Calibrating Uncertainty for Zero-Shot Adversarial CLIP

TL;DR

This paper introduces a novel adversarial fine-tuning method for CLIP that improves uncertainty calibration under adversarial attacks, balancing robustness and zero-shot generalization.

Contribution

It proposes a Dirichlet distribution-based output reparameterization and a unified objective to calibrate uncertainty while enhancing adversarial robustness.

Findings

Restores calibrated uncertainty under adversarial perturbations

Maintains competitive zero-shot classification accuracy

Improves reliability of uncertainty estimates in adversarial settings

Abstract

CLIP delivers strong zero-shot classification but remains highly vulnerable to adversarial attacks. Previous work of adversarial fine-tuning largely focuses on matching the predicted logits between clean and adversarial examples, which overlooks uncertainty calibration and may degrade the zero-shot generalization. A common expectation in reliable uncertainty estimation is that predictive uncertainty should increase as inputs become more difficult or shift away from the training distribution. However, we frequently observe the opposite in the adversarial setting: perturbations not only degrade accuracy but also suppress uncertainty, leading to severe miscalibration and unreliable over-confidence. This overlooked phenomenon highlights a critical reliability gap beyond robustness. To bridge this gap, we propose a novel adversarial fine-tuning objective for CLIP considering both prediction accuracy and uncertainty alignments. By reparameterizing the output of CLIP as the concentration parameter of a Dirichlet distribution, we propose a unified representation that captures relative semantic structure and the magnitude of predictive confidence. Our objective aligns these distributions holistically under perturbations, moving beyond single-logit anchoring and restoring calibrated uncertainty. Experiments on multiple zero-shot classification benchmarks demonstrate that our approach effectively restores calibrated uncertainty and achieves competitive adversarial robustness while maintaining clean accuracy.