Unveiling AI's Blind Spots: An Oracle for In-Domain, Out-of-Domain, and Adversarial Errors

Authors: Shuangpeng Han, Mengmi Zhang
Primary area: other topics in machine learning (i.e., none of the above)
Keywords: Error Prediction, AI reliability, In-domain, Out-of-Domain, Adversarial Attack

Abstract:
AI models make mistakes when recognizing images—whether in-domain, out-of-domain, or adversarial. Predicting these errors is critical for improving system reliability, reducing costly mistakes, and enabling proactive corrections in real-world applications such as healthcare, finance, and autonomous systems. However, understanding what mistakes AI models make, why they occur, and how to predict them remains an open challenge. Here, we conduct comprehensive empirical evaluations using a "mentor" model —a deep neural network designed to predict another model’s errors. Our findings show that the mentor model excels at learning from a mentee's mistakes on adversarial images with small perturbations and generalizes effectively to predict in-domain and out-of-domain errors of the mentee. Additionally, transformer-based mentor models excel at predicting errors across various mentee architectures. Subsequently, we draw insights from these observations and develop an "oracle" mentor model, dubbed SuperMentor, that achieves 78\% accuracy in predicting errors across different error types. Our error prediction framework paves the way for future research on anticipating and correcting AI model behaviours, ultimately increasing trust in AI systems. All code, models, and data will be made publicly available.

Decision: reject
Reviewer scores: 6, 5, 5, 8

Reviews and discussion:
<thread>
creation date:
1730392262327

thread_type:
official_review

<thread_object>
creator: reviewer_nkcr

<content>
summary:
This paper explores the utilization of a “mentor” model to predict the errors of a “mentee” model in a supervised image classification task. The strategy implies training the mentor on the frozen mentee by inputing the image, the mentee’s logits, and the correctness of the mentee in order to extract insight about the mentee’s decision patterns. The mentee’s logits are introduced in a distillation loss to incorporate its behaviour, while the prediction “correctness” (mentee's correctness vs. metor's prediction of mentee correctness) is supervised by a logistic regression loss.
In the experiments two types of architectures are used, ResNet50 and ViT. The latter corresponds to the powerful backbone since it is a transformer architecture based on self-attention mechanisms. Authors differentiate between 3 types of errors: In Domain errors, Out-of-domain errors and Adversarial Attack errors. Experiments are carried on these 3 types of errors to explore which reveals the mentee’s learning patterns better. According to the authors, it is important to remember that the mentor is expected to detect errors, not the source of them.
The experiments are carried over 3 datasets: CIFAR10, CIFAR100 and ImageNet-1K. For ID errors they use 3 different subsets of the original ones; for OOD they use 4 different corruptions for each dataset; and for the AA errors they use 4 different white-box attacks for each dataset.
The results show interesting findings: 

1. **AA errors** offer deeper insights into the mentee’s decision-making process compared to OOD and ID errors.
2. Mentors benefit from having more **complex architectures** than the mentees, particularly transformer-based models.
3. The mentor's performance **degrades with increasing perturbation** in AA examples.
4. Most notably, **mentors generalize across different mentee architectures**, allowing them to predict errors even when mentees change.

As a final contribution, authors propose an “oracle” mentor based on the findings from the experiments. This SuperMentor is trained on AA with small perturbation and its architecture correponds to ViT. An ablation study is performed on this mentor to determine the contribution of the distillation loss and the mentee’s logits on its performance. This SuperMentor is able to correctly separate most of the correct/incorrect points of different mentees over different datasets and sources of errors.

strengths:
- The problem assessed in the paper is an important one. Even though there exist other approaches for selective classification like, for example, Learning to Defer and Rejection Learning, the presented framework allows working with pretrained models and uses convex losses, thus avoiding the use of surrogate losses.
- The experiments are numerous and well chosen. The use of different error sources helps to understand the mentor’s understanding of the mentee. The use of different architectures is also an important one and the conclusion over them is insightful.
- Experimental results are exhaustive, well explained and supported in the text.

weaknesses:
- I miss a bit of mathematical formulation in Section 3. I would like to see the complete loss function somewhere (even though it can be easily understood in the text).

- Since the framework is intended to detect potential errors regardless of their domain, I miss some references on Selective Classification, Rejection Learning [1] and Learning to Defer [2]. 

- The paper would benefit from comparing and discussing supervised and unsupervised strategies to solve the issues dealt by their mentor system. See the next point.

- The authors try to distinguish and characterize three types of errors, but there is conflict in OOD errors and AA. For instance AA are not necessarily mutually exclusive with OOD, moreover trying to describe OOD errors with a set of perturbations on original images is not exhaustive or representative of OOD behaviour. In the literature on OOD detection there is justified skepticism towards using supervised examples of OOD, issue that is completely ignored across the paper and not mentioned as a possible limitation.

[1] Cortes, C., DeSalvo, G., & Mohri, M. (2016). Learning with rejection. In *Algorithmic Learning Theory: 27th International Conference, ALT 2016, Bari, Italy, October 19-21, 2016, Proceedings 27* (pp. 67-82). Springer International Publishing.
[2] Madras, D., Pitassi, T., & Zemel, R. (2018). Predict responsibly: improving fairness and accuracy by learning to defer. *Advances in neural information processing systems*, *31*.

questions:
- Can you elaborate on how does your model respond in multi-class setting in which two classes could be equally likely but the model makes a mistake in choosing the correct label?
- Did authors consider what to do next once the mentor predicts an error? How could the information be used?
- Are there any external baselines to compare against? If so, why aren’t they included?
- How would you tackle the calibration of the mentor’s predictions?
- Considering that the mentor is trained on examples of OOD or AA, there is a chance that the mentor learns to detect these kinds of data but nothing actually related to the mentee. This is similar to the faithfulness issue in explainability, where we might learn plausible explanations that have nothing to do with the method to explain. Could you comment on this point?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730509680822

thread_type:
official_review

<thread_object>
creator: reviewer_k1t1

<content>
summary:
The paper proposes using mentor model to predict the error of AI models (mentee models). It mainly considers image classification task with two architectures, ResNet50 and ViT. The basic idea of the paper is similar to membership inference attack(MIA), which treats the mentor as a binary classifier. The paper conducts decent empirical studies on different setup of data distribution, including in-domain, out-of-domain, and adversarial examples. The paper makes several interesting conclusions, including: 1. adversarial examples with small perturbations are most beneficial to mentor model training. 2. Mentor models can generalize across different mentee models.

strengths:
1. The formulation of the problem is interesting. The paper proposes using an AI model to predict the error of another, which can open new possibility for understanding DNNs.
2. The experiments are decent and comprehensive. The paper conducts experiments on multiple setup of model architecture and data distribution. It also includes experiments like generalizability of the model. In particular, the incorporation of AA data provides interesting insights.
3. The paper is generally well written and easy to follow.

weaknesses:
1. The paper lacks a comprehensive assessment of relationship to previous works. Monitoring errors of AI model seem crucial, but how previous approach attempts to address the problem is not clear (although it is presented in related work). The paper also does not compare its performance to previous methods, nor does it explicitly claim that the it is formalizing a new problem, which makes understanding the position and results of the paper in the area relatively difficult.

2. This is like my main concern -- I am very willing to discuss this further with the authors. It is not clear to me what the possible applications of the method is/what possible insights we could draw from the mentor.  For example, is it possible to give insights on interpretation of the mentee model based on the mentor model?

3. (minor) The accuracy of the mentor model seems not high "enough" -- although it outperforms random guessing by a large amount, it seems not high enough to safely draw more insights independently from it. Again it is related to first point as the position of the paper is unclear.

questions:
1. See Weaknesses, especially weakness 2.

2. In the results section, why is it sometimes possible that mentor model trained on ID data can outperform that trained on OOD data?

3. Is it possible that a mixture of ID, OOD and AA data can achieve better performance? AA data is like outliers for the mentee model, which, in turn, may lack some information of the in-domain distribution that the mentee model holds.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730696380428

thread_type:
official_review

<thread_object>
creator: reviewer_pvlx

<content>
summary:
Focusing on the vulnerability of DNN models regarding the wrongly predicted samples, this work proposes a framework to predict the errors of trained DNNs over (1) in-domain, (2) out-of-domain, and (3) adversarial samples. The framework trains a “mentor” model to minimize the combination of two losses to (i) mimic the mentee’s prediction and (ii) predict the mentee’s correctness.

strengths:
1. This work focuses on an interesting topic of predicting the errors of trained models over in-domain, out-of-domain, and adversarial errors. This is an important task given the vulnerability and nonlinearity of DNNs.
2. The paper is well-written and very easy to follow.
3. Extensive experiments are carried out.

weaknesses:
1. Main concern: The idea of training another DNN model to predict the vulnerability of another DNN model can be risky. The problems that exist in the training process of the mentee may also exist in the training process of the mentor. For example, what if the backbone of the mentor model is already suffering from these problems?
2. The motivations of the two loss terms are contradicting. $L_d$ encourages the mentor to mimic the mentee’s predictions, including wrong ones. However, $L_r$ encourages the mentor to distinguish the wrong predictions from the correct predictions.
3. The out-of-distribution genre studied in this work is very limited. In this work, only synthetic corruptions such as noise, blur, etc. are included, while important natural distribution shifts such as spurious correlations, styles shift, etc. are completely overlooked. This significantly undermines the real-world contribution of the experimental results.
4. It is observed in the experiments that adversarially trained mentor performs better. However, this could be the benefit of adversarial training as it leads to a smoother and more robust model. If the mentee model is already trained in the adversarial way, the testing accuracy under OOD, and AA could already be improved (e.g. [1]).
5. Due to the aforementioned issues, the contributions of this work remain unclear. It is not straightforward how real-world applications can benefit from this framework. The authors may consider elaborating more on the “high-stakes real-world applications” claimed in L539.


[Minor]

1. Figure 1 can be misleading. Since the authors focus only on the synthetic out-of-distribution samples, the “out-of-distribution images” (middle) look like an adversarial image. Furthermore, the “adversarial images” (bottom) show an attacked sample whose raw image differs from the other two images. This can be easily misunderstood as the out-of-distribution sample with a natural distribution shift. It is strongly suggested that the same raw input be used.
2. The specific formulation of the distillation loss $Distill$ should be given.

[Reference]

[1] Kireev, K., Andriushchenko, M., & Flammarion, N. (2022, August). On the effectiveness of adversarial training against common corruptions. In *Uncertainty in Artificial Intelligence* (pp. 1012-1021). PMLR.

questions:
1. Built also by DNNs, the mentor shall suffer the same problems such as the black-box nature, the high nonlinearity, etc. Does this require another mentor’s mentor to predict whether the mentor can correctly predict the mentee’s prediction? How does the author justify this cyclic scenario?
2. If the mentor can be able to predict the correctness of the mentor with higher accuracy than reconstructing the mentee’s prediction accurately, does this mean that the backbone of the mentor is capable of correctly predicting the true classes of those true negative samples (wrongly predicted by the mentee but recognized by the mentor)? The representations learned from the backbone of the mentor should be an interesting direction to explore.
3. The logistic regression loss $L_r$ is for the binary classification of whether the mentee makes the correct classification. This can be a very imbalanced task. How is this affecting the results?
4. In Figure 2, what is the “average accuracy”? Is it the average of the testing accuracy of the mentor with three ID, OOD, and AA?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730711753354

thread_type:
official_review

<thread_object>
creator: reviewer_cqcn

<content>
summary:
The work uses a dedicated neural network to detect 3 classes of error sources
in image classification, including adversarial examples, image distortion, and
in-distribution prediction error. The detection model is analyzed in various
ablation studies, including the effect of the strength of the different error
sources in accuracy, the accuracy under different architectures for both
detector and predictor (ResNet and ViT), and the distillation loss. A t-SNE
embedding is shown for the features of the detector.

strengths:
- The work is well written and clearly presents its contributions.

- The work introduces a novel comparison for detection difficulty between
  different error sources in image classification.

- Various ablation studies are conducted for the proposed model.

weaknesses:
- Novelty: Adversarial Examples are an extremely well researched topic. (see,
  e.g., Yuan et al., 2019) for a survey). Hence, the idea of detecting
  adversarial examples by using a classifier has been done before (see, e.g., Metzen
  et al., 2017). This limits the novel contribution of this work to the
  comparison of the detection of the different error types.

- Contribution: Although the work references other approaches for the detection of
  adversarial attacks and other presented error sources, there is no baseline
  comparison at all. For a significant contribution, it is necessary to compare
  it to previous work which attempts to solve the same issue. The work reports
  some accuracy of up to 83%, yet it is difficult to quantify this without
  analyzing the detection accuracy achieved through other approaches.

- Clarity: The work presents multiple ablation studies to compare how different
  architectures perform under the discussed error sources. While interesting,
  it is not quite clear to me why this is relevant unless compared to other
  baselines. I also did not understand how the t-SNE embeddings support the
  claim that the proposed neural network-based detector is a good idea.

In total, this work requires a more thorough literature search concerning
different approaches to errors in image classification. It is very difficult to
justify a method when it is not compared to previous work.


References:

X. Yuan, P. He, Q. Zhu and X. Li, "Adversarial Examples: Attacks and Defenses
for Deep Learning," in IEEE Transactions on Neural Networks and Learning
Systems, vol. 30, no. 9, pp. 2805-2824, Sept. 2019.

Metzen, J. H., Genewein, T., Fischer, V., & Bischoff, B. . "On
Detecting Adversarial Perturbations". ICLR 2017.

questions:
- Did you compare your approach to other baselines to detect model error?

- How does your approach differ from (Metzen et al., 2017), except for the different error types?

- What purpose do the t-SNE embeddings serve?
</content>
</thread_object>

</thread>
<thread>
creation date:
1732375457976

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Common.1: Performance comparison of mentor baselines and our SuperMentor (Part 1)

comment:
To the best of our knowledge, our study is the first to use one AI model to predict the correctness of another AI model’s predictions. Due to the lack of existing AI model baselines, we have introduced three baseline approaches based on the mentee’s confidence (Confidence), the entropy of the mentee’s logits (Entropy), and the L2 distance between the mentee’s features and the class feature centroids (Distance to Class Centroids), respectively. The details of these three baseline methods are provided below.

1) Confidence: As mentioned in Sec. 3.1, the mentee’s output logit is denoted as $z_E$. The confidence of the mentee’s output is defined as $Confidence(z_E) = \max\sigma(z_E))$ where $\sigma(\cdot)$ is the softmax function. The confidence indicates how confident the mentee is in its most probable prediction.  We set a threshold $\gamma$ to distinguish between the mentee's confident and unconfident predictions. Specifically, if $Confidence(z_E) > \gamma$, the mentee’s prediction will be considered a correct prediction due to its high confidence; otherwise, it will be regarded as an incorrect prediction. We employ three predefined thresholds for $\gamma$: 0.5, 0.7, and 0.9. 

2) Entropy: The entropy of the mentee’s output is defined as $Entropy(z_E) = H(\sigma(z_E))$, where $\sigma(\cdot)$ denotes the softmax function and $H(\cdot)$ represents the entropy measure quantifying the uncertainty in the probability distribution. A high entropy value signifies a high level of uncertainty in the mentee’s predictions. The entropy reaches its maximum value, $MaxEntropy(z_E)$, when the mentee’s class probabilities in $\sigma(z_E)$ are equal. We define the uncertainty threshold as $\alpha \cdot MaxEntropy(z_E)$, where $\alpha \in [0,1]$. If $Entropy(z_E) < \alpha \cdot MaxEntropy(z_E)$, the mentee’s prediction is considered correct, indicating sufficient certainty in its prediction. Otherwise, the prediction is regarded as incorrect. We set three predefined values for $\alpha$: 0.01, 0.1 and 0.3.

3) Distance to Class Centroid: The embedding generated by the mentee before the final binary classification layer represents the mentee’s feature interpretation of each sample. To determine the feature centroid for each class, we first average the features of all testing samples within that class based on the mentee's predictions. Next, we calculate the L2 distance between each sample’s feature and its corresponding class centroid, denoted as $d_s$. We establish a distance threshold $d$; if $d_s < d$, the mentee’s prediction is considered correct since the sample is close to the class centroid. Otherwise, the prediction is deemed incorrect. We have set three predefined values for $d$: 10, 20, and 30.

The experimental results for the three baseline methods applied to ResNet50 and ViT mentees are shown in Tab. R1 and Tab. R2, respectively. Our SuperMentor consistently achieves better average accuracies over all error types compared to all baselines. Notably, in the AA scenarios, SuperMentor has significantly higher accuracy than the baselines. For example, SuperMentor achieves an 80.2% prediction accuracy for the correctness of ViT mentee performance on data generated by PGD attack, whereas the best baseline only reaches 63.9%. This implies that the error prediction of AI mentees is complex and it requires more than manually defined criteria such as confidence or entropy. 

Additionally, all these baselines have the drawback of requiring predefined values or thresholds, which are not adaptive and are difficult to select for different OOD and AA scenarios. In contrast, our SuperMentor does not have these limitations. Therefore, using AI models for error predictions is more feasible and does not require hand-crafted features.

We will add these new experiments in the final version.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732375578103

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Common.1: Performance comparison of mentor baselines and our SuperMentor (Part 2)

comment:
**Table R1: Performance comparison of mentor baselines and our SuperMentor trained on various types of errors from the ImageNet dataset. The ResNet50 model serves as the mentee, with its correctness of predictions evaluated by mentors. The three types of baselines are based on the mentee’s confidence, the entropy of the mentee’s logits, and the L2 distance between the mentee’s features and the centroids of the class features respectively. Best results are in bold.**

|  | ID | SpN | GaB | Spat | Sat | PGD | CW | Jitter | PIFGSM | **Average** |
|---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
| Confidence Threshold  $\gamma = 0.5$  | 69.5 | 73.5 | 73.6 | 72.2 | 71.7 | 66.0 | 66.7 | 65.1 | 64.9 | 69.2 |
| Confidence Threshold  $\gamma = 0.7$  | 77.3 | **76.8** | **77.4** | **78.3** | **76.6** | 71.8 | 72.9 | 71.7 | 69.4 | 74.7 |
| Confidence Threshold  $\gamma = 0.9$  | 78.2 | 73.3 | 74.5 | 77.0 | 74.9 | 72.2 | 72.3 | 73.0 | 69.0 | 73.8 |
| Entropy Coefficient $\alpha = 0.01$ | 69.1 | 62.1 | 63.4 | 66.0 | 64.0 | 63.7 | 62.6 | 65.1 | 60.7 | 64.1 |
| Entropy Coefficient $\alpha = 0.1$ | 78.0 | 75.2 | 75.9 | 78.0 | 76.2 | 72.2 | 72.8 | 72.7 | 69.3 | 74.5 |
| Entropy Coefficient $\alpha = 0.3$ | 64.0 | 70.1 | 69.6 | 67.6 | 67.0 | 61.2 | 61.5 | 60.6 | 60.8 | 64.7 |
| Distance Threshold $d = 10$ | 50.1 | 50.2 | 50.0 | 50.5 | 50.5 | 50.2 | 50.1 | 50.0 | 50.2 | 50.2 |
| Distance Threshold $d = 20$ | 46.0 | 45.4 | 44.3 | 47.9 | 46.2 | 50.1 | 48.4 | 46.3 | 47.3 | 46.9 |
| Distance Threshold $d = 30$ | 48.8 | 49.3 | 49.7 | 49.3 | 49.5 | 49.5 | 49.4 | 49.6 | 49.6 | 49.4 |
| SuperMentor (Ours) | **78.9** | 73.6 | 74.6 | 78.3 | 73.6 | **83.0** | **78.4** | **79.9** | **72.3** | **77.0** |

**Table R2: Performance comparison of mentor baselines and our SuperMentor trained on various types of errors from the ImageNet dataset. The ViT model serves as the mentee, with its correctness of predictions evaluated by mentors. The three types of baselines are based on the mentee’s confidence, the entropy of the mentee’s logits, and the L2 distance between the mentee’s features and the centroids of the class features respectively. Best results in bold.**

|  | ID | SpN | GaB | Spat | Sat | PGD | CW | Jitter | PIFGSM | **Average** |
|---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
| Confidence Threshold  $\gamma = 0.5$  | 69.9 | 72.9 | 71.5 | 71.5 | 71.8 | 60.5 | 63.6 | 56.6 | 60.7 | 66.6 |
| Confidence Threshold  $\gamma = 0.7$  | **78.5** |**77.9** | **78.0** | **78.2** | **78.0** | 63.9 | 67.8 | 61.5 | 63.8 | 71.9 |
| Confidence Threshold  $\gamma = 0.9$  | 58.0 | 53.3 | 57.2 | 55.5 | 57.6 | 50.6 | 51.6 | 50.9 | 49.2 | 53.8 |
| Entropy Coefficient $\alpha = 0.01$ | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 |
| Entropy Coefficient $\alpha = 0.1$ | 51.4 | 50.7 | 51.2 | 51.1 | 51.5 | 49.6 | 50.1 | 49.6 | 49.1 | 50.5 |
| Entropy Coefficient $\alpha = 0.3$ | 72.4 | 73.7 | 73.5 | 72.7 | 73.5 | 61.3 | 63.7 | 57.0 | 60.2 | 67.5 |
| Distance Threshold $d = 10$ | 52.6 | 52.0 | 51.7 | 54.6 | 52.1 | 52.7 | 52.4 | 52.1 | 53.7 | 52.6 |
| Distance Threshold $d = 20$ | 55.6 | 59.1 | 52.8 | 54.6 | 53.2 | 54.8 | 53.1 | 51.3 | 53.4 | 54.2 |
| Distance Threshold $d = 30$ | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 | 50.0 |
| SuperMentor (Ours) | 72.7 | 71.3 | 71.7 | 73.0 | 70.2 | **80.2** | **74.1** | **72.9** | **74.1** | **73.3** |
</content>
</thread_object>

</thread>
<thread>
creation date:
1732376570729

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Common.2: SuperMentor performance on additional OOD domains on ImageNet dataset

comment:
We included experiments to evaluate the SuperMentor in more diversified OOD domains on ImageNet datasets, including ImageNet9-MIXED-RAND (IN9-MR) [a],  ImageNet9-MIXED-SAME (IN9-MS) [a],  ImageNet9-MIXED-NEXT (IN9-MN) [a], ImageNet-R (IN-R) [b] and ImageNet-Sketch (IN-S) [c]. Specifically, the MIXED-RAND, MIXED-SAME, and MIXED-NEXT datasets are derived from 9 classes in ImageNet and contain varying amounts of background and foreground signals. These datasets aim to demonstrate that models often classify objects based on background cues (often spurious features), rather than the objects themselves. Specifically, MIXED-SAME, MIXED-RAND, and MIXED-NEXT represent images with random backgrounds from the same class, random backgrounds from a random class, and random backgrounds from the next class, respectively. The ImageNet-R dataset comprises images featuring artistic representations of objects, such as cartoons, community-generated art, and graffiti renditions. The ImageNet-Sketch dataset consists of sketch-like images that match the ImageNet validation set in both categories and scale. 

The experimental results are shown in Tab. R3. It is worth noting that the SuperMentor learns from the mentee's errors on adversarial ImageNet images generated by the PIFGSM attack only. In other words, the SuperMentor was **NOT** trained on any of these additional ImageNet-related OOD datasets. Yet, the SuperMentor achieves prediction accuracy above the 50% chance level. Despite that our Supermentor model is a simple ViT, it is still quite remarkable to achieve above-chance error prediction performance. We hope our work inspires researchers to explore more sophisticated AI mentors, incorporating advanced architectures or loss functions, to further enhance the ability to predict the correctness of another AI model’s outputs. 

We will add these new experiments in the final version.

**Table R3: Performance of SuperMentor on additional ImageNet-related OOD datasets. The abbreviations IN9-MR, IN9-MS, IN9-MN, IN-R, and IN-S stand for ImageNet9-MIXED-RAND [a], ImageNet9-MIXED-SAME [a], ImageNet9-MIXED-NEXT [a], ImageNet-R [b], and ImageNet-Sketch [c], respectively. Results denote the average accuracy with over 3 runs.** 

|             |    IN9-MR    |    IN9-MS    |    IN9-MN    |     IN-R     |     IN-S     |
|:-----------:|:------------:|:------------:|:------------:|:------------:|:------------:|
| Accuracy(%) | 68.46 | 69.24 | 67.04 | 58.68 | 58.68 |
|             |              |              |              |              |              |
</content>
</thread_object>

</thread>
<thread>
creation date:
1732376782214

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Common.3: SuperMentor in real-world practice, such as NCTCRCHE100K dataset

comment:
To reflect the real-world contribution of our work, we expanded our experiments to the NCTCRCHE100K [g] dataset which is used for medical image classification on colorectal cancer. This dataset comprises around 100K images across 9 tissue classes. Predicting AI models’ errors in medical image classification has significant real-world implications, such as reducing misdiagnoses and increasing the reliability of AI-assisted medical tools, underscoring the real-world contribution of our study. The results presented in Tab. R4 demonstrate that the mentor accurately determines the correctness of up to 81.9 % of the mentee’s predictions compared to the chance level of 50%. The highest accuracy is achieved by training the mentor on the mentee's adversarial images generated by PIFGSM, which aligns with the SuperMentor configurations in our study.

As AI models become more integrated into our daily lives, ensuring their correctness is of paramount importance, especially in high-stakes fields such as the medical and finance fields. Our experiments with medical image datasets provide a compelling example of the critical role our work plays in these fields, demonstrating its significant impact on real-world applications. 

We will add these new experiments in the final version.

**Table R4: The average accuracy of mentor models trained on various error sources for the NCTCRCHE100K [g] dataset. The mentor and mentee are ViT and ResNet50 respectively. Results denote the average accuracy over 3 runs.**
|              |      ID     |     SpN    |     GaB     |     Spat    |     Sat     |     PGD     |      CW     |    Jitter   |    PIFGSM   |
|--------------|:-----------:|:----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|
| NCTCRCHE100K | 77.9 | 73.3 | 76.8 | 81.2  | 64.8 | 80.9 | 79.3 | 81.4 | 81.9 |
</content>
</thread_object>

</thread>
<thread>
creation date:
1732376929201

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Reference List

comment:
References:

[a] Xiao, Kai, et al. Noise or signal: The role of image backgrounds in object recognition. arXiv 2020.

[b] Hendrycks, Dan, et al. The many faces of robustness: A critical analysis of out-of-distribution generalization. ICCV 2021.

[c] Wang, Haohan, et al. Learning robust global representations by penalizing local predictive power. NeurIPS 2019.

[d] Cortes, et al. Learning with rejection. ALT 2016.

[e] Madras, et al. Predict responsibly: improving fairness and accuracy by learning to defer. NeurIPS 2018.

[f]  Geifman, et al. Selective classification for deep neural networks. NeurIPS 2017.

[g] Kather, et al. Predicting survival from colorectal cancer histology slides using deep learning: A retrospective multicenter study. PLoS medicine 2019.

[h] Selvaraju, et al. Grad-cam: Visual explanations from deep networks via gradient-based localization. ICCV 2017.

[i] Jumper, et al. Highly accurate protein structure prediction with AlphaFold. Nature 2021.

[j] Alyoubi, et al. Diabetic retinopathy detection through deep learning techniques: A review. Informatics in Medicine Unlocked, 2020.

[k] Corbière et al. Addressing failure prediction by learning model confidence. NuerIPS 2019.

[l] Luo. Learning to predict trustworthiness with steep slope loss.  NuerIPS 2021.

[m] Qiu et al. Detecting misclassification errors in neural networks with a gaussian process model. AAAI 2022.

[n] Jiang et al. To trust or not to trust a classifier. NuerIPS 2018.

[o] Jacob Gildenblat and contributors. Pytorch library for cam methods. https://github.com/jacobgil/pytorch-grad-cam, 2021. 

[p] Mohammed et al. Eigen-cam: Class activation map using principal components. IJCNN, 2020.
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper proposes a supermentor learning framework with the goal to predict mentee models error in three main settings: in-domain error, out-of-domain error and adversarial attack. While the idea of using DNNs as mentor model and the framework is interesting and that the authors did a great job providing additional experiment results (especially comparing with prior baselines, as suggested by multiple reviewers), there are some unresolved concerns on using another AI model to predict the error of an AI model, such as vulnerability of the mentor model. While the authors clarified that the mentor model's behavior is very different from the mentee models due to the distinct training objectives, a more fundamental question/concern still persists on this line of work: why and when do we want to use another model to predict the error of the model of interest, instead of directly evaluating the error of itself? Based on the setup, the mentor model and the mentee model both have the access to the same input data and the authors assume the white-box access to mentee models, the proposed research seem to be a redundant approach to understand the behavior of the model of interest (i.e. mentee models in this framework). The authors are encouraged to further investigate the practical use case of the proposed approach to justify the importance of the work. Therefore, a rejection is recommended.