Title: LEARNING OUT-OF-DISTRIBUTION DETECTION WITHOUT OUT-OF-DISTRIBUTION DATA

Abstract: Deep neural networks have attained remarkable performance when applied to data that comes from the same distribution as that of the training set, but can significantly degrade otherwise. Therefore, detecting whether an example is out-ofdistribution (OOD) is crucial to enable a system that can reject such samples or alert users. Recent works have made significant progress on OOD benchmarks consisting of small image datasets. However, such methods rely on training or tuning with both in-distribution and out-of-distribution data. The latter is generally hard to define a-priori, and its selection can easily bias the learning. In this work, we focus on the feasibility of learning OOD detection without OOD data, proposing two strategies for the problem. We specifically propose to decompose confidence scoring as well as a modified input pre-processing method. We show that both of these significantly help detection performance, all without tuning to any out-of-distribution data during training. Our further analysis on a larger scale image dataset shows that the two types of distribution shifts, specifically semantic shift and non-semantic shift, present a significant difference in the difficulty of the problem, providing an analysis of when the proposed strategies do or do not work.

1. INTRODUCTION:

State-of-the-art machine learning models, specifically deep neural networks, are generally designed for a static and closed world. The models are trained under the assumption that the input distribution at test time will be the same as the training distribution. In the real world, however, data distributions shift over time in a complex, dynamic manner. Even worse, new concepts (e.g. new categories of objects) can be presented to the model at any time. Such within-class distribution shift and unseen concepts both may lead to catastrophic failures since the model still attempts to make predictions based on its closed-world assumption. These failures are therefore often silent in that they do not result in explicit errors in the model.

The above issue had been formulated as a problem of detecting whether an input data is from indistribution (i.e. the training distribution) or out-of-distribution (i.e. a distribution different from the training distribution). A common baseline is to use the max value of class posterior probabilities output from a neural network classifier, which can in some cases be a good indicator for distinguishing in-distribution and out-of-distribution inputs (Hendrycks & Gimpel, 2017) . However, they also show that such probabilities tend to be overconfident. Since then, several works (Liang et al., 2017; Lee et al., 2018b; Vyas et al., 2018; Ren et al., 2019) follow a similar setting and evaluation metric, achieving significant improvement on the problem. However, the success of the above methods requires tuning hyperparameters with out-of-distribution data. In response, Dhamija et al. (2018) and Hendrycks et al. (2019) push this idea further by using a carefully chosen out-of-distribution dataset to regularize the learning of class posteriors so that out-of-distribution data have a much lower confidence than in-distribution. Lastly, Lee et al. (2018a) use a generative model to generate out-of-distribution data around the boundary of the in-distribution. All of the above strategies show the effectiveness of using out-of-distribution data during learning.

The risk of having out-of-distribution data for learning or tuning comes from the bias of the selection, leading to a concern that hyperparameters tuned with one out-of-distribution dataset might not generalize to others. Shafaei et al. (2019) investigate this concern and provide a less biased evalu-ation procedure by enumerating all combinations of known out-of-distribution datasets (for tuning) and unknown out-of-distribution datasets (for testing).

One natural choice for avoiding the mentioned bias is to not use out-of-distribution data for learning or tuning. Therefore in this work we focus on the setting where only in-distribution data are available during both training and validation stages. Furthermore, we consider a standard classification setting, in that the class labels and data are the only available information (in contrast, e.g. , to the work by Shalev et al. (2018) which uses extra supervision from word embeddings for learning).

Contribution: We propose two simple strategies for the problem under the above setting. First, inspired by the observation of classifier overconfidence (Hendrycks & Gimpel, 2017) , we provide a new probabilistic perspective of re-scaling the logits for decomposing confidence (predicted class probabilities) during the training. We specifically add a binary variable, representing whether the data is in-distribution or not, and use this variable to define the probability of the class and this variable conditioned on the data. We show this decomposes into two terms, both of which can be learned and used to define a new classifier. Our formulation is general and we show several existing methods reduce to specific cases for it. Second, we build on the input preprocessing method from ODIN (Liang et al., 2017) and develop an effective strategy to tune its perturbation magnitude (which is a hyperparameter of the preprocessing method) with only in-distribution data. We then perform extensive evaluations on benchmark image datasets such as CIFAR10/100, TinyImageNet, LSUN, SVHN, as well as a larger scale dataset DomainNet, for investigating the conditions under which the proposed strategies do or do not work. The results show that the two strategies can significantly improve upon baseline methods, achieving a performance close to, and in several cases surpassing, state-of-the-art methods (Lee et al., 2018b) which use out-of-distribution data for tuning. Lastly, our systematical evaluation with DomainNet reveals the relative difficulties between two types of distribution shifts: semantic shift and non-semantic shift, which are defined by whether a shift is related to the inclusion of new semantic categories.

2. BACKGROUND:

This work considers the OOD detection setting in classification problems. We begin with a dataset D in = {(x i , y i )} N i=1 , denotion in-distribution data x i ∈ R k and categorical label y i ∈ {y in } = {1..C} for C classes. D in is generated by sampling from a distribution p in (x, y in ). We then have a discriminative model f θ (x) with parameters θ learned with the in-domain dataset D in , predicting the class posterior probability p(y in |x).

When the learned classifier f θ is deployed in the open world, it may encounter data drawn from a different distribution p out such that p out = p in . Sampling from all possible distributions p out that might be encountered is generally intractable especially when the dimension k is large, such as in the cases of image data. Note also that we can conceptually categorize the type of differences into non-semantic shift and semantic shift. Data with non-semantic shift is drawn from the distribution p out (x, y in ). Examples with this shift come from the same object class but are presented in different forms, such as cartoon or sketch images. In the case of semantic shift, the data is drawn from a distribution p out (x, y out ) with {y out } ∩ {y in } = ∅. In other words, the data is from a class not seen in the training set D in .

The above separation leads to two natural questions that must be answered for a model to work in an open world: How can the model avoid making a prediction when encountering an input x ∼ p out (x, y out ), or reject a low confidence prediction when x ∼ p out (x, y in )? In this work, we propose to introduce an explicit binary domain variable d ∈ {d in , d out } in order to represent this decision, with d in meaning that the input is x ∼ p in while d out meaning x p in (or equivalently x ∼ p out ). Note that while generally the model cannot distinguish between the two cases we defined, we can still show that both of the questions above can be answered by estimating this single variable d.

The ultimate goal, then, is to find a scoring function S(x) which correlates to the domain posterior probability p(d|x), in that a higher score s from S(x) indicates a higher probability of p(d in |x). The binary decision now can be made by applying a threshold on s. Selecting such a threshold is subject to the application requirement or the performance metric calculation protocol. With the above notation, we can view the baseline method (Hendrycks & Gimpel, 2017) as a special case with a specific scoring function S Base (x) = max y in p(y in |x), where p(y in |x) is obtained from a standard neural network classifier f θ trained with cross entropy loss. However, S(x) can become a learnable parameterized function, and different OOD methods can then be categorized by specific parameterizations and learning procedures. A key differentiator between methods is whether the parameters are learned with or without OOD data.

2.1. RELATED METHODS:

This section describes the two methods that are the most related to our work: ODIN (Liang et al., 2017) and Mahalanobis (Lee et al., 2018b) . These two methods will serve as strong baselines in our evaluation, since Shafaei et al. (2019) reported that ODIN achieved the strongest results among 15 methods (which doesn't include Mahalanobis), out-performing popular strategies such as MC-Dropout (Gal & Ghahramani, 2016) , DeepEnsemble (Lakshminarayanan et al., 2017) , PixelCNN++ (Salimans et al., 2017) , and OpenMax (Bendale & Boult, 2016) with a less biased evaluation method. Mahalanobis has further been shown to have significant advantages over ODIN (Lee et al., 2018b) . Note that both ODIN and Mahalanobis start from a vanilla classifier f θ trained on D in , then have a scoring function S(x; f θ ) which has extra parameters to be tuned. In their original work, those parameters are specifically tuned for each OOD dataset. Here we will describe the methods to use them without tuning on OOD data.

ODIN comprises two strategies: temperature scaling and input preprocessing. The temperature scaling is applied to its scoring function which has f i (x) for the logit of i class:

S ODIN (x) = max i exp (f i (x)/T ) C j=1 exp (f j (x)/T ) (1)

Although ODIN originally involved tuning the hyperparameter T with out-of-distribution data, it was also shown that a large T value can generally be preferred, suggesting that the gain is saturated after 1000 (Liang et al., 2017) . We follow this guidance and fix T = 1000 in our experiments.

Mahalanobis comprises two parts as well: Mahalanobis distance calculation and input preprocessing. The score is calculated with Mahalanobis distance as follows:

EQUATION

The f (x) represents the output features at the th-layer of neural networks, while µ i and Σ are the class mean representation and the covariance matrix, correspondingly. The hyperparameter is α . In the original method, α is regressed with a small validation set containing both in-distribution and out-of-distribution data. Therefore they have a set of α tuned for each OOD dataset. As a result, for the baseline that does not tune on OOD data we use uniform weighting S M aha (x) = S M aha (x).

Note that both methods use the input preprocessing strategy, which has a hyperparameter to be tuned.

In their original works, this hyperparameter is tuned for each OOD dataset as well. Therefore we develop a version that does not require tuning with out-of-distribution data.

3. APPROACH:



3.1. THE DECOMPOSED CONFIDENCE:

Hendrycks & Gimpel (2017) observed that the softmax classifier tends to output a high confident prediction, reporting that "random Gaussian noise fed into an MNIST image classifier gives a predicted class probability of 91%". They attribute this to the use of the softmax function which is a smooth approximation of an indicator function, hence tending to give a spiky distribution instead of a uniform distribution over classes. We acknowledge this view and further consider it as a limitation in the design of the softmax classifier. To address this limitation, our inspiration starts from reconsidering its outputs, the class posterior probability p(y in |x), which does not consider the domain d at all. In other words, current methods condition on domain d = d in based on the implicit closed world assumption. Thus, we use our explicit variable d in the classifier, rewriting it as the quotient of the joint class-domain probability and the domain probability using the rule of conditional probability:

EQUATION

Equation 4 provides a probabilistic view of why classifiers tend to be overconfident. 2019), which adds an extra loss term to penalize a predicted non-uniform class probability when an out-of-distribution data is given to the classifier. In other words, this strategy requires out-of-distribution data for regularizing the training.

Without having supervision on domain d (i.e. without out-of-distribution data), there is no principled way to learn p(y in , d in |x). This situation is similar to unsupervised learning (or self-supervised learning) in that we need to insert assumptions or prior knowledge about the task for learning. In our case, we use the structure in Equation 4as the prior knowledge to re-design the structure of classifiers, leading to the decomposed confidence property.

We begin with describing a softmax function with logit f i (x) for class i. The f i (x) is defined by two functions h i (x) and g(x):

EQUATION

)

The h i (x) is a class-specific function similar to p(y in = i, d in |x), while the g(x) is shared among all classes like p(d in |x). The quotient of the two scores is then normalized by the exponential function (i.e. softmax) for outputting a class probability, which is subject to cross entropy loss. With Equation 5, the cross entropy loss can be minimized in two ways: increasing h i (x) or decreasing g(x). Here we make an assumption: There exist a pair of functions for h i (x) and g(x) so that h i (x) will have a harder time to output a large value for the data not in the high density region of in-distribution, but g(x) can easily output a small value (e.g. close to zero) for that case, making the logit f i (x) still able to generate a high p(y in = i|d in , x) for minimizing cross entropy loss.

There are several simple design choices for h i (x) and g(x) which satisfy the above assumption. Specifically we have g(x) = σ(BN (w g f p (x) + b g )), which uses features f p (x) from the penultimate layer of neural networks sequentially through another linear layer, batch normalization (BN , optional for a faster convergence), and a sigmoid function σ. For h i (x), we investigate three similarity measures, including inner-product (I), negative Euclidean distance (E), and cosine similarity (C) for h I i (x), h E i (x), and h C i (x), correspondingly:

EQUATION

The overall neural network model f θ therefore has two branches (h i and g) after its penultimate layer. At training time, the model calculates the logit f i followed by the softmax function with cross entropy loss on top of it. At testing time, the class prediction can be made by either calculating arg max i f i (x) or arg max i h i (x) (both will give the same predictions). For out-of-distribution detection, we use the scoring function S DeConf (x) = max i h i (x).

Note that when h i (x) = h I i (x) and g(x) = 1, this method reduces to the baseline (Hendrycks & Gimpel, 2017) . Additionally, the method in a concurrent work done by Techapanurak & Okatani (2019) can be regarded as a specific way to instantiate our framework when h i (x) = h C i (x). The above compatibility indicates that the proposed framework is general. Lastly, we call the three variants of our method DeConf-I, DeConf-E, and DeConf-C based the three different similarity measures (I, E, C) used in h i (x).

3.2. A MODIFIED INPUT PREPROCESSING STRATEGY:

This section describes a modified version of the input preprocessing method proposed in ODIN (Liang et al., 2017) . The main purpose of modification is making the search of the perturbation magnitude to not rely on out-of-distribution data. The perturbation of input is given by:

EQUATION

In the original method (Liang et al., 2017) the best value of is searched with a half-half mixed validation dataset of D val in ∼ p in and D val out ∼ p out over a list of 21 values. The perturbed images x are fed into the classification model f θ for calculating the score S(x). The performance of each magnitude is evaluated with the benchmark metric (TNR@TPR95, described later) and the best one is selected. This process repeats for each out-of-distribution dataset, and therefore the original method results in a number of values equal to the number of out-of-distribution datasets in the benchmark.

In our method, we search for the * which maximizes the score S(x) with only the in-distribution validation dataset D val in : * = arg max

EQUATION

Our searching criteria is still based on the same observation made by Liang et al. (2017) . They observe that the in-distribution images tend to have their score s increased more than the out-ofdistribution images when the input perturbation is applied. We therefore use Eq. 8 since we argue that an which makes a large score increase for in-distribution data should be sufficient to create a distinction in score. Our method also does not even require class labels although it is available in D val in . More importantly, our method selects only one based on D val in without access to the benchmark performance metric (e.g. TNR@TPR95), greatly avoiding the hyperparameter from fitting to a specific benchmark score. Lastly, we perform the search of on a much coarser grid, which has only 5 values: [0.0025, 0.005, 0.01, 0.02, 0.04]. Therefore, our search is much faster. Although overshooting is possible (e.g. the maximum value is at the middle of two scales in the grid) due to the coarser grid, it can be mitigated by reducing the found magnitude by one scale (i.e. divide it by two). This simple strategy consistently gains or maintains the performance on varied scoring functions, such as S Base , S DeConf , S ODIN , and S M aha .

The method in this section is orthogonal to all the methods evaluated in this work. For convenience, we will add a * after the name of other methods to indicate a combination, for example Baseline* and DeConf-C*.

4. EXPERIMENTS:



4.1. EXPERIMENTAL SETTINGS:

Overall procedure: In all experiments, we first train a classifier f θ on an in-distribution training set, then tune the hyperparameters (e.g. the perturbation magnitude ) on an in-distribution validation set without using its class labels. At testing time, the OOD detection scoring function S(x) calculates the scores s from the outputs of f θ . The scores s is calculated for both in-distribution validation set D val in and out-of-distribution dataset D out ∼ p out . The scores s are then sent to a performance metric calculation function. The above procedure is the same as related works in this line of research (Liang et al., 2017; Lee et al., 2018b; Hendrycks et al., 2019; Shafaei et al., 2019; Vyas et al., 2018 Lee et al., 2018a) , except that we do not use OOD data for tuning the hyperparameters in the scoring function S(x).

In-distribution Datasets: We use CIFAR-10/100 images with size 32x32 (Krizhevsky et al., 2009) for the classification task. Detecting OOD with CIFAR-100 classifier is generally harder than CIFAR-10, since a larger amount of classes usually involves a wider range of variance thus has a higher tendency to treat random data (e.g. Gaussian noise) as in-distribution. For that reason we use CIFAR-100 in our ablation and robustness study.

Out-of-distribution Datasets::

We include all the OOD datasets used in ODIN (Liang et al., 2017) , which are TinyImageNet(crop), TinyImageNet(resize), LSUN(crop), LSUN(resize), iSUN, Uniform random images, and Gaussian random images. We further add SVHN (Netzer et al., 2011) , a colored street numbers image dataset, to serve as a difficult OOD dataset. The selection is inspired by the finding in the line of works which uses a generative model for OOD detection (Ren et al., 2019; Nalisnick et al., 2018; Choi & Jang, 2018) . Those works report that a generative model of CIFAR-10 assigns higher likelihood to SVHN images, indicating a hard case for OOD detection.

Networks and Training Details::

We use DenseNet (Huang et al., 2017) , ResNet (He et al., 2016) , and WideResNet (Zagoruyko & Komodakis, 2016) for the classifier backbone. DenseNet has 100 layers with growth rate 12. It is trained with batch size 64 for 300 epochs with weight decay 0.0001. The ResNet and WideResNet-28-10 are trained with batch size 128 for 200 epochs with weight decay 0.0005. In both training, the optimizer is SGD with momentum 0.9, and the learning rate starts with 0.1 and decreases by factor 0.1 at 50% and 75% of the training epochs. Note that we do not apply weight decay for the weights in the h i (x) function of DeConf classifier since they work as the centroids for classes, and those weights are initialized with He-initialization (He et al., 2015) .

Evaluation Metrics: We use the two most widely adopted metrics in the OOD detection literature. The first one is the area under the receiver operating characteristic curve (AUROC), which plots the true positive rate (TPR) of in-distribution data against the false positive rate (TPR) of OOD data by varying a threshold. Thus it can be regarded as an averaged score. The second one is true negative rate at 95% true positive rate (TNR@TPR95), which simulates an application requirement that the recall of in-distribution data should be 95%. Having a high TNR under a high TPR is much more challenging than having a high AUROC score, thus TNR@TPR95 can discern between high-performing OOD detectors better. 

4.2. RESULTS AND DISCUSSION:

OOD benchmark performance: We show an overall comparison for methods that train without OOD data in Table 1 with 8 OOD benchmark datasets. The ODIN* and Mahalanobis* are significantly better than the baseline, while DeConf-C* still outperform them with a significant margin. These results clearly show that learning OOD detection without OOD data is feasible, and the two methods we proposed in Sections 3.1 and 3.2 combined are very effective for this purpose.

In Table 2 We further compare our results with the original ODIN (Liang et al., 2017) and Mahalanobis (Lee et al., 2018b ) methods which are tuned on each OOD dataset. We refer to the results of both original methods reported by Lee et al. (2018b) since it uses the same backbone network, OOD datasets, and metrics to evaluate OOD detection performance. In the comparison we find our ODIN* and Mahalanobis* perform worse than the ODIN orig and Mahalanobis orig in a major fraction of the cases. The result is not surprising because the original methods gain the advantage from using OOD data. However, our DeConf-C* still outperforms the two original methods with a margin in most of the cases. The cross-setting comparison further supports the effectiveness of proposed strategies.

Ablation Study: We study the effect of applying DeConf and our modified input preprocessing (IPP) strategy separately in Figure 1 and 2 . Figure 1 shows that all three variants (I, E, C) of the DeConf strategy help OOD detection performance with CIFAR-10 classifier, proving that the concept of DeConf is generally useful. However, the failure of DeConf-I with CIFAR-100 classifier may indicate the three variants have different robustness, which we will investigate in the next section. One downside of using the DeConf strategy is that the accuracy of the classifier may slightly reduce (Fig. 1b ). This could be a natural consequence of having an alternative term, i.e. g(x), in the model to fit the loss function. This may cause the lack of a high score for h i (x), instead assigning a lower score for the data away from the high density region of in-distribution data.

In Figure 2 , the results show that tuning the perturbation magnitude with only in-distribution data is an effective strategy, allowing us to reduce the required supervision for learning. The supervision here means the binary label for in/out-of-distribution.

Robustness Study: This study investigates when the OOD detection method will or will not work.

In Figure 3 , it shows that the number of in-distribution training data can largely affect the performance of the OOD detector. Mahalanobis has the lowest data requirement, but the DeConf method generally reaches a higher performance in the high data regime. In Figure 3 we also examine scalability by varying the number of classes in the in-distribution data. In this test, DeConf-E* and DeConf-C* show the best scalability. Overall, DeConf-C* is more robust than the other two DeConf variants. Lastly, Figure 4 shows that high performing methods such as DeConf-E*, DeConf-C*, and Mahalanobis* are not sensitive to the type and depth of neural networks. Therefore, the number of in-distribution samples and classes are the main factors that affect OOD detection performance. Figure 1 : An ablation study with three variants in our DeConf method (Section 3.1). Plain means g(x) = 1 so that the confidence decomposing effect is turned off. Each bar in (a) is averaged with the results on 8 OOD datasets listed in Table 1 . The backbone network is Resnet-34. Note that the plain setting with inner-product is equivalent to a vanilla Resnet for classification. Overall, our DeConf boosts the OOD detection performance while losing a small fraction of classification accuracy on in-distribution data.

Figure 2 : The OOD detection performance of our input preprocessing (IPP) strategy, which selects the perturbation magnitude with only in-distribution data. The setting plain means the IPP is turned off. The in-distribution data is CIFAR-100. The backbone network is Resnet-34. Each value is averaged with the results on 8 OOD datasets listed in Table 1 . Each method has its own scoring function S(x) (See Section 2.1 and 3), causing IPP to perform at varied levels of performance gain. 

4.3. SEMANTIC SHIFT VERSUS NON-SEMANTIC SHIFT:

One interesting aspect of out-of-distribution data that has not been explored is the separation of semantic and non-semantic shift. We therfore use a larger scale image dataset, DomainNet (Peng et al., 2018) , to repeat an evaluation similar to Table 1 . DomainNet has high resolution images in 345 classes from 6 different domains. There are 4 domains in the dataset with class labels available. They are real, sketch, infograph, and quickdraw, resulting in different types of distribution shifts.

To create subsets with semantic shift, we separate the classes to two splits. Split A has class indices from 0 to 172 while split B has 173 to 344. Our experiment uses real-A for in-distribution and has the other subsets for out-of-distribution. With the definition given in Section 2, real-B has a semantic shift from real-A, while sketch-A has a non-semantic shift. Sketch-B therefore has both types of distribution shift. Appendix Figure 5 illustrates the setup. The classifier learned on real-A uses a Resnet-34 backbone. Its training setting is described in Section 4.1 except that the networks are trained for 100 epochs and the images are center-cropped and resized to 224x224 in this experiment.

The results in Table 3 reveal two interesting trends. The first one is that the OOD datasets with both types of distribution shifts are easier to detect, followed by non-semantic shift. The semantic shift turns out to be the hardest one to be detected. The second observation is the failure of Mahalanobis*.

In most of the cases it is even worse than Baseline, except detecting random noise. In contrast, ODIN* has performance gain in most of the cases, but has less gain with random noise. Our DeConf-C* still performs the best, showing that its robustness and scalability is capable of handling a more realistic problem setting, although there is still large room for improvement.

5. CONCLUSION:

This paper shows methods and results that strongly suggest that learning OOD detection without OOD data is a viable option. Our comprehensive analysis shows that our two strategies, the decomposed confidence and modified input preprocessing, are effective and even better in many cases than the methods tuned for each OOD dataset. Our further analysis using a larger scale image dataset shows that the data with only semantic shift is harder to detect, pointing out a challenge for future works to address. ) /99.9(0.0) /99.9(0.0) Gaussian 48.0(28.) /62.0(38.) /100.(0.0) /6.79(4.9) /99.9(0.0) /99.9(0. 93.9(0.4) /92.9(2.9) /98.2(0.0) /98.6(0.0) /98.8(0.0) /99.4(0.1) iSUN 93.0(0.7) /92.2(3.4) /98.2(0.0) /98.6(0.0) /98.8(0.0) /99.4(0.0) SVHN 88.1(4.8) /89.6(0.3) /98.0(0.3) /98.2(0.2) /98.4(0.6) /98.8(0.1) Uniform 95.4(0.7) /98.9(0.7) /99.9(0.0) /99.2(0.5) /99.9(0.0) /99.9(0.0) Gaussian 94.0(2.9) /98.6(1.7) /100.(0.0) /99.1(0.3) /99.9(0.0) /99.9(0. 

:



Figures and Tables:

OOD detection performance with/without DeConf strategy (no input preprocessing). Left: CIFAR-10 classifier; Right: CIFAR-100 classifier.

Figure 3: Robustness analysis of 6 OOD detection methods. The left figure has classifiers trained on varied number of samples in CIFAR-10. The right figure has classifiers trained on varied number of classes in CIFAR-100. Each point in the line is an average of the results on 8 OOD datasets. The backbone network is Resnet-34. Please see Section 4.2 for a detailed discussion.

Figure 4: Robustness analysis using different neural network backbones. The in-distribution data is CIFAR-100. Each bar is averaged with the results on 8 OOD datasets. Table 3: Performance of four OOD detection methods using DomainNet. The in-distribution is the real-A subset. Each value is averaged over three runs. The type of distribution shift presents a trend of difficulty to the OOD detection problem: Semantic shift > Non-semantic shift > Semantic + Non-semantic shift.

Figure5: Semantic shift versus Non-semantic shift. We setup the two types of distribution shifts using DomainNet(Peng et al., 2018)

2.8) /56.0(3.1) /63.5(2.1) /31.0(3.4) /74.6(2.8) /87.8(1.7) Imagenet(r) 22.3(3.1) /59.4(3.7) /82.0(1.6) /21.4(4.0) /87.6(1.7) /93.3(1.2) LSUN(c) 23.0(2.2) /53.0(1.0) /31.6(1.3) /59.6(1.9) /51.0(1.0) /75.0(1.9) LSUN(r) 23.7(2.5) /64.0(3.0) /82.6(1.8) /21.1(3.3) /89.8(1.5) /93.8(0.3) iSUN 21.5(2.8) /58.4(4.1) /81.2(1.4) /17.6(3.3) /87.3(1.2) /92.5(0.2) SVHN 18.9(4.9) /35.3(2.9) /43.3(2.7) /52.0(0.6) /67.1(3.4) /77.0(5.0) Uniform 2.95(4.1) /66.1(46.) /100.(0.0) /0.0(0.0) /100.(0.0) /100.(0

Consider an example x ∼ p out : It is natural to expect that the joint probability P (y in , d in |x) is low (e.g. 0.09) for its maximum value among C classes. One would also expect its domain probability p(d in |x) is low (e.g. 0.1). Therefore, calculating p(y in |d in , x) with Equation4gives a high probability (0.9), demonstrating how overconfidence can result. Based on the form of Equation4, we call p(y in , d in |x) and p(d in |x) the decomposed confidence scores.One straight-forward solution for the above issue is to learn a classifier to predict the joint probability p(y in , d in |x) by having both supervision on class y in and domain d. Learning to predict p(y

Table content: <table/>

; Performance of four OOD detection methods. All methods in the table have no access to OOD data during training and validation. ODIN* and Mahalanobis* are modified versions that don't need any OOD data for tuning (see Section 2.1). The base network used in the table is DenseNet. All values are percentages averaged over three runs and the best results are indicated in bold. A more comprehensive version of the table is available in Appendix Table 5.

Table content: <table><tr><td>ID</td><td>OOD</td><td>AUROC</td><td>TNR@TPR95</td></tr><tr><td/><td/><td colspan="2">Baseline / ODIN* / Mahalanobis* / DeConf-C*</td></tr><tr><td/><td colspan="3">Imagenet(c) 79.0 / 90.5 / 92.4 / 97.6 25.3 / 56.0 / 63.5 / 87.8</td></tr><tr><td>CIFAR-100</td><td colspan="3">Imagenet(r) 76.4 / 91.1 / 96.4 / 98.6 22.3 / 59.4 / 82.0 / 93.3 LSUN(c) 78.6 / 89.9 / 81.2 / 95.3 23.0 / 53.0 / 31.6 / 75.0 LSUN(r) 78.2 / 93.0 / 96.6 / 98.7 23.7 / 64.0 / 82.6 / 93.8 iSUN 76.8 / 91.6 / 96.5 / 98.4 21.5 / 58.4 / 81.2 / 92.5 SVHN 78.1 / 85.6 / 89.9 / 95.9 18.9 / 35.3 / 43.3 / 77.0 Uniform 65.0 / 91.4 / 100. / 99.9 2.95 / 66.1 / 100. / 100.</td></tr><tr><td/><td>Gaussian</td><td colspan="2">48.0 / 62.0 / 100. / 99.9 0.06 / 33.3 / 100. / 100.</td></tr><tr><td/><td colspan="3">Imagenet(c) 92.1 / 88.2 / 96.3 / 98.7 50.0 / 47.8 / 81.2 / 93.4</td></tr><tr><td/><td colspan="3">Imagenet(r) 91.5 / 90.1 / 98.2 / 99.1 47.4 / 51.9 / 90.9 / 95.8</td></tr><tr><td>CIFAR-10</td><td>LSUN(c) LSUN(r) iSUN SVHN</td><td colspan="2">93.0 / 91.3 / 92.2 / 98.3 51.8 / 63.5 / 64.2 / 91.5 93.9 / 92.9 / 98.2 / 99.4 56.3 / 59.2 / 91.7 / 97.6 93.0 / 92.2 / 98.2 / 99.4 52.3 / 57.2 / 90.6 / 97.5 88.1 / 89.6 / 98.0 / 98.8 40.5 / 48.7 / 90.6 / 94.0</td></tr><tr><td/><td>Uniform</td><td>95.4 / 98.</td><td/></tr></table>

OOD detection with OOD data versus without OOD data. The values of ODIN orig and Maha orig (abbreviation of Mahalanobis) are copied from the Mahalanobis paper(Lee et al., 2018b)   which are tuned with OOD data. The values of ODIN*, Maha*, and DeConf-C* are copied from Table1of our paper which do not have any access to OOD data. All methods in this table use the same DenseNet for backbone. Note that the Mahalanobis paper(Lee et al., 2018b)  only has three OOD datasets for the table, so we only compare with those cases.

Table content: <table><tr><td>ID</td><td>OOD</td><td>AUROC</td><td>TNR@TPR95</td></tr><tr><td/><td/><td colspan="2">ODIN orig / Maha orig / ODIN* / Maha* / DeConf-C*</td></tr><tr><td/><td colspan="3">Imagenet(r) 85.2 / 97.4 / 91.1 / 96.4 / 98.6 42.6 / 86.6 / 59.4 / 82.0 / 93.3</td></tr><tr><td>CIFAR-100</td><td>LSUN(r)</td><td colspan="2">85.5 / 98.0 / 93.0 / 96.6 / 98.7 41.2 / 91.4 / 64.0 / 82.6 / 93.8</td></tr><tr><td/><td>SVHN</td><td colspan="2">93.8 / 97.2 / 85.6 / 89.9 / 95.9 70.6 / 82.5 / 35.3 / 43.3 / 77.0</td></tr><tr><td/><td colspan="3">Imagenet(r) 98.5 / 98.8 / 90.1 / 98.2 / 99.1 92.4 / 95.0 / 51.9 / 90.9 / 95.8</td></tr><tr><td>CIFAR-10</td><td>LSUN(r)</td><td colspan="2">99.2 / 99.3 / 92.9 / 98.2 / 99.4 96.2 / 97.2 / 59.2 / 91.7 / 97.6</td></tr><tr><td/><td>SVHN</td><td colspan="2">95.5 / 98.1 / 89.6 / 98.0 / 98.8 86.2 / 90.8 / 48.7 / 90.6 / 94.0</td></tr></table>



Table content: <table><tr><td>OOD</td><td>AUROC</td><td>TNR@TPR95</td></tr><tr><td/><td colspan="2">Baseline / ODIN* / Mahalanobis* / DeConf-C*</td></tr><tr><td>painting</td><td colspan="2">71.4(0.1) /62.4(0.2) /57.4(1.0) /66.7(0.2) 15.6(0.2) /5.55(0.2) /5.00(0.0) /7.40(0.5)</td></tr><tr><td>sketch</td><td colspan="2">75.8(0.1) /81.8(0.3) /63.8(0.1) /85.5(0.3) 19.7(0.5) /30.6(0.8) /8.21(0.1) /37.2(1.5)</td></tr><tr><td>clipart</td><td colspan="2">69.8(0.2) /82.6(0.1) /73.6(0.4) /85.0(0.0) 15.2(0.4) /35.3(0.5) /15.7(0.2) /41.7(0.6)</td></tr><tr><td>infograph</td><td colspan="2">77.4(0.0) /82.1(0.3) /80.4(0.8) /88.5(0.2) 18.7(0.4) /25.7(1.1) /20.5(1.0) /43.5(2.0)</td></tr><tr><td colspan="3">quickdraw 78.8(0.8) /97.6(0.1) /71.8(5.3) /97.4(0.2) 19.4(1.7) /88.4(0.8) /3.43(0.8) /87.5(1.7)</td></tr><tr><td>Uniform</td><td colspan="2">74.3(28.) /88.6(13.) /99.8(0.0) /97.0(1.1) 38.5(41.) /66.4(46.) /100.(0.0) /91.1(6.9)</td></tr><tr><td>Gaussian</td><td colspan="2">57.9(19.) /89.3(12.) /99.9(0.0) /98.1(0.1) 0.08(0.1) /66.6(47.) /100.(0.0) /99.9(0.1)</td></tr></table>

Performance of six OOD detection methods on 8 benchmark datasets. This is a full version of Table1which uses DenseNet for the backbone networks. The value in parentheses is the standard deviation.

Table content: <table><tr><td>ID</td><td>OOD</td><td>AUROC</td></tr><tr><td/><td/><td>Baseline / ODIN* / Maha* / DeConf-I* / DeConf-E* / DeConf-C*</td></tr><tr><td/><td>Imagenet(c)</td><td>79.0(2.2) /90.5(1.1) /92.4(0.3) /84.4(2.3) /95.1(0.5) /97.6(0.2)</td></tr><tr><td>CIFAR-100</td><td>Imagenet(r) LSUN(c) LSUN(r) iSUN SVHN Uniform</td><td>76.4(3.2) /91.1(1.3) /96.4(0.2) /81.2(3.6) /97.4(0.3) /98.6(0.2) 78.6(1.1) /89.9(0.5) /81.2(0.6) /91.7(0.3) /90.1(0.3) /95.3(0.4) 78.2(2.4) /93.0(0.8) /96.6(0.2) /84.1(2.1) /97.8(0.2) /98.7(0.0) 76.8(2.7) /91.6(1.1) /96.5(0.2) /82.1(2.9) /97.4(0.2) /98.4(0.0) 78.1(3.5) /85.6(0.0) /89.9(0.2) /89.7(0.4) /94.0(0.6) /95.9(0.7) 65.0(22.) /91.4(10.) /100.(0.0) /48.5(16.</td></tr></table>

Peer review (iclr2020):
Summary: This paper proposes a method for detecting out-of-distribution (OOD) data. Unlike most methods in this direction, this paper considers the scenario where a sample of out-of-distribution is not observed. Thus, the goal is detecting the out-of-distribution data using solely in-of-distribution data. First, the authors proposed to use input preprocessing similarly to ODIN (Liang et al., 2017) but the proposed scheme does not require out-of-distribution data. The way to search a parameter is different from the existing work (Liang et al., 2017). The proposed scheme looks simple and highly effective in the experiments. They also propose to decompose the learned function into two parts for making a good confidence score function. Finally, they illustrate a good performance on OOD detection using their proposed methods (combining the decomposition and preprocessing). ======================================================== Clarity: Overall, I found this paper is well-written and easy to follow. Only Section 3.1 highly concerns me on the clarity and correctness of the paper. The part that I am most concern about is the decomposed confidence, I am not sure that the argument of the proposed method about confidence decomposition is correct. If the authors can convince me that it is correct, I will consider improving the score. ======================================================== Comments: On the claim of the novelty of the problem setting: This paper claims that this paper is the first study focused on a minimal setting, where I think it means the setting that we do not assume that we have OOD sample when training a model. However, there already are existing works on this issue. And it is more important to discuss them in the Related Methods section (2.1) rather than mentioning the most related works as the work that requires true OOD sample when training. I read the discussion in the comment section on how the authors tried to state the reason why they think it is novel, but I think it is not sufficient. It is the freedom to choose how to solve this problem, e.g., one may try to construct pseudo-OOD data from in-distribution data. But the core setting is the same, that is, OOD detection without OOD data. The authors may instead criticize that the method that generates pseudo-OOD from in-distribution may be unreliable, biased, and that*s why other methods perform better. For the discussion about Hyperparameter-free, to me, it is simply a unique feature that Techapanurak & Okatani (2019) wanted to highlight as a contribution. Thus, the author may suggest a way to criticize that paper, e.g., it*s better to tune so we can do well on the dataset we are interested in instead of saying that hyperparameter-free makes the setting different. Not only these two works I mentioned, I believe OOD detection itself has a long history and I do not think it is important to state that this paper is the first one to consider such a setting. On the confidence decomposition Section (3.1): On why the network is overconfident: In 3.1, the authors attempted to illustrate why neural networks may give an overconfident value for OOD data. I strongly agree that it is an important problem to discuss. In the example in 3.1, it is understandable that in Eq. (4), both values of numerator and denominator can be low when using OOD data. However, from my viewpoint, Eq. (4) suggests that in practice, the left-hand side of Eq. (4) can be unstable when x comes from OOD data (since the denominator can be very small, so as the numerator). And we do not have much data in that region, which makes p(y|x) estimation difficult in that region. From this logic, I think this equation does not only suggests overconfident but also it can tend to be underconfident too, especially in the semantic shift scenario. Thus this Eq. (4) does not suggest that the network tends to be overconfident but tend to have an extreme value (please correct me if I misunderstood). Therefore, it would be better to focus on discussing this issue of stability rather than giving a bit ad-hoc example 0.09/0.1 = 0.9 (overconfident). Although underconfidence can be easily handled because those data are easy to detect them as out-of-distribution. On the influence of Eq. (4) to inspire : I cannot see how will relate to the denominator of Eq. (4). It is true that is a function that is not class-specific, similarly to the denominator of Eq. (4). However, the denominator in Eq. (4) is just simply marginalized y out by taking a summation of all class-specific function. Thus, I think the only way to relate Eq. (4) to Eq. (5) is is the unnormalized version of the denominator of Eq. (4), while is an unnormalized version of the numerator. Thus, I am not convince that Eq. (4) motivates . On the input preprocessing Section (3.2): I found the method for selecting the perturbation magnitude is very interesting and this is the most thing I like about this paper. It made me convinced that input preprocessing is highly useful and impactful for tacking OOD detection without OOD data (while ODIN already suggested this fact in the context where we have OOD sample). It enhances the performance of almost all cases as we can see from Figure 2. I have a positive impression on this part. It would be nice to see the performance of Deconf-C, which is almost identical to Techapanurak & Okatani (2019) in Table 1 to highlight the improvement from this preprocessing for different OOD datasets instead of averaging them all (as Figure 2). I think it is not too difficult to modify this part to highlight a contribution of the preprocessing part (currently only Figure 2 highlights the usefulness of it). On experiments: It is also important to see a standard deviation of the results. Especially if we only run only a few times (three times in this context). If the standard deviation is high, it is highly suggested to run more times to get a reliable result. In addition, we may use a better criterion to bold a score (e.g., one-sided t-test). I also would like to know if the existing method has a higher standard deviation due to less stability when g(x) is not 1 or a constant (T) as they were in most existing approaches. Other than this point, I think the authors did a great job to visualize and show the effectiveness of decomposing a confidence score and the advantage of input preprocessing. Experiments on semantic/non-semantic shift is also interesting. ======================================================== Decision: Although this paper proposed an interesting simple yet effective way to preprocess the data combining with decomposing a confidence function into two parts, I feel that the discussion of the relationship with existing methods and the clarification of the novelty have to be improved. Also, I disagree with the explanation of decomposed confidence part, and it simply looks like a scaling factor that depends on x to me. Finally, reviewers are suggested to put a higher standard for evaluation for a paper more than 9 pages. For these reasons, in the current form, I vote to reject for this paper. If I am convinced that the discussion about decomposed confidence is valid, I will consider improving the score. ======================================================== Minor comments: 1. Does log between gradient and S exist in Eq. (7) like the paper by Liang et al., 2017 ? 2. typo: Section 4.3: We therfore -> We therefore ======================================================== On the similar work by Techapanurak & Okatani (2019): I am aware that the two works are concurrent and I still treat this part as the authors* contribution in my evaluation. In my view, both works are are highly related. I am aware that the work by Techapanurak & Okatani (2019) is also very recent (25 May 2019: arXiv) and the authors suggested it to be a concurrent work. It is also nice and I appreciate that the authors cited them. But since the authors discussed a little bit about their work, I think it is fruitful to discuss them in detail and point out the difference clearly, for example in the related work section. Here are four reasons I think why they are highly related. 1. Same setting: OOD detection without OOD data 2. The authors attempted to clarify the difference and pointed out that the proposed framework is more general than Techapanurak & Okatani (2019). However, in my view, Techapanurak & Okatani also proposed to decompose the function into two parts, where (or ) in Eq. (3) of Techapanurak & Okatani (2019) is strictly the same as in this submitted work. Even before Techapanurak & Okatani (2019), people have been using this scaling parameter to improve the class posterior estimation (perhaps s = 1/T is the most common, although it does not depend on x). For the numerator , Techapanurak & Okatani (2019) proposed to change the standard to . Although they did not write clearly that can be something other than , the fact that they changed it is straightforward to see that we are able to generalize it and try other . Thus, the novelty of the generalization of Techapanurak & Okatani (2019) that this paper suggests is modest. 3. The choice of in this paper and in Techapanurak & Okatani (2019) are almost identical. It is very slightly different in my view (not sure if it changes the performance). In this context, if I understand correctly, Techapanurak & Okatani (2019) used while this paper proposed . 4. The that works best is the proposed by Techapanurak & Okatani (2019).