Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: This simple paper shows that the normalization of softmax causes a loss of information compared to using the unnormalized logits when trying to do OOD and adversarial example detection.  The main reason for this is of course the normalization used by the softmax. The paper is mostly empirical following this specific observation, and uses a number of examples on MNIST and CIFAR to show the improvement in performance by using unnormalized logits instead of softmax.

While interesting, it is to be noted that methods such as ODIN and temperature scaling specifically include a temperature to exactly overcome this same issue with softmax. The lack of comparison to such baselines makes this paper quite incomplete, especially as it is an empirical paper itself. 
review_title: Official Blind Review #4

final_score: rating: 1: Reject
review_content: Summary

This paper showed that out-of-distribution and adversarial samples can be detected effectively if we utilize logits (without softmax activations). Based on this observation, the authors proposed 2-logit based detectors and showed that they outperform the detectors utilizing softmax activations using MNIST and CIFAR-10 datasets.

I’d like to recommend "reject" due to the following

The main observation (removing softmax activation can be useful for detecting abnormal samples) is a bit interesting (but not surprising) but there is no theoretical analysis for this. It would be better if the authors can provide the reason why softmax activation hinders the novelty detection.

The logit-based detectors proposed in the paper are simple variants of existing methods. Because of that, it is hard to say that technical contributions are very significant.

Questions

For evaluation, could the authors compare the performance with feature-based methods like Mahalanobis [1] and LID [2]?

I would be appreciated if the author can evaluate their hypothesis using various datasets like CIFAR-100, SVHN, and ImageNet.

[1] Lee, K., Lee, K., Lee, H. and Shin, J., 2018. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Advances in Neural Information Processing Systems (pp. 7167-7177).

[2] Ma, X., Li, B., Wang, Y., Erfani, S.M., Wijewickrema, S., Schoenebeck, G., Song, D., Houle, M.E. and Bailey, J., 2018. Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv:1801.02613.
review_title: Official Blind Review #5

final_score: rating: 1: Reject
review_content: This paper suggests that the logits cary more information than the maximum softmax probability for OOD detection. They suggest this with scatterplots and develop techniques to support this claim.
They use logits for as features for OOD detection with by using a kernel density estimator. They also use a NN trained with logits features, but this assumes we can peak at the test distribution, so I ignore this entirely in this evaluation.
Unfortunately their KDE density estimator does not perform better than the maximum softmax probability for OOD detection on CIFAR-10 (74.3 vs 91.7).
They do not show results on CIFAR-100, but since the dimensionality of the logits would increase by an order of magnitude, one would expect kernel density estimation to perform much worse. The authors should include an evaluation on CIFAR-100 for completeness.

Small comments:

Table 3 is a comment about featurization. Does this hold when taking the log of the softmax probabilities (not the same as logits)? If not, then this isn't much a count against the softmax per se. Even then, this is a comment on using softmax information for KDE, not using the maximum softmax probability itself for OOD detection.

The full results for Table 2 are needed. Perhaps place this in an appendix.

They repeat that the logits contain more information than the maximum softmax probability, but so does the raw input. The challenge is not introducing more noise/variance when introducing more information.

I was confused at the experimental description. The information should be contained in one location. They train one of their CIFAR networks for 30 epochs, which isn't enough training time. Consequently, I suspect that those results are not worth drawing implications from since the accuracy is presumably low.

review_title: Official Blind Review #3

Meta-review: 
The paper investigates how the softmax activation hinders the detection of out-of-distribution examples.

All the reviewers felt that the paper requires more work before it can be accepted. In particular, the reviewers raised several concerns about theoretical justification, comparison to other existing methods, discussion of connection to existing methods and scalability to larger number of classes.

I encourage the authors to revise the draft based on the reviewers’ feedback and resubmit to a different venue.


Decision: Reject