Sam Babichenko

Reading notes / Conformal prediction and distribution shift

Black-box shift estimation

Lipton et al., 2018

Context. Suppose a classifier is trained when 0.1% of cases are positive and deployed when 5% are; every borderline case is then scored against an obsolete prior. One would like to detect the change, estimate the new base rates and correct the model from unlabeled target data, which needs an assumption on how the joint law changes. Under label shift, q(y)q(y) changes while p(x∣y)p(x|y) does not, which fits problems where the label causes the features. Earlier estimators (EM, kernel mean matching) had to model p(x∣y)p(x|y) or match distributions of xx, which scales badly with dimension. This paper uses any trained classifier as a dimension reduction; the estimator has antecedents in epidemiology and quantification, and what is new is the finite-sample analysis, the test, and the use with high-dimensional xx. Under label shift any fixed function of xx has the same conditional law given yy under both distributions, so the target's distribution of predictions is a known linear mixture of the source's class-conditional prediction distributions, and the kk weights q(y)/p(y)q(y)/p(y) solve a k×kk\times k linear system. The classifier need not be accurate or calibrated; it only has to make its confusion matrix invertible, and its quality enters the error only through that matrix's smallest singular value.

Setting. Labels take values in {1,…,k}\{1,\dots,k\}; labeled source data (xi,yi)i≤n(x_i,y_i)_{i\le n} come from PP and unlabeled target data x1′,…,xm′x'_1,\dots,x'_m from QQ. Assume (A1) label shift, p(x∣y)=q(x∣y)p(x|y)=q(x|y); (A2) q(y)>0⇒p(y)>0q(y)>0\Rightarrow p(y)>0, so w(y)=q(y)/p(y)w(y)=q(y)/p(y) is finite; and (A3) a fixed classifier ff whose joint confusion matrix C=[p(f(x)=i, y=j)]ijC=[p(f(x)=i,\,y=j)]_{ij} is invertible. Write y^=f(x)\hat y=f(x), μy^=[q(y^=i)]i\mu_{\hat y}=[q(\hat y=i)]_i, νy=[p(y=i)]i\nu_y=[p(y=i)]_i, μy=[q(y=i)]i\mu_y=[q(y=i)]_i, with plug-in estimates C^\hat C (from labeled source data not used to train ff), μ^y^\hat\mu_{\hat y} and ν^y\hat\nu_y. Black box shift estimation (BBSE) is w^=C^−1μ^y^,μ^y=diag(ν^y) w^.\hat w=\hat C^{-1}\hat\mu_{\hat y},\qquad \hat\mu_y=\mathrm{diag}(\hat\nu_y)\,\hat w. Soft predictions work too, and their confusion matrix can be invertible when the hard one is not, for example when a rare class is never the argmax.

Proposition (consistency). Under A1-A3, w^→w\hat w\to w and μ^y→μy\hat\mu_y\to\mu_y almost surely as n,m→∞n,m\to\infty. Theorem (error bound). Let σmin⁡\sigma_{\min} be the smallest singular value of CC (the statement says eigenvalue, but CC is not symmetric and the proof uses the singular value, which is the quantity to check). There is a constant C0C_0 such that, if n>80log⁡n/σmin⁡2n>80\log n/\sigma_{\min}^2, then with probability at least 1−3kn−10−2km−101-3kn^{-10}-2km^{-10}, ∥w^−w∥22≤C0σmin⁡2(∥w∥22log⁡nn+klog⁡mm),∥μ^y−μy∥22≲∥w∥22log⁡nn+∥νy∥∞2 ∥w^−w∥22.\|\hat w-w\|_2^2\le\frac{C_0}{\sigma_{\min}^2}\Big(\frac{\|w\|_2^2\log n}{n}+\frac{k\log m}{m}\Big),\qquad \|\hat\mu_y-\mu_y\|_2^2\lesssim\frac{\|w\|_2^2\log n}{n}+\|\nu_y\|_\infty^2\,\|\hat w-w\|_2^2. The dimension of xx does not appear. Proposition (detection). Under A1-A3, q(y)=p(y)q(y)=p(y) if and only if q(y^)=p(y^)q(\hat y)=p(\hat y); for any measurable ff and with no assumptions, P=QP=Q implies p(y^)=q(y^)p(\hat y)=q(\hat y).

Step 1

Predictions inherit the invariance, and that gives a linear system. Because y^\hat y depends on yy only through xx, A1 gives q(y^∣y)=p(y^∣y)q(\hat y|y)=p(\hat y|y), and total probability under QQ reads q(y^)=∑yp(y^∣y) q(y)=∑yp(y^,y) w(y),that is,μy^=Cw.q(\hat y)=\sum_yp(\hat y|y)\,q(y)=\sum_yp(\hat y,y)\,w(y),\qquad\text{that is,}\qquad \mu_{\hat y}=Cw. The left side is estimated from unlabeled target data, CC from labeled source data, and A3 makes the system solvable. It is a method of moments in a kk-dimensional space chosen by the classifier. A biased or miscalibrated ff does no harm, because its bias is measured on the source and enters CC and μy^\mu_{\hat y} in the same way. In the binary case this is the old adjusted count, q^(y=1)=(q^(y^=1)−FPR)/(TPR−FPR)\hat q(y=1)=(\hat q(\hat y=1)-\mathrm{FPR})/(\mathrm{TPR}-\mathrm{FPR}); the conditional confusion matrix has determinant TPR−FPR\mathrm{TPR}-\mathrm{FPR}, so an estimate built on a weakly discriminating score is unstable however well that score is calibrated. For a fraud or credit model, this is the base-rate estimate read off the scores of an unlabeled recent month.

Step 2

Consistency is eventual invertibility plus the strong law. Let δ=σmin⁡(C)\delta=\sigma_{\min}(C). C^\hat C is invertible once ∥C^−C∥2<δ/2\|\hat C-C\|_2<\delta/2, which Hoeffding and a union bound make fail with probability exponentially small in nn, so by Borel-Cantelli C^\hat C is singular only finitely often. The strong law for C^\hat C, μ^y^\hat\mu_{\hat y} and ν^y\hat\nu_y, with continuity of matrix inversion at an invertible matrix, gives the almost-sure limits.

Step 3

The error bound is a perturbation bound for a linear solve. Write C^=C+E1\hat C=C+E_1 and μ^y^=μy^+E2\hat\mu_{\hat y}=\mu_{\hat y}+E_2. Since μy^=Cw\mu_{\hat y}=Cw, w^−w=(C+E1)−1(E2−E1w),∥w^−w∥2≤2σmin⁡(∥E1∥2∥w∥2+∥E2∥2),\hat w-w=(C+E_1)^{-1}(E_2-E_1w),\qquad \|\hat w-w\|_2\le\frac2{\sigma_{\min}}\big(\|E_1\|_2\|w\|_2+\|E_2\|_2\big), once ∥E1∥2≤σmin⁡/2\|E_1\|_2\le\sigma_{\min}/2 (Weyl). C^−C\hat C-C is an average of independent centered rank-one matrices of bounded norm, so matrix Bernstein gives ∥E1∥2≲log⁡n/n\|E_1\|_2\lesssim\sqrt{\log n/n}, which is where the sample-size condition comes from; Hoeffding on the kk coordinates gives ∥E2∥2≲klog⁡m/m\|E_2\|_2\lesssim\sqrt{k\log m/m}. Read the bound term by term: the rates are parametric in the label dimension; ∥w∥22\|w\|_2^2 grows with the size of the shift and is large when a class rare in the source becomes common; and 1/σmin⁡21/\sigma_{\min}^2 measures the classifier, with σmin⁡=min⁡yp(y)\sigma_{\min}=\min_yp(y) for a perfect classifier and 00 for one that cannot tell two classes apart. For μ^y\hat\mu_y, the term diag(ν^y−νy)w\mathrm{diag}(\hat\nu_y-\nu_y)w costs ∥w∥2log⁡n/n\|w\|^2\log n/n even if ww were known.

Step 4

Testing for label shift reduces to a two-sample test on predictions. From Step 1, q(y^)−p(y^)=Cy^∣y (q(y)−p(y))q(\hat y)-p(\hat y)=C_{\hat y|y}\,(q(y)-p(y)) with Cy^∣y=C diag(νy)−1C_{\hat y|y}=C\,\mathrm{diag}(\nu_y)^{-1} invertible, so the prediction distributions agree exactly when the label distributions do. To test H0:q(y)=p(y)H_0:q(y)=p(y), compare ff on held-out source data with ff on target data by any two-sample test (Kolmogorov-Smirnov in the experiments). Validity needs nothing beyond A1, since under H0H_0 P=QP=Q and the two samples come from one law; power comes from ff, and the low-dimensional test avoids a kernel test in dimension dd. Since P=QP=Q implies p(y^)=q(y^)p(\hat y)=q(\hat y) for any ff, a rejection also flags covariate or concept shift and can be read as label shift only under A1, and some shifts leave p(y^)p(\hat y) unchanged.

Step 5

Correction is importance-weighted ERM with the estimated weights. Under label shift q(x,y)/p(x,y)=w(y)q(x,y)/p(x,y)=w(y), so minimizing ∑iw(yi) ℓ(yi,xi)\sum_iw(y_i)\,\ell(y_i,x_i) over source data targets the risk under QQ. The algorithm trains ff on one half of the source data and estimates C^\hat C on the other, falls back to w^=1\hat w=1 when σmin⁡(C^)≤δ\sigma_{\min}(\hat C)\le\delta, and otherwise retrains with weights max⁡(w^,0)\max(\hat w,0); negative weights, possible for classes rare in the target, are clipped because they would make the objective unbounded below. There is no guarantee for the corrected classifier beyond consistency of its weights, and the paper suggests correcting only when the test of Step 4 rejects, since reweighting when nothing has shifted only adds variance.

Step 6

In experiments the test on predictions has high power, and much of the accuracy gain comes from the prior. On resampled MNIST and CIFAR-10 with a two-layer MLP as ff, the Kolmogorov-Smirnov test on ff's outputs has uniform p-values under no shift, power far above a kernel B-test on raw images and close to an infeasible oracle test on the labels, and more power for a better-trained ff, matching its larger σmin⁡\sigma_{\min}. Kernel mean matching has lower weight error at the smallest nn, but BBSE's error falls faster and is lower by about n=8,000n=8{,}000; hard and soft BBSE are close. Reweighting raises MNIST accuracy under the largest Dirichlet shift, and the gain fades as the shift shrinks. On CIFAR-10 the unweighted MLP sits near 43% under every shift while BBSE climbs toward 100% as the target concentrates on one class, and that gain comes mostly from the prior: under tweak-one shift, always predicting the tweaked class scores ρ\rho, and for ρ≥0.6\rho\ge0.6 BBSE scores about ρ\rho. Splitting the data to train ff makes BBSE worse than the baseline at very small nn, a cost a classifier already in deployment avoids.

Consequences and limits. Under label shift, one fixed classifier and two frequency tables are enough to detect the shift, estimate the new class proportions at a parametric rate independent of the dimension of xx, and reweight training. The classifier's quality enters only through σmin⁡(C)\sigma_{\min}(C), which can be checked on source data and used to choose among classifiers; the size of the shift enters through ∥w∥2\|w\|_2, which argues for balanced training classes when one can choose them. Everything rests on A1. When the class-conditional law of the features moves too, as when fraudsters adapt or a credit cycle changes who defaults within a class, μy^=Cw\mu_{\hat y}=Cw fails: the detection test can still fire, but the estimated weights are wrong, and nothing in the method can tell that from the unlabeled data alone. The analysis treats ff as fixed and independent of the data used for C^\hat C. Later work regularizes the linear solve (Azizzadenesheli et al., 2019) and finds maximum likelihood (EM) on a calibrated classifier usually more accurate (Alexandari et al., 2020; Garg et al., 2020); the weights w(y)w(y) are also what weighted conformal prediction needs under label shift (Podkopaev and Ramdas, 2021).

Terms

Label shift (A1)
p(x∣y)=q(x∣y)p(x|y)=q(x|y): class proportions change, class-conditional features do not; natural when yy causes xx.
w(y)=q(y)/p(y)w(y)=q(y)/p(y)
Importance weight on labels; under A1 it equals q(x,y)/p(x,y)q(x,y)/p(x,y).
C=[p(f(x)=i,y=j)]C=[p(f(x)=i,y=j)]
Joint confusion matrix of the black box on source data; it must be invertible (A3).
Moment identity
μy^=Cw\mu_{\hat y}=Cw: target prediction frequencies are a known linear mixture of source class-conditionals.
BBSE
w^=C^−1μ^y^\hat w=\hat C^{-1}\hat\mu_{\hat y}, μ^y=diag(ν^y)w^\hat\mu_y=\mathrm{diag}(\hat\nu_y)\hat w; a k×kk\times k solve, no model of xx.
σmin⁡(C)\sigma_{\min}(C)
Smallest singular value; the classifier's quality in the bound, min⁡yp(y)\min_yp(y) for a perfect classifier and 0 for one that cannot tell two classes apart.
Error bound
∥w^−w∥2≲σmin⁡−2(∥w∥2log⁡n/n+klog⁡m/m)\|\hat w-w\|^2\lesssim\sigma_{\min}^{-2}(\|w\|^2\log n/n+k\log m/m), with no dependence on the dimension of xx.
Adjusted count
Binary case: q^(y=1)=(q^(y^=1)−FPR)/(TPR−FPR)\hat q(y=1)=(\hat q(\hat y=1)-\mathrm{FPR})/(\mathrm{TPR}-\mathrm{FPR}).
BBSD
Two-sample test of p(y^)p(\hat y) against q(y^)q(\hat y); under A1-A3 it tests q(y)=p(y)q(y)=p(y) exactly.
BBSC
Importance-weighted ERM with clipped weights max⁡(w^,0)\max(\hat w,0), falling back to w^=1\hat w=1 if σmin⁡(C^)\sigma_{\min}(\hat C) is small.

Quiz

  1. Which property of the classifier controls the estimation error in the theorem?
  2. In the binary case BBSE is the adjusted count (q^(y^=1)−FPR)/(TPR−FPR)(\hat q(\hat y=1)-\mathrm{FPR})/(\mathrm{TPR}-\mathrm{FPR}). When is this estimate unstable?
  3. A fraud model's score distribution on recent transactions moves, and BBSE reports a higher fraud rate. Which situation breaks the estimate even though the test correctly reports a change?

Sources