Self-Poisoning in Adaptive Out-of-Distribution Detection: A Sharp-Threshold Theory and Certified Label-Free Calibration

• URL: http://arxiv.org/abs/2607.21673v1
• Date: Thu, 23 Jul 2026 09:43:46 GMT
• Title: Self-Poisoning in Adaptive Out-of-Distribution Detection: A Sharp-Threshold Theory and Certified Label-Free Calibration
• Abstract summary: Test-time adaptive out-of-distribution detectors update a memory bank from the unlabelled stream.<n>We show this adaptation obeys a provable dynamical law.<n>For the complementary static-calibration failure under drift we give CDC, which restores nominal FPR label-free on all tested drift-affected cells.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Test-time adaptive out-of-distribution (OOD) detectors update a memory bank from the unlabelled stream. We show this adaptation obeys a provable dynamical law. Modelling bank impurity as a generalized Pólya urn, we prove almost-sure convergence to a mean-field equilibrium whose slope acts as a reproduction number. Below one, impurity stays benign. Above one, the bank is fully poisoned and the detector collapses. The measured admission kernel is affine ($R^2 \ge 0.996$) with slope just below one in every encoder family (a protocol signature), so this detector class is near-critical by design, and across 96 settings the predicted threshold matches the empirical collapse, where ungated dictionaries lose up to $0.163$ AUROC. We then prove that a certified admission gate, reading only a frozen reserve, severs the feedback loop and removes the transition at every contamination rate, even adversarially, while controlling false positives label-free. For the complementary static-calibration failure under drift we give CDC, which restores nominal FPR label-free on all tested drift-affected cells. Finally we prove a two-world impossibility theorem. Drift and contamination are indistinguishable without labels, forcing a closed-form power ceiling our procedure approaches. Together these give a complete possibility/impossibility characterization of label-free adaptive OOD detection.

Related papers

• Reversibility-Verified De-identification for Cloud-Local LLM Inference: A Locally Certified Dehydrate-Rehydrate Loop with Layered Assurance (DR-SL) [1.802678437602184]
  DR-SL (Dehydrate-Rehydrate with Self-Learning loop) formalizes de-identification completeness as two measurable conditions.<n>A fully local two-branch verifier iterates dehydration under a lexicographic gate with guaranteed termination.<n>We prove Fano-type lower bounds, a Pufferfish witness, and a rate-privacy feasibility criterion, and state their scope plainly.
  arXiv  Detail & Related papers  (2026-09-14T01:04:58Z)
• SteerCheck: Attribution Specificity and Alignment Leakage in Activation-Steering Audits [5.366718741784969]
  Activation steering can change behaviour without establishing that the effect is specific to the intended concept.<n>We introduce SteerCheck, a preregistered attribution audit that matches off-target KL and separates mean, protected-tail, polarity, transfer, and semantic claims.
  arXiv  Detail & Related papers  (2026-08-25T10:00:29Z)
• When Is Benchmark Contamination Detectable? Information Limits and Power-Calibrated Audits [6.908972852063454]
  Behavioral contamination detectors can return "no evidence" either because a benchmark is clean or because the audit has little power.<n>We formalize this distinction for a benchmark in which an unknown fraction alpha of items was seen during training.<n>Our empirical finding is two-sided. Frozen calibration efficacy predicts held-out power curves, with R2 = 0.83-0.98 across six exact-permutation channels.<n>A predeclared two-stage planner that simulates the deployed test repairs the budgets, is uniformly conservative, and abstains when its probe does not transport.
  arXiv  Detail & Related papers  (2026-08-08T04:41:36Z)
• Conformal calibration and look-elsewhere effect in anomaly detection for new-physics searches [0.0]
  Machine-learned anomaly detection is reshaping searches for new physics, but it has outrun the statistics used to interpret it.<n>We propose a calibration layer, built on conformal prediction, that turns any anomaly score into a defensible significance.
  arXiv  Detail & Related papers  (2026-06-11T18:00:02Z)
• A prior-free blind detection of information leakage from model predictions [0.0]
  We give a decision-theoretic framework in which leakage diagnostics are functionals of the predicted-risk/outcome law.<n>A recalibrated leak matching an honest model's calibration and discrimination is indistinguishable from honest performance by emphany function of the predictions.<n>A near-deterministic subgroup produces a sustained unit-purity head that no legitimate predictor of a non-deterministic outcome can manufacture.
  arXiv  Detail & Related papers  (2026-06-09T05:13:03Z)
• When to Trust Confidence Thresholding: Calibration Diagnostics for Pseudo-Labelled Regression [1.14219428942199]
  A standard practice is to threshold the calibrated score at a confidence cutoff and treat the hard label as the truth.<n>We develop a calibration-aware diagnostic apparatus for pseudo-labelling pipelines.<n>We derive a closed-form expression for the attenuation bias that confidence thresholding induces in the downstream regression coefficient.
  arXiv  Detail & Related papers  (2026-05-12T21:49:11Z)
• MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents [0.0]
  We formalize memory poisoning attacks on retrieval-augmented agents as a Stackelberg game with a unified evaluation framework.<n>We show faithful evaluation increases measured attack success by $4times$ (ASR-R: 0.25 to 1.00$)<n>Our primary contribution is MEMSAD, a calibration-based defense grounded in a gradient coupling.
  arXiv  Detail & Related papers  (2026-05-05T08:15:41Z)
• Evidence Sufficiency Under Delayed Ground Truth: Proxy Monitoring for Risk Decision Systems [0.0]
  This paper formalizes an evidence sufficiency model with four dimensions (completeness, freshness, reliability, representativeness) and a decision-readiness gate.<n>A complementary proxy indicator framework estimates sufficiency degradation without labels.<n>The framework contributes a governance sufficiency monitoring instrument.
  arXiv  Detail & Related papers  (2026-04-17T06:30:11Z)
• CoVerRL: Breaking the Consensus Trap in Label-Free Reasoning via Generator-Verifier Co-Evolution [52.691495954442985]
  CoVerRL is a framework where a single model alternates between generator and verifier roles, with each capability bootstrapping the other.<n> Experiments across Qwen and Llama model families demonstrate that CoVerRL outperforms label-free baselines by 4.7-5.9% on mathematical reasoning benchmarks.<n>Self-verification accuracy improves from around 55% to over 85%, confirming that both capabilities genuinely co-evolve.
  arXiv  Detail & Related papers  (2026-03-18T14:38:55Z)
• Semi-Supervised Regression with Heteroscedastic Pseudo-Labels [50.54050677867914]
  We propose an uncertainty-aware pseudo-labeling framework that dynamically adjusts pseudo-label influence from a bi-level optimization perspective.<n>We provide theoretical insights and extensive experiments to validate our approach across various benchmark SSR datasets.
  arXiv  Detail & Related papers  (2025-10-17T03:06:23Z)
• A Granular Study of Safety Pretraining under Model Abliteration [64.24346997570275]
  We study model abliteration, a lightweight projection technique designed to remove refusal-sensitive directions.<n>We issue 100 prompts with balanced harmful and harmless cases, classify responses as **Refusal** or **Non-Refusal** using multiple judges, and validate judge fidelity.<n>Our study produces a checkpoint-level characterization of which data-centric safety components remain robust under abliteration.
  arXiv  Detail & Related papers  (2025-10-03T07:01:45Z)
• Reinforcement Learning with Verifiable yet Noisy Rewards under Imperfect Verifiers [90.50039419576807]
  Reinforcement Learning with Verifiable Rewards (RLVR) trains policies against automated verifiers to avoid costly human labeling.<n>To reduce vulnerability to verifier hacking, many RLVR systems collapse rewards to binary $0,1$ during training.<n>This choice carries a cost: it introduces textitfalse negatives (rejecting correct answers, FNs) and textitfalse positives (accepting incorrect ones, FPs)
  arXiv  Detail & Related papers  (2025-10-01T13:56:44Z)
• Robust Conformal Prediction with a Single Binary Certificate [58.450154976190795]
  Conformal prediction (CP) converts any model's output to prediction sets with a guarantee to cover the true label with (adjustable) high probability.<n>We propose a robust conformal prediction that produces smaller sets even with significantly lower MC samples.
  arXiv  Detail & Related papers  (2025-03-07T08:41:53Z)
• Robust Yet Efficient Conformal Prediction Sets [53.78604391939934]
  Conformal prediction (CP) can convert any model's output into prediction sets guaranteed to include the true label. We derive provably robust sets by bounding the worst-case change in conformity scores.
  arXiv  Detail & Related papers  (2024-07-12T10:59:44Z)
• Mitigating the Mutual Error Amplification for Semi-Supervised Object Detection [92.52505195585925]
  We propose a Cross Teaching (CT) method, aiming to mitigate the mutual error amplification by introducing a rectification mechanism of pseudo labels. In contrast to existing mutual teaching methods that directly treat predictions from other detectors as pseudo labels, we propose the Label Rectification Module (LRM)
  arXiv  Detail & Related papers  (2022-01-26T03:34:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.