Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: The paper proposes an algorithm to generate boundary OOD positive/negative samples to train a classifier for OOD samples. The algorithm is based on the theoretical analysis on why confidence value could be high in unbounded polytopes. CVAE is used as a generative model to get new samples. Experiments are conducted on MNIST and Fashon-MNIST datasets, which are used as OOD and in-distribution, and vice versa. Other datasets are also used for OODs. Comparison are made with Confident-Classifier, ODIN, and Mahalanobis distance-based approach, and the proposed method outperforms the others.
Overall the paper is well-written and well-organized. The proposed method is based on the idea from theoretical analysis, and is reasonable and valid. There are only a couple of things to point out: First, the methods to compare, such as Confident-Classifier and ODIN, are not so strong. Thus, I am not sure whether the performance of the proposed algorithm is dramatically better. Second, I would like to see the sensitivity analysis of the proposed method, because there are several hyper-parameters as mentioned in the paper.
However, I like the method and could be accepted as an ICLR paper.

review_title: Official Blind Review #2

final_score: rating: 3: Weak Reject
review_content: ** post rebuttal start **

After reading reviews and authors' response, I decided not to change my score.
I recommend to strengthen their theoretical justification or make their method scalable to improve their work.


Detailed comments:

2. "Moreover, their results on some of the gray-scale experiments are significantly worse compared to ours."
-> If you are talking about the comparison in MNIST-variants, please note that experimental results on MNIST cannot be seriously taken unless there is a strong theoretical background; especially, MNIST-variants are too small to talk about the scalability of the method. It is hard to convince readers only with results in MNIST-variants, unless the method has a strong theoretical justification.
However, if your claim is true for general gray-scale images, e.g., preprocessing CIFAR to be in gray scale, then you may add supporting experiments about it.

4. Again, if the method is only applicable to MNIST-variants due to its computational complexity while it has no strong theoretical justification, I can't find benefits from it.

** post rebuttal end **



- Summary:
This paper proposes to improve confident-classifiers for OOD detection by introducing an explicit "reject" class. Although this auxiliary reject class strategy has been explored in the literature and empirically observed that it is not better than the conventional confidence-based detection, the authors provide both theoretical and empirical justification that introducing an auxiliary reject class is indeed more effective.


- Decision and supporting arguments:
Weak reject.

1. Though the analysis is interesting, it is not applicable to both benchmark datasets and real-world cases. Including the benchmark datasets they experimented, the input to the model is in general bounded, e.g., natural images are in RGB format, which is typically normalized to be bounded in [0,1]. Therefore, the polytopes would not be stretched to the infinity in most cases.
On the other hand, note that softmax classifiers produce a high confidence if the input vector and the weight vector of a certain class are in the same direction (of course feature/weight norm also matters, but let's skip it for simplicity). Therefore, if there is an auxiliary reject class, only data in the same direction will be detected as OOD; in other words, OOD is "modeled" to be in the same direction with the weight vector of the auxiliary reject class. However, the conventional confidence-based detection does not model OOD explicitly. Since OOD is widely distributed over the data space by definition, modeling such a wide distribution would be difficult. Thus, the conventional approach makes more sense to me.

2. The experiment is conducted only on MNIST variations, so it is unclear whether their claim is true on large-scale datasets and real-world scenario.
Why don't you provide some experimental results on other datasets commonly used in other OOD detection papers, such as CIFAR, SVHN, TinyImageNet, and so on?


- Comments:
1. In section 4, the authors conjectured the reason why the performance of reject class in Lee et al. (2018a) was worse is that the generated OOD samples do not follow the in-distribution boundaries well. I think Appendix E in the Lee et al.'s paper corresponds to this reasoning, but Lee et al. actually didn't generate OOD samples but simply optimized the confidence loss with a "seen OOD." Lee et al. didn't experiment on MNIST variations but many natural image datasets. So, it is possible that the auxiliary reject class strategy is only effective in MNIST variations. I suggest the authors to do more experiments on larger datasets to avoid this criticism.
review_title: Official Blind Review #3

final_score: rating: 3: Weak Reject
review_content: Comments on rebuttal

I don’t think that the authors made a valid argument to address my concerns about theoretical justification and experiments. As I mentioned in the review, the assumption and statements in the paper are not clear to me. Moreover, I think the authors should evaluate their methods on more realistic cases. Because of that, I’d like to keep my score. 

====

[Summary]

To detect out-of-distribution (OOD) samples, the authors proposed to add an explicit "reject" class instead of producing a uniform distribution and OOD sample generation method. They showed that the proposed method can perform better than several OOD detectors on MNIST and Fashion-MNIST datasets.

[Detailed comments]

I'd like to recommend a "weak reject" due to the following reasons:

1. Justification is not clear: The authors argue that arbitrarily large confidence values cannot be obtained if there are multiple K*. However, how can we guarantee that there are multiple K* only by introducing the additional class? Could the authors elaborate this more? Also, I'm not sure that the theoretical justifications are really valid because we usually consider bounded input space. 

2. Experimental results are not convincing: in the paper, only grayscale datasets, such as MNIST and FMNIST, are considered to evaluate the proposed method and I think it is not enough. I would be appreciated if the authors can provide more evaluations on various datasets (e.g., CIFAR, SVHN, TinyImageNet) and deep architectures (e.g., DenseNet and ResNet) similar to [Hendrycks 19, Liang' 18, Lee' 18].

[Questions]

1. Introducing additional class increases the number of parameters and can suffer from overfitting. Could the authors comment on overfitting issues? 

2. Could the authors compare the performance of the proposed method with the ensemble version of MD? 

3. Instead of generated OOD samples, could the authors report the performance with explicit OOD samples similar to [Hendrycks' 19]? 

[Hendrycks' 19] Hendrycks, D., Mazeika, M. and Dietterich, T.G., Deep anomaly detection with outlier exposure. In ICLR, 2019.

[Lee' 18] Lee, K., Lee, H., Lee, K. and Shin, J., Training confidence-calibrated classifiers for detecting out-of-distribution samples. In ICLR, 2018.

[Liang' 18] Liang, S., Li, Y. and Srikant, R., Enhancing the reliability of out-of-distribution image detection in neural networks In ICLR, 2018.
review_title: Official Blind Review #1

Meta-review: The paper improves the previous method for detecting out-of-distribution  (OOD) samples. 

Some theoretical analysis/motivation is interesting as pointed out by a reviewer. I think the paper is well written in overall and has some potential.

However, as all reviewers pointed out, I think experimental results are quite below the borderline to be accepted (considering the ICLR audience), i.e., the authors should consider non-MNIST-like and more realistic datasets. This indicates the limitation on the scalability of the proposed method. 

Hence, I recommend rejection.
Decision: Reject