Original: A Geometric Method for Improved Uncertainty Estimation in Real-time
Revised: A Geometric Method for Improved Uncertainty Estimation in Real-time

Original: Abstract
Revised: Abstract

Original: Machine learning classiﬁers are probabilistic in nature, and thus inevitably involve uncertainty.
Revised: Machine learning classifiers are probabilistic in nature, and thus inevitably involve uncertainty.

Original: Predicting the probability of a speciﬁc input to be correct is called uncertainty (or conﬁdence) estimation and is crucial for risk management.
Revised: Predicting the probability of a specific input to be correct is called uncertainty (or confidence) estimation and is crucial for risk management.

Original: Posthoc model calibrations can improve models’ uncertainty estimations without the need for retraining, and without changing the model.
Revised: Posthoc model calibrations can improve models’ uncertainty estimations without the need for retraining, and without changing the model.

Original: Our work puts forward a geometric-based approach for uncertainty estimation.
Revised: Our work puts forward a geometric-based approach for uncertainty estimation.

Original: Roughly speaking, we use the geometric distance of the current input from the existing training inputs as a signal for estimating uncertainty and then calibrate that signal (instead of the model’s estimation) using standard post-hoc calibration techniques.
Revised: Roughly speaking, we use the geometric distance of the current input from the existing training inputs as a signal for estimating uncertainty and then calibrate that signal (instead of the model’s estimation) using standard post-hoc calibration techniques.

Original: We show that our method yields better uncertainty estimations than recently proposed approaches by extensively evaluating multiple datasets and models.
Revised: We show that our method yields better uncertainty estimations than recently proposed approaches by extensively evaluating multiple datasets and models.

Original: In addition, we also demonstrate the possibility of performing our approach in near real-time applications.
Revised: In addition, we also demonstrate the possibility of performing our approach in near real-time applications.

Original: Our code is available at anonymous-Git.
Revised: Our code is available at our Github [Leman and Chouraqui, 2022].

Original:  INTRODUCTION
Revised:  INTRODUCTION

Original: Machine learning models such as neural networks, random forests and gradient boosted trees are extensively used in domains ranging from computer vision to transportation and are slowly revolutionizing computer science [NiculescuMizil and Caruana, 2006, Zhang and Haghani, 2015].
Revised: Machine learning models such as neural networks, random forests, and gradient boosted trees are extensively used in domains ranging from computer vision to transportation and are slowly revolutionizing computer science [NiculescuMizil and Caruana, 2006, Zhang and Haghani, 2015].

Original: Dealing with uncertainty is a fundamental challenge for all machine learning-based applications.
Revised: Dealing with uncertainty is a fundamental challenge for all machine learning-based applications.

Original: In principle, classiﬁcations are always probabilistic, implying that missclassiﬁcations are inevitable.
Revised: In principle, classifications are always probabilistic, implying that missclassifications are inevitable.

Original: Uncertainty calibration is the process of adapting machine learning models’ conﬁdence estimations to be consistent with the actual success probability of the model [Guo et al., 2017a].
Revised: Uncertainty calibration is the process of adapting machine learning models’ confidence estimations to be consistent with the actual success probability of the model [Guo et al., 2017a].

Original: The model’s conﬁdence evaluation on its classiﬁcations, i e., the model’s prediction of the success ratio on a speciﬁc input, is an essential aspect of mission-critical machine learning applications as it provides a realistic estimate of the classiﬁcation’s success probability and facilitates informed decisions about the current situation.
Revised: The model’s confidence evaluation on its classifications, i e., the model’s prediction of the success ratio on a specific input, is an essential aspect of mission-critical machine learning applications as it provides a realistic estimate of the classification’s success probability and facilitates informed decisions about the current situation.

Original: Even a very accurate model may run into an unexpected situation, which could then be communicated to the user by the conﬁdence estimation.
Revised: Even a very accurate model may run into an unexpected situation, which could then be communicated to the user by the confidence estimation.

Original: For example, consider an autonomous driver that uses a model to identify and classify trafﬁc signs.
Revised: For example, consider an autonomous driver that uses a model to identify and classify traffic signs.

Original: The model is very accurate, and in most cases, its classiﬁcations are correct with high conﬁdence.
Revised: The model is very accurate, and in most cases, its classifications are correct with high confidence.

Original: However, one day, it encountered a trafﬁc sign obscured by, e.g., heavy vegetation.
Revised: However, one day, it encountered a traffic sign obscured by, e.g., heavy vegetation.

Original: In such a case, the model’s classiﬁcation is more likely to be incorrect.
Revised: In such a case, the model’s classification is more likely to be incorrect.

Original: Thus, estimating conﬁdence (i.e., uncertainty) is an essential tool for assessing unavoidable risks, enabling system designers to address the risks better, potentially avoiding unexpected and catastrophic implications.
Revised: Thus, estimating confidence (i.e., uncertainty) is an essential tool for assessing unavoidable risks, enabling system designers to address the risks better, potentially avoiding unexpected and catastrophic implications.

Original: Our autonomous driver, for example, may reduce the speed and activate additional sensors until it reaches higher conﬁdence.
Revised: Our autonomous driver, for example, may reduce the speed and activate additional sensors until it reaches higher confidence.

Original: Thus, indeed, all popular machine learning models have mechanisms for determining conﬁdence that can be calibrated to maximize the quality of conﬁdence estimations [NiculescuMizil and Caruana, 2005, Guo et al., 2017b, Kumar et al., 2019] and there is a concentrated effort to calibrate models better and facilitate more dependable applications [Leistner et al., 2009, Sun et al., 2007].
Revised: Thus, indeed, all popular machine learning models have mechanisms for determining confidence that can be calibrated to maximize the quality of confidence estimations [NiculescuMizil and Caruana, 2005, Guo et al., 2017b, Kumar et al., 2019] and there is a concentrated effort to calibrate models better and facilitate more dependable applications [Leistner et al., 2009, Sun et al., 2007].

Original: Existing calibration methods can be divided into two types: post-hoc methods that preform a transformation that maps from classiﬁers’ raw outputs to their expected probabilities [Kull et al., 2019, Guo et al., 2017a, Gupta and Ramdas, 2021b], and ad-hoc methods that adapt the training process to generate better calibrated design [Thulasidasan et al., 2019, Hendrycks et al., 2019a].
Revised: Existing calibration methods can be divided into two types: post-hoc methods that preform a transformation that maps from classifiers’ raw outputs to their expected probabilities [Kull et al., 2019, Guo et al., 2017a, Gupta and Ramdas, 2021b], and ad-hoc methods that adapt the training process to generate better calibrated design [Thulasidasan et al., 2019, Hendrycks et al., 2019a].

Original: Post-hoc calibration methods are easier to apply as they do not change the model and do not require us to retrain a model.
Revised: Post-hoc calibration methods are easier to apply as they do not change the model and do not require us to retrain a model.

Original: That said, ad-hoc methods may lead us to better model training in the ﬁrst place and thus better models.
Revised: That said, ad-hoc meth- ods may lead us to better model training in the first place and thus better models.

Original: With the success of the two approaches, recent approaches suggest using ensemble methods whose estimation is a (weighted) average of multiple calibration methods [Ashukha et al., 2020, Ma et al., 2021].
Revised: With the success of the two approaches, recent approaches suggest using ensemble methods whose estimation is a (weighted) average of multiple calibration methods [Ashukha et al., 2020, Ma et al., 2021].

Original: This paper presents a post-hoc uncertainty estimation method, but of a different kind.
Revised: This paper presents a post-hoc uncertainty estimation method, but of a different kind.

Original: While current post-hoc methods use the model itself as their signal for calibration, we use the training dataset (without modifying the model).
Revised: While current post-hoc methods use the model itself as their signal for calibration, we use the training dataset (without modifying the model).

Original: More precisely, our method is based on geometric notions calculated on the training dataset.
Revised: More precisely, our method is based on geometric notions calculated on the training dataset.

Original: In fact, our geometric choice of the signal is orthogonal to the preformed calibration method in the sense that we can employ it using various post-hoc calibration methods.
Revised: In fact, our geometric choice of the signal is orthogonal to the preformed calibration method in the sense that we can employ it using various post-hoc calibration methods.

Original: Roughly speaking, we examine the geometric distance of the current input from the existing training inputs and use it to estimate the model’s conﬁdence.
Revised: Roughly speaking, we examine the geometric distance of the current input from the existing training inputs and use it to estimate the model’s confidence.

Original: Intuitively, the conﬁdence is high when the current input is close to training set inputs in the same classiﬁcation and is far from training set inputs with other classiﬁcations.
Revised: Intuitively, the confidence is high when the current input is close to training set inputs in the same classification and is far from training set inputs with other classifications.

Original: Dually, the conﬁdence would be low when there are very close training set inputs with different classiﬁcations.
Revised: Dually, the confidence would be low when there are very close training set inputs with different classifications.

Original: To maximize this geometric signal the inputs should be normalized.
Revised: To maximize this geometric signal the inputs should be normalized.

Original: That is, the size, format, etc. of the images should be consistent.
Revised: That is, the size, format, etc. of the images should be consistent.

Original: Thus, in this paper, we employ such well behaved datasets.
Revised: Thus, in this paper, we employ such well behaved datasets.

Original: Our work demonstrates that geometry can facilitate better uncertainty estimations for diverse models and datasets.
Revised: Our work demonstrates that geometry can facilitate better uncertainty estimations for diverse models and datasets.

Original: We ﬁrst provide an algorithm for calculating the maximal geometric separation of an input.
Revised: We first provide an algorithm for calculating the maximal geometric separation of an input.

Original: However, calculating the geometric separation for an input requires evaluating the whole space of training inputs, making it a computationally expensive method that is not always feasible.
Revised: However, calculating the geometric separation for an input requires evaluating the whole space of training inputs, making it a computationally expensive method that is not always feasible.

Original: For example, an autonomous driver needs to reach decisions within a short time frame to be effective.
Revised: For example, an autonomous driver needs to reach decisions within a short time frame to be effective.

Original: Therefore, we also suggest a lightweight approximation called fast-separation , and show that it provides an approximation of geometric separation.
Revised: Therefore, we also suggest a lightweight approximation called fast-separation , and show that it provides an approximation of geometric separation.

Original: Our next challenge is to move from a separation value to a conﬁdence estimation.
Revised: Our next challenge is to move from a separation value to a confidence estimation.

Original: For this, we apply numerical analysis tools.
Revised: For this, we apply numerical analysis tools.

Original: Thus, to obtain a conﬁdence estimation in real-time we only need to apply a regression function to the calculated separation value.
Revised: Thus, to obtain a confidence estimation in real-time we only need to apply a regression function to the calculated separation value.

Original: Interestingly, our extensive simulation across different models and datasets shows that our geometric-based method yields better conﬁdence estimations when compared to popular libraries used in the industry [Pedregosa et al., 2011] , as well as recently proposed calibration methods [Kumar et al., 2019, Gupta and Ramdas, 2021a].
Revised: Interestingly, our extensive simulation across different models and datasets shows that our geometric-based method yields better confidence estimations when compared to popular libraries used in the industry [Pedregosa et al., 2011] , as well as recently proposed calibration methods [Kumar et al., 2019, Gupta and Ramdas, 2021a, Guo et al., 2017a, Zhang et al., 2020].

Original: Furthermore, our evaluation shows that using our method with the fast-separation approximation allows for multiple conﬁdence estimations per second, making it real-time applicable.
Revised: Furthermore, our evaluation shows that using our method with the fastseparation approximation allows for multiple confidence estimations per second, making it real-time applicable.

Original:  RELATED WORKS
Revised:  RELATED WORKS

Original: The dependability of machine learning models is a key challenge in the research community [Johnson, 2018].
Revised: The dependability of machine learning models is a key challenge in the research community [Johnson, 2018].

Original: Various works demonstrate vulnerabilities in popular machine learning models [Biggio et al., 2014b,a], or show explicit methods to generate adversarial inputs to such models
Revised: Various works demonstrate vulnerabilities in popular machine learning models [Biggio et al., 2014b,a], or show explicit methods to generate adversarial inputs to such models

Original: [Zhou et al., 2012].
Revised: [Zhou et al., 2012].

Original: Unfortunately, such vulnerabilities are fundamental to the ﬁeld and cannot be avoided.
Revised: Unfortunately, such vulnerabilities are fundamental to the field and cannot be avoided.

Original: As mentioned above, uncertainty calibration is about estimating the model’s success probability of classifying a given example.
Revised: As mentioned above, uncertainty calibration is about estimating the model’s success probability of classifying a given example.

Original: Post-hoc calibration methods apply some transformation to the model’s conﬁdence (without changing the model) such transformations include Temperature Scaling (TS)
Revised: Post-hoc calibration methods apply some transformation to the model’s confidence (without changing the model) such transformations include Temperature Scaling (TS)

Original: [Guo et al., 2017a, Kull et al., 2019], Ensemble
Revised: [Guo et al., 2017a, Kull et al., 2019], Ensemble

Original: Temperature Scaling (ETS)
Revised: Temperature Scaling (ETS)

Original: [Zhang et al., 2020], and cubic spline [Gupta and Ramdas, 2021a].
Revised: [Zhang et al., 2020], and cubic spline [Gupta and Ramdas, 2021a].

Original: In brief, these methods are limited by the best learn able mapping between the model’s conﬁdence estimations, and the actual conﬁdence.
Revised: In brief, these methods are limited by the best learnable mapping between the model’s confidence estimations, and the actual confidence.

Original: That is, post-hoc calibration methods are limited in mapping each conﬁdence value to another calibrated value.
Revised: That is, post-hoc calibration methods are limited in mapping each confidence value to another calibrated value.

Original: In comparison, our method uses geometric distance as a signal for calibration and its improvement over post-hoc calibration is because geometric distances better differentiate then the model’s predicted probabilities in the models and datasets included in our evaluation.
Revised: In comparison, our method uses geometric distance as a signal for calibration and its improvement over post-hoc calibration is because geometric distances better differentiate than the model’s predicted probabilities in the models and datasets included in our evaluation.

Revised: Another work that uses a geometric distance in this context is [Dalitz, 2009].

Revised: There, the confidence score is computed directly from the geometric distance, while we first fit a function on a subset of the data in order to learn the specific behavior of the dataset and model.

Revised: Moreover, the work in [Dalitz, 2009] only applies to the k-nearest neighbor model, while our method is applicable to all models.

Original: The recently proposed work of [Kumar et al., 2019] uses a ﬁtting function on the conﬁdence values and then divides the inputs into bins of equal size and outputs the function’s average in each bin.
Revised: The recently proposed work of [Kumar et al., 2019] uses a fitting function on the confidence values and then divides the inputs into bins of equal size and outputs the function’s average in each bin.

Original: The work of [Gupta and Ramdas, 2021a] uses a similar idea but divide the inputs into uniform-mass (rather than equal size) bins.
Revised: The work of [Gupta and Ramdas, 2021a] uses a similar idea but divide the inputs into uniform-mass (rather than equal size) bins.

Original: It is interesting to note that while most post-hoc calibration methods are model agnostic, recent methods have begun to look on a neural network non-probabilistic output called logits[Guo
Revised: It is interesting to note that while most post-hoc calibration methods are model agnostic, recent methods have begun to look on a neural network non-probabilistic output called logits(before applying softmax)

Original:  et al., 2017b, Z.Ding et al., 2020, J.Wenger et al., 2019] (before applying softmax).
Revised: [Guo et al., 2017b, Z.Ding et al., 2020, J.Wenger et al., 2019].

Original: Thus, some of the new post-hoc calibration methods are applicable only to neural networks.
Revised: Thus, some of the new post-hoc calibration methods are applicable only to neural networks.

Original: Ensemble methods are similar to post-hoc calibration methods as they do not change the model, but they consider multiple signals to determine the model’s conﬁdence [Ashukha et al., 2020, Ma et al., 2021].
Revised: Ensemble methods are similar to post-hoc calibration methods as they do not change the model, but they consider multiple signals to determine the model’s confidence [Ashukha et al., 2020, Ma et al., 2021].

Original: In principle, ensemble methods complement our approach.
Revised: In principle, ensemble methods complement our approach.

Original: For example, one can include our estimator in an ensemble, e.g., by averaging its prediction with other methods.
Revised: For example, one can include our estimator in an ensemble, e.g., by averaging its prediction with other methods.

Original: Ad-hoc calibration is about training models in new manners aimed to yield better uncertainty estimations.
Revised: Ad-hoc calibration is about training models in new manners aimed to yield better uncertainty estimations.

Original: Important techniques in this category include mixup training [Thulasidasan et al., 2019], pretraining [Hendrycks et al., 2019a], label-smoothing [Müller et al., 2019], data augmentation [Ashukha et al., 2020], selfsupervised learning [Hendrycks et al., 2019b], Bayesian approximation (MC-dropout) [Gal and Ghahramani, 2016,
Revised: Important techniques in this category include mixup training [Thulasidasan et al., 2019], pretraining [Hendrycks et al., 2019a], label-smoothing [Müller et al., 2019], data augmentation [Ashukha et al., 2020], selfsupervised learning [Hendrycks et al., 2019b], Bayesian approximation (MC-dropout) [Gal and Ghahramani, 2016,

Original: Gal et al., 2017], Deep Ensemble (DE)
Revised: Gal et al., 2017], Deep Ensemble (DE)

Original: [Lakshminarayanan et al., 2017], Snapshot Ensemble [Huang et al., 2017a], Fast
Revised: [Lakshminarayanan et al., 2017], Snapshot Ensemble [Huang et al., 2017a], Fast

Original: Geometric Ensembling (FGE)
Revised: Geometric Ensembling (FGE)

Original: [Garipov et al., 2018], and
Revised: [Garipov et al., 2018], and

Original: SWA-Gaussian (SWAG)
Revised: SWA-Gaussian (SWAG)

Original: [Maddox et al., 2019].
Revised: [Maddox et al., 2019].

Original: Ad-hoc calibration is perhaps the best approach in public as it tackles the core of model’s calibration directly.
Revised: Ad-hoc calibration is perhaps the best approach in public as it tackles the core of model’s calibration directly.

Original: However, because it offers speciﬁc training methods it is of less use to large and already trained models, and the impact of each work is limited to a speciﬁc model type (e.g.,
Revised: However, because it offers specific training methods it is of less use to large and already trained models, and the impact of each work is limited to a specific model type (e.g.,

Original: DNNs in [Garipov et al., 2018]).
Revised: DNNs in [Garipov et al., 2018]).

Original: In compression, ad-hoc and ensemble methods (and our own method) often work for numerous models.
Revised: In compression, ad-hoc and ensemble methods (and our own method) often work for numerous models.

Original: Our geometric method is largely inspired by the approach of robustness proving in machine learning models.
Revised: Our geometric method is largely inspired by the approach of robustness proving in machine learning models.

Original: In this ﬁeld, formal methods are used to prove that speciﬁc inputs are robust to small adversarial perturbations.
Revised: In this field, formal methods are used to prove that specific inputs are robust to small adversarial perturbations.

Original: That is, we formally prove that all images in a certain geometric radius around a speciﬁc train-set image receive the same classiﬁcation [Narodytska et al., 2018, Katz et al., 2017, Huang et al., 2017b, Gehr et al., 2018, Ehlers, 2017, Einziger et al., 2019].
Revised: That is, we formally prove that all images in a certain geometric radius around a specific train-set image receive the same classification [Narodytska et al., 2018, Katz et al., 2017, Huang et al., 2017b, Gehr et al., 2018, Ehlers, 2017, Einziger et al., 2019].

Original: These works are not applicable to uncertainty calibration as they can only produce proves in an ofﬂine manner, and thus only to training set inputs rather than to the current input.
Revised: These works are not applicable to uncertainty calibration as they can only produce proves in an offline manner, and thus only to training set inputs rather than to the current input.

Original: However, the underlying intuition is that inputs that are geometrically similar should be classiﬁed the same also appears in our approach.
Revised: However, the underlying intuition is that inputs that are geometrically similar should be classified the same also appears in our approach.

Original: Indeed, our work shows that geometric properties of the inputs can help us quantify the uncertainty in certain inputs, and that in general inputs that are less geometrically separated and are ’on the edge’ between multiple classiﬁcations are more error prune than points that are highly separated from other classes.
Revised: Indeed, our work shows that geometric properties of the inputs can help us quantify the uncertainty in certain inputs, and that in general inputs that are less geometrically separated and are ’on the edge’ between multiple classifications are more error prune than points that are highly separated from other classes.

Original: Thus our work reinforces the intuition behind applying formal methods to prove robustness and support the intuition that more robust training models would be more dependable.
Revised: Thus our work reinforces the intuition behind applying formal methods to prove robustness and support the intuition that more robust training models would be more dependable.

Original:  GEOMETRIC CONFIDENCE EVALUATION
Revised:  GEOMETRIC CONFIDENCE EVALUATION

Original: This section lays the foundations for a geometric estimation of the model’s conﬁdence level on a given instance.
Revised: This section lays the foundations for a geometric estimation of the model’s confidence level on a given instance.

Original: Our work assumes that the inputs are normalized.
Revised: Our work assumes that the inputs are normalized.

Original: That is, they are ﬁxed-sized images and within the same format.
Revised: That is, they are fixed-sized images and within the same format.

Original: Under such conditions, we can measure the geometric distance between various inputs.
Revised: Under such conditions, we can measure the geometric distance between various inputs.

Original: Formally, a model receives a data input, x , and outputs the pair (cid:104)C ( x ) , conf ( x ) (cid:105) , where C ( x ) is the model’s classiﬁcation of x and conf ( x ) reﬂects the probability that the classiﬁcation is correct.
Revised: Formally, a model receives a data input, x , and outputs the pair ⟨C ( x ) , conf ( x ) ⟩ , where C ( x ) is the model’s classification of x and conf ( x ) reflects the probability that the classification is correct.

Original: Our current work evaluates conf ( x ) from a geometric point of view.
Revised: Our current work evaluates conf ( x ) from a geometric point of view.

Original: We estimate the environment around x where points are closer to inputs of certain classiﬁcations over the others.
Revised: We estimate the environment around x where points are closer to inputs of certain classifications over the others.

Original: In Section 3.1 we deﬁne a geometric separation measure, and provide an algorithm to calculate it.
Revised: In Section 3.1 we define a geometric separation measure, and provide an algorithm to calculate it.

Original: We explain that such a computation is too cumbersome for real-time systems, and so we suggest a lightweight approximation in Section 3.2.
Revised: We explain that such a computation is too cumbersome for real-time systems, and so we suggest a lightweight approximation in Section 3.2.

Original: Finally, Section 3.3 explains how we use the geometric signal to derive conf ( x ) .
Revised: Finally, Section 3.3 explains how we use the geometric signal to derive conf ( x ) .

Original: That is, mapping a real number corresponding to the geometric separation to a number in [0 , 1] corresponding to the conﬁdence ratio.
Revised: That is, mapping a real number corresponding to the geometric separation to a number in [0 , 1] corresponding to the confidence ratio.

Original: 3.1 SEPARATION MEASURE
Revised: 3.1 SEPARATION MEASURE

Original: We look at the displacement of x compared to nearby data inputs within the training set.
Revised: We look at the displacement of x compared to nearby data inputs within the training set.

Original: Intuitively, when x is close to other inputs in C ( x ) (i.e., inputs with the same classiﬁcation as x ) and is far from inputs with other classiﬁcations, then the model is correct with a high probability, implying that conf ( x ) should be high.
Revised: Intuitively, when x is close to other inputs in C ( x ) (i.e., inputs with the same classification as x ) and is far from inputs with other classifications, then the model is correct with a high probability, implying that conf ( x ) should be high.

Original: On the other hand, when there are training inputs with a different classiﬁcation close to x , we estimate that C ( x ) is more likely to be incorrect.
Revised: On the other hand, when there are training inputs with a different classification close to x , we estimate that C ( x ) is more likely to be incorrect.

Original: Below we provide deﬁnitions that allow us to formalize this intuitive account.
Revised: Below we provide definitions that allow us to formalize this intuitive account.

Original: In what follows, we consider a model
Revised: In what follows, we consider a model

Original: M to consist of a machine learning model (e.g., a gradient boosted tree or a neural network), along with a labeled train set, Tr , used to generate the model.
Revised: M to consist of a machine learning model (e.g., a gradient boosted tree or a neural network), along with a labeled train set, Tr , used to generate the model.

Original: We use an implicit notion of distance, and denote by d ( x, y ) the distance between inputs x and y , and by D ( x, A ) the distance between the input x and
Revised: We use an implicit notion of distance, and denote by d ( x, y ) the distance between inputs x and y , and by D ( x, A ) the distance between the input x and

Original: the set A (i.e., the minimal distance between x and the inputs in A ).
Revised: the set A (i.e., the minimal distance between x and the inputs in A ).

Original: Deﬁnition 1 (Safe and Dangerous inputs) .
Revised: Definition 1 (Safe and Dangerous inputs) .

Original: Let M be a model.
Revised: Let M be a model.

Original: For an input x in the sample space we deﬁne:
Revised: For an input x in the sample space we define:

Original: [Equation]
Revised: [Equation]

Original: := { x (cid:48) ∈

Original: Tr : C ( x (cid:48) )

Original: =

Original: C ( x ) } .

Original: We denote by F M ( x ) the set
Revised: We denote by F M ( x ) the set

Original: Tr \ F M ( x ) .
Revised: Tr \ F M ( x ) .

Original: An input x ∈ X is labeled as safe if it is closer to F M ( x ) than to F M ( x ) , and it is labeled as dangerous otherwise.
Revised: An input x ∈ X is labeled as safe if it is closer to F M ( x ) than to F M ( x ) , and it is labeled as dangerous otherwise.

Original: Deﬁnition 2 (Zones) .
Revised: Definition 2 (Zones) .

Original: Let x be a safe (dangerous) point.
Revised: Let x be a safe (dangerous) point.

Original: A zone for x , denoted z x , is such that for any input y , if d ( x, y ) <
Revised: A zone for x , denoted z x , is such that for any input y , if d ( x, y ) <

Original: z x , then D ( y, F M ( x )) <
Revised: z x , then D ( y, F M ( x )) <

Original: D ( y, F M ( x ))
Revised: D ( y, F M ( x ))

Original: ( D ( y, F M ( x )) ≥ D ( y, F M ( x )) ).
Revised: ( D ( y, F M ( x )) ≥ D ( y, F M ( x )) ).

Original: For each x we denote the maximal such zone by Z ( x ) .
Revised: For each x we denote the maximal such zone by Z ( x ) .

Original: In other words, a zone of a safe (dangerous) input x , Z ( x ) , is a radius around x such that all inputs in this ball are closer to an input in F M ( x ) ( F M ( x ) ) than to any input in F M ( x ) ( F M ( x ) ), respectively.
Revised: In other words, a zone of a safe (dangerous) input x , Z ( x ) , is a radius around x such that all inputs in this ball are closer to an input in F M ( x ) ( F M ( x ) ) than to any input in F M ( x ) ( F M ( x ) ), respectively.

Original: Deﬁnition 3 (Separation) .
Revised: Definition 3 (Separation) .

Original: The separation of a data input x with respect to the model M is Z ( x ) when x is a safe input, and − 1 · Z ( x ) when x is a dangerous input.
Revised: The separation of a data input x with respect to the model M is Z ( x ) when x is a safe input, and − 1 · Z ( x ) when x is a dangerous input.

Original: That is, the separation of x encapsulates the maximal zone for x (provided by the absolute value) together with an indication of whether the point is safe or dangerous (provided by the sign).
Revised: That is, the separation of x encapsulates the maximal zone for x (provided by the absolute value) together with an indication of whether the point is safe or dangerous (provided by the sign).

Original: The separation of x depends only on the classiﬁcation of x by the model and the train set.
Revised: The separation of x depends only on the classification of x by the model and the train set.

Original: This is because our deﬁnition partitions the inputs in Tr into two sets: one with C ( x ) , F M ( x ) , and one with all other classiﬁcations,
Revised: This is because our definition partitions the inputs in Tr into two sets: one with C ( x ) , F M ( x ) , and one with all other classifications,

Original: F M ( x ) .
Revised: F M ( x ) .

Original: These sets vary between models only when they disagree on the classiﬁcation of x .
Revised: These sets vary between models only when they disagree on the classification of x .

Original: Note that x ’s for which the distance from F M ( x ) equals the distance from F M ( x ) are considered dangerous inputs, and their separation measure will bezero.
Revised: Note that x ’s for which the distance from F M ( x ) equals the distance from F M ( x ) are considered dangerous inputs, and their separation measure will be

Original: As mentioned, Deﬁnition 2 and Deﬁnition 3 use an implicit notion of distance.
Revised: As mentioned, Definition 2 and Definition 3 use an implicit notion of distance.

Original: Such notion can accept any distance metric (e.g., L 1 , L 2 or L ∞ ).
Revised: Such notion can accept any distance metric (e.g., L 1 , L 2 or L ∞ ).

Original: However, in this work, we ﬁx the metric to L 2 as it is a standard measure for safety features in adversarial machine learning [Moosavi-Dezfooli et al., 2017], in addition to it being easy to illustrate and intuitive to understand.
Revised: However, in this work, we fix the metric to L 2 as it is a standard measure for safety features in adversarial machine learning [Moosavi-Dezfooli et al., 2017], in addition to it being easy to illustrate and intuitive to understand.

Original: Furthermore, our methodology relies on calculating the nearest neighbors of a given input, and for L 2 , this can be done using standard and well-optimized libraries.
Revised: Furthermore, our methodology relies on calculating the nearest neighbors of a given input, and for L 2 , this can be done using standard and well-optimized libraries.

Original: Accordingly, all our deﬁnitions and calculations assume the L 2 metrics (Euclidean distances).
Revised: Accordingly, all our definitions and calculations assume the L 2 metrics (Euclidean distances).

Original: Figure 1 provides a geometric illustration of safe and danger zones, and separation values.
Revised: Figure 1 provides a geometric illustration of safe and danger zones, and separation values.

Original: For illustration purposes, the ﬁgure uses the L 2 norm with two dimensions, whereas our data usually includes many more dimensions.
Revised: For illustration purposes, the figure uses the L 2 norm with two dimensions, whereas our data usually includes many more dimensions.

Original: For example, a 30 × 30 trafﬁc sign image will have 900 dimensions.
Revised: For example, a 30 × 30 traffic sign image will have 900 dimensions.

Original: In the ﬁgure, x is a safe input, and the green highlighted ball represents its maximal zone which reﬂects how far we can get from x and still be closer to training set inputs classiﬁed the same as x than any other inputs.
Revised: In the figure, x is a safe input, and the green highlighted ball represents its maximal zone which reflects how far we can get from x and still be closer to training set inputs classified the same as x than any other inputs.

Original: The input y is a dangerous input, and the red highlighted ball represents its maximal zone which dually represents how far we need to distance ourselves from x so that inputs classiﬁed as x become closer than other inputs.
Revised: The input y is a dangerous input, and the red highlighted ball represents its maximal zone which dually represents how far we need to distance ourselves from x so that inputs classified as x become closer than other inputs.

Original: Thus, x will have a positive separation value, while y will have a negative one.
Revised: Thus, x will have a positive separation value, while y will have a negative one.

Original: Next, we provide a formula for calculating the separation of a given input x within the L 2 distance metric.
Revised: Next, we provide a formula for calculating the separation of a given input x within the L 2 distance metric.

Original: Deﬁnition 4.
Revised: Definition 4.

Original: Given a model M and an input x , deﬁne:
Revised: Given a model M and an input x , define:

Original: [Equation]
Revised: [Equation]

Original: ) 2 d ( x (cid:48) , x (cid:48)(cid:48) )

Original: Lemma 1.
Revised: Lemma 1.

Original: Let x, x (cid:48) , x (cid:48)(cid:48) ∈ R n be inputs such thatd ( x, x (cid:48) )
Revised: Let x, x ′ , x ′′ ∈ R n be inputs such that

Original: <
Revised: [Equation]

Original: d ( x, x (cid:48)(cid:48) ) . The maximal distance M ( x, x (cid:48) , x (cid:48)(cid:48) ) for which if y ∈ R n such that d ( x, y ) < 
Revised: for which if y ∈ R n such that d ( x, y ) < M ( x, x ′ , x ′′ ) , then

Original: M ( x, x (cid:48) , x (cid:48)(cid:48) ) , then d ( y, x (cid:48) ) < d ( y, x (cid:48)(cid:48) ) is d 2 ( x, x (cid:48)(cid:48) ) − d 2 ( x, x (cid:48) ) 2 d ( x (cid:48) , x (cid:48)(cid:48) ) .
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: Since any three points in space deﬁne a plane we focus on the plane deﬁned by these three points.
Revised: Since any three points in space define a plane we focus on the plane defined by these three points.

Original: Figure 2 demonstrates a geometric positioning of the points, and the main constructions in the proof.
Revised: Figure 2 demonstrates a geometric positioning of the points, and the main constructions in the proof.

Original: The perpendicular bisector to the line between x (cid:48) and x (cid:48)(cid:48) divides the plane into two parts: one in which all the points are closer to x (cid:48)(cid:48) than to x (cid:48) (the lower part in the ﬁgure) and one in which all the points are closer to x (cid:48) than to x (cid:48)(cid:48) (the upper part in the ﬁgure).
Revised: The perpendicular bisector to the line between x ′ and x ′′ divides the plane into two parts: one in which all the points are closer to x ′′ than to x ′ (the lower part in the figure) and one in which all the points are closer to x ′ than to x ′′ (the upper part in the figure).

Original: Our goal is thus to establish the distance between x and the lower part of the plane.
Revised: Our goal is thus to establish the distance between x and the lower part of the plane.

Original: Hence, M ( x, x (cid:48) , x (cid:48)(cid:48) ) amounts to the distance from x to the perpendicular bisector to the line between x (cid:48) and x (cid:48)(cid:48) .
Revised: Hence, M ( x, x ′ , x ′′ ) amounts to the distance from x to the perpendicular bisector to the line between x ′ and x ′′ .

Original: Using trigonometric calculations, it is straightforward to verify that indeed
Revised: Using trigonometric calculations, it is straightforward to verify that indeed

Original: [Equation]
Revised: [Equation]

Original: Proposition 1.
Revised: Proposition 1.

Original: S M ( x ) is the separation of x with respect to the model M (in Deﬁnition 3).
Revised: S M ( x ) is the separation of x with respect to the model M (in Definition 3).

Original: Proof.
Revised: Proof.

Original: Let x be a safe input, and y be an input such that
Revised: Let x be a safe input, and y be an input such that

Original: [Equation]
Revised: [Equation]

Original: We ﬁrst show that y is closer to F M ( x ) than to F M ( x ) .
Revised: We first show that y is closer to F M ( x ) than to F M ( x ) .

Original: Let z (cid:48)(cid:48) ∈ F M ( x ) , it sufﬁces to show that there exist z (cid:48) ∈
Revised: Let z ′′ ∈ F M ( x ) , it suffices to show that there exist z ′ ∈

Original: F M ( x ) such that d ( y, z (cid:48) ) <
Revised: F M ( x ) such that d ( y, z ′ ) <

Original: d ( y, z (cid:48)(cid:48) ) .
Revised: d ( y, z ′′ ) .

Original: Notice that
Revised: Notice that

Original: [Equation]
Revised: [Equation]

Original:  Therefore, there exist a z (cid:48) ∈ F M ( x ) for which
Revised: [Equation] Therefore, there exist a z ′ ∈ F M ( x ) for which

Original: [Equation]
Revised: [Equation]

Original: Thus, since x is a safe point, using Lemma [Equation] we conclude that d ( y, z (cid:48) ) <
Revised: Thus, since x is a safe point, using Lemma 1, we conclude that d ( y, z ′ ) <

Original: d ( y, z (cid:48)(cid:48) ) .
Revised: d ( y, z ′′ ) .

Original: The proof follows similar arguments for dangerous points, taking the distances as −S M and ﬂipping the inequalities.
Revised: The proof follows similar arguments for dangerous points, taking the distances as −S M and flipping the inequalities.

Original: To show maximality, observe that the intersection point marked by w in Figure 2, which is at distance S M ( x ) from x , can be easily shown to be of equal distances from F M ( x ) and F M ( x ) .
Revised: To show maximality, observe that the intersection point marked by w in Figure 2, which is at distance S M ( x ) from x , can be easily shown to be of equal distances from F M ( x ) and F M ( x ) .

Original: While separation provides the maximal zone, it is expensive to calculate.
Revised: While separation provides the maximal zone, it is expensive to calculate.

Original: As can be seen in Deﬁnition 4, to estimate the separation of one speciﬁc input, we go over many triplets of inputs.
Revised: As can be seen in Definition 4, to estimate the separation of one specific input, we go over many triplets of inputs.

Original: The exact amount is unbounded and depends on the dataset.
Revised: The exact amount is unbounded and depends on the dataset.

Original: Thus, separation is infeasible to compute in near real-time.
Revised: Thus, separation is infeasible to compute in near real-time.

Original: Therefore, when time or computation resources are limited, we require a different and computationally simpler notion.
Revised: Therefore, when time or computation resources are limited, we require a different and computationally simpler notion.

Original: Accordingly, the following section provides an efﬁcient approximation of the separation measure.
Revised: Accordingly, the following section provides an efficient approximation of the separation measure.

Original: 3.2 FAST-SEPARATION APPROXIMATION
Revised: 3.2 FAST-SEPARATION APPROXIMATION

Original: We approximate the separation of a given input using only its distance from F M ( x ) and its distance from F M ( x ) .
Revised: We approximate the separation of a given input using only its distance from F M ( x ) and its distance from F M ( x ) .

Original: This simpliﬁcation allows us to calculate a zone for any given point, which is not necessarily the maximal one.
Revised: This simplification allows us to calculate a zone for any given point, which is not necessarily the maximal one.

Original: The reliance on these two distances enables a faster calculation since we do not perform an exhaustive search over many triplets of inputs.
Revised: The reliance on these two distances enables a faster calculation since we do not perform an exhaustive search over many triplets of inputs.

Original: In particular, we do not consider the geometric positioning of the inputs that determine the distance from these sets.
Revised: In particular, we do not consider the geometric positioning of the inputs that determine the distance from these sets.

Original: Deﬁnition 5 (Fast-Separation) .
Revised: Definition 5 (Fast-Separation) .

Original: Given a model M , the fastseparation of an input x , denoted S M ( x ) , is deﬁned as:
Revised: Given a model M , the fastseparation of an input x , denoted S M ( x ) , is defined as:

Original: [Equation]
Revised: [Equation]

Original: Notice that just as is the case for separation, if x is a safe input, its fast-separation value will be strictly positive and non-positive otherwise.
Revised: Notice that just as is the case for separation, if x is a safe input, its fast-separation value will be strictly positive and non-positive otherwise.

Original: Figure 3 illustrates the notion of fast-separation.
Revised: Figure 3 illustrates the notion of fast-separation.

Original: In particular, it exempliﬁes why it only provides an approximation of the more accurate separation measure.
Revised: In particular, it exemplifies why it only provides an approximation of the more accurate separation measure.

Original: It encapsulates a zone  that is less than or equal to that of separation.
Revised: It encapsulates a zone [Figure] that is less than or equal to that of separation.

Original: Sub-ﬁgure (a) demonstrates a case in which S M ( x ) =
Revised: Sub-figure (a) demonstrates a case in which S M ( x ) =

Original: S M ( x ) , while sub-ﬁgure (b) presents a case where S M ( x ) is considerably larger than S M ( x ) .
Revised: S M ( x ) , while sub-figure (b) presents a case where S M ( x ) is considerably larger than S M ( x ) .

Original: Proposition 2.
Revised: Proposition 2.

Original: S M is a lower bound of the separation
Revised: S M is a lower bound of the separation

Original: S M in the sense that for every safe (dangerous) input 0 ≤
Revised: S M in the sense that for every safe (dangerous) input 0 ≤

Original: S M ( x ) ≤ S M ( x ) ( S M ( x ) ≤ S M ( x ) ≤ 0 ).
Revised: S M ( x ) ≤ S M ( x ) ( S M ( x ) ≤ S M ( x ) ≤ 0 ).

Original: Proof.
Revised: Proof.

Original: Let x be a safe input.
Revised: Let x be a safe input.

Original: Since Proposition 1 shows that
Revised: Since Proposition 1 shows that

Original: S M ( x ) is the maximal zone, it sufﬁces to show that S M ( x ) is a zone of x .
Revised: S M ( x ) is the maximal zone, it suffices to show that S M ( x ) is a zone of x .

Original: Let y be a point such that
Revised: Let y be a point such that

Original: [Equation]
Revised: [Equation]

Revised: x )

Original: [Figure]
Revised: [Equation]

Original: We show that D ( y, F M ( x )) <
Revised: We show that D ( y, F M ( x )) <

Original: D ( y, F M ( x )) .
Revised: D ( y, F M ( x )) .

Original: Take z (cid:48) ∈ F M ( x ) and z (cid:48)(cid:48) , w ∈ F M ( x ) such that d ( x, z (cid:48) ) =
Revised: Take z ′ ∈ F M ( x ) and z ′′ , w ∈ F M ( x ) such that d ( x, z ′ ) =

Original: D ( x, F M [Equation] x )) , d ( x, z [Equation]
Revised: D ( x, F M ( x )) , d ( x, z ′′ ) =

Original: = D ( x, F M ( x )) , and d ( y, w ) =
Revised: D ( x, F M ( x )) , and d ( y, w ) =

Original: D ( y, F M ( x )) .
Revised: D ( y, F M ( x )) .

Original: Using the triangle inequality we get:
Revised: Using the triangle inequality we get:

Original: [Equation]
Revised: [Equation]

Original: For dangerous points, the proof follows similar arguments, switching F M ( x )) and F M ( x )) .
Revised: For dangerous points, the proof follows similar arguments, switching F M ( x )) and F M ( x )) .

Original: Proposition 2 shows that the absolute value of S M ( x ) is always smaller than or equal to that of S M ( x ) and that they have the same sign.
Revised: Proposition 2 shows that the absolute value of S M ( x ) is always smaller than or equal to that of S M ( x ) and that they have the same sign.

Original: Thus, fast-separation is an approximation of separation in the sense that it uses smaller zones.
Revised: Thus, fast-separation is an approximation of separation in the sense that it uses smaller zones.

Revised: The following proposition further provides an approximation bound for fast-separation.

Original: 3.3 PREDICTING CONFIDENCE FROM SEPARATION
Revised: Proposition 3. The following holds for any point x : [Equation] Proof.

Revised: We here prove the bound for safe points x , the proof for dangerous points is similar.

Revised: Let x be a safe point.

Revised: By definition:

Revised: [Equation]

Revised: Let z ′′ ∈ F M ( x ) be a point such that d ( x, z ′′ ) =

Revised: D ( x, F M ( x ))

Revised: [Equation]

Revised: and let z ′ ∈ F M ( x ) be a point for which the maximum on the expression above is obtained.

Revised: Then, we have:

Revised: [Equation]

Revised: The first inequality (Equation (1)) holds due to the definition of the minimum function.

Revised: The second inequality (Equation (3)) is due to the triangle inequality.

Revised: The last inequality (Equation (5)) holds because, since x is a safe point, the maximal distance between x and z ′ can’t be greater than the distance from x to F M ( x ) .

Revised: Notice that the above bound is tight, in the sense that there exists an example witnessing the exact bound, as shown in Figure 4 below.

Revised: 3.3 PREDICTING CONFIDENCE FROM SEPARATION

Original: At this point, we showed how to calculate geometric separation and fast-separation for points (the latter can be done efﬁciently).
Revised: At this point, we showed how to calculate geometric separation and fast-separation for points (the latter can be done efficiently).

Original: Next, we take the calculated (fast-)separation value and derive a conﬁdence estimation conf .
Revised: Next, we take the calculated (fast-)separation value and derive a confidence estimation conf .

Original: We use a validation set that is disjoint from the train and test sets to calculate for each input S M or S M values.
Revised: We use a validation set that is disjoint from the train and test sets to calculate for each input S M or S M values.

Original: We perform a ﬁtting to map S M or S M values to conﬁdence probabilities.
Revised: We perform a fitting to map S M or S M values to confidence probabilities.

Original: The ﬁtting is done between S M (or S M ) values and the ratios of correct classiﬁcations (on the validation set) for each unique value.
Revised: The fitting is done between S M (or S M ) values and the ratios of correct classifications (on the validation set) for each unique value.

Original: E.g., if for S M value of 10 we see that 90% of the points are classiﬁed correctly then we’ll add the pair (cid:104) 10 , 0 .
Revised: E.g., if for S M value of 10 we see that 90% of the points are classified correctly then we’ll add the pair ⟨ 10 , 0 .

Original: 9 (cid:105) to the ﬁtting function.
Revised: 9 ⟩ to the fitting function.

Original: We expect very low conﬁdence values for highly negative (fast-)separation values, and we expect to approach 100% conﬁdence when the values become positive enough.
Revised: We expect very low confidence values for highly negative (fast-)separation values, and we expect to approach 100% confidence when the values become positive enough.

Original: The regression function we ﬁnally get accepts a (fast-)separation value in R and outputs a scalar in [0 , 1] indicating the conﬁdence estimation, i.e., the predicted success probability for inputs with that (fast-)separation score.
Revised: The regression function we finally get accepts a (fast-)separation value in R and outputs a scalar in [0 , 1] indicating the confidence estimation, i.e., the predicted success probability for inputs with that (fast-)separation score.

Original: In principle, our method can accept most post-hoc calibration methods to perform the ﬁtting.
Revised: In principle, our method can accept most post-hoc calibration methods to perform the fitting.

Original: In this paper, we use isotonic regression as our ﬁtting fuction.
Revised: In this paper, we use isotonic regression as our fitting fuction.

Original: Such a function was shown to work best for the tested workloads both for our geometric signal and for the model’s original signal, as done in [Pedregosa et al., 2011].
Revised: Such a function was shown to work best for the tested workloads both for our geometric signal and for the model’s original signal, as done in [Pedregosa et al., 2011].

Original:  EXPERIMENTAL RESULTS
Revised:  EXPERIMENTAL RESULTS

Original: This section provides experimental results following the method described in the previous section.
Revised: This section provides experimental results following the method described in the previous section.

Original: We ﬁrst introduce the datasets, models, and evaluation criteria and then continue to experimental results.
Revised: We first introduce the datasets, models, and evaluation criteria and then continue to experimental results.

Original: 4.1 METHODOLOGY 4.1.1 Datasets
Revised: 4.1 METHODOLOGY 4.1.1 Datasets

Original: Our evaluation uses the following standard datasets.
Revised: Our evaluation uses the following standard datasets.

Original: • Modiﬁed National Institute of Standards and Technology database (MNIST)
Revised: • Modified National Institute of Standards and Technology database (MNIST)

Original: [LeCun and Cortes, 2010], which consists of hand-written images designed for training various image processing systems.
Revised: [LeCun and Cortes, 2010], which consists of hand-written images designed for training various image processing systems.

Original: It includes 70,000 28×28 grayscale images belonging to one of ten labels.
Revised: It includes 70,000 28×28 grayscale images belonging to one of ten labels.

Original: • Fashion MNIST
Revised: • Fashion MNIST

Original: (Fashion)
Revised: (Fashion)

Original: [Xiao et al., 2017], which is a dataset comprising of 28×28 grayscale images of 70,000 fashion products from 10 categories.
Revised: [Xiao et al., 2017], which is a dataset comprising of 28×28 grayscale images of 70,000 fashion products from 10 categories.

Original: • German Trafﬁc Signs Recognition Benchmark (GTSRB) [Houben et al., 2013], which is a large image set of trafﬁc signs devised for the single-image, multiclass classiﬁcation problem.
Revised: • German Traffic Signs Recognition Benchmark (GTSRB) [Houben et al., 2013], which is a large image set of traffic signs devised for the single-image, multiclass classification problem.

Original: It consists of 50,000 RGB30×30 images of trafﬁc signs, belonging to 43 classes.
Revised: It consists of 50,000 RGB images of traffic signs, belonging to 43 classes.

Original: • American Sign Language (SignLang)
Revised: • American Sign Language (SignLang)

Original: [Techperson, 2017], which is a database of hand gestures representing a multi-class problem with 24 classes of letters.
Revised: [Techperson, 2017], which is a database of hand gestures representing a multi-class problem with 24 classes of letters.

Original: It consist of 30,000 28×28 grayscale images.
Revised: It consist of 30,000 28×28 grayscale images.

Original: • Canadian Institute for Advanced Research (CIFAR10) [A.Krizhevsky et al., 2009], which is a dataset containing 32x32 RGB images of 60,000 objects from 10 classes.
Revised: • Canadian Institute for Advanced Research (CIFAR10) [A.Krizhevsky et al., 2009], which is a dataset containing 32x32 RGB images of 60,000 objects from 10 classes.

Original: For each dataset, we randomly partitioned the data into three subsets: train set Tr (60%), validation set Vs (20%) and test set
Revised: For each dataset 1 , we randomly partitioned the data into three subsets: train set Tr (60%), validation set Vs (20%) and test set

Original: Ts (20%).
Revised: Ts (20%).

Original: The train set is used to calculate fast separation and train the model.
Revised: The train set is used to calculate fast separation and train the model.

Original: The validation set is used to evaluate the conﬁdence estimation associated with each fast-separation value.
Revised: The validation set is used to evaluate the confidence estimation associated with each fast-separation value.

Original: These values, in turn, are used to ﬁt a
Revised: These values, in turn, are used to fit a

Original: Sigmoid function.
Revised: Sigmoid function.

Original: Finally, the test set is used to evaluate the conﬁdence on new inputs that were not present in the train and validation sets.
Revised: Finally, the test set is used to evaluate the confidence on new inputs that were not present in the train and validation sets.

Original: 4.1.2 Models
Revised: 4.1.2 Models

Original: In our evaluation, we use the following popular machine learning models: Random Forest (RF) [Breiman, 2001],
Revised: In our evaluation, we use the following popular machine learning models: Random Forest (RF) [Breiman, 2001],

Original: Gradient Boosting Decision Trees (GBDT)
Revised: Gradient Boosting Decision Trees (GBDT)

Original: [Mason et al., 1999], and Convolutional Neural Network (CNN) [Gu et al., 2018].
Revised: [Mason et al., 1999], and Convolutional Neural Network (CNN) [Gu et al., 2018].

Original: We chose these models because they are different: RF and GBDT are tree-based, while CNN is a neural network.
Revised: We chose these models because they are different: RF and GBDT are tree-based, while CNN is a neural network.

Original: For RF and GBDT, we conﬁgured the meta parameters (e.g., the maximal depth of trees) by cross-validation on the train set.
Revised: For RF and GBDT, we configured the meta parameters (e.g., the maximal depth of trees) by cross-validation on the train set.

Original: For CNN, we used the conﬁguration suggested by practitioners.
Revised: For CNN, we used the configuration suggested by practitioners.

Original: Our speciﬁc conﬁgurations are detailed in https://tinyurl.com/ybx87rtw .
Revised: Our specific configurations as well as the accuracy scores of each of the models are detailed in Leman and Chouraqui [2022].

Original: 4.1.3 Evaluation Criteria
Revised: 4.1.3 Evaluation Criteria

Original: To evaluate our method, we compare our fast-separationbased conﬁdence estimation to: (a) the built-in conﬁdence in the Sklearn library, (b) the scaling-binning calibrator [Kumar et al., 2019] which we call SBC ,and (c) the histogram binning calibrator [Gupta and Ramdas, 2021a] which we call HB  . 
Revised: To evaluate our method, we compare our (fast-)separationbased confidence estimation to: (a) the built-in confidence in the Sklearn library, (b) the scaling-binning calibrator [Kumar et al., 2019] which we call SBC , (c) the histogram binning calibrator [Gupta and Ramdas, 2021a] which we call HB , (d) the temperature scaling calibrator [Guo et al., 2017a] which we call TS , and (e) the ensemble temperature scaling calibrator [Zhang et al., 2020] which we call ETS . TS and ETS are calibration methods for neural networks thus we only apply those to CNNs.

Original: Each method received the same baseline model as an input yielding a slightly different calibrated model.
Revised: Each method received the same baseline model as an input yielding a slightly different calibrated model.

Original: Note that our method is evaluated against the uncalibrated model as our method does not affect the model.
Revised: Note that our method is evaluated against the uncalibrated model as our method does not affect the model.

Original: Moreover, it allows us to compare our method against different calibration methods, as shown in Table 1.
Revised: Moreover, it allows us to compare our method against different calibration methods, as shown in Table 1.

Original: To evaluate the conﬁdence predictions, we use the Expected
Revised: To evaluate the confidence predictions, we use the Expected

Original: Calibration Error (ECE) , which is a standard method to evaluate conﬁdence calibration of a model [Xing et al., 2020,
Revised: Calibration Error (ECE) , which is a standard method to evaluate confidence calibration of a model [Xing et al., 2020,

Original: Krishnan and Tickoo, 2020].
Revised: Krishnan and Tickoo, 2020].

Original: Concretely, the predictions sample of size n are partitioned into M equally spaced  bins ( B m ) m ≤ M , and ECE measures the difference between the sample accuracy in the m th bin and the the average conﬁdence in it [Naeini et al., 2015].
Revised: Concretely, the predictions sample of size n are partitioned into M equally spaced [Figure] bins ( B m ) m ≤ M , and ECE measures the difference between the sample accuracy in the m th bin and the the average confidence in it [Naeini et al., 2015].

Original: Formally, ECE is calculated by the following formula:
Revised: Formally, ECE is calculated by the following formula:

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]

Original: correct

Original: [Equation]

Original: and

Original: [Equation]
Revised: [Equation]

Original: 4.2 FITTING FUNCTION
Revised: 4.2 FITTING FUNCTION

Original: Post-hoc calibration methods based on ﬁtting functions typically use either a logistic (Sigmoid) or an isotonic regression [Zadrozny and Elkan, 2002].
Revised: Post-hoc calibration methods based on fitting functions typically use either a logistic (Sigmoid) or an isotonic regression [Zadrozny and Elkan, 2002].

Original: Isotonic regression ﬁts a non-decreasing free-form line to a sequence of observations.
Revised: Isotonic regression fits a non-decreasing free-form line to a sequence of observations.

Original: In comparison, Sigmoid is a continuous step function.
Revised: In comparison, Sigmoid is a continuous step function.

Original: We used both ﬁtting functions on our (fast-)separation values and obtainedobtained similar accuracy.We opt here to [Table] [Figure]
Revised: We used both fitting functions on our (fast-)separation values and obtained similar accuracy.

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure] [Table] [Figure] present the isotonic regression as it provides the best results, as motivated by Figure 4.
Revised: We opt here to present the isotonic regression as it provides the best results, as motivated by Figure 5.

Original: Figure 4 illustrates an example of the success ratio of the
Revised: Figure 5 illustrates an example of the success ratio of the

Original: Random Forest model for MNIST inputs with varying values of S M scores (similar behavior were observed for the various models and datasets).
Revised: Random Forest model for MNIST inputs with varying values of S M scores (similar behavior were observed for the various models and datasets).

Original: We clustered inputs with a similar score together (into 50 bins overall) as each classiﬁcation is correct or not, and we are looking for the average.
Revised: We clustered inputs with a similar score together (into 50 bins overall) as each classification is correct or not, and we are looking for the average.

Original: The black line represents the Sigmoid function and the green line represents the isotonic regression.
Revised: The black line represents the Sigmoid function and the green line represents the isotonic regression.

Original: As can be observed, both regressions are nearly identical on all the points with positive S M values.
Revised: As can be observed, both regressions are nearly identical on all the points with positive S M values.

Original: We eventually chose isotonic regression because it better ﬁtted the few points with negative S M  values.
Revised: We eventually chose isotonic regression because it better fitted the few points with negative S M [Table] values.

Original: Interestingly, these points were consistently a poor ﬁt for the Sigmoid regression rendering slightly less accurate on average.
Revised: Interestingly, these points were consistently a poor fit for the Sigmoid regression rendering slightly less accurate on average.

Original: Also, observe that the transition is around the value 0, indicating that the distinction of safe and dangerous points is meaningful in conﬁdence evaluation
Revised: Also, observe that the transition is around the value 0, indicating that the distinction of safe and dangerous points is meaningful in confidence evaluation.

Original: [Figure]

Original: 4.3 CONFIDENCE EVALUATION
Revised: 4.3 CONFIDENCE EVALUATION

Original: Table 1 presents the main experimental results of our work.
Revised: Table 1 presents the main experimental results of our work.

Original: The table summarizes ECEs for our method (with bin size 30 ).
Revised: The table summarizes ECEs for our method (with bin size 30 ).

Original: Each entry in the table describes the ECE, the 95% conﬁdence interval, and (in parenthesis) the improvement of our fast-separation-based method over each competitor method.
Revised: Each entry in the table describes the ECE, the 95% confidence interval, and (in parenthesis) the improvement of our fast-separation-based method over each competitor method.

Original: The improvement is calculated using the ratio between the difference between our ECE and the competitor’s ECE.
Revised: The improvement is calculated using the ratio between the difference between our ECE and the competitor’s ECE.

Original: In this experiment, we perform ten random splits of the data into train, validation, and test sets for each model and dataset.
Revised: In this experiment, we perform ten random splits of the data into train, validation, and test sets for each model and dataset.

Original: We then measure the ECE of the conﬁdence estimation for all test set items, average the result and take the 95% conﬁdence intervals.
Revised: We then measure the ECE of the confidence estimation for all test set items, average the result and take the 95% confidence intervals.

Original: First, observe that S M and S M yield very similar ECEs, and that the differences between them are usually statistically insigniﬁcant.
Revised: First, observe that S M and S M yield very similar ECEs, and that the differences between them are usually statistically insignificant.

Original: Thus, we conclude that S M is a very good approximation of S M despite being considerably simpler to compute.
Revised: Thus, we conclude that S M is a very good approximation of S M despite being considerably simpler to compute.

Original: The next interesting comparison is between
Revised: The next interesting comparison is between

Original: S M and SKlearn.
Revised: S M and SKlearn.

Original: We use the same ﬁtting function (Isotonic regression) in both cases, but SKlearn performs the calibration on the model’s natural uncertainty estimation, and S M performs the calibration on geometric distances.
Revised: We use the same fitting function (Isotonic regression) in both cases, but SKlearn performs the calibration on the model’s natural uncertainty estimation, and S M performs the calibration on geometric distances.

Original: Thus, the beneﬁt of our approach stems from the geometric signal and not from the chosen ﬁtting function.
Revised: Thus, the benefit of our approach stems from the geometric signal and not from the chosen fitting function.

Original: [Table]

Original: Observe that our S M improves the conﬁdence estimations consistently and across the board when compared to
Revised: Observe that our S M improves the confidence estimations consistently and across the board when compared to

Original: SKlearn, SBC, and HB.
Revised: SKlearn, SBC, and HB.

Original: Speciﬁcally, we derive improvements up to 99% in all tested models [Table] and for all tested datasets.
Revised: Specifically, we derive improvements up to 99% in all tested models, and for all tested datasets.

Original: Such results demonstrate the potential of geometric signals to improve the effectiveness of uncertainty estimation.
Revised: Such results demonstrate the potential of geometric signals to improve the effectiveness of uncertainty estimation.

Original: 4.4 REAL-TIME COMPUTATION
Revised: 4.4 REAL-TIME COMPUTATION

Original: Table 2 provides the computational advantage of our method.
Revised: Table 2 provides the computational advantage of our method.

Original: We used a Macbook Pro with an Intel Core i5 with four processor cores@2.

Revised: We used a Macbook Pro with an Intel Core i5 with four processor cores@2.

Original: GHz and 8GB RAM in this experiment.
Revised: GHz and 8GB RAM in this experiment.

Original: We measure the throughput of conﬁdence evaluations in predictions per second and the 95% conﬁdence intervals using ﬁve trials for each measurement.
Revised: We measure the throughput of confidence evaluations in predictions per second and the 95% confidence intervals using five trials for each measurement.

Original: Observe that the dominant factor in operation speed is the dataset.
Revised: Observe that the dominant factor in operation speed is the dataset.

Original: These differences are due to variations in training set sizes, where larger training sets result in slower operation.
Revised: These differences are due to variations in training set sizes, where larger training sets result in slower operation.

Original: Importantly, our method runs in 23–46 predictions per second in all but the CIFAR-10 datasets.
Revised: Importantly, our method runs in 23–46 predictions per second in all but the CIFAR-10 datasets.

Original: Such performance is within the ballpark for camera-based applications.
Revised: Such performance is within the ballpark for camera-based applications.

Original: For reference, a TV is broadcast in 60 frames per second, and most animation ﬁlms use up to 24 frames per second.
Revised: For reference, a TV is broadcast in 60 frames per second, and most animation films use up to 24 frames per second.

Original: Thus our performance is within an applicable scale.
Revised: Thus our performance is within an applicable scale.

Original: CIFARis considerably larger, and thus our performance on that dataset is a bit slow.
Revised: CIFARis considerably larger, and thus our performance on that dataset is a bit slow.

Original: While we can also use parallelism to obtain a faster runtime and mitigate this issue, we plan to address larger training sets in future work. 
Revised: While we can also use parallelism to obtain a faster runtime and mitigate this issue, we plan to address larger training sets in future work. [Table]

Original:  CONCLUSION
Revised:  CONCLUSION

Original: Our work uses post-hoc calibration techniques but on a geometry-based signal rather than on the model’s conﬁdence estimation.
Revised: Our work uses post-hoc calibration techniques but on a geometry-based signal rather than on the model’s confidence estimation.

Original: We demonstrated the feasibility of our approach in estimating uncertainty for multiple models, and for multiple datasets.
Revised: We demonstrated the feasibility of our approach in estimating uncertainty for multiple models, and for multiple datasets.

Original: Our evaluation shows that our fastseparation method ( S M ) outperforms post-hoc calibration methods based on the model’s conﬁdence consistently and across the board.
Revised: Our evaluation shows that our fastseparation method ( S M ) outperforms post-hoc calibration methods based on the model’s confidence consistently and across the board.

Original: Our approach reduces the error in conﬁdence estimations by up to 99% compared to alternative methods (depending on the speciﬁc dataset and model).
Revised: Our approach reduces the error in confidence estimations by up to 99% compared to alternative methods (depending on the specific dataset and model).

Original: In addition, we showed that for moderately-sized standard datasets our method achieves near-real time operation.
Revised: In addition, we showed that for moderately-sized standard datasets our method achieves near-real time operation.

Original: As suggested by our analysis and indicated by the experimental results, the complexity of calculating S M depends on the training-set size which implies that very large datasets would be slower, and not run in near real-time.
Revised: As suggested by our analysis and indicated by the experimental results, the complexity of calculating S M depends on the training-set size which implies that very large datasets would be slower, and not run in near real-time.

Revised: Another related limitation of the work presented in this paper is that our current approach requires using also the training set.

Revised: Since shipping the model with as little communication or storage overhead is important, our future research focuses on utilizing a smaller data structure that approximates the entire training set.

Original: In the future, we will develop ways to control thedataset’s effect  on the runtime by calculating conﬁdence estimations only on a subset of the dataset.
Revised: Thus, we will develop ways to control the effect of the dataset size on the run-time by calculating confidence estimations only on a subset of the dataset.

Original: E.g., by pre-processing the data and removing data inputs that are geometrically close to each other.
Revised: E.g., by pre-processing the data and removing data inputs that are geometrically close to each other and reducing the overheads.

Original: Doing so would increase the applicability of our method on larger datasets. In the near future, once anonymity restrictions are lifted, we will make all the code used in this work as an opensource library and pursue the adaptation of our technique into standard machine learning libraries.
Revised: calibrator

Original: In the meanwhile, our code is available at anonymous-Git.
Revised: source code. https //github.com/NoSleepDeveloper https://www.kaggle.com/datamunge mnist