Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: OOD detection is an important task for reliable AI. This paper proposes a new framework for OOD detection which combines the generative and discriminative models together. Specifically, they use the diffusion model for modifying the data under control and use the changes in the feature space for OOD detection. They choose ten representative methods to compare with the proposed methods on several datasets.
strength_and_weaknesses: Strength
- It provides a novel and promising strategy for OOD detection. Although using the generative model together with the discriminative model for OOD detection has been proposed in [1], the intrinsic idea behind how to use the generative model is radically different.
- The paper is well written, easy to follow, and with plenty of experiments to verify the effectiveness of their method.

[1] Oodgan: Generative adversarial network for out-of-domain data generation


Weaknesses:
-   The toy example in section 3.1 and section 3.3 are too disjoint with the practice, which makes the motivation not very convincing. More specifically, the discriminator considered in section 3.1 is a mask operator, which will hardly be used in practice as a discriminator. Adding some more realistic and convincing examples would be helpful.
-   Figure 4 demonstrates the dynamic of confidence over time has a different pattern for InD input and OOD input. However, their proposed algorithm does not rely on the dynamic of the confidence under the perturbance of DDP. And Figure 4 itself is also very confusing, with the differences between the three cases hard to understand. It is suggested that the author have a discussion of the performance by using the dynamic information.
clarity,_quality,_novelty_and_reproducibility: The usage of diffusion models for OOD is new in certain aspects, and extensive numerical experiments are presented to demonstrate good performance. 2 out of 4 datasets in OpenOOD benchmarks are conducted in the experiment. 
Although this paper gives plenty of toy examples to demonstrate motivation, the readability can be improved. Some examples, like figure 4 seem very confusing. 
summary_of_the_review: Overall I like the idea of applying diffusion models to do out-of-distribution detection, and this paper showed good performance compared with existing baselines. This paper can be greatly improved in terms of: more realistic and meaningful motivation examples; more detailed demonstration of the proposed method, etc.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper applies a denoising function (in the form of a diffusion model) to an image before doing OOD detection. The claim is that the new method outperforms other OOD methods on two of the datasets CIFAR10 and CIFAR100.
strength_and_weaknesses: Strengths: 
-- OOD detection is an important problem. The paper motivates their work with the point that discriminator-based methods can be susceptible to adversarial examples and bad cases. 

-- The authors propose a denoising technique that diffuses an image and then does OOD classification on it. 

Cons: 
 -- The paper is difficult to follow due to poor writing. For instance: "Let us assume that x0 is an image and epsilon is Gaussian noise, which  is the reverse of image x1, and we ...". One has to figure out what which refers to. The noise seems wrong. 
 -- Figure 4 is not clear
 --The  mathematical model could be clearer.
 -- The Toy example seems  contrived and very unlikely to occur in practice.
 -- The empirical results are not convincing. It seems that the results are mixed. 
 -- It is not clear how efficient the OOD detection scheme is.  Some discussion of the efficiency of OOD detection versus other techniques may be useful.


clarity,_quality,_novelty_and_reproducibility: The paper could be better written. A lot of detail in 2.2 could be abstracted and  perhaps moved to the Appendix, since it refers to past work and doesn't add value to understanding the Toy Example or the definitions  there -- I am not sure specific equations such as (6) enhance the understanding though they may be useful in reproducing the results. Instead, the authors could use the space to provide a more detailed discussion of the definitions used in the Toy Example and intuition behind them. I have concerns over the Toy Example overall since it seems like a rare scenario. But, if you are going to provide it, it would be good to write it really well and illustrate it well with examples so that it gives a strong intuition behind your approach.

The paper started out the motivation that discriminator-based methods can be susceptible to malicious and bad cases. But, later on in the paper, in the evaluations, I did not see an analysis of how well the scheme performs on malicious examples (e.g., adversarial OOD examples that are perturbed to evade the detector). I would like to see some results on that since that was one of the motivations.







 
summary_of_the_review: The paper left me unconvinced of the approach or the claims. The paper could use improvements on the intuition behind the approach, presentation of the approach, and empirical results. 

Update after the rebuttal: 
I reviewed the changes made. I still find the writing quality to be a significant issue. For instance, I made the following comment in my original review as an example of poor writing:  

*"Let us assume that x0 is an image and epsilon is Gaussian noise, which  is the reverse of image x1, and we ...". One has to figure out what which refers to. The noise seems wrong.*

I don't see that addressed. The concerns with empirical results remain as well. The adversarial examples need to be adaptive to the authors' detection pipeline and designed with those in mind. I would recommend using AutoAttack as well.

I do like the water analogy. But, the toy example still seems a bit contrived to me.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes a new OOD detection framework that combines a typical discriminator approach with a diffusion-based neighborhood definition. Motivated by a synthetic scenario, the de-noising process of invertible diffusion models is regarded as a kind of asymmetric interpolation and is utilized to find the diffusion-based neighbors of a given input. Then the OOD samples are detected based on the features of the neighborhood. The method is validated on OOD detection benchmarks and some analyses on the model component and sensitivity on the hyperparameters are also given. 
strength_and_weaknesses: [+] Introducing the (noise) interpolation scheme to the OOD problem via the diffusion process has a strong mathematical background and is claimed to be more interpretable. 

[+] Combining generative and discriminative models adds another proxy for distinguishing between ID and OOD. This enables the coordination of generator-sensitive and discriminator-sensitive features. 

[+] The Open-OOD benchmarks allowed for a fair evaluation. 

[-] The presented experimental results (in Table 1) are not very impressive compared to the previous methods.  

[-] Overall, the clarity and readability of the manuscript have been compromised, and there is a crucial need for extensive revisions. 

[-] Insufficient methodological clarification was given: it seems impracticable for readers to get a high-level overview of the diffusion models; rather, it is required to focus on how to organize and develop the diffusion-based neighborhood for identifying IOD and OOD. (especially how the ‘interpolation’ is managed to develop the classifier)

[-] It is not straightforward to grasp the context of Figure 2 and Figure 4. A more detailed explanation should be presented in the caption and the main text. 

[-] The descriptions in Algorithms 1-3 need to be improved. For example, the input and output of each line of codes do not match with those in other lines and some notations are used without introduction. 

[-] Figure 7 illustrates that the performance of the proposed strategy appeared to be hyper-parameter-sensitive. Nonetheless, Table 1 lacks a criterion for its selection. 

[-] We encourage the authors to provide more implementation details and the source code to the public to guarantee reproducibility.

[Q1] How does the model function when neighbors are obtained from random noises rather than images? 
 
clarity,_quality,_novelty_and_reproducibility: This study presents a novel perspective on OOD modeling, which is quite inspiring. However, its performance is not fully validated, and the quality of this work needs to be improved while focusing on clarity, particularly with detailed explanations and revising the layout of the content significantly. 
summary_of_the_review: The proposed idea seems novel and could inspire the readers. However, its performance is less impressive yet, and to be officially presented at the conference, the manuscript must be strengthened in its readability, and the authors need to provide enough details to guarantee its reproducibility.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper introduces diffusion models (DMs), a kind of powerful generative model, into OOD detection and finds that the denoising process of DMs also functions as a novel form of asymmetric interpolation. This property establishes a diffusion-based neighborhood for each input data. Then, the authors perform discriminator-based OOD detection based on the diffusion-based neighborhood instead of isolated data.
strength_and_weaknesses: strength:
1. the paper uses diffusion models to replace the requirement of the real outliers in the ood detection literature. the idea makes sense to me.
2. the results seem to be effective from the main tables on one benchmark.

weakness:
1. the paper is really hard to grasp. some of the descriptions are quite vague. What does the author mean by saying "reduces the information loss of feature extraction."?
2. there are some obvious mistakes in the paper, such as the algorithmic blocks such that It is heavy to grasp the flow of the method. For example, in Algorithm 2 and 3, the x_noise is generated but it is never used in the algorithm, x_neighbor does not have a closed-form relationship with x_noise.
3. the training time is suspicious, the author trained the classification and also the diffusion model for 160k epochs, which is not scalable in practice. Also, no experiments show its effectiveness on large-scale benchmarks, such as Imagenet1k as the in-distribution data.
4. There are no visualizations provided on the generated neighboring data points so that the readers might be confused why the proposed approach works.
5. the paper ignores some existing literature on using generation for OOD detection, such as [1-4]. Some additional discussion are favorable for readers to get the context.

[1] Zongyuan Ge, Sergey Demyanov, Zetao Chen, and Rahil Garnavi. Generative openmax for multi-class open set classification. In British Machine Vision Conference 2017. British Machine Vision Association and Society for Pattern Recognition, 2017.

[2] Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting out-of-distribution samples. In International Conference on Learning Representations, 2018.

[3] Lawrence Neal, Matthew Olson, Xiaoli Fern, Weng-Keen Wong, and Fuxin Li. Open set learning with counterfactual images. In Vittorio Ferrari, Martial Hebert, Cristian Sminchisescu, and Yair Weiss, editors, Computer Vision – ECCV 2018

[4] Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don’t know by virtual outlier synthesis. In International Conference on Learning Representations, 2021
clarity,_quality,_novelty_and_reproducibility: The paper is not written clearly such that I have to guess a lot of details of their method. The novelty is valid for me. No one uses diffusion models for OOD detection so far.
summary_of_the_review: This paper introduces diffusion models (DMs) to generate outliers for OOD detection. The method is valid to me but further clarifications and visualizations are needed to understand the approach better. Will consider changing my score after I see some of the other reviewers' opinions and the authors' responses.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper introduces diffusion models into OOD detection that combines a typical discriminator approach with a diffusion-based neighborhood definition. All the reviwers find that the paper is hard to follow, and there are some obvious mistakes in the paper, such as the algorithmic blocks. The paper is below the bar of top conferences. It is better to improve the paper according to the comments of reviewers.
justification_for_why_not_higher_score:  N/A
justification_for_why_not_lower_score:  N/A
Decision: Reject