Calibrating Uncertainty for Zero-Shot Adversarial CLIP

AI summary

Overview

Research area: Computer vision and vision-language models, specifically zero-shot adversarial robustness (ZSAR) and uncertainty calibration for CLIP-style models.

Technical level: Intermediate. The paper assumes familiarity with CLIP-style contrastive pretraining, softmax classification, and PGD/CW/AutoAttack threat models, but it develops the Dirichlet/evidential uncertainty machinery from scratch in its own preliminary section.

Scope: The paper identifies that adversarial perturbations suppress rather than raise CLIP's predictive uncertainty, and proposes an adversarial fine-tuning objective that aligns full Dirichlet predictive distributions between clean and adversarial inputs to restore calibrated confidence while keeping clean accuracy and competitive robustness.

What This Paper Is About

Prior zero-shot adversarial fine-tuning for CLIP mainly pulls an adversarial image embedding toward the ground-truth text prototype (a "single-anchor" alignment), matching predicted logits between clean and adversarial examples and largely ignoring how confident the resulting predictions are. The authors observe a reliability failure that goes beyond accuracy: on adversarially perturbed inputs, CLIP can report lower predictive uncertainty than on the corresponding clean inputs, producing spuriously confident misclassifications and severe miscalibration. The goal is to fine-tune CLIP's image encoder so that uncertainty grows as inputs become harder, while retaining zero-shot generalization.

Key Contributions

1. Dirichlet-based formulation of CLIP. The paper reinterprets CLIP's image-to-text logits as the concentration parameters of a Dirichlet distribution, giving a closed-form way to estimate predictive uncertainty from a single forward pass. The construction is shown to be valid (Lemma 4.3: concentration parameters satisfy α_k(x) ≥ 1 and lie in [1, exp(2/τ′)] with strict monotonicity), to recover CLIP's softmax exactly when τ = τ′ (Lemma 4.5), and to preserve the argmax while exposing a tunable sharpness parameter s = τ/τ′ (Corollary 4.7).

2. Uncertainty-Calibrated Adversarial fine-Tuning (UCAT). A fine-tuning objective that regularizes entire Dirichlet distributions rather than anchoring to a single class, using a reverse KL divergence between the adversarial and clean Dirichlet predictions so that both inter-class relations (aleatoric uncertainty) and overall evidence strength (epistemic uncertainty) are preserved under attack.

3. Extensive empirical validation. Evaluation across 16 single-label zero-shot benchmarks and the multi-label dataset MS-COCO, showing improved uncertainty calibration under attack with competitive adversarial robustness and preserved clean accuracy.

4. Generalization across backbones and settings. The objective is tested on CLIP-B/32, CLIP-B/16 and SLIP-B/16, and under multiple attack regimes (100-step PGD, CW, AutoAttack), with parameter sensitivity analyses over λ and τ′.

Main Findings

• Adversarial inputs can reduce CLIP's uncertainty. The authors report the opposite of the usual expectation that uncertainty rises with input difficulty or distributional shift: perturbations both degrade accuracy and suppress uncertainty, yielding over-confidence. This trend is shown for clean vs. adversarial samples under AutoAttack and CW at ε = 1/255 on CIFAR-10, and the paper states the same trend is observed across multiple datasets (Appendix C.2).

• Calibration restores a sensible difficulty ordering. After UCAT, the predictive uncertainty ordering becomes: original CLIP on clean images < fine-tuned CLIP on clean images < fine-tuned CLIP on adversarial images, which the authors present as faithfully reflecting increasing input difficulty.

• Multi-label MS-COCO results. Models are adversarially trained on TinyImageNet with the FARE 10-step PGD setting (ε = 1/255) and evaluated under CW-100 at ε ∈ {1/255, 2/255, 4/255} plus clean, reporting mAP, precision, recall and F1 at top-3. UCAT achieves F1@3 of 42.07 clean, 37.04 at ε = 1/255, 31.78 at ε = 2/255, and 21.59 at ε = 4/255, with harmonic means H(F1@3) of 39.40, 36.21 and 28.54 at the three attack radii. The paper states UCAT consistently achieves the best top-3 precision, recall, F1 and harmonic mean across the three attack strengths. Gains in mAP are described as more limited, because mAP evaluates fine-grained global ordering across all labels including low-confidence and long-tail categories.

• Single-label averages across 16 datasets. Under TGA-ZSR's fine-tuning setup on TinyImageNet with 2-step PGD at ε = 1/255, UCAT reaches an average clean accuracy of 54.17, compared with 64.45 for CLIP, 43.83 for TeCoA, 53.00 for FARE, 53.72 for PMG-AFT, 49.91 for TGA-ZSR and 52.09 for Comp-TGA. Robust averages are 32.20 under PGD, 31.41 under CW and 30.58 under AutoAttack, with corresponding harmonic means of 40.39, 39.76 and 39.09.

• Two domain-specific exceptions. PCAM and EuroSAT are the only datasets where the method does not rank best or second-best. The authors attribute this to these datasets having the highest predictive uncertainty, strong semantic overlap, and a substantial departure from CLIP's natural-image pre-training domain, leaving less reliable clean semantic structure for Dirichlet alignment to preserve. UCAT is reported to remain stable on these datasets.

• Backbone generalization. On TinyImageNet with 2-step PGD at ε = 1/255, UCAT raises CLIP-B/16 AutoAttack robustness from 0.01 to 30.54 and its harmonic mean from 0.02 to 39.05; CLIP-B/32 from 5.58 to 30.58 (H from 10.28 to 39.09); and SLIP-B/16 from 0.02 to 20.40 (H from 0.04 to 26.68). Clean accuracy drops in each case relative to the base model.

• Reverse KL is deliberately chosen. The authors argue that forward KL covers modes and flattens evidence, whereas reverse KL is mode-seeking and preserves both relative class structure and absolute evidence strength by permitting low evidence on irrelevant classes.

Methodology in Plain English

The approach starts from a structural observation: CLIP's zero-shot prediction is a softmax over image-text similarity scores, and the mean of a Dirichlet distribution is also a softmax-like normalization over its concentration parameters. The authors turn this resemblance into an identity by defining each concentration parameter as an exponential function of the shifted CLIP logit, α_k(x) = exp(h(ℓ_k)) with h(ℓ) = (τℓ + 1)/τ′, where a shift of +1 moves the cosine similarity range from [−1, 1] to [0, 2] and τ′ is a calibration coefficient. When τ′ equals the CLIP temperature τ, the Dirichlet mean reproduces CLIP's softmax exactly; in general it equals softmax(s·ℓ(x)) with s = τ/τ′, so the argmax is untouched and only the sharpness changes. The authors fix τ′ = 0.07, a standard contrastive-learning temperature, which yields s < 1 and hence softer predictions that tolerate semantically related negatives.

On top of this reformulation, fine-tuning proceeds as follows. The text encoder is frozen and the image encoder is trainable. Each training image is paired with an ℓ∞-PGD adversarial version, and both are encoded and mapped to Dirichlet parameters α and α_adv. A regularization term L_ucr = KL(Dir(α_adv) ‖ Dir(α)) aligns the two distributions, and because aleatoric and epistemic uncertainty are closed-form functions of the Dirichlet parameters (aleatoric via a digamma expression, epistemic as EU(x) = C/(α_0 + C)), minimizing this term simultaneously aligns inter-class structure and evidence magnitude. A standard text-guided cross-entropy term L_ce anchors adversarial embeddings to the ground-truth prototype for discriminative supervision. The final objective is L = L_ce + λ·L_ucr, with λ set to 10^5/β where β = 2/e^{τ′}. Fine-tuning uses CLIP-B/32 with TeCoA's protocol, in a light setting (2-step PGD, ε = 1/255) and a stronger setting (10-step PGD, ε = 2/255), and robustness is tested with 100-step PGD, CW and AutoAttack. Code is released at https://github.com/VivienLu/UCAT.

Why This Matters

Impact on research. The paper reframes zero-shot adversarial robustness as a calibration problem rather than a pure accuracy problem, arguing that logit scale carries useful reliability signal in open-vocabulary vision-language models even though many prior methods constrain only the softmax distribution and thereby remove scale effects. It also extends evidential deep learning, previously developed largely for closed-set classifiers, to a frozen-text-encoder CLIP pipeline, and provides a construction that provably reduces to CLIP's own predictive rule under a specific parameter choice.

Real-world applications:

• Open-vocabulary image recognition systems that must signal when a prediction is untrustworthy, such as content moderation or media monitoring pipelines.
• Safety-critical visual inspection in domains like medical imaging (PCAM) or remote sensing (EuroSAT), where the paper specifically notes weaker results but also stability under domain shift.
• Multi-label retrieval and tagging, where the paper's top-3 improvements on MS-COCO matter for ranking the most relevant labels under ambiguity.
• Any deployment that relies on absolute CLIP similarity scores as confidence values for open-set decisions, since the paper argues those scores are where calibration should be measured.

Industry relevance. Adversarially fine-tuning only the image encoder while keeping the text encoder frozen is a cheaper and more practical adaptation path than retraining a full vision-language model, and the reported gains transfer across CLIP-B/32, CLIP-B/16 and SLIP-B/16. The trade-off is a reduction in clean accuracy relative to the base model (for example, 54.17 vs. 64.45 average on the 16 datasets for CLIP-B/32), which is a real deployment consideration.

Future Directions

• Improving calibration on far-domain datasets. UCAT is weakest on PCAM and EuroSAT, which the authors link to high predictive uncertainty, semantic overlap and a large departure from CLIP's pre-training domain. Whether a different alignment target or domain-aware regularization helps there is open.
• Extending to mAP-style global ranking. The authors note that gains are concentrated in top-k reliability metrics while mAP improvements are limited, since mAP depends on fine-grained ordering across all labels including long-tail categories.
• Broader threat models and scale. The paper reports extended evaluation with larger-scale training and stronger attack settings in its appendix, but the main text focuses on ℓ∞ PGD training plus 100-step PGD, CW and AutoAttack at ε up to 4/255 for MS-COCO; other norm constraints and larger backbones remain unexplored.
• Choosing the calibration coefficient more principledly. τ′ is fixed at 0.07 by analogy to contrastive learning conventions, with sensitivity analysis relegated to an appendix; a data- or task-driven rule for selecting it is not established.

Target Audience

Researchers and practitioners working on adversarial robustness of vision-language models, uncertainty quantification and calibration, and evidential deep learning. It is also relevant to engineers deploying CLIP-style models in open-vocabulary settings who need reliable confidence scores, and to readers interested in probabilistic reinterpretations of softmax-based contrastive models.

Authors’ abstract

CLIP delivers strong zero-shot classification but remains highly vulnerable to adversarial attacks. Prior adversarial fine-tuning work primarily matches predicted logits between clean and adversarial examples, which overlooks uncertainty calibration and may degrade the zero-shot generalization. A common expectation in reliable uncertainty estimation is that predictive uncertainty should increase as inputs become more difficult or shift away from the training distribution. However, we frequently observe the opposite in the adversarial setting: perturbations not only degrade accuracy but also suppress uncertainty, leading to severe miscalibration and over-confidence. This reveals a critical reliability gap beyond robustness. To bridge this gap, we propose an adversarial fine-tuning objective for CLIP considering both accuracy and uncertainty. By reparameterizing CLIP outputs as the concentration parameters of a Dirichlet distribution, we propose a unified representation that captures relative semantic structure and confidence magnitude. This enables holistic distribution alignment under perturbations, moving beyond single-logit anchoring and restoring calibrated uncertainty. Experiments across multiple zero-shot benchmarks demonstrate that our method significantly improves uncertainty calibration and achieves competitive adversarial robustness while preserving clean accuracy.