Beating Max-Softmax: The Cheapest Abstention Triggers for Small Decision Encoders

This report answers the first open question from the parent abstention survey: what the cheapest abstention trigger is that beats max-softmax thresholding on a small typed-decision encoder, and on which slices it wins. It assumes the parent’s framework (abstention as an explicit output with reason codes, scored by selective risk and coverage plus abstention precision and recall) and the measurement design in the sibling unanswerable-items report, and it does not re-derive either. All arXiv IDs below were verified against their abs pages, and every number is attributed inline to a source fetched for this paper. Velofy has trained no model for this report and ships none with it.

The question

A typed-decision encoder produces one logit vector per question in a single forward pass, over the declared option set. An abstention trigger is a scalar function of what the model already computed, compared against a fitted threshold: on one side of the threshold the system answers, and on the other it abstains. Which side is which depends on the score’s sign convention. Max-softmax thresholding, refusing when the top probability is below a tuned cutoff, is the default trigger and the floor every rival must beat.

“Cheapest” here has a precise meaning: arithmetic over the already-computed logits of the single forward pass, O(k) in the option count, with no second forward pass, no backward pass, no stored embedding bank, no auxiliary head, and no training change. Triggers are ranked by what they demand beyond the logits, and the question asks which trigger in the cheapest tier reliably beats max-softmax, and where.

“Beats” also needs pinning down. Each trigger gets its own fitted threshold on held-out data, so the comparison is between scoring functions, not cutoffs. A trigger beats max-softmax when it separates answerable from unanswerable inputs (or correct from incorrect predictions) better at the same coverage, measured by area under the receiver operating characteristic curve (AUROC) on the detection task or by selective risk at fixed coverage. A trigger that wins only because its threshold was tuned while the baseline’s was not has proven nothing.

The short answer, with the evidence below: negative energy is the cheapest trigger that beats max-softmax on out-of-distribution (OOD) and out-of-scope slices, and margin (the top-1 minus top-2 gap) is the cheapest trigger with a mechanism argument for in-distribution misclassification slices. Both cost one reduction over the same logits. Neither wins everywhere, and on saturated-confidence failures no output-space trigger can win at all.

First principles

Softmax throws away the height of the logit vector. Adding the same constant to every logit leaves the softmax unchanged. Logits of 1, 0, 0 and 11, 10, 10 give identical probabilities. So max-softmax sees only the gaps between logits, never how strongly the input activated any option at all. Max logit and energy keep that height, which is the information an unfamiliar input tends to lack.

Every cheap trigger is a summary of the same vector. Max-softmax keeps the top probability. Margin keeps the gap between the top two. Entropy keeps the spread of the whole distribution. Energy keeps the overall level of the logits. They cost the same, one pass over k numbers, so they differ only in which information they keep. That is why each wins on a different slice.

A threshold cuts an ordering, so only separation counts. The fitted threshold decides where to split the items once they are sorted by score. Coverage at a given error rate depends on how well that sort puts right answers above wrong ones. A trigger with honest stated confidence but poor ordering is a poor trigger.

No function of the output can see what the output does not contain. If the model is confidently wrong, every trigger computed from its logits reads the same confident vector. Catching that failure needs a signal from the input side, before or beside the forward pass.

Background

The baseline is Hendrycks and Gimpel, who showed that correctly classified examples tend to have greater maximum softmax probabilities than misclassified and out-of-distribution examples, and proposed thresholding that probability across vision, language, and speech tasks [1]. The paper explicitly notes the baseline can sometimes be surpassed, which is the opening this report walks through.

Max-softmax fails for two documented reasons. First, the softmax saturates: Liu et al. show an in-distribution and an out-of-distribution example with softmax confidences of 1.0 and 0.99, effectively tied, while their negative energy scores are 11.19 and 7.11, cleanly separated [3]. Second, modern networks are systematically overconfident: Guo et al. established that depth, width, and related factors harm calibration, and that temperature scaling is surprisingly effective as a post-hoc fix on most datasets [4]. Calibration restores the meaning of stated confidence but not necessarily separability, a distinction the evidence section returns to.

The cheapest tier above max-softmax is the logit-space family, all post-hoc functions of the same vector. Maximum logit drops the softmax entirely. Energy takes the negative logsumexp of the logits (Helmholtz free energy with logits as negative energies), which Liu et al. note is conveniently calculated via the logsumexp operator [3]. Margin subtracts the runner-up logit or probability from the top one, using information max-softmax discards. Entropy pools the whole distribution, and normalized entropy is already the documented confidence in at least one open typed-decision engine [17]. None of these needs anything the forward pass has not already produced.

One step up in cost are learned triggers. ConfidNet learns to predict the true-class probability (TCP), arguing it is better suited than the maximum class probability for failure prediction, with theoretical guarantees and wins over methods from maximum probability to Bayesian uncertainty [6]. Deep Gamblers converts the m-class problem to m+1 classes with an abstain class, trained with a portfolio-theory loss, requiring almost no modification to inference or architecture and reporting strong results on SVHN and CIFAR-10 at various coverages [7]. Both need training changes, which puts them outside the cheapest tier but makes them the natural next experiment.

The expensive tier sets the ceiling that cheap triggers approach. ODIN adds temperature scaling plus input perturbations from a gradient step, reducing the false positive rate (FPR) from 34.7% to 4.3% on DenseNet over CIFAR-10 at 95% true positive rate (TPR) [5]. The k-nearest-neighbor (KNN) method scores test inputs by nearest-neighbor distance to training embeddings, reducing FPR at TPR 95% by 24.77% against a strong Mahalanobis baseline on ImageNet-1k, but needs a stored embedding bank and a neighbor search per query [11]. ReAct clips penultimate activations at a fitted quantile, reducing FPR95 by 25.05% against the previous best method on ImageNet, but needs activation statistics and a modified forward pass [12]. Every one of these pays per query with gradients, memory, or surgery; the question is how much of their gain survives at logit-only cost.

Two benchmark efforts frame the comparison. OpenOOD implements over 30 methods under one generalized detection framework so that anomaly detection, open-set recognition, and OOD methods can be compared fairly [9]. Its successor extends evaluation to ImageNet scale and foundation models such as CLIP and DINOv2, and to full-spectrum detection covering semantic and covariate shift together [10]; its repository tracks a live leaderboard of more than 35 methods [13]. On the text side, Larson et al. built the closest precedent to a typed-decision OOD slice: 150 intents over 10 domains with explicit out-of-scope queries, finding classifiers perform well in scope but struggle to identify out-of-scope inputs [14]. And Hendrycks et al. showed pretrained transformers degrade less under shift than older text models, while finding larger models are not necessarily more robust, distillation can be harmful, and diverse pretraining data helps [15].

What the evidence says

The table orders triggers from cheapest to most demanding. Cost is what each trigger needs beyond the single forward pass that produced the logits.

Four findings cut across the rows.

First, logit-space scores beat probability-space scores on OOD-flavored slices, because the softmax destroys the evidence. Energy’s 18.03% average FPR reduction over softmax confidence comes with the mechanism attached: energy is aligned with input density and resists the overconfidence that saturates softmax outputs [3]. Hendrycks et al. independently found that a maximum-logit detector outperforms prior methods on large-scale multiclass, multilabel, and segmentation tasks, introducing the Species set of over 700,000 images and a thousand anomalous species to prove it [2]. Vaze et al. add that open-set performance tracks closed-set accuracy across losses and architectures, and that a maximum-logit baseline with improved accuracy reaches state of the art on several open-set benchmarks [8]. The pattern is consistent: skip the normalization, keep the magnitude information, separate better.

Second, full-distribution statistics beat top-1 statistics on misclassification slices. DOCTOR’s black-box mode uses only the soft predictions, needs no training data and no prior information about the dataset, and still beats state-of-the-art misclassification detection on image and sentiment datasets [16]. ConfidNet’s true-class-probability target beats maximum class probability with theoretical backing for failure prediction [6]. Margin belongs in this family by construction, since the runner-up carries the ambiguity signal: a top probability of 0.6 means something different against a runner-up of 0.35 than against 0.05. But honesty requires the caveat recorded in the table: no source fetched for this report gives a clean margin-versus-max-softmax number on a small encoder, so that cell is UNVERIFIED and the claim rests on mechanism plus the neighboring DOCTOR and TCP results.

Third, calibration and separation are different objectives, and optimizing the first can harm the second. Yu et al. report the widely observed but neglected phenomenon that most confidence calibration methods are useless or harmful for failure prediction, because they worsen the confidence separation between correct and incorrect samples [18]. Their flat-minima method instead beats the state-of-the-art failure prediction method, correctness ranking loss (CRL), on ResNet110 over CIFAR-10. The practical consequence: fit temperature for honest stated confidence (Guo et al. show it works on most datasets [4]), but fit the abstention threshold on a separation metric such as AUROC or risk at fixed coverage, and never assume a lower expected calibration error (ECE) means a better trigger.

Fourth, the backbone can matter more than the trigger. Vaze et al. show the none-of-above decision tracks closed-set accuracy strongly enough that improving accuracy moves both the baseline and the state of the art together [8]. Hendrycks et al. show pretrained transformers start from a better robustness floor than older text models, with diverse pretraining data helping and distillation sometimes hurting [15]. A trigger comparison that holds the backbone fixed, as this report’s recommended experiment does, measures the trigger; a comparison across backbones mostly measures the backbone.

Analysis

Start with cost accounting, since “cheapest” is the question. For an option count k, max-softmax, max logit, margin, entropy, and energy each cost one O(k) reduction over data already in registers: microseconds against a forward pass measured in tens of milliseconds. DOCTOR’s black-box statistic is the same order. A learned confidence head adds parameters and a training procedure but still no second encoder pass. ODIN needs a backward pass and a second forward pass on perturbed input, roughly tripling inference. KNN needs a stored bank of training embeddings and a similarity search per query, with memory linear in the bank. On a small-decision latency budget (Laya’s README reports 33 ms for one question and 7.2 ms per question batched on a T4 [17]), the O(k) tier is effectively free and everything from ODIN up needs its own latency line item.

The recommended design is therefore two triggers from one logit vector, each fitted per bucket, each serving the slice where the evidence favors it. Negative energy gates the OOD and out-of-scope slice: far-shift inputs, off-topic intents in the Larson sense [14], and anything where the whole logit vector sits low. Margin gates the in-distribution misclassification slice: ambiguous inputs where the top two options genuinely compete. Both thresholds are fitted on held-out data per bucket, reusing the cardinality buckets the field already uses (Laya fits per-bucket temperatures over 2, 3 to 5, 6 to 10, and 11-plus options [17]), because a single global threshold is simultaneously too lax on hard slices and too strict on easy ones. Either trigger firing produces an abstain with its own reason code, following the parent survey’s schema recommendation, so the two slices stay separately gradable.

Slice by slice, the win map looks like this. On far-OOD and out-of-scope inputs, energy and max logit beat max-softmax by the saturation argument with numbers attached [2, 3]. On near-OOD and in-distribution errors, margin and full-distribution statistics should win by the ambiguity argument, with DOCTOR and TCP as the nearest measured support [6, 16] and the direct margin number marked UNVERIFIED above. On high-cardinality option sets, logit-space scores win because the softmax dilutes: with 77 Banking77-style options or 255 at a choice cap, the top probability compresses while logit magnitudes keep their spread, which is the large-scale regime where maximum logit won [2]. On covariate shift with the same label set, the evidence says the backbone dominates and trigger choice is second order [8, 15], so the experiment should stratify by backbone before ranking triggers.

There is one slice where no output-space trigger wins, and naming it is as important as the win map. When confidence saturates in a failure region, every function of the output distribution inherits the saturation. Laya’s README documents the canonical example: Khmer inputs score 0.000 accuracy at 0.952 mean confidence, and the project states plainly that confidence gating cannot save you, routing instead on script detection in under 0.5 ms of pure Python before the forward pass [17]. Energy, margin, and max-softmax all read the same overconfident vector; only an input-side signal (script, language, length, character-set features) or a router decision can catch that slice. The cheapest trigger beating max-softmax is therefore a complete answer only for output-separable slices, and the eval must include a saturated-confidence slice to show where the win map ends.

The measurement protocol follows directly. For each candidate trigger, fit thresholds per cardinality bucket on held-out data, then report AUROC per slice, the full risk-coverage curve rather than one operating point (the selective-classification practice of rejecting to meet a target risk, demonstrated at 2% ImageNet top-5 error with 99.9% probability at almost 60% coverage [19]), and ECE separately as an honesty metric that must not select the trigger [18]. The unanswerable-item families in the sibling report supply the abstention precision and recall slices. Until that experiment runs on a small encoder, the energy and max-logit numbers transfer from vision backbones by analogy, not by measurement.

Implications for small decision models

For Jev, the implication is caller-side and conditional. The independent decision-model-benchmark (DMB) reports Jev at 76.3% on 77-way Banking77, ECE 0.246 against a large language model (LLM) range of 0.039 to 0.122, ignorance admitted on 49.7% of forced-uncertainty items against 97.3 to 100% for LLMs, latency of 264 to 276 ms, and a sharp 255-choice cap [20]. Those numbers describe a closed application programming interface (API): TypeSafe’s architecture and training are undisclosed, per the Jev survey in this graph. If the API exposes the full option distribution, a caller can compute energy and margin client-side for free and fit thresholds on their own held-out traffic, turning the documented overconfidence into a gated risk-coverage tradeoff. If it exposes only the top label and confidence, the caller is stuck with max-softmax gating, which the saturation evidence says is the weakest trigger exactly where Jev looks weakest. Which surface Jev exposes is UNVERIFIED from the sources fetched here; the recommendation is to check the response schema before trusting any gate.

For Laya, the path is a small engineering change on top of existing machinery. Its README documents ModernBERT-large at 421M parameters for English and mmBERT-base at 322M for multilingual use, single-forward-pass typed decisions at 33 ms per question and 7.2 ms batched on a T4, entropy-based confidence, per-bucket temperatures, and a documented confidence-gating pattern [17]. Its Hugging Face card confirms the text-classification pipeline tag and Apache-2.0 licensing [21]. The teardown in this graph adds that the action head already consumes top-1 probability, the top-1/top-2 gap, normalized entropy, and option count, which means every input to the recommended two-trigger design already exists in the codebase. Three concrete steps follow: publish per-bucket energy and margin thresholds fitted on held-out data next to the per-bucket temperatures; keep the undocumented action probability out of the gating path until its saturation at 1.0 is resolved; and keep the sub-0.5 ms input-side router as the saturated-confidence backstop, since no output trigger covers the Khmer slice. None of this needs retraining.

For Velofy’s proposed Maestro Flash, the trigger choice should be designed in as an experiment rather than a constant: log full logit vectors on every eval item, fit per-bucket energy and margin thresholds on held-out data, report per-slice AUROC and risk-coverage curves over the sibling report’s unanswerable families, and run learned-trigger follow-ups (a ConfidNet-style true-class head [6], a Deep Gamblers abstain class [7]) against the logit-only tier on the same backbone. That experiment is the paper this report cannot write: no fetched source compares triggers on a small typed-decision encoder. Maestro Flash has no weights and no results, and nothing here claims otherwise.

Limitations

This report ran no experiments; every empirical claim is attributed to its source. Most trigger evidence comes from vision backbones (ResNet, DenseNet, WideResNet on CIFAR and ImageNet), with text evidence limited to intent out-of-scope detection [14], sentiment misclassification detection [16], and transformer robustness aggregates [15]. No fetched source compares abstention triggers on a small typed-decision encoder with closed option sets, so every transfer to Jev, Laya, or Maestro Flash is analogy supported by mechanism, not measurement. The margin-versus-max-softmax cell is explicitly UNVERIFIED.

Fitted thresholds carry their own caveats. Thresholds transfer poorly across backbones, languages, and option counts, which is why the report recommends per-bucket fitting rather than a universal cutoff, and the Khmer example shows the failure mode when transfer is assumed [17]. Threshold fitting also assumes the held-out data resembles deployment; under the distribution shifts that motivate abstention, that exchangeability assumption degrades exactly when the trigger matters most. Cost is analyzed as arithmetic order, not measured latency on any target accelerator. Finally, the OpenOOD leaderboard moves: the repository tracks more than 35 methods today [13], and any trigger ranking is a snapshot against a moving field.

Open questions

1. Which logit-only trigger wins on which slice for a small typed-decision encoder: a head-to-head of max-softmax, max logit, margin, entropy, energy, and DOCTOR-style statistics across out-of-scope, near-OOD, high-cardinality, and saturated-confidence slices?
2. How should per-bucket abstention thresholds be fitted so they transfer across option counts, languages, and backbones without refitting on every deployment’s held-out data?
3. What is the cheapest input-side signal that catches saturated-confidence failures where all output-space triggers agree and are wrong, and how should it combine with logit triggers in one abstention policy?

References

1. Hendrycks and Gimpel, A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks. arXiv:1610.02136
2. Hendrycks et al., Scaling Out-of-Distribution Detection for Real-World Settings. arXiv:1911.11132
3. Liu et al., Energy-based Out-of-distribution Detection. arXiv:2010.03759
4. Guo et al., On Calibration of Modern Neural Networks. arXiv:1706.04599
5. Liang et al., Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networks (ODIN). arXiv:1706.02690
6. Corbiere et al., Addressing Failure Prediction by Learning Model Confidence. arXiv:1910.04851
7. Liu et al., Deep Gamblers: Learning to Abstain with Portfolio Theory. arXiv:1907.00208
8. Vaze et al., Open-Set Recognition: A Good Closed-Set Classifier is All You Need? arXiv:2110.06207
9. Yang et al., OpenOOD: Benchmarking Generalized Out-of-Distribution Detection. arXiv:2210.07242
10. Zhang et al., OpenOOD v1.5: Enhanced Benchmark for Out-of-Distribution Detection. arXiv:2306.09301
11. Sun et al., Out-of-Distribution Detection with Deep Nearest Neighbors. arXiv:2204.06507
12. Sun et al., ReAct: Out-of-distribution Detection With Rectified Activations. arXiv:2111.12797
13. OpenOOD official repository (generalized OOD detection framework, live leaderboard of 35-plus methods). https://github.com/Jingkang50/OpenOOD
14. Larson et al., An Evaluation Dataset for Intent Classification and Out-of-Scope Prediction. arXiv:1909.02027
15. Hendrycks et al., Pretrained Transformers Improve Out-of-Distribution Robustness. arXiv:2004.06100
16. Granese et al., DOCTOR: A Simple Method for Detecting Misclassification Errors. arXiv:2106.02395
17. NandhaKishorM/laya, open typed-decision engine README (architecture, checkpoints, latency and confidence figures). https://github.com/NandhaKishorM/laya
18. Yu et al., Rethinking Confidence Calibration for Failure Prediction. arXiv:2303.02970
19. Geifman and El-Yaniv, Selective Classification for Deep Neural Networks. arXiv:1705.08500
20. nibzard/decision-model-benchmark, independent typed-decision benchmark (Jev behavior, calibration, and latency findings). https://github.com/nibzard/decision-model-benchmark
21. convaiinnovations/laya model card on Hugging Face (pipeline tag, license, tags). https://huggingface.co/convaiinnovations/laya

← All papers