Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper uses a generative model to assign anomaly scores. By its construction, it can provide provable performance guarantees. Experiments do not make unreasonable assumptions such as the ability to peak at the test data, unlike much previous work.
My primary concern is that they should show performance on CIFAR-100 not just CIFAR-10, and I certainly hope these experiments will be included during the rebuttal. Overall experimentation is thorough and competently executed, and the proposed technique is sufficiently novel.

Small comments:

> adv OOD detection with uniform ball perturbed
This is a good way of formulating adversarial OOD detection.

A possibly related work is _Early Methods for Detecting Adversarial Images_ (2016) since it uses covariance matrix information for detecting adversarial examples. This paper should cite _Open Category Detection with PAC Guarantees_ by Liu et al. (ICML 2018) since this also involved provable guarantees for OOD detection.

Update: my concerns are addressed but my sentiment is still that this is a 6.
review_title: Official Blind Review #3

final_score: rating: 6: Weak Accept
review_content: Summary: This paper provides a method to train neural networks with guarantees on outputting probabilities/scores close to uniform on inputs that are out of domain.
Precisely, on some point x_0, we can obtain the largest radius such that on inputs in the ball around x_0 the classifier outputs some predetermined  maximum score. 
The paper combines a simple generative model (mixture of Gaussian) for modeling in-distribution vs. out of distribution. The simplicity allows to obtain guarantees on the probability of an input being considered out of class. The model output p(y | x) critically uses the probability of being out of distribution. Hence guarantees on being detected as out of distribution translate to guarantees on p(y|x) being close to uniform.

Decision: I vote for accepting the paper. The paper has some clear strengths. However, I have some concerns regarding experiments and comparison to previous work. It would be great if the authors could clarify. 

Strengths: The paper’s methodolgy is clearly written.  The modeling is clear and sound. Overall, this idea is a promising approach to obtain networks that are provably under-confident far from training examples. The training cost for this approach is comparable to standard training, and the approach seems scalable and broadly applicable in general. 

The experimental evaluation is also clearly described. Worst-case evaluation of OOD (out of domain) performance seems novel and the gains not this objective using the proposed approach of this paper are interesting and promising. 

Concerns: While the paper explains the proposed method well, the description of previous work and relation to previous work is inadequate. After spending some hours reading the cited paper, I am still confused about what’s the novelty of this work at a high level. 
This work uses p(x|i) and p(x|o) in the computation of p(y|x) during inference, where i and o are in distribution and out of distribution respectively. This is crucial to obtain guarantees one performance. However, how does this compare to other previous work that also uses some kind of generative modeling to model in/out distribution? A bunch of papers are cited in the introduction as doing this, but the relationship to the proposed work is unclear.

— I have a major experimental concern: When comparing against ACET, the baseline of performing adversarial style training on random noise inputs seems more appropriate since it’s closer to the evaluation metric (which picks random noise as out of domain and not 80M Tiny Images). What does the performance of this ACET baseline look like?

— During evaluation, how do you ensure that the radius is not too large such that it has images that the model should actually be confident on (close to in distribution samples). A flip-side is how sensitive the performance is to the score chosen for choosing the radius for computing the valid set of images for the adversary? It’s possible that the 11%  threshold is too high? What’s the minimum confidence of CCU on the test images?

Minor comments on writing: 
—K_i, K_0 are not defined when writing the expression for GMM

review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: The authors present a novel approach for OOD detection; in particular their approach comes with worst-case guarantees without compromising on performance. 

The manuscript is clearly written and I only have some concerns regarding the evaluation. 
First, while the authors include with MCD an uncertainty-aware training approach, I miss more state-of-the-art methods with substantially better OOD performance, including Evidential Deep Learning (Sensoy et al, NeurIPS 2018) and Deep Ensembles. In particular a comparison to EDL would be interesting, since a similar entropy-encouraging term in the loss function is used during training, resulting is maximum entropy for OOD samples. 
Second, I would have liked to see precision and recall of the OOD detection task in addition to AUC, allowing a more meaningful/complete comparison between the approaches. 
review_title: Official Blind Review #1

Meta-review: This paper tackles the problem of confidence on neural network predictions for out-of-distribution (OOD) samples. The authors propose an approach for training neural networks such that the OOD prediction is uniform across classes. The approach requires samples from in- and out-of distribution and relies on a mixture of Gaussians for modelling the distributions, allowing to obtain theoretical guarantees on detecting OOD samples (unlike existing techniques).

The main concerns of the reviewers have been addressed during the rebuttal. If this approach does not outperform state-of-the-art in practice, providing such theoretical guarantees is an important contribution.

All reviewers agree that this paper should be accepted. I therefore recommend acceptance.
Decision: Accept (Poster)