Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper presents a post hoc method for OOD detection in classification models. The key to the proposed approach is to determine the typical feature set from the data and the trained neural network, and use it to compute an existing OOD detection score, such as the energy score. The typical set is computed by truncating the output from a batch normalization error. The truncation is controlled by a hyperparameter that determines the bias-variance trade-off for the method. The proposed BATS method outperforms baseline methods consistently across a variety of experimental settings.
strengths_and_weaknesses: Strengths:
* I really enjoyed reading this paper. It is well written and the ideas are easy to follow. 
* The problem is well-motivated and the literature review does a good job at contextualizing the paper in prior work.
* The proposed approach is simple, yet appears to be highly effective. The theoretical analysis further provides intuition for the BATS method.
* Overall, the empirical evaluation of the method is extensive and convincing. The analysis and discussion is thoughtfully constructed, and the effects of the hyperparameter thoroughly ablated.
* The figures are informative and effectively illustrate the benefits of the proposed approach.
* The analysis in the appendix was extensive and interesting, providing further support for the claims made in the main paper.

Weaknesses:
* In lines 3-4, the statement is not necessarily true as there are also methods that focus on better distribution calibration during training (some of these ideas are mentioned later in the paper as well). I would recommend softening the message of this sentence to be more precise.
* Language like 'Obviously' (line 47) and 'It is easy to see' (line 168) should generally be avoided in academic writing.
* At the end of Sec. 2, it would be helpful to have a one or two sentence discussion to contextualize the proposed BATS method in the described related work.
* Variations on the phrase 'We propose to rectify the features into the feature's typical set and then use these typical features to calculate the OOD score.' are repeated frequently throughout the paper.
* The $\lambda$ hyperparameter was not introduced in line 142 when it was first used.
* The decreased BATS performance on Tiny-Imagenet OOD detection in Table 2 is not mentioned or discussed.

The paper needs to be proofread for typos. The following is a non-exhaustive list of the typos I found:

1. Line 2: 'which raises the attention on out-of-distribution (OOD) detection' is awkward phrasing.
2. Lines 74-75: 'large sufficiently' should read 'sufficiently large'.
3. Line 98: 'energe score' should read 'energy score'.
4. Line 109: 'is provable aligned' should read 'is provably aligned'.
5. Line 130: 'common-used layer' should read 'commonly used layer'.
6. Footnote 1: I did not grammatically understand the phrase: 'the pre-training outputs moving average estimators during iterations'. Maybe something like: 'The pre-trained model outputs moving average estimators at each iteration.'?
7. Line 184: 'a two-side rectified normal distribution' should read 'a two-sided rectified normal distribution'.
8. There should be a space between the abbreviation and the number in references (i.e., Fig. X, Table Y, Sec. Z).
9. Line 197: 'Fig.2 illustrate' should read 'Fig. 2 illustrates'.
10. Line 220: 'verse vice' should read 'vice versa'.
10. Line 225: 'Recent researches propose' should read 'Recent literature/work proposes'.
11. Line 235: 'models are standard pre-trained' is grammatically awkward. Maybe something like: 'models are pre-trained in a standard manner'?
12. Line 238: 'In specific,' should read 'Specifically,'.
13. Line 246: 'which cost more' should read 'which costs more'.
14. Line 252: 'The start learning rate' should read 'The starting learning rate'.
15. Line 284: 'Our BATS can reduce the variance that benefit the OOD detection but also introduce a bias.' should read 'Our proposed BATS method can reduce variance, which benefits OOD detection, but can also introduce a bias.'.
16. Line 285: 'Energy Score (The horizontal lines).' should read 'Energy Score (the horizontal lines)'.
17. Fig. 5: x-axis labels are missing. This is also the case for some figures in the appendix.
18. Sec. 6: 'Limitation and societal impact' should read 'Limitations and societal impact'. 
19. Sec. 6: batch normalization is referred to in three different ways in the last paragraph (Batch Normalization, Batch-Norm, BN).
20. Line 693: 'our method surpass' should read 'our method surpasses'.
21. The references should be proofread (e.g., to ensure the year is not entered twice in a citation, the conference venue is listed instead of ArXiv when available, etc.).
questions: In addition to addressing the above listed weaknesses, I have the following questions for the authors.

1. How well do you believe that OOD detection can work post hoc without retraining the model? How much do poorly calibrated softmax uncertainties hinder post hoc method effectiveness?
2. Do you have a hypothesis for why BATS performance is lower than baseline methods on the Tiny-Imagenet OOD dataset in Table 2?
3. In the limitations, it is mentioned that 'some other information in the model' may be conducive to selecting the feature's typical set. Do you have a hypothesis for what this information might be?
limitations: The authors have done a good job in listing limitations of the BATS method. However, the addition of some potential negative societal implications would be helpful. For example, by truncating the features, certain biases in the data learned by the pre-trained model may be amplified. Furthermore, the process of truncation will inherently cause some information loss which may be crucial to model performance during deployment (building on the hyperparameter tuning discussion in the paper).
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The authors propose an OoD method that does not require the retraining of the model, and which relies on replacing the last BN layer by their proposed TrBN at inference time. The main concept of the new layer is that it clamps the most extreme features to be within their variance. By correcting those features (compressing the extreme features), the outputs of the model become less susceptible to OoD miss-classifications. The authors provide comparable or better results to existing state-of-the-art methods under different OoD scenarios.
strengths_and_weaknesses: *Strentghs*

The idea is of interest to the community and the method is easy to implement.

The theoretical analysis seems sound and well based.

The analysis of the trade-off from lambda and the bias introduced by the proposed TrBN looks correct.

The ablation study provides nice insight and answers a question I was already thinking of while reading the method section.

*Weaknesses*

The comparison with the related work is brief and there is little discussion of the similarities and differences. Methods such as ReAct seem to be close to the proposed approach, since they target "anomalous features".

The presentation could be improved. It requires a revision to correct some typos and grammatical errors. Some images and their texts could be more readable (e.g. Figs. 1-2).

The best results of the proposed method are in the supplementary, which is a bit odd. I would expect those to be discussed in the main paper, and also provide some insight on why the proposed method might work better in some of those methods. With the results shown in the main paper, the improvements in some of the scenarios are quite marginal in relation to other methods.
questions: Could you provide a bit more explanation on the differences with ReAct, that truncates the values of the activations? I assume by the results that the activations targeted by both ReAct and BATS are not the same, but is there any insight on that? Are the abnormal activations of ReAct closely correlated with the extreme features of BATS?

Most reported results are basically an upgrade on top of Energy [5], which can be applied to other methods (as shown in Fig. 3, and Appendix I). Therefore, wouldn't it make more sense to report it in most tables/figures as Energy+BATS? Considering the huge gap between the Energy and the Energy+BATS results, why use that combination and not another one? Even with the added cost of GradNorm, the results are much better. Also, that would raise the question to why would BATS work better in some methods than others.

Minor comments:
- check for typos and revise manuscript (e.g. line 9 play-and-plug --> plug-and-play, line 98 energe --> energy)
- Table 2, CIFAR100 WRN, ODIN, that should be in bold (check for other cases)
- Figure 5 is not mentioned in the text.
limitations: It is correctly stated in the limitations that this method is proposed as a post-hoc method, however, it has the limitation of the model a BN layer before the last FC layer.

There does not seem to be any potential negative societal impact generated from this work.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper proposes a replacement of the batch normalization layer (BATS) to rectify deep model features into its typical set to improve OOD detection performance. The authors provide theorectical analysis and ablation studies to look deeper into BATS, and achieves state-of-the-art performance using it as a play-and-plug module.
strengths_and_weaknesses: **Strengths**

Originality: The idea is new and intriguing. The authors propose a novel insight for OOD detection from the perspective of feature typicality, and divides deep features into typical features and extreme features. They also propose a novel replacement for Batch Normalization, which can be integrated into existing model structrues and OOD scores.

Quality: From the perspective of typicality, and under the assumption that extreme features are harmful for model training, the authors provide thourough ablation studies on the proposed BATS approach, and theoretically prove its bias-variance trade-off. The proof is in detail and experiments are discussed well.

Clarity: The paper is well-written and easy to follow.

Significance: The paper provides a novel perspective into OOD detection, and introduces a simple yet effective method for post-hoc detection. The method is evaluated on both small and large real-world datasets.

**Weaknesses**

I have not identified major weaknesses of this paper, while I do have some minor concerns that are listed in the “Questions” part.
questions: 1.Uncertainty measurement is important in OOD cases. Although the authors used FPR95, AUROC and test accuracy (in appendix) to show the effectiveness of BATS, it would be interesting to analyze the results of the pretrained models from the perspective of uncertainty quantification, such as comparing Brier score or expected calibration error (ECE)[1].

2.What are the choices for the reject region threshold $\gamma$, is it always the best value or a fixed value? 
 
[1] Guo C , Pleiss G , Yu S , et al. On Calibration of Modern Neural Networks, 2017.
limitations: The authors have properly addressed the limitations and potential negative societal impacts.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposed Batch Normalization Assisted Typical Set Estimation (BATS) for enhancing Out-of-distribution Detection methods. BATS is a truncated activation scheme to bound the output features of the BN unit. The paper demonstrated that BATS could improve several OOD detection methods, such as Energy, Gradnorm, ODIN, when applying it to rectify the features of the penultimate layer. The proposed approach looks simple and effective.
strengths_and_weaknesses: Strengths:
1) The proposed approach is simple to implement
2) The proposed approach is effective on several OOD detection methods with BN in the architecture demonstrated by experiments
3) The paper is well-written and easy to understand.

Weaknesses:
1) My first impression of this paper is that the proposed approach looks like a slight modification of ReAct.
Although BATS outperforms ReAct in experiments, the operation and the mathematical analysis look very similar.
In my understanding, BATS adaptively estimates the parameter c in ReAct.

- The authors explain the motivation in the perspective of typical features, but typicality is not novel in OOD detection, e.g.,

[r1] Detecting Out-of-Distribution Inputs to Deep Generative Models Using Typicality.

[r2] WAIC, but Why? Generative Ensembles for Robust Anomaly Detection.

2) The major limitation of the proposed approach is that it can be applied only on BN (please correct me if I misunderstand.)
This can bring two major concerns:
- As previous research showed that BN increases adversarial vulnerability [r3, r4], whether the proposed approach solved the problem of BN or had the ability of detecting OOD samples is not clear.
- Modern archiectures utilize better normalization methods other than BN, such as LN and GN, and thus interest and impact of the proposed method is greatly limited.

[r3] Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspective. ICCV 2021.

[r4] Batch Normalization is a Cause of Adversarial Vulnerability.

3) The authors didn't compare with SOTA of OOD detection on large-scale ImageNet, e.g.,

[r5] Out-of-distribution detection with deep nearest neighbors. ICML 2022.

[r6] VIM: Out-of-distribution with virtual-logit matching. CVPR 2022.

questions: Besides the concerns mentioned above, I don't understand why BATS can boost OOD detection theoretically.

Section 4.3 shows that BATS reduces the variance of output features and also introduces a bias term. In lines 175 - 177, the authors stated that "Our BATS aids this problem by reducing the variance of the deep features, which contributes to constraining the uncertainty of f and T(x; f) and improving the estimation accuracy of the reject region."

However, why variance reduction boosts OOD detection isn't clear. Does it generally improve classifiers or specifically solve OOD detection problem?
limitations: The discussion of limitations by authors is adequate. As said in Lines 299 - 300, "The limitation of our method can be that the Batch-Norm layers are required in the model architecture in our approach." I would encourage the authors to continue to improve the method and find a more general formulation, as normalization technique (especially unified formulation) have been extensively studied.
review_title: null

Meta-review: metareview: This paper received unanimous recommendations of acceptance. Concerns were expressed regarding the similarity between the proposed method and ReAct, but the concerns were addressed by the authors. The AC agrees with the reviewer regarding the contribution of this paper and recommends acceptance.
confidence: Certain
Decision: Accept