Catching a Model That Is Wrong at 0.96 Confidence: DUD Splits FFN From Attention and Reaches 0.9487 AUROC on HaluEval

Researchers at Nanjing University of Aeronautics and Astronautics released DUD on August 4, 2026, a framework that measures uncertainty in large language models by decoupling feed-forward network and attention contributions instead of aggregating transformer residual stream updates, reaching an AUROC of 0.9487 on HaluEval with Llama-3.1-8B-Instruct. In the same table the ICR Probe scores 0.7703 and Semantic Entropy 0.7745. The central observation is that models produce wrong answers at an output probability near 0.96 and correct answers at roughly 0.35, and that this mismatch is legible in the restoration dynamics of internal modules. ASAP lays out the method and the reported figures, then examines where this approach is usable in production and where it stops.

The method splits an update stream that previous work read as one signal

Every transformer layer adds what attention and the FFN compute into a residual stream, and prior mechanistic uncertainty methods summed the magnitude or direction of those updates layer by layer to form a signal. The paper argues that this aggregation conflates two different jobs. The FFN retrieves what is stored in parameters while attention routes context, so a memory-context misalignment, which is exactly what shows up when the two push different answers, disappears in the sum.

DUD's instrument is causal tracing. A clean run and a corrupted run establish baselines, and then, in the corrupted run, only the FFN activations or only the attention activations are patched back to their clean values. How far the output recovers reveals whether that module was actually supporting the prediction. Repeating this per layer for both modules yields a dual-stream dynamic profile of twice the layer count, and the DUD-Probe is trained on that vector to predict correctness.

The starting point of the design is that the measured quantity is not a probability. Output probability is the surface signal a model finally emits; restoration capability is a signal about what supported that answer internally. The paper calls the latter active mechanistic diagnosis.

High confidence with a wrong answer, low confidence with a right one

One case study has a model answering "Japan" to a question about stick gymnastics. Output probability was approximately 0.96, yet the DUD-Probe assigned the generated token a faithfulness score of 0.04. Internal mechanistic support had collapsed while the surface distribution stayed smooth, which the paper labels a Stubborn Error.

The opposite case appears alongside it. For a query about the "Land of Fish and Rice" nickname, model confidence was around 0.35 and the answer was correct, with the paper attributing the low probability to the rarity of the entity in training data rather than to a failure of internal support. Together the two directions are what the paper names Confidence Inversion.

The mismatch also holds as a distribution, not just as anecdotes. Partitioning samples into four quadrants by whether attention and FFN stability exceed their thresholds, the error rate is 16.8% in the quadrant where both modules stay stable and 72.0% in the quadrant where both deviate. Those two numbers carry the claim that internal instability is a decisive predictor of failure.

How the main table was built across three models and four datasets

The evaluation covers three open models, Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct and Gemma-2-9B-it, on four knowledge-intensive tasks: HaluEval, SQuAD, TriviaQA and HotpotQA. Correctness labels come from a ROUGE-L threshold of 0.5, each dataset is split 80-20 for training and testing, and the DUD-Probe is trained with 5-fold cross-validation. Baselines include training-free methods such as perplexity, length-normalized entropy, Semantic Entropy, SAR and LLM-Check, alongside the trained probes SAPLMA, SEP and ICR.

DUD posts the highest AUROC for all three models. On Llama-3.1-8B the scores are 0.9487 on HaluEval, 0.8959 on SQuAD, 0.8579 on HotpotQA and 0.8031 on TriviaQA; on Qwen2.5-7B, 0.8642, 0.8204, 0.8435 and 0.8252; on Gemma-2-9B, 0.8747, 0.8218, 0.8597 and 0.8199. The strongest trained baseline, the ICR Probe, reaches 0.7703 on Llama HaluEval and 0.8144 on Qwen HaluEval.

Two relative figures carry the paper's argument: a 17.4% gain over Semantic Entropy on Llama HaluEval and a 5.0% gain over the ICR Probe on Qwen2.5. The first supports the claim that internal signals beat surface probabilities; the second supports the narrower claim that internal signals should be decoupled rather than aggregated. Those are different comparisons against different baselines and should be read separately.

Calibration error and rejection efficiency sit closer to operations

Expected calibration error on Qwen2.5-7B is the second metric the paper reports, and the DUD-Probe is the lowest on every one of the four datasets. On HotpotQA the DUD-Probe reaches 0.0039 against 0.0138 for the ICR Probe, 0.0675 for SAPLMA and 0.0979 for SEP; on HaluEval it reaches 0.0425 against 0.0798 and 0.0997. Low calibration error means the probe's score can be read directly as a probability of correctness without drifting far from reality.

One inconsistency is worth flagging. The prose in that section cites SEP at 0.2879 and SAPLMA at 0.1675 on HotpotQA, while Table 6, which the same passage references, lists 0.0979 and 0.0675. The table is the value to cite, and the conclusion that DUD has the lowest error on every dataset holds under either reading.

Rejection efficiency points the same way. PRR on HaluEval is 0.6346 for the DUD-Probe against 0.4989 for the ICR Probe, 0.4414 for SAPLMA and 0.3927 for SEP, with DUD highest on the other three datasets as well. Since PRR measures how much accuracy improves among retained answers once high-uncertainty ones are rejected, it maps directly onto the design of a human review queue. Robustness to the labeling rule was checked too: varying the ROUGE-L threshold across 0.3, 0.5 and 0.7 on Qwen2.5-7B leaves DUD first in every cell, holding between 0.8135 and 0.8636 under the strictest setting where SAPLMA runs between 0.7031 and 0.7348.

The ablation shows why one stream is not enough

The Llama-3.1-8B ablation is the test of whether splitting the two streams earns its complexity, and the full dual-stream configuration wins on all four datasets. On HaluEval an attention-only probe scores 0.9144 and an FFN-only probe 0.8968, while the full dual-stream configuration reaches 0.9487. On SQuAD the ordering flips, with attention-only at 0.8349 and FFN-only at 0.8511 against 0.8959 for the full configuration.

That flip is the substance of the argument. If factual errors surface as FFN collapse while context failures surface in attention, a single-stream detector will wobble whenever the task type changes. The full configuration taking the top score on every dataset is what supports the claim.

The layer study raises a different trap. Removing early layers 1 to 10 drops HaluEval from 0.95 to 0.8511, removing middle layers 11 to 21 gives 0.8893, and removing deep layers 22 to 32 gives 0.9001. There is no single golden layer for uncertainty; the probe needs the whole trajectory from initial encoding to final projection, which is where this design departs from probes that read one layer's hidden state.

Transfer across datasets held up

Trained on TriviaQA and evaluated on SQuAD, the DUD-Probe holds an AUROC of 0.868 where the ICR Probe reaches 0.613. Transferring from TriviaQA to HaluEval gives 0.930, close to in-domain performance. The paper reports degradation under 5% for DUD against drops of 15% to 20% for baselines.

Interpretation depends on what the probe learned. A probe that memorized dataset-specific surface patterns collapses when the domain moves; one that learned a task-agnostic mechanistic signature such as FFN fragility travels. Out-of-distribution scores approaching in-domain scores is evidence for the second reading.

The travel range, however, is only as wide as the experiments. All four tasks are knowledge-intensive question answering, and code generation, multi-step tool use and long-form summarization, where failures look different, were not tested.

Where this can be deployed and where it cannot

The hardest constraint is stated by the authors. DUD is a white-box method requiring access to internal activations and causal interventions, so it is inapplicable to closed-source API models. A service calling GPT-class or Claude models through an API cannot measure its own answers this way; only teams holding weights qualify. That also means teams self-hosting open-weight models are, for once, in the advantaged position.

The second constraint is cost. Causal tracing needs multiple forward passes for the clean, corrupted and patched runs, which raises inference latency relative to logits-based methods. Experiments ran on a server with four NVIDIA A100 80GB GPUs for a total budget of roughly 800 to 1,000 GPU hours, and the stated future work is distilling these mechanistic signals into lighter detectors for real-time monitoring.

The third is labeling. Judging correctness by ROUGE-L can push a correct answer phrased differently into the incorrect bucket. The authors mitigate this with three thresholds plus exact match and BERTScore sensitivity analyses, but defining correctness for open-ended generation remains an open problem. Probes also need per-dataset training; even with strong transfer, standing this up in a new domain still requires labeled samples once.

A high AUROC does not hand you a threshold

The number to read carefully is the metric itself. AUROC measures ranking quality independent of any threshold, so 0.9487 says nothing about what fraction gets filtered at a given operating point. Deploying this means choosing the score below which answers go to human review, and that choice trades the cost of missed errors against the cost of unnecessary review. The figures most usable for that trade are PRR at 0.6346 and ECE at 0.0039, not the headline AUROC.

Fairness of comparison deserves the same care. The DUD-Probe is a trained method and therefore does not operate under the same constraints as Semantic Entropy or perplexity. The paper applies identical data splits to all baselines and includes the trained probes SAPLMA, SEP and ICR, but the 17.4% improvement should always be quoted with the note that its comparator runs without training.

Scale is the last caveat. The models tested run between 7B and 9B parameters, with an added size comparison on Qwen2.5 at 3B and 14B reported as stable. Whether the same layer patterns hold at hundreds of billions of parameters, or in reasoning-specialized models, is outside what this paper answers.

Why uncertainty measurement matters again now

The problem DUD targets is one that grew larger through 2026 as AI system design shifted, and the paper's position makes more sense against that shift. As deployments move from one model answering a person to several agents consuming each other's outputs, the number of paths along which a wrong answer travels quietly into the next step keeps growing. What such systems need is not only higher accuracy but a mechanism that notices failure early, inside the pipeline.

The problem is that the available signal was output probability. As long as answers that are wrong at 0.96 exist, filtering by a probability threshold lets through the most dangerous class of error, the confidently wrong one. That is exactly the gap DUD targets, and the 16.8% versus 72.0% spread across the stability quadrants is evidence that a usable signal lives there.

The limit of this direction is equally clear. Requiring white-box access restricts who can build such safeguards to those holding weights, while most services calling models through an API stay dependent on surface signals and external verification. For teams running their own models this adds a tool; for everyone else it adds one more reason to evaluate self-hosting.

Source: ASAP analysis based on DUD: Decoupled Update Dynamics for Reliable Uncertainty Quantification in Large Language Models (arXiv:2608.03411v1, August 4, 2026) by researchers at Nanjing University of Aeronautics and Astronautics