Pith. sign in

REVIEW 5 major objections 4 minor 51 references

PaTAS: A Framework for Trust Propagation in Neural Networks Using Subjective Logic

T0 review · 5 major / 4 minor · reviewed 2026-08-03 · deepseek-v4-flash

Pith's one-line read Neural-network predictions can be assigned a principled trust score by a parallel Subjective Logic layer, flagging poisoned or unreliable inputs independently of accuracy.

desk verdict A coherent layer-wise Subjective Logic trust propagation formalism, but the empirical anchor—gradient-count parameter trust—is unvalidated, so treat this as a framework proposal rather than a demonstrated reliability signal. read the letter →

arxiv 2511.20586 v4 pith:DG3ZFQJ4 submitted 2025-11-25 cs.AI cs.LG

classification cs.AIcs.LG MSC 68T07
keywords TrustworthyAISubjectiveLogicTrustpropagationNeuralnetworksUncertaintyquantificationDatapoisoningInference-pathassessment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PaTAS claims that a neural network's trustworthiness can be computed as a parallel subjective-logic computation, without modifying the network itself. It builds a mirror network of Trust Nodes in which every neuron's inputs are weighted by trust in the corresponding parameters, using Subjective Logic discounting and fusion. During training, a Parameter Trust Update turns gradient magnitudes and label trust into binomial opinions about each weight; at inference, the Inference-Path Trust Assessment propagates input-feature trust along the activated neurons to produce a per-instance trust, distrust, and uncertainty score. If correct, this gives operators a reliability signal distinct from softmax confidence, one that degrades under poisoning, label noise, and adversarial patches, and that provably preserves symmetry and passes uncertainty through vacuous inputs.

What carries the argument

The central mechanism is the Trust Function T_z = fusion_i( T_{x_i} ⊗ T_{theta_i} ), which replaces each neuron's weighted sum with a Subjective Logic discount-then-fuse operation, and the Trust Nodes Network that mirrors the network's topology. The Parameter Trust Update (Algorithm 1) is the load-bearing component: it counts gradient magnitudes below a threshold epsilon as positive evidence and at-or-above as negative evidence, maps these to a binomial opinion, and then revises parameter trust using the aggregated label trust and input-feature trust via SL operators (fusion, deduction, conservative division). IPTA then instantiates the trust network along the specific activated path to comp

What would settle it

Train a network on clean data, then corrupt a known subset of weights (e.g., scramble the output-layer weights); if PaTAS's per-parameter trust does not drop more for the scrambled weights than for untouched weights, the gradient-to-trust mapping is not tracking real parameter reliability. Alternatively, compare PaTAS trust against a direct sensitivity measure: perturb each weight by a small delta and measure test-accuracy change; high-trust weights should be the least sensitive if the mapping is correct.

Watch

Extended reading notes

Core claim

The paper's central claim is that trust in a neural network's output can be modeled as a subjective binomial opinion (trust, distrust, uncertainty) and propagated through a mirror network of Trust Nodes that mirrors every neuron. Each Trust Node computes T_z = fusion_i( T_{x_i} ⊗ T_{theta_i} ), where ⊗ discounts input-feature trust by parameter trust and fusion combines contributions. Parameter trust is learned during training by Algorithm 1, which counts small gradients as positive evidence and large gradients as negative evidence, then revises each weight's trust using label trust and input-feature trust. At inference, Inference-Path Trust Assessment (IPTA) restricts the trust network to t

Load-bearing premise

The load-bearing premise is that a small gradient magnitude (below epsilon) marks a parameter as reliable positive evidence and a large gradient marks it as unreliable, so parameter trust is anchored to gradient magnitude rather than to any direct measurement of parameter quality.

Editorial extensions

If this is right

  • When softmax confidence is high but the input or training data are corrupted, PaTAS still reports low trust and high uncertainty, giving an operator a signal to reject the prediction.
  • Because parameter trust is tied to gradient evidence and label trust, training on poisoned labels produces low trust for the affected parameters even when training accuracy stays high (Table I).
  • The three proved properties — convergence during training, vacuous-in/vacuous-out, and symmetric inference — make the trust scores predictable and testable under canonical boundary inputs.
  • Trust mass and accuracy are not redundant: in poisoned MNIST the clean digit '6' has higher accuracy but lower trust than the clean digit '3', showing PaTAS exposes reliability differences accuracy hides.
  • The parallel design means PaTAS can be attached to an existing network without retraining, though its Parameter Trust Update requires access to training gradients.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the gradient-to-trust mapping is valid, the same machinery could become an online training audit: per-layer trust curves would identify which layers are memorizing poisoned samples, enabling targeted re-training or early stopping.
  • The vacuous conditional T_{n_i | not y_batch} is a placeholder for 'no evidence'; a testable extension would replace it with an opinion derived from out-of-distribution or corrupted inputs, turning IPTA into an OOD detector.
  • Since IPTA constructs a trust network from the activated path, the trust scores could be traced back to individual input features or weights, offering a trust-based attribution map that complements gradient-based explanations.
  • An adaptive epsilon schedule (start large, shrink as training converges) is suggested by the paper's own sensitivity discussion; a concrete experiment would compare fixed vs. scheduled epsilon on poisoned datasets to see if trust separation improves.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. PaTAS proposes a parallel subjective-logic layer on top of a neural network. Every neuron is mirrored by a Trust Node; trust feedforward composes input and parameter trust through SL discounting and fusion; parameter trust is updated each batch from gradient magnitudes and label trust; and the Inference-Path Trust Assessment (IPTA) generates instance- and path-specific trust scores. The paper states theoretical properties (convergence, vacuous-input invariance, symmetry) and reports experiments on breast cancer, MNIST, and poisoned MNIST to show that trust estimates converge, remain symmetric, and separate benign from adversarial inputs.

Significance. If validated, PaTAS would provide a model-agnostic, topology-mirroring trust audit with an interpretable belief/distrust/uncertainty decomposition, which is a useful complement to accuracy and softmax confidence. The paper makes its operator choices explicit, releases an implementation, and proves boundary-case identities that are useful as sanity checks. However, the significance is conditional on two unverified supports: the gradient-to-parameter-trust mapping and a non-circular evaluation of poisoned/adversarial scenarios. As presented, the contribution is a well-specified architecture with preliminary correlations, not yet a demonstrated reliability estimator.

major comments (5)
  1. [Section V-C, Algorithm 1] The entire Parameter Trust Update hinges on NodeTrust (Algorithm 1, lines 22-27), where gradients with |g|<epsilon are counted as positive evidence r and gradients with |g|>=epsilon as negative evidence s. This mapping encodes the assumption that small gradients imply reliable parameters and large gradients imply unreliable ones, with no external calibration against a ground-truth notion of parameter quality. Small gradients also occur for dead ReLUs and saturated units, while large gradients are normal in early training; Section VII.A concedes that this procedure 'may not be optimal' and that calibration of epsilon is 'crucial.' Since T_theta enters every downstream trust computation (Eq. (14), Definition 6), the central reliability signal is unanchored unless this mapping is validated. A test against external quality measures (e.g., pruning/perturbation sensitivity, held-out generaliza
  2. [Section VI-A3, Tables III-IV] The poisoned-MNIST evaluation is partly circular. In the experimental setup, patch pixels are explicitly assigned distrust and the labels of patched 6/9 images are explicitly assigned distrust; IPTA then reports lower trust for those pre-flagged classes. This demonstrates consistency of the propagation rules, not an ability to detect unknown poisoning or adversarial inputs. The claimed 'effectively distinguishes between benign and adversarial inputs' requires an evaluation where the trust layer is not given the attack information, or at least a comparison with standard uncertainty and OOD baselines on the same inputs.
  3. [Section VI-B, Tables III-IV] The empirical separation between benign and adversarial cases is numerically weak and statistically unsubstantiated. In Table IV, clean digit 3 has trust 0.484, clean digit 6 has 0.482, and poisoned digit 6 has 0.449; in Table III the clean/poisoned differences range from about 0.03 to 0.2 depending on patch size. All results appear to come from a single run, with no error bars, confidence intervals, or significance tests. For a claim of 'effectively distinguishing,' I would expect multiple seeds, a ROC/AUC analysis treating trust as a detector, and a comparison against standard baselines such as softmax confidence or MC dropout.
  4. [Section IV-C, Definition 6] The translation from neural arithmetic to subjective-logic operations is asserted rather than justified. Definition 6 sets T_z = W_i( T_{x_i} ⊗ T_{theta_i} ) for z = sum theta_i x_i and sets the trust-equivalent of ReLU to the identity, but no algebraic property is given that makes these substitutions faithful to the network's computation. As noted in the related work, DeepTrust is criticized for exactly this type of ungrounded mapping between SL operators and network operations. The paper should either prove a correspondence property (e.g., order preservation, monotonicity, or a limit consistency result) or explicitly reposition the mapping as a design heuristic whose behavioral validity requires empirical support rather than definitional fiat.
  5. [Appendix C, Theorem 1] The convergence proof is incomplete. Theorem 4 assumes that fusion operators move opinions strictly closer to the fused quantity q, but averaging fusion, which the paper uses in its implementation, does not converge to q; the proof itself notes the exception for averaging fusion. Moreover, Algorithm 1 updates parameter trust through a chain of distinct operations (⊖, ⊙, and the custom ⊘ combination), not through a single generic fusion operator. The proof therefore does not establish convergence for the actual PaTAS update. Please provide a proof for the concrete operator sequence, or remove the convergence theorem and report convergence only as an empirical observation.
minor comments (4)
  1. [Section V-C, Definition 6] The typesetting of the Trust Function definition is corrupted: 'where •⊗ is a trust discounting operator, • W and ⊕ is a trust fusion operator' should read clearly as two separate operators. Please fix all such symbol artifacts in Definition 6 and Table VI.
  2. [Algorithm 1 / Table VII] The pseudocode and symbol table use nonstandard notations such as 'T_ybatch ← −V' and 'T_theta ← − ...' where the intended fusion, deduction, or revision operator is obscure. Standard SL symbols (e.g., ⊕, ⊔, ⊚) would improve readability.
  3. [Section VII.A] The text says epsilon 'is not a tuned hyperparameter but a sensitivity parameter' and then says 'proper calibration of epsilon is therefore crucial.' This is contradictory; clarify whether epsilon requires tuning and how it interacts with gradient scale across layers and training time.
  4. [Section V-D, Theorem 3] The proof of symmetry under fusion states 'any symmetric fusion operator' but the experiments use averaging fusion; some SL fusion variants are not symmetric in the way the theorem states. State explicitly for which fusion variants the proof holds and confirm that the implemented variant satisfies the condition.

Circularity Check

4 steps flagged · score 6.0 of 10

Adversarial 'detection' reduces to pre-assigned distrust: Experiment 3 marks the known patch pixels and poisoned labels as distrusted, and PaTAS returns low trust for those inputs; vacuous-input and symmetry 'properties' are identities of the adopted SL operators; parameter trust is a gradient-magnitude count that the paper's own Discussion concedes is heuristic.

  1. fitted input called prediction [Section VI-A3 (Poisoned MNIST setup), Table IV, Section VII.A]
    "For the poisoned dataset, trust is assigned as follows: •Pixels corresponding to the patch are considered distrusted, while all other pixels are trusted. •Labels for patched images of digits 6 and 9 are distrusted, while others are trusted. ... Furthermore, when we explicitly distrust the patch pixels while trusting the remaining inputs, the resulting trust opinion becomes (0.35, 0.1, 0.55). These results show that PaTAS provides interpretable warnings about poisoned outputs."

    By Definition 6 (T_z = fusion_i(T_{x_i} ⊗ T_{θ_i})) and trust discounting, a distrusted input opinion (0,1,0) discounted by any non-vacuous parameter trust yields zero belief and positive distrust, so the output 'warning' (0.35,0.1,0.55) is generated from the manually pre-assigned patch/label distrust. The abstract's claim that PaTAS 'effectively distinguishes between benign and adversarial inputs' therefore restates the input assignment: the framework is told which pixels and labels are unreliable and then reports low trust for exactly those inputs. With all inputs fully trusted the benign-vs-poisoned contrast shrinks to t=0.484 vs 0.449 (Section VII.A); the dramatic separation appears only after the patch is explicitly marked distrusted. In Experiment 1 too, trust profiles are hand-set t

  2. self definitional [Section V-D, Theorems 2 and 3; 'confirmed' in Section VI-B]
    "PaTAS Feedforward on Vacuous Input Yields Vacuous Output. Let T_x = (0,0,1,a) be the trust assessment of an input to PaTAS. Then for any parameter trust configuration T_θ, the output trust assessment satisfies: T_y = IPTA(T_x) = (0,0,1,a). ... They confirm several theoretical properties of PaTAS proven in Section V-D: ... Inference on fully uncertain input yields fully uncertain output ... Symmetric Inference."

    Both 'properties' are immediate identities of the operators chosen in Section IV-C: discounting multiplies belief/disbelief by the referral's projected probability P, so a vacuous input (0,0,1,a) yields (P·0, P·0, 1−0−0) = (0,0,1,a), and the proof completes with 'by fusion of vacuous opinions: T_z = (0,0,1,a)'. Symmetry (Theorem 3) likewise follows because discounting swaps P·b and P·d and the proof asserts the fusion operator 'treats belief and disbelief symmetrically'. The experimental confirmation in Section VI-B ('a fully uncertain input always produces a fully uncertain output'; 'when input trust assessments are symmetric, the inference results remain symmetric') therefore verifies equations that hold by construction; the paper even says 'Processing uncertain inputs naturally yields u

2 more flagged steps
  1. other [Algorithm 1, NodeTrust (Lines 22-27) and Section VII.A Discussion]
    "Count r: #edges with |g_i,j^(l)| < ϵ; Count s: #edges with |g_i,j^(l)| ≥ ϵ; Map (r, s) into a binomial opinion using Baseline-Prior Quantification. ... Finally, trust quantification for T θi|ybatch in the Trust Update Algorithm 1 relies on a simple gradient-counting procedure. Although computationally efficient ... may not be optimal in all cases ... Proper calibration of ϵ is therefore crucial."

    Algorithm 1 defines parameter trust T_{θ(i,j)} as a function of gradient-magnitude counts (r = #{|g|<ε}, s = #{|g|≥ε}) mapped through Baseline-Prior Quantification, so the entire downstream trust signal is, by construction, a monotone transform of gradient size (Table V: g→0 ⇒ 'Trusted', g→∞ ⇒ 'Distrusted'). The abstract's conclusion that PaTAS 'exposes reliability gaps' is then a report of this renamed gradient statistic plus the manually-assigned input/label trust; no experiment checks whether small gradients actually indicate reliable parameters or whether ε tracks true quality. The paper's own Discussion concedes the gradient-counting 'may not be optimal in all cases' and warns 'if ε is too small, PaTAS may misinterpret gradients as large even when the model performs well'. The Table I

  2. other [Appendix C, Theorem 4 proof (supporting Theorem 1)]
    "By the properties of subjective logic fusion, the result of this operation satisfies one of the following: 1) d(ω_{n+1}, q) < d(ω_n, q), i.e., the new opinion is strictly closer to q, or 2) d(ω_{n+1}, q) = d(ω_n, q) and ω_{n+1} = ω_n, meaning the sequence has reached a fixed point. ... In case 1, the distance to q strictly decreases at each step. Since the 2-norm is bounded in [0,1]^4, the sequence (ω_n) ... converges to the unique fixed point q."

    The proof of Theorems 4/5 and hence of Theorem 1 ('the PaTAS parameter will also converge') rests on an unproved assertion that fusion strictly decreases Euclidean distance to q (or is already a fixed point). That distance-decrease property is precisely the contraction needed to conclude convergence; it is stated as 'a property of subjective logic fusion' without proof for the specific operators used, and the conclusion follows only if the property is granted. Since the implementation states 'Trust revision uses the same averaging fusion', the asserted contraction is the load-bearing premise, making the headline 'convergent' claim an assumed rather than derived result.

full rationale

The framework's internal derivation is self-contained: the SL opinions, discount/fusion equations, Trust Function, and Algorithm 1 are wired consistently, and I found no load-bearing self-citation (citations [12], [14], [37] are background SL/dataset-trust results). The circularity lies in what is presented as prediction. Experiment 3 hands PaTAS the corruption map (patch pixels and poisoned labels pre-labeled distrusted) and then reports low trust for those inputs as evidence that PaTAS 'exposes reliability gaps'; by Eq. (13)-(14) and Definition 6, a distrusted input opinion discounted by any non-vacuous parameter trust yields zero belief and positive distrust, so the detection is the propagation of the input assignment. The vacuous-input and symmetry properties (Theorems 2-3) are identities of the chosen discount/fusion definitions, confirmed as 'properties proven in Section V-D'; they add no independent evidence. The remaining reliability signal, parameter trust, is defined in Algorithm 1 as a gradient-magnitude count with the paper's own Discussion conceding the procedure 'may not be optimal' and epsilon calibration 'crucial', so the trust scores are largely a renamed gradient statistic modulated by manually-assigned trust. The convergence proof likewise assumes the contraction property it purports to prove. Because one component (the gradient-derived IPTA contrast 0.484 vs 0.449) is a genuine computation and the framework architecture itself is not a fit, the circularity is partial: the central reliability predictions reduce substantially to their inputs, but the system is not wholly an empty renaming. Score 6.

Assumptions & free parameters 3 free parameters · 5 assumptions · 2 invented entities

The framework's central computation rests on two postulates: mapping neural multiplication/addition to SL discounting/fusion, and mapping gradient magnitudes to parameter-trust evidence. Both are introduced for this paper without independent validation. The hand-assigned trust profiles in the experiments are additional free inputs that control the observed outcomes.

free parameters (3)
  • epsilon gradient threshold = 0.01 and 0.1 in the cancer experiment
    Controls classification of gradients as positive/negative evidence in NodeTrust (Alg. 1). Final trust masses change materially with epsilon in Table I, and the paper says it can be tuned per layer or reduced during training.
  • Hand-assigned input/label trust opinions = (1,0,0), (0,0,1), (0,1,0), (0.25,0,0.75), (0.25,0.25,0.5)
    Assigned by hand to simulate corruption. For poisoned MNIST, the exact patch pixels and poisoned classes are marked distrusted, which is privileged information the framework would not normally have.
  • Baseline-prior weight W = not specified
    Baseline-Prior Quantification (Eq. 2) requires W > 0 and affects the resulting uncertainty; no value or calibration is given for the NodeTrust mapping.
assumptions (5)
  • standard math SL fusion and discounting operators have the algebraic properties assumed (associativity, symmetry, distance contraction)
    Used in Definitions 1-3 and Theorems 4-5; the contraction property of all fusion operators is asserted, not proven, in Appendix C.
  • ad hoc to paper Multiplication in a neural network can be faithfully represented by SL trust discounting and addition by SL fusion
    Definition 6 maps z = sum theta_i x_i to fusion over T_{x_i} tensor T_{theta_i}; no semantic justification beyond analogy, and DeepTrust is criticized for a comparable mapping.
  • ad hoc to paper Gradient magnitude relative to epsilon is evidence for or against parameter trust
    Alg. 1 NodeTrust counts weak gradients as positive evidence and strong gradients as negative evidence; this empirical identification is not derived or validated against ground-truth reliability.
  • ad hoc to paper The trust-equivalent of ReLU is the identity function
    Section IV-C sets T_f^(l) to identity because ReLU is used; no proof that ReLU preserves subjective opinions.
  • domain assumption The wrong-label conditional trust T_{n_i | not y_batch} is vacuous
    DeduceTrust line 29 initializes the false-label conditional to (0,0,1), asserting there is no evidence for wrong labels; this is a modeling choice that shapes all deduced node trusts.
invented entities (2)
  • Trust Nodes / Trust Nodes Network
    purpose: Per-neuron parallel trust-propagation units mirroring the neural-network structure
    Defined entirely by the paper; no external falsifiable prediction is tied to their semantics, so they have no independent evidence.
  • Inference-Path Trust Assessment (IPTA)
    purpose: Instance-specific trust function built from the activated-neuron subnetwork
    A method construct whose outputs are the framework's own scores; Table IV values are not validated against an external trust benchmark.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PaTAS: A Framework for Trust Propagation in Neural Networks Using Subjective Logic." pith.science (2026). https://pith.science/paper/DG3ZFQJ4

@misc{pith2026251120586,
  author       = {Pith},
  title        = {Pith review of: PaTAS: A Framework for Trust Propagation in Neural Networks Using Subjective Logic},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DG3ZFQJ4}},
  note         = {Machine review of arXiv:2511.20586}
}
read the original abstract

Trustworthiness has become a key requirement for the deployment of artificial intelligence systems in safety-critical applications. Conventional evaluation metrics, such as accuracy and precision, fail to appropriately capture uncertainty or the reliability of model predictions, particularly under adversarial or degraded conditions. This paper introduces the Parallel Trust Assessment System (PaTAS), a framework for modeling and propagating trust in neural networks using Subjective Logic (SL). PaTAS operates in parallel with standard neural computation through Trust Nodes and Trust Functions that propagate input, parameter, and activation trust across the network. The framework defines a Parameter Trust Update mechanism to refine parameter reliability during training and an Inference-Path Trust Assessment (IPTA) method to compute instance-specific trust at inference. Experiments on real-world and adversarial datasets demonstrate that PaTAS produces interpretable, symmetric, and convergent trust estimates that complement accuracy and expose reliability gaps in poisoned, biased, or uncertain data scenarios. The results show that PaTAS effectively distinguishes between benign and adversarial inputs and identifies cases where model confidence diverges from actual reliability. By enabling transparent and quantifiable trust reasoning within neural architectures, PaTAS provides a foundation for evaluating model reliability across the AI lifecycle.

Figures

Figures reproduced from arXiv: 2511.20586 by the authors.

Figure 1
Figure 1. STN used to assess the output y′ = f(x) of a perceptron Θ B. Perceptron Case: SL Formulation Assume that an observer A wants to form a trust opinion ω A y′ on the output y′ of a perceptron. Since A does not directly observe or interact with the internal process used to produce y′, their opinion must be inferred indirectly through the output neuron (or output neurons of the network in the general case), denoted NO. S… view at source ↗
Figure 3
Figure 3. Trust-propagation Trust Network including parameter [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 2
Figure 2. Trust-propagation based solely on input-feature trust [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figures from the paper (41 more)
Figure 4
Figure 4. Figure 4: Illustration of the Trust Node structure and computation [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Overview of PaTAS Workflow [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: High-Level Overview of PaTAS Integration with a [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Functional flow of the PaTAS framework integrated with a neural network, illustrating how trust is propagated and [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: xdistrust+ydistrust 0 20 40 60 80 100 120 0.00 0.05 0.10 0.15 0.20 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.80 0.85 0.90 0.95 1.00 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0.04 0.02 0.00 0.02 0.04 Evolut…
Figure 9
Figure 9. Figure 9: xdistrust+yvacuous [PITH_FULL_IMAGE:figures/full_fig_p023_9.png]
Figure 10
Figure 10. Figure 10: xdistrust+ytrust 0 20 40 60 80 100 120 0.00 0.05 0.10 0.15 0.20 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.80 0.85 0.90 0.95 1.00 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0.04 0.02 0.00 0.02 0.04 Evolutio…
Figure 11
Figure 11. Figure 11: xvacuous+ydistrust [PITH_FULL_IMAGE:figures/full_fig_p024_11.png]
Figure 12
Figure 12. Figure 12: xvacuous+yvacuous 0 20 40 60 80 100 120 0.16 0.18 0.20 0.22 0.24 0.26 0.28 0.30 0.32 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.68 0.70 0.72 0.74 0.76 0.78 0.80 0.82 0.84 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 …
Figure 13
Figure 13. Figure 13: xvacuous+ytrust [PITH_FULL_IMAGE:figures/full_fig_p025_13.png]
Figure 14
Figure 14. Figure 14: xtrust+ydistrust 0 20 40 60 80 100 120 0.24 0.26 0.28 0.30 0.32 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.68 0.70 0.72 0.74 0.76 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0.04 0.02 0.00 0.02 0.04 Evolutio…
Figure 15
Figure 15. Figure 15: xtrust+yvacuous [PITH_FULL_IMAGE:figures/full_fig_p026_15.png]
Figure 16
Figure 16. Figure 16: xtrust+ytrust B. Cancer Model with ϵ = 0.1(Section VI-A1) 0 20 40 60 80 100 120 0.00 0.05 0.10 0.15 0.20 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.80 0.85 0.90 0.95 1.00 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 …
Figure 17
Figure 17. Figure 17: xdistrust+ydistrust [PITH_FULL_IMAGE:figures/full_fig_p027_17.png]
Figure 18
Figure 18. Figure 18: xdistrust+yvacuous 0 20 40 60 80 100 120 0.00 0.05 0.10 0.15 0.20 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.80 0.85 0.90 0.95 1.00 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0.04 0.02 0.00 0.02 0.04 Evolut…
Figure 19
Figure 19. Figure 19: xdistrust+ytrust [PITH_FULL_IMAGE:figures/full_fig_p028_19.png]
Figure 20
Figure 20. Figure 20: xvacuous+ydistrust 0 20 40 60 80 100 120 0.23 0.24 0.25 0.26 0.27 0.28 0.29 0.30 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.70 0.71 0.72 0.73 0.74 0.75 0.76 0.77 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0…
Figure 21
Figure 21. Figure 21: xvacuous+yvacuous [PITH_FULL_IMAGE:figures/full_fig_p029_21.png]
Figure 22
Figure 22. Figure 22: xvacuous+ytrust 0 20 40 60 80 100 120 0.00 0.05 0.10 0.15 0.20 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.80 0.85 0.90 0.95 1.00 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0.04 0.02 0.00 0.02 0.04 Evolution…
Figure 23
Figure 23. Figure 23: xtrust+ydistrust [PITH_FULL_IMAGE:figures/full_fig_p030_23.png]
Figure 24
Figure 24. Figure 24: xtrust+yvacuous 0 20 40 60 80 100 120 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0.04 0.02 0.00 0.02 …
Figure 25
Figure 25. Figure 25: xtrust+ytrust [PITH_FULL_IMAGE:figures/full_fig_p031_25.png]
Figure 26
Figure 26. Figure 26: (0.25, 0, 0.75) 0 20 40 60 80 100 120 0.12 0.14 0.16 0.18 0.20 0.22 Evolution of trust mass for fully trusted input 0 20 40 60 80 100 120 0.78 0.80 0.82 0.84 0.86 0.88 Evolution of uncertainty mass for fully trusted input 0 20 40 60 80 100 120 0.04 0.02 0.00 0.02 0.04…
Figure 27
Figure 27. Figure 27: (0.25, 0.25, 0.5) [PITH_FULL_IMAGE:figures/full_fig_p032_27.png]
Figure 28
Figure 28. Figure 28: Accuracy evolution of the Cancer model under different combinations of clean, corrupted, and noisy features and [PITH_FULL_IMAGE:figures/full_fig_p033_28.png]
Figure 29
Figure 29. Figure 29: Accuracy evolution of the Cancer model when reducing the noise for noised features and labels. [PITH_FULL_IMAGE:figures/full_fig_p033_29.png]
Figure 30
Figure 30. Figure 30: 5 Hidden neurons 0 5 10 15 20 25 30 35 40 0.23 0.24 0.25 0.26 0.27 0.28 0.29 0.30 Evolution of trust mass for fully trusted input 0 5 10 15 20 25 30 35 40 0.70 0.71 0.72 0.73 0.74 0.75 0.76 0.77 Evolution of uncertainty mass for fully trusted input 0 5 10 15 20 25 30 …
Figure 31
Figure 31. Figure 31: 10 Hidden neurons [PITH_FULL_IMAGE:figures/full_fig_p034_31.png]
Figure 32
Figure 32. Figure 32: 20 Hidden neurons 0 5 10 15 20 25 30 35 40 0.3 0.4 0.5 0.6 0.7 0.8 0.9 Evolution of trust mass for fully trusted input 0 5 10 15 20 25 30 35 40 0.1 0.2 0.3 0.4 0.5 0.6 0.7 Evolution of uncertainty mass for fully trusted input 0 5 10 15 20 25 30 35 40 0.04 0.02 0.00 0.…
Figure 33
Figure 33. Figure 33: 20 Hidden neurons with Fully Trusted Assessment [PITH_FULL_IMAGE:figures/full_fig_p035_33.png]
Figure 34
Figure 34. Figure 34: MNIST with Vacuous Trust Assessment [PITH_FULL_IMAGE:figures/full_fig_p036_34.png]
Figure 35
Figure 35. Figure 35: 1 pixel [PITH_FULL_IMAGE:figures/full_fig_p037_35.png]
Figure 36
Figure 36. Figure 36: 4×4 pixels [PITH_FULL_IMAGE:figures/full_fig_p038_36.png]
Figure 37
Figure 37. Figure 37: 20×20 pixels [PITH_FULL_IMAGE:figures/full_fig_p039_37.png]
Figure 38
Figure 38. Figure 38: 27×27 pixels [PITH_FULL_IMAGE:figures/full_fig_p040_38.png]
Figure 39
Figure 39. Figure 39: Accuracy for poisoned MNIST model with 20 hidden neurons [PITH_FULL_IMAGE:figures/full_fig_p041_39.png]
Figure 40
Figure 40. Figure 40: 1 pixel [PITH_FULL_IMAGE:figures/full_fig_p042_40.png]
Figure 41
Figure 41. Figure 41: 4×4 pixels [PITH_FULL_IMAGE:figures/full_fig_p043_41.png]
Figure 42
Figure 42. Figure 42: 20×20 pixels [PITH_FULL_IMAGE:figures/full_fig_p044_42.png]
Figure 43
Figure 43. Figure 43: 27×27 pixels [PITH_FULL_IMAGE:figures/full_fig_p045_43.png]
Figure 44
Figure 44. Figure 44: MNIST randomized trust [PITH_FULL_IMAGE:figures/full_fig_p046_44.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 2 canonical work pages

  1. [1]

    Learning from noisy labels with deep neural networks: A survey,

    H. Song, M. Kim, D. Park, Y . Shin, and J.-G. Lee, “Learning from noisy labels with deep neural networks: A survey,”IEEE Transactions on Neural Networks and Learning Systems, vol. 34, no. 11, pp. 8135– 8153, 2023

  2. [2]

    Your other left! vision-language models fail to identify relative positions in medical images,

    D. Wolf, H. Hillenhagen, B. Taskin, A. B ¨auerle, M. Beer, M. G ¨otz, and T. Ropinski, “Your other left! vision-language models fail to identify relative positions in medical images,” inProceedings of International Conference on Medical Image Computing and Computer-Assisted Inter- vention, 2025

  3. [3]

    Assessing the transferability of adversarial patches in real-world systems: Implications for adversarial testing of image recognition security,

    S. Kleber, J. Eppler, T. Palm, D. Eisermann, and F. Kargl, “Assessing the transferability of adversarial patches in real-world systems: Implications for adversarial testing of image recognition security,” in2025 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks - Supplemental Volume (DSN-S), 2025, pp. 42–48

  4. [4]

    Understanding the effect of accuracy on trust in machine learning models,

    M. Yin, J. Wortman Vaughan, and H. Wallach, “Understanding the effect of accuracy on trust in machine learning models,” in Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, ser. CHI ’19. New York, NY , USA: Association for Computing Machinery, 2019, p. 1–12. [Online]. Available: https://doi.org/10.1145/3290605.3300509 16

  5. [5]

    Ethics guidelines for trustworthy ai,

    High Level Expert Group on Artificial Intelligence, “Ethics guidelines for trustworthy ai,” European Commission, Brussels, Tech. Report, Apr. 2019, published 8 April 2019. [Online]. Available: https:// digital-strategy.ec.europa.eu/en/library/ethics-guidelines-trustworthy-ai

  6. [6]

    Establishing and evaluating trustworthy ai: overview and research challenges,

    D. Kowald, S. Scher, V . Pammer-Schindler, P. M ¨ullner, K. Waxnegger, L. Demelius, A. Fessl, M. Toller, I. G. Mendoza Estrada, I. ˇSimi´c, V . Sabol, A. Tr ¨ugler, E. Veas, R. Kern, T. Nad, and S. Kopeinik, “Establishing and evaluating trustworthy ai: overview and research challenges,”Frontiers in Big Data, vol. V olume 7 - 2024,

  7. [7]

    Trustworthy transfer learning: A survey,

    J. Wu and J. He, “Trustworthy transfer learning: A survey,” 2024. [Online]. Available: https://arxiv.org/abs/2412.14116

  8. [8]

    Smoothgrad: removing noise by adding noise,

    D. Smilkov, N. Thorat, B. Kim, F. Vi ´egas, and M. Wattenberg, “Smoothgrad: removing noise by adding noise,” 2017. [Online]. Available: https://arxiv.org/abs/1706.03825

Show all 51 references
  1. [9]

    Jøsang,Subjective Logic: A Formalism for Reasoning Under Uncertainty, ser

    A. Jøsang,Subjective Logic: A Formalism for Reasoning Under Uncertainty, ser. Artificial Intelligence: Foundations, Theory, and Algorithms. Cham: Springer, 2016. [Online]. Available: https: //doi.org/10.1007/978-3-319-42337-1

  2. [10]

    Upper and lower probabilities induced by a multivalued mapping,

    A. P. Dempster, “Upper and lower probabilities induced by a multivalued mapping,”The Annals of Mathematical Statistics, vol. 38, no. 2, pp. 325–339, 1967

  3. [11]

    Shafer,A Mathematical Theory of Evidence

    G. Shafer,A Mathematical Theory of Evidence. Princeton, NJ: Princeton University Press, 1976

  4. [12]

    Assessing trustworthiness of ai training dataset using subjective logic – a use case on bias,

    K. I. Ouattara, I. Krontiris, T. Dimitrakos, and F. Kargl, “Assessing trustworthiness of ai training dataset using subjective logic – a use case on bias,” 2025. [Online]. Available: https://arxiv.org/abs/2508.13813

  5. [13]

    Multi-source fusion in subjective logic,

    A. Jøsang, D. Wang, and J. Zhang, “Multi-source fusion in subjective logic,” in2017 20th International Conference on Information Fusion (Fusion), 2017, pp. 1–8

  6. [14]

    On subjective logic trust discount for referral paths,

    K. I. Ouattara, A. Petrovska, A. Hermann, N. Trkulja, T. Dimitrakos, and F. Kargl, “On subjective logic trust discount for referral paths,” in 2024 27th International Conference on Information Fusion (FUSION), 2024, pp. 1–8

  7. [15]

    Trust network analysis with subjective logic,

    A. Jøsang, R. Hayward, and S. Pope, “Trust network analysis with subjective logic,” inProceedings of the 29th Australasian Computer Science Conference. Australian Computer Society, 2006, pp. 85–94

  8. [16]

    Trust network analysis with subjective logic,

    ——, “Trust network analysis with subjective logic,” inProceedings of the 29th Australasian Computer Science Conference - Volume 48, ser. ACSC ’06. AUS: Australian Computer Society, Inc., 2006, p. 85–94

  9. [17]

    Optimal trust network analysis with sub- jective logic,

    A. Jøsang and T. Bhuiyan, “Optimal trust network analysis with sub- jective logic,” in2008 Second International Conference on Emerging Security Information, Systems and Technologies, 2008, pp. 179–184

  10. [18]

    Propagation of trust and distrust,

    R. Guha, R. Kumar, P. Raghavan, and A. Tomkins, “Propagation of trust and distrust,” inProceedings of the 13th International Conference on World Wide Web, ser. WWW ’04. New York, NY , USA: Association for Computing Machinery, 2004, p. 403–412. [Online]. Available: https://doi....

  11. [19]

    A review on trust propagation and opinion dynamics in social networks and group decision making frameworks,

    R. Ure ˜na, G. Kou, Y . Dong, F. Chiclana, and E. Herrera-Viedma, “A review on trust propagation and opinion dynamics in social networks and group decision making frameworks,”Information Sciences, vol. 478, pp. 461–475, 2019. [Online]. Available: https: //www.sciencedirect.com...

  12. [20]

    Liar liar, pants on fire; or how to use subjective logic and argumentation to evaluate information from untrustworthy sources,

    A. Koster, A. L. C. Bazzan, and M. de Souza, “Liar liar, pants on fire; or how to use subjective logic and argumentation to evaluate information from untrustworthy sources,”Artificial Intelligence Review, vol. 48, no. 2, pp. 219–235, Aug 2017. [Online]. Available: https://doi....

  13. [21]

    An optimized framework for dspg synthesis and trust network analysis with subjective logic,

    K. I. Ouattara, A. Petrovska, I. Krontiris, T. Dimitrakos, and F. Kargl, “An optimized framework for dspg synthesis and trust network analysis with subjective logic,” inRules and Reasoning, A. Hogan, K. Satoh, H. Da ˘g, A.-Y . Turhan, D. Roman, and A. Soylu, Eds. Cham: Springe...

  14. [22]

    Dos and don’ts of machine learning in computer security,

    D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wressnegger, L. Cavallaro, and K. Rieck, “Dos and don’ts of machine learning in computer security,” 2021. [Online]. Available: https://arxiv.org/abs/2010.09470

  15. [23]

    Pervasive label errors in test sets destabilize machine learning benchmarks,

    C. G. Northcutt, A. Athalye, and J. Mueller, “Pervasive label errors in test sets destabilize machine learning benchmarks,” 2021. [Online]. Available: https://arxiv.org/abs/2103.14749

  16. [24]

    D. V . Vargas,One-Pixel Attack: Understanding and Improving Deep Neural Networks with Evolutionary Computation. Singapore: Springer Singapore, 2020, pp. 401–430. [Online]. Available: https: //doi.org/10.1007/978-981-15-3685-4 15

  17. [25]

    What uncertainties do we need in Bayesian deep learning for computer vision?

    A. Kendall and Y . Gal, “What uncertainties do we need in Bayesian deep learning for computer vision?” inAdvances in Neural Information Processing Systems, vol. 30, 2017, pp. 5574–5584

  18. [26]

    R. M. Neal,Bayesian Learning for Neural Networks, 1st ed., ser. Lecture Notes in Statistics. New York, NY: Springer, 1996, vol. 118, springer Book Archive; eBook ISBN: 978-1-4612-0745-0. [Online]. Available: https://doi.org/10.1007/978-1-4612-0745-0

  19. [27]

    Weight uncertainty in neural networks,

    C. Blundell, J. Cornebise, K. Kavukcuoglu, and D. Wierstra, “Weight uncertainty in neural networks,” 2015. [Online]. Available: https://arxiv.org/abs/1505.05424

  20. [28]

    Decomposition of uncertainty in Bayesian deep learning for efficient and risk-sensitive learning,

    S. Depeweg, J.-M. Hernandez-Lobato, F. Doshi-Velez, and S. Udluft, “Decomposition of uncertainty in Bayesian deep learning for efficient and risk-sensitive learning,” inProceedings of the 35th International Conference on Machine Learning, ser. Proceedings of Machine Learning R...

  21. [29]

    Dropout as a bayesian approximation: Representing model uncertainty in deep learning,

    Y . Gal and Z. Ghahramani, “Dropout as a bayesian approximation: Representing model uncertainty in deep learning,” 2016. [Online]. Available: https://arxiv.org/abs/1506.02142

  22. [30]

    Simple and scalable predictive uncertainty estimation using deep ensembles,

    B. Lakshminarayanan, A. Pritzel, and C. Blundell, “Simple and scalable predictive uncertainty estimation using deep ensembles,” 2017. [Online]. Available: https://arxiv.org/abs/1612.01474

  23. [31]

    A survey of uncertainty in deep neural networks,

    J. Gawlikowski, C. R. N. Tassi, M. Ali, J. Lee, M. Humt, J. Feng, A. Kruspe, R. Triebel, P. Jung, R. Roscher, M. Shahzad, W. Yang, R. Bamler, and X. X. Zhu, “A survey of uncertainty in deep neural networks,”Artificial Intelligence Review, vol. 56, no. 1, pp. 1513–1589, Oct 202...

  24. [32]

    The need for uncertainty quantification in machine-assisted medical decision making,

    E. Begoli, T. Bhattacharya, and D. Kusnezov, “The need for uncertainty quantification in machine-assisted medical decision making,”Nature Machine Intelligence, vol. 1, no. 1, pp. 20–23, Jan 2019. [Online]. Available: https://doi.org/10.1038/s42256-018-0004-1

  25. [33]

    From calibration to collaboration: Llm uncertainty quantification should be more human-centered,

    S. Devic, T. Srinivasan, J. Thomason, W. Neiswanger, and V . Sharan, “From calibration to collaboration: Llm uncertainty quantification should be more human-centered,” 2025. [Online]. Available: https: //arxiv.org/abs/2506.07461

  26. [34]

    Can you trust your model’s uncertainty? evaluating predictive uncertainty under dataset shift,

    Y . Ovadia, E. Fertig, J. Ren, Z. Nado, D. Sculley, S. Nowozin, J. V . Dillon, B. Lakshminarayanan, and J. Snoek, “Can you trust your model’s uncertainty? evaluating predictive uncertainty under dataset shift,” 2019. [Online]. Available: https://arxiv.org/abs/1906.02530

  27. [35]

    On calibration of modern neural networks,

    C. Guo, G. Pleiss, Y . Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” inProceedings of the 34th International Conference on Machine Learning. PMLR, 2017, pp. 1321–1330

  28. [36]

    Evidential deep learning to quantify classification uncertainty,

    M. Sensoy, L. Kaplan, and M. Kandemir, “Evidential deep learning to quantify classification uncertainty,” 2018. [Online]. Available: https://arxiv.org/abs/1806.01768

  29. [37]

    Quantifying calibration error in neural networks through evidence-based theory,

    K. I. Ouattara, I. Krontiris, T. Dimitrakos, and F. Kargl, “Quantifying calibration error in neural networks through evidence-based theory,” in 2025 28th International Conference on Information Fusion (FUSION), 2025, pp. 1–8

  30. [38]

    There is hope after all: Quantifying opinion and trustwortheiness in neural networks,

    M. Cheng, S. Nazarian, and P. Bogdan, “There is hope after all: Quantifying opinion and trustwortheiness in neural networks,” Frontiers in Artificial Intelligence, vol. 3, 2020. [Online]. Avail- able: https://www.frontiersin.org/journals/artificial-intelligence/articles/ 10.33...

  31. [39]

    Uncertainty propagation for dropout-based bayesian neural networks,

    Y . Mae, W. Kumagai, and T. Kanamori, “Uncertainty propagation for dropout-based bayesian neural networks,”Neural Networks, vol. 144, pp. 394–406, 2021. [Online]. Available: https://www.sciencedirect.com/ science/article/pii/S0893608021003555

  32. [40]

    Input uncertainty propagation through trained neural networks,

    P. Monchot, L. Coquelin, S. J. Petit, S. Marmin, E. Le Pennec, and N. Fischer, “Input uncertainty propagation through trained neural networks,” inProceedings of the 40th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, A. Krause, E. ...

  33. [41]

    Propagation of uncertainty through multilayer perceptrons for robust automatic speech recognition

    R. Astudillo and J. Neto, “Propagation of uncertainty through multilayer perceptrons for robust automatic speech recognition.” 08 2011, pp. 461– 464

  34. [42]

    Spreading activation models for trust propagation,

    C.-N. Ziegler and G. Lausen, “Spreading activation models for trust propagation,” inIEEE International Conference on e-Technology, e- Commerce and e-Service, 2004. EEE ’04. 2004, 2004, pp. 83–97

  35. [43]

    Multi-source fusion operations in subjective logic,

    R. W. van der Heijden, H. Kopp, and F. Kargl, “Multi-source fusion operations in subjective logic,” 2018. [Online]. Available: https://arxiv.org/abs/1805.01388 17

  36. [44]

    Breast cancer wisconsin (diagnostic) data set,

    W. H. Wolberg, O. L. Mangasarian, and W. N. Street, “Breast cancer wisconsin (diagnostic) data set,” https://archive.ics.uci.edu/ml/datasets/ breast+cancer+wisconsin+(diagnostic), 1995, uCI Machine Learning Repository

  37. [45]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,”Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998

  38. [46]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” 2017. [Online]. Available: https://arxiv.org/abs/1712.05526

  39. [47]

    Principles of subjective networks,

    A. Jøsang and L. Kaplan, “Principles of subjective networks,” in2016 19th International Conference on Information Fusion (FUSION), 2016, pp. 1292–1299. 18 APPENDIXA SUBJECTIVELOGICOPERATORS ANDNOTATION FORPARAMETER-TRUSTUPDATE TABLE VI: Summary of Subjective Logic Operators Us...

  40. [49]

    Sincea q ∈[0,1[, this is a geometric sequence: an =a 0an q →0asn→ ∞

    Convergence ofa n:By definition,a n+1 =a naq. Sincea q ∈[0,1[, this is a geometric sequence: an =a 0an q →0asn→ ∞

  41. [50]

    This is a first-order linear recurrence

    Convergence ofd n:The recurrence relation is: dn+1 =d n +d q −d ndq =d n(1−d q) +d q. This is a first-order linear recurrence. Ifd q >0, the sequence is increasing and bounded above by 1. Therefore: lim n→∞ dn = 1 (the fixed point) 21 Ifd q = 0, thend n+1 =d n =d 0 for alln

  42. [51]

    Behavior ofb n:The update equation forb n+1 is rational function involvinga n,b n, andu n. Asa n →0, the update expressions simplify: bn+1 ≈b nbq +a qbnuq =b n(bq +a quq) =b npq this converges since the projected probabilityp q ∈[0,1] To conclude withu n, since we haveu n = 1−...

  43. [2024]

    Available: https://www.frontiersin.org/journals/big-data/ articles/10.3389/fdata.2024.1467222

    [Online]. Available: https://www.frontiersin.org/journals/big-data/ articles/10.3389/fdata.2024.1467222

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.