Adversarially Robust Abductive Fusion of Pre-trained Transformer-based Perception Models

# Adversarially Robust Abductive Fusion of Pre-trained Transformer-based Perception Models
Source: [https://arxiv.org/html/2608.04190](https://arxiv.org/html/2608.04190)
###### Abstract

Deploying pre\-trained perception models in novel environments degrades their accuracy under distributional shift, and assembling them alone does not recover it: combiners such as majority voting trade recall for precision and are brittle to coordinated failures\. Prior metacognitive methods learn logical rules that flag a model’s errors, but rely on hand\-authored domain\-knowledge cues \(object\-size priors, segmentation masks\) that do not transfer to genuinely novel scenes\. We show that this metacognitive layer can be learned*without any domain knowledge*by exploiting vector\-space geometry: per\-model*Label Vector Pools*\(LVP\), built from each model’s own training embeddings, yield error\-detection rules from the geometry of detections relative to training\-determined prototypes, reaching parity with domain\-knowledge rules to within0\.0020\.002every F1 on test set\. Because the approach remains neurosymbolic, these geometric rules share a single logical framework and can still be complemented by domain knowledge when available\. We frame the fusion of multiple imperfect ViT\-based detectors as a*consistency\-based abduction*problem solved at test time by an exact Integer Program \(IP\) and a polynomial\-time heuristic\. On an aerial\-imagery benchmark of 15 weather\-shifted test sets and six ViT detectors, our domain\-knowledge\-free layer matches the strongest majority\-vote variant on clean data \(within0\.0050\.005F1\) and, unlike every majority\-vote baseline, retains its performance under a coordinated label\-flipping attack: at a90%90\\%flip rate it averages0\.420\.42F1 versus0\.350\.35for MV\-Plurality \(a22%22\\%relative gain\) and attains the highest F1 on*every*test set once the flip rate exceeds0\.40\.4\.

## Introduction

Pre\-trained perception models are now the default for classification and detection in images and video\(Hanet al\.[2021](https://arxiv.org/html/2608.04190#bib.bib15); Radfordet al\.[2021](https://arxiv.org/html/2608.04190#bib.bib16)\), and in practice they are deployed on the distribution they were trained on\. We focus on the*deployment in novel environments*setting: the operating conditions differ from training and no labeled data from target distribution is available\. Emergency response after a disaster, or an aid mission to a remote region for which no representative imagery exists, are concrete examples—the scene is*novel*relative to anything the models have seen\.

Recent work\(Leivaet al\.[2026](https://arxiv.org/html/2608.04190#bib.bib1)\)has combined ideas from abducitve learning\(Daiet al\.[2019](https://arxiv.org/html/2608.04190#bib.bib20)\)and metacognitive error detection rules\(Kricheliet al\.[2024](https://arxiv.org/html/2608.04190#bib.bib6)\)for test\-time ensembling of vision models in a novel environment\. However, this approach requires the establishment of candidate metacognitive cues that the learner uses to derive rules\. This means that the system designer must have some a\-priori domain knowledge on potential causes of error, which may lead to bespoke systems that to not generalize\. Further, while that work showed significant improvement over the baselines, it did not examine the case where some of the perceptual models may be subject to adversarial perturbations\.

Here we extend the work of\(Leivaet al\.[2026](https://arxiv.org/html/2608.04190#bib.bib1)\)by removing its two key limitations\. The working hypothesis is the same: deploying*more than one*model and reasoning over their joint \(in\)consistency can recover the recall that single\-model error filtering throws away\. We extend that line in two ways that we argue are necessary for novel and adversarial deployment\.

Contribution 1: A domain\-knowledge\-free metacognitive layer\.We replace hand\-authored domain cues with a learned signal that uses nothing but each model’s own embeddings\. Borrowing the*Label Vector Pool*idea from continual learning with CLIP\(Maet al\.[2025](https://arxiv.org/html/2608.04190#bib.bib2)\), we represent each \(model, class\) by a small pool of prototype vectors obtained from the model’s training detections, and train a light error detector on the distances of a new detection to these pools\. The resulting “LVP error probability” is the only condition our error\-detection rules use—no masks, no size priors, no scene semantics\. This makes the entire metacognitive stack transferable to any new model or scene\.

Contribution 2: Robustness to attacks on majority voting\.Majority voting is the canonical way to combine models, yet it is fragile since an adversary who can coordinate a minority of models can flip the vote\. We study a*coordinated label\-flip*attack designed precisely to defeat plurality voting, and show that our abductive formulation degrades far more gracefully than any majority\-vote variant because it accepts predictions based on cross\-model*consistency*rather than raw counts\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/x1.png)Figure 1:Overview\.\(Top\)Offline, each of theη\\etapre\-trained models builds a Label Vector Pool by clustering its training\-detection embeddings withkk\-means into per\-class prototype pools𝒫i,c=\{μi,c1,μi,c2,μi,c3\}\\mathcal\{P\}\_\{i,c\}=\\\{\\mu\_\{i,c\}^\{1\},\\mu\_\{i,c\}^\{2\},\\mu\_\{i,c\}^\{3\}\\\}\(⋆\\star= centroids\)\. A new detection with embedding e is mapped toϕ​\(e\)∈ℝ3​m\\phi\(e\)\\in\\mathbb\{R\}^\{3m\}and a per\-\(model, class\) Random Forest yields an error probabilitys∈\[0,1\]s\\in\[0,1\]; thresholdings≥τs\\geq\\tauvia the EDR rule learner \(strictnessϵ\\epsilon\) produces the error\-detection programΠi\\Pi\_\{i\}—using no domain knowledge and no target\-distribution data\.\(Bottom\)At test time theη\\etamodels perceive a novel scene; their predictions, together with the per\-model programsΠi\\Pi\_\{i\}, form a logical programΠ\\Pi\. Consistency\-based abduction selects an accepted set maximizing coverage𝑃𝑟𝑒𝑑​\(H\)\\mathit\{Pred\}\(H\)subject to𝐼𝑛𝑐​\(H\)≤δ\\mathit\{Inc\}\(H\)\\leq\\delta, solved by an exact Integer Program \(IP\) or a polynomial\-time Heuristic Search \(HS\), each with an optional tie\-breaker \(TB\)\. Rules are learned independently per model from training data only, so there is no test\-time leakage\. Unlike majority voting, the combiner degrades gracefully under coordinated label\-flip attacks because acceptance is consistency\-driven, not count\-driven\.As summarized in Figure[1](https://arxiv.org/html/2608.04190#Sx1.F1),η\\etamodels perceive a novel scene; their predictions, together with LVP\-derived metacognitive rules learned independently per model, are encoded in a logical program\. We then abduce a subset of accepted predictions that maximizes coverage while keeping logical inconsistency below a budget\. We derive an exact Integer Program \(IP\) and a scalable Heuristic Search \(HS\), each with an optional tie\-breaker \(TB\)\. The rules are learned only from each model’s training data, so there is no test\-time leakage and no assumption about how models perform together\.

## Related Work

Error detection and correction rules\.Prior work on error detection rules \(EDR\) relies on the assumption that there is prior knowledge on the potential causes of error \- an assumption relaxed in this paper\(Xiet al\.[2024](https://arxiv.org/html/2608.04190#bib.bib5); Kricheliet al\.[2024](https://arxiv.org/html/2608.04190#bib.bib6)\)\. A recent use of EDR\(Leivaet al\.[2026](https://arxiv.org/html/2608.04190#bib.bib1)\)leverages this in an abductive framework for test\-time ensembling, which we use as a baseline in this paper\. We differ in two ways: we operate over*multiple*models, and our rule*conditions*are derived from a learned LVP error detector rather than domain\-specific predicates\. We use only error*detection*rules here, though correction rules fit the same framework\.

Abductive learning\.ABL\(Daiet al\.[2019](https://arxiv.org/html/2608.04190#bib.bib20)\)also uses abduction with domain knowledge, but to improve a model at training time and under the assumption that the test environment is not fully novel; the follow\-up on new concepts\(Caiet al\.[2021](https://arxiv.org/html/2608.04190#bib.bib21)\)extends the label scheme similarly to EDCR\. We instead use abduction*only at test time*and change the data distribution rather than the concept scheme\. Classic consistency\-based diagnosis\(Reiter[1987](https://arxiv.org/html/2608.04190#bib.bib23); Poole[1989](https://arxiv.org/html/2608.04190#bib.bib22)\)and the complexity of logic\-based abduction\(Eiter and Gottlob[1995](https://arxiv.org/html/2608.04190#bib.bib4)\)inspire our formulation; to the best of our knowledge this machinery has not been applied to test\-time perception over model ensembles\.

Label Vector Pool and prototypes\.LVP\-CLIP\(Maet al\.[2025](https://arxiv.org/html/2608.04190#bib.bib2)\)keeps, per class/task, a*pool*of label vectors rather than a single text embedding, enabling continual learning without forgetting\. This is conceptually related to prototypical networks\(Snellet al\.[2017](https://arxiv.org/html/2608.04190#bib.bib24)\)\. We repurpose the pool idea not for classification but for*error detection*: distances to per\-class prototype pools are the features of a metacognitive classifier\.

Test\-time training and adaptation\.TTT\(Sunet al\.[2020](https://arxiv.org/html/2608.04190#bib.bib25)\)adapts the network itself at test time via self\-supervision\. This is complementary: a TTT\-adapted model is just another pre\-trained model in our framework, and several TTT variants could be combined through our abduction layer\.

Adversarial robustness of ensembles\.Adversarial examples and poisoning are well studied\(Goodfellowet al\.[2014](https://arxiv.org/html/2608.04190#bib.bib26); Madryet al\.[2017](https://arxiv.org/html/2608.04190#bib.bib27); Biggioet al\.[2012](https://arxiv.org/html/2608.04190#bib.bib28); Biggio and Roli[2018](https://arxiv.org/html/2608.04190#bib.bib29); Minget al\.[2024](https://arxiv.org/html/2608.04190#bib.bib30)\), and ensembles are not automatically robust\(Tramèret al\.[2017](https://arxiv.org/html/2608.04190#bib.bib31)\)\. We study a threat aimed specifically at the*combiner*: a coordinated minority of models is made to agree on a wrong label, defeating plurality voting\. Our consistency\-based acceptance method is shown to be more resistant to this attack\.

## Consistency\-based Abduction

We summarize the framework we build on; though the formulation follows\(Leivaet al\.[2026](https://arxiv.org/html/2608.04190#bib.bib1)\), we keep it self\-contained\.

Preliminaries\.We consider object identification over perception dataΩ\\Omegawithη\\etamodelsℱ=\{f1,…,fη\}\\mathcal\{F\}=\\\{f\_\{1\},\\dots,f\_\{\\eta\}\\\}predicting overmmclasses𝒞=\{c1,…,cm\}\\mathcal\{C\}=\\\{c\_\{1\},\\dots,c\_\{m\}\\\}\. Under the unique\-name assumption111Implementation details for the unique\-name assumption are in the supplementary material \(Sec\. A\)\., each objectω∈Ω\\omega\\in\\Omegadetected by a model yields a factfi​\(ω\)=cjf\_\{i\}\(\\omega\)=c\_\{j\}; the set of such facts \(“observations”\) isOO\. Because models disagree and make mistakes, we introduce𝑎𝑐𝑐𝑒𝑝𝑡​\(i,c\)\\mathit\{accept\}\(i,c\), which is true when we choose to trust modelfif\_\{i\}’s outputs of classcc\. The set of all acceptance atoms isℋ\\mathcal\{H\}; a subsetH⊆ℋH\\subseteq\\mathcal\{H\}is a*hypothesis*\.

Each modelfif\_\{i\}carries a logic programΠi\\Pi\_\{i\}of metacognitive rules of the form:

𝑒𝑟𝑟𝑜𝑟​\(i,c,ω\)←\(fi​\(ω\)=c\)∧𝑐𝑜𝑛𝑑​\(ω\)\.\\mathit\{error\}\(i,c,\\omega\)\\leftarrow\(f\_\{i\}\(\\omega\)=c\)\\wedge\\mathit\{cond\}\(\\omega\)\.I\.e\., if cue𝑐𝑜𝑛𝑑\\mathit\{cond\}fires forω\\omegaandfif\_\{i\}labeled itcc, an error is suspected\. The novelty here is that𝑐𝑜𝑛𝑑\\mathit\{cond\}is the single LVP\-derived predicateLVP​\_​Error​\_​Probability​\_​GEτ\\mathrm\{LVP\\\_Error\\\_Probability\\\_GE\}\_\{\\tau\}, learned without domain knowledge\. Helper programΠhelper\\Pi\_\{\\textit\{helper\}\}contains

𝑎𝑠𝑠𝑖𝑔𝑛​\(c,ω\)←¬𝑒𝑟𝑟𝑜𝑟​\(i,c,ω\)∧\(fi​\(ω\)=c\)∧𝑎𝑐𝑐𝑒𝑝𝑡​\(i,c\)\\mathit\{assign\}\(c,\\omega\)\\leftarrow\\neg\\mathit\{error\}\(i,c,\\omega\)\\wedge\(f\_\{i\}\(\\omega\)=c\)\\wedge\\mathit\{accept\}\(i,c\)and a domain programΠdom\\Pi\_\{\\textit\{dom\}\}contains integrity constraints¬𝑎𝑠𝑠𝑖𝑔𝑛​\(c′,ω\)←𝑎𝑠𝑠𝑖𝑔𝑛​\(c,ω\)\\neg\\mathit\{assign\}\(c^\{\\prime\},\\omega\)\\leftarrow\\mathit\{assign\}\(c,\\omega\)forbidding conflicting labels on one object\. This integrity constraint is the*only*domain knowledge used to judge consistency, and it is inherent to the task \(the mutual exclusivity of class labels\) rather than environment\-specific expertise: it needs no segmentation masks, size priors, or other scene artifacts, and holds unchanged in any novel domain\. All discriminative, scene\-specific knowledge instead lives in the learned error\-detection rulesΠi\\Pi\_\{i\}; keeping the consistency layer minimal is deliberate, and is what lets the same abduction machinery transfer across domains\. We writeΠ=Πdom∪Πhelper∪\(⋃iΠi\)\\Pi=\\Pi\_\{\\textit\{dom\}\}\\cup\\Pi\_\{\\textit\{helper\}\}\\cup\(\\bigcup\_\{i\}\\Pi\_\{i\}\); stratification and limited negation, in addition to the instance size, make inference tractable and monotonic, realized in PyReason\(Adityaet al\.[2023](https://arxiv.org/html/2608.04190#bib.bib14)\)\.

Abduction problem\.Following consistency\-based abduction\(Eiter and Gottlob[1995](https://arxiv.org/html/2608.04190#bib.bib4); Peng and Reggia[1990](https://arxiv.org/html/2608.04190#bib.bib3)\), we seekH⊆ℋH\\subseteq\\mathcal\{H\}such thatH∪O∪ΠH\\cup O\\cup\\Piis consistent\. We allow a small, controlled amount of inconsistency:𝐼𝑛𝑐​\(H\)\\mathit\{Inc\}\(H\)is the normalized number of ground rules inΠdom\\Pi\_\{\\textit\{dom\}\}not entailed by\(H∪O∪Π\)∖Πdom\(H\\cup O\\cup\\Pi\)\\setminus\\Pi\_\{\\textit\{dom\}\}, andδ∈\[0,1\]\\delta\\in\[0,1\]bounds it\. Among consistent hypotheses we prefer the most informative one:𝑃𝑟𝑒𝑑​\(H\)\\mathit\{Pred\}\(H\)counts the𝑎𝑠𝑠𝑖𝑔𝑛​\(c,ω\)\\mathit\{assign\}\(c,\\omega\)atoms entailed by the minimal model of\(H∪O∪Π\)∖Πdom\(H\\cup O\\cup\\Pi\)\\setminus\\Pi\_\{\\textit\{dom\}\}\. We*maximize*𝑃𝑟𝑒𝑑​\(H\)\\mathit\{Pred\}\(H\)because \(i\) more assignments means fewer suspected errors on well\-trained models, \(ii\) we want high recall, and \(iii\)Πhelper\\Pi\_\{\\textit\{helper\}\}already guards against over\-assignment\. The problem is

maxH⊆ℋ⁡𝑃𝑟𝑒𝑑​\(H\)​s\.t\.​𝐼𝑛𝑐​\(H\)≤δ,\(H∪O∪Π\)∖Πdom​consist\.\\max\_\{H\\subseteq\\mathcal\{H\}\}\\mathit\{Pred\}\(H\)\\,\\text\{s\.t\.\}\\,\\mathit\{Inc\}\(H\)\\leq\\delta,\\;\(H\\cup O\\cup\\Pi\)\\setminus\\Pi\_\{\\textit\{dom\}\}\\text\{ consist\}\.The rule\-learner exposes a hyperparameterϵ\\epsiloninterpretable as the expected recall reduction from discarding flagged predictions; we sweep it and also set it heuristically\.

Integer Program \(IP\)\.With binaryAc,ωA\_\{c,\\omega\}\(objectω\\omegaassigned classcc\),Conω,\(c,c′\)\\textit\{Con\}\_\{\\omega,\(c,c^\{\\prime\}\)\}\(conflict indicator\),Elimf,c\\textit\{Elim\}\_\{f,c\}\(exclude modelff’s class\-ccoutput;Elimf,c=0⇔𝑎𝑐𝑐𝑒𝑝𝑡​\(f,c\)∈H\\textit\{Elim\}\_\{f,c\}=0\\Leftrightarrow\\mathit\{accept\}\(f,c\)\\in H\),Xω,f,cX\_\{\\omega,f,c\}\(consider\(ω,f,c\)\(\\omega,f,c\)\), and constant𝑝𝑟𝑒𝑑f,c,ω\\mathit\{pred\}\_\{f,c,\\omega\}, we solve

max​∑ω∑cAc,ω\\max\\sum\_\{\\omega\}\\sum\_\{c\}A\_\{c,\\omega\}subject toXω,f,c≤1−Elimf,cX\_\{\\omega,f,c\}\\leq 1\-\\textit\{Elim\}\_\{f,c\};Xω,f,c⋅𝑝𝑟𝑒𝑑f,c,ω≤Ac,ωX\_\{\\omega,f,c\}\\cdot\\mathit\{pred\}\_\{f,c,\\omega\}\\leq A\_\{c,\\omega\};Ac,ω≤∑fXω,f,c⋅𝑝𝑟𝑒𝑑f,c,ωA\_\{c,\\omega\}\\leq\\sum\_\{f\}X\_\{\\omega,f,c\}\\cdot\\mathit\{pred\}\_\{f,c,\\omega\};Ac,ω\+Ac′,ω−1≤Conω,\(c,c′\)A\_\{c,\\omega\}\+A\_\{c^\{\\prime\},\\omega\}\-1\\leq\\textit\{Con\}\_\{\\omega,\(c,c^\{\\prime\}\)\}for\(c,c′\)∈I​C\(c,c^\{\\prime\}\)\\in IC;∑cAc,ω≥1\\sum\_\{c\}A\_\{c,\\omega\}\\geq 1; and the global budget∑ω∑\(c,c′\)Conω,\(c,c′\)≤δ⋅∑i,ωAi,ω\\sum\_\{\\omega\}\\sum\_\{\(c,c^\{\\prime\}\)\}\\textit\{Con\}\_\{\\omega,\(c,c^\{\\prime\}\)\}\\leq\\delta\\cdot\\sum\_\{i,\\omega\}A\_\{i,\\omega\}\. The model hasO​\(N⋅\|ℱ\|⋅\|𝒞\|\)O\(N\\cdot\|\\mathcal\{F\}\|\\cdot\|\\mathcal\{C\}\|\)variables and constraints \(N=\|Ω\|N=\|\\Omega\|\)\. It is NP\-hard in general, but the locality of the conflict and consideration constraints makes the instances at our scale solvable in seconds\.

Heuristic Search \(HS\)\.Algorithm[1](https://arxiv.org/html/2608.04190#alg1)greedly decides𝑎𝑐𝑐𝑒𝑝𝑡​\(f,c\)\\mathit\{accept\}\(f,c\)per \(model,class\) pair: for each pair it picks theϵ\\epsilonwhose filtered predcition set most increases coverage while keeping global inconsistency≤δ\\leq\\delta\. HS runs inO​\(\|ℱ\|⋅\|𝒞\|⋅\|Eset\|\)O\(\|\\mathcal\{F\}\|\\cdot\|\\mathcal\{C\}\|\\cdot\|E\_\{\\textit\{set\}\}\|\), polynomial in the input\.

Algorithm 1Heuristic Search \(HS\)1:Input:

PrawP\_\{\\textit\{raw\}\}\(raw prediction tuples\);

δ\\delta\(budget\);

EsetE\_\{\\textit\{set\}\}\(

ϵ\\epsilonthresholds\)

2:Output:

SfinalS\_\{\\textit\{final\}\}\(accepted predictions\)

3:

Sfinal←∅S\_\{\\textit\{final\}\}\\leftarrow\\emptyset
4:foreach model

f∈ℱf\\in\\mathcal\{F\}, class

c∈𝒞c\\in\\mathcal\{C\}do

5:

Pbest←∅P\_\{\\textit\{best\}\}\\leftarrow\\emptyset;

nmax←\|Sfinal\|n\_\{\\textit\{max\}\}\\leftarrow\|S\_\{\\textit\{final\}\}\|
6:foreach

ϵ∈Eset\\epsilon\\in E\_\{\\textit\{set\}\}do

7:

Pnew←GetFilteredPreds​\(f,c,ϵ,Praw\)P\_\{\\textit\{new\}\}\\leftarrow\\textit\{GetFilteredPreds\}\(f,c,\\epsilon,P\_\{\\textit\{raw\}\}\)
8:

Scand←Sfinal∪PnewS\_\{\\textit\{cand\}\}\\leftarrow S\_\{\\textit\{final\}\}\\cup P\_\{\\textit\{new\}\}
9:if

CalcIncon​\(Scand\)≤δ\\textit\{CalcIncon\}\(S\_\{\\textit\{cand\}\}\)\\leq\\deltaand

\|Scand\|\>nmax\|S\_\{\\textit\{cand\}\}\|\>n\_\{\\textit\{max\}\}then

10:

Pbest←PnewP\_\{\\textit\{best\}\}\\leftarrow P\_\{\\textit\{new\}\};

nmax←\|Scand\|n\_\{\\textit\{max\}\}\\leftarrow\|S\_\{\\textit\{cand\}\}\|
11:endif

12:endfor

13:if

Pbest≠∅P\_\{\\textit\{best\}\}\\neq\\emptysetthen

14:

Sfinal←Sfinal∪PbestS\_\{\\textit\{final\}\}\\leftarrow S\_\{\\textit\{final\}\}\\cup P\_\{\\textit\{best\}\}
15:endif

16:endfor

17:return

SfinalS\_\{\\textit\{final\}\}

Tie\-Breaker \(TB\)\.Abduction can leave several admissible labels for an object\. TB makes the output deterministic: for an objectω\\omegawith multiple admisible labels it keeps the pair\(ω,c\)\(\\omega,c\)from the model with the highest confidence, yielding the IP\+TB and HS\+TB variants\.

## Learning the Metacognitive Layer without Domain Knowledge

Here, we describe how each model’s error\-detection programΠi\\Pi\_\{i\}is learned from a*Label Vector Pool*\(LVP\) instead of hand\-authored domain predicates\.

Why no domain knowledge\.The domain\-knowledge \(DK\) conditions used by prior work are predicates such as “the pedestrian box center lies on the street segmentation mask” or “the box area is far from the average class area in training\.” These require artifacts that a*novel*environment does not provide \(a segmentation map of the new scene, reliable size priors\) and they are model\-agnostic, so they cannot capture*which model*is unreliable*where*\. We want a condition that \(i\) needs only the model’s own training data and \(ii\) is specific to each \(model, class\)\.

Label Vector Pool per \(model, class\)\.Each detection produced by a ViT\-backbone detector comes with add\-dimensional embedding \(d=1024d=1024\)\. For a modelfif\_\{i\}and classcc, we take the embeddings offif\_\{i\}’s*training*detections of classccand cluster them withkk\-means \(k=3k=3\), obtaining a pool𝒫i,c=\{μi,c1,μi,c2,μi,c3\}\\mathcal\{P\}\_\{i,c\}=\\\{\\mu\_\{i,c\}^\{1\},\\mu\_\{i,c\}^\{2\},\\mu\_\{i,c\}^\{3\}\\\}of prototype vectors\. The collection\{𝒫i,c\}c∈𝒞\\\{\\mathcal\{P\}\_\{i,c\}\\\}\_\{c\\in\\mathcal\{C\}\}is modelfif\_\{i\}’s Label Vector Pool: a compact, multi\-modal summary of how each class looks*to that model under its own training condition*\. Sub\-clustering \(k\>1k\>1\) matters because a class is rarely unimodal in embedding space \(e\.g\., vehicles seen from different angles\)\.

LVP error detector\.For a new detection with embeddingee, we form the feature vector of Euclidean distances to every prototype of every class,

ϕ​\(e\)=\[∥e−μi,cr∥2\]c∈𝒞,r∈\{1,2,3\}∈ℝ3​m,\\phi\(e\)=\\big\[\\,\\lVert e\-\\mu\_\{i,c\}^\{r\}\\rVert\_\{2\}\\,\\big\]\_\{c\\in\\mathcal\{C\},\\,r\\in\\\{1,2,3\\\}\}\\in\\mathbb\{R\}^\{3m\},i\.e\.3×4=123\\times 4=12features in our setting\. A per\-\(model, class\) Random Forest mapsϕ​\(e\)\\phi\(e\)to the probability that the detection is an*error*,

si,c​\(e\)=Pr⁡\[error∣ϕ​\(e\)\]∈\[0,1\],s\_\{i,c\}\(e\)=\\Pr\[\\text\{error\}\\mid\\phi\(e\)\]\\in\[0,1\],where a training detection is labeled an error if it does not match a ground\-truth object of the same class atIoU≥0\.5\\mathrm\{IoU\}\\geq 0\.5\. Intuitively, a detection far from its predicted class’s pool \(or close to another class’s pool\) is suspicious\. Scoresi,cs\_\{i,c\}is what we call the*LVP error probability*; it is the only component of our metacognitive conditions and uses no domain semantics\.

From scores to rules\.We threshold the score into a family of monotone conditions𝑐𝑜𝑛𝑑τ​\(ω\)≡\(si,c​\(eω\)≥τ\)\\mathit\{cond\}\_\{\\tau\}\(\\omega\)\\equiv\\big\(s\_\{i,c\}\(e\_\{\\omega\}\)\\geq\\tau\\big\)for a grid ofτ\\tau, and feed them to the EDCR rule learner\(Xiet al\.[2024](https://arxiv.org/html/2608.04190#bib.bib5); Kricheliet al\.[2024](https://arxiv.org/html/2608.04190#bib.bib6)\)\. For each \(model, class\) and each strictness levelϵ\\epsilon, the learner selects the condition\(s\) that yield error\-detection rules meeting its precision criterion;ϵ\\epsilonis interpretable as the expected recall reduction\. The output is the programΠi\\Pi\_\{i\}introduced in the Consistency\-based Abduction section, where the suspected\-error predicate is fired when the learned LVP threshold is exceeded\. Because pools and detectors are built independently per model on each model’s own training data, there is no test\-time leakage and no cross\-model coupling assumed a priori\. Empirically,ϵ\\epsilonacts as a monotone control: as it increases, the learner selects a lower effective threshold on the LVP error probability, flagging more detections and trading retained recall for higher per\-model precision\. Thisϵ\\epsilonto threshold mapping differs across detectors, each reflecting its own error\-score distribution, so a singleϵ\\epsiloninduces model\-specific operating points without any domain\-specific tuning \(a per\-model curve is given in the supplementary material, Sec\. C\)\.

Putting it together\.The full test\-time pipeline is: \(1\) each ViT detector emits boxes, labels, and embeddings \(also a confidence score\) on the novel scene; \(2\) the LVP detector assigns each detection an error probability; \(3\) the learner rules fire suspected errors; \(4\) IP or HS abduces an accepted set under the inconsistency budgetδ\\delta; \(5\) TB resolves residual ties\. Steps 1–3 are the contribution of this section; steps 4–5 are the abduction machinery introduced earlier under Consistency\-based Abduction\.

## Experimental Setup

Dataset\.We use the Multiple Distribution Shift – Aerial \(MDS\-A\) dataset\(Nguet al\.[2025](https://arxiv.org/html/2608.04190#bib.bib7)\), generated with AirSim\(Shahet al\.[2017](https://arxiv.org/html/2608.04190#bib.bib8)\), in the 15\-test\-set extension introduced in\(Leivaet al\.[2026](https://arxiv.org/html/2608.04190#bib.bib1)\)\. Images are captured in a city environment under varying weather, with bounding boxes in four classes:*pedestrian*,*vehicle*,*construction*,*nature*\. Six training conditions \(*rain, snow, fog, maple leaves, dust*, and a no\-weather*normal*\) and a test suite of 15 sets spanning increasingly complex mixed\-weather shifts are used: ids encode how many conditions share an intensity level: UM \(unimodal\), BM \(bimodal\), MM \(most modes\), AM \(all modes\), HUM \(high unimodal\)\. Figure[1](https://arxiv.org/html/2608.04190#Sx1.F1)shows the conditions of the training sets for the 6 detectors and 4 of the 15 test sets \(Figure 1 in the supp\. material illustrates all conditions\)\.

Detection models\.The six detectors use a plain Vision Transformer \(ViT\) backbone\(Dosovitskiyet al\.[2020](https://arxiv.org/html/2608.04190#bib.bib9)\)in the ViTDet configuration\(Liet al\.[2022](https://arxiv.org/html/2608.04190#bib.bib10)\), initialized from MAE self\-supervised pretraining\(Heet al\.[2022](https://arxiv.org/html/2608.04190#bib.bib11)\)and paired with a Faster R\-CNN\(Renet al\.[2015](https://arxiv.org/html/2608.04190#bib.bib12)\)detection head; all are fine\-tuned with Detectron2\(Wuet al\.[2019](https://arxiv.org/html/2608.04190#bib.bib13)\)\. Each model is specialized to a single weather condition and trained in isolation, so that the mixed\-weather test sets induce a genuine distributional shift\. The embedding we use is a feature from each detector’s*own*detection head, and each model is fine\-tuned end\-to\-end per weather condition, backbone and head together, with no frozen shared backbone and no adapters\. Each model therefore has its own feature space, so the prototype pools𝒫i,c\\mathcal\{P\}\_\{i,c\}are model\-specific and not directly comparable across models, which is why the metacognitive layer is built per model\. Since each model specializes in one condition, the indexiidenotes both the modelfif\_\{i\}and the weather domain it is trained for\. All six share the same four output classes, and for every detection we take the10241024\-dimensional feature produced by the detection head’s penultimate fully\-connected layer as the embedding consumed by the LVP error detectors\. Full training hyperparameters per\-model are reported in the supplementary material \(Sec\. B\)\.

Multimodal test set\.Beyond MDS\-A, we evaluate on VisDrone\-DroneVehicle\(Sunet al\.[2022](https://arxiv.org/html/2608.04190#bib.bib32)\), a multimodal aerial dataset of paired RGB and infrared \(IR\) images \(see Fig\.[12](https://arxiv.org/html/2608.04190#Sx9.F12)for a sample pair\)\. This probes a different use of the framework: the ensemble is two modality\-specialized detectors \(one RGB, one IR\) rather than six weather specialized ones\. We evaluate on a mixed test set of 250 RGB and 250 IR scenes drawn from disjoint location, so each detector sees both in\- and out\-of\-domain inputs; with van and freight\_car too rare to learn, the pipeline runs on three effective classes \(car, truck, bus\)\. Preprocessing and sampling details are in the supplement \(Sec\. H\)\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/gt_example_rgb_13788.png)![Refer to caption](https://arxiv.org/html/2608.04190v1/gt_example_ir_13788.png)Figure 2:DroneVehicle sample scene from the same physical location in RGB \(left\) and IR \(right\), with ground\-truth bounding boxes color\-coded by class\.Baselines\.We compare against per\-model references—*MacroAVG*\(mean over models\) and*Best Model*\(best single model\)—and against all majority\-vote \(MV\) variants:*MV\-Plurality*\(plurality among active detectors\),*MV\-Plurality\-NoTB*\(plurality without the confidence tie\-break\),*MV\-Quorum*\(requires⌊N/2⌋\+1\\lfloor N/2\\rfloor\+1active detectors\), and*MV\-Strict*\(plurality across all models, treating “no detection” as a vote\)\. Our methods are IP, IP\+TB, HS and HS\+TB\. Also, as a first step after the model detections, ghost detections \(detections that did not match any object in the ground truth\) were eliminated, in order to work only with the true FPs: detections with incorrect labels\.

Hardware and software\.The detectors were fine\-tuned on a single NVIDIA T4 GPU \(Google Colab\); every other stage—detection inference, LVP error detection, EDR rule firing, and the IP/HS abduction—runs on CPU only\. We use a single\-socket server with an AMD EPYC 9755 running Ubuntu 24\.04 and Python 3\.12, with no GPU\. Test scenarios are processed in parallel across cores via multiprocessing\. Logical deduction is implemented in PyReason\(Adityaet al\.[2023](https://arxiv.org/html/2608.04190#bib.bib14)\), and the integer program is solved with the CBC solver through the PuLP modeling library\.

## Results

Clean\-data performance\.Table[1](https://arxiv.org/html/2608.04190#Sx6.T1)reports F1 and Accuracy on a representative subset of the test sets under clean \(unattacked\) conditions and the average over all 15 test sets\. On these scenarios, our IP\+TB and HS\+TB are statistically*on par*with the strongest ensemble baseline, MV\-Plurality, while outperforming the per\-model references and the precision\-biased MV variants\. However, we note that our method reaches parity with the best baselines but does not rely on voting, which is susceptible to correlation\-based attacks \(as described later\)\.

Table 1:F1 / Accuracy on a representative subset of test sets for best individual model, MV\-Plurality \(MV\-P\) and our approach using the abductive framework of\(Leivaet al\.[2026](https://arxiv.org/html/2608.04190#bib.bib1)\)\. The Average row is over all 15 datasets\. Accuracy is the detection Jaccard index,Acc=F​1/\(2−F​1\)\\mathrm\{Acc\}=F1/\(2\-F1\)\. The full 15\-scenario table appears in the supplement \(Sec\. D\)\.Ceiling analysis\.For each test set we compute two ceilings over methods that only*select*among existing predictions: the*detection coverage*\(fraction of ground\-truth objects seen by at least one model\) and the*oracle recall*\(fraction seen with the*correct*class by at least one model\), with corresponding oracle F1\. Figure[3](https://arxiv.org/html/2608.04190#Sx6.F3)plots each method against these ceilings on the same representative subset used in Table[1](https://arxiv.org/html/2608.04190#Sx6.T1)\(AM\_1, BM\_1, MDS\-A\_1, MM\_1, UM\_1\); the remaining 10 test sets are variations of the same five families \(AM\_2/3, BM\_2/3, MDS\-A\_2/3, MM\_2/3, UM\_2/3, HUM\_1\) and behave qualitatively the same\. The gap between the precision\-based MV variants \(MV\-Quorum, MV\-Strict\) and the oracle is large, whereas MV\-Plurality and our methods approach the oracle\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/ceiling_summary_f1.png)Figure 3:F1 of each method per test set with the oracle\-recall ceiling drawn above each group\. Methods that select among existing predictions cannot exceed the dashed line; IP\+TB sits closest to it\.LVP vs\. domain\-knowledge rules\.We compare the LVP\-based rules against the domain\-knowledge \(DK\) rules used by prior work, holding the abduction stage fixed\. The headline results are in Table[2](https://arxiv.org/html/2608.04190#Sx6.T2):*the two reach essentially the same downstream F1*—the largest absolute difference across the five test sets is\|Δ\|=0\.0018\|\\Delta\|=0\.0018\(i\.e\., below0\.0020\.002F1\)—yet the LVP variant requires*no*scene artifacts: no segmentation masks, no class\-specific size priors, only each model’s own training embeddings\. This method reaches parity with a domain\-knowledge baseline*without*using any domain knowledge—the metacognitive layer can be made portable to genuinely novel scenes at no measurable cost in downstream accuracy\. The per\-detection disagreement analysis in Figure[4](https://arxiv.org/html/2608.04190#Sx6.F4)adds a finer view: although the aggregate F1 is identical, the two signals catch different failures—LVP flags model\-specific embedding\-space anomalies that no hand authored cue captures \(top\), while DK catches geometric/contextual mistakes that the embedding alone does not \(bottom\)\. The two are complementary, and combining them is a natural direction for future work\.

Table 2:Downstream F1 with LVP vs\. DK conditions \(abduction fixed\)\. LVP requires no domain artifacts and reaches the same downstream F1 as DK \(larges gap<0\.002<0\.002\)\.![Refer to caption](https://arxiv.org/html/2608.04190v1/x2.png)Figure 4:Detections where the LVP and DK rules disagree\.*Top:*errors the DK rules miss but the LVP rules catch, typically model\-specific embedding\-space anomalies that no hand\-authored cue captures;*Bottom:*the converse, errors the LVP rules miss but the DK rules catch\. Although LVP needs no domain knowledge and matches DK on downstream F1, the per\-detection view shows the two flag different failures\.Robustness to coordinated attacks\.We assume an attacker who can perturb predictions to defeat the combiner but cannot retrain detectors\. With probabilityppper ground\-truth object, the attacker samples three models and one wrong class and forces those three models to output that class for the object\. The flips are*coordinated*: three models agree on the same wrong label, impacting voting\-based techniques that have a latent independence assumption among the models\.

Multimodal test\.On clean data the multimodal ensemble is the hardest case for abduction: RGB and IR were trained on paired scenes and rarely disagree \(inter\-detector inconsistency≈0\.0002\\approx 0\.0002\), so IP\+TB and HS\+TB reduce to the majority\-vote solution and tie MV\-Plurality atF1=0\.672F\_\{1\}=0\.672, just below the best single detector \(IR,F1=0\.68F\_\{1\}=0\.68\)\. Under the coordinated label\-flip attack, this regime becomes the best case: IP\+TB and HS\+TB stay above every baseline for allp≥0\.1p\\geq 0\.1, reachingF1=0\.395F\_\{1\}=0\.395and0\.4100\.410atp=0\.9p=0\.9against0\.3760\.376for MV\-Plurality, while MV\-Plurality\-NoTB collapses\. They also stay closest to the clean\-data ceiling across the whole sweep \(Figure[5](https://arxiv.org/html/2608.04190#Sx6.F5), right\); the fullF1F\_\{1\}\-vs\-ppcurves and per\-method numbers are in the supplementary material \(Sec\. H\)\. The disagreements the abduction layer resolves arise naturally from six weather detectors on MDS\-A, but only under attack on the two correlated modality detectors; the same mechanism yields clean\-data wins on one dataset and adversarial wins on the other\.

Results\.Table[3](https://arxiv.org/html/2608.04190#Sx6.T3)lists F1 across all 15 test sets at five attack rates that span the non\-trivial regime \(p∈\{0\.2,0\.4,0\.6,0\.8,0\.9\}p\\in\\\{0\.2,0\.4,0\.6,0\.8,0\.9\\\}\), for the strongest representative of each method family—*Best*\(best per\-model baseline, ahead of Macro AVG\),*MV\-Plurality*\(best majority\-vote variant, ahead of MV\-Plurality\-NoTB, MV\-Quorum and MV\-Strict\), and our*IP\+TB*and*HS\+TB*\. Clean\-data values \(p=0p=0\) are already in Table[1](https://arxiv.org/html/2608.04190#Sx6.T1); the full grid with all ten methods and allp∈\{0\.0,…,0\.9\}p\\in\\\{0\.0,\\dots,0\.9\\\}is in the supplementary material \(Sec\. E\)\. The pattern is unambiguous: atp=0\.2p=0\.2IP\+TB and MV\-Plurality are still close \(often tied\), but fromp=0\.4p=0\.4onward IP\+TB takes the lead on*every*test set, and byp=0\.9p=0\.9MV\-Plurality has lost roughly0\.100\.10–0\.150\.15F1 while IP\+TB has barely moved\. HS\+TB follows the same trend and stays comfortably above the MV baseline\. The take\-away is that the gap to the count\-based combiner grows monotonically withpp, which is what we should expect if acceptance is consistency\-driven rather than vote\-driven\.

Table 3:F1 across all 15 test sets under the coordinated label\-flip attack, at attack ratesp∈\{0\.2,0\.4,0\.6,0\.8,0\.9\}p\\in\\\{0\.2,0\.4,0\.6,0\.8,0\.9\\\}\. Mean over 3 seeds\.Bold: highest F1 within each \(test set,pp\) cell \(ties highlighted together\)\. As soon as the attack becomes non\-trivial, IP\+TB takes the lead on*every*test set, and the gap to MV\-P widens monotonically withpp—direct evidence that consistency\-based abduction is far more attack\-resistant than count\-based combiners\. Acc derivable asAcc=F​1/\(2−F​1\)\\mathrm\{Acc\}=F1/\(2\-F1\)\.The left panel of Figure[5](https://arxiv.org/html/2608.04190#Sx6.F5)shows a complementary view\. The figure aggregates over all 15 test sets and plots the*gap to the oracle F1 ceiling*per method asppgrows: this is the headline robustness picture—IP\+TB stays closest to the oracle across the entire attack range, MV\-Plurality and MV\-Plurality\-NoTB lose ground sharply, and the precision\-based MV variants pull away from the oracle even faster\. Acceptance based on cross\-model*consistency*\(our methods\) is therefore far more attack\-resistant than acceptance based on raw vote counts \(MV\)\. Our methods never fall below the baselines once the attack is non\-trivial: forp≥0\.4p\\geq 0\.4, Table[3](https://arxiv.org/html/2608.04190#Sx6.T3)shows IP\+TB best or tied on every one of the 15 test sets, so the overlapping bands in Figure[5](https://arxiv.org/html/2608.04190#Sx6.F5)reflect how much headroom varies across scenes, rather than cases where a baseline overtakes our methods\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/x3.png)Figure 5:Adversarial coordinated label\-flip: gap to the F1 ceiling per method as flip probabilityppgrows \(lower is better\); panel titles andyy\-axes name the ceiling used in each\.*\(Left\)*MDS\-A over the 15 test sets, bands±1\\pm 1std across test sets\.*\(Right\)*Multimodal test \(k=1k=1\) over 3 adversary seeds, bands±1\\pm 1std over seeds; its ceiling is a fixed constant, so the informative signal is the ordering among methods, not the absolute gap\. IP\+TB and HS\+TB stay closest to the ceiling in both; full multimodal curves in the supp\. material \(Sec\. H\)\.Runtime\.Figure[6](https://arxiv.org/html/2608.04190#Sx6.F6)presents the wall\-clock cost of IP\+TB and HS\+TB on the 15 clean test sets \(p=0p=0\)\. HS\+TB completes a full scenario in1\.91\.9–19\.719\.7s, with per\-object solve time pinned in a narrow1\.41\.4–3\.03\.0ms band across the entire range of scenario sizes \(1\.3k–6\.7k detected objects\), consistent with itsO​\(\|ℱ\|⋅\|𝒞\|⋅\|Eset\|\)O\(\|\\mathcal\{F\}\|\\cdot\|\\mathcal\{C\}\|\\cdot\|E\_\{\\textit\{set\}\}\|\)analysis\. IP\+TB is roughly30×30\\timesslower in absolute terms \(264264–349349s per scenario\) but its per\-object cost actually*decreases*from0\.210\.21s on the smallest scenario to0\.0050\.005s on the largest, because the fixed CBC overhead amortizes over more objects: at our scale, the IP\+TB approach is driven by setup, not by combinatorial growth\. Both methods thus remain practical end\-to\-end—HS\+TB for tight latency budgets, IP\+TB when the \(small\) gain in F1 justifies the extra cost in terms of running time\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/x4.png)Figure 6:Wall\-clock cost of IP\+TB and HS\+TB on the 15 clean test sets \(p=0p=0\), one point scenario\. Per\-object solve time: HS\+TB is essentially flat at1\.41\.4–3\.03\.0ms regardless of scenario size, matching the polynomial bound\.
## Conclusions and Future Work

We showed that the metacognitive layer of a multi\-model perception system can be learned*without domain knowledge*, using only per\-model Label Vector Pools, and that framing model integration as consistency\-based abduction yields a combiner that is both competitive on clean data and robust to a coordinated attack that breaks majority voting\. Future work includes richer deduction rules for alternative assignment sets, automatic FP\-detection without an oracle, finer joint exploration ofϵ\\epsilonandδ\\delta, and runtime optimization for real\-time deployment\. Furthermore, one promising direction for future work is combining the domain knowledge \(DK\-EDR\) and LVP \(LVP\-EDR\) versions of EDR, as they both work in a rule\-based framework\. In the supplementary material \(Sec\. G\), we report that the two approaches identify different sources of error, making them complementary\. However, this complementary nature also has the effect of reducing true positives due to increases in error recall, and we found that combining the approaches did not meaningfully impact F1 \(also reported in the supplementary material, Sec\. G\)\.

## Acknowledgments

Funded by ARO grant W911NF\-24\-1\-0007 and experiments were performed with compute resources supported by ARO DURIP and equipment donated by AMD\.

## References

- D\. Aditya, K\. Mukherji, S\. Balasubramanian, A\. Chaudhary, and P\. Shakarian \(2023\)PyReason: software for open world temporal logic\.arXiv preprint arXiv:2302\.13482\.Cited by:[Consistency\-based Abduction](https://arxiv.org/html/2608.04190#Sx3.p3.13),[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p5.1)\.
- B\. Biggio, B\. Nelson, and P\. Laskov \(2012\)Poisoning attacks against support vector machines\.arXiv preprint arXiv:1206\.6389\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p5.1)\.
- B\. Biggio and F\. Roli \(2018\)Wild patterns: ten years after the rise of adversarial machine learning\.InProceedings of the 2018 ACM SIGSAC conference on computer and communications security,pp\. 2154–2156\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p5.1)\.
- L\. Cai, W\. Dai, Y\. Huang, Y\. Li, S\. Muggleton, and Y\. Jiang \(2021\)Abductive learning with ground knowledge base\.InProceedings of IJCAI,Z\. Zhou \(Ed\.\),pp\. 1815–1821\.Note:Main TrackExternal Links:[Document](https://dx.doi.org/10.24963/ijcai.2021/250),[Link](https://doi.org/10.24963/ijcai.2021/250)Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p2.1)\.
- W\. Dai, Q\. Xu, Y\. Yu, and Z\. Zhou \(2019\)Bridging machine learning and logical reasoning by abductive learning\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Cited by:[Introduction](https://arxiv.org/html/2608.04190#Sx1.p2.1),[Related Work](https://arxiv.org/html/2608.04190#Sx2.p2.1)\.
- A\. Dosovitskiy, L\. Beyer, A\. Kolesnikov, D\. Weissenborn, X\. Zhai, T\. Unterthiner, M\. Dehghani, M\. Minderer, G\. Heigold, S\. Gelly,et al\.\(2020\)An image is worth 16x16 words: transformers for image recognition at scale\.arXiv preprint arXiv:2010\.11929\.Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p2.4)\.
- T\. Eiter and G\. Gottlob \(1995\)The complexity of logic\-based abduction\.J\. ACM42\(1\),pp\. 3–42\.External Links:ISSN 0004\-5411,[Link](https://doi.org/10.1145/200836.200838),[Document](https://dx.doi.org/10.1145/200836.200838)Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p2.1),[Consistency\-based Abduction](https://arxiv.org/html/2608.04190#Sx3.p4.11)\.
- I\. J\. Goodfellow, J\. Shlens, and C\. Szegedy \(2014\)Explaining and harnessing adversarial examples\.arXiv preprint arXiv:1412\.6572\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p5.1)\.
- X\. Han, Z\. Zhang, N\. Ding, Y\. Gu, X\. Liu, Y\. Huo, J\. Qiu, Y\. Yao, A\. Zhang, L\. Zhang,et al\.\(2021\)Pre\-trained models: past, present and future\.AI open2,pp\. 225–250\.Cited by:[Introduction](https://arxiv.org/html/2608.04190#Sx1.p1.1)\.
- K\. He, X\. Chen, S\. Xie, Y\. Li, P\. Dollár, and R\. Girshick \(2022\)Masked autoencoders are scalable vision learners\.InProceedings of the IEEE/CVF conference on computer vision and pattern recognition,pp\. 16000–16009\.Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p2.4),[B\. Detection Models: Training Configuration](https://arxiv.org/html/2608.04190#Sx9.SSx3.p1.1)\.
- J\. S\. Kricheli, K\. Vo, A\. Datta, S\. Ozgur, and P\. Shakarian \(2024\)Error detection and constraint recovery in hierarchical multi\-label classification without prior knowledge\.InProceedings CIKM,pp\. 3842–3846\.Cited by:[Introduction](https://arxiv.org/html/2608.04190#Sx1.p2.1),[Related Work](https://arxiv.org/html/2608.04190#Sx2.p1.1),[Learning the Metacognitive Layer without Domain Knowledge](https://arxiv.org/html/2608.04190#Sx4.p5.8)\.
- M\. A\. Leiva, N\. Ngu, J\. S\. Kricheli, A\. Taparia, R\. Senanayake, P\. Shakarian, N\. D\. Bastian, J\. Corcoran, and G\. I\. Simari \(2026\)Consistency\-based abductive reasoning over perceptual errors of multiple pre\-trained models in novel environments\.InProceedings of AAAI,S\. Koenig, C\. Jenkins, and M\. E\. Taylor \(Eds\.\),pp\. 19216–19223\.External Links:[Link](https://doi.org/10.1609/aaai.v40i23.38996),[Document](https://dx.doi.org/10.1609/AAAI.V40I23.38996)Cited by:[Introduction](https://arxiv.org/html/2608.04190#Sx1.p2.1),[Introduction](https://arxiv.org/html/2608.04190#Sx1.p3.1),[Related Work](https://arxiv.org/html/2608.04190#Sx2.p1.1),[Consistency\-based Abduction](https://arxiv.org/html/2608.04190#Sx3.p1.1),[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p1.1),[Table 1](https://arxiv.org/html/2608.04190#Sx6.T1),[Dataset: The 15\-Test\-Set MDS\-A Benchmark](https://arxiv.org/html/2608.04190#Sx9.SSx1.p1.1)\.
- Y\. Li, H\. Mao, R\. Girshick, and K\. He \(2022\)Exploring plain vision transformer backbones for object detection\.InProceedings of ECCV,pp\. 280–296\.Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p2.4),[B\. Detection Models: Training Configuration](https://arxiv.org/html/2608.04190#Sx9.SSx3.p1.1)\.
- Y\. Ma, H\. Ren, B\. Wang, J\. Jin, S\. Velipasalar, and Q\. Qiu \(2025\)LVP\-clip: revisiting clip for continual learning with label vector pool\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\) Workshops,pp\. 231–240\.Cited by:[Introduction](https://arxiv.org/html/2608.04190#Sx1.p4.1),[Related Work](https://arxiv.org/html/2608.04190#Sx2.p3.1)\.
- A\. Madry, A\. Makelov, L\. Schmidt, D\. Tsipras, and A\. Vladu \(2017\)Towards deep learning models resistant to adversarial attacks\.arXiv preprint arXiv:1706\.06083\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p5.1)\.
- D\. Ming, P\. Ren, Y\. Wang, and X\. Feng \(2024\)Boosting the transferability of adversarial attack on vision transformer with adaptive token tuning\.InThe Thirty\-eighth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=sNz7tptCH6)Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p5.1)\.
- N\. Ngu, A\. Taparia, G\. I\. Simari, M\. Leiva, J\. Corcoran, R\. Senanayake, P\. Shakarian, and N\. D\. Bastian \(2025\)Multiple distribution shift – aerial \(mds\-a\): a dataset for test\-time error detection and model adaptation\.InAAAI Spring Symposium,External Links:2502\.13289,[Link](https://arxiv.org/abs/2502.13289)Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p1.1),[Dataset: The 15\-Test\-Set MDS\-A Benchmark](https://arxiv.org/html/2608.04190#Sx9.SSx1.p1.1)\.
- Y\. Peng and J\. A\. Reggia \(1990\)Abductive inference models for diagnostic problem\-solving\.Springer\-Verlag\.Cited by:[Consistency\-based Abduction](https://arxiv.org/html/2608.04190#Sx3.p4.11)\.
- D\. Poole \(1989\)Normality and faults in logic\-based diagnosis\.InProceedings of the 11th International Joint Conference on Artificial Intelligence \- Volume 2,IJCAI’89,San Francisco, CA, USA,pp\. 1304–1310\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p2.1)\.
- A\. Radford, J\. W\. Kim, C\. Hallacy, A\. Ramesh, G\. Goh, S\. Agarwal, G\. Sastry, A\. Askell, P\. Mishkin, J\. Clark,et al\.\(2021\)Learning transferable visual models from natural language supervision\.InInternational conference on machine learning,pp\. 8748–8763\.Cited by:[Introduction](https://arxiv.org/html/2608.04190#Sx1.p1.1)\.
- R\. Reiter \(1987\)A theory of diagnosis from first principles\.Artificial Intelligence32\(1\),pp\. 57–95\.External Links:ISSN 0004\-3702,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/0004-3702%2887%2990062-2),[Link](https://www.sciencedirect.com/science/article/pii/0004370287900622)Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p2.1)\.
- S\. Ren, K\. He, R\. Girshick, and J\. Sun \(2015\)Faster R\-CNN: towards real\-time object detection with region proposal networks\.Advances in neural information processing systems28\.Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p2.4)\.
- S\. Shah, D\. Dey, C\. Lovett, and A\. Kapoor \(2017\)AirSim: high\-fidelity visual and physical simulation for autonomous vehicles\.InField and Service Robotics,External Links:arXiv:1705\.05065,[Link](https://arxiv.org/abs/1705.05065)Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p1.1),[Dataset: The 15\-Test\-Set MDS\-A Benchmark](https://arxiv.org/html/2608.04190#Sx9.SSx1.p1.1)\.
- J\. Snell, K\. Swersky, and R\. Zemel \(2017\)Prototypical networks for few\-shot learning\.Advances in neural information processing systems30\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p3.1)\.
- Y\. Sun, B\. Cao, P\. Zhu, and Q\. Hu \(2022\)Drone\-based rgb\-infrared cross\-modality vehicle detection via uncertainty\-aware learning\.IEEE Transactions on Circuits and Systems for Video Technology\(\),pp\. 1–1\.External Links:[Document](https://dx.doi.org/10.1109/TCSVT.2022.3168279)Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p3.1),[H\. External\-Validity Experiment: Multimodal Test](https://arxiv.org/html/2608.04190#Sx9.SSx9.p1.1),[H\. External\-Validity Experiment: Multimodal Test](https://arxiv.org/html/2608.04190#Sx9.SSx9.p2.7)\.
- Y\. Sun, X\. Wang, Z\. Liu, J\. Miller, A\. Efros, and M\. Hardt \(2020\)Test\-time training with self\-supervision for generalization under distribution shifts\.InInternational conference on machine learning,pp\. 9229–9248\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p4.1)\.
- F\. Tramèr, A\. Kurakin, N\. Papernot, I\. Goodfellow, D\. Boneh, and P\. McDaniel \(2017\)Ensemble adversarial training: attacks and defenses\.arXiv preprint arXiv:1705\.07204\.Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p5.1)\.
- Y\. Wu, A\. Kirillov, F\. Massa, W\. Lo, and R\. Girshick \(2019\)Detectron2\.Note:https://github\.com/facebookresearch/detectron2Cited by:[Experimental Setup](https://arxiv.org/html/2608.04190#Sx5.p2.4)\.
- B\. Xi, K\. Scaria, D\. Bavikadi, and P\. Shakarian \(2024\)Rule\-based error detection and correction to operationalize movement trajectory classification\.External Links:2308\.14250,[Link](https://arxiv.org/abs/2308.14250)Cited by:[Related Work](https://arxiv.org/html/2608.04190#Sx2.p1.1),[Learning the Metacognitive Layer without Domain Knowledge](https://arxiv.org/html/2608.04190#Sx4.p5.8)\.

## Supplementary Material

### Dataset: The 15\-Test\-Set MDS\-A Benchmark

We use the Multiple Distribution Shift – Aerial \(MDS\-A\) dataset\(Nguet al\.[2025](https://arxiv.org/html/2608.04190#bib.bib7)\), generated with AirSim\(Shahet al\.[2017](https://arxiv.org/html/2608.04190#bib.bib8)\), in the 15\-test\-set extension introduced by Leiva et al\.\(Leivaet al\.[2026](https://arxiv.org/html/2608.04190#bib.bib1)\)\. Images are captured in a city environment under varying weather, with bounding boxes in four classes:*pedestrian*,*vehicle*,*construction*,*nature*\. Six training conditions \(*rain,snow,fog,maple leaves, dust*, and a no\-weather*normal*\) and a test suite of 15 sets spanning increasingly complex mixed\-weather shifts are used\. Figure[7](https://arxiv.org/html/2608.04190#Sx9.F7)illustrates the conditions\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/x5.png)Figure 7:Example AirSim views under different weather conditions and the weather\-intensity distribution of the corresponding test sets\.
### A\. Unique\-Name Assumption: Implementation

We instantiate the unique\-name assumption through the ensemble\-matching step: a detection is associated with a ground\-truth object when their boxes overlap atIoU≥0\.5\\mathrm\{IoU\}\\geq 0\.5; among multiple candidates from the same model we keep the highest\-IoU box*regardless of predicted class*, so that genuine inter\-model disagreements are preserved\. Detections that match no ground\-truth object are kept as their own object identifiers \(FP\-detections\)\.

### B\. Detection Models: Training Configuration

The six detectors follow the ViTDet recipe\(Liet al\.[2022](https://arxiv.org/html/2608.04190#bib.bib10)\): a plain ViT\-Base backbone pretrained with MAE\(Heet al\.[2022](https://arxiv.org/html/2608.04190#bib.bib11)\)and a Faster R\-CNN detection head, fine\-tuned per weather condition with Detectron2\. Table[4](https://arxiv.org/html/2608.04190#Sx9.T4)lists the shared training configuration\.

Table 4:Detector training configuration\.
### C\. LVP Error Detector: Training Details

Per \(model, class\) Random Forest are trained on the distance featuresϕ​\(e\)\\phi\(e\)\(33sub\-centroids×4\\times\\,4classes=12=12dims\), with hyperparameters selected by 3\-fold cross\-validation\. Table[5](https://arxiv.org/html/2608.04190#Sx9.T5)reports the error\-detector Precision, Recall and F1 averaged across the four classes and across the 15 test scenarios, one row per backbone\-model condition\.

Table 5:LVP error\-detector metrics per model, averaged across all classes and all test scenarios \(mean±\\pmstd\)\.Hyperparameter Study: Rule\-Learner Strictness \(ϵ\\epsilon\)We also examine how the strictness hyperparameterϵ\\epsilonof the rule learner shapes the LVP\-derived programs\. Recall thatϵ\\epsilonis interpretable as the expected recall reduction from discarding flagged predictions\. Figure[8](https://arxiv.org/html/2608.04190#Sx9.F8)shows the*effective threshold*on the LVP error probability picked by the learner as a function ofϵ\\epsilon, separately per model: asϵ\\epsilongrows, the effective threshold decreases monotonically\. A lower threshold means the rule fires on lower error scores, which in turn flags more detections as errors—more aggressive filtering, more downstream recall reduction, and \(on the per\-model side\) higher precision\. The slope and operating range differ across the six models, reflecting how each detector’s error\-score distribution responds to its own LVP pool; this is what makes the rule\-learning stage*model\-specific without being domain\-specific*\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/effective_threshold_vs_epsilon.png)Figure 8:Effective LVP error\-probability threshold as a function of the rule\-learner strictnessϵ\\epsilon, one curve per detector\. Largerϵ\\epsilonlowers the effective threshold, yielding more error detections and lower retained recall\. The per\-model curves differ in slope and range, showing that the sameϵ\\epsilonproduces different operating points for different detectors\.
### D\. Full Per\-Scenario Results

Table[6](https://arxiv.org/html/2608.04190#Sx9.T6)gives F1 and Accuracy for every method on all 15 test sets, the full version of Table 1 in the main paper\.

Table 6:F1 / Accuracy across the 15 test sets \(clean data\)\. In bold: the strongest baseline \(MV\-Plurality in every set\) and our two methods \(IP\+TB, HS\+TB\), i\.e\. the top\-performing cluster—our methods land within≈0\.005\\approx 0\.005F1 of the best baseline on every set\. Columns: Avg\. \(macro average over models\), Best \(best single model\), MV\-P \(MV\-Plurality\), MV\-P†\(MV\-Plurality without tie\-break\), MV\-Q \(MV\-Quorum\), MV\-S \(MV\-Strict\), IP\+TB, HS\+TB\. Accuracy is the detection Jaccard index,Acc=F​1/\(2−F​1\)\\mathrm\{Acc\}=F1/\(2\-F1\)\.
### E\. Aggregated Adversarial Results \(all methods, allpp\)

Table[7](https://arxiv.org/html/2608.04190#Sx9.T7)reports F1 averaged across the 15 test sets, for each of the 10 methods at all 10 attack ratesp∈\{0\.0,…,0\.9\}p\\in\\\{0\.0,\\dots,0\.9\\\}\. This complements Table 3 in the main paper, which shows per\-scenario values for the four headline methods at five attack rates: here we trade per\-scenario detail for full coverage of the method space \(the four MV variants plus the no\-TB versions of IP and HS that we omitted from the body\) and of the attack\-rate grid\. Means are computed by first averaging across the 3 seeds per scenario, then across the 15 scenarios; the reported standard deviation is the across\-scenario variability\.Bold: top mean F1 per column\.

Table 7:F1 under the coordinated label\-flip attack, averaged over the 15 test sets \(mean±\\pmacross\-scenario std; per\-scenario values are themselves the mean over 3 seeds\)\.Bold: top mean F1 per column\. MV\-P\-NoTB abbreviates MV\-Plurality\-NoTB\.Observations\.Four points worth noting on Table[7](https://arxiv.org/html/2608.04190#Sx9.T7)\.

*\(i\) Effect of TB on MV\-Plurality\.*On clean data MV\-P and MV\-P\-NoTB are indistinguishable \(0\.640\.64vs\.0\.630\.63\)\. Under attack the gap widens monotonically: atp=0\.9p=0\.9MV\-P holds at0\.350\.35F1 while MV\-P\-NoTB collapse to0\.250\.25\. The0\.100\.10F1 difference is entirely due to the confidence tie\-break, which rescues plurality from the random ties induces by the coordinate flips\.

*\(ii\) Effect of TB on our methods\.*IP and IP\+TB are virtually identical at everypp\(e\.g\.,0\.4220\.422vs\.0\.4230\.423atp=0\.9p=0\.9\): the abduction step already leaves almost no residual ambiguity to resolve\. HS\+TB beats raw HS by∼0\.015\\sim 0\.015F1 atp=0\.9p=0\.9, because the greedy search admits slightly more ambiguous \(model, class\) pairs that TB then disambiguates\.

*\(iii\) Where the crossover happens\.*On clean data MV\-Plurality is marginally ahead of IP\+TB in the aggregate \(0\.6360\.636vs\.0\.6320\.632\)\. Fromp≥0\.3p\\\!\\geq\\\!0\.3IP\+TB takes the lead, and the gap widens monotonically, reaching\+0\.07\+0\.07F1 \(\+22%\+22\\%relative\) atp=0\.9p=0\.9\.

*\(iv\) Conservative MV variants and per\-model baselines\.*Macro AVG, MV\-Quorum and MV\-Strict stay below Best Model at everyppin the aggregate, and never come within0\.100\.10F1 of either MV\-Plurality or our methods\. Their precision bias offers no robustness advantage under this attack\.

### F\. Running\-Time Analysis

Figure[9](https://arxiv.org/html/2608.04190#Sx9.F9)shows the empirical runtime of IP and HS as a function of the number of objects per images and the total solver runtime\. On the left, we seee the total runtime, demonstrating the advantages of HS\+TB, and the right the runtime per object per image, showing the convergence of IP\+TB, consistent with theO​\(N​\|ℱ\|​\|𝒞\|\)O\(N\|\\mathcal\{F\}\|\|\\mathcal\{C\}\|\)analysis\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/x6.png)Figure 9:Empirical runtime of IP and HS as a function of the number of objects per images\.\(left\)total solve time and\(right\)per\-object solve time
### G\. Combining LVP\-EDR \+ DK\-EDR

To explore potential synergies between our EDR rules approaches, we evaluated combining the outputs of LVP\-EDR and DK\-EDR using Union \(L​V​P∪D​KLVP\\cup DK\) and Intersection \(L​V​P∩D​KLVP\\cap DK\) operations\. However, results across the five clean test sets demonstrated that no combination outperforms the individual rules, with either LVP or DK alone achieving the highest F1 scores in all evaluated scenarios\. For instance, in the AM\_1 dataset using the IP\+TB configuration, the maximum F1 score reached is 0\.342 for LVP and 0\.344 for DK, whereas the Union reduces performance to 0\.330 and the Intersection decreases it to 0\.329 \(Figure[11](https://arxiv.org/html/2608.04190#Sx9.F11)\)\. This widespread performance degradation—with drops of up to \-0\.013 compared to LVP alone—indicates that the downstream abductive step is already operating at its maximum selection capacity; therefore, forcing additional filters ends up discarding valid predictions instead of improving the final result\.

The overlap analysis reveals that this failure occurs because both methods identify almost completely disjoint sets of errors, operating on fundamentally different principles \(LVP focuses on anomalies in the embedding space, while DK relies on geometry and masks\)\. The confusion matrices show that, for the MDS\-A\_1 scenario atϵ=0\.5\\epsilon=0\.5, only 405 detections are simultaneously flagged by both methods, compared to 3347 identified exclusively by LVP and 4921 exclusively by DK, representing a mere 4\.7% overlap \(Figure[10](https://arxiv.org/html/2608.04190#Sx9.F10)\)\. Although this confirms a strong theoretical complementarity between the approaches, stacking such divergent error signals under the current abductive combiner tightens the filter too aggressively\. Given that straightforward logical combinations fail to exploit this complementarity without penalizing the F1 score, their evaluation on the remaining test suites and adversarial scenarios was discarded\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/x7.png)Figure 10:Comparison of maximum F1 scores across five clean test sets for individual detection methods \(LVP\-alone and DK\-alone\) versus their logical combinations \(Union,L​V​P∪D​KLVP\\cup DK, and Intersection,L​V​P∩D​KLVP\\cap DK\)\. Results are shown for both HS\+TB and IP\+TB abductive steps\. In all evaluated scenarios, the combined filters fail to outperform the best standalone method, indicating a performance degradation during the downstream abduction\.![Refer to caption](https://arxiv.org/html/2608.04190v1/x8.png)Figure 11:Detection overlap between LVP\-EDR and DK\-EDR across varying rule rigor levels \(ϵ\\epsilon\) for the five evaluated test sets\. The matrices display the number of errors flagged simultaneously by both methods, solely by LVP, and solely by DK\. The identified error sets are nearly disjoint \(e\.g\., yielding only a 4\.7% overlap in MDS\-A\_1 atϵ=0\.5\\epsilon=0\.5\), showing that while the methods are fundamentally complementary, combining them creates an overly aggressive filter that hinders the abductive step\.
### H\. External\-Validity Experiment: Multimodal Test

To assess how the LVP\-EDR framework transfers beyond the MDS\-A dataset, we ran the full pipeline on VisDrone\-DroneVehicle\(Sunet al\.[2022](https://arxiv.org/html/2608.04190#bib.bib32)\), a multimodal aerial dataset with paired RGB and infrared modalities\. This setup subjects the framework to a fundamentally different regime than MDS\-A: only two detectors \(one per modality\) instead of six weather\-specific models\. We first present the dataset and setup, then the results with clean and adversary data, and conclude with a discussion of when the abduction layer adds value\.

Dataset and Setup\.VisDrone\-DroneVehicle\(Sunet al\.[2022](https://arxiv.org/html/2608.04190#bib.bib32)\)provides28,43928\{,\}439aligned RGB / infrared aerial image pairs of urban and suburban scenes with five vehicle classes:*car*,*truck*,*bus*,*van*, and*freight\_car*\. Annotations are oriented bounding boxes; for our pipeline we convert them to axis\-aligned bounding rectangles, strip the100100\-pixel annotation border built into the released files \(training resolution becomes640×512640\\times 512\), and randomly sample20002000train \+200200val \+500500test pairs \(seed4242\) to keep compute tractable while retaining full class coverage\.

To make the ensemble evaluation meaningful, we build a*mixed test set*of500500images composed of250250RGB scenes and250250IR scenes drawn from disjoint physical locations, so that each detector faces both in\-domain and out\-of\-domain inputs at test time \(see Fig\.[12](https://arxiv.org/html/2608.04190#Sx9.F12)for a sample pair\)\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/gt_example_rgb_13788.png)![Refer to caption](https://arxiv.org/html/2608.04190v1/gt_example_ir_13788.png)Figure 12:DroneVehicle sample scene from the same physical location in RGB \(left\) and IR \(right\), with ground\-truth bounding boxes color\-coded by class\.Detection PerformanceBoth detectors reach comparableAP50\\text\{AP\}\_\{50\}around3232on their respective validation splits \(Table[8](https://arxiv.org/html/2608.04190#Sx9.T8)\)\. IR is consistently equal or better than RGB on the well\-represented classes, with the largest gap on*car*where the thermal signature of engines gives IR a clear advantage\. Van and freight\_car collapse toAP=0\\text\{AP\}=0in both modalities: with∼900\\sim 900training instances and strong visual similarity to trucks in an aerial view, the models rarely commit to these ambiguous shapes\. Downstream the pipeline therefore operates on three effective classes \(car, truck, bus\)\.

Table 8:DroneVehicle validation AP by class\.Baselines and Abduction on Clean DataTable[9](https://arxiv.org/html/2608.04190#Sx9.T9)reports the FULL\-metric performance on the mixed test set \(FP counts include false\-positive detections without a matching GT\)\. The best single detector is IR atF1=0\.680F\_\{1\}=0\.680; the ensemble baselines cluster aroundF1=0\.67F\_\{1\}=0\.67, with MV\-Quorum penalized for enforcing agreement across the mixed in\-domain/out\-of\-domain regime\. Recall crashes without a proportional precision gain, unlike in MDS\-A where MV\-Quorum benefits from six independent votes\.

Our IP\+TB and HS\+TB tie MV\-Plurality atF1=0\.672F\_\{1\}=0\.672because the inter\-detector inconsistency on the clean test set is essentially zero \(0\.00020\.0002\)\. The abductive layer has no conflicts to resolve on clean data: RGB and IR were trained on paired scenes and their predictions on any given object almost always agree at the class level, so the IP/HS optimizers degenerate to the majority\-vote solution\. This is the worst\-case regime for our framework in clean conditions, and yet, as the adversarial results show below, it becomes the best\-case regime under attack\.

Table 9:DroneVehicle mixed\-test performance on clean data \(FULL metric\)\. Inter\-detector inconsistency is0\.00020\.0002; IP\+TB and HS\+TB degenerate to MV\-Plurality because there are no conflicts to resolve\.Adversarial Coordinated Label\-FlipWe apply the same coordinated label\-flip protocol used in the main paper\. For each ground\-truth object, with probabilitypp, we pick one of the two detectors \(k=1k=1: partial compromise\) and replace its predicted class with a random wrong class\. We sweepp∈\{0,0\.1,…,0\.9\}p\\in\\\{0,0\.1,\\ldots,0\.9\\\}with three adversary seeds and reuse the LVP classifiers and EDR rules learned on clean data \(no retraining per attack\)\.

Both of our unconstrained methods*stay above every baseline*for allp≥0\.1p\\geq 0\.1\(see left in Fig\.[13](https://arxiv.org/html/2608.04190#Sx9.F13)\)\. Atp=0\.9p=0\.9, IP\+TB reachesF1=0\.395F\_\{1\}=0\.395and HS\+TBF1=0\.410F\_\{1\}=0\.410, versus MV\-Plurality0\.3760\.376, MV\-Quorum0\.3600\.360, and Best Model0\.3670\.367; MV\-Plurality\-NoTB collapses toF1=0\.16F\_\{1\}=0\.16because the adversary\-induced ties trigger its abstention policy\. The gap to the clean\-data ceiling widens for every method asppgrows, but stays smallest for IP\+TB and HS\+TB across the whole sweep \(see right in Fig\.[13](https://arxiv.org/html/2608.04190#Sx9.F13)\)\. The coordinated flip introduces the inter\-detector inconsistency that the abduction step was designed to resolve\.

![Refer to caption](https://arxiv.org/html/2608.04190v1/drone_adv_f1_vs_p.png)![Refer to caption](https://arxiv.org/html/2608.04190v1/drone_adv_gap_to_ceiling.png)Figure 13:\(Left:\) Adversarial coordinated label\-flip \(k=1k=1\):F1F\_\{1\}vs\. attack probabilitypp, averaged over three adversary seeds\. Error bars are±1\\pm 1std on the three methods \(MV\-Plurality, IP\+TB, HS\+TB\)\. IP\+TB \(red\) and HS\+TB \(blue\) are the top two lines for allp≥0\.1p\\geq 0\.1; MV\-Plurality\-NoTB collapses\. \(Right:\) Gap to the clean\-data ceiling \(F1ceiling=0\.680F\_\{1\}^\{\\text\{ceiling\}\}=0\.680, achieved by the IR detector alone atp=0p=0\) as a function of attack probability\. IP\+TB and HS\+TB stay closest to the ceiling across the sweep; MV\-Plurality\-NoTB grows fastest\.DiscussionDroneVehicle exercises the LVP\-EDR framework in a regime that is strictly harder than MDS\-A for the abductive layer to add value on clean data: only two detectors, and both trained on paired scenes with high behavioral correlation\. Inter\-detector inconsistency is essentially zero and no ensemble method, ours included, meaningfully beats the best single detector \(IR atF1=0\.680F\_\{1\}=0\.680\)\. The clean\-data story is a tie between our methods and MV\-Plurality, and a mild loss against Best Model\.

The adversarial results reverse this picture\. The coordinated label\-flip attack*creates*the very inconsistency the abductive layer requires, and the LVP filter, learned from clean data alone, flags the flipped detections\. As a result, both IP\+TB and HS\+TB stay every baseline across the full attack sweep, with a margin that widens with attack strength \(up to∼5\\sim 5F1F\_\{1\}points over MV\-Quorum atp=0\.9p=0\.9\)\.

We view this as a complementary corroboration of the paper’s central claim: the LVP metacognitive layer adds most value precisely when the base ensemble faces disagreements it cannot resolve on its own\. On MDS\-A those disagreements arise naturally from six specialized weather detectors and yield strong clean\-data wins; on DroneVehicle they arise only under adversarial pressure and yield strong adversarial wins\.