D ETECTING M ISCLASSIFICATION E RRORS IN N EURAL N ETWORKS WITH A G AUSSIAN P ROCESS M ODEL
Anonymous authors
Paper under double-blind review
A BSTRACT
As neural network classiﬁers are deployed in real-world applications, it is crucial that their predictions are not just accurate, but trustworthy as well.
One practical solution is to assign conﬁdence scores to each prediction, then ﬁlter out lowconﬁdence predictions.
However, existing conﬁdence metrics are not yet sufﬁciently reliable for this role.
This paper presents a new framework that produces more reliable conﬁdence scores for detecting misclassiﬁcation errors.
This framework, RED, calibrates the classiﬁer’s inherent conﬁdence indicators and estimates uncertainty of the calibrated conﬁdence scores using Gaussian Processes.
Empirical comparisons with other conﬁdence estimation methods on 125 UCI datasets demonstrate that this approach is effective.
An experiment on a vision task with a large deep learning architecture further conﬁrms that the method can scale up, and a case study involving out-of-distribution and adversarial samples shows potential of the proposed method to improve robustness of neural network classiﬁers more broadly in the future.
I NTRODUCTION
Classiﬁers based on Neural Networks (NNs) are widely deployed in many real-world applications (LeCun et al., 2015; Anjos et al., 2015; Alghoul et al., 2018;
Shahid et al., 2019).
Although good prediction accuracies are achieved, lack of safety guarantees becomes a severe issue when NNs are applied to safety-critical domains, e g., healthcare (Selis¸teanu et al., 2018; Gupta et al., 2007; Shahid et al., 2019), ﬁnance (Dixon et al., 2017), self-driving (Janai et al., 2017; Hecker et al., 2018) etc.
One way to estimate trustworthiness of a classiﬁer prediction is to use its inherent conﬁdence-related score, e.g., the maximum class probability (Hendrycks & Gimpel, 2017), entropy of the softmax outputs (Williams & Renals, 1997), or difference between the highest and second highest activation outputs (Monteith & Martinez, 2010).
However, these scores are unreliable and may even be misleading: high-conﬁdence but erroneous predictions are frequently observed (Provost et al., 1998;
Guo et al., 2017; Nguyen et al., 2015; Goodfellow et al., 2014; Amodei et al., 2016).
In a practical setting, it is beneﬁcial to have a detector that can raise a red ﬂag whenever the predictions are suspicious.
A human observer can then evaluate such predictions, making the classiﬁcation system safer.
In order to construct such a detector, quantitative metrics for measuring predictive reliability under different circumstances are ﬁrst developed, and a warning threshold then be set based on users’ preferred precision-recall tradeoff.
Existing such methods can be categorized into three types based on their focus: error detection, which aims to detect the natural misclassiﬁcations made by the classiﬁer (Hendrycks & Gimpel, 2017; Jiang et al., 2018; Corbi`ere et al., 2019); out-of-distribution (OOD) detection, which reports samples that are from different distributions compared to training data (Liang et al., 2018; Lee et al., 2018a; Devries & Taylor, 2018); and adversarial sample detection, which ﬁlters out samples from adversarial attacks (Lee et al., 2018b; Wang et al., 2019; Aigrain &
Detyniecki, 2019).
Among these categories, error detection, also called misclassiﬁcation detection (Jiang et al., 2018) or failure prediction (Corbi`ere et al., 2019), is the most challenging (Aigrain & Detyniecki, 2019) and underexplored.
For instance, Hendrycks & Gimpel (2017) deﬁned a baseline based on maximum class probability after softmax layer.
Although the baseline performs reasonably well in most testing cases, reduced efﬁcacy in some scenaria indicates room for improvement (Hendrycks & Gimpel,
Jiang et al.
(2018) proposed Trust Score, which measures the similarity between the original classiﬁer and a modiﬁed nearest-neighbor classiﬁer.
The main limitation of this method is scalability: the Trust Score may provide no or negative improvement over the baseline for high-dimensional data.
ConﬁdNet (Corbi`ere et al., 2019) builds a separate NN model to learn the true class probablity, i.e. softmax probability for the ground-truth class.
However, ConﬁdNet itself is a standard
NN, so its conﬁdence scores may be unreliable or misleading: A random input may generate a random conﬁdence score, and ConﬁdNet do not provide any information regarding uncertainty of these conﬁdence scores.
Moreover, none of these methods can differentiate natural classiﬁer errors from risks caused by OOD or adversarial samples; if a detector could do that, it would be easier for practitioners to ﬁx the problem, e.g., by retraining the original classiﬁer or applying better preprocessing techniques to ﬁlter out OOD or adversarial data.
To meet these challenges, a new framework is developed in this paper for error detection in NN classiﬁers.
The main idea is to utilize RIO (Residual, Input, Output; Qiu et al., 2020), a regression model based on Gaussian Processes, on top of the original NN classiﬁer.
Whereas the original RIO is limited to regression problems, the proposed approach extends it to misclassiﬁcation detection by modifying its components.
The new framework not only produces a calibrated conﬁdence score based on the original maximum class probability, but also provides a quantitative uncertainty estimation of that score.
Errors can therefore be detected more reliably.
Note that the proposed method does not change the prediction accuracy of the original classiﬁcation model.
Instead, it provides a quantitative metric that makes it possible to detect misclassiﬁcation errors.
This framework, referred to as RED (RIO for Error Detection), is compared empirically to existing approaches on 125 UCI datasets and on a large-scale deep learning architecture.
The results demonstrate that the approach is effective and robust.
A further case study with OOD and adversarial samples shows the potential of using RED to diagnose the sources of mistakes as well, thereby leading to a possible comprehensive approach for improving trustworthiness of neural network classiﬁers in the future
R ELATED W ORK
In the past two decades, a large volume of work was devoted to calibrating the conﬁdence scores returned by classiﬁers.
Early works include Platt Scaling (Platt, 1999;
Niculescu-Mizil & Caruana, 2005), histogram binning (Zadrozny & Elkan, 2001), isotonic regression (Zadrozny & Elkan, 2002), with recent extensions like Temperature Scaling (Guo et al., 2017), Dirichlet calibration (Kull et al., 2019), and distance-based learning from errors (Xing et al., 2020).
These methods focus on reducing the difference between reported class probability and true accuracy, and generally the rankings of samples are preserved after calibration.
As a result, the separability between correct and incorrect predictions is not improved.
In contrast, RED aims at deriving a score that can differentiate incorrect predictions from correct ones better.
A related direction of work is the development of classiﬁers with rejection/abstention option.
These approaches either introduce new training pipelines/loss functions (Bartlett & Wegkamp, 2008; Yuan & Wegkamp, 2010; Cortes et al., 2016), or deﬁne mechanisms for learning rejection thresholds under certain risk levels (Dubuisson & Masson, 1993; Santos-Pereira & Pires, 2005; Chow, 2006;
Geifman & El-Yaniv, 2017).
In contrast to these methods, RED assumes an existing pretrained NN classiﬁer, and provides an additional metric for detecting potential errors made by this classiﬁer, without specifying a rejection threshold.
Designing metrics for detecting potential risks in NN classiﬁers has also become popular recently.
While most approaches focus on detecting OOD (Liang et al., 2018; Lee et al., 2018a; Devries & Taylor, 2018) or adversarial examples (Lee et al., 2018b; Wang et al., 2019; Aigrain & Detyniecki, 2019), work on detecting natural errors, i.e., regular misclassiﬁcations not caused by external sources, is more limited.
Ortega (1995) and Koppel & Engelson (1996) conducted early work in predicting whether a classiﬁer is going to make mistakes, and Seewald & F¨urnkranz (2001) built a meta-grading classiﬁer based on similar ideas.
However, these early works did not consider NN classiﬁers.
More recently, Hendrycks & Gimpel (2017) and Haldimann et al.
(2019) demonstrated that raw maximum class probability is an effective baseline in error detection, although its performance was reduced in some scenaria.
More elaborate techniques for error detection have also been developed recently.
Mandelbaum &
Weinshall (2017) proposed a conﬁdence score based on the data embedding derived from the penul- timate layer of a NN.
However, their approach requires modifying the training procedure in order to achieve effective embeddings.
Jiang et al.
(2018) introduced Trust Score to measure the similarity between a base classiﬁer and a modiﬁed nearest-neighbor classiﬁer.
Trust Score outperforms the maximum class probability baseline in many cases, but negative improvement over baseline can be observed in high-dimensional problems, implying poor scalability of local distance computations.
ConﬁdNet (Corbi`ere et al., 2019) learns to predict the class probability of true class with another
NN, while Introspection-Net (Aigrain & Detyniecki, 2019) utilizes the logit activations of the original NN classiﬁer to predict its correctness.
Since both models themselves are standard NNs, the conﬁdence scores returned by them may be arbitrarily high without any uncertainty information.
Moreover, existing approaches for error detection cannot differentiate natural misclassiﬁcation error from OOD or adversarial samples, making it difﬁcult to diagnose the sources of risks.
In contrast,
RED explicitly reports its uncertainty about the estimated conﬁdence score, providing more reliable error detection.
The uncertainty information returned by RED may also be helpful in clarifying the cause of classiﬁer mistakes, as will be demonstrated in this paper.
M ETHODOLOGY
This section gives the general problem statement, introduces the basic idea of original RIO, on which
RED is built, and describes the technical details of RED.
3. P ROBLEM S TATEMENT
Consider a training dataset D =
( X , y )
= { ( x i , y i ) }
Ni =1 , and a pretrained NN classiﬁer that outputs a predicted label
ˆ y i and class probabilities for each class σ i =
[ˆ p i, 1 , ˆ p
i, 2 , . . .
, ˆ p i,K ] given x i , where
N is the total number of training points and K is the total number of classes.
The problem is to develop a metric that can serve as a quantitative indicator for detecting natural misclassiﬁcation errors made by the pretrained NN classiﬁer
. 3. RIO
The original RIO (Qiu et al., 2020) was developed to quantify point-prediction uncertainty in regression models.
More speciﬁcally, RIO ﬁts a Gaussian Process (GP) to predict the residuals, i.e. the differences between ground-truth and original model predictions.
It utilizes an I/O kernel, i.e. a composite of an input kernel and an output kernel, thus taking into account both inputs and outputs of the original regression model.
As a result, it measures the covariances between data points in both the original feature space and the original model output space.
For each new data point, a trained RIO model takes the original input and output of the base regression model, and predicts a distribution of the residual, which can be added back to the original model prediction to obtain both a calibrated prediction and the corresponding predictive uncertainty.
In the original RIO work, SVGP (Hensman et al., 2013; 2015) was used as an approximate GP to improve the scalability of the approach.
Both empirical results and theoretical analysis showed that RIO is able to consistently improve the prediction accuracy of base model as well as provide reliable uncertainty estimation.
Moreover, RIO can be directly applied on top of any pre-trained models without retraining or modiﬁcation.
It therefore forms a promising foundation for improving reliability of error detection metrics as well.
3. RIO FOR E RROR D ETECTION (RED)
Although RIO performs robustly in a wide variety of regression problems, it cannot be directly applied to classiﬁcation models.
A new framework, namely RED, is proposed to utilize RIO for error detection in classiﬁcation domains.
Building on the fact that the original maximum class probability is a strong baseline for error detection (Hendrycks & Gimpel, 2017; Haldimann et al., 2019), the main idea of RED is to derive a more reliable conﬁdence score by stacking RIO on top of the original maximum class probability.
Since
RIO was designed for single-output regression problems, it contains an output kernel only for scalar outputs.
In RED, this original output kernel is extended to multiple outputs, i.e. to vector outputs
[Figure]
Algorithm
Require:
( X , y )
= { ( x i , y i ) }
Ni =1 : training data ˆy = { ˆ y i } Ni =1 : labels predicted by original NN classiﬁer on training data σ = { σ i
=
[ˆ p i, 1 , ˆ p
i, 2 , . . .
, ˆ p i,K ] } Ni =1 : softmax outputs of original NN classiﬁer on training data ˆc
= { ˆ c i = max( σ i ) } Ni =1 : maximum class probability returned by original NN classiﬁer on training data x ∗ : data to be predicted σ ∗ : softmax outputs of original NN classiﬁer on x ∗
ˆ c ∗ : maximum class probability returned by original NN classiﬁer on x ∗ Ensure: ˆ c (cid:48)∗ ∼ N (ˆ c ∗ + ¯ˆ r ∗ , var(ˆ r ∗ ))
: ˆ c ∗ + ¯ˆ r ∗ can be used as conﬁdence score for error detection, and var(ˆ r ∗ ) represents the uncertainty of returned conﬁdence score
1: obtain target conﬁdence score c
= { c i =
δ y
i , ˆ y i } Ni =1 , where δ y i , ˆ y
i is the Kronecker delta ( δ y
i , ˆ y i =
if y i
= ˆ y i ,
otherwise δ y
i , ˆ y i = 0 ) 2: calculate residuals r
= { r i
=
c i − ˆ c i } Ni = 3: for each optimizer step do 4: calculate covariance matrix K c (( X , σ ) , ( X , σ )) , where each entry is given by k c (( x i , σ i ) , ( x j , σ j ))
=
k in ( x i , x j ) + k out ( σ i , σ j ) , for i, j = 1 , 2 , . .
, N 5: optimize GP hyperparameters by maximizing log marginal likelihood log p ( r |X , σ )
= − 12 r (cid:62) ( K c (( X , σ ) , ( X , σ ))
+ σ 2 n I ) − 1 r − 12 log | K c (( X , σ ) , ( X , σ ))
+ σ 2 n I | − n 2 log 2 π
Deployment Phase: 6: calculate residual mean ¯ˆ r ∗ =
k (cid:62)∗ ( K c (( X , σ ) , ( X , σ ))
+ σ 2 n I ) − 1 r and residual variance var(ˆ r ∗ ) =
k c (( x ∗ , σ ∗ ) , ( x ∗ , σ ∗ ))
− k (cid:62)∗ ( K c (( X , σ ) , ( X , σ ))
+ σ 2 n I ) − 1 k ∗ , where k ∗ denotes the vector of kernel-based covariances (i.e., k c ( x ∗ , x i ) ) between x ∗ and all the training points 7: return distribution of calibrated conﬁdence score ˆ c (cid:48)∗ ∼ N (ˆ c ∗ + ¯ˆ r ∗ , var(ˆ r ∗ )) such as those of the ﬁnal softmax layer of a NN classifer, representing estimated class probabilities for each class.
This modiﬁcation allows RIO to access more information from the classiﬁer outputs.
The targets for RIO training need to be redesigned as well.
The raw targets of a classiﬁcation problem are the ground-truth labels; they are in categorical space, while RIO works in continuous space.
To solve this issue, RED constructs a different problem: Instead of predicting the labels directly, it predicts whether the original prediction is correct or not.
A target conﬁdence score is assigned to each training data point accordingly.
The residual between this target conﬁdence score and the originally returned maximum class probability is calculated, and a RIO model is trained to predict these residuals.
Given a new data point, the trained RIO model combined with the original
NN classiﬁer thus provides a calibrated conﬁdence score for detecting misclassiﬁcation errors.
Figure 1 illustrates the RED training and deployment processes conceptually, and Algorithm 1 speciﬁes them in detail.
In the training phase, the ﬁrst step is to deﬁne a target conﬁdence score
c
i for each training sample ( x i , y i ) .
For simplicity, all training samples that are correctly predicted by the original NN classiﬁer receive 1 as the target conﬁdence score, and those that are incorrectly predicted receive 0.
The validation dataset during the original NN training is included in the training dataset for RED.
After the target conﬁdence scores are assigned, a regression problem is formulated for the RIO model:
Given the original raw features { x i } Ni =1 and the corresponding softmax outputs of the original NN classiﬁer { σ i =
[ˆ p i, 1 , ˆ p
i, 2 , . . .
, ˆ p i,K ] } Ni =1 , predict the residuals r = { r i
=
c i − ˆ c i } ni =1 between target conﬁdence scores c = { c i } Ni =1 and the original maximum class probabilities ˆc
= { ˆ c i = max( σ i ) } Ni =1 .
The RIO model relies on an I/O kernel consisting of two components: the input kernel k in ( x i , x j ) , which measures covariances in the raw feature space, and the modiﬁed multi-output kernel k out ( σ i , σ j ) , which calculates covariances in the softmax output space.
The hyperparameters of the I/O kernel are optimized to maximize the log marginal likelihood log p ( r |X , σ ) .
In the deployment phase, given a new data point x ∗ , the trained RIO model provides a Gaussian distribution for the estimated residual ˆ r ∗ ∼ N (¯ˆ r ∗ , var(ˆ r ∗ )) .
By adding the estimated residual back to the original maximum class probability ˆ c ∗ , a distribution of calibrated conﬁdence score is obtained as ˆ c (cid:48)∗ ∼ N (ˆ c ∗ + ¯ˆ r ∗ , var(ˆ r ∗ )) .
The mean ˆ c ∗ + ¯ˆ r ∗ can be directly used as a quantitative metric for error detection, and the variance var(ˆ r ∗ ) represents the corresponding uncertainty of the conﬁdence score.
E MPIRICAL E VALUATION
In this section, the error detection performance of RED is evaluated comprehensively on 125 UCI datasets, comparing it to other related methods.
Its generality is then evaluated by applying it to two other base models, and its scale-up properties measured in a larger deep learning architecture and in a larger task. Finally, RED’s potential to improve robustness more broadly is demonstrated in a case study focusing on OOD and adversarial samples.
4. C OMPARISONS WITH R ELATED A PPROACHES
As a comprehensive evaluation of RED, an empirical comparison with seven related approaches on 125 UCI datasets (Dua & Graff, 2017) was performed.
These approaches include maximum class probability baseline (MCP; Hendrycks & Gimpel, 2017), three state-of-the-art approaches, namely
Trust Score (Jiang et al., 2018), ConﬁdNet (Corbi ` ere et al., 2019), and Introspection-Net (Aigrain & Detyniecki, 2019), as well as three earlier approaches, i.e. entropy of the original softmax outputs (Steinhardt & Liang, 2016), DNGO (Snoek et al., 2015), and the original SVGP (Hensman et al., 2013; 2015).
The 125 UCI datasets include 121 datasets used by Klambauer et al.
(2017) and four more recent ones.
Full details about the datasets and parametric setup of all tested algorithms, and a downloadable link for source codes are provided in Appendix A.1.
Following the experimental setup of Hendrycks & Gimpel (2017); Corbi`ere et al.
; Aigrain &
Detyniecki (2019), the task for each algorithm is to provide a conﬁdence score for each testing point.
An error detector can then use a predeﬁned ﬁxed threshold on this score to decide which points are probably misclassiﬁed by the original NN classiﬁer.
For RED, the mean of calibrated conﬁdence score ˆ c ∗ + ¯ˆ r ∗ was used as the reported conﬁdence score.
Five threshold-independent performance metrics were used to compare the methods: AUPR-Error, which computes the area under the Precision-Recall (AUPR) Curve when treating incorrect predictions as positive class during the detection; AUPR-Success, which is similar to AUPR-Error but uses correct predictions as positive class; AUROC, which computes the area under receiver operating characteristic (ROC) curve for the error detection task; AP-Error, which computes the average precision (AP) under different thresholds treating incorrect predictions as positive class; and AP-Success, which is similar to AP-Error but uses correct predictions as positive class.
AUPR and AUROC are commonly used in prior work (Hendrycks & Gimpel, 2017; Corbi`ere et al., 2019; Aigrain & De-
[Table] [Table]
tyniecki, 2019)
[Table]
but as discussed by Davis & Goadrich (2006) and Flach & Kull (2015), AUPR may provide overly-optimistic measurement of performance.
To compensate for this issue, AP-Error and
AP-Success are included as additional metrics.
Since the target for the conﬁdence metrics is to detect misclassiﬁcation errors, the following discussion will focus more on AP-Error and AUPR-Error.
Ten independent runs were conducted for each dataset.
During each run, the dataset was randomly split into training dataset and testing dataset
[Table]
and a standard NN classiﬁer trained and evaluated on them.
The same dataset split and trained NN classiﬁer was used to evaluate all methods.
Full details of the experimental setup are provided in Appendix A.1.
Table 1 shows the ranks of each algorithm averaged over all 125 UCI datasets.
The rank of each algorithm on each dataset is based on the average performance over 10 independent runs.
RED performs best on all metrics; the performance differences between RED and all other methods are statistically signiﬁcant under paired t -test and Wilcoxon test.
Trust Score has the highest standard deviation, suggesting that its performance varies signiﬁcantly across different datasets.
As a more detailed comparison, Table 2 shows how often RED performs statistically signiﬁcantly better, how often the performance is not signiﬁcantly different, and how often it performs signiﬁcantly worse than the other methods.
RED is most often signiﬁcantly better, and very rarely worse.
In a handful of datasets Trust Score is better, but most often it is not.
To illustrate the performance of RED further compared to the baseline and the three state-of-theart approaches, Figure 2 shows the distribution of the relative rank of RED, MCP baseline, Trust Score, ConﬁdNet and Introspection-Net as a function of the number of samples and the number of features in the dataset.
These plots are based on the AP-Error metric; other metrics provide similar results.
RED performs consistently well over different dataset sizes and feature dimensionalities.
Trust Score performs best in several datasets, but occasionally also worst in both small and large datasets, making it a rather unreliable choice.
ConﬁdNet generally exhibits worse performance on datasets with large dataset sizes and high feature dimensionalities, i.e. it does not scale well to larger problems.
[Figure]
[Table] 4. G ENERALITY WRT . B ASE M ODELS To evaluate generality and robustness of RED, it was applied to two other base models: an NN classiﬁer using MC-dropout technique (Gal & Ghahramani, 2016) and a Bayesian Neural Network (BNN) classiﬁer (Wen et al., 2018).
They were each trained as base classiﬁers, and RED was then applied to each of them (implementation details are provided in Appendix A.1).
Experiments analogous to those in Table 2 were performed on 125 UCI datasets in both cases.
Table 3 shows the pairwise comparisons between RED and the internal conﬁdence scores returned by the base models.
MCP and Entropy represent the maximum class probability and entropy of softmax outputs, respectively, after averaging over 100 test-time samplings.
RED signiﬁcantly improves MC-dropout and BNN classiﬁer in most datasets, demonstrating that it is a general technique that can be applied to a variety of models.
4. S CALING UP TO L ARGER A RCHITECTURES
To conﬁrm that the RED approach scales up to large deep learning architectures, a VGG16 model (Simonyan & Zisserman, 2015) was trained on the CIFAR-10 dataset using a state-of-the-art training pipeline (see Appendix A.2 for details).
In order to remove the inﬂuence of feature extraction in image preprocessing and to make the comparison fair, all approaches used the same logit outputs of the trained VGG16 model as their input features.
10 independent runs are performed.
During each run, a VGG16 model is trained, and all the methods are evaluated based on this VGG16 model.
Table 4 shows the results on the two main error detection performance metrics (note that the table lists absolute values instead of rankings along each metric).
Trust Score performs much better than in previous literatures (Corbi`ere et al., 2019).
This difference may be due to the fact that logit outputs are used as input features here, whereas Corbi`ere et al.
(2019) utilized a higher dimensional feature space for Trust Score.
Based on the results, RED signiﬁcantly outperforms all the counterparts in both metrics.
This result demonstrates the advantages of RED in scaling up to larger architectures.
[Table]
[Figure]
[Table]
[Figure]
hand, indicates that RED is uncertain about its conﬁdence score, which can be used to identify OOD and adversarial samples.
In this manner, RED can serve as a foundation for improving robustness of classiﬁers more broadly in the future.
4. A C ASE S TUDY WITH OOD AND A DVERSARIAL S AMPLES
In all experiments so far, the mean of calibrated conﬁdence score ˆ c ∗ + ¯ˆ r ∗ was used as RED’s conﬁdence score.
Although good performance is observed in error detection by only using the mean, the variance of calibrated conﬁdence score var(ˆ r ∗ ) may be helpful if the scenario is more complex, e.g., the dataset includes some OOD data, or even adversarial data.
A preliminary investigation of RED in such scenaria was performed by manually adding OOD and adversarial data into the test set of the UCI ”annealing” dataset, on which RED detected errors well.
The synthetic OOD and adversarial samples were created to be highly deceptive, aiming to evaluate the performance of RED under difﬁcult circumstances.
The OOD data were sampled from a
Gaussian distribution with mean 0 and variance 1, and the number of added OOD data was the same as the number of samples in the original test set.
Note that all data points from original dataset are normalized to have mean 0 and variance 1 for each feature dimension during preprocessing, so the
OOD data and in-distribution data have similar scales.
The adversarial data was created by adding negligible modiﬁcations to training samples that the original NN classiﬁer predicted incorrectly with highest conﬁdence.
This process mimics an adversary that can arbitrarily alter the output of the NN classiﬁer with minuscule changes to the input (Goodfellow et al., 2014).
Figure 3 shows the distribution of mean and variance of calibrated conﬁdence scores for testing samples, including correctly and incorrectly labeled actual samples, as well as the synthetic OOD and adversarial samples.
The mean is a good separator for correctly classiﬁed and incorrectly classiﬁed samples, which tend to cluster on the top and bottom half of the image, respectively.
On the other hand, variance is a promising indicator of OOD and adversarial samples.
RED’s conﬁdence scores of in-distribution samples have low variance because they covary with the training samples.
The variance thus represents RED’s conﬁdence in its conﬁdence score.
Samples with large variance indicate that RED is uncertain about its conﬁdence score, which can be used as a basis for detecting
OOD and adversarial samples.
Thus, although the main focus of this paper is to demonstrate RED on misclassiﬁcation detection, the preliminary results in this subsection show that it provides a promising foundation for detecting other error types as well.
D ISCUSSION AND F UTURE W ORK
One interesting observation from the experiments is that RED almost never performs worse than the MCP baseline.
This result suggests that there is almost no risk in applying RED on top of an existing NN classiﬁer.
Since RED is based on a GP model, the estimated residual ¯ˆ r ∗ is close to zero if the predicted sample is far from the distribution of the original training samples, resulting in no change to the original MCP.
In other words, RED does not make random changes to original
MCP if it is very uncertain about the predicted sample, and this uncertainty is explicitly represented in the variance of the estimated conﬁdence score.
This property makes RED a particularly reliable technique for error detection.
Another interesting observation is that the variance is also helpful in detecting OOD and adversarial samples.
This result follows from the design of the RIO uncertainty model.
Since RIO in RED has an input kernel and an output kernel, lower estimated variance requires that the predicted sample is close to training samples in both the input feature space and the classiﬁer output space.
This requirement is difﬁcult for OOD and adversarial attacks to achieve, providing a basis for detecting them.
In a real-world deployment, it is necessary to deﬁne a threshold for triggering error warning based on RED’s conﬁdence scores.
A practical way is to use a validation dataset to determine how the precision/recall tradeoff changes over different thresholds.
The user can then select a threshold based on their preference.
The most compelling direction of future work is to extend this capability of RED further.
Instead of using a single dimensional conﬁdence score for error detection, it is possible to use mean and variance simultaneously, leading to a two dimensional detection space.
Further separation between
OOD and adversarial samples may be possible by adding one more dimension, such as the ratio between input kernel output and output kernel output.
Also, instead of using a hard target conﬁdence score (i.e. either 0 or 1), it may be possible to deﬁne a soft target conﬁdence that may be more informative.
Further, RED may be used to calibrate other existing conﬁdence metrics, such as the
Trust Score, which may lead to a further improvement in detection performance.
C ONCLUSION
This paper introduced a new framework, RED, for error detection in neural network classiﬁers that can produce a more reliable conﬁdence score than previous methods.
RED is able to not only provide a calibrated conﬁdence score, but also report the uncertainty of the estimated conﬁdence score.
Experimental results show that RED’s scores consistently outperform state-of-the-art methods in separating the misclassiﬁed samples from correctly classiﬁed samples.
Preliminary experiments also demonstrate that the approach scales up to large deep learning architectures, and can form a basis for detecting OOD and adversarial samples as well.
It is therefore a promising foundation for improving robustness of neural network classiﬁers.
A A PPENDIX A. E XPERIMENTAL S ETUP FOR S ECTION 4.1 AND S ECTION 4.
General Information 10 indenpendent runs are performed for each dataset.
During each run, the dataset is randomly split into a training set ( 80% ) and a testing set ( 20% ), then a fully connected feedforward NN classiﬁer with 2 hidden layers, each with 64 hidden neurons, are trained on the training set.
The activation function is ReLU for all the hidden layers.
The maximum number of epochs for training is 1000.
20% of the training set is used as validation set, and the split is random at each independent run.
An early stop is triggered if the loss on validation set has not be improved for 10 epochs.
The optimizer is Adam with learning rate 0.001, β 1 = 0 .
9 , and β 2 = 0 .
The loss function is cross entropy loss.
During each independent run, the same random dataset split and trained base NN classiﬁer is used for evaluating all algorithms.
All source codes for reproducing the experimental results can be downloaded from (https://drive.google.com/drive/folders/1X5R6sEkjmucR7B4MvFrY6QnCvos6a7n?usp=sharing).
Dataset Description
In total, 125 UCI datasets are used in the experiments, among which 121 are from Klambauer et al.
(2017), and 4 are recent datasets released in Dua & Graff (2017).
All features in all datasets are normalized to have mean 0 and standard deviation 1.
Full details regarding the number of samples N, number of features M, and number of classes K for each dataset are shown in
Table 5.
Parametric Setup for Algorithms
• RED: SVGP (Hensman et al., 2013; 2015) is used as an approximator to original GP.
The number of inducing points are 50.
RBF kernel is used for both input and multi-output kernel.
Automatic Relevance Determination (ARD ) feature is turned on.
The signal variances and length scales of all the kernels plus the noise variance are the trainable hyperparameters.
The optimizer is L-BFGS-B with default parameters as in Scipy.optimize documentation (https://docs.scipy.org/doc/scipy/reference/optimize.minimize-lbfgsb.html), and the maximum number of iterations is set as 1000.
The optimization process runs until the
L-BFGS-B optimizer decides to stop.
To overcome the sensitivity of GP optimization to initialization of the hyperparameters (Ulapane et al., 2020), 20 random initialization of the hyperparameters are tried for each independent run.
For each random initialization, the signal variances are generated from a uniform distribution within interval [0 , 1] , and the lengthscales are generated from a uniform distribution within interval [0 , 10] .
For 10 initializations, the hyperparameters of input kernel are ﬁrst optimized while the multi-output kernel is temporarily turned off, then after the optimizer stops, the multi-output kernel is turned on, and both the two kernels are optimized simultaneously.
For the other 10 initializations, both kernels are optimized simultaneouly from the start.
The average performance of the 3 best optimized model in terms of corresponding metrics are used as the ﬁnal performance of RED on each independent run.
During our preliminary investigation, several statistic metrics on training set is effective in picking the true best-performing model out of these 20 trials, e.g., the gap between average estimated conﬁdence scores of correctly classiﬁed training samples and incorrectly classiﬁed training samples, the scale of optimized noise variance of SVGP model, the ratio between sum of signal variances and noise variance after optimization, etc.
Since improving initialization and optimization of GP hyperparameters is out of the scope of this work, we simply use average performance of the best 3 models (top 15% ) in comparison.
• MCP baseline: The maximum class probability of softmax outputs of the base NN classiﬁer is used as the conﬁdence score of MCP baseline.
The setup of the base NN classiﬁer is provided above.
• Trust Score: k=10, α = 0 , without ﬁltering.
This is the same as the default setup in https://github.com/google/TrustScore.
ConﬁdNet: During training, the input to ConﬁdNet is the raw feature, and the target is the class probability of the ground-truth class returned by base NN classiﬁer.
The architecture of ConﬁdNet is a fully connected feed-forward NN regressor with 2 hidden layers, each with 64 hidden neurons.
The activation function is ReLU for all the hidden layers.
The maximum number of epochs for training is 1000.
An early stop is triggered if the loss on validation data has not be improved for 10 epochs.
The optimizer is RMSprop with learning rate 0.001, and the loss function is mean squared error (MSE).
• Introspection-Net: During training, the input to Introspection-Net is the logit outputs of base NN classiﬁer, and the target is 1 for correctly classiﬁed sample, and 0 for incorrectly classiﬁed sample.
The architecture of ConﬁdNet is a fully connected feed-forward NN regressor with 2 hidden layers, each with 64 hidden neurons.
The activation function is ReLU for all the hidden layers.
The maximum number of epochs for training is 1000.
An early stop is triggered if the loss on validation data has not be improved for 10 epochs.
The optimizer is RMSprop with learning rate 0.001, and the loss function is mean squared error (MSE).
• Entropy: The entropy of softmax outputs of the base NN classiﬁer is used as the conﬁdence score of Entropy.
THe setup of the base NN classiﬁer is provided above.
• DNGO: A Bayesian linear regression layer similar to that of Snoek et al. (2015) is added after the logits layer of the original NN classiﬁer to predict whether an original prediction is correct or not (1 for correct and 0 for incorrect).
Default parametric setup, as in https://github.com/automl/pybnn/blob/master/pybnn/dngo.py, is used.
• SVGP: The original SVGP without output kernel is used to predict directly whether a prediction made by the base NN classiﬁer is correct or not (1 for correct and 0 for incorrect).
All other parameters are identical to those in RED.
• BNN MCP: The standard dense layers in the base NN classiﬁer described in RED setup above is replaced with Flipout layers (Wen et al., 2018).
All other parameters are identical with those in RED.
The maximum class probability averaging over 100 test-time samplings is used as the conﬁdence score for error detection.
• BNN Entropy: The same setup as with BNN MCP, except now the entropy of softmax outputs averaging over 100 test-time samplings is used as the conﬁdence score for error detection.
• MC-Dropout MCP: A dropout layer with dropout rate of 0.5 is added after each dense layer of the base NN classiﬁer described in the RED setup.
All other parameters are identical with those in RED.
The maximum class probability averaging over 100 test-time MonteCarlo samplings is used as the conﬁdence score for error detection.
• MC-Dropout Entropy: The same setup as with MC-Dropout MCP, except now the entropy of softmax outputs is averaged over 100 test-time Monte-Carlo samplings and used as conﬁdence score for error detection.
A. E XPERIMENTAL S ETUP FOR S ECTION 4.
Setup of VGG16 Training The standard VGG16 architecture (Simonyan & Zisserman, 2015) is used.
The training pipeline is based on the default setup described in https://github.com/geifmany/cifar-vgg/blob/master/cifar10vgg.py.
For the CIFAR-10 dataset, 40,000 samples are used as the training set, 10,000 as the validation set, and 10,000 as the testing set.
Parametric Setup for Algorithms All algorithms use the logit outputs of the trained VGG model as input features.
The maximum class probability of softmax outputs of the trained VGG model is used as the conﬁdence score of MCP baseline.
The parameters for RED, Trust Score,
Entropy, DNGO and SVGP are identical to those in the UCI experiments.
For ConﬁdNet and
Introspection-Net, all parameters are the same as in the UCI experiments, except for that the number of hidden neurons for all hidden layers is increased to 128.
A. D ETAILED R ESULTS FOR S ECTION 4.1 AND S ECTION 4.
This subsection shows all the detailed results for experiments performed in Section 4.1 and Sec- tion 4.2.
The results are averaged over 10 independent runs in terms of AP-Error, AP-Success, AUPR-Error, AUPR-Success, and AUROC.
Detailed results for Section 4.1 are shown in Table 5, Table 6, Table 7, Table 8, and Table9.
Detailed results for Section 4.2 are shown in Table 10, Table 11, Table 12, Table 13, and Table14.
Each table is corresponding to one performance metric.
The column ”N”, ”M”, and ”K” denotes the number of samples, number of features, and number of classes for corresponding datasets.
To save space, ”MCP”, ”Intro-Net”, ”MC-D” stands for ”MCP Baseline”, ”Introspection-Net”, and ”MC-Dropout”, respectively.
For datasets that the original NN classiﬁer achieves 100% accuracy, the entries are marked as ”NA”.
For dataset splits that the number of samples in one particular class is too small for Trust Score to calculate neighborhood distance, the entries are marked as ”NA”.
[Table]
[Table]
Continued on next page.
[Table]
0.445 image-segmentation   0.539 0.
0.139 ionosphere   0.543 0.
0.171 iris   0.686 0.
0.227 led-display  10 0.572 0.
0.470 lenses   0.875 0.
0.587 letter  26 0.495 0.
0.164 libras  15 0.602 0.
0.279 low-res-spect   0.552 0.
0.343 lung-cancer   0.887 0.
0.582 lymphography   0.660 0.
0.363 magic   0.366 0.
{+0.233 mammographic   0.
+}
[Table] [Table]
402 messidor
[Table] [Table]
[Table] [Table] [Table] 175 mushroom
[Table]
[Table]
[Table]
nursery
[Table]
[Table]
0.715 ringnorm   0.348 0.
0.027 seeds   0.583 0.
0.345 semeion 256 10 0.541 0.
0.142 soybean  18 0.573 0.
0.319 spambase   0.316 0.
0.139 spect   0.520 0.
0.434 spectf   0.478 0. 0.346 statlog-australian-credit   0.473 0. 0.430 statlog-german-credit   0.423 0. 0.254 statlog-heart   0.471 0.
Continued on next page.
[Table]
[Table]
[Table]
[Table]
[Table]
car
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] Continued on next page.
[Table] 0.826 magic   0.966 0. 0.946 mammographic   0.922 0.
0.926 messidor   0.863 0. 0.806 miniboone 130064 0.992 0. 0.981 molec-biol-promoter   0.892 0. 0.822 molec-biol-splice   0.953 0.
0.838 monks0.998 0. 0.995 monks0.885 0. 0.808 monks0.999 0. 0.991 mushroom
NA NA NA
NA NA NA NA
NA
[Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table]
teaching
[Table] [Table] [Table]
0.996 tic-tac-toe   1.000 0. 0.999 titanic   0.877 0.
0.877 trains   0.778 0. 0.750 twonorm   0.998 0. 0.973 vertebral-column-2clases   0.977 0. 0.937 vertebral-column-3clases   0.978 0.
0.953 wall-following   0.980 0. 0.933 waveform   0.968 0. 0.848 waveform-noise   0.962 0. 0.844 wine   0.999 0.
0.978 wine-quality-red   0.
[Table]
Continued on next page.
[Table]
from previous page
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
0.162 libras  15 0.586 0.
[Table] [Table]
{+0.479 lymphography   0.641 0. 0.323 magic   0.
 [Table] [Table]+}
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
0.171 monks
[Table] [Table]
0.149 monks
[Table]
NA NA NA
NA NA NA
NA
NA
[Table] [Table]
314 semeion
[Table]
132 soybean
[Table]
289 spambase
[Table]
[Table] [Table]
[Table] [Table]
131 spect
[Table] [Table]
spectf
[Table] [Table]
[Table]
304 statlog
[Table]
[Table] [Table] [Table] Continued on
[Table]
[Table] [Table]
[Table] [Table]
hepatitis
[Table] [Table]
-valley
[Table] [Table] [Table]
[Table]
-colic
[Table] [Table]
[Table]
ilpd
[Table] [Table]
[Table]
985 ionosphere
[Table]
933 iris
[Table]
[Table]
-display
[Table]
lenses
[Table]
[Table]
[Table]
0.982 libras  15 0.955 0. 0.848 low-res-spect   0.977 0.
0.949 lung-cancer   0.728 0. 0.356 lymphography   0.939 0. 0.817 magic   0.966 0. 0.946 mammographic   0.922 0.
0.925 messidor   0.862 0.
0.805 miniboone 130064 0.992 0.
0.981 molec-biol-promoter   0.886 0.
[Table]
[Table]
0.945 optical  10 0.999 0. 0.992 ozone   0.994 0.
0.951 page-blocks   0.998 0. 0.994 parkinsons   0.994 0. 0.963 pendigits  10 0.999 0.
0.993 phishing   0.975 0. 0.952 pima   0.897 0. 0.869 pittsburg-bridges-MATERIAL   0.975 0.
0.936 pittsburg-bridges-REL-L   0.776 0. 0.755 pittsburg-bridges-SPAN   0.842 0. 0.695 pittsburg-bridges-T-OR-D [Table]
Continued on next page. [Table] Continued from previous page. [Table]
[Table] [Table] [Table] [Table]
[Table] [Table]
[Table] [Table] Continued on next page. [Table]
0.455 hepatitis   0.822 0.
0.677 hill-valley   0.712 0.
0.627 horse-colic   0.743 0.
0.568 ilpd-indian-liver [Table] [Table] [Table]
[Table]
709 image-segmentation   0.935 0.
[Table]
749 ionosphere   0.
[Table]
[Table]
[Table]
535 iris
[Table]
[Table]
0.612 led-display  10 0.762 0.
0.700 lenses   0.
[Table]
[Table]
0.583 letter  26 0.932 0.
0.775 libras
[Table]
[Table]
[Table]
[Table]
[Table]
562 low-
[Table]
-spect
[Table]
717 lung-cancer
[Table]
[Table]
304 lymphography
[Table]
[Table]
566 magic
[Table]
720 mammographic
[Table]
[Table]
755 messidor
[Table]
[Table]
[Table]
{+601 miniboone 
+}
[Table]
783 molec-biol-promoter
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
501 monks-
[Table]
[Table]
[Table]
[Table]
0.546 optical  10 0.970 0.
0.703 ozone   0.899 0.
0.315 page-blocks   0.952 0.
0.861 parkinsons   0.918 0.
0.666 pendigits  10 0.951 0.
0.660 phishing   0.859 0.
0.766 pima   0.754 0.
0.653 pittsburg-bridges-MATERIAL   0.848 0.
0.692 pittsburg-bridges-REL-L   0.643 0.
0.604 pittsburg-bridges-SPAN   0.689 0.
0.488 pittsburg-bridges-T-OR-D   0.
[Table]
[Table]
soybean
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
Continued on next page. [Table] [Table] 0.548 horse-colic   0.
0.397 ilpd-indian-liver   0. 0.472 image-segmentation   0.
0.406 ionosphere   0.
0.394 iris   0.
0.705 led-display   0.
0.523 lenses   0. 0.854 letter   0.
Continued on next page.
[Table]
0.801 ringnorm   0. 0.377 seeds   0.
0.657 semeion 2560. 0.499 soybean   0. 0.410 spambase   0.
0.377 spect   0. 0.518 spectf   0. 0.355 statlog-australian-credit   0.
0.421 statlog-german-credit   0. 0.422 statlog-heart   0. 0.395 statlog-image   0. 0.403 statlog-landsat   0.
0.380 statlog-shuttle   0.
[Table]
Continued from previous page.
[Table] [Table] [Table] 957 conn-bench-vowel-deterding
[Table]
connect-
[Table]
contrac
[Table] [Table]
-approval
[Table]
-bands
[Table]
echocardiogram
[Table]
950 ecoli
[Table] [Table] [Table]
[Table] fertility [Table] [Table]
728 glass [Table] [Table]
0.997 led-display   0.
0.879 lenses   0.
0.935 letter   0.
0.980 libras   0.
0.925 low-res-spect   0.
0.984 lung-cancer   0.
0.592 lymphography   0.
0.934 magic   0.
0.967 mammographic   0.
0.920 messidor   0.
0.870 miniboone 130064 0.
0.993 molec-biol-promoter   0.
0.901 molec-biol-splice   0.
[Table]
Continued on next page.
[Table]
[Table]
Continued on next page.
[Table]
0.508 hill-valley   0.
0.543 horse-colic   0.
0.372 ilpd-indian-liver   0.
[Table]
0.457 image-segmentation
[Table]
[Table]
[Table]
[Table]
0.382 ionosphere
[Table]
[Table]
[Table]
[Table]
0.314 iris
[Table]
[Table]
0.619 led-display   0.
[Table]
0.513 lenses
[Table]
[Table]
[Table]
[Table] [Table]
[Table] 807 letter [Table] [Table]
[Table]
[Table]
[Table] 0.562 libras   0. [Table] [Table]
[Table] [Table] 347 low-res-spect [Table]
[Table] [Table] 543 lung-cancer [Table]
[Table] [Table] 0.725 lymphography   0. [Table]
magic [Table] [Table] [Table]
[Table] [Table] [Table] states 2f
[Table] [Table] [Table] [Table]
[Table] [Table] 5b [Table]
[Table] optical [Table] [Table]
[Table] [Table] [Table] 344 ozone
[Table] [Table] [Table]
[Table] [Table] [Table] 311 page-blocks
[Table]
[Table] [Table]
342 parkinsons
[Table] [Table]
454 pendigits
[Table] [Table] [Table] [Table]
[Table]
261 phishing
[Table] [Table]
434 pima
[Table] [Table] [Table]
452 pittsburg-bridges-MATERIAL
[Table] [Table]
[Table] [Table]
435 pittsburg-bridges-REL-
[Table]
[Table] [Table] [Table]
492 pittsburg
[Table]
bridges
[Table]
SPAN
[Table] [Table]
[Table] [Table]
-bridges-
[Table]
OR-D
[Table] [Table]
[Table] [Table]
[Table]
[Table]
planning
[Table]
[Table] [Table] [Table]
[Table] [Table]
seeds
[Table] [Table]
[Table] [Table]
610 semeion
[Table] [Table]
[Table] [Table]
Continued on
page. [Table] [Table]
[Table]
1.000 climate   0.
0.990 congressional-voting   0.
0.717 conn
[Table]
-rocks   0.
0.956 conn-bench-vowel-deterding   0.
0.996 connect0.
0.954 contrac   0.
[Table]
-approval   0.
0.943 cylinder-bands   0.
0.872 dermatology   0.
0.999 echocardiogram   0. 0.949 ecoli   0. 0.959 energy-y    0. 0.993 energy-
[Table]
[Table]
Continued
on next page.
[Table]
902 post-operative   0.
0.662 primary-tumor   0.
0.747 ringnorm   0.
0.998 seeds   0.
0.985 semeion 2560.
0.993 soybean   0.
0.992 spambase   0.
0.992 spect   0.
0.773 spectf   0.
0.949 statlog-australian-credit   0.
0.700 statlog-german-credit   0.
0.898 statlog-heart   0.
0.930 statlog-image   0.
0.998 statlog- [Table] [Table] [Table]
teaching
[Table] [Table] Continued on next
page.
[Table]
from
[Table]
-tissue
[Table]
[Table]
[Table]
[Table]
[Table]
888 car
[Table]
[Table]
[Table]
[Table] [Table] 965 cardiotocography-10clases [Table]
[Table]
[Table]
[Table]
[Table]
818 cardiotocography-
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
696 chess-
[Table] [Table] [Table]
[Table] [Table]
[Table] [Table]
956 climate
[Table] [Table]
[Table] [Table]
[Table]
897 congressional-voting
[Table] [Table]
[Table]
[Table]
[Table] [Table]
617 conn
[Table]
rocks   0.
[Table]
836 conn-bench-vowel-deterding   0.
[Table] [Table]
[Table] [Table]
928 connect0.
[Table]
808 contrac
[Table] [Table]
0.665 credit-approval   0.
0.753 cylinder-bands   0.
0.705 dermatology   0. 0.982 echocardiogram   0. 0.786 ecoli   0. 0.800 energy-y
[Table]
0.888 energy-y    0.
[Table]
[Table]
0.894 fertility
[Table]
[Table] [Table] 0.608 ﬂags   0.
[Table]
0.715 glass   0. 0.660 haberman
[Table]
survival   0.
0.703 hayes
[Table]
roth   0.
[Table]
-cleveland   0. 0.800 heart-hungarian   0.
[Table]
[Table]
[Table]
0.561 hepatitis   0.
[Table]
0.850 hill
[Table]
[Table] [Table] [Table]
-colic
[Table]
0.708 ilpd
[Table]
indian
[Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
0.952 ionosphere
[Table]
[Table] [Table] [Table]
[Table] [Table]
878 iris
[Table]
[Table] [Table]
[Table]
[Table]
[Table]
-display
[Table] [Table]
[Table]
[Table]
[Table]
[Table]
738 lenses
[Table]
[Table]
[Table]
0.865 letter
[Table]
[Table]
[Table]
895 libras   0.
[Table]
[Table]
[Table]
Continued on next page.
[Table]
-bridges-MATERIAL
[Table]
0.975 titanic   0.
0.674 trains   1.
0.625 twonorm   0.
0.955 vertebral-
[Table]
-2clases   0.
0.858 vertebral-column-3clases   0. 0.859 wall-following   0.
0.919 waveform   0. 0.845 waveform-noise   0.
0.849 wine   0.
0.954 wine-quality-red   0. 0.611 wine-quality-white   0. 0.560 yeast   0. 0.645 zoo   0.
[Table]
from previous page.