Unified benchmark
A standardized benchmark for evaluating the trade-off between robustness and uncertainty in selective classification, using unified and reproducible protocols across methods, architectures, and augmentations.
ECCV 2026
Robustness Meets Uncertainty
Evidential Adversarial Training for Robust Selective Classification
Multitel Research & Innovation Center, Artificial Intelligence Department, Belgium
TRAIL – Trusted AI Labs, Belgium
† Equal contribution.
EV-AT jointly improves adversarial robustness and uncertainty ranking, enabling safer selective classification under attack.
Abstract
Safety-critical applications require classifiers that are both robust and reliable. Adversarial training is a widely adopted defense for improving robustness in deep neural networks; however, its effect on the reliability of predictive uncertainty remains underexplored. We investigate this gap through the lens of selective classification, which has rarely been systematically analyzed alongside adversarial robustness.
We introduce a unified benchmark for the robustness–uncertainty trade-off. It standardizes architectures, augmentations, threat models, and evaluation metrics across clean, adversarial, and common-corruption settings. Across a wide range of state-of-the-art adversarial training methods, we uncover a recurring failure mode: several approaches improve robust accuracy while degrading uncertainty ranking, leading to poorer selective behavior.
To address this, we propose Evidential Adversarial Training (EV-AT), which models uncertainty through a Dirichlet distribution and combines (i) an evidence-based loss promoting clean accuracy and reliable uncertainty with (ii) a robust evidence-alignment loss matching clean and adversarial predictions in log Dirichlet-parameter space. Extensive experiments show that EV-AT shifts the Pareto frontier of robustness–uncertainty trade-offs beyond prior state-of-the-art adversarial training methods.
Contributions
Evidential Adversarial Training
A new adversarial-training objective that learns Dirichlet distributions to jointly improve robustness and uncertainty quality, enabling more reliable selective classification under attack.
Beyond the prior Pareto frontier
Experiments across datasets and threat models show simultaneous gains in robust accuracy, uncertainty quality, and end-to-end selective behavior.
Evidential Adversarial Training
Evidential classifier
The network predicts Dirichlet parameters. Their normalized mean drives classification, while their total concentration captures evidence strength and supports uncertainty-aware selection.
Evidence-targeted adversary
Adversarial examples maximize posterior mismatch rather than only changing the predicted class, directly targeting the quantities that govern robust selective behavior.
Robust evidence alignment
Clean and adversarial posteriors are aligned in log-Dirichlet space, stabilizing both the predictive mean and the confidence structure used for abstention.
Posterior-level selective robustness
Standard attacks can move predictions toward an incorrect class while keeping them inside the accepted low-entropy region. EV-AT encourages adversarial samples to move toward higher-entropy regions, where they are more likely to be rejected.
Unified benchmark
Datasets
CIFAR-10, CIFAR-100, CIFAR-10-C, and CIFAR-100-C.
Architectures
WideResNet-34-10 and PreActResNet-18.
Augmentations
Basic, Cutout, AutoAugment, and AugMix.
Attacks
AutoAttack, PGD-20, and PGD-100.
Threat models
ℓ∞ with ε = 8/255 and ℓ2 with ε = 128/255.
Metrics
Accuracy, AURC, AUGRC, AUROC, retention, and risk–coverage.
Main results
EV-AT improves the operating point that matters: strong predictions when the model is right, and informative uncertainty when it is not.
71.84
Average clean/AA accuracy
Best joint accuracy across the benchmark summary.
6.52
Average AUGRC
Lower is better for uncertainty ranking.
0.022
Clean → attack retention gap
Stable selective behavior under distribution shift.
Higher robust accuracy is not a reliable proxy for trustworthy uncertainty. Several strong adversarial-training baselines become harder to fool while assigning relatively low uncertainty to adversarial errors, allowing silent failures to remain accepted. EV-AT improves both axes simultaneously and moves beyond the prior robustness–uncertainty Pareto frontier.
Additional benchmark results Show four architecture-specific figures
Selective classification under attack
EV-AT maintains safer coverage when predictions are filtered by uncertainty.
Why the alignment design matters
Aligning in log-Dirichlet space is crucial. On CIFAR-10/WRN-34-10 with AugMix, the selected design reaches a clean/AA accuracy of 71.51 with an AUGRC of 6.67.
Direct alignment in raw concentration space or in the Dirichlet mean substantially degrades the trade-off. A moderate robust evidence-alignment weight gives the best joint operating point; overly weak alignment reduces robustness, while overly strong alignment over-regularizes the model.
BibTeX
Please cite our work as:
@inproceedings{sournac2026robustness,
title = {Robustness Meets Uncertainty: Evidential Adversarial Training
for Robust Selective Classification},
author = {Sournac, Nicolas and Ben Jmaa, Ahmed Baha and
Braeckeveldt, Bertrand},
booktitle = {European Conference on Computer Vision},
year = {2026}
}Acknowledgements
This work was supported by the Public Service of Wallonia (Economy, Employment and Research) under grant no. 2010235 (ARIAC — Applications and Research for Trusted Artificial Intelligence), within the DigitalWallonia4.ai programme. The research also benefited from computational resources made available on Lucia, the Tier-1 supercomputer of the Walloon Region, infrastructure funded by the Walloon Region under grant agreement no. 1910247.
