Eulig et al.] 2021) that compriscs distorted and upsampled coloured images of size 128 128 from the MNIST dataset (LeCun 1998). Each image defined by five controllable factors that induce changes in texture, hue, lightness, position, and scale. A domain corresponds specific configuration of these factors.
13

---

Published in Transactions on Machine Learning Research (10/2025)
Vanilla ERM
Arjovsky et al.
Yao et
Stift Ratio 0.2000
Shift Ratio 0.2000
1.00
-10
0.98
0.96
0.94
-10
0.92
0.88
0.86
2
Shift Factors
Shift Factors
Shift Ratio 0,4000
Shift Ratio 0.4000
1.00
-10
PA
-10
0.92
0.90
0.88
-10
0.86
Shift Pactors
Shift Pactors
0.6000
0.6000
0.98
0.96
0.34
102-
0.92
0.90
0.88
Shift Factors
Shift Factors
Shift Batio 0,8000
1.00
Shift Ratio D 0.8000
161
0.98
0.96
2A
0.04
-10
0.88
-107
0.86
2
Shift Factors
Shift Pactors
Shift Ratio 1.0000
Shift Ratio 1.0000
1.00
10
0.96
0.94
10a
0.92
0.90
0.88
-10
0.86
Shift
Shift
Figure 7: Effect of domain shift in the PA performance on a weak and robust model, over five distinct levels of the shift ratio. Each plot depiets the response of both models to cumulative levels of distribution shift, from one to five shifted factors. At each shift ratio, PA is able to differentiale between the two models.
For training, we define two unique original domains, {e) ef); under a pair of original instantiations of cach image factor, where all the factors of of are different from eg We induce second pair of domains for the validation data, following precisely the factor configuration of the training domains, but with disjoint set of
14

---

Published in Transactions on Machine Learning Research (10/2025)
Vanilla ERM
Arjowsky et al.
Yao et al.
Avg. predictive confidence
1.00
Avg. prodielive confidence
1.00
Agg. predictive confidence
1.00
0.98
0.98
0.98
0.96
0.96
0.96
0.94
0.94
0.94
0.92
0.92
0.92
# Shift Factors
# Shift Factors
Shift Factors
5
Avg. predictive confdonce
Avg. prediclive confidence
1.00
1.00
4
0.98
D.98
0
0.96
0.96
2
0.94
0.94
1
0.92
0.92
0
Shift Factors
Shift Factors
Figure 8: Average predictive confidence for three models-(bll) Vanilla ERM, (orange) IRM, and (green) LISA, under SF = 1. Each panel shows results at different number of shift factors (#SF), illustrating how the models' predictive confidence varies the distribution shift increases. The left column remains fixed, and the right column changes across #F 1, 4,5. The final bar plot on the right depicts the B for shift factors. We see that higher model confidence leads to an adjusted higher B.
samples. Finally, a set of six additional domains, fea, e }. is generated. The factors of domain eo are identical cb. while each (i I,....57 5) is obtainined by modifying exacty of the five factors relative to ej-
Our final dataset comprises two sets 40 000 images for training, two sets of 000 images for validation, and six sets of 10000 images for testing. Note that the original MNIST images used for generating the datasets do not overlap. For more details on how the dataset was adjusted to our setting, refer Appendix E
For the experiments, consider ResNet50 model trained with three different algorithms: vanilla Empirical Risk Minimization (ERM, Vapnik 1991), Invariant Risk Minimization (IRM, Arjovsky et al. 2019) and Learning Invariant Predictors with Selective Augmentation (LISA, Yao et al. 2022). These methods were chosen as representative examples of two distinct approaches to domain generalization: IRM operates by enforcing invariance the level of latent representations, while LISA augments the data itself to promote invariance in the input space. By including both, we evaluate robustness across approaches that intervene at different, stages of the learning process.
Model discriminability In Figure we showcase the PA evaluation results over cumulative distribution shifts. Each plot presents the variation of PA over five cumulative implementations of the shift factors (SF), in five distinct test sets corresponding to increasing amounts of shift ratio (SR). In particular, subset of the test set to the related cumulative distribution shift to an SR corresponding to 20%, 40%, 60%, 80%, and 100% of the original dataset. Similarly to AR, SR = 1 entails a change of all the samples in the dataset.
subject
As depicted, and already well established in Koh et al. (2021) the overall trend of robustness starts with ERM as the weakest model, followed by IRM, and then by LISA as the most robust. However, PA is also able to identify more nuanced robustness behaviors. In particular, when SF ERM achieves higher
15

---

Published in Transactions on Machine Learning Research (10/2025)
PA score because it relics on domain-specific features already encountered during training, even when the number of mismatching predictions is higher. Note that PA is the only measure that was able to discriminate ERM. Conversely, the domain invariance imposed by IRM slightly hinders PA under these mild shifts, even though its overall AFR remains comparable or better.
This illustrates that PA and AFRT provide complementary insights in domain generalization: AFR reflects performance differences across shifts, while PA emphasizes the stability of predictive distributions under factor perturbations. For example, PA stabilizes after certain shifts because the model has not learned to represent additional factors (e.g., after hue and brightness), whereas AFR continues to decrease as perfor- mance drops. At the same time, PA can capture fine-grained effects that AFRr may overlook. In particular, the source-versus- partially overlap with training distributions, while AFRT may mask these munnces. Consequently, IRM's robust design trades off some PA in low-shift regimes but does not sacrifice performance, distinguishing its behavior from both ERM and LISA in a way that PA can clearly reveal. Taken together, both mcasures are valuable for a comprehensive evaluation of robustness.
domain difference highlights how PA reveals model behavior when domain shifts
As shown in Figure S predictive confidence varies across models under distribution shifts. ERM starts with high confidence but declines as the number of shift factors increases, while IRM remains stable, and LISA consistently exhibits the highest confidence, which suggests superior robustness. Higher confidence models require a greater 3 for posterior alignment, as seen in the rightmost plot. Conversely, lower confidence models benefit from reduced 3 to flatten distributions and minimize mismatches. This effect is most pronounced with five shift factors, where LISA maintains strong confidence while ERM struggles. This behavior aligns with adversarial settings, where models with lower confidence require higher 8 to align their distributions. However, this is not strictly a matter of distribution alignment but rather mutual information maximization: such models only push 3 to higher values if their predictions agree. PA demonstrates superior performance because it effectively navigates the trade-off between model performance and informativeness. In particular, modols with lower confiPA effectively captures these dynamics, and through optimal selection of / can enhance robustness under shifting distributions.
We also attempted to better understand the impact of controlled domain shifts and their impact on robustness assessment through PA (cf. Appendix D for more details). A phenomenon observed in this work is the decrease in classification performance as the nunber of shift factors increases, while the PA measure remains comparable or slightly improves. Specifically, at SF = 5, the feature space differs significantly (as shown in Figure [1] from those at SF < 4, leading to lower accuracy yet roughly similar (or slightly improved) robustness. This observation highlights that in more complex settings, where the effects of the covariate shift are directly controlled (as in the case of DiagViB-6), the robustness of the model does not stem solely from how out-of-distribution the samples are. Instead, as noted by Geirhhs et al. (2020), it is influenced by compounded learning phenomena related to which features are captured during training. Consequently, future research should account for these interactions when designing evaluation protocols. For example, one possibility is to test the model on all possible combinations of shift factors, thereby more comprehensively revealing how different combinations and sequences of shifts affect robustness.
Model Selection While our measure has been primarily intended for evaluation, in this section, we inves- tigate whether PA can also effectively guide model selection. To that end, we now examine a setting where the inductive bias is deliberately "poisoned" by shortcut opportunities (SO), i.c., spurious correlations between the predicted factor Fp and the learning factor Fr. We train a ResNet50 architecture from scratch using datasets X' and X", which differ only in the hue factor. These data sets are resampled for each shortcut- opportunity configuration, where spurious correlations between the predicted factor Fp and the learning factor Ft are systematically controlled. As illustrated in Figure 12 (and in more detail Appendix E we systematically control these co-occurrences to create zero or partial Generalization Opportunities (GO). Un- der Zero-GO (ZGO), each instance of Ep is exclusively paired with one instance of Fr., strongly encouraging models to overfit to the shortcut. Partial GOs (1/2/3-CGO) break some of these exclusive pairings, while Zero-SO (ZSO) allows all factor combinations. Generalization performance then evaluated on progressively shifted test datasets, equivalent to those used in our previous experiment. Epoch-wise model selection is performed by either maximizing accuracy or maximizing PA on the validation sets, and the difference in
16

---

Published in Transactions on Machine Learning Research (10/2025)
Test
Test
Test
Test 4
Test 5
Acc.
Accc
Acc.
AAcc
Acc.
Accc
Acc.
AAcc.
Acc.
AAc.
ERM
7GO
53.2
+0.01
54.6
+0.01
55.7
+0.01
66.7
+0.01
66.6
+0.01
1-CGO
62.9
+9.5
64.7
+10.2
60.8
+0.3
62.9
+2.2
61.2
+0.5
2-CGO
69.1
+9.4
71.2
+7.8
71.9
-2.2
76.2
-2.4
77.0
-2.8
&-GGO
73.1
+16.6
85.6
+3.6
70.1
-9.7
71.4
+6.4
72.1
+6.7
ZSO
99.6
+0.01
92.8
-0.1
89.9
#0.01
89.9
+0.2
85.9
#0.01
IRM
ZGO
50.1
+5.9
50.5
+449
+9.5
64.4
+1.1
69.4
+1.2
1-CGO
63.0
+7.0
65.9
+7.6
59.4
+2.
59.0
+1.8
59.0
+1.8
2-CGO
69.0
+10.6
69.7
+10.0
65.8
+4.7
77.0
+13.0
65.1
+12.6
3-CGO
79.5
+11.6
83.0
+9.8
73.6
+10.9
79.5
+11.0
72.2
+11.3
ZSO
99.4
+0.1
93.4
+1.3
89.2
-0.2
87.0
+1.6
87.0
+1.6
Table 1: Test performance under increasing levels of shift for models selected through different configura- tions of factor co-occurrence in the huc-based learning factor experiment. Specifically, the performance of models selected through validation accuracy (Acc.) and the difference between accuracy-based and PA-based selection (AAcc.) are reported. PA is able to select models that perform better than the accuracy-selected model in most cases.
generalization performance between these criteria is reported. For more details on the experiment setup, including the precise vain/validation configurations, refer to Appendix
In contrast to the previous experiments, we exclude LISA here because its dataa-augmenttaiionnneeen strategies would undermine the carefully constructed SO/GO configurations as the algorithm augments the data based on the same image transformations present in this experiment. We therefore restrict our study ERM and IRM, trained on source environments. Additionally, following the model-selection findings from carlier scctions, configuration the training dalasets, ensuring that model selection is not confounded by unseen shifts. The results in Table [ show that caaustness-drveee model selection (based on PA) substantially improves the test performance, in particular, in settings with partial GOs (i.e., 1-CGO or 3-CGO). In these cases, shortcut learning is partially mitigated, so identifying models that best maintain consistent predictions across slightly varied conditions (rather than just maximizing raw accuracy) proves crucial. Notably, TRM tends to benefit more from these robustness-beat based criteria, converging models that can resist spurious correlations and better exploit the available GOs. Overall, this approach demonstrates how focus robust performance through PA, rather than pure in-distribution accuracy significantly enhance generalization.
conduct in-distribution validation: the validation datascts match the same shift
5 Discussion
The PA measure is an attempt at assessing robustness under an epistemologically grounded approach. Such an assessment is agnostic of the underlying data generation process and even the nature of the data itself, therefore, is versatile and can be applied to explain diverse scenarios with single thcory, as illustrated in the experimental study. Additionally, PA is general in its scope. Our proposed version requires only the probabilistic outputs of the model, e.g., the logits of model, and supervision. The model itself does not need to be differentiable, as we do not optimize its parameters.
By relying on the MEP, PA provides an estimate of a model's robustness which is as neutral as possible with respect to missing information. The measure relies on predictive confidence rather than predictions, thus providing a more fino-grained evaluation and a better discriminative asscssment of model robustness. Indeed, the overlap between posteriors over the hypothesis space is indicative of the nature of the shift at an even greater detail than in standard analyses. Instead, test performance measures, such AFRT rely solely
17

---

Published in Transactions on Machine Learning Research (10/2025)
hard-counting of "successes", therefore, they do not fulfill the desired properties of a robustness measure and are more prone to inconsistencies in the rankings.
In particular, in the adversarial learning setting, PA provides higher discriminability and consistency across the various covariate shifts, which is only partially matched by AFR in highly perturbed settings. Addi- tionally, the analysis of the 3 parameter provides further insights into the robustness of the models. In the domain generalization setting, PA further highlights that the robustness of the tested models decreases only with the first shifts, then it stabilizes. AFRr, instead, keeps decreasing, showing once again that robustness and performance two distinct concepts. In this setting, PA also proves to be very efficient in performing model selection.
Our proposed version of PA has, however, limitations. The Cheoretical framework has been developed by considering only the case of a finite hypothesis set. While this does not pose a severe drawback, and the exper- imental results attest to the validity of this approach, a characterization of PA for continuous hypothesis sets would be much more general in its scope. Additionally; we have assumed uniform probability p(c), to obtain more tractable formula for the measure, ignoring the complexity of the hypothesis set. Adding this informa- tion would improve the robustness estimation process, allowing for more fine-grained discrimination between models. In the future, we plan to extend some of the presented theoretical results to more general kernels.
6 Conclusions
In this paper, we have set some desiderata for designing measure measuring robustness against forms of covariate shift such as adversarial noise and domain generalization. Following theoretically grounded thinking, proposed PA, measure derived from the Posterior Agreement framework. We have conducted comparison against commonly used accuracy measures, presenting analyses based novel aspects of the shift. Our study shows that PA (i) provides a consistent and reliable robustness scoring, (ii) provides further details to the analysis that would be otherwise overlooked by accuracy measures and (iii) is also an efficient measure for model selection, while requiring no supervision. In conclusion, our work lays the basis for a more sound model robustness asscssment, in the PA sense.
References
Sravanti Addepalli, Samyak Jain, Gaurang Sriramanan, and R. Venkatesh Babu. Scaling adversarial training to large perturbation bounds. In European Conference on Computer Vision, 2022.
Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization, 2019.
Yatao Bian, Alexey Gronskiy, and Joachim M. Buhmann. coormattiontheoreete analysis of maxcut algo- rithms. In 2016 Information Theory and Applications Workshop, ITA 2016, La Jolla, CA, USA, Jonuary 31 February 5, 2016, pp. 1-5. IEEE, 2016.
Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 2154-2156, 2018.
Joachim M. Buhmann. Information theoretic model validation for clustering. In IEEE International Sym- posium on Information Theory, ISIT 2010, June 13-18, 2010, Austin, Texas, USA, Proceedings, pp. 1398-1402. IEEE, 2010.
Joachim M. Buhmann. Context sensitive information: Model validation by information theory. In Pedro Matorre-Carmona J. Salvador Sánchez, and Ana L. N. Fred (eds.), ICPRAM 2012 Proceedings of the 1st International Conference on Pattern Recognition Applications and Methods, Volume 1, Vilamoura, Algarve, Portugal, 6-8 February, 2012. SciTePress, 2012.
Joachim M. Buhmann and Hans Küihnel. Vector quantization with complexity costs. IEEE Transactions on Information Theory, 39(4):1333-111 1145, July 1993.
18

---

Published in Transactions on Machine Learning Research (10/2025)
Joachim M Buhmann, Alexey Gronskiy, and Wojeiech Szpankowski. Free energy rates for class of very noisy optimization problems. Probabilistic, Combinatorial and Asymplotic Melhods for the Analysis of Algorithms, pp. 61, 2014.
Joachim M. Buhmann, Julien Dumazert, Alexey Gronskiy, and Wojeiech Szpankowski. Phase transitions in parameter rich optimization problems. In Conrado Martínez and Mark Daniel Ward (ods.), Proceedings of the Fourteenth Workshop on Analytic Algorithmics and Combinatorics, ANALCO 2017, Barcelona, Spain, Hotel Porta Fira, January 16-17, 2017, pp. 148-155. STAM, 2017.
Joachim M. Buhmann, Julien Dumazert, Alexey Gronskiy, and Wojeiech Sæpankowski. Posterior agreement for large parameter-rich optimization problems. Theor. Comput. Sci., 745:1 22, 2018a.
Joachim M. Buhmann, Alexey Gronskiy, Matús Mihalák, Tobias Pröger, Rastislav Srámek, and Peter Wid- mayer. Robust optimization in the presence of uncertainly: A generic approach. J. Comput. Syst. Sci., 04:135-1666 2018b.
Ludwig M. Busse, Morteza Haghir Chehreghani, and Joachim M. Buhmann. Approximate sorting. In Joachim Weickert, Matthias Hein, and Bernt Schiele (eds.), Pattern Recognition 35th German Confer- ence, GCPR 2013, Saarbrücken, Germany, September 3-6, 2013. Proceedings, volume 8142 of Lecture Notes in Computer Science, pp. 142 152. Springer, 2013.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security (AISec), 2017a.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Prinacy (SBP), 201 7b.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexcy Kurakin. On evaluating adversarial robustness, 2019.
Antonio Emanuele Cinå, Jérôme Rony, Maura Pintor, Luca Demetrio, Ambra Demontis, Battista Biggio, Ismail Ben Ayed, and Fabio Roli. Attackbench: Evaluating gradient-based attacks for adversarial examples. In Proceedings of the AAAI Conference Artificial Intelligence, 2025.
Thomas M Cover and Joy A Thomas. Elements of information theory. John Wiley Sons, 1999.
Francesco Croce and Matthias Hein. A randomized gradient-free allack on relu networks. In Pallern Recognition, 2019.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Evend, volune 119 of Proceedings of Machine Learning Research, pp. 2196 2205. PMLR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fie free attacks. In International Conference on Machine Learning (ICML), 2020b.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateck Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In Proceedings of the Neural Information Processing Systems Track on Datasets and Bench- marks 1, NeurIPS Dalasets and Benchmarks, 2021.
Nilaksh Das, Madhuri Shanbhogue, Shang- Tse Chen, Fred Hohman, Li Chen, Michael E. Kounavis, and Duen Horng Chau. Keeping the bad guys out: Protecting and vaccinating deep learning with JPEG compression. CoRR, abs/1705.02900, 2017.
Sina. Däubener, Lea Schönherr, Asja Fischer, and Dorothea Kolossa. Detecting adversarial examples for speech recognition via uncertainty quantification. In Conference of the International Speech Communico- tion Association (INTERSPEECH), 2020.
19

---

Published in Transactions on Machine Learning Research (10/2025)
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pallern recognilion, pp. Teee, 2009.
Thorsten Eisenhofer, Lea Schönherr, Joel Frank, Lars Speckemeier, Dorothea Kolossa, and Thorsten Holz. Dompteur: Taming audio adversarial examples. In USENIX Security Symposium, 2021.
Logan Engstrom, Andrew Tlas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry. Adversarial robustness as prior for learned representations, 2019.
Elias Eulig, Piyapat Saranrittichai, Chaithanya Kumar Mummadi, Kilian Rambach, William Beluch, Xiahan Shi, and Volker Fischer. Diagvib-6: A diagnostic benchmark suite for vision models in the presence of shorteut and generalization opportunities. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), October 2021.
Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is oftt---disttibuutin detection learnable? In Advances in Neural Information Processing Systems (NeurIPS), 2022.
Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelli- gence, 2611):665 673, 2020.
Ian J. Goodfellow. Gradient masking causes CLEVER to overestimate adversarial perturbation size. CoRR, abs/1804.0783 2018.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Represenlations (ICLR), 2015.
Nico S. Gorbach, Andrew An Bian, Benjamin Fischer, Stefan Bauer, and Joachim M. Buhmann. Model selection for gaussian process regression. In Volker Roth and Thomas Vetter (eds.), Pattern Recograttio 39th German Conference, GCPR 2017, Basel, Switzerland, September 12-15, 2017, Proceedings, volume 10496 of Leclure Noles in Compuler Science, pp. 306-30 318. Springer, 2017.
Alexey Gronskiy. Statistical Mechanics and Information Theory in Approzimate Robust Inference. PhD thesis, ETH Zurich, 2018.
Alexey Gronskiy and Joachim M. Buhmann. How informative are minimum spanning tree algorithms? In 2014 IEEE International Symposium on Information Theory, Honolulu, HI, USA, June 29 July 4, 2014, pp. 2277 2281. IEEÉ, 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Computer Vision and Pattern Recognition, pp. 770 778. IEEE Computer Society, 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European Conference on Compuler Vision, ECCV, volume 9908 of Lecture Notes in Computer Science, pp. 630-645. Springer, 2016b.
Edwin T Jaynes. Information theory and statistical mechanics. Physical review, 106(4):620, 1957.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In 3rd International Conference Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubra- mani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, Tony Lee, Etienne David, lan Stavnoss, Wei Guo, Berton Earnshaw, Imran Haque, Sara M Beery, Jure Leskovec, Anshul Kundaje, Emma Pierson, Sergey Levine, Chelsea Finn, and Percy Liang. Wilds: A benchmark of in-the-wild distribution shifts. In International Conference on Machine Learning, pp. 6637-5664. PMLR, 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
20

---

Published in Transactions on Machine Learning Research (10/2025)
Alexey Kurakin, lan J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Arlificial intelligence safely and securily, pp. 99-112. Chapman and Hall 2018.
Yann LeCun. The mnist database of handwritten digits. http:///orn.eeoo..om////////////
1998.
Yann LeCun, Yoshua Bengio, and Geoffrey E. Hinton. Deep learning. Nat., 521(7333) 444, 2015.
Taesung Lee, Benjamin Edwards, lan M. Molloy, and Dong Su. Defending against model stealing attacks using deceptive perturbations. Colli, abs/1800 1806.00054, 2018.
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In Proceedings of the Association for Computational Lin- guistics, ACI, pp. 142-150. The Association for Computer Linguisties, 2011.
A Madry, A Makelov, L Schmidt, D Tsipras, and A Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018.
A Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. Sparsefool: few pixels make big difference. In Conference computer vision and pattern recognition (CVPR), 2019.
Seysd-Mohsen Moosavi-Dezfooll Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Conference on computer vision and pattern recognition (CVPR), 2016.
Maura Pintor, Fabio Roli, Wieland Brendel, and Battista Biggio. Fast minimum-norm adversarial attacks through adaptive norm constraints. In Advances in Neural Information Processing Systems (NeurIPS), pp. 20052-2000 20062, 2021.
Joaquin Cuunel,ro-Candela,
Candela, Masashi Sugiyama, Anton Schwaighofer, and Neil D. Lawrence. Dataset Shift in Machine Learning. The MIT Press, 12 2008.
K. Rose, E. Gurewitz, and G. Fox. Vector quantization by deterministic annealing. IEEE Transactions on Information Theory, 3844)12249-125) 1992.
Kenneth Rose. Deterministic annealing for clustering, compression, classification, regression, and related optimization problems. Proc. IEEE, 86(11):2210 2239, 1998.
Christian Szegedy, Wojciech Zaremba, 1lya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014.
Antonio Torralba and Alexci A. Efros. Unbiased look at dataset bias. In CVPR 2011, pp. 1521-1528, 2011.
Vladimir Vapník. Principles of risk minimization for learning theory. Tn John F. Moody, Stephen Jose Hanson, and Richard Lippmann (eds.), Advances in Neural Information Processing Systems [NIPS Conference, Deaver, Colorado, USA, December 2-5, 1991). pp. 831 838. Morgan Kaufmann, 1991.
Jindong Wang, Cuiling Lan, Chang Liu, Yidong Ouyang, Tao Qin, Wang Lu, Yiqiang Chen, Wenjun Zeng, and Philip S. Yu. Generalizing unseen domains: A survey on domain generalization. JEEE Transactions on Knowledge and Data Engineering, 35(8):8052-0077 2023a. doi: 10.1109/ 21100/KKDF.202233188222
Yang Wang, Bo Dong, Ke Xu, Haiyin Piao, Yufei Ding, Baocai Yin, and Xin Yang. A geometrical approach evaluate the adversarial robustness of deep neural networks. ACM Trans. Multim. Comput. Commun. Appl., 19:5::172:1 172:17, 2023b.
Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In International Conference Machine Learning, ICML, volume 202 of Proceedings of Machine Learning Research, pp. 36246 36263. PMLR, 2023c.
Viktor Wegmayr and Joachim M. Buhmann. Entrack: Probabilistic spherical regression with entropy regu- larization for fiber tractography. Inl. J. Comput. Vis., 129(3):656 160.666666666-- 2021.
21

---

Published in Transactions on Machine Learning Research (10/2025)
Tsui-Wei Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsich, and Luca Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. In International Conference on Learning Representations, ICLR, 2018.
Olivia Wiles, Sven Gowal, Florian Stimberg, Sylvestre-Alvise Rebuffi, Tra Ktena, Krishnamurthy Dj Dvi- jotham, and Ali Taylan Cemgil. A fino-grained analysis distribution shift. In International Conference on Learning Represenlations, 2022.
David H. Wolpert and William G. Macready. No free lunch theorems for optimization. IEEE Transactions on Bvolutionary Compulation, ((1):67-8)) -2,77822-77 1997.
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020.
Huaxiu Yao, Yu Wang, Sai Li, Linjun Zhang, Weixin Liang, James Zou, and Chelsea Finn. Improving out- of-distribution robustness via selective augmentation. In International Conference on Machine Learning, pp. 25407 25437. PMLR, 2022.
Samuel Yu, Peter Wu, Paul Pu Liang, Ruslan Salakhutdinov, and Louis-Philippe Morency. Pacs: A dataset for physical andiovisual commonsense reasoning. In European Conference Compuler Vision, 2022.
Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 2019.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Brilish Machine Vision Conference. BMVA Press, 2016.
Yang Zheng, Luca Demetrio, Antonio Emanuele Cinà, Xiaoyi Feng, Zhaoqiang Xia, Xiaoyue Jiang, Ambra Demontis, Battista Biggio, and Fabio Roli. Hardening rgb-d object recognition systems against adversarial patch attacks. Inf. Sci., 651:119701, 2023.
22

---

Published in Transactions on Machine Learning Research (10/2025)
A Proofs of theorems
A.1 Proof of Theorem 1
We first require the following lemmn. For ease of reading, we slightly abuse the notation and consider to be mapping from the object indices instead of the measurements F2, that is e: {I....,,N} {l..... K}. Lemma Let N, K E N and let {Ei lis N, i K} be an indered set of volues. Then,
EII E,00 cmc
III Eg
(15)
Proof. By induction on N. For the N base case, observe that has only K elements, as there are only functions mapping {1} to (l,...,Ak K}. Then
EI CEC KN
Eld( = EE = Σ = II Eg.-
(16)
CEC
JSK
RENJSK
Assume now that the result holds for some N. We demonstrate then that also holds for N + 1. Observe that there is bijection between C and (1...., K)N. Therefore, identify every function E C with the tuple ((N)). Conversely, we identify every tuple CN) E (1.....K with the function that maps i to Cc.
Σ II CEC iSN+1
E,e(()
Σ
II
&
(N4)))) K) M+1 igN+1
Σ
II
&
(c (EE(L eNtISK
KJN iSN+1
Σ
Σ
II
E,
(C) (C KJN WHISKiNNH (I,,.)
Σ
Σ
EN+Lo((+1) II
Eie
(e)))N)) KYN eN+ISK
ISN
Σ EN4LANNH))
E
II Es,o
CNIISK
(N JE KI..,,N ISN
EN4LONNH CNIISK
Σ
Σ E iSNJSK
II
Σ EN+1J
II EL,
jSK
ISNJSK
II
Eij. E
(17)
KSN+1JKK
We ready to prove the theorem
23

---

Published in Transactions on Machine Learning Research (10/2025)
Theorem
pCc x) I p(c(2;) X),
(18)
where
exp (fi))
p(k x) = Σラ e (x:))
(19)
is the probability that x; is assigned class k.
Proof. The Gibbs distribution
exp CiSN (xi)
p(c x))
(20)
Evec exp (BEis (23)
The numerator can be rewritten as follows:
exp
3 Σ Fates(te)
II SS
exp (zi))
(21)
iSN
We now apply Lemma !
ΣI exp (5Faz)(za))
II Σ exp (3F)(I:)) KEN
(22)
REC IS
Putting these results together yields that
p 0, = H exp (BF ((Fo) (2:4)
(23)
IIsN EnsK exp F3 (xx))
exp (3Fe(z,) (x:)
II
(24)
ΣnSK exp (3FF (x:))
p(c(x;) X).
(25)
0
A.2 Proof of Theorem 2
Theorem 2 With no prior information available, the empirical posterior agreement kernel k(X', Xx), can be rewritlen os:
N K
puli X )'sp x3)
1(X', = llog
|C
I1
(26)
j=
Proof.
p(c
X')p(c X*)
k(X', (() = log
Σ SEC
x(c)
N
= log
|C|
II pi(c(xx) X') II
pi(e(zs)) xx*)
i=1 t=1
E=1
N
= log
|e]
pi pa(c(z)) X')p:(((as) x")
eEC i=1
K
pelk X')p:(k ( 1x))
log
CC|
(27)
==
24

---

Published in Transactions on Machine Learning Research (10/2025)
The last step is obtained by applying Lemma
A.3 Proof of Theorem 3
Theorem 3 Under no prior information available, the following properties hold for the empirical posterior
agreement kernel:
Boundedness:
0 PA(X', S log K.
2. Symmetry: PA(X', PA(X",X').
Concuvily: PA(X', X") conouve function 3 < +00.
Proof.
Property (Boundedness) When all predictions match, + too and posteriors converge to Kro-
necker deltas centred at their respective MAPs, Vi and V. coinciding for each i == 1, I.....N:
N:
N I
N
PA(X"X";BB3 log
|C|
o50;000 6000
log |c| |0 i=1
1 N
[Ig((IC) + Σ 1og(1)
i=1
==1
Log((CI)
log(K~)
(o)(K).
N
N
When none of the predictions matches, 8 and posteriors converge to uniform distribution:
N
K
log PA(X', x*)
1
I
log
|C]
1
[og([C)) + Σ log log(K-")
N
K
K
N
K
N
log((CI)
log(K) K) log( K) log( K) O.
N
Property (Symmetry) Trivial, as it follows from the commutativity of the product.
Property (Concavity)
First, note that
N IM j=
log [
A: (XX, (X'x"*) X")
log
p. (1
(28)
where the posteriors pı(j X), X (X'.") are the Gibbs distributions over classes for each observation
exp(33(j.xx))
pi(j 1X) K
(29)
Ek=1 exp(33((k) zx))
Since the sum of concave functions is concave, we will focus on proving only the concavity of the log term In particular, we will show that
K x xx)
X(3) log
(30)
is convex.
Note that do specify the form of the function, therefore the theorem applied with any function R(),
25

---

Published in Transactions on Machine Learning Research (10/2025)
Let us define x') Sj and exp($S(),z') exp( e/j, with x' X'. Similar notation is used for x" E X". ((3 can be therefore rewritten as
Ej ejee Ex=1& c Ep= Sg)
log First, let us focus on the first term. In particular,
(33 - log
Egey + log
= - + (2))
(31)
p=1
Σ (S + SyDeee
d
(32)
dB
Σx 62
The second derivative
de
K 25=1(8) (S) + Sy Σk= E'e,z
25=1 ( +SDeees
K
(1)
(33)
d32
Σk Cje
Therefore,
2
d² > 0 = a1)
K
K (S5 + 87p(ee
d
Σ
Ejje
E(s) (5)+ Syyeee St)eee
>0
(34)
Using the distributive property of the product over the sum, the expression becomes
(8) + sefeee ΣΣ (S) + (S) $Defffe
(35)
k=11=1
K [S] ST) - (S) + SS + S
(36)
k=1j=1
Let (6)))( = S7) (S) + ) define the difference the cost attributed to reference class and the cost attributed to class k. accumulated over X', X", and Ejt- cfejtec
Overall, the sum be expressed as:
K
K M ( + (3)
K K ΣΣ GZ))(R)) (37)
Σ Σ IiS
+55+55) (8) + SMISS + Sy ΣΣ
Note that Am).n = 0 Gon.on 0. Moreover, (n) = - and Ejt = Exj. Then, the previous term can be rewritten as
K
K
K K
Gon.uay + Guay)n
=
(S) 1
+ (S% + +K) Bunsoon
(38)
k
j=1 k
K
K
K K
=
E5 3 (00 S²) - -S, + + = ΣV
Ezk
2
(18)
(39)
j=1 ki
The last term strictly positive for Σ,2 > 0 ey 0, for j I.... K, which always possible for 3 0. Therefore, the first term is convex.
We proceed equivalently with the second term:
K
K
K k
A² = log
= log
Σ>
(40)
/=1
k=1
k=1
1=1
26

---

Published in Transactions on Machine Learning Research (10/2025)
d
K 1=
-==1 (8} + SWee
k
A2(33
(41)
d5
Σ Σ c
dB2 \o(0)
d
Lk=1
K
K 1= (S) + Siec
Σ Ej= (S) + +DDe4 2
>0
(42)
Σ Ej=ehe 64
E E Cj
2
K K
K K
K K
Eje%
Σ
SS) ( S
Σ
( + S
>
(43)
k=1==1
K K k K
S + Sp - + S Spde
(44)
K
(S) St)feeee)) + + - (S S[ > 0
(45)
Similarly, as we did before, we define e e.ee = ( = E(a)).i0)) = ((i)).0)) = ()) and (G)) =
(S} S2) + (S% Sg = (ig)) Then,
de
K K K ΣΣΣΣ G(R))
K K K ΣΣΣ k=1ş=
d3B 22
(8/ + B0)
(46)
Therefore,
K KKKK K
ΣΣΣΣ
G(R)).6)) + G(8)).G))
(47)
K
ΣΣΣ Σ
+ F()))) + (S)+ + S ((60).00))
(48)
k=lgck j=1
BoM (UN,, 5%) (8) +.]]]
(49)
klgckk==l
K K K K
ΣΣΣΣ (
(50)
The last term is again positive for e' > 0, I,...,K. K. Last, we prove the convexity of A(3):
d ((3) d.22
K ΣΣΣΣ
Σ Σ P'=
(51)
k=1qckj=l
By reindexing k' j j and jr i it is clear that the second sum is contained in the first one, thus the negative terms nullify, and the derivative is positive. Proving that X(3) is absolutely convex in R+.
Note that concavity is assured for positive 3 and on the limit 3 + the curvature is not defined, so it is advisable to start numerical optimization procedure at value 8n = o since
lim p-0 d33 F(3) 0.
(52)
27

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS
Engstrom et al.
Wong et al.
Addepalli et al.
Wang et al.
PGD, AR 1.0, f, 8255
PGD, 1.0. 16/ 253
1.0
Tredictive confidance
Predictire confidlence
0.6
0.6
0.4
0.4
0.2
0.2
PGD, AR 1.0, L. 32/255
1.0
Predictive con.idennce
0.8
0.0
FMN AR - 0.5
FMN, 1.0
1.0
1.0
Predictive confidenoe
0.8
8.8
0.6
0.6
0.0 Predictive
0.0
Figure 9: Adversarial setting: predictive confidence distribution for all tested models.
B Extended Results
we report the predictive confidence distribution for all the tested models in the adversarial setting. Again, it can be seen that the robust models lower their average confidence on X", showing that they are effectively detecting an ongoing attack. AAdeealli et al. (2022) presents long-tailed distribution before the attack, favouring more conservative, less confident prodictions, which penalize the detection an allack.
In Figure 9
We include plot of FMN for AR = 1. This case contains attacked images with very high norm (4x 32). The models were not trained to resist such powerful attacks, therefore the average conditional confidence is more variable and all standard errors overlap.
C PA is not accuracy
It may be tempting to use Posterior Agreement to measure model performance instead of accuracy mea- sures. In Figure 10 we show an example of why this is wrong use of PA. In particular, we display the performance of PA and of classification model (DistiBBERT-base) under three different shift strategies: (i) Levenshtein: addition, removal or substitution of characters in the sentence, (ii) Amplification: addition of adjectives reinforcing the sentence's sentiment (iii) Contradiction: addition of adjective weakening the sentence's sentiment. While in cases (i) and (iii) both measures behave similarly, case (ii) the addition of reinforcing adjectives has the effect of increasing the confidence in the model predictions, improving the
28

---

Published in Transactions on Machine Learning Research (10/2025)
x10*
IMDB classification
IMDB classification
1.0
0.8
-0.5
AFRT
0.6
PA
-1.0
0.44
Levenshtein
Levenshtein
-1.5
Amplification
0.2
Amplification
Contradiction
Contradiction
0.0
0
2
3
4
0
3
4 5
6
Shift Power
Shift Power
Figure 10: PA and accuracy for the IMDB sentiment classification task (Maas et al. 2011 under simple attacks. Observations are perturbed by manipulating some characters (Levenshtein) and by replacing some words with positive or negative adjectives that either encourage (Amplification) or discourage (Contradiction) the true sentiment of the review. The shift power is defined as W, being 2 the number of replacements.
overall performance. The sensibility of the method this shift is correctly detected by PA, that penalizes the model decreasing its robustness score. This example again remarks that PA and accuracy are different measures meant to investigate distinct aspects of model.
D Robustness and feature alignment
To better understand the impact of controlled domain shifts on robustness assessment through PA, we used ERM and IRM algorithms to train a ResNet18 model for 50 epochs on Durain using Adam with a learning rate of 10-2 From each validation sample yaal, .=Yal, we selected 128 observations to form reduced validation set Daub (2gut, .zqub] C Daal Both za and zgu share the same random seed 7'al, thus containing the same MNIST samples in the same order, and they differ only by a hue- based distribution shift (blue us red;
cf. Table 2
At the end of each epoch, we compute the principal component (via PCA) the feature representations of wguh and æqub separately. Each MNIST observation Daub thus has two projected values, one for each sample. By examining this principal component (the direction of greatest variance), we can qualitatively evaluate the inductive bias encoded after cach training epoch.
Let te be the feature extractor of classifier after given epoch. Denote by and the principal directions of the feature space for wgth and zuub, respectively. We compute the projections of each observation sub and sub onto these directions: 00n
Zo,n (1b()))))) vol. 21, (oTh))))) vI). n n= 1..... Naub.
The distribution of 20,n and 21,n across different classes indicates how well the inductive bias aligns with task-relevant features: ideally, class membership should drive the principal variance in the feature space. The class-conditional variance of these projections thus gauges the discriminative strength of the modcl's latent features and, in turn, its robustness to sampling variability.
Figure illustrates the principal component projections of the feature space representations of samples 25th uuu for ERM and IRM algorithms at three different training stages. These results show that ERM is unable to encode a representation that is both discriminative and invariant to domain shifts, as it either displays a high cross-domain error or a high class-conditional variance. This indicates that its inductive bias is exclusively driven by domain-spccific features or by class-specific features, and possibly the high learning rate avoids the model converge a more robust solution. In contrast, IRM is able to encode a representation that reduces both qualitative measures at the same time, which indicates that the inductive
29

---

Published in Transactions on Machine Learning Research (10/2025)
IRM, Epoch (3)
IRM, Eooch (2)
IBM Enoch (3)
1.0
Label
1.2
Label
1.0
Label
Ervrrnmment
0.5
Envtronmentt
0.5
Environment
0.5
0.0
0.0
0.0
-0.5
-0.3
-0.5
-1.00
-1.0
-1.0)
1.00
-0.5
0.0
0.5
1.0
1.0
0.5
0.0
0.5
1.0
-1.0
-0.5
0.0
0.5
1.0
PC Rnvironment
PC Environment
PC Enviroument
Epoch (1)
ERM, Epoch (2)
ERM, Epoch
Label Label
PC Cnveronment
Endrronment
Label
Environmmnt
0.0
-0.5
PC Environment
PC Environment
Environmen
Figure 11: Normalized principal component for each environment at three different training stages. ERM (top) and IRM (bottom) algorithms are considered, and projections are colored by class membership. ERM projections display either a high cross-lomain error high class-conditional variance. In contrast, IRM is able to encode representation that reduces both measures at the same time, thus indicating more robust inductive bias.
bias is able to capture the most predictive features for the task at hand without being significantly influenced by the shift in the huc factor.
These measures have been shown to qualitatively assess the suitability of the inductive bias for the afore- mentioned sources of randomness separately.
E Details on the DiagViB-6 Dataset
The DiagViB-6 dataset comprises both source domains (S (Xo, x1)) and target domains (T X3, X4, Here, X, represents the random variable corresponding to domain j, where j indi- cates the number of shifted factors relative to Xo- The classification task focuses on predicting the shape factor (the digit) using handwritten 4s and 9s from MNIST. We systematically control the covoriate shift by varying visual attributes (e.g., color/huc) while keeping class identities intact.
Data Splits and Notation different random instantiations TO Ti train -val, and 7 rrest, We thus define:
For each domain Xj, we generate four disjoint subsets of MNIST by applying
train
Derain
{ag fairain , ..frann), where 2y I. train for j 0, 1.
Dval {ayal, 2T=1), ), where xy := I val, for j 0, 1.
D(i) (atest) J, where a/est := plstt for ......5.
In this way, the training data is subject to both sampling randomness (r # rrrain) and domain shift (Xo o X1), while the validation and lest splits each use single instantiation, ensuring that distribution shift (i.e., changes in hue or other visual attributes) is the only significant source of randomness across X' and X" Overall, we create two sets of 40 000 images for training, two sets 20000 images for validation, and six sets of 10000 images for lesting.
Controlled Covariate Shift By design, each shift factor introduced in domain X, modifies specific image features (e.g., color channels, texture patterns) while preserving the underlying digit shape. Because each domain relies on the same MNIST base classes (4s and 9s), domain shift can be precisely engineered to test
30

---

Published in Transactions on Machine Learning Research (10/2025)
X Training, Validation
Test
ZGO
1-CGO
2-CGO
3-CGO
ZSO
X
O
Ff
X
X
Predicted Fr
X
X
X
X
FF
Predicted
Predicted
Predicted
Predicted
X
FR
O
X O
Ff
X
X
Ff
X
X
O
X
X
O
FJ F Learned
FR
F
FM F
F Fm
F}
Fh
FA
F}
F
Fl
Learned
Learned FL
Learned
Learned
Figure 12: Representation of the co-occurrence pattern in between learning factors F and predicted factors
pP for the ZGO, CGO and 7SO settings that will be considered in this experiment.
# Shift Factors
1
2
5
Hue
red
blue
blue bright
blue bright
blue bright
blue bright
Lightness
dark dark
Position
CC
CC
CC
LC
LC
LC
Scale
normal
normal
normal blank
normal blank
large blank
large
Texture
blank
blank
tiles
Shape
4.9
4.9
4,9
4.9
4.9
4.9
Table 2: Specific image factors associated with each enviromment considered in the model discriminability experiments. CC and LC account for centered center and centered low, respectively.
model's robustness. Hence, the DiagViB-6 setup allows for a clear separation between sampling randomness and shifl-induced variability:
Sampling randomness: Different subsets of MNIST (different seeds) across training, validation, and test.
Domain shift: Controlled variations (e.g., hue) systematically applied to form X1,..., Xs from Xo-
Rationale for DiagViB-6 This setup maximizes the potential for learning invariant features by exposing models progressively more challenging shifts during training. It also provides strong volidation and testing conditions evaluate how well the learned representations generalize to new shifts. Because the same underlying digit classes are maintained across domains, the impact of domain shift on classification can be directly attributed to feature manipulation (e.g., hue, stroke thickness), rather than confounded by changes in class identity. This approach follows the methodology outlined in Geirhos et al. (020 where controlling image factors enables a clearer view of the shortcut learning phenomena.
DiagViBas for Model Discriminability To adjust Diag specific parameters of our multiple environments, we have defined the values described in Table the shift factor settings for each environment. An example of training, validation, and test samples subject to different distribution shifts is depicted in
Figure 13
Diag for Model Selection To evaluate model selection under domain generalization, we examined the impact of hue shift as the primary source of inductive bias. Since hue represents a significant variation in image representation, this experiment provides insight into the consistency of model selection criteria. For this experiment, two different sampling instantiations for the validation datasets are considered, de- val correspond to different instantiations of the hue shift factor. The training and validation dataset configurations are detailed in Table 2 Similarly to the model discriminability experiment, training datascts are always drawn from source domains and consist of samples Durain {agrain .2trann, Validation datasets can be drawn from either source or target domains, leading different generalization scenarios.
noted as r r|all This means that (0)) and ((1)
31

---

Published in Transactions on Machine Learning Research (10/2025)
4
Train
Validation
Test (0 5)
Figure 13: Samples from the training, validation and test datasets. Training samples belong to different
MNIST subsets, whereas validation and lest. samples are the Iransformations of the same observation.
Env.
Hue
Lightness
Position
Scale
Texture
Shape
0
red dark
CC
large
blank
1,4,7,9
Training
blue dark
CC
large
blank
1,4,7,9
Validation
red dark
CC
large
blank
1,4,7,9
SD
red dark
CC
large
blank
1,4,7,9
ID
blue dark
CC
large
blank
1,4,7,9
IF-MD
magenta dark
CC
large
blank
1,4,7,9
5F-MD
green
bright
UL
small
tiles
1,4,7,9
yellow
dark
CC
large
blank
1,4, 7,9
Validation OOD
magenta
dark
CC
large
blank
1,4,
Table Image factors associated with each of the environments considered in the model selection experiment. CC and UL account for 'centered center' and 'upper left', respectively.
First, when both D (0) and ((!) val are drawn from source domains, two configurations are considered. If validation samples originate from the same distribution as training, they are in the same distribution (SD) setting. If they come from source domains but with different huc instantiations than the training data, they are in the in-distributton (ID) setting. Second, when ( is drawn from source domains and D from target domains, the mized distribution (MD) setting applies. Depending on the magnitude of the hue shift, we define two cases: a 1-factor mixed distribution (1F-MD), where only huc varies, and a 5-factor mixed distribution (5F-MD), where huc is combined with additional variations. Finally, when both D and ((1) are drawn from target domains, the setup corresponds to the uut-of-distribute (OOD) setting, where validation samples differ entirely from training.
This selup ensures that models are systematically lested under increasing levels of domain shift, from mild (LD, 1F-MD) to severe (5F-MD, OOD). By doing so, we assess the robustness of model selection criteria when generalizing to unscen huc shifts. For more details on the final datasct configuration, please refer to Table
F
Autoattack results
In order to test our measure on more realistic benchmarks, we include analysis of PA vs AFR7 using the well-known AutoAttack library CCroe & Hein 2020b).
F.1
CIFAR10
We test the previous models on the CIFAR-10 dataset under three attacks: APGD-CE & DLR (Croce &
Hein 2020b) and FAB Croce & Hein (2020a) all with fo f/255, & E 8,, 16, 32]. These attacks are significantly more effective than PGD and FMN, therefore, we are able to score robustness the complete
100% AFRT range.
In Figure 14 16 we can see the results for the attacks. The trends of the models are similar the ones presented in the main paper, with AFRr failing to single out the undefended model. On the contrary, in the
32

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS - Engstrom et al.
Wong et al.
Addepalli et al.
Wang et al.
x10'
APGD-CE, 2/2
APGD-CE. 2/255
0.2
0.0
3 5
6
0
Adversarial Ratio
Adversartal Ratio
0.0
X10'
APGD-CE, t.- 255
1.0
APGD-CE, 255
0.5
0.0
45
-1.0
0.0
-.8
0.4
2.0
0.2
0.0
62 3 3
5² 5² - 0 0
Adversatial Ratio
Adversarial Ratio
0.0
X10'
APGD-CE, 1, 8/255
1.0
APGD-CE, 1, 255
0.5
-10
-1.5
2.0
0
Adversaraa Ratio
Adversarial Ratio
x10*
APGD-CE, 255
APGD-CE. 16 255
0.8
0.6
4.44
0.2
0.0
Adversarial Ratio
Adversarial Ratio
0.0
"10"
APGD-CE, 1, = 225
1.0
APGD-CE, 1, = 32 255
0.5
0.8
-1.0-
APRs
8
-1.5
0.4
2.0-
Adversarial Ratio
Adversarial Ratio
Figure 14: PA (left) and AFRr (right) scores against increasing AR and lxc, for the APGD-CE attack of the Autoattack library.
APGD family, PA scores its minimum already with AR < 1. Another notable phenomenon is represented by Addcpalli et al. (2022) model, which is scored as the best or socond-best model according to PA. In AFRr, this happens only in the presence of large AR and for values, due the faster worsening of the other models. This highlights once again the risk of inconsistency in the robustness evaluation when using AFRr;
33

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS - Engstrom et al.
Wong et al.
Addepalli et al.
Wang et al.
x10'
APGD-DLR f, 2/5
APGD-DLR. L, 2/255
0.2
0.0
3 39
6 6
0
Adversarial Ratio
Adversarial Ratio
0.0
X10'
APGD-DLR, 1.- 2/5
1.0
APGD-DLR. J. 4/255
0.8
0.0
45
-1.0
0.0
-18
0.4
2.0
0.2
0.0
62 3 3
5² 52 - 00 0
Adversarial Ratio
Adversarial Ratio
0.0
X10'
APGD-DLR f, 855
1.0
APGD-DLR. 1, 8/255
0.5
-10
-1.5
2.0
0
Adversaraa Ratio
Adversarial Ratio
K10*
APGD-DLR 16//55
APGD-DLR 165255
0.8
0.6
4.44
0.2
0.0
Adversarial Ratio
Adversarial Ratio
"10" APGD-DLR f. 32 /255
APGD-DLR, f. = 32 /25
0.0
1.0
0.5
0.8
-1.0-
APRs
8
-15
0.4
2.0-
Adversarial Ratio
Adversarial Ratio
Figure 15: PA (left) and AFR2 (right) scores against increasing AR and lxo, for the APGD-DLR attack of the Autoattack library.
while PA maintains an overall stable ranking across the foo values. As witnessod with PGD and FMN, PA correctly estimates the models' performance and ranks them as AFRT (AR 0) does (this is not easily noticeable in the plots due to the scale used).
34

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS
Engstrom et al.
Wong et al.
Addepalli et al.
Wang et al.
FAB. 255
FAB. f. 2/255
-22
0.0
3
3
0.0
0
Adversarial Ratio
Adversartal Ratio
0.0
x10'
FAB, L. 255
1.0
FAB. f. 425
42
0.0
0.0
4
0.4
4.8
0.2
52 3 5
5² 3 3
Adversarial Ratio
Adversarial Ratio
0.0
X10'
FAB, f. = 855
1.0
FAB. 1, 655
0.5
0.8
-1.0
-12
Adversanaa Ratio
Adversarial Ratio
x100
16/255
42
0.8
0.5
0.6
4
0.44
-1.0-
-12
0.2
0.0
Adversarial Ratio
Adversarial Ratio
0.0 "10"
FAB, 1. 255
1.0
FAB, J, 32/255
0.8
APRS
8
0.8
0.4
-100
Adversarial Ratio
Adversarial Ratio
Figure 16: PA (left) and AFR; (right) scores against increasing AR and Ezo, for the FAB attack of the Autoattack library.
35

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG + RS
Engstrom et al.
Wong et al.
X10
APGD-CE, t. 2/5
APGD-CE, 22555
0.0
-1.0
AFR:
8 3.00
4.0
6 6? 5² 3
Adversarial Ratio
Adversarial Ratio
APGD-CE, 1, 4/255
APGD-CE, 4/2
0.0
0.4
4.0
4.0-
0
0 0
Adversanial Ratio
Adversarial Ratio
x100
APGD-CE, 8/255
APGD-CE 81255
2.0
AIR
0.4
0.0
Adversarial Ratio
Adversarial Ratio
Figure 17: PA (left) and AFRT (right) scores against increasing AR and loc, for the APGD-CE attack of the Autoattack library.
F.2 ImageNet
We select four of the fastest models and test them the ImageNet dataset. Following (Croce & Hein 2020b), we use the APGD-CE & APGD-DLRT, an approximated, faster version of APGD-DLR for large datasets. We test with &o = f/255, E (2.
In Figure I7 we report the results. We obtain similar results to those in the previous case, with PA discriminating the weak models from the robust ones. In this case, JPEG+RS defense only resisting the attack at higher power, and behaves as undefended for lower ones. This may be due the different confi- dence in the outputs, which the efficiency of the method depends. Otherwise, PA provides robustness assessment that aligns with AFRT at high AR values, showcasing its increased discriminability.
36

---

Published in Transactions on Machine Learning Research (10/2025)
Undefended
JPEG RS
Engstrom al.
Wong al.
APGD-DLR", 255
APGD-DLR', 255
2.0
0.8
3.0
0.4
0.2
Adversarial Ratio
Adversarial Ratio
X10'
APGD-DLE 4/5
425
0.0
2.0
0.6
0.2
0.0
3
Adversatial Ratio
Adversarial Ratio
x10'
APGD-DLR", 25
APGD-DLAT 1. 255
0.0
0.8
0.2
4.0
Adversarial Ratio
Adversarial Ratio
Figure 18: PA (left) and AFRT (right) scores against increasing AR. and loo, for the targeted APGD-DLI attack of the Autoattack library.
37


Reviews:
[{"review_id": "ZqMwwMPfYM", "reviewer": "Reviewer_c1ic", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\n1. The metric seems novel; PA provides a theoretically sound robustness evaluation.\n2. The paper is well written.\n3. The paper did the experiments with PA across adversarial and domain generalization contexts, demonstrating its power.\n\nWeakness\n\n1. The experiment is only conducted with CIFAR-10, which is less practical.\n2. It seems like the $\\beta$ is an very important parameter which impacts the results, and it is computational expensive to search for the critical parameter, which makes the PA less practical", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces a robustness evaluation metric named Posterior Agreement (PA), specifically designed to assess the robustness of machine learning models under covariate shifts. The PA measures the consistency in model predictions across perturbed and original datasets. The authors demonstrate theoretically and empirically that PA satisfies essential properties for robustness evaluation, including shift sensitivity and non-increasing.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. More experiments on ImageNet, which is closer to a real-world scenario, would make the paper stronger.\n2. Maybe I missed it, but could the author discuss more about the parameter $\\beta$? specifically from the computational cost point of view?", "broader_impact_concerns": "Not apply", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "OVHbW51TyC", "reviewer": "Reviewer_7tFM", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n* A well-justified novel use for the existing PA-measure.\n* Detailed experiments and a strong analysis of results.\n* Relevant theoretical results about the PA-measure.\n\nWeaknesses:\n\nThere are some major weaknesses in explaining the content sufficiently clearly. The rest are relatively minor issues that can be fixed quite easily.\n\n* Not clear whether PA is a metric in the sense of a metric space. I suggest to either demonstrate it by proving the triangle inequality or emphasize that the term metric is not used in this sense.\n\n* The second property (shift-sensitive) on page 2 is quite vague. I understand that this may be partly intentional, but the vagueness should then be emphasized more clearly. What does it mean that generalization capabilities against covariate shift are the same or not for two models? And what does it mean that the metric is independent of the task performance? After reading the rest of the paper, I still feel that I don't have answers to these questions in the paper. It also seems to me that the paper does not explicitly claim that PA satisfies this Property 2. I suggest to change this property to be more precise, such that it would become possible to mathematically check whether a metric has this property.\n\n* The description of PA in the introduction is not sufficiently understandable. Either make it better understandable or drop some of the text and stay at a more abstract level in the introduction. Currently, the sentence \"The proposed PA metric provides a unique and unified framework for robustness assessment in the covariate shift setting, as it relies on a concept of robustness that does not stem from the nature of the data or the shift but instead from the consistency of the probabilistic response of the model\" is not clear enough. I understand it after reading the whole paper, but it assumes too much from the reader at the early stage of the paper. \n\n* It was not sufficiently clear from the text what the point of Fig. 1 is. I understood the overall sentiment, but not the full details.\n\n* The paragraph starting with \"Following epistemologically ...\" at the bottom of page 3 is not clear enough, and due to this Fig. 2 remained unclear. Perhaps after reading Buhmann 2018 it would become clear, but the paper should be self-contained here. I understand what is meant by the datasets being 'with ideally identical signal, but different noise realizations' but the phrasing should be improved. However, the rest of the paragraph seems to assume that the reader should first read Buhmann 2018. In particular, it is not clear what the dataset X' and X'' are in Fig.2.\n\n* I was expecting the Related Work section to include papers about PA also.\n\n* More explanation should be added near Eq.(2). $F$ has been stated as fixed, and $c$ was defined through $f$ and $F$; hence, it was confusing to see $c$ as an argument of $R$ in Eq.(2), because it should be dependent on $F$. So in some sense, the reader should mentally drop $c=f\\circ F$ before reading Eq.(2). I eventually understood what was meant, but it should be written more clearly.\n\n* I suggest to explain the role of $\\mu$ after (3e) in more detail. Currently, the meaning has to be put together by the reader from formulas and texts near Eq.(8) and Eq.(13a).\n\n* The intuitive meaning of PA has not been sufficiently explained in the context when X' and X'' come from the same source. It has been briefly mentioned in the paragraph starting with \"Following epistemologically\" but this is too early for the reader to connect the dots. It is briefly stated also at the beginning of Section 3.2, but not in sufficient detail. I suggest to state the same explanation more clearly and in more detail somewhere in Section 3.2. \n\n* The second paragraph in Section 4.2 starting with \"In this scenario\", is not clear enough. I didn't understand from this description how exactly the data were generated and what exactly $e_0^1,e_0^2,e_0,\\dots,e_5$ meant. There are more details in the appendix, but the text in the main paper should still be clear, possibly referring to the appendix for some details, e.g. for the numbering of factors.\n\n* The last paragraph of page 10 explains that for AR=0 the resulting beta is caused by particular properties of the Adam optimizer. Does it mean that using a different optimizer could give substantially different results? Perhaps this should be tested experimentally? If not testing other optimizers, then the paper should explicitly state the limitation that the method has been tested only on the Adam optimizer.\n\n* The layout of Fig.7 could be improved by moving the third row of figures to the left, so that PA and AFR would align vertically. Maybe even better would be to have only two columns of figures, so that all different shift ratios for PA and AFR would align vertically, respectively.\n\n* The choice of IRM and LISA was not justified. Why these and not some other methods?\n\n* In my opinion, the claim that \"PA is more suitable than AFR for evaluating robustness\" on page 13 is overly strongly stated. As discussed later, AFR can reveal some details of shift 4 vs 5 which PA is not distinguishing and has a similar PA-value. I would say that PA and AFR provide different information and altogether both are valuable metrics of robustness. \n\n* I didn't understand how exactly PA was used for model selection. What were X' and X'' in this case? Appendix E has more details, but the main paper should provide a sufficient explanation.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes to use Posterior Agreement (PA) as a metric of robustness in scoring multi-class classifiers, applicable both for adversarial robustness and domain shift robustness, but also for model selection. The PA method was developed earlier (Buhmann 2010) but not used before in the context of robustness of multi-class classifiers. The empirical results demonstrate how the method adds more nuance in robustness analysis, compared to the commonly used Attack Failure Rate (AFR) metric.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Addressing all of the above weaknesses is critical for acceptance.", "broader_impact_concerns": "No concerns beyond the basic ethical implications of machine learning research.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "wRY5Z5xoJq", "reviewer": "Reviewer_iaqh", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n- The problem of assessing model robustness under covariate shift is important and interesting.\n- The authors define the properties that a metric should have and identify the limitations of traditional metrics.\n- The proposed PA metric is grounded in information theory and the Maximum Entropy Principle.\n\nWeaknesses\n- The experiments are inadequate. For instance, it only includes two attacks, PGD and FMN, and not the more advanced ones like AutoAttack. There is also only one small dataset of CIFAR-10 in this setting. Therefore, it is not convincing that the proposed metric can accurately reflect the robustness of models in real-world settings.\n- Results in Figure 3 are strange. The undefended model under Adversarial Ratio of 1.0 should have very low AFR, but it is over 80%.\n-  The proposed metric and the traditional metric AFR report similar trends and rankings, except that AFR tends to overestimate the robustness of the undefended model (which is questionable, as stated in my last point). This result makes the proposed metric less useful, because it is not very different from the existing ones.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper studies the problem of evaluating the robustness of machine learning models under covariate shifts, including adversarial shift and out-of-distribution shift. The authors argue that traditional metrics like accuracy-based scores are insufficient for assessing robustness, because the authors claim that the metric should differentiate models only by their generalization capabilities against covariate shift and should be independent of the task performance of the model.\n\nTo overcome this, they introduce a novel metric called Posterior Agreement (PA), grounded in information theory and the Maximum Entropy Principle. The PA metric quantifies the agreement between posterior distributions of model predictions under different data distributions, providing a more nuanced assessment of robustness. The authors validate their approach through experiments in adversarial learning and domain generalization scenarios, demonstrating that PA can effectively identify vulnerabilities in models that traditional metrics might overlook.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Please add more adversarial attack algorithms (e.g., AutoAttack) and perform the experiments on larger datasets like ImageNet.\n- Please explain why the undefended model under Adversarial Ratio of 1.0 has such a high AFR.\n- On CIFAR-10, any attack strength over $l_\\infty$ of 8/255 may be too strong and makes the image unrecognizable to humans (but the AFR under 32 / 255 is still high, which looks weird to me).  Use ImageNet instead can solve this problem.\n- Some notations are not clearly defined. For example, what is R(C, X)?", "broader_impact_concerns": "I do not see any concerns on the ethical implications of this work.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)