Venue: ICLR 2018 conference

Reviews:

final_score: rating: 9: Top 15% of accepted papers, strong accept
review_content: Detecting out of distribution examples is important since it lets you know when neural network predictions might be garbage. The paper addresses this problem with a method inspired by adversarial training, and shows significant improvement over best known method, previously published in ICLR 2017.

Previous method used at the distribution of softmax scores as the measure. Highly peaked -> confidence, spread out -> out of distribution. The authors notice that in-distribution examples are also examples where it's easy to drive the confidence up with a small step. The small step is in the direction of gradient when top class activation is taken as the objective. This is also the gradient used to determine influence of predictors, and it's the gradient term used for adversarial training "fast gradient sign" method.

Their experiments show improvement across the board using DenseNet on collection of small size dataset (tiny imagenet, cifar, lsun). For instance at 95% threshold (detect 95% of out of distribution examples), their error rate goes down from 34.7% for the best known method, to 4.3% which is significant enough to prefer their method to the previous work.


review_title: Improvement on state-of-the-art for detecting out of distribution examples

final_score: rating: 6: Marginally above acceptance threshold
review_content: The paper proposes a new method for detecting out of distribution samples. The core idea is two fold: when passing a new image through the (already trained) classifier, first preprocess the image by adding a small perturbation to the image pushing it closer to the highest softmax output and second, add a temperature to the softmax. Then, a simple decision is made based on the output of the softmax of the perturbed image - if it is able some threshold then the image is considered in-distribution otherwise out-distribution.

This paper is well written, easy to understand and presents a simple and apparently effective method of detecting out of distribution samples. The authors evaluate on cifar-10/100 and several out of distribution datasets and this method outperforms the baseline by significant margins. They also examine the effects of the temperature and step size of the perturbation. 
 
My only concern is that the parameter delta (threshold used to determine in/out distribution) is not discussed much. They seem to optimize over this parameter, but this requires access to the out of distribution set prior to the final evaluation. Could the authors comment on how sensitive the method is to this parameter? How much of the out of distribution dataset is used to determine this value, and what are the effects of this size during tuning? What happens if you set the threshold using one out of distribution dataset and then evaluate on a different one? This seems to be the central part missing to this paper and if the authors are able to address it satisfactorily I will increase my score. 
review_title: simple, effective technique

final_score: rating: 6: Marginally above acceptance threshold
review_content: 
-----UPDATE------

The authors addressed my concerns satisfactorily. Given this and the other reviews I have bumped up my score from a 5 to a 6.

----------------------


This paper introduces two modifications that allow neural networks to be better at distinguishing between in- and out- of distribution examples: (i) adding a high temperature to the softmax, and (ii) adding adversarial perturbations to the inputs. This is a novel use of existing methods.

Some roughly chronological comments follow:

In the abstract you don't mention that the result given is when CIFAR-10 is mixed with TinyImageNet.

The paper is quite well written aside from some grammatical issues. In particular, articles are frequently missing from nouns. Some sentences need rewriting (e.g. in 4.1 "which is as well used by Hendrycks...", in 5.2 "performance becomes unchanged").

 It is perhaps slightly unnecessary to give a name to your approach (ODIN) but in a world where there are hundreds of different kinds of GANs you could be forgiven.

I'm not convinced that the performance of the network for in-distribution images is unchanged, as this would require you to be able to isolate 100% of the in-distribution images. I'm curious as to what would happen to the overall accuracy if you ignored the results for in-distribution images that appear to be out-of-distribution (e.g. by simply counting them as incorrect classifications). Would there be a correlation between difficult-to-classify images, and those that don't appear to be in distribution?

When you describe the method it relies on a threshold delta which does not appear to be explicitly mentioned again.

In terms of experimentation it would be interesting to see the reciprocal of the results between two datasets. For instance, how would a network trained on TinyImageNet cope with out-of-distribution images from CIFAR 10?

Section 4.5 felt out of place, as to me, the discussion section flowed more naturally from the experimental results. This may just be a matter of taste.

I did like the observations in 5.1 about class deviation, although then, what would happen if the out-of-distribution dataset had a similar class distribution to the in-distribution one? (This is in part, addressed in the CIFAR80 20 experiments in the appendices).

This appears to be a borderline paper, as I am concerned that the method isn't sufficiently novel (although it is a novel use of existing methods).

Pros:
- Baseline performance is exceeded by a large margin
- Novel use of adversarial perturbation and temperature
- Interesting analysis

Cons:
- Doesn't introduce and novel methods of its own
- Could do with additional experiments (as mentioned above)
- Minor grammatical errors

review_title: Review

Meta-review: The reviewers agree that the method is simple, the results are quite good, and the paper is well written. The issues the reviewers brought up have been adequately addressed. There is a slight concern about novelty, however the approach will likely be quite useful in practice.
Decision: Accept (Poster)