ReliableNet: A Chance-Constrained Approach to Trustworthy Classification in Deep Learning

ReliableNet: A Chance-Constrained Approach to Trustworthy Classification in Deep Learning Ange-Clément Akazan1,2 , Ineza Remy Mugenga3 , Abebe Geletu3 , Jean Medard Ngnotchouye1 and Issa Karambal2

arXiv:2608.09768v1 [cs.LG] 10 Aug 2026

1

School of Agriculture and Science, University of KwaZulu-Natal, Pietermaritzburg, KwaZulu-Natal, South Africa 2 AIMS Research and Innovation Centre, African Institute for Mathematical Sciences, Kigali, Rwanda 3 African Institute for Mathematical Sciences, Kigali, Rwanda

Abstract A prediction that is both confident and wrong is a critical reliability failure because it can bypass abstention and human review precisely when the model is mistaken. Empirical risk minimization (ERM) controls average loss but not this failure directly, while calibration, uncertainty estimation, conformal risk control, and selective prediction methods target related reliability properties rather than bounding the joint failure event during training. We propose ReliableNet, which constrains the Joint Confident-Wrong (JCW) probability, the probability that a prediction is simultaneously confident and incorrect, below a user-specified risk budget α ∈ (0, 1). We formulate this as a chance-constrained ERM problem, use a conservative smooth inner approximation whose population feasibility implies the original JCW constraint. Across four tabular and two image datasets, ReliableNet is the only method certified within the JCW budget for every dataset and seed in distribution, when compared against baselines spanning ERM, post-hoc calibration, conformal risk control, and selective prediction. Under demographic, ambiguity, spurious-correlation, novel-class, and covariate shifts, it achieves the lowest empirical JCW among the compared methods while remaining very competitive in accuracy, coverage, calibration, and selective prediction. Risk-coverage results further indicate that ReliableNet achieves better selective ranking than the benchmark methods on most datasets. Overall, ReliableNet provides a principled approach to trustworthy classification.

1

Introduction

Machine learning systems are increasingly used across science, industry, and daily life, powering systems that translate language, recommend content, drive vehicles, support medical decisions, and more. As these systems move from research benchmarks into deployment, the demands placed on them shift: a model is no longer judged solely by its average accuracy, but by whether it can be trusted in the specific situations where its outputs drive real decisions. This is especially acute in classification, where predictions increasingly influence consequential outcomes in medical diagnosis, autonomous perception, financial risk assessment, and scientific discovery [Yeturu, 2020, Kotsiantis et al., 2007]. In such settings, accuracy alone is insufficient: a prediction is useful only if the system also signals when it should be trusted. Classifiers make this concrete through confidence scores, which are often used operationally, a highconfidence prediction may be trusted automatically, while a low-confidence one is deferred, rejected, or routed to a human reviewer. The central reliability question is therefore not whether a classifier is accurate on average, but whether it also avoids being wrong precisely when it appears most confident. This is difficult to guarantee in modern learning systems, where real-world problems involve noisy measurements, partial

1

observability, distribution shift, and model misspecification, the very conditions under which confident errors are most likely and most costly. These sources of uncertainty are commonly separated into aleatoric uncertainty, which reflects irreducible ambiguity in the data-generating process, and epistemic uncertainty, which reflects incomplete knowledge of the predictive mechanism and can in principle be reduced with better data or modeling [Hora, 1996, Der Kiureghian and Ditlevsen, 2009, Hüllermeier and Waegeman, 2021, Gruber et al., 2023]. In deployment, for classification tasks, both forms of uncertainty are often compressed into class probability vector and acted on using a scalar confidence score, typically the maximum predicted class probability, for class prediction. This creates a sharp failure mode: the classification model may assign high confidence to a prediction that is wrong, either because the input is intrinsically ambiguous or because the model is extrapolating beyond what it has learned. However, the dominant supervised learning paradigm, empirical risk minimization  (ERM), is not  designed to prevent this failure. ERM seeks parameters that minimize an expected loss, E ℓ(fθ (X), Y ) , or its empirical counterpart. This objective is well suited to average-case predictive performance, but it does not directly control rare but consequential tail events. A classifier can thus attain low average error while assigning near-certain confidence to a small set of incorrect predictions, and such high-confidence errors are qualitatively different from ordinary ones: they are the errors most likely to bypass caution, abstention, or human review. The consequences are not abstract. A confident false negative in medical triage can send a malignant lesion home without further examination. A confident perception error in an autonomous vehicle can suppress the very braking response that was needed. A confident underestimate of credit risk can wave through a loan that should have been declined. In each case it is not the error that causes the damage but the confidence attached to it: a hesitant mistake still invites a second look, whereas a confident one bypasses review entirely. The failure that matters in deployment is therefore specific, predictions that are simultaneously confident and wrong. These slip through abstention, deferral, and human review untouched, because every confidence-based safeguard is triggered by low confidence. Worse, they are disproportionately the errors that survive training: ERM drives down average loss with no pressure on the high-confidence tail. Existing reliability methods address related aspects of this problem, but they do not target it directly. Post-hoc calibration (Platt and temperature scaling) adjusts predicted probabilities so that confidence better matches empirical accuracy [Platt et al., 1999, Guo et al., 2017], but it optimizes an average: expected calibration error sums the confidence-accuracy gap over all predictions, so it can be small while confident errors concentrate in the high-confidence region, a blind spot that even modern, well-calibrated architectures inherit [Minderer et al., 2021]. Average calibration is not even a reliable summary of confidence quality: Chidambaram and Ge [2025] show that a trivial constant-confidence predictor attains near-zero calibration error while carrying no discriminative information. Training-time modifications, label smoothing, focal loss, Brier-score objectives, mixup, likewise reduce overconfidence on average rather than bounding confident error [Szegedy et al., 2016, Müller et al., 2019, Mukhoti et al., 2020, Zhang et al., 2018]. Selective prediction equips a classifier with a rejection option and studies the coverage-accuracy tradeoff on accepted samples [Chow, 1957, Bartlett and Wegkamp, 2008, Geifman and El-Yaniv, 2019, Liu et al., 2019]; conformal methods give finite-sample post-hoc guarantees under exchangeability by calibrating prediction sets or risk-controlling thresholds on held-out data [Angelopoulos et al., 2024, 2023]; and Bayesian and ensemble methods improve uncertainty estimates through posterior or model averaging [Gal and Ghahramani, 2016, Lakshminarayanan et al., 2017]. These approaches target related reliability objectives, but not the specific training-time constraint on confident misclassification considered here. We focus on the event where a classifier predicts confidently and incorrectly. We call the probability of this event the Joint Confident-Wrong (JCW) probability, where a prediction is deemed confident when its top-class probability (confidence) exceeds a chosen confidence threshold ε ∈ (0, 1). Rather than measuring or correcting this quantity after training, we treat it as a constraint during training: we minimize the usual ERM 2

classification loss while requiring the Joint Confident-Wrong probability to stay below a user-specified risk budget α ∈ (0, 1) (e.g., α = 0.05). The threshold defines what counts as a confident prediction, and the risk budget sets how much confident error is tolerated, so the practitioner controls reliability directly through two interpretable quantities. This formulation results into a single chance-constrained (probabilistic-constrained) optimization problem. We encoded the high-confidence misclassifications using a scalar violation function gθ that is differentiable almost everywhere to facilitate training. This formulation directly encodes the deployment requirement that accepted high-confidence predictions should rarely be wrong. The resulting optimization problem was challenging because the JCW constraint contains a discontinuous indicator event and is generally nonconvex. To make the problem tractable, we use the inner-outer analytic approximation framework for probabilisticconstrained optimization [Nemirovski and Shapiro, 2007, Geletu et al., 2017]. ReliableNet replaces the hard event during training with a smooth conservative inner surrogate, while the corresponding outer surrogate is used to assess approximation tightness. The resulting problem is a surrogate constrained optimization problem whose Lagrangian has a nonconvex-concave minimax structure, which motivates a two-timescale primal-dual scheme in which the model parameters are updated by descent and a bounded multiplier by projected ascent, increasing the influence of the constraint when violations occur [Lin et al., 2020, 2025]. Unlike post-hoc calibration or threshold selection, ReliableNet incorporates the reliability requirement during training, so that the model parameters are optimized under an explicit constraint on confident error. The main contributions of this work are threefold. • We formalize the Joint Confident-Wrong probability, a direct measure of high-confidence misclassification, and formulate classifier training as a probabilistic-constrained problem that explicitly bounds this failure event. We further establish its connections to selective risk and high-confidence calibration. • We adapt a smooth inner approximation whose population feasibility implies satisfaction of the JCW constraint, together with finite-sample results linking empirical and population surrogate feasibility. We also provide an independent held-out Clopper-Pearson certificate for the final hard JCW event. • We evaluate ReliableNet against six baselines spanning post-hoc calibration, conformal risk control, and selective prediction. Across four tabular and two image datasets, ReliableNet is the only method certified on every dataset and seed in distribution. Under demographic, ambiguity, spurious-correlation, novel-class, and covariate shifts, it attains the lowest empirical JCW while remaining stronger or very competitive in overall accuracy, calibration, and selective-prediction performance. The remainder of the paper is organized as follows. Section 2 reviews the state of the art and identifies the gap addressed by this study. Section 3 concerns the problem definition, Section 4 presents the JCW formulation and the ReliableNet training procedure. Section 5 describes the experimental setup and reports the empirical results. Section 6 concludes the paper.

2

State-of-the-Art

Work on reliable classification is most closely connected to four neighboring literature: calibration, selective prediction, conformal risk control, and predictive uncertainty estimation. Across most of these lines of work, the common objective is to make model confidence more informative for downstream decision making, especially when overconfident mistakes are costly. Our method is close in spirit to this literature, but differs in that it does not treat reliability only as a post-hoc diagnostic, an abstention policy, or an uncertainty score. Instead, it incorporates the failure event of interest directly into the training objective by constraining the probability of confident misclassifications.

3

A first line of work studies calibration, namely the agreement between predicted confidence and empirical correctness. Classical post-hoc methods include Platt scaling, isotonic regression, binning-based calibration, and temperature scaling [Platt et al., 1999, Zadrozny and Elkan, 2002, Niculescu-Mizil and Caruana, 2005, Guo et al., 2017]. A complementary line modifies training itself through label smoothing, mix-up, focal loss, logit-norm penalties, or trainable calibration regularizers [Szegedy et al., 2016, Müller et al., 2019, Zhang et al., 2018, Thulasidasan et al., 2019, Mukhoti et al., 2020, Joo and Chung, 2020, Kumar et al., 2018]. These methods generally improve average calibration by reducing overconfidence. However, lower raw ECE does not necessarily imply more informative confidence scores. Wang et al. [2021] show that confidence-penalizing regularizers can compress the score distribution and remove information about sample difficulty, thereby limiting subsequent post-hoc calibration. ReliableNet differs in both target and mechanism because rather than penalizing confidence globally, it directly constrains the probability that a prediction is simultaneously confident and wrong. Thus, high confidence remains permissible on correct predictions, while the specific failure event of confident misclassification is explicitly controlled. A second line of work addresses reliability through abstention or selective prediction. The classical rejectoption formulation goes back to Chow, and later learning-theoretic work developed selective classification as a principled risk-coverage trade-off [Chow, 1957, 1970, Bartlett and Wegkamp, 2008, El-Yaniv and Wiener, 2010]. In deep learning, this perspective has led to confidence-thresholding baselines, SelectiveNet, and Deep Gamblers, which equip the predictor with an explicit reject option and optimize performance on the accepted subset of inputs [Geifman and El-Yaniv, 2017, 2019, Liu et al., 2019]. Closely related are trust estimation methods such as Trust Score, which attempt to predict whether an individual decision should be trusted by comparing classifier outputs to local neighborhood structure in feature space [Jiang et al., 2018]. This literature is operationally very close to our setting, but its guarantees are typically stated in terms of selective risk at a chosen coverage level, rather than as a direct upper bound on the probability that the model is simultaneously confident and wrong. A third line of work provides post-hoc statistical guarantees. Conformal prediction converts point predictions into prediction sets or abstaining decision rules with finite-sample validity guarantees under exchangeability [Angelopoulos et al., 2023]. More recently, Conformal Risk Control generalized this paradigm beyond marginal coverage to broader monotone risk functionals, including risks relevant to selective prediction [Angelopoulos et al., 2024]. Recent extensions have begun to relax the idealized exchangeability assumption in more specialized non-exchangeable settings, but the framework remains fundamentally calibration-based and post-hoc [Farinhas et al., 2024, Fontana et al., 2023]. This makes conformal methods one of the strongest available tools for uncertainty control after training, yet conceptually they differ from our objective: they calibrate a decision rule built on top of a fixed predictor, whereas our method changes the predictor itself so as to reduce confident errors during learning. A fourth line of work seeks more faithful predictive uncertainty estimates. Bayesian approximations such as MC dropout and ensemble-based methods such as deep ensembles aim to represent epistemic uncertainty more faithfully than a single deterministic network [Gal and Ghahramani, 2016, Lakshminarayanan et al., 2017, Kendall and Gal, 2017]. Large-scale evaluations have shown, however, that uncertainty quality can deteriorate substantially under dataset shift, even for strong approximate Bayesian and ensemble methods [Ovadia et al., 2019]. Closely related is the literature on out-of-distribution and failure detection, where maximum softmax probability, ODIN, Mahalanobis-based scores, energy-based methods, and Outlier Exposure are all used to detect inputs on which the model is less trustworthy [Hendrycks and Gimpel, 2017, Liang et al., 2018, Lee et al., 2018, Liu et al., 2020a, Hendrycks et al., 2018]. These approaches are important because they help identify when the model may fail, but they still treat uncertainty estimation or anomaly detection as the main object. They do not directly train the classifier to satisfy a user-specified bound on the event of confident misclassification. On the other hand, probabilistic-constrained optimization has appeared in machine learning, but mostly in specialized settings rather than in modern confidence-aware classifier training. Early work focused on 4

uncertain or robust support vector machine formulations, where probabilistic constraints were used to control misclassification under input uncertainty [Wang et al., 2018, Khanjani-Shiraz et al., 2023, Lin et al., 2024]. More recent examples include sequence optimization, safe reinforcement learning, and deep metric learning, where probabilistic constraints are used to enforce validity, safety, or feasibility with high probability [Liu et al., 2020b, Chow et al., 2018, Wang et al., 2023, Gürbüz et al., 2024]. These works demonstrate that probabilistic-constrained optimization is a viable tool for risk control in deep learning, but they target different failure modes and typically rely on specialized formulations or problem-specific approximations. By contrast, our setting is standard probabilistic classification, and our goal is to control the probability of a model being simultaneously confident and wrong during end-to-end training. Relative to these literatures, ReliableNet is best viewed as a training-time reliability method. It is closer to selective prediction and calibration-aware learning than to post-hoc conformal adjustment or general-purpose uncertainty estimation, but differs from all of them in one essential respect: it treats high-confidence error itself as the quantity to be controlled during optimization. In that sense, our method is not primarily a recalibration procedure, an abstention wrapper, or an uncertainty estimator; it is a classifier training objective designed to suppress a concrete tail-risk event that is operationally meaningful in deployment.

3

Problem Definition

As discussed above, the high-confidence misclassification event is the main failure event to consider. In this part, we formulate a probabilistic-constrained optimization learning problem that minimizes the empirical risk while directly controlling the probability of confident misclassifications, and derive its consequences for selective prediction and calibration.

3.1

Setup

Let (X , BX ) be a measurable input space, Y = {1, . . . , K} a finite label space, and Z = (X, Y ) ∼ P a random input-output pair drawn from an unknown reference distribution P . All probabilities and expectations are with respect to P . A parametric classifier fθ : X → RK , θ ∈ Θ ⊆ Rd , produces logits from which we derive class probabilities, predictions, and confidence, respectively for k ∈ {1, · · · , K}: exp(fθ (x)k ) pθ (k | x) := PK , j=1 exp(fθ (x)j )

ŷθ (x) := arg max pθ (k | x), k

cθ (x) := max pθ (k | x). k

(1)

We maintain the following assumptions throughout. Assumption 3.1 (Measurability). fθ , ŷθ , and cθ are Borel measurable for every θ ∈ Θ. Assumption 3.2 (Parameter space). Θ ⊆ Rd is nonempty. Where uniform convergence is invoked, we take Θ to be compact.

3.2

The Confident Misclassification Event

For a classifier fθ and a fixed confidence threshold ε ∈ (1/K, 1) (1/K because we want ε to be greater than uniform confidence spread) , we are interested in the event that a random pair Z = (X, Y ) ∼ P is simultaneously misclassified and assigned high confidence, that is, ŷθ (X) ̸= Y and cθ (X) ≥ ε. To refer to this event compactly, we introduce the notation Cθ (ε) := {(x, y) ∈ X × Y : cθ (x) ≥ ε},

Bθ := {(x, y) ∈ X × Y : ŷθ (x) ̸= y},

5

(2)

where (x, y) is a generic point in X × Y. These are deterministic level sets of the classifier fθ , fully characterized by θ and ε. Under Assumption 3.1, both sets are Borel measurable, ensuring that the following probability is well-defined. We define the joint confident-wrong (JCW) probability as JCW(θ) := Pr (Z ∈ Cθ (ε) ∩ Bθ ) , Z∼P

(3)

the probability, under the full data-generating distribution P , that a randomly drawn pair Z ∼ P is both misclassified and highly confident. For any fixed θ ∈ Θ, the sets Cθ (ε) and Bθ are deterministic, so the sole source of randomness in (3) is Z ∼ P ; consequently, JCW(θ) is a deterministic scalar-valued function of θ alone, and the constraint JCW(θ) ≤ α is a well-posed condition on the model parameters. The threshold ε enters only as a pre-fixed hyperparameter. JCW measures the probability of the specific failure mode that is most dangerous in decision-critical applications: the model is wrong and reports high confidence. Unlike expected calibration error, which averages discrepancies across all confidence levels, JCW targets a single, operationally meaningful event. Unlike selective risk, which conditions on a selection decision, JCW is an unconditional joint probability over P . To encode the event {Z ∈ Cθ (ε) ∩ Bθ } we first used the multiclass margin defined as: ℓθ (x, y) := max fθ (x)k − fθ (x)y , k̸=y

(4)

which satisfies ℓθ (x, y) > 0 ⇔ ŷθ (x) ̸= y under Assumption 3.4. Define the scalar violation function gθ (Z) := min {cθ (X) − ε, ℓθ (X, Y )} .

(5)

Assumption 3.3 (Continuity). For P -almost every z, the map θ 7→ gθ (z) defined in (5) is continuous on Θ. Assumption 3.4 (Boundary regularity). P r{gθ (Z) = 0} = 0 for every θ ∈ Θ. Assumption 3.4 excludes the measure-zero event of exact logit ties or exact threshold hits, which is satisfied generically for neural networks with continuous-valued logits under any non-degenerate input distribution. Corollary 3.5 (Exact encoding). Under Assumption 3.4, for P -almost every z = (x, y), gθ (z) > 0 cθ (x) ≥ ε ∧ ŷθ (x) ̸= y, and consequently Pr{gθ (Z) > 0} = JCW(θ).

⇐⇒

Proof. Recall gθ (z) = min{ cθ (x) − ε, ℓθ (x, y) }. By Assumption 3.4 the tie set {gθ (Z) = 0} is P -null, so we may work on its complement {gθ ̸= 0}. There, gθ (z) ≥ 0 implies gθ (z) > 0, a fact we use in the reverse direction below. If gθ (z) > 0, the minimum is positive, so both terms are: hence cθ (x) > ε (so in particular cθ (x) ≥ ε) and ℓθ (x, y) > 0. Thus the prediction is confident and, by the argmax rule, wrong (ŷθ (x) ̸= y). Conversely, if the prediction is confident and wrong, then cθ (x) − ε ≥ 0 and ℓθ (x, y) > 0 (a misclassification without an exact tie has strictly positive margin), so the minimum satisfies gθ (z) ≥ 0; being off the tie set, gθ (z) > 0. This proves the equivalence P -almost everywhere. Since the events {gθ (Z) > 0} and {cθ (X) ≥ ε, ŷθ (X) ̸= Y } coincide up to a P -null set, they have equal probability, giving Pr{gθ (Z) > 0} = JCW(θ). Remark 3.6 (Choice of the minimum). Writing g1 := cθ (X) − ε and g2 := ℓθ (X, Y ), the reliability requirement P (g1 > 0 ∧ g2 > 0) ≤ α is equivalent to P (min{g1 , g2 } > 0) ≤ α, since the minimum is positive whenever both arguments are positive. This reduces the intersection of two events to a standard single probabilistic constraint.

6

3.3

The Probabilistic-Constrained Learning Problem

The learning problem we propose is  
min E L Y, pθ (· | X) + R(θ) θ∈Θ

subject to

JCW(θ) ≤ α,

(6)

where L is a classification loss (cross entropy, Brier score, etc.), R(θ) is a regularizer (Weight decay in our case), α ∈ (0, 1) is a prescribed risk budget and, by Corollary 3.5, the constraint is equivalently P r{gθ (Z) ≤ 0} ≥ 1 − α. The threshold ε is a data-driven threshold selected from the validation set. Problem (6) differs from ERM in a fundamental way: ERM controls the expected loss, which is silent about the distribution of errors across confidence levels, whereas (6) supplements expected loss with an explicit constraint on the joint occurrence of high confidence and incorrect prediction.

3.4

Properties of the JCW Constraint

All statements below are population-level identities or bounds and do not depend on how (6) is solved. Fix ε and abbreviate the coverage Cov(θ) = Pr{cθ (X) ≥ ε} and the high-confidence accuracy Acchc (θ) = Pr{ŷθ (X) = Y | cθ (X) ≥ ε}. The rest follows from a single identity, obtained by conditioning on whether the model acts. Corollary 3.7 (Decomposition). For every θ,
JCW(θ) = Cov(θ) 1 − Acchc (θ) .

(7)

and JCW(θ) ≤ α holds iff Acchc (θ) ≥ 1 − α/Cov(θ). Proof. JCW(θ) = Pr{cθ ≥ ε, ŷ ̸= Y } = Pr{ŷ ̸= Y, cθ ≥ ε}

(8)

= Pr{ŷ ̸= Y | cθ ≥ ε} Pr{cθ ≥ ε} (9)
= 1 − Acchc (θ) Cov(θ) (10)
Therefore JCW(θ) ≤ α ⇔ 1 − Acchc (θ) Cov(θ) ≤ α ⇔ Acchc (θ) ≥ 1 − α/Cov(θ) by rearranging Remark 3.8. Writing T (θ) := Pr{cθ (X) ≥ ε, ŷθ (X) = Y } for the confident-correct throughput, the acceptance region splits as Cov(θ) = T (θ) + JCW(θ). Reliability therefore requires small JCW and large T , and the two are supplied by the two terms of problem (6): the loss minimization rewards confident-correct predictions and pushes T up, while the constraint caps confident errors. Because the JCW constraint alone does not impose a minimum coverage, a feasible model may reduce confident errors partly by lowering its acceptance rate. We therefore report coverage and confident-correct throughput alongside JCW. Corollary 3.9 (Selective risk). If JCW(θ) ≤ α and Cov(θ) > 0, the error rate on accepted inputs satisfies Pr{ŷθ (X) ̸= Y | cθ (X) ≥ ε} ≤

α . Cov(θ)

(11)

Proof. Pr{ŷθ (X) ̸= Y, cθ (X) ≥ ε} Pr{cθ ≥ ε} JCW (θ) α = ≤ Cov(θ) Cov(θ)

Pr{ŷθ (X) ̸= Y | cθ (X) ≥ ε} =

7

(12) (13)

Thus ε already acts as a selection rule since it defines an acceptance region Cθ (ε) and bounds the risk there, with no gating network and no separate abstention loss. Remark 3.10 (Connection to Bayes-optimal rejection). Let η(x) = maxk Pr(Y = k | X = x). By Chow’s rule, thresholding η yields a Bayes-optimal acceptance set at fixed coverage. Hence, when cθ = η and ŷθ is Bayes-optimal, {cθ ≥ ε} is optimal and JCW equals the accepted error probability. Under misspecification, JCW still measures confident error on the model’s own acceptance region, but controlling it does not guarantee recovery of the Bayes confidence ranking. Modern networks are typically overconfident, with the confidence-accuracy gap concentrated at high confidence [Guo et al., 2017], though its magnitude is architecture-dependent [Minderer et al., 2021]. This is exactly the region a JCW budget constrains. Proposition 3.11. Let WCEhc (θ) = Cov(θ) E[cθ | cθ ≥ ε] − Acchc (θ) be the coverage-weighted calibration gap on accepted inputs. If the model is overconfident there, E[cθ | cθ ≥ ε] ≥ Acchc (θ), and JCW(θ) ≤ α, then WCEhc (θ) ≤ α Proof. Using the fact that overconfidence removes the absolute value, and cθ ≤ 1 we find:

WCEhc (θ) = Cov(θ) E[cθ | cθ ≥ ε] − Acchc ≤ Cov(θ) 1 − Acchc = JCW(θ) ≤ α, using corollary 3.7 and the constraint. This local guarantee partly explains the calibration ReliableNet gains as a by-product, since overconfidence is suppressed exactly where the constraint is active.

4

Methodology

In this part, we describe the smooth approximation used to solve the problem (6) that was initially not amenable to gradient-based optimization due to the probabilistic constraint JCW(θ) ≤ α. We also explore the finite sample feasibility of the smooth approximation and the constrained-optimization technique used to solve our problem.

4.1

Inner-Outer Analytic Approximation

Replace JCW(θ) ≤ α by a smooth surrogate constraint, adopting the inner-outer smoothing framework of Geletu et al. [2017]. Consider the Geletu-Hoffman parametric function 1 + m1 τ m1 ζ(τ, s) = , τ ∈ (0, 1), s ∈ R, 0 < m2 < , (14) 1 + m2 τ exp(−s/τ ) 1 + m1 together with its reflection Π(τ, s) := ζ(τ, −s). The family is bounded, dominates the Heaviside function h(s) := 1{s ≥ 0} pointwise (ζ(τ, s) ≥ h(s) for all s), and converges to pointwise as τ ↓ 0. Surrogates and the estimation bracket.

Define the smoothed surrogate functions

ψτ (θ) := E [ζ(τ, gθ (Z))] ,

ϕτ (θ) := E [Π(τ, gθ (Z))] .

By Lemma A.1, ζ(τ, s) ≥ 1{s ≥ 0} and, applying it at −s, Π(τ, s) = ζ(τ, −s) ≥ 1{s ≤ 0}. Taking expectation under Z ∼ P gives the estimation bracket 1 − ψτ (θ) ≤ P(gθ (Z) ≤ 0) ≤ ϕτ (θ),

∀τ > 0,

(15)
which holds pointwise in θ for any P . In particular ψτ (θ) ≥ P(gθ (Z) ≥ 0) ≥ JCW(θ), (P gθ (Z) ≥ 0 = JCW(θ) under Assumption 3.4)[Geletu et al., 2017], hence the conservative implication: ψτ (θ) ≤ α =⇒ JCW(θ) ≤ α. 8

(16)

Inner and outer feasible sets. Let F := {θ ∈ Θ : P(gθ (Z) ≤ 0) ≥ 1 − α} denote the feasible set of the probabilistic constraint, and define Fτin := {θ : ψτ (θ) ≤ α},

Fτout := {θ : ϕτ (θ) ≥ 1 − α}.

The bracket (15) yields the inclusion directly: if ψτ (θ) ≤ α then P(gθ (Z) ≤ 0) ≥ 1 − ψτ (θ) ≥ 1 − α, so θ ∈ F; if θ ∈ F then ϕτ (θ) ≥ P(gθ (Z) ≤ 0) ≥ 1 − α, so θ ∈ Fτout . Therefore, Fτin ⊆ F ⊆ Fτout ,

∀τ > 0.

This gives rise to two approximation problems  
(PIAτ ) min E L Y, pθ (· | X) + R(θ) θ∈Θ

s.t.

ψτ (θ) ≤ α,

(18)

s.t.

ϕτ (θ) ≥ 1 − α.

(19)



(POAτ )


min E L Y, pθ (· | X) + R(θ)

(17)

θ∈Θ

By (17), any feasible point of (PIAτ ) is feasible for the original probabilistic constraint, making the inner problem the vehicle for reliable solutions; (POAτ ) relaxes the feasible set and yields a lower bound on the optimal objective value, used purely as a diagnostic. A pointwise stopping diagnostic. In practice Geletu et al. [2017] solve both (POAτ ) and (PIAτ ) for each decaying τ and compare their objective values, but solving them at every smoothing level to monitor the objective-value gap is expensive. We instead use a cheap diagnostic requiring only two forward surrogate evaluations at the incumbent which measures the width of the probability enclosure at the evaluated parameter. Proposition 4.1 (Gap diagnostic). Let Assumption 3.4 (P{gθ (Z) = 0} = 0) holds. Write p(θ) := P(gθ (Z) ≤ 0) and
∆τ (θ) := ϕτ (θ) − 1 − ψτ (θ) (≥ 0). (20) Then, for every θ and every τ ∈ (0, 1),   p(θ) ∈ 1 − ψτ (θ), ϕτ (θ) ,

so

max

n

p(θ) − (1 − ψτ (θ)) , p(θ) − ϕτ (θ)

o

≤ ∆τ (θ).

(21)

Moreover, for each fixed θ, lim ∆τ (θ) = 0. τ ↓0

(22)

Proof. Enclosure (21). The bracket (15) states 1 − ψτ (θ) ≤ p(θ) ≤ ϕτ (θ), so p(θ) lies in the stated interval, whose width is ∆τ (θ) ≥ 0; the two-sided bound is immediate. Limit (22). Fix θ. By Lemma A.1, ζ(τ, gθ (z)) → h(gθ (z)) as τ ↓ 0 for every z, and ζ(τ, ·) ≤ 1 + m1 for τ ∈ (0, 1), a constant P -integrable majorant. Dominated convergence gives ψτ (θ) → E[h(gθ (Z))] = P(gθ (Z) ≥ 0),

ϕτ (θ) = E[ζ(τ, −gθ (Z))] → P(gθ (Z) ≤ 0) = p(θ).

Hence 1 − ψτ (θ) → P(gθ (Z) < 0), which equals p(θ) by Assumption 3.4 (P{gθ (Z) = 0} = 0). Therefore ∆τ (θ) = ϕτ (θ) − (1 − ψτ (θ)) → p(θ) − p(θ) = 0. The enclosure (21) provides a pointwise tightness diagnostic: for fixed θ̂, ∆τ (θ̂) is the width of an interval containing p(θ̂). In practice, we solve only (PIAτ ), evaluate ∆τ (θ̂τ ) at the current incumbent, and tighten τ until this width falls below ϑ (10−4 in our experiments). The returned model is always obtained from the inner approximation; ∆τ measures surrogate tightness, not optimization suboptimality. 9

4.2

Finite-Sample Feasibility of the Inner Approximation

The inner inclusion in (17) is a population-level statement: if the true surrogate ψτ (θ) := E[ζ(τ, gθ (Z))] satisfies ψτ (θ) ≤ α, then the JCW probabilistic constraint is satisfied. In learning, however, the distribution P is unknown and Algorithm 1 only observes the empirical surrogate 1 ψbτ,n (θ) := n

n X

ζ (τ, gθ (Zi )) ,

i.i.d.

Z1 , . . . , Zn ∼ P.

(23)

i=1

This section bridges empirical surrogate feasibility to population JCW feasibility at finite sample size. The difficulty is that the returned parameter θb is data-dependent, selected on the same sample used to evaluate ψbτ,n , so a pointwise bound at fixed θ is insufficient. We first establish uniform concentration over Θ, apply b and finally give independent holdout certificates, including the Clopper-Pearson it at the random output θ, certificate used in the experiments. Throughout, the smoothing level τ ∈ (0, 1) and the threshold ε are fixed; since ε is selected on a validation fold, the statements below are conditional on that value. We use the Geletu–Hoffman parametric function ζ(τ, s) 14. Assumption 4.2 (Bounded parameter class). The parameter set satisfies Θ ⊆ {θ ∈ Rd : ∥θ∥2 ≤ R} for some R < ∞. Assumption 4.3 (Parameter-Lipschitz violation). There exists Lg < ∞ such that |gθ (z) − gθ′ (z)| ≤ Lg ∥θ − θ′ ∥2 for all θ, θ′ ∈ Θ and P -almost every z. Assumption 4.3 is a standard theoretical regularity condition: on compact parameter and input sets, neural-network logits are Lipschitz in the parameters; the confidence cθ , the margin ℓθ , and their minimum inherit this Lipschitz property. Lemma 4.4 (Boundedness and conservatism). For every τ ∈ (0, 1) and s ∈ R, 0 < ζ(τ, s) ≤ bτ := 1 + m1 1τ m1 τ, |∂s ζ(τ, s)| ≤ Lζ (τ ) := 1+m 4τ . Moreover, under 0 < m2 < 1 + m we have ζ(τ, s) ≥ 1{s ≥ 0} 1 for all s, and therefore ψτ (θ) ≥ JCW(θ) for all θ ∈ Θ. Proof. The denominator in (14) belongs to (1, ∞), so 0 < ζ(τ, s) ≤ 1 + m1 τ = bτ . Setting w = m2 τ e−s/τ , w 1τ differentiation gives ∂s ζ(τ, s) = 1+m . Since maxw≥0 w/(1 + w)2 = 1/4, the derivative bound τ (1+w)2 follows. The conservatism ζ(τ, s) ≥ 1{s ≥ 0} is Lemma A.1(ii). Applying it pointwise to s = gθ (Z) and integrating gives ψτ (θ) ≥ Pr{gθ (Z) ≥ 0} = Pr{gθ (Z) > 0} = JCW(θ), where the middle equality uses Pr{gθ (Z) = 0} = 0 (Assumption 3.4) and the last uses Corollary 3.5. Theorem 4.5 (Uniform concentration of the empirical surrogate). Under Assumptions 4.2-4.3, for any ρ ∈ (0, 1), with probability at least 1 − ρ, sup ψbτ,n (θ) − ψτ (θ) ≤ δn (τ, ρ),

(24)

θ∈Θ

where

r δn (τ, ρ) := bτ

d ln(3n) + ln(2/ρ) (1 + m1 τ )Lg R + . 2n 2τ n

Proof. Let Φ(θ; z) := ζ(τ, gθ (z)). By Lemma 4.4 and Assumption 4.3, |Φ(θ; z) − Φ(θ′ ; z)| ≤ Lζ (τ )Lg ∥θ − θ′ ∥2 =: Lτ ∥θ − θ′ ∥2 , where Lτ = (1 + m1 τ )Lg /(4τ ). Hence D(θ) := ψbτ,n (θ) − ψτ (θ) is 2Lτ -Lipschitz. 10

(25)

Let {θ1 , . . . , θN } be a κ-net of Θ. Since Θ is contained in a radius-R ball (assumption4.2), N ≤ (3R/κ)d . For every θ ∈ Θ, choose θj with ∥θ − θj ∥2 ≤ κ. Then sup |D(θ)| ≤ max |D(θj )| + 2Lτ κ. θ∈Θ

1≤j≤N

For fixed θj , the variables Φ(θj ; Zi ) are i.i.d., bounded in [0, bτ ], and have mean ψτ (θj ). Hoeffding’s inequality gives   2nt2 Pr{|D(θj )| ≥ t} ≤ 2 exp − 2 . bτ A union bound over the net gives     2nt2 . Pr max |D(θj )| ≥ t ≤ 2N exp − 2 j bτ p Setting the right-hand side equal to ρ yields t = bτ ln(2N/ρ)/(2n). Therefore, with probability at least 1 − ρ, r ln(2N/ρ) sup |D(θ)| ≤ bτ + 2Lτ κ. 2n θ∈Θ Taking κ = R/n gives N ≤ (3n)d and 2Lτ κ = (1 + m1 τ )Lg R/(2τ n), which proves (24). Theorem 4.6 (Finite-sample feasibility for data-dependent outputs). Suppose Assumptions 4.2-4.3 hold. Fix τ ∈ (0, 1), α ∈ (0, 1), and ρ ∈ (0, 1). With probability at least 1 − ρ, every θ ∈ Θ satisfying ψbτ,n (θ) ≤ α − δn (τ, ρ)

(26)

also satisfies JCW(θ) ≤ α. Consequently, the same implication holds for any data-dependent output θb = A(Z1 , . . . , Zn ) returned by Algorithm 1. Proof. Let En be the event on which (24) holds. By Theorem 4.5, Pr(En ) ≥ 1 − ρ. On En , for every θ ∈ Θ, ψτ (θ) ≤ ψbτ,n (θ) + δn (τ, ρ). Thus any θ satisfying (26) also satisfies ψτ (θ) ≤ α. By Lemma 4.4, JCW(θ) ≤ ψτ (θ) ≤ α. Because the event En holds uniformly for all θ ∈ Θ, the same argument applies to a random θb selected using the sample. This proves the claim. b ε, and τ be fixed before evaluating an independent Theorem 4.7 (Independent holdout certificates). Let θ, i.i.d. em ∼ P . Then the following certificates hold. certification sample Ze1 , . . . , Z   cert (θ) b := m−1 Pm ζ τ, g b(Zei ) . With probability at least (i) Hoeffding surrogate certificate. Let ψbτ,m i=1 θ q ln(1/ρ) b ≤ ψbcert (θ) b + bτ 1 − ρ, ψτ (θ) τ,m 2m . Consequently, if the right-hand side is at most α, then b JCW(θ) ≤ α with probability at least 1 − ρ.

11

n o ei ) ≥ ε, ybb(X ei ) ̸= Yei , Km := (ii) Clopper-Pearson hard-JCW certificate. Define Bi := 1 cθb(X θ Pm . Conditional on the fixed model and threshold, the B are i.i.d. Bernoulli with success B i i i=1 b probability q = JCW(θ). Let ( β −1 (1 − ρ; Km + 1, m − Km ), Km < m, UCP (Km , m; ρ) := 1, Km = m, where β −1 (·; a, b) is the quantile function of the Beta(a, b) distribution. Then n o b ≤ UCP (Km , m; ρ) ≥ 1 − ρ. Pr JCW(θ) Thus, if UCP (Km , m; ρ) ≤ α, the hard JCW constraint is certified at confidence level 1 − ρ. b ε, and τ . The variables Wi := ζ(τ, g b(Zei )) are i.i.d., bounded in Proof. For (i), condition on the fixed θ, θ b The one-sided Hoeffding inequality gives [0, bτ ], and have mean ψτ (θ).   n o 2mt2 cert b b b . Pr ψτ (θ) − ψτ,m (θ) ≥ t ≤ exp − 2 bτ p b ≤ α, and Taking t = bτ ln(1/ρ)/(2m) gives the stated bound. If this upper bound is at most α, then ψτ (θ) b ≤ α. Lemma 4.4 implies JCW(θ) For (ii), condition on the fixed model and threshold. The certification sample is independent, so b The one-sided Clopper-Pearson interval B1 , . . . , Bm are i.i.d. Bernoulli with parameter q = JCW(θ). is obtained by inverting the binomial test and satisfies, for every q ∈ [0, 1], Pr{q ≤ UCP (Km , m; ρ)} ≥ 1 − ρ. q

b proves the certificate. Substituting q = JCW(θ) Remark 4.8. The uniform theorem explains why empirical surrogate feasibility can imply population JCW b In experiments, however, we use the hard-JCW Clopper-Pearson feasibility even for a data-dependent θ. certificate because it directly confirms the deployment event of interest and does not depend on the smooth surrogate or on the parameter dimension or the optimization technique.

4.3

Solving the Constrained Problem

Since ψτ (θ) in (18) is nonconvex, (PIAτ ) is a nonconvex constrained problem, and direct projection onto Fτin is impractical. For a fixed smoothing level τ , we form the Lagrangian 

Lτ (θ, λ) = E L Y, pθ (· | X) + R(θ) + λ ψτ (θ) − α , λ ∈ [0, λmax ]. The Lagrangian has a nonconvex-concave minimax structure: it is generally nonconvex in θ and linear, hence concave, in the dual variable λ. This motivates a primal-dual update in which the classifier is optimized by descent while the multiplier responds by projected ascent to constraint violations. Two-timescale gradient descent-ascent methods admit stationarity guarantees for related nonconvex-concave minimax problems under suitable regularity conditions [Lin et al., 2020, 2025, Ramirez et al., 2025]. These modifications are motivated by the minimax structure but fall outside the exact assumptions of the cited convergence results; accordingly, Algorithm 1 returns a candidate solution whose JCW feasibility is verified independently on the held-out certification sample. 12

Algorithm 1 Pseudo Code: ReliableNet Training Require: Warm-started parameters θ0 ; smoothing levels τ0 , τmin ; risk budget α; primal and dual step sizes ηθ , ηλ ; EMA factor β ∈ [0, 1]; multiplier cap λmax ; bracket-width tolerance δtol ; decay γ ∈ (0, 1); epochs per stage E; maximum stages Jmax Ensure: Candidate parameters θ; feasibility assessed post hoc by Theorem 4.7 1: θ ← θ0 , λ ← 0, v̄ ← 0, τ ← τ0 2: for j = 1, . . . , Jmax do ▷ continuation over smoothing levels 3: for e = 1, . . . , E do 4: for each mini-batch {(xi , yi )}B i=1 do P 1 PB b 5: ψτ ← B i=1 ζ (τ, gθ (xi , yi )) , Lb ← B1 B i=1 ℓ(xi , yi , θ) ψbτ − α 6: v← ▷ normalized violation max(α, 10−2 )  ▷ primal descent 7: θ ← θ − ηθ ∇θ Lb + R(θ) + λv 8: v̄ ← βv̄ + (1 − β)v ▷ EMA stabilization
B 9: λ ← clip λ + ηλ n v̄, 0, λmax ▷ projected dual ascent 10: end for 11: end for   12: ∆τ ← ϕbτ (θ) − 1 − ψbτ (θ) ▷ bracket width, Prop. 4.1 13: if ∆τ ≤ δtol then 14: break 15: end if 16: τ ← max(τmin , γτ ) ▷ tighten inner approximation 17: end for 18: return θ ▷ certify independently via Thm. 4.7 Unless otherwise stated, we use τ0 = 0.5, τmin = 0.01, γ = 0.65, δtol = 10−4 , ηλ = 1.1, β = 0.75, and λmax = 50, with surrogate parameters m1 = 0.5 and m2 = 0.3. ReliableNet training proceeds in two phases. Phase 1 is a 10-epoch ERM warm-up, after which the threshold ε∗ is fixed to the 80th percentile of the confidences of misclassified examples on the selection fold. Phase 2 is run for E = 6 epochs for at most Jmax = 15 stages; for CIFAR-10 we use E = 14 and Jmax = 5 to match the baseline training budget. The primal optimizer is Adam with learning rate 10−3 , weight decay 10−4 , batch size 256, and gradient-norm clipping at 5.

4.4

Benchmark Methods

We compare ReliableNet with six representative baselines spanning unconstrained training, post-hoc calibration and risk control, and end-to-end selective prediction. All methods use the same base architecture and data splits within each dataset. Model parameters and operating points are fixed using the training and selection folds before evaluation on the independent certification fold. ReliableNet uses the fixed threshold ε∗ selected before constrained training and accepts an input when cθ (x) ≥ ε∗ . The corresponding acceptance rule for each baseline is specified below. • ERM (Empirical Risk Minimization). ERM minimizes the standard cross-entropy objective 1 Pn i=1 ℓCE (fθ (xi ), yi ), without an explicit reliability constraint [Vapnik, 1998]. It serves as the n primary unconstrained baseline. At evaluation, ERM accepts predictions satisfying cθ (x) ≥ ε∗ , using the same confidence threshold as ReliableNet.

13

• Temperature Scaling. Temperature Scaling [Guo et al., 2017] leaves the ERM-trained model unchanged and fits a scalar temperature T > 0 on the selection fold by minimizing the negative log-likelihood of the scaled logits fθ (x)/T . The predicted class is unchanged, but the confidence becomes cθ,T (x) = maxk softmax (fθ (x)/T )k . The method accepts when cθ,T (x) ≥ ε∗ . It assesses whether post-hoc recalibration alone is sufficient to control confident errors. • Confidence Thresholding. This post-hoc baseline keeps the ERM model fixed and selects the most perPnsel  [ sel (εct ) = 1 missive threshold εct on the selection fold such thatJCW bi ̸= yi , ci ≥ εct ≤ i=1 1 y nsel α . At evaluation, it accepts when cθ (x) ≥ εct . This baseline isolates the effect of selecting an empirical JCW-controlling threshold from that of modifying the model during training. • Conformal Risk Control (CRC). CRC [Angelopoulos et al., 2024] keeps the ERM predictor fixed and bn (ε) = selects an operating threshold using the conformal finite-sample risk correction. Define R 1 Pn yi ̸= yi , n ci > ε}. Since this loss is obounded by B = 1 and non-increasing in ε, CRC i=1 1 {b n bn (ε) + 1 ≤ α . Under the exchangeability and regularity condiselects εbCRC = inf ε : n R n+1

n+1

tions of Angelopoulos et al. [2024], this choice satisfies the finite-sample expected-risk guarantee E [Rn+1 (b εCRC )] ≤ α. At evaluation, CRC accepts predictions whose confidence exceeds the selected threshold. Unlike ReliableNet, CRC controls the operating rule of a fixed predictor rather than modifying the classifier parameters during training. • Selective prediction. These methods are trained end-to-end to learn an abstention mechanism jointly with the classifier. They optimize the risk-coverage tradeoff but provide no certified operating point. – SelectiveNet. SelectiveNet [Geifman and El-Yaniv, 2019] augments the classifier with a selection head sθ (x) ∈ [0, 1] and an auxiliary prediction head hθ (x). The main classifier and selection head minimize the selective risk under a target-coverage penalty, !2 P X s (x )ℓ (f (x ), y ) 1 i θ i CE θ i + λcov κ − Lsel (θ) = i P sθ (xi ) , (27) s (x ) + ϵ n i θ i i

+

where κ is the target coverage and λcovPcontrols the coverage penalty. The auxiliary head is trained on all inputs using Laux (θ) = n1 i ℓCE (hθ (xi ), yi ), and the total objective is L(θ) = ωLsel (θ) + (1 − ω)Laux (θ), where ω ∈ [0, 1] is the mixing coefficient. After training, the native rejection score is rSN (x) = 1 − sθ (x), so lower values indicate more acceptable predictions. We select the most permissive threshold tSN on the selection fold such that the empirical JCW of the accepted predictions does not exceed α. At evaluation, SelectiveNet accepts when rSN (x) ≤ tSN , equivalently, when sθ (x) ≥ 1 − tSN . – Deep Gamblers [Liu et al., 2019] augments the classifier with an additional abstain output whose probability p̂m+1 (x) represents rejection. After a short cross-entropy warm-up, the model is trained with the gambling loss   n 1X p̂m+1 (xi ) log p̂yi (xi ) + LDG (θ) = − , n o

(28)

i=1

where m is the number of classes and o > 1 is the reward parameter controlling the trade-off between prediction and abstention. We use o = 1.9. For class prediction, the non-abstention 14

probabilities are renormalized over the m prediction classes. The native rejection score is rDG (x) = p̂m+1 (x), so lower values indicate more acceptable predictions. We select the most permissive threshold tDG on the selection fold such that the empirical accepted-and-wrong rate does not exceed α. At evaluation, Deep Gamblers accepts when p̂m+1 (x) ≤ tDG . The benchmarks were chosen to span the main alternatives to ReliableNet: unconstrained ERM, post-hoc calibration and risk control, and learned selective prediction. ERM, Temperature Scaling, and ReliableNet are evaluated at the common threshold ε∗ , isolating the effect of constrained training at a fixed deployment rule. Methods with native thresholding or abstention scores use the most permissive selection-fold operating point satisfying the empirical JCW budget. All thresholds are fixed before evaluation on the independent certification fold, where every method is assessed using the same hard JCW event and Clopper-Pearson certificate. Because resulting coverages may differ, we also report AURC and risk-coverage curves to compare selective performance at matched coverage.

4.5

Evaluation Metrics

We evaluate predictive performance, reliability, and approximation tightness using metrics that directly correspond to the formulation of probabilistic constraints. Table 1: Evaluation metrics (predictive performance and primary reliability). Aθ (ε) is the acceptance region; π sorts predictions by ascending score (most to least acceptable). ↓ = lower is better. Accuracy ↑

Coverage ↑

HC Accuracy ↑

JCW (primary) ↓

Formula

Acc = P(ŷθ (X) = Y )

Cov = P(X ∈ Aθ (ε))

Accconf = P(ŷ = Y | X ∈ Aθ (ε))

JCW = P (cθ (X) ≥ ε ∧ ŷθ (X) ̸= Y )

Role

Overall correctness. Re- Fraction of inputs accepted. ported for completeness; does not capture confidence or abstention.

Accuracy restricted to accepted predictions. Measures decision quality when the model acts.

Primary reliability metric. Exact quantity controlled by the probabilistic constraint JCW ≤ α.

Table 2: Evaluation metrics (certification, calibration, and selective prediction). Cert. ↑

5

Formula

Cert PS

Role

Certification metric. Counts how often the one-sided ClopperPearson upper bound is below α across S seeds.

ECE ↓

AURC ↓ |Bb | n acc(Bb ) −

P AURC = n1 nk=1 Rk , Rk =   1 Pk i=1 1 ŷπ(i) ̸= yπ(i) , k

Alignment between confidence and accuracy across B bins. Low ECE indicates well-calibrated predictions.

Area under the Risk-Coverage curve. Summarises selective prediction quality across all operating points.

= n o ECE = (s) (s) 1 U (K , m; ρ) ≤ α . conf(Bb ) m s=1 CP

PB

b=1

Experiments

We evaluate ReliableNet on six benchmarks spanning four tabular and two image modalities: a controlled synthetic ambiguity benchmark, UCI Adult, UCI German Credit, the cybersecurity dataset UNSW-NB15, spurious Colored-MNIST-10, and CIFAR-10. The experiments answer three questions. First, does ReliableNet satisfy the joint confident-wrong (JCW) constraint in distribution, and does it do so where standard methods fail? Second, how does it compare with confidence, calibration, and selective-classification baselines across 15

accuracy, coverage, calibration, and ranking quality? Third, how does empirical reliability performance degrade under demographic shift, covariate noise, spurious-correlation inversion, and novel classes? All experiments use PyTorch on an NVIDIA GeForce RTX 3090, with the same base architecture for all methods within each dataset. Tabular models use a two-hidden-layer MLP with width 128; Colored-MNIST uses a five-layer Convolutional Neural Network; and CIFAR-10 uses ResNet-18 [He et al., 2016]. Results are averaged over five seeds {0, 37, 42, 123, 2026}. We set α = 0.05 for the tabular datasets, α = 0.03 for CIFAR-10, and α = 0.01 for Colored-MNIST, with certification level ρ = 0.05. ReliableNet begins with a 10-epoch ERM warm-up, after which ε∗ is fixed to the 80th percentile of the confidence scores of misclassified selection-fold examples. The subsequent constrained-training procedure follows Algorithm 1. The other methods are trained over 100 epochs for tabular dataset and Colored MNIST and 80 for CIFAR10.

5.1

Data Description

We evaluate ReliableNet on six benchmarks covering intrinsic ambiguity, demographic shift, small-sample credit-risk prediction, spurious correlation, image corruption, and novel cyberattacks. Each benchmark is divided into independent training, selection, and certification folds. The selection fold is used for threshold choice, checkpointing, and operating-point selection, while the certification fold remains untouched until the final model is fixed. All preprocessing is fitted on the training fold only. For tabular datasets, numerical variables are median-imputed and standardized, categorical variables are mode-imputed and one-hot encoded, and zero-variance features are removed. Synthetic Band. Synthetic Band is a controlled ambiguity benchmark in (R10 ). Labels follow a fixed linear boundary but are flipped with probability (1/2) within a band of half-width (γ). Outside the band, the task is nearly separable; inside it, uncertainty is irreducible. We use (d=10), (ntrain = 5000), and (ntest = 3000). The in-distribution setting uses (γ = 0.5), while the ambiguity stress test uses (γtest = 0.7). We also monitor the behavior of the JCW over sweeping γ values. UCI Adult. The Adult Income dataset [Becker and Kohavi, 1996] contains (48, 842) census records with 14 demographic and socioeconomic features, with the binary target indicating whether annual income exceeds $50,000. The in-distribution experiment uses a stratified training-selection-certification split. For the stress test, the model is trained on male records and evaluated on female records. The sex variable is used only to define the domains and is excluded from the predictors. Reliability is also assessed across female education subgroups. UCI German Credit. The German Credit dataset [Hofmann, 1994] contains (1000) records describing loan applicants with 20 features covering financial history, loan purpose, and personal attributes, with the binary target indicating creditworthiness. The in-distribution experiment uses a stratified training-selectioncertification split. For the stress test, the model is trained on applicants aged (30) and above and evaluated on applicants younger than (30), producing an age-based subgroup and support shift. Colored-MNIST-10. Colored-MNIST Deng [2012] is a 10-class benchmark in which digit identity is the target and color is an artificial spurious feature. Each digit receives its associated color with probability (ρ); otherwise, an incorrect color is assigned. Images are weakened through downsampling, noise, and occasional occlusion to encourage reliance on color. The in-distribution folds use the same color generation process. For the stress test, the model is trained with (ρtrain = 0.9) and evaluated with (ρtest = 0.1), creating a controlled spurious-correlation shift. We considered monitoring reliability for sweeping ρtest values.

16

CIFAR-10. CIFAR-10 Krizhevsky et al. [2009] contains (60,000) color images from ten object classes. Training, selection, and certification data are drawn from the clean official training split, while the clean official test set provides an independent in-distribution evaluation. Distributional stress tests apply labelpreserving transformations to the same test images, including grayscale conversion, Gaussian noise, and reduced brightness. Images are normalized using the training-set channel statistics. These experiments evaluate reliability under image corruption and covariate shift rather than unknown-class detection. UNSW-NB15. UNSW-NB15 [Moustafa and Slay, 2015] is a network-intrusion dataset of 257,673 flow records, each described by 42 features (39 numerical and 3 categorical: proto, service, state), containing normal traffic and nine attack families. The binary task distinguishes normal from malicious traffic. The source distribution comprises normal observations together with four seen attack families (Generic, Exploits, Fuzzers, DoS), split into training, selection, and in-distribution certification folds. The stress test comprises disjoint normal observations together with the five held-out families (Reconnaissance, Analysis, Backdoor, Shellcode, Worms), evaluating generalization to novel attacks. Normal observations are partitioned before constructing the source and shifted sets to prevent overlap. Categorical features are one-hot encoded and numerical features standardized, with the preprocessing pipeline fitted only on the training fold.

5.2

In-distribution certification and comparison

We first evaluate all methods in distribution using independent training, selection, and certification folds. The training fold is used to fit the model, the selection fold is used to select thresholds, and the certification fold is held out until the final model and operating point are fixed. The
main reliability statistic is the b joint confident-wrong probability JCW = P Y (X) ̸= Y, conf(X) ≥ ε . A seed is certified (Cert) when the Clopper-Pearson certificate is below the risk budget: UCP (Km , m; ρ) ≤ α ( ρ = 0.05). Table 3 compares ReliableNet with ERM, Temperature Scaling, Confidence Thresholding, CRC, SelectiveNet, and DeepGamblers, it first of all reports that ReliableNet is the only method that is consistently certified across all datasets. These in-distribution results show that ReliableNet is not merely a post-hoc thresholding rule. It directly trains the model toward a certificate-compatible JCW constraint. On Synthetic Band and German Credit, ReliableNet obtains the lowest JCW and the highest high-confidence accuracy. On Adult and ColoredMNIST, Temperature Scaling remains a strong calibration baseline, but ReliableNet remains competitive while providing a training-time reliability mechanism and consistent certification behavior.

5.3

Stress Test Results

This part covers aggregated metrics and selective prediction result under various stress tests. 5.3.1

Aggregate Reliability Under Fixed Shift

We evaluate reliability under a single fixed distribution shift per dataset, chosen to represent a realistic deployment mismatch rather than a swept severity. Each dataset defines a distinct shift type: subpopulation shift in Adult (train on male, test on female observations) and German Credit (train on individuals aged ≥ 30, test on those aged < 30); novel-class shift in UNSW-NB15 (train on Generic, Exploits, Fuzzers and DoS; test on the five held-out attack families); a fixed ambiguity gap in Synthetic Band (γtrain = 0.5, γtest = 0.7); spurious-correlation shift in Colored MNIST (ρtrain = 0.90, ρtest = 0.10, fully inverting the colour cue); and covariate shift in CIFAR-10 (grayscale conversion with additive Gaussian noise σ = 0.15 and brightness factor 0.60). Together, these span common shift types encountered in deployment.

17

Table 3: In-distribution results across six datasets (mean ± std over 5 seeds). Coverage is not bolded because it reflects each method’s abstention policy. Cert. counts seeds certified by the held-out Clopper-Pearson bound; AURC is threshold-free and measured over the full test split, so it reflects confidence-ranking quality independent of the operating point (identical for ERM, ConfThresholding, and CRC, which share the ERM score). Arrows indicate the preferred direction; α is the per-dataset JCW budget. Acc ↑

Cov

AccHC ↑

JCW ↓

AURC ↓

JCW/α ↓

ECE ↓

Cert.

ERM TempScaling ConfThresholding CRC SelectiveNet DeepGamblers ReliableNet (Ours)

0.762±0.029 0.762±0.029 0.762±0.029 0.762±0.029 0.762±0.035 0.773±0.034 0.749±0.039

1.00±0.00 0.50±0.07 0.50±0.07 0.44±0.08 0.47±0.11 0.45±0.07 0.39±0.04

0.762±0.029 0.886±0.011 0.886±0.011 0.894±0.019 0.912±0.047 0.908±0.036 0.928±0.031

0.2379±0.0294 0.0568±0.0094 0.0568±0.0094 0.0463±0.0120 0.0442±0.0319 0.0421±0.0211 0.0274±0.0120

0.2314±0.0064 0.2334±0.0058 0.2314±0.0064 0.2314±0.0064 0.2298±0.0119 0.2289±0.0159 0.2145±0.0129

4.76±0.59 1.14±0.19 1.14±0.19 0.93±0.24 0.88±0.64 0.84±0.42 0.55±0.24

0.215±0.020 0.090±0.026 0.215±0.020 0.215±0.020 0.202±0.025 0.207±0.027 0.101±0.030

0/5 1/5 1/5 2/5 2/5 2/5 5/5

Adult

ERM TempScaling ConfThresholding CRC SelectiveNet DeepGamblers ReliableNet (Ours)

0.809±0.003 0.809±0.003 0.809±0.003 0.809±0.003 0.810±0.004 0.816±0.008 0.821±0.004

1.00±0.00 0.63±0.01 0.63±0.01 0.62±0.01 0.62±0.01 0.60±0.01 0.52±0.12

0.809±0.003 0.917±0.007 0.917±0.007 0.917±0.007 0.916±0.005 0.915±0.007 0.952±0.023

0.1911±0.0025 0.0520±0.0050 0.0520±0.0050 0.0517±0.0049 0.0519±0.0040 0.0515±0.0043 0.0271±0.0144

0.0211±0.0013 0.0211±0.0013 0.0211±0.0013 0.0211±0.0013 0.0299±0.0032 0.0284±0.0047 0.0159±0.0018

3.82±0.05 1.04±0.10 1.04±0.10 1.03±0.10 1.04±0.08 1.03±0.09 0.54±0.29

0.056±0.004 0.018±0.006 0.056±0.004 0.056±0.004 0.053±0.008 0.138±0.010 0.015±0.022

0/5 2/5 2/5 2/5 1/5 2/5 5/5

SyntheticBand

ERM TempScaling ConfThresholding CRC SelectiveNet DeepGamblers ReliableNet (Ours)

0.835±0.029 0.835±0.029 0.835±0.029 0.835±0.029 0.837±0.032 0.835±0.030 0.839±0.029

1.00±0.00 0.75±0.08 0.75±0.08 0.74±0.07 0.76±0.05 0.67±0.14 0.42±0.12

0.835±0.029 0.932±0.023 0.932±0.023 0.935±0.017 0.936±0.022 0.937±0.014 0.999±0.001

0.1653±0.0289 0.0515±0.0206 0.0515±0.0206 0.0479±0.0142 0.0483±0.0170 0.0437±0.0160 0.0005±0.0003

0.0721±0.0249 0.0721±0.0249 0.0721±0.0249 0.0721±0.0249 0.0683±0.0243 0.0709±0.0269 0.0712±0.0257

3.31±0.58 1.03±0.41 1.03±0.41 0.96±0.28 0.97±0.34 0.87±0.32 0.01±0.01

0.065±0.011 0.036±0.008 0.065±0.011 0.065±0.011 0.066±0.004 0.074±0.016 0.029±0.019

0/5 3/5 3/5 3/5 2/5 2/5 5/5

Dataset

Method

GermanCredit

Table 4: In-distribution results across six datasets (Table 3 continued). Dataset

Method

Acc ↑

Cov

AccHC ↑

JCW ↓

AURC ↓

JCW/α ↓

ECE ↓

Cert.

ColoredMNIST

ERM TempScaling ConfThresholding CRC SelectiveNet DeepGamblers ReliableNet (Ours)

0.980±0.016 0.980±0.016 0.980±0.016 0.980±0.016 0.985±0.014 0.986±0.008 0.992±0.001

1.00±0.00 0.97±0.05 0.97±0.05 0.97±0.06 0.86±0.25 0.99±0.02 0.98±0.00

0.980±0.016 0.991±0.002 0.991±0.002 0.991±0.002 0.989±0.006 0.990±0.003 0.998±0.001

0.0198±0.0163 0.0091±0.0022 0.0091±0.0022 0.0089±0.0022 0.0085±0.0020 0.0093±0.0028 0.0023±0.0006

0.0238±0.0200 0.0239±0.0201 0.0238±0.0200 0.0238±0.0200 0.009±0.0043 0.0105±0.0201 0.0076±0.0008

1.98±1.63 0.91±0.22 0.91±0.22 0.89±0.22 0.85±0.20 0.93±0.28 0.23±0.06

0.004±0.003 0.003±0.001 0.004±0.003 0.004±0.003 0.003±0.002 0.004±0.003 0.002±0.000

1/5 2/5 2/5 3/5 3/5 2/5 5/5

CIFAR10

ERM TempScaling ConfThresholding CRC SelectiveNet DeepGamblers ReliableNet (Ours)

0.831±0.009 0.831±0.009 0.831±0.009 0.831±0.009 0.822±0.020 0.820±0.009 0.853±0.011

1.00±0.00 0.68±0.03 0.68±0.02 0.68±0.02 0.63±0.06 0.64±0.03 0.52±0.06

0.831±0.009 0.953±0.003 0.952±0.003 0.952±0.003 0.949±0.008 0.949±0.003 0.989±0.003

0.1692±0.0094 0.0319±0.0029 0.0331±0.0024 0.0326±0.0021 0.0321±0.0038 0.0330±0.0033 0.0061±0.0021

0.0681±0.0044 0.0677±0.0044 0.0681±0.0044 0.0681±0.0044 0.0541±0.0169 0.0319±0.0029 0.0530±0.0047

5.64±0.31 1.06±0.10 1.10±0.08 1.09±0.07 1.07±0.13 1.10±0.11 0.20±0.07

0.112±0.009 0.023±0.003 0.112±0.009 0.112±0.009 0.107±0.014 0.130±0.009 0.024±0.012

0/5 1/5 1/5 1/5 2/5 1/5 5/5

UNSW-NB15

ERM TempScaling ConfThresholding CRC SelectiveNet DeepGamblers ReliableNet (Ours)

0.931±0.002 0.931±0.002 0.931±0.002 0.931±0.002 0.929±0.003 0.939±0.002 0.932±0.002

1.00±0.00 0.96±0.00 0.96±0.00 0.96±0.00 0.94±0.01 0.96±0.01 0.85±0.02

0.931±0.002 0.948±0.002 0.948±0.002 0.948±0.002 0.948±0.002 0.950±0.002 0.982±0.005

0.0693±0.0020 0.0497±0.0024 0.0497±0.0024 0.0495±0.0025 0.0486±0.0017 0.0482±0.0024 0.0154±0.0045

0.0141±0.0020 0.0141±0.0020 0.0141±0.0020 0.0141±0.0020 0.0134±0.0030 0.0133±0.0012 0.0139±0.0017

1.39±0.04 0.99±0.05 0.99±0.05 0.99±0.05 0.97±0.03 0.96±0.05 0.31±0.09

0.007±0.001 0.007±0.002 0.007±0.001 0.007±0.001 0.008±0.001 0.042±0.002 0.006±0.002

0/5 2/5 2/5 2/5 3/5 3/5 5/5

Figure 1 compares ReliableNet with the benchmark methods across the six datasets. The main reliability metric is JCW/α, where values below one satisfy the target confident-error budget. ReliableNet consistently reduces JCW/α relative to ERM and all baselines, on all six datasets. On ColoredMNIST, the severe spurious-correlation shift remains challenging; ReliableNet still lowers the normalized confident-error rate 18

compared with the benchmark methods.

(a) JCW/α across datasets and methods. The dotted line marks the target boundary JCW/α = 1.

(b) High-confidence accuracy across datasets and methods.

(c) Coverage across datasets and methods.

(d) Expected calibration error (ECE) across datasets and methods.

(e) Area under the Risk-Coverage curve (AURC) across datasets and methods.

Figure 1: Summary comparison over five random seeds on Adult, ColoredMNIST, German Credit, and SyntheticBand, CIFAR and UNSW-NB15. Bars show seed averages and error bars show standard deviations. The high-confidence accuracy results show that ReliableNet usually achieves the strongest or nearstrongest accuracy among accepted predictions. This suggests that the method improves the quality of accepted predictions rather than simply rejecting difficult cases. The coverage panel confirms the expected reliability-coverage trade-off: ReliableNet rejects more samples than ERM and other benchmark, but generally preserves meaningful coverage. Finally, the ECE results show that Temperature scaling and ReliableNet are better calibrated than other models. The AURC results show improved ranking quality on four datasets and competitive performance on the remaining two. Overall, the summary metrics indicate that ReliableNet offers a favorable balance between reliability, high-confidence accuracy, coverage, selective prediction and calibration across heterogeneous shifts. 5.3.2

Selective Prediction Quality: Risk-Coverage Curve During Stress test

Motivated by Corollary 3.9, we assess selective risk at matched coverage under distribution shift, where differences in confidence ranking become most informative and cannot be attributed to operating at a lower coverage. We report the area under the risk-coverage curve (AURC), where lower values indicate lower 19

selective risk averaged over all coverage levels. Crucially, a risk-coverage curve evaluates every method over the same coverage grid [0, 1]: at each coverage c the curve reports the selective risk of the top-ranked fraction c of inputs, so the comparison is coverage-matched by construction and the AURC integrates each method over identical support. Any advantage therefore reflects a genuinely better confidence ordering and cannot be attributed to a method simply operating at lower coverage. Figure 2 shows mean risk-coverage curves over five seeds under the stress-test conditions of Section 5.3.1. At matched coverage, ReliableNet attains the lowest selective risk over most of the coverage range and the lowest AURC on Adult, ColoredMNIST, German Credit, and CIFAR-10, despite never optimizing AURC directly. This indicates that the JCW constraint does more than lower confident-error rate at a single operating point: it reshapes the confidence scores so that correct predictions are ranked above incorrect ones across the whole coverage spectrum. On UNSW-NB15 and SyntheticBand the methods are statistically indistinguishable (curves overlap within one standard deviation), with ReliableNet essentially tied for best. The trained selective baselines, SelectiveNet and DeepGamblers, degrade most under shift, since their abstention mechanisms are learned on the source distribution and do not transfer. Temperature scaling, confidence thresholding, and CRC track ERM almost exactly, because as post-hoc procedures they recalibrate or threshold the same fixed classifier rather than changing the learned representation.

20

(a) Adult. ReliableNet attains the lowest AURC (0.016 ± 0.002).

(b) German Credit. ReliableNet attains the lowest AURC (0.214 ± 0.012) under age-based shift.

(c) ColoredMNIST. ReliableNet attains the lowest and most stable AURC (0.008 ± 0.001).

(d) CIFAR-10. ReliableNet attains the lowest AURC (0.053 ± 0.004).

(e) UNSW-NB15. ReliableNet ties the post-hoc baselines (0.014 ± 0.002); DeepGamblers is marginally lower (0.013 ± 0.001).

(f) SyntheticBand. Curves overlap within std; ReliableNet (0.071±0.023) is competitive with the best (SelectiveNet, 0.068 ± 0.022).

Figure 2: Risk-coverage curves across four tabular and two image datasets, averaged over five random seeds under the stress-test conditions of Section 5.3.1. Each curve sweeps coverage over [0, 1], so all methods are compared at identical coverage levels; lower curves and lower AURC therefore indicate better confidence ordering independent of any single operating point. ReliableNet improves selective ordering on Adult, ColoredMNIST, German Credit, and CIFAR-10, and remains competitive on SyntheticBand and UNSW-NB15. 21

5.4

Reliability Under Increasing Shift Severity

Having established aggregate performance, we now examine each dataset’s stress test individually, reporting JCW and coverage as a function of shift severity. The two must be read together: JCW alone can be lowered simply by abstaining more, so a low confident-error rate is only meaningful alongside the coverage at which it is achieved. Jointly, the two metrics reveal how each method responds to distribution shift, through increased abstention, retained margin relative to the constraint, or neither, and whether its empirical JCW remains below the risk budget α as shift severity increases beyond the training distribution. Adult data (Education Shift Analysis). Figure 3 evaluates all methods across female subgroups stratified by education level, ordered from lowest to highest. Panel (a) shows that ReliableNet maintains JCW ≤ 0.05 across most education levels, except (Doctorate , Masters, Prof-school) for high-education subgroups where all baselines (except CRC) violate the constraint substantially at Masters and Doctorate level. This violation pattern is not random: higher education subgroups are better represented in the high-confidence region, making confident errors more likely. Panel (b) shows the cost: ReliableNet’s coverage drops sharply for mid-education groups (HS-grad through Bachelors), reflecting increased abstention where the model is uncertain. This suggests that abstention is not uniform but targeted and principled where uncertainty resides the most.

(a) JCW across female subgroups stratified by education level.

(b) Coverage across female subgroups stratified by education level.

Figure 3: JCW and Coverage across female subgroups stratified by education level Synthetic Data We train and evaluate in d = 10 with ntrain = 5000, ntest = 3000 (all examples are 10-dimensional), sweeping γ ∈ {0.1, . . . , 1.3} For the geometric visualization (Fig. 4b) we instantiate the identical generator and training pipeline in d = 2 with the same s and γ and its own unit vector w ∈ R2 (n = 3000). The ambiguous band was shaded as the strip between the parallel lines ⟨w, x⟩ = ±γ, and mark confident errors (ŷ ̸= ỹ, confidence ≥ ε). Figures 4a and 4b jointly explain this result. At the same threshold ε∗ = 0.66, ERM produces 19 confident wrong predictions concentrated inside the ambiguous band while ReliableNet produces zero, having learned to suppress confidence near the boundary. This is confirmed in Figure 4a: ERM saturates at near-perfect confidence at distance ≈ 0.7 from the boundary, while ReliableNet’s confidence rises monotonically with distance as we get away from the ambiguous band. This shows that ReliableNet learns to suppress confidence near the ambiguous region.

22

(a) Prediction confidence as a function of distance to the true decision boundary |w⊤ x|. ERM remains overconfident near the boundary where label noise is irreducible. ReliableNet learns to be uncertain there and recovers high confidence only as distance increases.

(b) ERM vs ReliableNet on the synthetic data on a 2D setting (γ = 0.9, ε∗ = 0.66). Both models are evaluated at the same threshold. ERM produces 19 confident wrong predictions (red crosses) concentrated inside the ambiguous band (grey), where misclassification is irreducible. ReliableNet eliminates all confident errors by suppressing confidence near the boundary, visible as the wider low-confidence region (purple) in the right panel.

Figure 4: Geometric confidence calibration ( ntest = 3,000, α = 0.05).

(a) JCW vs ambiguity band width γ ∈ {0.1, 0.3, 0.5, 0.7, 0.9, 1.1, 1.3} for α = 0.05. All methods except ReliableNet violate the threshold from γ = 0.5 onward. ReliableNet maintains the lowest JCW across all severity levels.

(b) Coverage vs ambiguity band width {0.1, 0.3, 0.5, 0.7, 0.9, 1.1, 1.3} for α = 0.05.

γ

∈

Figure 5: Synthetic Band ambiguity sweep Figures 5 shows that coverage is invariant to the band parameter for all methods. This is because the sweep perturbs p(y | x) while leaving p(x) unchanged: no confidence-thresholding rule can adapt by abstaining more, so robustness here is determined entirely by the margin a method holds against the constraint. The post-hoc baselines, which select the most permissive threshold satisfying JCW ≤ α on validation data, sit on the constraint boundary at the training band and consequently violate it under any increase in severity, reaching 4-5α at band 1.3. ReliableNet attains JCW ≈ 0.001 at the same band, about 2% of the budget, and remains below the risk budget up to band ≈ 1.1, roughly twice the severity range tolerated by any baseline, while degrading gracefully rather than linearly. Constrained training drives the solution into the interior of the feasible set, and this slack, obtained at a fixed coverage cost incurred once at training time, is what converts 23

into robustness under shift. German Age Shift Analysis. Figure 6 evaluates the young-age subpopulations (20-25, 25-30), underrepresented at training time. ERM is severely unreliable here (JCW 0.32-0.37), and none of the post-hoc or selective baselines holds the target either: temperature scaling, confidence thresholding, CRC, SelectiveNet, and Deep Gamblers all sit at JCW 0.06-0.09, above α = 0.05. ReliableNet is the only method that keeps confident-wrong risk below α on both groups, attaining JCW ≈ 0.03 at approximately 25% coverage. Confidence Thresholding and CRC retain slightly higher coverage, approximately 30-40%, but their JCW remains above the target. Thus, ReliableNet achieves the most favorable reliability-coverage trade-off in these subgroups, although part of its lower JCW is associated with its more conservative acceptance rate. Enforcing the constraint during training, rather than selecting a threshold post-hoc, is what attains the target level under shift.

(a) JCW calibration error (α = 0.05).

(b) Empirical coverage.

Figure 6: Evaluation under age subpopulation shifts on German Credit (train: age ≥ 30). Colored MNIST. Figure 7 reports JCW and coverage as the test colour, label correlation ρtest decreases from 0.9 to 0.1, progressively reversing the spurious colour cue learned during training (lower ρtest indicates stronger shift). Coverage declines gradually for the selective methods (ReliableNet: 0.88 → 0.67), while JCW increases as the colour cue becomes increasingly misleading. Across the full severity range, ReliableNet maintains the lowest JCW, reaching approximately 0.17 under full inversion, compared with 0.24-0.26 for the strongest baselines and 0.37 for ERM. Since ReliableNet does not achieve this reduction at higher coverage, the improvement is not explained by accepting more inputs and is consistent with more reliable confidence ordering under spurious-feature shift. At full inversion, no method remains empirically below the JCW budget, although ReliableNet exhibits the slowest degradation.

24

(a) JCW error at sweeping ρtest .

(b) Empirical coverage at sweeping ρtest .

Figure 7: Evaluation under sweeping ρtest . CIFAR-10 (Noise severity). Figure 8 assesses all the methods under input Gaussian noise perturbation. Here, coverage responds to the shift: all selective methods reject increasingly many inputs as severity grows. Robustness here, therefore, combines margin with adaptive rejection. At σ = 0 ReliableNet attains JCW ≈ 0.006, a sixth of the budget α = 0.03, whereas the post-hoc baselines sit on the constraint boundary by construction; at σ = 0.05 this slack is decisive, as ReliableNet remains below the risk budget (≈ 0.022) while every competing method has already violated (2-2.7α, and 0.34 for ERM). The ordering persists at all severities, with ReliableNet reducing confident-error rates by 2-3× relative to the strongest baseline. Notably, baseline coverage increases between σ = 0.1 and σ = 0.25 while their JCW rises, the signature of overconfidence under corruption, whereas ReliableNet’s coverage remains more stable, indicating that constrained training yields confidence that degrades more faithfully under shift.

(a) JCW error (α = 0.03).

(b) Empirical coverage.

Figure 8: Evaluation under Gaussian noise injection (varying noise standard deviation σ) on CIFAR10 (train ID data). UNSW-NB15 Unseen-Attack Analysis. Figure 9 decomposes the UNSW-NB15 unseen-attack split by family, reporting JCW and coverage respectively. Coverage alone suggests excessive conservatism, ReliableNet retains only 45% of Reconnaissance and 37% of Shellcode samples versus 78 − 100% for the baselines, but these are precisely the families where confidence-based baselines fail (JCW up to 2α; ERM 0.19 and 0.13), while ReliableNet attains 0.012 and 0.007. Where confidence remains informative (Backdoor, Worms), it retains 90-96% coverage while providing the lowest JCW. This gives a clear message: abstention is targeted, not uniform. 25

(a) JCW error (α = 0.05).

(b) Empirical coverage.

Figure 9: Evaluation under unseen attacks.

6

Conclusion

High-confidence misclassification is not an ordinary prediction error. It is a reliability failure that can suppress abstention, human review, or other corrective mechanisms precisely when the model is wrong. This paper introduced ReliableNet to address this failure mode directly. Rather than treating reliability as a post-hoc calibration problem, we formulate the probability of being simultaneously confident and wrong as a probabilistic constraint and incorporate this constraint into ERM training. The central idea is that confident-error control admits a clean probabilistic formulation through the Joint Confident-Wrong probability, JCW. By encoding the confident-wrong event through the scalar violation function gθ , the target reliability requirement becomes a standard probabilistic constraint. We then adapt the inner approximation of probabilistic-constrained optimization to obtain a smooth conservative surrogate that can be optimized by gradient-based training. At the population level, feasibility of the smooth inner surrogate implies feasibility of the original JCW constraint. At the finite-sample level, we further provide certification tools that connect empirical feasibility to population reliability, including a held-out Clopper-Pearson certificate for the hard JCW event. The experiments support the main claim that confident-error control can be learned during training. Across tabular and image-based benchmarks, ReliableNet consistently reduces high-confidence errors while maintaining competitive accuracy under the evaluated distribution shifts. The in-distribution certification results show that ReliableNet satisfies the held-out JCW certificate on all seeds for all datasets, unlike the benchmark methods. The comparison with ERM, temperature scaling, confidence thresholding, conformal risk control, SelectiveNet, and Deep Gamblers further shows that ReliableNet is not merely a post-hoc thresholding rule: it changes the learned confidence behavior itself. This is especially visible in settings where the accepted region must become more selective to keep confident mistakes under control. The results also clarify the relationship between ReliableNet, calibration, and selective prediction. ReliableNet does not optimize expected calibration error, coverage, or selective risk directly. Nevertheless, by suppressing confident errors, it often improves calibration in the high-confidence regime and yields strong accepted-sample reliability. The JCW decomposition explains this behavior: controlling JCW constrains the product of coverage and high-confidence error rate. A reliable model may therefore trade some coverage for substantially safer accepted predictions. This is not a weakness of the constraint but its intended behavior in decision-sensitive applications. The theoretical analysis complements the empirical findings: the target confident-wrong event up to a null boundary set can be exactly encoded, ensuring that the probabilistic constraint controls the intended failure mode rather than an unrelated surrogate. ReliableNet induces a selective prediction mechanism. The main 26

ReliableNet tool, JCW control also bounds a weighted high-confidence calibration error under the overconfidence condition, providing a theoretical explanation for the calibration improvements observed in several experiments. The finite-sample feasibility results further distinguish the population inner approximation from the empirical learning problem and justify the use of independent certification folds for post-training reliability claims. Limitations and future work. Some limitations remain. First, ReliableNet is developed here for classification with a scalar confidence threshold. Extending the same probabilistic-constrained principle to regression, structured prediction, and sequential decision-making is an important direction for future work. Second, although the experiments include tabular, synthetic, spurious-correlation, and image benchmarks, larger-scale image and foundation-model settings remain to be studied. Third, the uniform finite-sample surrogate certificate is theoretically useful but can be conservative for high-dimensional neural networks because it depends on parameter dimension and global Lipschitz constants. In practice, the held-out Clopper-Pearson certificate is more directly interpretable, but it requires an independent certification sample from the distribution being certified and can be conservative when the certification fold is small. Finally, the confidence threshold ε∗ is selected before constrained training, and the final model is chosen by held-out feasibility via a validation checkpoint; a fully joint treatment of threshold selection, checkpoint selection, and reliability certification, ideally on a single certification budget, would further strengthen the framework. A related open direction is subgroup-conditional control: our per-family analysis on UNSW-NB15 shows that marginal JCW feasibility does not guarantee feasibility within every subpopulation, motivating group-conditional constraints. Overall, ReliableNet provides a principled path toward classifiers that are not only accurate on average, but also safer in the predictions they choose to make confidently.

References Kalidas Yeturu. Machine learning algorithms, applications, and practices in data science. Handbook of statistics, 43:81–206, 2020. Sotiris B Kotsiantis, Ioannis Zaharakis, P Pintelas, et al. Supervised machine learning: A review of classification techniques. Emerging artificial intelligence applications in computer engineering, 160(1): 3–24, 2007. Stephen C. Hora. Aleatory and epistemic uncertainty in probability elicitation with an example from hazardous waste management. Reliability Engineering & System Safety, 54(2):217–223, 1996. ISSN 09518320. doi: https://doi.org/10.1016/S0951-8320(96)00077-4. URL https://www.sciencedirect. com/science/article/pii/S0951832096000774. Treatment of Aleatory and Epistemic Uncertainty. Armen Der Kiureghian and Ove Ditlevsen. Aleatory or epistemic? does it matter? Structural safety, 31(2): 105–112, 2009. Eyke Hüllermeier and Willem Waegeman. Aleatoric and epistemic uncertainty in machine learning: An introduction to concepts and methods. Machine learning, 110(3):457–506, 2021. Cornelia Gruber, Patrick Oliver Schenk, Malte Schierholz, Frauke Kreuter, and Göran Kauermann. Sources of uncertainty in machine learning–a statisticians’ view. arXiv preprint arXiv:2305.16703, 2023. John Platt et al. Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods. Advances in large margin classifiers, 10(3):61–74, 1999. 27

Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International conference on machine learning, pages 1321–1330. PMLR, 2017. Matthias Minderer, Josip Djolonga, Rob Romijnders, Frances Hubis, Xiaohua Zhai, Neil Houlsby, Dustin Tran, and Mario Lucic. Revisiting the calibration of modern neural networks. Advances in neural information processing systems, 34:15682–15694, 2021. Muthu Chidambaram and Rong Ge. Reassessing how to compare and improve the calibration of machine learning models. In International Conference on Learning Representations, volume 2025, pages 61542– 61570, 2025. Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818–2826, 2016. Rafael Müller, Simon Kornblith, and Geoffrey E Hinton. When does label smoothing help? Advances in neural information processing systems, 32, 2019. Jishnu Mukhoti, Viveka Kulharia, Amartya Sanyal, Stuart Golodetz, Philip Torr, and Puneet Dokania. Calibrating deep neural networks using focal loss. Advances in neural information processing systems, 33: 15288–15299, 2020. Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations (ICLR), 2018. C. K. Chow. An optimum character recognition system using decision functions. IRE Transactions on Electronic Computers, 6(4):247–254, 1957. Peter L. Bartlett and Marten H. Wegkamp. Classification with a reject option using a hinge loss. Journal of Machine Learning Research, 9(59):1823–1840, 2008. Yonatan Geifman and Ran El-Yaniv. Selectivenet: A deep neural network with an integrated reject option. In Proceedings of the 36th International Conference on Machine Learning, 2019. URL https:// proceedings.mlr.press/v97/geifman19a.html. Ziyin Liu, Zhikang Wang, Paul Pu Liang, Russ R Salakhutdinov, Louis-Philippe Morency, and Masahito Ueda. Deep gamblers: Learning to abstain with portfolio theory. Advances in Neural Information Processing Systems, 32, 2019. Anastasios Angelopoulos, Stephen Bates, Adam Fisch, Lihua Lei, and Tal Schuster. Conformal risk control. In International conference on learning representations, volume 2024, pages 55198–55218, 2024. Anastasios N Angelopoulos, Stephen Bates, et al. Conformal prediction: A gentle introduction. Foundations and Trends® in Machine Learning, 16(4):494–591, 2023. Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In international conference on machine learning, pages 1050–1059. PMLR, 2016. Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. Advances in neural information processing systems, 30, 2017. Arkadi Nemirovski and Alexander Shapiro. Convex approximations of chance constrained programs. SIAM Journal on Optimization, 17(4):969–996, 2007. 28

Abebe Geletu, Armin Hoffmann, Michael Klöppel, and Pu Li. An inner-outer approximation approach to chance constrained optimization. SIAM Journal on Optimization, 27(3):1834–1857, 2017. doi: 10.1137/ 15M1049750. URL https://doi.org/10.1137/15M1049750. Tianyi Lin, Chi Jin, and Michael Jordan. On gradient descent ascent for nonconvex-concave minimax problems. In International conference on machine learning, pages 6083–6093. PMLR, 2020. Tianyi Lin, Chi Jin, and Michael I Jordan. Two-timescale gradient descent ascent algorithms for nonconvex minimax optimization. Journal of Machine Learning Research, 26(11):1–45, 2025. Bianca Zadrozny and Charles Elkan. Transforming classifier scores into accurate multiclass probability estimates. In Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 694–699, 2002. Alexandru Niculescu-Mizil and Rich Caruana. Predicting good probabilities with supervised learning. In Proceedings of the 22nd international conference on Machine learning, pages 625–632, 2005. Sunil Thulasidasan, Gopinath Chennupati, Jeff A Bilmes, Tanmoy Bhattacharya, and Sarah Michalak. On mixup training: Improved calibration and predictive uncertainty for deep neural networks. Advances in neural information processing systems, 32, 2019. Taejong Joo and Uijung Chung. Revisiting explicit regularization in neural networks for well-calibrated predictive uncertainty. arXiv preprint arXiv:2006.06399, 2020. Aviral Kumar, Sunita Sarawagi, and Ujjwal Jain. Trainable calibration measures for neural networks from kernel mean embeddings. In International Conference on Machine Learning, pages 2805–2814. PMLR, 2018. Deng-Bao Wang, Lei Feng, and Min-Ling Zhang. Rethinking calibration of deep neural networks: Do not be afraid of overconfidence. Advances in Neural Information Processing Systems, 34:11809–11820, 2021. C. K. Chow. On optimum recognition error and reject tradeoff. IEEE Transactions on Information Theory, 16(1):41–46, 1970. Ran El-Yaniv and Yair Wiener. On the foundations of noise-free selective classification. Journal of Machine Learning Research, 11(53):1605–1641, 2010. URL http://jmlr.org/papers/v11/ el-yaniv10a.html. Yonatan Geifman and Ran El-Yaniv. Selective classification for deep neural networks. Advances in neural information processing systems, 30, 2017. Heinrich Jiang, Been Kim, Melody Y. Guan, and Maya R. Gupta. To trust or not to trust a classifier. In Advances in Neural Information Processing Systems, 2018. António Farinhas, Chrysoula Zerva, Dennis Ulmer, and Andre Martins. Non-exchangeable conformal risk control. In International Conference on Learning Representations, volume 2024, pages 50952–50966, 2024. Matteo Fontana, Gianluca Zeni, and Simone Vantini. Conformal prediction: a unified review of theory and new challenges. Bernoulli, 29(1):1–23, 2023. Alex Kendall and Yarin Gal. What uncertainties do we need in bayesian deep learning for computer vision? Advances in neural information processing systems, 30, 2017. 29

Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, David Sculley, Sebastian Nowozin, Joshua Dillon, Balaji Lakshminarayanan, and Jasper Snoek. Can you trust your model’s uncertainty? evaluating predictive uncertainty under dataset shift. Advances in neural information processing systems, 32, 2019. Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. Proceedings of International Conference on Learning Representations, 2017. Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In International Conference on Learning Representations (ICLR), 2018. Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting outof-distribution samples and adversarial attacks. In Advances in Neural Information Processing Systems (NeurIPS), volume 31, 2018. Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detection. In Advances in Neural Information Processing Systems (NeurIPS), volume 33, pages 21464–21475, 2020a. Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint arXiv:1812.04606, 2018. Ximing Wang, Neng Fan, and Panos M Pardalos. Robust chance-constrained support vector machines with second-order moment information. Annals of Operations Research, 263(1):45–68, 2018. Rashed Khanjani-Shiraz, Ali Babapour-Azar, Zohreh Hosseini-Nodeh, and Panos M Pardalos. Distributionally robust joint chance-constrained support vector machines. Optimization Letters, 17(2):299–332, 2023. Fengming Lin, Shu-Cherng Fang, Xiaolei Fang, and Zheming Gao. Distributionally robust chance-constrained kernel-based support vector machine. Computers & Operations Research, page 106755, 2024. ISSN 0305-0548. doi: https://doi.org/10.1016/j.cor.2024.106755. URL https://www.sciencedirect. com/science/article/pii/S0305054824002272. Xianggen Liu, Qiang Liu, Sen Song, and Jian Peng. A chance-constrained generative framework for sequence optimization. In Hal Daumé III and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 6271–6281. PMLR, 13–18 Jul 2020b. URL https://proceedings.mlr.press/v119/liu20i.html. Yinlam Chow, Mohammad Ghavamzadeh, Lucas Janson, and Marco Pavone. Risk-constrained reinforcement learning with percentile risk criteria. Journal of Machine Learning Research, 18(167):1–51, 2018. Yixuan Wang, Simon Sinong Zhan, Ruochen Jiao, Zhilu Wang, Wanxin Jin, Zhuoran Yang, Zhaoran Wang, Chao Huang, and Qi Zhu. Enforcing hard constraints with soft barriers: Safe reinforcement learning in unknown stochastic environments. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors, Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pages 36593–36604. PMLR, 23–29 Jul 2023. URL https://proceedings.mlr.press/v202/wang23as.html. Yeti Z. Gürbüz, Oğul Can, and A. Aydın Alatan. Deep metric learning with chance constraints. In 2024 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 532–542, 2024. doi: 10.1109/WACV57701.2024.00060. Juan Ramirez, Ignacio Hounie, Juan Elenter, Jose Gallego-Posada, Meraj Hashemizadeh, Alejandro Ribeiro, and Simon Lacoste-Julien. Feasible learning. arXiv preprint arXiv:2501.14912, 2025. 30

Vladimir N. Vapnik. Statistical Learning Theory. Wiley, New York, 1998. Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. Barry Becker and Ronny Kohavi. https://doi.org/10.24432/C5XW20.

Adult.

UCI Machine Learning Repository, 1996.

Hans Hofmann. Statlog (German Credit Data). https://doi.org/10.24432/C5NC77.

UCI Machine Learning Repository, 1994.

DOI: DOI:

Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE signal processing magazine, 29(6):141–142, 2012. Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. Nour Moustafa and Jill Slay. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In 2015 Military Communications and Information Systems Conference (MilCIS), pages 1–6, 2015. doi: 10.1109/MilCIS.2015.7348942.

A

Appendix

This part presents some useful properties of the Geletu-Hoffman parametric function.

A.1

Some Properties of the Smoothing Family

Lemma A.1 (Properties of the smoothing family). Let h(s) := 1{s ≥ 0} and, for 0 < m2 < τ ∈ (0, 1), ζ(τ, s) =

1 + m1 τ , 1 + m2 τ e−s/τ

m1 and 1 + m1

s ∈ R.

Then: (i) (Boundedness) 0 < ζ(τ, s) ≤ 1 + m1 τ for all s ∈ R. (ii) (Conservatism) ζ(τ, s) ≥ h(s) for all s ∈ R. (iii) (Pointwise limit) lim ζ(τ, s) = h(s) for all s ∈ R. τ ↓0

Proof. Write w := m2 τ e−s/τ > 0, so the denominator is 1 + w > 1. 1τ (i) Since 1 + w > 1 and the numerator 1 + m1 τ > 0, 0 < ζ(τ, s) = 1+m 1+w < 1 + m1 τ ; the upper value 1 + m1 τ is approached as s → +∞ (then w → 0). (ii) The map s 7→ ζ(τ, s) is strictly increasing, because as s increases e−s/τ decreases, hence w decreases 1τ and ζ = 1+m 1+w increases. For s < 0, h(s) = 0 < ζ(τ, s) by (i). For s ≥ 0, monotonicity gives 1τ ζ(τ, s) ≥ ζ(τ, 0) = 1+m 1+m2 τ > 1 = h(s). Hence ζ(τ, s) ≥ h(s) for all s. (iii) Fix s and let τ ↓ 0. If s > 0 then −s/τ → −∞, so e−s/τ → 0, the denominator → 1, and ζ → 1 = h(s). If s < 0 then −s/τ → +∞ and τ e−s/τ → +∞ (the exponential dominates the factor τ ↓ 0), 1τ so the denominator → +∞ and ζ → 0 = h(s). If s = 0 then ζ(τ, 0) = 1+m 1+m2 τ → 1 = h(0). In all cases ζ(τ, s) → h(s).

31

Related documents

• Intriguing properties of robust classification#433598
• AdaProb: Efficient Machine Unlearning via Adaptive Probability#128319
• VanillaBench: The Hidden Accuracy Cost of Adversarial Robustness#366198
• Perturbing the Phase: Analyzing Adversarial Robustness of Complex-Valued Neural Networks#1014608
• Robust image representation for classification, retrieval and object discovery#1166399