Title: BAYESIAN VARIATIONAL AUTOENCODERS FOR UNSUPERVISED OUT-OF-DISTRIBUTION DETECTION Anonymous

Abstract: Despite their successes, deep neural networks still make unreliable predictions when faced with test data drawn from a distribution different to that of the training data, constituting a major problem for AI safety. While this motivated a recent surge in interest in developing methods to detect such out-of-distribution (OoD) inputs, a robust solution is still lacking. We propose a new probabilistic, unsupervised approach to this problem based on a Bayesian variational autoencoder model, which estimates a full posterior distribution over the decoder parameters using stochastic gradient Markov chain Monte Carlo, instead of fitting a point estimate. We describe how information-theoretic measures based on this posterior can then be used to detect OoD data both in input space as well as in the model's latent space. The effectiveness of our approach is empirically demonstrated.

1. INTRODUCTION:

Outlier detection in input space. While deep neural networks (DNNs) have successfully tackled complex real-world problems in various domains including vision, speech and language (Schmidhuber, 2015; LeCun et al., 2015; Goodfellow et al., 2016) , they still face significant limitations that make them unfit for safety-critical applications (Amodei et al., 2016) . One well-known shortcoming of DNNs is that when faced with test data points coming from a different distribution than the data the network was exposed to during training, the DNN will not only output wrong predictions, but it will do so with high confidence. The lack of robustness of DNNs to such out-of-distribution (OoD) inputs (or outliers/anomalies) was recently addressed by the development of various methods to detect OoD inputs. Most existing OoD detection approaches are task-specific in that they consider a certain prediction task (typically classification) and use the corresponding output labels for the supervised training of a deep discriminative model to produce the desired target output as well as some confidence score (Hendrycks & Gimpel, 2016; Hendrycks et al., 2018; Liang et al., 2017) . Alternatively, task-agnostic OoD detection methods solely use the input data for the unsupervised training of a deep generative model (DGM). One simple and seemingly sensible approach to detect a potential OoD input x * is to train a likelihood-based DGM (e.g. a VAE, auto-regressive DGM, or flow-based DGM) by (approximately) maximizing the likelihood p(D|θ) of the model parameters θ under the training data D, and to then estimate the probability p(x * |θ) that x * was generated by the model θ (Bishop, 1994): If p(x * |θ) is large, then x * must be in-distribution, and OoD otherwise. However, recent works have shown that this likelihood-based approach does not work in general, as deep generative models sometimes assign higher probability to OoD data than to in-distribution data (Nalisnick et al., 2018; Choi & Jang, 2018) . Motivated by this finding, recent works have tried to develop more effective scores by correcting the likelihood estimate (Choi & Jang, 2018; Ren et al., 2019; Nalisnick et al., 2019) . However, while these approaches improve upon the likelihood score, we argue that OoD detection scores which are fundamentally based on the likelihood values are not robust, as the likelihood estimates produced by commonly used DGMs are not reliable for OoD data, similar to how deep discriminative models produce unreliable output predictions on OoD data.

Outlier detection in latent space. In a distinct line of research, recent works have tackled the challenge of efficiently optimizing a complex black-box function f : X → R, f (x) = y defined over high-dimensional, richly structured input domains X (e.g. graphs, images or text). Given examples D = {(x i , y i )} N i=1 , these methods jointly train a VAE on inputs x and a predictive model g : Z → R, g(z) = y mapping from latent codes z to targets y, to then perform the optimization w.r.t. y in the low-dimensional, continuous latent space Z instead of in input space X (Gómez-Bombarelli et al., 2018) . While these approaches have achieved state-of-the-art results in important domains including automatic chemical design and automatic machine learning (Gómez-Bombarelli et al., 2018; Luo et al., 2018; Lu et al., 2018) , their practical effectiveness is limited by their ability to handle the following trade-off: They need to find inputs x that both have a high target value y and are sufficiently novel (i.e., not too close to inputs in the training data D), while at the same time ensuring that the optimization w.r.t. y does not progress into regions of the latent space Z too far away from the training data, which might yield latent points z that decode to semantically meaningless and/or syntactically invalid inputs x (Kusner et al., 2017; Griffiths & Hernández-Lobato, 2017; Brookes et al., 2019; Mahmood & Hernández-Lobato, 2019; Alperstein et al., 2019) . We observe that the required ability to quantify the semantic/syntactic distance of latent codes z to the training data directly corresponds to the ability to detect outliers in latent space Z.

Our approach. In this work, we propose a principled, unsupervised, probabilistic method to simultaneously tackle the challenge of detecting outliers x * in input space X (without directly relying on likelihood estimates) as well as outliers z * in latent space Z. To this end, we take an informationtheoretic perspective on OoD detection, and propose to use the (expected) informativeness of an input x * / latent z * as a proxy for whether x * / z * is OoD or not. To quantify this informativeness, we take inspiration from information-theoretic active learning (MacKay, 1992) and leverage probabilistic inference techniques to maintain a posterior distribution over the parameters of a deep generative model, in particular of a variational autoencoder (VAE) (Kingma & Welling, 2013; Rezende et al., 2014) . This results in a Bayesian VAE (BVAE) model, where instead of fitting a point estimate of the decoder parameters via maximum likelihood, we estimate their posterior distribution using samples generated via stochastic gradient Markov chain Monte Carlo (MCMC). The informativeness of an unobserved input x * / latent z * is then quantified by measuring the (expected) change in the posterior over model parameters after having observed x * / z * . In summary, our contributions are as follows: (a) We propose a Bayesian VAE model which uses state-of-the-art Bayesian inference techniques to estimate a posterior distribution over the decoder parameters (Section 3.2). (b) We describe how this model can be used to detect outliers both in input space (Section 3.3) as well as in the model's latent space (Section 3.4) using information-theoretic metrics. (c) We empirically demonstrate that our approach outperforms state-of-the-art outlier detection methods (Section 5).

2. BACKGROUND:

2.1 VARIATIONAL AUTOENCODERS Consider a latent-variable model p(x, z|θ) with marginal likelihood p(x|θ) = p(x, z|θ)dz, where x are observed variables, z are local latent variables (i.e., individually tied to some x), and θ are global latent variables (i.e., shared among all x).1 For clarity, we will mostly refer to z simply as latent variables (i.e., without the prefix local), and to θ as model/decoder parameters. We assume that p(x, z|θ) = p(x|z, θ)p(z), i.e., the joint density p(x, z|θ) factorizes into a prior distribution p(z) on the local latent variables z and a parameterized likelihood p(x|z, θ) of the observed variables x given z. We furthermore assume the z to be continuous, such that computing p(x|θ) in generally intractable. Such a model is called a variational autoencoder (VAE) (Kingma & Welling, 2013; Rezende et al., 2014) if θ are the parameters of a deep neural network, and the corresponding intractable posterior distribution p(z|x, θ) over the latent variables z is approximated using amortized variational inference via another deep neural network q(z|x, φ) parameterized by φ (typically called the encoder, inference network or recognition network). Given some dataset D = {x i } N i=1 of N input vectors x i ∈ X drawn i.i.d. from some underlying data distribution p * (x), the parameters θ and φ of a VAE are then learned by maximizing the evidence lower bound (ELBO) L θ,φ , which is a lower bound to the marginal log-likelihood log p(x|θ), i.e.,

EQUATION

for some input x ∈ D. By independence, L θ,φ (D) = x∈D L θ,φ (x). Since maximizing the ELBO approximately maximizes log p(D|θ), this training procedure can be viewed as approximate max-imum likelihood estimation (MLE). In practice, L θ,φ (x) in Eq. ( 1) is maximized by mini-batch stochastic gradient-based optimization using low-variance, unbiased, stochastic Monte Carlo estimators of ∇L θ,φ obtained via the reparametrization trick. Finally, one can approximate the probability p(x|θ, φ) of a data point x under the generative model via importance sampling w.r.t. the variational posterior q(z|x, φ), i.e., p(x|θ, φ) = E q(z|x,φ) p(x|z, θ)p(z) q(z|x, φ)

EQUATION

Note that the likelihood p(x|θ, φ) in Eq. ( 2) is conditioned on both θ and φ, to make explicit the dependence on the parameters φ of the proposal distribution q(z|x, φ). 

2.2. BAYESIAN LEARNING IN NEURAL NETWORKS VIA STOCHASTIC GRADIENT MCMC:

EQUATION

3 BAYESIAN VARIATIONAL AUTOENCODERS FOR OOD DETECTION

3.1. MOTIVATION AND INTUITION:

We take the following information-theoretic perspective on OoD detection. Consider an active learning scenario, where we have computed an estimate of our model parameters θ based on some observations D, and want to add an unobserved input x * to the training set D to improve our estimate of θ as much as possible. To this end, in information-theoretic active learning (MacKay, 1992), it is observed that every potential input x * contains a certain amount of information about the values of the model parameters. In other words, every data point x * helps us to some extent in updating our model parameters to find the optimal ones which capture the true underlying data-generating process. Now, we argue that inputs which are uninformative about the model parameters are likely similar to the data points already in the training set D, i.e., they are likely in-distribution inputs.

In contrast, inputs which are very informative about the model parameters are likely different from everything we have seen so far in the training data D, i.e., they are likely OoD inputs. We thus propose to use the informativeness of a datum x * as a proxy for whether x * is OoD or not. To quantify this informativeness, information-theoretic active learning approaches leverage probabilistic inference techniques to maintain a posterior distribution p(θ|D) over model parameters θ given data D (i.e., instead of fitting a point estimate of θ via maximum likelihood estimation). Given this posterior p(θ|D), the informativeness of an unobserved datum x * is then quantified by measuring the (expected) change in the posterior after having observed x * , i.e., the change required to update p(θ|D) to the posterior p(θ|D ∪ {x * }). We follow this approach and propose to use a Bayesian VAE (BVAE) model, where instead of fitting a point estimate of the parameters via maximum likelihood, we estimate their posterior distribution using samples generated via stochastic gradient MCMC.

3.2. THE BAYESIAN VAE (BVAE):

In contrast to an ordinary VAE, where we fit the generative model parameters θ via (approximate) MLE, i.e., θ MLE = arg max θ L(D) θ,φ , to obtain the likelihood p(x|z, θ MLE ), we place a prior p(θ) over θ and estimate its full posterior distribution p(θ|D) ∝ p(D|θ)p(θ), to induce the generator likelihood p(x|z, D) = p(x|z, θ)p(θ|D)dθ = E p(θ|D) [p(x|z, θ) ]. This induces the marginal likelihood

EQUATION

which marginalizes over both the local latent variables z and the global latent variables θ. The generative process defined in Eq. ( 4) first draws a latent vector z ∼ p(z) from its prior and a decoder parameterization θ ∼ p(θ|D) from its posterior, and then generates x ∼ p(x|z, θ) by passing both through the likelihood. Training this model now involves performing Bayesian inference over both z and θ, resulting in the posterior p(z|x, D) over z and the posterior p(θ|D) ∝ p(D|θ)p(θ) over θ. Since both posteriors are intractable for the model we consider, we will now discuss how to approximate inference over z and θ, respectively.

3.2.1. INFERENCE OVER THE LATENT VARIABLES z:

To estimate the posterior p(z|x, D) over z, we follow an ordinary VAE and resort to amortized variational inference via a recognition network q(z|x, φ) with variational parameters φ, using the ELBO L θ,φ (x) ≤ log p(x|θ) in Eq. ( 1). We learn the encoder parameters φ via approximate MLE, using a low-variance, unbiased Monte Carlo estimator of the stochastic gradient ∇ φ L θ,φ (x), i.e.,

EQUATION

where the posterior samples z l ∼ q(z|x, φ) are generated using the reparametrization trick.

3.2.2. INFERENCE OVER THE MODEL PARAMETERS θ:

To generate posterior samples θ ∼ p(θ|D) of decoder parameters (e.g. as required to approximate the gradient ∇ φ L φ (x) in Eq. ( 5)), we propose to use SGHMC (cf. Section 2). However, the gradient of the energy function ∇ θ U (θ, M) in Eq. ( 3) used for simulating the Hamiltonian dynamics requires us to evaluate the log-likelihood log p(x|θ), which is intractable in a VAE and thus also in our model. To alleviate this issue, we approximate the log-likelihood appearing in ∇ θ U (θ, M) by the ELBO L θ,φ (x) of an ordinary VAE in Eq. (1). Given a set Θ = {θ m } M m=1 of posterior samples θ m ∼ p(θ|D), we can more intuitively think of working with a finite mixture/ensemble of decoders/generative models p(x|z, 4)).

D) = E p(θ|D) [p(x|z, θ)] 1 M θ∈Θ p(x|z, θ) (cf. Eq. (

3.2.3. INFERENCE OVER THE VARIATIONAL PARAMETERS φ:

Recall that the goal of amortized variational inference is to learn how to do posterior inference, by finding the optimal parameters φ MLE = arg max φ L(D) θ,φ (cf. Eq. ( 1)) of an inference network i : X → Ψ : i φ (x) = ψ mapping inputs x to parameters ψ of the variational posterior q ψ (z) = q(z|x, φ) over z. However, one fundamental shortcoming of fitting an inference network via MLE is that the model q(z|x, φ MLE ) will not generalize to OoD inputs, but instead produce confidently wrong posterior inferences for OoD inputs. To alleviate this issue, we refrain from fitting a point estimate φ MLE , and instead consider a Bayesian treatment of the variational parameters φ (i.e., in addition to the Bayesian treatment of the decoder parameters θ discussed earlier). While this might seem strange conceptually, it allows us to quantify our epistemic uncertainty in the amortized inference of z, intuitively increasing the flexibility of the recognition network. We thus also place a prior p(φ) over φ and infer the posterior p(φ|D) ∝ p(D|φ)p(φ), yielding the amortized posterior

q(z|x, D) = q(z|x, φ)p(φ|D)dφ = E p(φ|D) [q(z|x, φ)] 1 M M j=1 q(z|x, φ j ), φ j ∼ p(φ|D) . (6)

We also use SGHMC to generate the posterior samples φ j ∼ p(φ|D), again approximating the loglikelihood log p(x|φ, D) in ∇ φ U (φ, M) (cf. Eq. ( 3)) by the ELBO L θ,φ (x) in Eq. (1). Given a set Φ = {φ j } M j=1 of posterior samples φ j ∼ p(φ|D), we can again more intuitively think of Eq. ( 6) as defining a finite mixture/ensemble of inference networks q(z|x, D)

1 M φ∈Φ q(z|x, φ).

Inference over θ revisited. When doing inference over both φ and θ, we need to slightly adapt the SGHMC sampling procedure for the decoder parameters θ ∼ p(θ|D) described in Section 3.2.2. In particular, instead of using the ELBO L θ,φ (x) of an ordinary VAE in Eq. ( 1) (which is based on the recognition network q(z|x, φ) and thus depends on both θ and φ), we now need to use the ELBO

EQUATION

which depends on θ only, as it is based on the encoder mixture q(z|x, D) in Eq. ( 6) and thus integrates the variational parameters φ over their posterior p(φ|D). We then obtain an approximation to the stochastic gradient ∇ θ U (θ, M) in Eq. ( 3) by using a Monte Carlo approximation of the gradient ∇ θ L θ (x) of the ELBO in Eq. ( 7), i.e.,

EQUATION

The z l ∼ q(z|x, D) are sampled from the encoder mixture in Eq. ( 6) by first sampling the index of the mixture component uniformly at random, i.e., j ∼ U[1, M ] (due to the mixture weights all being 1/M ), and then sampling the latent vector z l from the j-th mixture component, i.e., z l ∼ q(z|x, φ j ).

3.3. DETECTING OUTLIERS IN INPUT SPACE:

Training a BVAE (see Appendix B for pseudocode) yields the sets Φ = {φ j } M j=1 and Θ = {θ m } M m=1 of posterior samples φ j ∼ p(φ|D) and θ m ∼ p(θ|D) of encoder and decoder parameters, respectively. Given these samples, we follow ideas from information-theoretic active learning (MacKay, 1992) (cf. Section 1) and aim to detect if a certain test input x * is OoD based on its informativeness about the model parameters θ, as measured by the change in the posterior distribution over θ after having observed x * . In particular, assume that given some data D and prior p(θ), we have inferred the posterior p(θ|D) = p(D|θ)p(θ) p(D|θ)p(θ)dθ = p(D|θ) p(D) p(θ) over θ. In a sequential Bayesian setting, the posterior p(θ|D) then serves as the new prior, which, given a new observation x * , is updated to the posterior p(θ|D

∪ {x * }) = p(x * |θ)p(θ|D) p(x * |θ)p(θ|D)dθ = p(x * |θ) p(x * |D) p(θ|D), i.e.

, by multiplying p(θ|D) by the normalized likelihood p(x * |θ) p(x * |D) . The intuition now is as follows: If x * is very different from the previous observations in D, then the updated posterior p(θ|D ∪ {x * }) will likely be different from p(θ|D), to capture the atypicality of x * . In contrast, if x * is very similar to the observations in D, then the posterior p(θ|D ∪ {x * }) will also be similar to the previous one p(θ|D). Thus, to detect whether x * is OoD or not, we aim to quantify the change from p(θ|D) to p(θ|D ∪ {x * }), which is captured by the factor p(x * |θ) p(x * |D) . Since in our case, the posterior p(θ|D) is represented by the finite set of samples Θ, we find ourselves in a sequential Monte Carlo (or particle filtering) setting, such that for a given parameter/particle θ and input x * , the normalized likelihood p(x * |θ) p(x * |D) can be written as

EQUATION

where w θ ∈ [0, 1] and θ∈Θ w θ = 1. The scalar w θ defined in Eq. ( 9) can be interpreted as the probability that x * was generated from the particle θ, thus measuring how well x * is explained by the model θ (and thus how useful θ is for describing the updated posterior p(θ|D∪{x * })), relative to the other particles. More formally, the values [w θ ] θ∈Θ correspond to the importance weights of the samples/particles θ ∈ Θ drawn from the proposal distribution p(θ|D) (i.e., the previous posterior) for an importance sampling-based Monte Carlo approximation of an expectation w.r.t. the target distribution p(θ|D ∪ {x * }) (i.e., the updated posterior after having observed x * ), i.e.,

EQUATION

for some function f : Θ → R. To measure the change in distribution from p(θ|D) to p(θ|D ∪ {x * }), we can then use the weights [w θ ] θ∈Θ to compute the effective sample size (ESS)

EQUATION

The ESS(x * ) is a widely used measure for the efficiency of the estimator in Eq. ( 10), and measures how many i.i.d. samples drawn from the target posterior p(θ|D ∪ {x * }) are equivalent to the M samples θ ∈ Θ drawn from the proposal posterior p(θ|D) and weighted according to w θ . It intuitively quantifies the degree of agreement between the particles θ ∈ Θ as to how probable the input x * is, inducing the following decision rule:

If ESS(x * ) is large, then [w θ ] θ∈Θ is close to the uniform dis- tribution [ 1 M ] θ∈Θ (for which ESS(x * ) = M )

, meaning that all particles θ ∈ Θ explain x * equally well and are in agreement as to how probable x * is. Thus, x * likely is an in-distribution input. Conversely, if ESS(x * ) is small, then [w θ ] θ∈Θ contains a few large weights (i.e., corresponding to particles that by chance happen to explain the datum well), with all other weights being very small, where in the extreme case, [w θ ] θ∈Θ = [0, . . . , 0, 1, 0, . . . , 0] (for which ESS(x * ) = 1). This means that the particles do not agree as to how probable x * is, so that x * likely is an OoD input.

Finally, we discuss how to compute the likelihood p(x|θ) of the BVAE given an input x required to compute the weight w θ in Eq. ( 9). We consider two approaches based on importance sampling, with different proposal distributions for sampling the latent codes z k depending on the assumed relationship between the samples Θ of decoder parameters and the samples Φ of encoder parameters:

1. Firstly, one may treat the samples in Θ and Φ as being coupled as

(θ m , φ m ) ∈ {(θ m , φ m )} M m=1

, where each pair (θ m , φ m ) effectively defines a separate VAE. This is motivated by the fact that in practice, we for simplicity do indeed take samples of full VAEs, by simultaneously sampling from p(θ|D) and p(φ|D), as outlined in Algorithm 1 in Appendix B. Since such a coupled sample (θ m , φ m ) defines a VAE, the likelihood can then simply be computed as in a regular VAE, i.e., p(x|θ m ) = p(x|θ m , φ m ) as defined in Eq. ( 2), using the proposal distribution q(z|x, φ m ).

2. Secondly, one may decouple the samples in Θ and Φ and treat them as being independent of each other. In particular, for a given decoder sample θ m , instead of using the corresponding sample φ m as the encoder, we may view the encoder as the mixture q(z|x, D) 6) defined by all samples in Φ. The likelihood is then estimated as p(x|θ) = p(x|θ, D) with

1 M φ∈Φ q(z k |x, φ) in Eq. (

EQUATION

where the proposal distribution now is the mixture q(z|x, D) instead of q(z|x, φ). Since q(z|x, D) marginalizes over encoder parameters φ, the likelihood in Eq. ( 12) only depends on θ.

3.4. DETECTING OUTLIERS IN LATENT SPACE:

Detecting outliers in latent space involves identifying latent vectors z * which are very different from the latent vectors corresponding to the training inputs D, and which will thus yield unpredictable results when passed through the decoder to produce p(x|z * , θ). To discriminate if a given latent vector z * is an outlier or not, we follow the same approach as in Section 3.3 and quantify the informativeness of z * on the model parameters θ by measuring the change in the posterior p(θ|D). However, quantifying this change in posterior by e.g. computing the ESS metric in Eq. ( 11) requires evaluating the likelihood p(x * |θ) of the input x * corresponding to the latent code z * , which is not available to us. We thus alternatively quantify the expected change in the posterior p(θ|D) by computing the expected ESS, by averaging over the likelihood mixture p(x|z * , D) (cf. Section 3.2), thus effectively taking into account all possible inputs x * corresponding to z * , i.e.,

ESS Θ (z * ) = E p(x|z * ,D) [ESS Θ (x)] (11) 1 N N n=1 θ∈Θ p(x n |z * , θ) 2 θ∈Θ p(x n |z * , θ) 2 , x n ∼ p(x|z * , D) (13)

where the inputs x n are sampled from the decoder mixture p(x|z * , D) by first sampling the index of the mixture component uniformly at random, i.e., m ∼ U[1, M ] (due to the mixture weights all being 1/M ), and then sampling x n from the m-th mixture component, i.e., x n ∼ p(x|z * , θ m ).

In contrast to computing the ESS in Eq. ( 11) for outlier detection in input space, where we had to estimate the likelihoods via importance sampling using the (mixture of) inference network(s), computing the likelihoods p(x n |z * , θ) in Eq. ( 13) simply involves passing the given latent code z * through the decoders parameterized by θ ∈ Θ. In fact, the encoding part of the model is not required for outlier detection in latent space. If we are only interested in outlier detection in latent space, we thus do not face any of the issues arising from the recognition network making wrong inferences for OoD inputs, and as a result do not require a Bayesian treatment of the encoder parameters φ.

4. RELATED WORK:

Supervised/Discriminative outlier detection methods Most existing OoD detection approaches are task-specific and designed for the context of a certain prediction task. As described in Section 1, these approaches train a deep discriminative model in a supervised fashion using the given labels.

To detect outliers w.r.t. the target task, many approaches then rely on a confidence score to decide on the reliability of the prediction, which is either produced by modifying the model and/or training procedure, or computed/extracted post-hoc from the model and/or predictions (DeVries & Taylor, 2018; An & Cho, 2015; Sölch et al., 2016; Ahmed & Courville, 2019; Sricharan & Srivastava, 2018; Hendrycks & Gimpel, 2016; Hendrycks et al., 2018; Liang et al., 2017; Shafaei et al., 2018) . Alternatively, one can use predictive uncertainty estimates for OoD detection (Malinin & Gales, 2018; Gal & Ghahramani, 2016; Lakshminarayanan et al., 2017; Osawa et al., 2019; Ovadia et al., 2019) . One drawback of such task-specific approaches is that discriminatively trained models by design discard all input features which are not informative about the specific prediction task, such that information which is relevant for OoD detection might be lost.

Unsupervised/Generative outlier detection methods In contrast, task-agnostic OoD detection methods solely use the input data for the unsupervised training of a deep generative model, which makes them more general, as they do not require the availability of labels for some prediction task. Moreover, these approaches capture the entire input data distribution via the generative model, which might be beneficial for OoD detection (it was shown that despite not exploiting label information, unsupervised approaches often work better in practice (Ren et al., 2019) ). Perhaps closest to our approach is the recent work by Choi & Jang (2018) The WAIC provides an asymptotically correct estimate between the training and test set expectations (assuming a fixed underlying data distribution) and can be viewed as a corrected log-likelihood score which penalizes points x with a large variance in log-likelihoods. Their approach has two shortcomings as compared to ours: Firstly, while we use stochastic gradient MCMC on a single model to obtain M approximate posterior samples, they train M independent models to form an ensemble, which (a) is not a principled way of doing approximate Bayesian inference (although connections can be made (Mandt et al., 2017) under certain conditions), and (b) is M times more computationally expensive in practice. Secondly, independent of the quality of the posterior approximation, their score is not expected to work well, since it still relies on the suboptimal log-likelihood estimates (as we will demonstrate in the experiments). Another recent unsupervised approach is the likelihood ratio method by Ren et al. (2019) 

5. EXPERIMENTS:

We now present some experimental results showing the competitiveness of our approach. 2016) and use Gaussian priors over θ and φ, i.e., p(θ) = N (0, λ -1 θ ) and p(φ) = N (0, λ -1 φ ). We also place Gamma hyperpriors over the precision parameters λ θ and λ φ , i.e., p(λ θ ) = Γ(α θ , β θ ) and p(λ φ ) = Γ(α φ , β φ ), with α θ = β θ = α φ = β φ = 1, and resample λ θ and λ φ after every training epoch (i.e., after an entire pass over D). We also follow the previous work and use a step size of 10 -3 and momentum decay of 0.05 for SGHMC. We discard samples within a burn-in phase of B = 1 epoch, and store a sample (of both encoder and decoder parameters) after every D = 1 epoch. We only keep the 10 most recent samples to represent the posterior. In addition to the BVAE described in Section 3.2 which uses the two ELBOs L θ,φ in Eq. ( 1) and L θ in Eq. ( 7) to train/sample from φ and θ, respectively (denoted by BVAE), we also report results on the following variants: a BVAE that uses the ordinary VAE ELBO in Eq. ( 1) for both φ and θ ( BVAE; see Appendix C for pseudocode) and a VAE where only θ is integrated out and φ is estimated via maximum likelihood (BVAE θ ). We furthermore consider both alternative ways of estimating the log-likelihoods for computing the ESS (cf. Section 3.3), i.e., the case where log-likelihoods are computed using samples Φ of encoders and Θ of decoders that are treated as independent (ESS), and the case where the log-likelihoods are computed using coupled samples {(φ j , θ j )} M j=1 (ESS θ φ ).

5.1. OUT-OF-DISTRIBUTION:

Experimental setup. We use two benchmarks: (a) FashionMNIST (in-distribution) vs. MNIST (OoD) (Hendrycks et al., 2018; Nalisnick et al., 2018; Ren et al., 2019; Zenati et al., 2018; Akcay et al., 2018) , and (b) eight classes of FashionMNIST (in-distribution) vs. the remaining two classes (OoD), using five different splits {(0, 1), (2, 3), (4, 5), (6, 7), (8, 9)} of held-out classes (Ahmed & Courville, 2019) . We compare against the log-likelihood (LL) as well as three state-of-the-art methods for unsupervised OoD detection (all described in Section 4): (1) The generative ensemble based method by Choi & Jang (2018) composed of five independently trained models (WAIC), ( 2) the likelihood ratio method by Ren et al. (2019) (LLR), using Bernoulli rates µ = 0.2 for the Fashion-MNIST vs. MNIST experiment (Ren et al., 2019) , and µ = 0.15 for the other experiment, and (3) the test for typicality by Nalisnick et al. (2019) (TT) . All methods use VAEs for the log-likelihood estimation. 3 They are evaluated by randomly selecting 5000 in-distribution and OoD inputs from held-out test sets and computing the following threshold independent metrics (Hendrycks & Gimpel, 2016; Liang et al., 2017; Hendrycks et al., 2018; Alemi et al., 2018; Ren et al., 2019) : (i) The area under the ROC curve (AUROC↑), (ii) the area under the precision-recall curve (AUPRC↑), and (iii) the false-positive rate at 80% true-positive rate (FPR80↓).

Results. Table 1 shows that our approaches generally perform better on the considered benchmarks. Coupling the encoder and decoder samples appears beneficial, which might be due to the fact that we actually take the samples in couples after every epoch. Being Bayesian about the encoder parameters φ also seems to help. Fig. 2 show the precision-recall and ROC curves used to compute the metrics, for the FashionMNIST vs. MNIST experiment (see Appendix E for the curves for the other experiment). Fig. 1 shows histograms of the log-likelihoods (left) and of the BVAE-ESS scores (right) on FashionMNIST in-distribution (blue) vs. MNIST OoD (orange) test data. While the log-likelihoods strongly overlap, the ESS scores more clearly separate in-distribution data (closer to ESS = 10 on the r.h.s.) from OoD data (closer to ESS = 1 on the l.h.s.).

5.2. OUT-OF-DISTRIBUTION DETECTION IN LATENT SPACE:

While input space OoD detection is a well-studied problem, OoD detection in latent space was only recently identified as an important open problem (Gómez-Bombarelli et al., 2018; Griffiths & Hernández-Lobato, 2017; Mahmood & Hernández-Lobato, 2019; Alperstein et al., 2019) (see also Section 1). Thus, there is a lack of suitable experimental benchmarks, making a quantitative evaluation challenging. A major issue in designing toy benchmarks based on commonly-used datasets such as MNIST or FashionMNIST (i.e., as typically used for assessing input space OoD detection) is that it is not clear how to obtain ground truth labels for which latent points are OoD and which are not, as we require OoD labels for all possible latent vectors z * ∈ R d , not just for those corresponding to inputs x * from some training or test set. As a first step to facilitate a systematic empirical evaluation of latent space OoD detection techniques, we propose the following experimental protocol.

We use the BVAE variant where only θ is integrated out and φ is estimated via maximum likelihood (denoted by BVAE θ in Section 5.1, using the same prior and hyperprior as described there). We 2019) (we use b = 10000). Since there does not exist a ground truth label for whether a given latent point z * is OoD or not, we instead compute some OoD proxy score (to be detailed below) for each of the N latent test vectors and then simply define the N/2 latents with the lowest scores to be in-distribution, and the N/2 latents with the highest scores to be OoD.

For this OoD score, we propose to train an ensemble of J convolutional neural network classifiers with parameters W = {w j } J j=1 on FashionMNIST (Lakshminarayanan et al., 2017) . We then approximate the mutual information score4 proposed by Houlsby et al. (2011) N x∈D q(z|x, φ), i.e., a uniform mixture of N Gaussians in our case (qz)5 (Mahmood & Hernández-Lobato, 2019) . Fig. 3 shows that our proposed method significantly outperforms the two baselines on this benchmark task. 

6. CONCLUSION:

We proposed a new approach to unsupervised out-of-distribution detection in input space as well as in latent space, using information-theoretic metrics based on the approximated posterior over the parameters of a variational autoencoder. For future work, we are keen to explore extensions of our approach to (i) state-of-the-art VAE architectures (e.g., using more sophisticated posteriors (Rezende & Mohamed, 2015) , priors (Tomczak & Welling, 2017; Papamakarios et al., 2017; Bauer & Mnih, 2019) , decoders, etc., which is all complementary); (ii) use alternative lower bounds to the marginal log-likelihood, such as the importance weighted lower bound used in an IWAE (Burda et al., 2015) , or combinations of the VAE and IWAE lower bounds, as proposed in (Rainforth et al., 2018) ; (iii) alternative approximate inference techniques for estimating the posterior distribution over model parameters; (iv) other likelihood-based deep generative models (e.g., flow-based and auto-regressive deep generative models); (v) exploit label information (e.g., by using a hybrid model combining our BVAE with a predictive model, to enable semi-supervised OoD detection).

A SVHN VS. CIFAR10 RESULTS FOR OOD DETECTION IN INPUT SPACE:

We performed additional experiments on OoD detection in input space on the higher-dimensional SVHN (in-distribution) vs. CIFAR10 (OoD) benchmark 6 (Hendrycks et al., 2018; Nalisnick et al., 2019; Choi & Jang, 2018) , following the same experimental protocol as described in Section 5.1. Looking at Table 2 and Fig. 5 , we arrive at the same conclusion as with the benchmarks considered in Section 5.1 in that our approaches appear to significantly outperform the baselines we compare against. While the variants BVAE-ESS and BVAE-ESS θ φ are not as strong as the other BVAE-ESS variants on this benchmark (as compared to the benchmarks considered in Section 3.3), they still outperform the other baselines. The histograms in Fig. 4 again show that the BVAE-ESS scores (right) more clearly separate in-distribution data from OoD data than the log-likelihood scores (left). 6 Interestingly, following the implementation details provided in Nalisnick et al. (2019) , we were not quite able to reproduce their results. In particular, our experiments yielded better calibrated log-likelihood scores for the benchmark CIFAR10 (in-distribution) vs. SVHN (OoD) than theirs (i.e., our VAE model assigned lower likelihood to most of the SVHN OoD data than to the CIFAR10 in-distribution data, as desired); this phenomenon requires further investigation. For this reason, we instead chose the opposite benchmark, i.e., SVHN (in-distribution) vs. CIFAR10 (OoD), for which the likelihood scores largely overlap, as shown in Fig. 4 (left). 

b = |D| |M| for t = 1, . . . , T do Set φ0 = φ t-1 , θ0 = θ t-1 for b = 1, . . . , N b do Sample minibatch M ∼ D Set Θ * = { θb-1 } if t ≤ B else Θ * = Θ Set Φ * = { φb-1 } if t ≤ B else Φ * = Φ Compute ∇ φ Ũ ( φb-1 , Θ * , M), update φb-1 → φb via SGHMC Compute ∇ θ Ũ ( θb-1 , Φ * , M), update θb-1 → θb via SGHMC end for Set φ t = φN b , θ t = θN b if t ≥ B and (t -B) mod D = 0 then Add Φ = Φ ∪ {φ t } and Θ = Θ ∪ {θ t } end if end for Output: Posterior samples Φ and Θ ∇ φ Ũ ( φb-1 , Θ * , M) and ∇ θ Ũ ( θb-1 , Φ * , M

) are approximations to the stochastic gradient in Eq. ( 3) required for the SGHMC updates, defined as

EQUATION

with ELBO gradient ∇ φ L φb-1 (x) as in Eq. ( 5), and

EQUATION

with ELBO gradient ∇ θ L θb-1 (x) as in Eq. ( 8). 

C PSEUDOCODE OF ALTERNATIVE BVAE:

EQUATION

with the standard VAE ELBO as in Eq. ( 1), i.e., L θb-1 , φb-1 (x) = E q(z|x, φb-1 ) [log p(x|z, θb-1 )] -D KL (q(z|x, φb-1 ) p(z)) .

D NUMERICALLY STABLE IMPLEMENTATION OF THE ESS SCORE:

For numerical stability, we in practice always work with log-probabilities (since raw probabilities may get arbitrarily close to and thus be rounded to zero). I.e., instead of directly computing p(x|θ) in Eq. ( 12) based on the probabilities p(x|z, θ), p(z) and q(z|x, φ), we compute log p(x|θ) based on the respective log-probabilities log p(x|z, θ), log p(z) and log q(z|x, φ) as follows:

log p(x|θ) log 1 K K k=1 p(x|z k , θ)p(z k ) 1 M φ∈Φ q(z k |x, φ) = log 1 K K k=1 exp log p(x|z k , θ)p(z k ) 1 M φ∈Φ q(z k |x, φ) = logmeanexp z k log p(x|z k , θ)p(z k ) 1 M φ∈Φ q(z k |x, φ) = logmeanexp z k log exp(log(p(x|z k , θ)p(z k ))) exp(log( 1 M φ∈Φ exp(log p(z k |x, φ)))) = logmeanexp z k log exp(log p(x|z k , θ) + log p(z k )) exp(logmeanexp φ (log p(z k |x, φ))) = logmeanexp z k log p(x|z k , θ) + log p(z k ) -logmeanexp φ (log p(z k |x, φ))

where z k ∼ q(z|x, D), where the last equality uses log exp(a) exp(b) = log(exp(a -b)) = a -b, and where logmeanexp is a variant of the commonly used numerically stable logsumexp function which computes the mean instead of the sum.

We thus obtain the vector p = [p θ ] θ∈Θ = [log p(x|θ)] θ∈Θ of log-likelihoods, which we can then use to compute the vector w = [w θ ] θ∈Θ of weights w θ in Eq. ( 9) by passing p through the numerically stable softmax function, i.e., 

:

Note that most literature on VAEs includes the parameters θ as a subscript, e.g., p θ (x, z), assuming a fixed point estimate θMLE of θ, i.e., p θ MLE (x, z) = p(x, z|θ = θMLE). We instead use the notation p(x, z|θ) to make explicit that we assume θ to be a random variable governed by some distribution (to be detailed in Section 3).

We use their implementation of the SGHMC sampler as a PyTorch Optimizer (https:// github.com/automl/pybnn), thus serving as a drop-in replacement for an optimizer such as SGD.

The architecture of the deconvolutional VAE we use and the training protocol follows previous work(Nalisnick et al., 2018;Choi & Jang, 2018;Ren et al., 2019). We use the Adam optimizer(Kingma & Ba, 2014) with learning rate 10 -3 for all maximum likelihood fits of parameters.

This score is closely related to the disagreement score w∈W DKL(p(y|x * , w) p(y|x * , D)) proposed by Lakshminarayanan et al. (2017) for ensemble-based OoD detection, which could be used alternatively.

For efficiency, we only consider the 100 nearest neighbors (found by a 100-NN model) of a latent test point z * for computing this log-probability(Mahmood & Hernández-Lobato, 2019).

Figures and Tables:

Figure 1: Histograms of LL (left) and BVAE-ESS θ φ (right) on FashionMNIST (in-distribution) and MNIST (out-of-distribution). The ESS score separates the data more clearly than the LL score.

Figure 2: (Left) Precision-recall curves (treating OoD data as the upper class) and (right) ROC curves of all methods on the FashionMNIST vs. MNIST benchmark.

, i.e., I(w, y|x * , D) = H(p(y|x * , D)) -E p(w|D) [H(p(y|x * , w))], where E p(w|D) [H(p(y|x * , w))] 1 J w∈W H(p(y|x * , w)) is the average entropy of the predictive class distribution of the classifier with parameters w, and H(p(y|x * , D)) H w∈W p(y|x * , w) is the entropy of the mixture 1 J w∈W p(y|x * , w) of categorical distributions p(y|x * , w) (which is again categorical with averaged probits). Note that this score requires a test input x * . Since in our setting, we only know the latent code z * corresponding to x * , we instead use the expected mutual information under the mixture decoding distribution p(x|z * , D) defined by the decoder ensemble Θ, i.e., E p(x|z * ,D) [I(w, y|x, D)] 1 N N n=1 I(w, y|x n , D) where x n ∼ p(x|z * , D). In practice, we use an ensemble of J = 5 classifiers and N = 32 input samples for the expectation. We compare the expected ESS (see Section 3.4, with N = 32) against two baselines: (a) The distance of z * ∈ R d to the spherical annulus of radius √ d -1, since that is where most probability mass lies under our prior N (0, I d ) (Annulus) (Alperstein et al., 2019). (b) the log-probability of z * under the training data distribution in latent space q(z) = 1

Figure 3: (Left) Precision-recall curves (treating OoD data as the upper class) and (right) ROC curves of all methods on the FashionMNIST based latent space OoD detection benchmark.

Figure 4: Histograms of LL (left) and BVAE-ESS (right) on SVHN (in-distribution) and CIFAR10 (out-of-distribution). The ESS score separates the data more clearly than the LL score.

Figure 5: (Left) Precision-recall curves (treating OoD data as the upper class) and (right) ROC curves of all methods on the SVHN vs. CIFAR10 benchmark. Algorithm 1 Bayesian VAE Training Input: Dataset D, generative model p(x, z, θ), inference model q(z|x, φ), burn-in length B, sample distance D, mini-batch size |M| Initialize φ 0 , θ 0 and Φ = ∅, Θ = ∅ Define number of mini-batches per epoch N b = |D|

θ -p * ) θ∈Θ exp(p θ -p * ) = softmax(p -p * ) θ(18)where p * = max(p) = max{log p(x|θ)|θ ∈ Θ} is the largest log-likelihood value across all θ ∈ Θ.E PRECISION-ROC AND PR CURVES FOR FASHIONMNIST (

Figure 6: (Left) Precision-recall curves and (right) ROC curves of all methods on the FashionMNIST (held-out classes) benchmark with classes 0 and 1 held-out.

Figure 7: (Left) Precision-recall curves and (right) ROC curves of all methods on the FashionMNIST (held-out classes) benchmark with classes 2 and 3 held-out.

Figure 10: (Left) Precision-recall curves and (right) ROC curves of all methods on the FashionM-NIST (held-out classes) benchmark with classes 8 and 9 held-out.

AUROC↑, AUPRC↑, and FPR80↓ scores (where higher ↑ or lower ↓ is better) of the baselines (top) and our methods (bottom). For the experiment on FashionMNIST with with held-out classes, we report the mean scores over all five class splits.

Table content: <table><tr><td/><td colspan="3">FashionMNIST vs MNIST</td><td colspan="3">FashionMNIST (held-out)</td></tr><tr><td/><td colspan="6">AUROC↑ AUPRC↑ FPR80↓ AUROC↑ AUPRC↑ FPR80↓</td></tr><tr><td>LL</td><td>0.557</td><td>0.564</td><td>0.703</td><td>0.565</td><td>0.577</td><td>0.683</td></tr><tr><td>WAIC</td><td>0.541</td><td>0.548</td><td>0.798</td><td>0.446</td><td>0.464</td><td>0.827</td></tr><tr><td>LLR</td><td>0.617</td><td>0.613</td><td>0.638</td><td>0.560</td><td>0.569</td><td>0.698</td></tr><tr><td>TT</td><td>0.482</td><td>0.502</td><td>0.833</td><td>0.482</td><td>0.496</td><td>0.806</td></tr><tr><td>BVAE-ESS</td><td>0.842</td><td>0.830</td><td>0.245</td><td>0.660</td><td>0.650</td><td>0.577</td></tr><tr><td>BVAE-ESS θ φ</td><td>0.871</td><td>0.855</td><td>0.190</td><td>0.697</td><td>0.681</td><td>0.534</td></tr><tr><td>BVAE-ESS</td><td>0.897</td><td>0.893</td><td>0.149</td><td>0.672</td><td>0.659</td><td>0.562</td></tr><tr><td>BVAE-ESS θ φ</td><td>0.921</td><td>0.907</td><td>0.082</td><td>0.683</td><td>0.668</td><td>0.558</td></tr><tr><td>BVAE θ -ESS</td><td>0.904</td><td>0.891</td><td>0.117</td><td>0.693</td><td>0.680</td><td>0.540</td></tr><tr><td colspan="2">in-distribution out-of-distribution</td><td/><td/><td/><td colspan="2">in-distribution out-of-distribution</td></tr></table>

AUROC↑, AUPRC↑, and FPR80↓ scores (where higher ↑ or lower ↓ is better) of the baselines (top) and our methods (bottom) on the SVHN vs. CIFAR10 benchmark.

Table content: <table><tr><td/><td colspan="3">AUROC↑ AUPRC↑ FPR80↓</td></tr><tr><td>LL</td><td>0.574</td><td>0.575</td><td>0.634</td></tr><tr><td>WAIC</td><td>0.293</td><td>0.380</td><td>0.912</td></tr><tr><td>LLR</td><td>0.570</td><td>0.570</td><td>0.638</td></tr><tr><td>TT</td><td>0.395</td><td>0.428</td><td>0.859</td></tr><tr><td>BVAE-ESS</td><td>0.667</td><td>0.656</td><td>0.564</td></tr><tr><td>BVAE-ESS θ φ</td><td>0.669</td><td>0.647</td><td>0.562</td></tr><tr><td>BVAE-ESS</td><td>0.828</td><td>0.817</td><td>0.281</td></tr><tr><td>BVAE-ESS θ φ</td><td>0.814</td><td>0.799</td><td>0.310</td></tr><tr><td>BVAE θ -ESS</td><td>0.807</td><td>0.793</td><td>0.331</td></tr><tr><td colspan="2">in-distribution out-of-distribution</td><td/><td>in-distribution out-of-distribution</td></tr></table>

TRAINING PROCEDURE Algorithm 2 shows pseudocode of an alternative Bayesian VAE (BVAE) training procedure, which essentially is identical to the training of an ordinary VAE, but using the SGHMC sampler instead of a stochastic gradient optimizer. The posterior samples Θ and Φ are thus not used during training (as in Algorithm 1), but only for test time prediction. Algorithm 2 Alternative Bayesian VAE Training Input: Dataset D, generative model p(x, z, θ), inference model q(z|x, φ), burn-in length B, sample distance D, mini-batch size |M| Initialize φ 0 , θ 0 and Φ = ∅, Θ = ∅ Define number of mini-batches per epoch N b = |D|

Table content: <table/>

Peer review (iclr2020):
The paper advocates to use information gain to detect whether a sample is out of distribution. To that end, a Bayesian VAE is introduced for which that quantity is tractable. The experiments show a solid improvement over previous methods. I like the paper, but I have a few questions. I am more than willing to increase my score from weak reject to weak or strong accept if these are addressed properly. What is the relationship of information gain to the marginal likelihood of the data? Since both can be expressed in entropies, I can see a very strong relationship, but would enjoy the authors opinion here–what exactly is it that gives the edge? The experiments report results on the likelihood based score. Were these results taken from previous publications or obtained from exactly the same pipeline? Why is the *outlier in latent space* section included even though it is not experimentally verified? I think it should go, as conducting experiments is cheap in ML. On the other hand, if we cannot come up with an experiment to conduct, then what is hypothesis is tested? I think the section needs to be removed and be revisited in future work. Is the method really principled? Where is the connection from the assumption that the score should be high for out of distribution and low for in distribution? If a method is called *principled* I want to see a rigorous derivation of how a method derives from what principles exactly and how it is approximated. Since only the 10 most recent samples are kept to represent the posterior, I am worried about their diversity. I think the authors should back up that this is sufficient to represent the posterior. What happens in the non-parametric limit, where the posterior will collapse to a point? Does the method not rely on an insufficiently inferred model?