Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a new OOD detection method that is provably robust against perturbations to OOD inputs. This method, called ProoD, has several desired properties including high detection performance as well as OOD detection certified robustness. ProoD makes use of a classifier and a certified binary discriminator for detection OOD samples and computes the class likelihoods as a product of the two functions. Theorem 1 in the paper guarantees that the network confidence would asymptotically converge to the uniform distribution and avoids overconfident predictions common in ReLU networks. 
strengths_and_weaknesses: **strengths** 
- well written paper 
- detailed explanation of the methods, theoretical background and contribution
- thorough evaluations

**weaknesses** 
- The main weakness of this work is the limited scope of the problem considered. As it is mentioned in the text, ProoD is designed to only consider the possibility of adversarial perturbations on the OOD samples (and not ID) and thus only seeks robustness in that regard. While this could be considered as a half-full half-empty kind of situation, I'm afraid in practice this is a critical downside which renders the method ultimately impractical.  
- While the empirical results, reported in Table-2, are very thorough, the reported numbers are somewhat mixed. E.g. ProoD outperforms other baselines on most OOD sets in terms of the newly introduced GAUC. However, when considering the more common AAUC metric, it underperforms in most cases. Also related to the previous point, the evaluations seem to be always on OOD samples, so it limits the ability to assess if the method can additionally generalize its robustness  to ID samples. 
questions: I do not have any additional questions. 
limitations: As it is also mentioned in the text, the proposed method only tackles one side of the problem which concerns adversarial robustness to OOD samples and by design does not consider the possibility of malicious perturbations to ID samples -- which is equally likely in principle. From that point of view the proposed method is severely handicapped.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The paper proposes a noval approach, ProoD, to integrate provably robustness against adversary on OOD data into OOD detection and achieve high classification accuracy. In partcular, Prood first learns a certifably robust model for the binary classification task between in- and out-distribution, and enable its integration of with state-of-the-art OOD detection methods, like OE, via joint training. Prood demonstrated its effectiveness against asymptotic overconfidence of deep neural network both theoretically and empirically. The authors also perform comprehensive empirical study for Prood on benchmark datasets and against various SOTA OOD methods. 

strengths_and_weaknesses: Strength: 
- The paper considers a novel setup of provably adversarially robust OOD, and the Prood is well-motivated with theoretical soundness.
- The guarantee on asymptotic confidence is an interesting aspect with empirical validation.
- The empirical study is comprehensive and evaluated on various benchmark datasets 

Weakness: 
- The proposed variation of the algorithms though well-motivated, is poorly presented. For better presentation, I suggest the author create a latex algorithm box and describe the different options: separate training, semi-joint training, Prood-disc, and Prood-\Delta. Does Prood-disc corresponds to Prood-\Delta = 0? 
- The empirical results require more clarification: 
	- Highlight the best performing algorithm in each setup for table 2 and tables in the appendix
	- Explain specifically how the bias shift is chosen. I am assuming the authors take the bias shift that maximizes AUC+GAUC+Accuracy. Is there results for AAUC under different bias shift? 

typos: 
- PDG should be PGD for line 289
questions: - Since binary shift is a core hyper-parameter for joint training, can authors explain why AUC increases with bias shift whereas GAUC decreases with the bias shift?
- Since the adversarial robustness is evaluated on OOD detection task instead of the naive classification, I am wondering if the authors explore the model-specific adaptive attack? It seems that currently the authors use an ensemble of variants of projected gradient descent. Particularly, I am not sure how robust the joint training procedure is against adaptive attacks. 
- I am wondering empirically what is the computation cost of the different variants of Prood, like Prood-S, Prood-disc, relative to other OOD detection methods, like OE?  

limitations: - As the authors mentioned in the paper, their approach only handles adversary around OOD samples instead of the in-distribution samples, and the studied adversary perturbation is generally limited to l_\infty ball. 
- The type of allowed adversary, limited to small perturbation sets, could be unrealistic for OOD data, which can have more different forms of uncertainty for the adversary.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper studies a significant and interesting topic: robust Out-of-Distribution (OOD) detection issue. Specifically, the authors propose a new method which combines a provably adversarially robust binary discriminator and standard classifier. Then, authors show that their method can simultaneously achieve high accuracy, high clean OOD detection performance as well as certified adversarially robust OOD detection. Finally, the authors verify the effectiveness of their method through extensive experiments.
strengths_and_weaknesses: Strengths 

1，	Training Prood model proposed in this paper is easy and stable and thus Prood provides OOD guarantees that come for free.

2，	The authors provide a theoretical guarantee for their proposed method.


Weaknesses:

1，	Related work is not presented clearly. It is hard to follow the intuition or motivation of authors.

2，	I would have preferred to see more authors’ comparison with previous related work

questions: see the weaknesses above.
limitations: N/A
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: This paper proposes ProoD which merges a certified binary classifier for in-versus out-distribution with a classifier for the in-distribution task in a principled fashion into a joint classifier. It shows that ProoD simultaneously achieves three properties: 1) guaranteed adversarially robust OOD detection via certified upper bounds on the confidence in $l_\infty$-balls around OOD samples; 2) ProoD provably prevents the asymptotic overconfidence of deep neural networks; 3) ProoD can be used with arbitrary architectures and has no loss in prediction performance and standard OOD detection performance. Extensive experiments are performed to show the promising performance of the proposed method ProoD.
strengths_and_weaknesses: I think this paper has the following strengths:

1. It derives the method ProoD in a principled way and proves that the method can prevent the asymptotic overconfidence of deep neural networks. Also, ProoD can be used with arbitrary architectures and has no loss in prediction performance and standard OOD detection performance;

2. It performs extensive experiments to evaluate the proposed method ProoD and also compares ProoD to existing baselines;

3. It is well-written and the related works are properly discussed.

However, I think this paper has the following weaknesses:

1. The idea of training a discriminator independently via interval bound propagation (IBP) to achieve certified robustness on out-of-distribution samples is not very novel since IBP is an existing technique that can ensure certified robustness;

2. The performance of the proposed method ProoD is quite mixed across different in-distribution and OOD datasets. For example, in Table 2, on CIFAR-10 vs. Smooth, the performance of ProoD is worse than that of ATOM and GOOD in terms of AAUC metric, and in terms of GAUC metric, the performance of ProoD is also worse than that of GOOD; On CIFAR-10 vs. LSUN_CR, the performance of ProoD is also worse than that of GOOD in terms of GAUC metric. On CIFAR-100 as the in-distribution dataset, it seems the performance of ProoD is usually worse than that of ATOM in terms of the AAUC metric. In Table 7 (in the appendix), when evaluating the method on more OOD test datasets, the performance of ProoD is also mixed. Although ProoD usually has higher accuracy compared to the baselines, its adversarial robustness is worse when it achieves higher accuracy. So there is a trade-off here. For robust OOD detection, I think we should consider both clean accuracy and adversarial robustness. However, it seems ProoD doesn't achieve good performance when considering both clean accuracy and adversarial robustness (or achieve a good trade-off). 

3. In practice, we need to pick a threshold for OOD detection. Thus, the False Positive Rate at 95% true positive rate (FPR) metric is also very important. Some results under the FPR metric are reported in Appendix F. However, based on the results in Table 6 (Appendix F), it seems the performance of ProoD is not good, and ProoD doesn't have clear advantages over the existing methods under the FPR metric. Thus, it might be hard to select a suitable threshold for the proposed method ProoD. 

questions: 1. How to interpret the experimental results? Does the proposed method ProoD achieve a good trade-off between clean accuracy and adversarial robustness? Does ProoD outperform existing methods in terms of adversarial robustness? 

2. How to select a suitable threshold for the proposed method ProoD? Does ProoD have good performance under the False Positive Rate at 95% true positive rate (FPR) metric? 
limitations: The limitations and potential negative societal impact are properly addressed.
review_title: null

Meta-review: metareview: The paper considers the task of OOD detection facing adversarial manipulations. It shows two existing defenses can be broken. It then proposes a method called ProoD to construct a classifier with both provability and high clean accuracy, and prove that it avoids asymptotic overconfidence. 

The paper studies an important topic and has made significant contributions: well-designed method with guarantees, thorough experiments with strong performance. The reviewers have some concerns that are addressed by the reviewers: 

1. Interpretation of the experimental results. ProoD doesn't always outperformance in all metrics. In the response, the authors clarify that among the methods with high accuracy, ProoD enjoys strong out-distribution robustness and also with certificates. Making this explicit can improve the presentation.

2. Presentation of the experimental results. The authors have incorporated some suggestions and the presentation is improved.

Overall, the work is a good contribution, and acceptance is recommended. 

confidence: Certain
Decision: Accept