Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The paper proposes a method to improve the OOD detection capability of the existing OOD methods. The paper relies on the "reprogramming" property of DNNs and learns watermarks that, when applied, can better separate the ID and OD data as in existing methods. The paper proposes an algorithm to learn these watermarks more effectively. Experimental results demonstrate that the proposed method can improve the OOD performance of the existing OOD detection methods. The paper also includes several qualitative analysis to study various aspects of the proposed method, including ablation studies, and transferability. 
strengths_and_weaknesses: The paper proposes an interesting approach to improve the performance of the existing OOD methods. In general, I find the paper's contribution novel:
1) A nice motivation for the study of reprogramming in the context of OOD. I can see that the proposed method helps improve the separation of ID and OD data.
2) The proposed algorithm seems to be effective in learning the watermarks.
3) The experiments at least demonstrate the core results of the task, and the benefits of the proposed approach.

I, however, also have some concerns/comments:

1) I can see that in practice, we don't have access to the OD dataset. And there's a large variation in the OOD performance as reported in the ablation study. How exactly do we choose the hyperparameters? Will selecting the wrong hyperparameters can even hurt OOD performance. I'm also not sure about the detail of the ablation experiments (I don't seem to be able to find it in appendix). What OD dataset is used?
2) The previous comment is particularly important when the performance improvements of the proposed method saturate when the dataset has more classes or becomes more complex (e.g., cifar100 or imagenet). This makes the proposed method not favorable to be used in practice. 

questions: In general, I find the study of reprogramming in the context of OOD interesting. However, I'm concerned about the practicality of the proposed method as mentioned in the weakness comments. 
limitations: The paper does not explicitly mention the limitation but I think it is discussed in some parts. I would appreciate it if the paper could provide a dedicated section to discuss the limitation of the method.
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: OOD detection aims to detect OOD data given only ID data or ID classifier. Since OOD data may cause risks when deploying the deep learning models into the real world, it is important to detect OOD data (like this paper considering). Based on my experience, this paper considers a setting where only ID classifiers are available and it is unavailable to see the ID data. Thus, the performance on ID classes will be maintained naturally. Given only the models, previous methods proposed score functions to determine if a data point is OOD, which is a natural way to utilize the models’ information. However, this paper argues that there might be another way to use the models, i.e., reprograming the models via changing data slightly. Compared to previous methods, this paper considers using the models from a higher level (based on the model reprograming property of deep models), which is very novel and interesting. 

From the technical level, the proposed watermarking strategy is also novel and different from previous reprograming methods. Extensive experiments verify that the proposed OOD detection methods are useful and performs better in general.
strengths_and_weaknesses: Pros:

1.  Reprogramming property of deep models is first used for OOD detection, which makes good contributions to the field of OOD detection. Previous methods only use models’ outputs and do not fully use the reprogramming property of deep models. This paper considers this property and successfully uses this property to address the OOD detection problem, which is novel. 

2. In previous post-hoc OOD detection methods, there are no tuning parameters after selecting a score function, which does not fully use the models’ information. However, this paper breaks through this situation and shows that we can further utilize the models’ information.

3. Previous reprogramming methods cannot be directly used for OOD detection, and this paper makes a new contribution to this field by proposing the watermarking strategy, which is novel.

4. Experiments verify the performance of the watermarking strategy, which is solid evidence that the reprogramming property of deep models can also help address the OOD detection problem. This finding will motivate more work in this field. It is appreciated that the performance is also tested on ImageNet benchmark datasets.

Cons:

1. When training the watermarks, additional noise is introduced. The proposed methods seem to use more information than previous methods. Why do previous methods not use this information? Are your methods the only methods that can use this information in post-hoc OOD detection? More explanations are required here. 

2. It is better to explain the use of Eq. (6). This optimization procedure seems very important to the method but lacks enough explanation. 

3. In the free-energy version, how to set the hyperparameter T? How does the value of T influence the performance of free-energy watermarking method?

4. The results regarding ImageNet benchmark should be moved into the main context instead of the appendix, which can help demonstrate the performance of watermarking strategy better.

5. In the whole paper, the data use ID and OOD to represent the ID or OOD data. While the loss functions use IN and OUT to present parts regarding ID and OOD. Keeping both consistencies is a better option.

6. Adding some specific noise into data can have a great impact on the model’s output, which has been verified in many areas. Watermark is one of them. How to analyse the power of watermark in math? Necessary discussions are required. 

questions: Please see weakness.
limitations: The authors have addressed the limitation part. There are no ethical concerns regarding the proposed strategy.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: This paper presents an out-of-distribution (OOD) detection method called “watermarking”, inspired by adversarial reprogramming. Given a scoring function that measures how in-distribution an image is, the method is to learn a fixed additive perturbation, later applied to test images, such that in-distribution images have high scores, and the perturbation has a low score. The authors claim that this will translate to being able to distinguish in vs out (i.e. OOD images with the additive perturbation will yield lower score) since OOD data was not observed during training, only the watermark. With the addition of some tricks (sign gradient descent and sharpness-aware minimization), watermarking is shown to improve OOD detection performance compared to not using watermark, on various scoring functions, and on various in-distribution datasets.
strengths_and_weaknesses: Strengths:
- To the best of my knowledge, the idea of learning an additive perturbation to improve OOD detection is novel.
- The method is relatively simple, and doesn’t involve training a classifier or generative model.
- The method can be used with various scoring functions, and it improves the OOD detection performance most of the time.

Weaknesses:
- The method is a bit ad hoc and the motivation is unclear. The authors claim that watermarking works because “the learning procedure does not see any OOD data during training”. If the only difference between test ID and OOD is that OOD data were not seen before, then why is watermarking necessary?
- The method involves, and is sensitive to hyperparameters. Furthermore, unsurprisingly, the optimal hyperparameter setting seems to depend on the test OOD data. This limits the usage of this method. Additionally, the authors seem to have tuned the hyperparameters on a separate validation OOD dataset disjoint from the ones used to evaluate the tables, however, there is no mention of this validation dataset in the main paper of the appendix. Since the quality of the hyperparameters should depend on the validation dataset, it’s important to know how the performance changes depending on different choices of the validation datasets.
- The evaluation of the method is limited. The evaluated ID and OOD pairs are very easy to distinguish, especially since CIFAR and ImageNet are very object-centric, while the OOD datasets are mostly scenery-based (except for SVHN, which are all numbers). I would like to see at the minimum, harder problems like CIFAR-10 vs CIFAR-100, which many papers already include, or ImageNet 1k vs ImageNet 21k (excluding ImageNet 1k). It would be great to see other more difficult datasets, like the ones used in open set recognition (e.g. the semantic shift benchmark from [1]) with bigger models like the Vision Transformer.

[1] Vaze, Sagar, et al. "Open-set recognition: A good closed-set classifier is all you need." 

questions: - Could the authors elaborate on the motivation behind watermarking? 
- What was the validation OOD dataset used to tune the hyperparameters?
- It seems like the sign is off for Equation 3 and Equation 11 (the higher the energy, the more OOD it should be). It seems like the sign is correct for the code though.
- Figure 5 seems to be missing something. The text refers to LSUN-C and LSUN-R, but there is only LSUN in Figure 5.
- The experiments testing watermarking’s impact on test accuracy (lines 272-279) doesn’t seem very relevant, since watermarking is only used to detect in vs out.
- Lines 283-284 “watermark is learned with the softmax scoring and tested regarding the free energy scoring” -> “learned with free energy and tested with softmax scoring”?
- The experiments testing the effect of masking my thresholding (lines 292-308) doesn’t seem very surprising, because the watermarks were trained to be a certain way, so there is no guarantee that changing parts of it abruptly, would do anything meaningful.

limitations: The authors have adequately addressed limitations of their work.
review_title: null

Meta-review: metareview: The reviewers agree that the proposed method is interesting and yields good performance.  A number of concerns were raised during the initial round of reviews concerning the rigorousness and completeness of experiments, but these were addressed during extensive back-and-forth between authors and reviewers.  

confidence: Certain
Decision: Accept