Unlabelled accuracy estimation

You have a million predictions from the last hour and no labels for any of them. You want a number for the model's current error rate, today, not in a quarter. This is not hopeless: the prediction itself carries information about whether it is right, and three families of method extract it in different ways, each paying for its estimate with a different assumption.

Confidence thresholding

The simplest estimator that works well. Fit a threshold \(t\) on a labelled source set so that the fraction of source examples with confidence above \(t\) equals the source accuracy, then apply the same threshold to unlabelled target data and report the fraction above it. Average Thresholded Confidence does exactly this (Garg et al., 2022, ICLR, arXiv:2201.04234), and across WILDS, ImageNet, BREEDS, CIFAR and MNIST it estimated target performance 2 to 4 times more accurately than the prior methods it was compared against.

The assumption it buys with: that the relationship between confidence and correctness transfers from source to target, even though the confidence distribution itself may move. That is weaker than requiring calibration, and it is why thresholding beats naively averaging softmax probabilities, which degrades whenever the model is overconfident on shifted data.

Confusion-matrix inversion

Under label shift, where \(P(y)\) changes but \(P(x \mid y)\) does not, the target label distribution is recoverable in closed form. Black Box Shift Estimation inverts the source confusion matrix against the target's predicted-label distribution (Lipton, Wang & Smola, 2018, ICML, arXiv:1802.03916):

with \(\mu_{\hat{y}}\) the target distribution of predicted labels. It works with a biased, uncalibrated, even mediocre predictor, as long as the confusion matrix is invertible, which fails when classes are rare or the model never predicts one of them. Its assumption is the strong one: label shift, which is the right model for disease prevalence or fraud base rates and the wrong model for a new camera, a new market, or an adversary.

Disagreement

Train a second model, or an ensemble, and use the rate at which they disagree on target data as a proxy for error. D3M formalises this for post-deployment deterioration monitoring and gives sample-complexity bounds for detecting genuine degradation while holding false positives low under benign shift (Nguyen et al., 2025, NeurIPS, arXiv:2506.05047). A close relative is training an explicit error estimator and monitoring its predictions as a proxy for the unobserved loss (Amoukou et al., 2024, NeurIPS, arXiv:2412.12910). The assumption: that the ensemble's disagreement region tracks its error region under the shift, which holds less well when all members share a bias, as they do when they share a training set.

When it breaks

All three degrade in the same direction, and it is the worst direction. Under mild shift they are accurate and you did not need them; under severe shift, which is when you do, calibration degrades, the confusion matrix stops describing the target, and correlated ensembles agree confidently on the same wrong answer. Treat an unlabelled estimate as a trigger to go and get labels, not as the metric itself. The reasonable production posture is: estimate continuously, alarm on a sustained estimated-risk increase, and resolve every alarm against a small adjudicated sample before acting on it.