# Distribution shift

> Source: https://aiwiki.ai/wiki/distribution_shift
> Updated: 2026-07-24
> Fact-checked: 2026-07-24
> Categories: AI Safety, Data & Datasets, Machine Learning, Model Evaluation
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) - attribute to "AI Wiki (aiwiki.ai)"
> Cite as: AI Wiki. "Distribution shift." aiwiki.ai, 24 Jul 2026. https://aiwiki.ai/wiki/distribution_shift
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution.

Distribution shift is the condition in which the [probability distribution](https://aiwiki.ai/wiki/probability_distribution) that produced a model's training data differs from the distribution that produces the data the model actually encounters at test or deployment time. It is also called dataset shift, and in streaming or online settings it is often just called drift. Nearly all of [supervised learning](https://aiwiki.ai/wiki/supervised_learning) theory assumes that training and test examples are drawn [independently and identically distributed](https://aiwiki.ai/wiki/independently_and_identically_distributed_i_i_d) from one fixed distribution. When that assumption fails, the held-out accuracy a model reports during development stops being a reliable estimate of the accuracy it will deliver in use [1].

The problem is not a corner case. Deployment conditions differ from training conditions for mundane reasons: a hospital replaces a scanner, a camera is moved, a population ages, a vendor changes an upstream data feed, users adapt their behavior to the system's own outputs. Amos Storkey's chapter in the standard reference volume on the subject opens with scenarios of the same kind: a camera company that wants to resell its pattern recognition software for use on other cameras, a policy result from one country that another country hopes to reproduce, network intrusion detection software developed with machine learning on data from four years earlier. His summary of the gap is that textbook predictive [machine learning](https://aiwiki.ai/wiki/machine_learning) works by presuming either that the training and test domains match or that any mismatch does not matter [1]. In practice the mismatch usually matters, and the failures it causes tend to be silent: the model keeps returning confident predictions, it just returns wrong ones.

Distribution shift should not be confused with [data contamination](https://aiwiki.ai/wiki/data_contamination), which is the opposite failure. Contamination inflates benchmark scores because evaluation data leaked into training; shift deflates deployment performance because deployment data was never represented in training. Both break the link between a reported [benchmark](https://aiwiki.ai/wiki/benchmark) number and real-world behavior, in opposite directions, and a single system can suffer from both at once.

## Formal setting

Write the joint distribution over inputs and labels as P(x, y). Distribution shift exists whenever the training joint distribution and the test joint distribution differ, that is, whenever P_tr(x, y) is not equal to P_te(x, y) [1]. The concept-drift literature states the same thing over time: drift between time points t0 and t1 means there exists some x for which the joint distributions at those two times disagree [4].

The joint distribution can be factored two ways, and the choice of factorization organizes almost the entire field. The discriminative factorization P(x)P(y | x) separates a marginal over inputs from a predictive conditional; the generative factorization P(y)P(x | y) separates a class prior from class-conditional inputs [1][4]. Which factor changes determines both what breaks and what can be repaired. If only P(x) moves while P(y | x) holds, a correctly specified conditional model remains valid in principle, and the damage comes from finite samples, misspecification, and the model having spent its capacity on regions of input space that no longer matter [1]. If P(y | x) itself moves, the learned decision boundary is simply wrong and no amount of reweighting the inputs will fix it [4].

## A taxonomy of shift

Terminology in this area is inconsistent across communities, and several papers exist mainly to reconcile it. Moreno-Torres and colleagues published a unifying view of dataset shift in classification in Pattern Recognition in 2012 [3]; Storkey's chapter gives a causal-model framing of six named cases [1]; the concept-drift community, working on data streams rather than train-test pairs, developed a parallel vocabulary [4].

| Type | What changes | What stays fixed | Typical cause |
| --- | --- | --- | --- |
| Covariate shift (simple covariate shift) | P(x) | P(y \| x) | New population, new sensor placement, biased sampling [1][2] |
| Prior probability shift (label shift) | P(y) | P(x \| y) | Disease prevalence rises; class balance differs between sites [1][5] |
| Concept shift (real concept drift) | P(y \| x) | Sometimes P(x) | The relationship itself changes: fraud tactics evolve, user interests move [4] |
| Virtual drift | P(x) over time | P(y \| x) | Streaming analogue of covariate shift; also called sampling shift or feature change [4] |
| Sample selection bias | Effective P(x, y) | Underlying process | An unknown rejection process filters which examples were collected [1] |
| Domain shift | Measurement of x | Underlying quantity | Instrument, calibration, or units change [1] |
| Source component shift | Mixture weights of contributing sources | Components | Data pools several sources whose proportions move [1] |

Covariate shift is the best-studied case. Hidetoshi Shimodaira's 2000 paper in the Journal of Statistical Planning and Inference showed how to correct maximum-likelihood estimation for it by weighting the log-likelihood function, the importance-weighting idea that later correction methods build on [2]. Label shift, where the class marginal moves but the class-conditional inputs do not, is the natural model for diagnosis problems in which disease causes symptoms. Zachary Lipton, Yu-Xiang Wang and Alex Smola's Black Box Shift Estimation (BBSE), presented at ICML 2018, estimates the new label distribution using only an arbitrary black-box predictor's confusion matrix, and works even when that predictor is biased, inaccurate or uncalibrated, provided the confusion matrix is invertible [5].

[Concept drift](https://aiwiki.ai/wiki/concept_drift) is the time-indexed cousin of the whole family. The survey by Gama and colleagues in ACM Computing Surveys separates real concept drift, which changes P(y | x) and therefore the decision boundary, from virtual drift, which moves P(x) without touching the predictive relationship [4]. It also catalogues how change arrives over time: suddenly or abruptly, incrementally through a chain of intermediate concepts, gradually with the old and new concepts alternating, or as a reoccurring concept that returns after an absence. A one-off outlier is explicitly not drift, and confusing the two is one of the standard ways adaptive systems misfire [4].

## Why shifted data breaks models

Standard training minimizes average loss on the training sample, an objective known as [empirical risk minimization](https://aiwiki.ai/wiki/empirical_risk_minimization). That objective is indifferent to which features carry the signal, so a model will happily rely on any cue that predicts the label in the training data, including cues with no causal connection to the target. Geirhos and co-authors named this shortcut learning in a Nature Machine Intelligence perspective: decision rules that perform well on standard benchmarks but fail to transfer to more challenging testing conditions, including real-world ones [28].

A second mechanism is subtler. D'Amour and a large group of collaborators at Google described underspecification: a training pipeline can return many predictors with equivalently strong held-out performance, yet those predictors behave very differently once deployed [29]. Because the in-distribution validation score cannot distinguish among them, the choice of which one gets shipped is effectively made by arbitrary details such as initialization schemes or step size schedules picked for trainability [29]. The authors documented this across [computer vision](https://aiwiki.ai/wiki/computer_vision), [medical imaging](https://aiwiki.ai/wiki/medical_imaging), natural language processing, clinical risk prediction from electronic health records and medical genomics pipelines [29].

Sequential decision problems add a third mechanism. In [behavioral cloning](https://aiwiki.ai/wiki/behavioral_cloning), the learner's own actions determine what it sees next, so any deviation from the demonstrator's behavior moves the state distribution away from the training data and errors compound. Ross, Gordon and Bagnell framed this as a violation of the i.i.d. assumption in their 2011 AISTATS paper introducing DAgger, which retrains iteratively on states the learner actually visits [39].

How much these mechanisms cost is measurable. Taori and colleagues evaluated 204 ImageNet models in 213 test conditions and found little to no transfer of robustness from synthetic corruptions to natural distribution shifts; almost all robustness interventions gave negligible protection against natural shift, with training on larger and more diverse data the main exception, and even that did not close the gap [30]. That conclusion is contested. Hendrycks and colleagues, working with four real-world shift datasets of their own, reported that larger models and artificial data augmentations do improve robustness to real-world shift and that gains on artificial benchmarks can transfer, while still finding that no method they evaluated improved robustness consistently across every shift [20]. Miller and colleagues later documented an "accuracy on the line" phenomenon in which out-of-distribution performance is strongly correlated with in-distribution performance across many models and shifts, with notable exceptions including some CIFAR-10-C corruptions and the Camelyon17 tissue classification task from WILDS [31].

## Out-of-distribution generalization and detection

Two distinct goals sit under the label "out of distribution" (OOD). OOD generalization asks a model to keep working on shifted inputs. OOD detection asks it to notice that an input is unfamiliar and abstain, defer, or raise an alert. A survey by Yang, Zhou, Li and Liu proposed a generalized OOD detection framework that treats [anomaly detection](https://aiwiki.ai/wiki/anomaly_detection), novelty detection, open set recognition, OOD detection and outlier detection as sub-tasks of one problem, since these areas had developed largely in isolation despite shared motivations and methods [14].

The reference baseline for detection is embarrassingly simple. Dan Hendrycks and Kevin Gimpel showed at ICLR 2017 that the maximum softmax probability already separates correctly classified in-distribution examples from misclassified and out-of-distribution ones well enough to serve as a threshold, across vision, language and speech tasks [13]. A large literature of scoring functions followed, and OpenOOD v1.5 exists to compare them on a common footing, extending evaluation to ImageNet scale and to [foundation models](https://aiwiki.ai/wiki/foundation_models) such as [CLIP](https://aiwiki.ai/wiki/clip) and DINOv2, and framing the problem as full-spectrum detection covering both semantic and covariate shift [15].

Uncertainty estimates degrade exactly when they are most needed. Ovadia and colleagues benchmarked predictive uncertainty under dataset shift at NeurIPS 2019 and found that post-hoc [calibration](https://aiwiki.ai/wiki/calibration) falls short as shift increases, while methods that marginalize over models, notably [ensembles](https://aiwiki.ai/wiki/ensemble_learning), gave surprisingly strong results across tasks [16]. For detecting that a shift has happened at all, Rabanser, Gunnemann and Lipton compared shift-detection pipelines and found that two-sample testing on representations from a pretrained classifier performed best, with domain-discriminating approaches useful for characterizing a shift qualitatively and judging whether it is harmful [17].

## Domain adaptation and domain generalization

[Domain adaptation](https://aiwiki.ai/wiki/domain_adaptation) assumes access to unlabeled (sometimes partly labeled) data from the target domain; domain generalization assumes none, and asks for a model that works on domains never seen in training. The theoretical anchor is Ben-David and colleagues' 2010 Machine Learning paper, which bounds target-domain error by source-domain error plus a classifier-induced divergence between the two domains that can be estimated from unlabeled samples, plus a term for the best joint hypothesis across both [6].

That bound suggests making [representations](https://aiwiki.ai/wiki/representation_learning) domain-indistinguishable, which is what domain-adversarial training does. Ganin and co-authors added a gradient reversal layer to a standard [neural network](https://aiwiki.ai/wiki/neural_network), so ordinary backpropagation produces features that are discriminative for the task and invariant to domain [7]. Invariant Risk Minimization, from Arjovsky, Bottou, Gulrajani and Lopez-Paz, takes a more [causal](https://aiwiki.ai/wiki/causal_inference) route: learn a representation such that the optimal classifier on top of it is the same across all training environments [8]. Group distributionally robust optimization instead minimizes worst-case loss over predefined groups; Sagawa, Koh, Hashimoto and Liang showed that this only works for overparameterized networks when combined with strong regularization such as L2 penalties or early stopping, in which case worst-group accuracy improves by 10 to 40 percentage points on the Waterbirds, CelebA and MultiNLI benchmarks [9][10].

Adaptation can also happen after training. Tent, presented at ICLR 2021, adapts a deployed model with no access to source data and no labels by minimizing the entropy of its own predictions, updating [batch normalization](https://aiwiki.ai/wiki/batch_normalization) statistics and channel-wise affine parameters online in a single pass over the test data, which set a new state of the art error on ImageNet-C at the time [12].

Whether any of this beats careful baselines is contested. Gulrajani and Lopez-Paz built DomainBed, a testbed of seven multi-domain datasets, nine algorithms and three model selection criteria, and reported that when carefully implemented, empirical risk minimization shows state-of-the-art performance across all datasets [11]. Their broader point was methodological: a domain generalization algorithm is not complete without a model selection strategy, because choosing hyperparameters using target-domain data quietly assumes away the problem [11].

## Benchmarks

| Benchmark | Introduced | Shift studied | Scale and notes |
| --- | --- | --- | --- |
| ImageNet-C / ImageNet-P | Hendrycks and Dietterich, ICLR 2019 | Synthetic corruption and perturbation | 15 corruption types in four families (noise, blur, weather, digital) at five severities, plus four held-out corruptions; scored by mean Corruption Error normalized to AlexNet [18][19] |
| ImageNetV2 | Recht et al., 2019 | Replication of the original collection process | New test sets caused accuracy drops of 11-14% on [ImageNet](https://aiwiki.ai/wiki/imagenet) and 3-15% on CIFAR-10 [23] |
| ImageNet-R | Hendrycks et al., ICCV 2021 | Renditions: art, cartoons, graffiti, origami, sculpture, toys, video game imagery | 30,000 images over 200 ImageNet classes [20][21] |
| ImageNet-A / ImageNet-O | Hendrycks et al., CVPR 2021 | Natural adversarial filtration | 7,500 and 2,000 images over 200-class subsets; a DenseNet-121 scores about 2% on ImageNet-A, roughly a 90% drop, while the authors' annotators reached about 90% [22] |
| Caltech Camera Traps / Terra Incognita | Beery, van Horn and Perona, ECCV 2018 | New physical locations | Twenty static camera traps; generalization to unseen locations is poor, especially for classification [27] |
| WILDS | Koh et al., ICML 2021 | Real deployment shifts | 10 datasets spanning tumor identification across hospitals, wildlife camera traps, satellite imagery and poverty mapping [24] |
| WILDS 2.0 | Sagawa et al., 2021 | Same, plus realistic unlabeled target data | Unlabeled data added to eight of the ten datasets; domain-invariant, self-training and self-supervised methods showed limited success [25] |
| DomainBed | Gulrajani and Lopez-Paz, 2020 | Domain generalization with controlled model selection | Seven datasets, nine algorithms, three selection criteria [11] |
| Wild-Time | Yao et al., NeurIPS 2022 | Temporal shift | Five datasets with timestamps; average 20% drop from in-distribution to out-of-distribution, which existing methods did not close [26] |

## Documented failures in deployment

Google Flu Trends is the canonical cautionary tale. Its initial version was fitted by finding the best matches among 50 million search terms against 1,152 data points, and in February 2013 a later version predicted more than double the proportion of doctor visits for influenza-like illness that the Centers for Disease Control and Prevention reported [38]. Lazer, Kennedy, King and Vespignani documented that it overshot the actual level in the 2011-2012 season by more than 50% and reported overly high prevalence in 100 out of 108 weeks between 21 August 2011 and 1 September 2013 [38]. Two shifts compounded. The initial version had latched onto seasonal search terms and completely missed the non-seasonal 2009 influenza A-H1N1 pandemic, being in the authors' words part flu detector and part winter detector. Google's own search algorithm and interface then kept changing underneath the model, an effect the authors called algorithm dynamics [38].

Medical imaging supplies the clearest examples of shortcut-driven shift. Zech and colleagues, writing in PLOS Medicine in 2018, trained pneumonia detectors on chest radiographs from three hospital systems and found that internal performance beat external performance in three of five natural comparisons, for example an internal area under the curve of 0.802 against 0.717 externally for a model trained at Mount Sinai, and 0.931 internally against 0.815 externally for a model trained jointly on Mount Sinai and National Institutes of Health data [34]. A network trained to name the hospital system a radiograph came from succeeded on 99.95% of NIH and 99.98% of Mount Sinai images, and positive pneumonia cases were far more prevalent in the Mount Sinai data (34.2%) than at NIH (1.2%) or Indiana (1.0%), so site and department cues that correlate with local prevalence were available for a model to exploit instead of pathology [34]. During the COVID-19 pandemic, Maguolo and Nanni showed that comparable classification results could be obtained from X-ray images with most of the lungs masked out, evidence that the classifiers were keying on dataset artifacts [37]. Roberts and colleagues screened 2,212 studies of machine learning for COVID-19 detection and prognosis from chest radiographs and CT, of which 415 passed initial screening, and concluded in Nature Machine Intelligence that none of the models identified were of potential clinical use because of methodological flaws or underlying biases [36].

Deployed clinical prediction models drift too. Wong and colleagues externally validated Epic's proprietary sepsis model across 27,697 patients and 38,455 hospitalizations at one academic medical center between December 2018 and October 2019 and measured a hospitalization-level area under the curve of 0.63 (95% CI 0.62-0.64), against the 0.76-0.83 range reported by the vendor [35]. At the operational alert threshold the model missed 1,709 patients with sepsis, 67% of cases, while firing on 18% of all hospitalizations [35].

## Foundation models and language models

Large pretrained models changed the empirical picture without solving the problem. In the CLIP paper, OpenAI reported that a ResNet-101 makes five times as many mistakes on natural distribution shifts as on the ImageNet validation set, whereas zero-shot CLIP models reduced the gap between ImageNet accuracy and accuracy under distribution shift by up to 75% [32]. The paper's own explanation is instructive: a zero-shot model cannot exploit spurious correlations specific to a training distribution it was never fitted to. Adapting CLIP to ImageNet raised in-distribution accuracy by 9.2% while reducing robustness, which is the same tradeoff in reverse [32]. Wortsman and colleagues attacked that tradeoff directly with WiSE-FT, which averages the weights of the zero-shot and [fine-tuned](https://aiwiki.ai/wiki/fine_tuning) models and reported gains of 4 to 6 percentage points under distribution shift over prior work, 1.6 points on the target task, and 2 to 23 points on six further shifts, at no extra compute [33].

For [large language models](https://aiwiki.ai/wiki/large_language_model), the dominant shift is temporal. Training corpora have a cutoff; the world does not. Chen, Zaharia and Zou measured behavior change in a different sense by comparing the March and June 2023 snapshots of the same commercial models, reporting that GPT-4's accuracy at identifying prime versus composite numbers fell from 84% to 51% between the two versions while other capabilities improved [40]. That study measures a shift in the model rather than in the data, but the operational consequence is the same for anyone whose pipeline was validated against the earlier snapshot. Wild-Time's five temporally ordered datasets remain the cleanest quantification of the data-side version of this, with an average 20% in-distribution to out-of-distribution gap that domain generalization, [continual learning](https://aiwiki.ai/wiki/continual_learning), self-supervised and ensemble methods all failed to close [26].

## Distribution shift versus data contamination

The two are frequently conflated in discussion of [LLM evaluation](https://aiwiki.ai/wiki/llm_evaluation), and separating them matters because the remedies are opposite. Data contamination occurs when a model is trained on the test split of a benchmark and then evaluated on that benchmark, which overestimates the contaminated model's performance relative to uncontaminated counterparts [41]. Distribution shift is the reverse: the evaluation data is genuinely held out, but it is drawn from a distribution the deployment environment does not match, so the benchmark number overestimates deployment performance for a different reason. Contamination is fixed by better data hygiene and decontamination auditing; shift is fixed by evaluating on target-like data, adapting the model, or monitoring after release. A benchmark score can be simultaneously inflated by contamination and uninformative because of shift.

## Monitoring, governance, and open problems

In production, labels usually arrive late or never, which is why practical [MLOps](https://aiwiki.ai/wiki/mlops) monitoring leans on unsupervised signals: two-sample tests on input representations [17], label-shift estimators that need only predictions [5], and score-distribution tracking. Gama and colleagues set out the requirements for models in changing environments as detecting drift as early as possible, distinguishing drift from noise, and operating within fixed time and memory per example [4].

Regulation has begun to encode the same concerns. Article 15 of the [EU AI Act](https://aiwiki.ai/wiki/eu_ai_act) requires high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity and to perform consistently in those respects throughout their lifecycle, with the levels of accuracy and the relevant accuracy metrics declared in the accompanying instructions for use [42]. It adds a specific provision for systems that continue to learn after being placed on the market or put into service: they must be developed so as to eliminate or reduce as far as possible the risk of possibly biased outputs influencing input for future operations, that is, feedback loops [42]. Article 113 sets 2 August 2026 as the general date from which the Regulation applies, with the high-risk classification rule in Article 6(1) and its corresponding obligations applying from 2 August 2027 [43].

Several problems remain genuinely open. Model selection under shift is unresolved, since any validation set drawn from the source distribution is the wrong instrument and any drawn from the target assumes access the setting is supposed to deny [11]. Unlabeled target data helps less than expected: on WILDS 2.0 the leading domain-invariant, self-training and self-supervised methods had limited success even with realistic unlabeled data [25]. Whether robustness to synthetic corruption transfers to natural shift is itself disputed, with Taori and colleagues finding little transfer [30] and Hendrycks and colleagues reporting transfer on their own real-world datasets [20]. And the taxonomy itself keeps expanding into new settings: a 2025 survey organizes text classification under shifting class distributions around Universum learning, zero-shot learning and open-set learning, and argues that continual learning addresses many of the resulting problems [44]. As of 2026, no single method dominates across the standard benchmarks, and carefully tuned empirical risk minimization remains a baseline that specialized algorithms often fail to beat [11].

## See also

- [Concept drift](https://aiwiki.ai/wiki/concept_drift)
- [Domain adaptation](https://aiwiki.ai/wiki/domain_adaptation)
- [Data contamination](https://aiwiki.ai/wiki/data_contamination)
- [Generalization](https://aiwiki.ai/wiki/generalization)
- [Overfitting](https://aiwiki.ai/wiki/overfitting)
- [Robust AI](https://aiwiki.ai/wiki/robust_ai)

## References

1. Storkey, A. J. "When Training and Test Sets are Different: Characterising Learning Transfer." Chapter in Dataset Shift in Machine Learning, MIT Press. https://homepages.inf.ed.ac.uk/amos/publications/Storkey2009TrainingTestDifferent.pdf
2. Shimodaira, H. "Improving predictive inference under covariate shift by weighting the log-likelihood function." Journal of Statistical Planning and Inference, vol. 90, pp. 227-244, 2000. https://doi.org/10.1016/S0378-3758(00)00115-4
3. Moreno-Torres, J. G., Raeder, T., Alaiz-Rodriguez, R., Chawla, N. V., Herrera, F. "A unifying view on dataset shift in classification." Pattern Recognition, vol. 45, pp. 521-530, 2012. https://doi.org/10.1016/j.patcog.2011.06.019
4. Gama, J., Zliobaite, I., Bifet, A., Pechenizkiy, M., Bouchachia, A. "A Survey on Concept Drift Adaptation." ACM Computing Surveys. https://mpechen.win.tue.nl/publications/pubs/Gama_ACMCS_AdaptationCD_accepted.pdf
5. Lipton, Z. C., Wang, Y.-X., Smola, A. "Detecting and Correcting for Label Shift with Black Box Predictors." ICML 2018. https://arxiv.org/abs/1802.03916
6. Ben-David, S., Blitzer, J., Crammer, K., Kulesza, A., Pereira, F., Vaughan, J. W. "A theory of learning from different domains." Machine Learning, vol. 79, pp. 151-175, 2010. https://www.alexkulesza.com/pubs/adapt_mlj10.pdf
7. Ganin, Y., Ustinova, E., Ajakan, H., Germain, P., Larochelle, H., Laviolette, F., Marchand, M., Lempitsky, V. "Domain-Adversarial Training of Neural Networks." Journal of Machine Learning Research, vol. 17, 2016. https://arxiv.org/abs/1505.07818
8. Arjovsky, M., Bottou, L., Gulrajani, I., Lopez-Paz, D. "Invariant Risk Minimization." 2019. https://arxiv.org/abs/1907.02893
9. Sagawa, S., Koh, P. W., Hashimoto, T. B., Liang, P. "Distributionally Robust Neural Networks for Group Shifts: On the Importance of Regularization for Worst-Case Generalization." 2019. https://arxiv.org/abs/1911.08731
10. group_DRO reference implementation and dataset descriptions. https://github.com/kohpangwei/group_DRO
11. Gulrajani, I., Lopez-Paz, D. "In Search of Lost Domain Generalization." 2020. https://arxiv.org/abs/2007.01434
12. Wang, D., Shelhamer, E., Liu, S., Olshausen, B., Darrell, T. "Tent: Fully Test-time Adaptation by Entropy Minimization." ICLR 2021. https://arxiv.org/abs/2006.10726
13. Hendrycks, D., Gimpel, K. "A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks." ICLR 2017. https://arxiv.org/abs/1610.02136
14. Yang, J., Zhou, K., Li, Y., Liu, Z. "Generalized Out-of-Distribution Detection: A Survey." https://arxiv.org/abs/2110.11334
15. Zhang, J., Yang, J., Wang, P., et al. "OpenOOD v1.5: Enhanced Benchmark for Out-of-Distribution Detection." https://arxiv.org/abs/2306.09301
16. Ovadia, Y., Fertig, E., Ren, J., Nado, Z., Sculley, D., Nowozin, S., Dillon, J. V., Lakshminarayanan, B., Snoek, J. "Can You Trust Your Model's Uncertainty? Evaluating Predictive Uncertainty Under Dataset Shift." NeurIPS 2019. https://arxiv.org/abs/1906.02530
17. Rabanser, S., Gunnemann, S., Lipton, Z. C. "Failing Loudly: An Empirical Study of Methods for Detecting Dataset Shift." NeurIPS 2019. https://arxiv.org/abs/1810.11953
18. Hendrycks, D., Dietterich, T. "Benchmarking Neural Network Robustness to Common Corruptions and Perturbations." ICLR 2019. https://arxiv.org/abs/1903.12261
19. ar5iv rendering of the ImageNet-C paper, used for corruption-type and mCE details. https://ar5iv.labs.arxiv.org/html/1903.12261
20. Hendrycks, D., Basart, S., Mu, N., et al. "The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization." ICCV 2021. https://arxiv.org/abs/2006.16241
21. ImageNet-R and DeepAugment repository. https://github.com/hendrycks/imagenet-r
22. Hendrycks, D., Zhao, K., Basart, S., Steinhardt, J., Song, D. "Natural Adversarial Examples." CVPR 2021. https://arxiv.org/abs/1907.07174
23. Recht, B., Roelofs, R., Schmidt, L., Shankar, V. "Do ImageNet Classifiers Generalize to ImageNet?" 2019. https://arxiv.org/abs/1902.10811
24. Koh, P. W., Sagawa, S., Marklund, H., et al. "WILDS: A Benchmark of in-the-Wild Distribution Shifts." 2020. https://arxiv.org/abs/2012.07421
25. Sagawa, S., Koh, P. W., Lee, T., et al. "Extending the WILDS Benchmark for Unsupervised Adaptation." 2021. https://arxiv.org/abs/2112.05090
26. Yao, H., Choi, C., Cao, B., Lee, Y., Koh, P. W., Finn, C. "Wild-Time: A Benchmark of in-the-Wild Distribution Shift over Time." NeurIPS 2022 Datasets and Benchmarks Track. https://arxiv.org/abs/2211.14238
27. Beery, S., van Horn, G., Perona, P. "Recognition in Terra Incognita." ECCV 2018. https://arxiv.org/abs/1807.04975
28. Geirhos, R., Jacobsen, J.-H., Michaelis, C., Zemel, R., Brendel, W., Bethge, M., Wichmann, F. A. "Shortcut Learning in Deep Neural Networks." Nature Machine Intelligence. https://arxiv.org/abs/2004.07780
29. D'Amour, A., Heller, K., Moldovan, D., et al. "Underspecification Presents Challenges for Credibility in Modern Machine Learning." 2020. https://arxiv.org/abs/2011.03395
30. Taori, R., Dave, A., Shankar, V., Carlini, N., Recht, B., Schmidt, L. "Measuring Robustness to Natural Distribution Shifts in Image Classification." 2020. https://arxiv.org/abs/2007.00644
31. Miller, J., Taori, R., Raghunathan, A., Sagawa, S., Koh, P. W., Shankar, V., Liang, P., Carmon, Y., Schmidt, L. "Accuracy on the Line: On the Strong Correlation Between Out-of-Distribution and In-Distribution Generalization." 2021. https://arxiv.org/abs/2107.04649
32. Radford, A., Kim, J. W., Hallacy, C., et al. "Learning Transferable Visual Models From Natural Language Supervision." 2021. https://arxiv.org/abs/2103.00020
33. Wortsman, M., Ilharco, G., Kim, J. W., et al. "Robust fine-tuning of zero-shot models." CVPR 2022. https://arxiv.org/abs/2109.01903
34. Zech, J. R., Badgeley, M. A., Liu, M., Costa, A. B., Titano, J. J., Oermann, E. K. "Variable generalization performance of a deep learning model to detect pneumonia in chest radiographs: A cross-sectional study." PLOS Medicine, 6 November 2018. https://journals.plos.org/plosmedicine/article?id=10.1371/journal.pmed.1002683
35. Wong, A., Otles, E., Donnelly, J. P., et al. "External Validation of a Widely Implemented Proprietary Sepsis Prediction Model in Hospitalized Patients." JAMA Internal Medicine, 21 June 2021. https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/2781307
36. Roberts, M., Driggs, D., Thorpe, M., et al. "Common pitfalls and recommendations for using machine learning to detect and prognosticate for COVID-19 using chest radiographs and CT scans." Nature Machine Intelligence, vol. 3, pp. 199-217, 2021. https://arxiv.org/abs/2008.06388
37. Maguolo, G., Nanni, L. "A Critic Evaluation of Methods for COVID-19 Automatic Detection from X-Ray Images." 2020. https://arxiv.org/abs/2004.12823
38. Lazer, D., Kennedy, R., King, G., Vespignani, A. "The Parable of Google Flu: Traps in Big Data Analysis." Science, vol. 343, pp. 1203-1205, 14 March 2014. https://gking.harvard.edu/files/gking/files/0314policyforumff.pdf
39. Ross, S., Gordon, G. J., Bagnell, J. A. "A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning." AISTATS 2011. https://arxiv.org/abs/1011.0686
40. Chen, L., Zaharia, M., Zou, J. "How is ChatGPT's behavior changing over time?" 2023. https://arxiv.org/abs/2307.09009
41. Sainz, O., Campos, J. A., Garcia-Ferrero, I., Etxaniz, J., Lopez de Lacalle, O., Agirre, E. "NLP Evaluation in trouble: On the Need to Measure LLM Data Contamination for each Benchmark." 2023. https://arxiv.org/abs/2310.18018
42. Article 15, EU Artificial Intelligence Act (Accuracy, robustness and cybersecurity). https://artificialintelligenceact.eu/article/15/
43. Article 113, EU Artificial Intelligence Act (Entry into force and application). https://artificialintelligenceact.eu/article/113/
44. Costache, A. V., Gheorghe, S. F., Poesina, E. G., Irofti, P., Ionescu, R. T. "Text Classification Under Class Distribution Shift: A Survey." 2025. https://arxiv.org/abs/2502.12965