Title: SIMULTANEOUS CLASSIFICATION AND OUT-OF-DISTRIBUTION DETECTION USING DEEP NEURAL NETWORKS

Abstract: Deep neural networks have achieved great success in classification tasks during the last years. However, one major problem to the path towards artificial intelligence is the inability of neural networks to accurately detect samples from novel class distributions and therefore, most of the existent classification algorithms assume that all classes are known prior to the training stage. In this work, we propose a methodology for training a neural network that allows it to efficiently detect outof-distribution (OOD) examples without compromising much of its classification accuracy on the test examples from known classes. Based on the Outlier Exposure (OE) technique, we propose a novel loss function that achieves state-of-the-art results in out-of-distribution detection with OE both on image and text classification tasks. Additionally, we experimentally show that the combination of our method with the Mahalanobis distance-based classifier achieves state-of-the-art results in the OOD detection task.

1. INTRODUCTION:

Modern neural networks have recently achieved superior results in classification problems (Krizhevsky et al., 2012; He et al., 2016) . However, most of the classification algorithms proposed so far make the assumption that data generated from all the class conditional distributions are available during training time i.e., they make the closed-world assumption. In an open world environment (Bendale & Boult, 2015) , where examples from novel class distributions might appear during test time, it is necessary to build classifiers that are able to detect OOD examples while having high classification accuracy on known class distributions.

It is generally known that deep neural networks can make predictions for out-of-distribution (OOD) examples with high confidence (Nguyen et al., 2015) . High confidence predictions are undesirable since they consist a symptom of overfitting (Szegedy et al., 2015) . They also make the calibration of neural networks difficult. Guo et al. (2017) observed that modern neural networks are miscalibrated by experimentally showing that the average confidence of deep neural networks is usually much higher than their accuracy.

A simple yet effective method to address the problem of the inability of neural networks to detect OOD examples is to train them so that they make highly uncertain predictions for examples generated by novel class distributions. In order to achieve that, Lee et al. (2018a) defined a loss function based on the Kullback-Leibler (KL) divergence metric to minimize the distance between the output distribution given by softmax and the uniform distribution for samples generated by a GAN (Goodfellow et al., 2014) . Using a similar loss function, Hendrycks et al. (2019) showed that the technique of Outlier Exposure (OE) that draws anomalies from a real and diverse dataset can outperform the GAN framework for OOD detection.

Using the OE technique, our main contribution is threefold:

• We propose a novel loss function consisting of two regularization terms. The first regularization term minimizes the l 1 norm between the output distribution given by softmax and the uniform distribution which constitutes a distance metric between the two distributions (Deza & Deza, 2009) . The second regularization term minimizes the Euclidean distance between the training accuracy of a DNN and its average confidence in its predictions on the training set. • We experimentally show that the proposed loss function outperforms the previous work of Hendrycks et al. (2019) and achieves state-of-the-art results in OOD detection with OE both on image and text classification tasks. • We experimentally show that our proposed method can be combined with the Mahalanobis distance-based classifier (Lee et al., 2018b) . The combination of the two methods outperforms the original Mahalanobis method in all of the experiments and to the best of our knowledge, achieves state-of-the-art results in the OOD detection task.

2 RELATED WORK Yu et al. (2017) used the GAN framework (Goodfellow et al., 2014) to generate negative instances of seen classes by finding data points that are close to the training instances but are classified as fake by the discriminator. Then, they used those samples in order to train SVM classifiers to detect examples from unseen classes. Similarly, Kliger & Fleishman (2018) (Platt, 1999) , temperature scaling, was proposed by Guo et al. (2017) for calibration of modern neural networks. For image data, based on the idea of Hendrycks & Gimpel (2017) , Liang et al. (2018) observed that simultaneous use of temperature scaling and small perturbations at the input can push the softmax scores of in-and out-of-distribution images further apart from each other, making the out-of-distribution images distinguishable. Lee et al. (2018a) generated GAN examples and forced the neural network to have lower confidence in predicting their classes. Hendrycks et al. (2019) substituted the GAN samples with a real and diverse dataset using the technique of OE. Similar works (Malinin & Gales, 2018; Bevandić et al., 2018) Under the assumption that the pre-trained features of a softmax neural classifier can be fitted well by a class-conditional Gaussian distribution, Lee et al. (2018b) defined a confidence score using the Mahalanobis distance that can efficiently detect abnormal test samples. As also mentioned by Lee et al. (2018b) , Euclidean distance can also be used but with less efficiency. We prefer to call these methods Distance-Based Post-Training (DBPT) methods for OOD detection.

3. SIMULTANEOUS CLASSIFICATION AND OUT-OF-DISTRIBUTION DETECTION:

We consider the multi-class classification problem under the open-world assumption (Bendale & Boult, 2015) , where samples from some classes are not available during training. Lee et al. (2018a) and Hendrycks et al. (2019) used the KL divergence metric in order to minimize the distance between the output distribution produced by softmax for the OOD examples and the uniform distribution. In our work, we choose to minimize the l 1 norm between the two distributions which has shown great success in machine learning applications.

Viewing the knowledge of a model as the class conditional distribution it produces over outputs given an input (Hinton et al., 2015) , the entropy of this conditional distribution can be used as a regularization method that penalizes confident predictions of a neural network (Pereyra et al., 2017) . In our approach, instead of penalizing the confident predictions of posterior probabilities yielded by a neural network, we force it to make predictions for examples generated by D in with an average confidence close to its training accuracy. In such a manner, not only do we make the neural network avoid making overconfident predictions, but we also take into consideration its calibration (Guo et al., 2017) .

Let us consider a classification model that can be represented by a parametrized function f θ , where θ stands for the vector of parameters in f θ . Without loss of generality, assume that the cross entropy loss function is used during training. We propose the following constrained optimization problem for finding θ:

minimize θ E (x,y)∼Din [L CE (f θ (x), y)] subject to E x∼Din max l=1,...,K e z l K j=1 e zj = A tr max l=1,...,K e z l K j=1 e zj = 1 K , ∀x (i) ∼ D OE out (1)

where L CE is the cross entropy loss function and K is the number of classes available in D in .

Even though the constrained optimization problem (1) can be used for training various classification models, for clarity we limit our discussion to deep neural networks. Let z denote the vector representation of the example x (i) in the feature space produced by the last layer of the deep neural network (DNN) and let A tr be the training accuracy of the DNN. Observe that the optimization problem (1) minimizes the cross entropy loss function subject to two additional constraints. The first constraint forces the average maximum prediction probabilities calculated by the softmax layer towards the training accuracy of the DNN for examples sampled from D in , while the second constraint forces the maximum probability calculated by the softmax layer towards 1 K for all examples sampled from the probability distribution D OE out . In other words, the first constraint makes the DNN predict examples from known classes with an average confidence close to its training accuracy, while the second constraint forces the DNN to be highly uncertain for examples of classes it has never seen before by producing a uniform distribution at the output for examples sampled from the probability distribution D OE out . It is also worth noting that the first constraint of (1) uses the training accuracy of the neural network A tr which is not available in general. To handle this issue, one can train a neural network by only minimizing the cross entropy loss function for a few number of epochs in order to calculate A tr and then fine-tune it using (1).

Because solving the nonconvex constrained optimization problem described by (1) is extremely difficult, let us introduce Lagrange multipliers (Boyd & Vandenberghe, 2004) and convert it into the following unconstrained optimization problem:

EQUATION

where it is worth mentioning that in (2), we used only one Lagrange multiplier for the second set of constraints in (1) instead of using one for each constraint in order to avoid introducing a large number of hyperparameters to our loss function. This modification is a special case where we consider the Lagrange multiplier λ 2 to be common for each individual constraint involving a different x (i) ∼ D OE out . Note also that according to the original Lagrangian theory, one should optimize the objective function of (2) both with respect to θ,λ 1 and λ 2 but as it commonly happens in machine learning applications, we approximate the original problem by calculating appropriate values for λ 1 and λ 2 through a validation technique (Hastie et al., 2001) .

After converting the constrained optimization problem (1) into an unconstrained optimization problem as described by (2), it is possible that at each training epoch, the maximum prediction probability produced by softmax for each example drawn from D OE out changes, introducing difficulties in making the DNN produce a uniform distribution at the output for those examples. For instance, assume that we have a K-class classifier with K = 3 and at epoch t n , the maximum prediction probability produced by softmax for an example x (i) ∼ D OE out corresponds to the second class. Then, the last term of (2) will push the prediction probability of example x (i) for the second class towards 1 3 while concurrently increasing the prediction probabilities for either the first class or the third class or both. At the next epoch t n+1 , it is possible that the prediction probability for either the first class or the third class becomes the maximum among the three and hence, the last term of (2) will push that one towards 1 3 by possibly increasing again the prediction probability for the second class. It becomes obvious that this process introduces difficulties in making the DNN produce a uniform distribution at the output for examples sampled from D OE out . However, this issue can be resolved by concurrently pushing all the prediction probabilities produced by the softmax layer for examples drawn from D OE out towards 1 K . Additionally, in order to prevent the second and the third term of (2) from taking negative values during training, let us convert (2) into the following:

EQUATION

The second term of the the loss function described by (3) minimizes the squared distance between the training accuracy of the DNN and the average confidence in its predictions for examples drawn from D in . Additionally, the third term of (3) minimizes the l 1 norm between the uniform distribution and the distribution produced by the softmax layer for the examples drawn from D OE out . While converting the unconstrained optimization problem (2) into (3), one could use several combinations of norms to minimize. However, we found that minimizing the squared distance between the training accuracy of the DNN and the average confidence in its predictions for examples drawn from D in and the l 1 norm between the uniform distribution and the distribution produced by the softmax layer for the examples drawn from D OE out works best. This is because l 1 norm uniformly attracts all the prediction probabilities produced by softmax to the desired value 1 K , better contributing to producing a uniform distribution at the output of the DNN for the examples drawn from D OE out . On the other hand, minimizing the squared distance between the training accuracy of the DNN and the average confidence in its predictions for examples drawn from D in emphasizes more on attracting the maximum softmax probabilities that are further away from the average confidence of the DNN, making the neural network better detect in-and out-of-distribution examples at the low softmax probability levels.

4. EXPERIMENTS:

During the experiments, we observed that if we start training the DNN with a relatively high value of λ 1 , the learning process might slow down since we constantly force the neural network to make predictions with an average confidence close to its training accuracy. Therefore, it is recommended to split the training of the algorithm into two stages where in the first stage, we train the DNN using only the cross entropy loss function until it reaches the desired level of accuracy A tr and then using a fixed A tr , we fine-tune it using the combined loss function given by (3).

4.1. COMPARISON WITH STATE-OF-THE-ART IN OE:

The experimental setting is as follows. We draw samples from D in and we train the DNN until it reaches the desired level of accuracy A tr . Then, drawing samples from D OE out , we fine-tune it using the combined loss function given by (3). During the test phase, we evaluate the OOD detection capability of the DNN using examples from D test out which is disjoint from D OE out . We demonstrate the effectiveness of our method in both image and text classification tasks by comparing it with the previous OOD detection with OE method proposed by Hendrycks et al. (2019) . A part of our experiments was based on the publicly available code of Hendrycks et al. (2019) .

4.1.1. EVALUATION METRICS:

Our OOD detection method belongs to the class of Maximum Softmax Probability (MSP) detectors (Hendrycks & Gimpel, 2017) and therefore, we adopt the evaluation metrics used in Hendrycks et al. (2019) . Defining the OOD examples as the positive class and the in-distribution examples as the negative class, the performance metrics associated with OOD detection are the following:

• False Positive Rate at N % True Positive Rate (FPRN): This performance metric (Balntas et al., 2016; Kumar et al., 2016) measures the capability of an OOD detector when the maximum softmax probability threshold is set to a predefined value. More specifically, assuming N % of OOD examples need to be detected during the test phase, we calculate a threshold in the softmax probability space and given that threshold, we measure the false positive rate, i.e. the ratio of indistribution examples that are incorrectly classified as OOD.

• Area Under the Receiver Operating Characteristic curve (AUROC): In the out-of-distribution detection task, the ROC curve (Davis & Goadrich, 2006) summarizes the performance of an OOD detection method for varying threshold values.

• 2019), for CIFAR 10 and CIFAR 100 experiments, we used 40-2 wide residual networks (WRNs) proposed by Zagoruyko & Komodakis (2016) . We initially trained the WRN for 100 epochs using a cosine learning rate (Loshchilov & Hutter, 2017) with an initial value 0.1, a dropout rate of 0.3 and a batch size of 128. As in Hendrycks et al. (2019) , we also used Nesterov momentum and l 2 weight regularization with a decay factor of 0.0005. For CIFAR 10, we fine-tuned the network for 15 epochs minimizing the loss function given by (3) using a learning rate of 0.001, while for the CIFAR 100 the corresponding number of epochs was 20. For the SVHN experiments, we trained 16-4 WRNs using a learning rate of 0.01, a dropout rate of 0.4 and a batch size of 128. We then fine-tuned the network for 5 epochs using a learning rate of 0.001. During fine-tuning, the 80 Million Tiny Images dataset was used as D OE out . The values of the hyperparameters λ 1 and λ 2 were chosen in the range [0.03, 0.09] using a separate validation dataset D val out similar to (Hendrycks et al., 2019) versus fine-tuning with our proposed loss function given by (3). All results are percentages and averaged over 10 runs and over 8 OOD datasets. Detailed experimental results are in Appendix A.1.

Contribution of each regularization term.:

To demonstrate the effect of each regularization term of the loss function described by (3) in the OOD detection task, we ran some additional image classification experiments which are presented in Table 2 . For these experiments, we incrementally added each regularization term to the loss function described by (3) and we measured its effect both in the OOD detection evaluation metrics as well as in the accuracy of the DNN on the test images of D in . The results of these experiments validate that the combination of the two regularization terms of (3) not only improves the OOD detection performance of the DNN but also improves its accuracy on the test examples of D in compared to the case where λ 1 = 0. 2018b) proposed a DBPT method for OOD detection that can be applied to any pretrained softmax neural classifier. Under the assumption that the pre-trained features of a DNN can be fitted well by a class-conditional Gaussian distribution, they defined the confidence score using the Mahalanobis distance with respect to the closest class-conditional probability distribution, where its parameters are chosen as empirical class means and tied empirical covariance of training samples (Lee et al., 2018b) . To further distinguish in-and out-of-distribution examples, they proposed two additional techniques. In the first technique, they added a small perturbation before processing each input example to increase the confidence score of their method. In the second technique, they proposed a feature ensemble method in order to obtain a better calibrated score. The feature ensemble method extracts all the hidden features of the DNN and computes their empirical class mean and tied covariances. Subsequently, it calculates the Mahalanobis distance-based confidence score for each layer and finally calculates the weighted average of these scores by training a logistic regression detector using validation samples in order to calculate the weight of each layer at the final confidence score.

Since the Mahalanobis distance-based classifier proposed by Lee et al. (2018b) is a post-training method, it can be combined with our proposed loss function described by (3). More specifically, in our experiments, we initially trained a DNN using the standard cross entropy loss function and then we fine-tuned it with the proposed loss function given by ( 3). After fine-tuning, we applied the Mahalanobis distance-based classifier and we compared the obtained results against the results presented in Lee et al. (2018b) . The simulation experiments on image classification tasks show that the combination of our method which belongs to the OE "family" of methods and the Mahalanobis distance-based classifier which belongs to the "family" of DBPT methods achieves state-of-the-art results in the OOD detection task. A part of our experiments was based on the publicly available code of Lee et al. (2018b) .

To demonstrate the adaptability of our method, in these experiments, we adopt the OOD detection evaluation metrics used in Lee et al. (2018b) .

• True Negative Rate at N % True Positive Rate (TNRN): This performance metric measures the capability of an OOD detector to detect true negative examples when the true positive rate is set to 95%. • Area Under the Receiver Operating Characteristic curve (AUROC): In the out-of-distribution detection task, the ROC curve (Davis & Goadrich, 2006) summarizes the performance of an OOD detection method for varying threshold values. • Detection Accuracy (DAcc): As also mentioned in Lee et al. (2018b) , this evaluation metric corresponds to the maximum classification probability over all possible thresholds :

1 -min {D in (q(x) ≤ )P (x is from D in ) + D out (q(x) > )P (x is from D out )},

where q(x) is a confidence score. Similar to Lee et al. (2018b) , we assume that P (x is from D in ) = P (x is from D out ).

4.2.2. EXPERIMENTAL SETUP:

To demonstrate the adaptability and the effectiveness of our method, we adopt the experimental setup of Lee et al. (2018b) . We train ResNet (He et al., 2016) (Lee et al., 2018b) and the combination of our proposed method with the Mahalanobis method. The hyper-parameters are tuned using a validation dataset of in-and out-of-distribution data similar to Lee et al. (2018b) . Additional training details for our method are presented in Appendix C.

algorithm with momentum 0.9. The learning rate starts at 0.1 and is dropped by a factor of 10 at 50% and 75% of the training progress, respectively. Subsequently, we compute the Mahalanobis distancebased confidence score using both the input pre-processing and the feature ensemble techniques.

The hyper-parameters that need to be tuned are the magnitude of the noise added at each test input example as well as the layer indexes for feature ensemble. Similar to Lee et al. (2018b) , both of them are tuned using a separate validation dataset consisting of both in-and out-of-distribution data.

Since the Mahalanobis distance-based classifier belongs to the "family" of DBPT methods for OOD detection tasks, it can be combined with our proposed method. More specifically, we initially train the ResNet model with 34 layers for 200 epochs using exactly the same training details as mentioned above. Subsequently, we fine-tune the network with the proposed loss function described by (3) using the 80 Million Tiny Images as D OE out . During fine-tuning, we use the SGD algorithm with momentum 0.9 and a cosine learning rate (Loshchilov & Hutter, 2017) with an initial value 0.001 using a batch size of 128 for data sampled from D in and a batch size of 256 for data sampled from D OE out . For CIFAR-10 and 100 experiments, we fine-tuned the network for 30 and 20 epochs respectively, while for SVHN the corresponding number of epochs was 5. The values of the hyperparameters λ 1 and λ 2 were chosen using a separate validation dataset consisting of both in-and out-of-distribution images similar to Lee et al. (2018b) . The results are shown in Table 4 .

Discussion. The results in Table 4 demonstrate the effectiveness of our method when combined with the Mahalanobis distance-based classifier since it outperforms the original version of the Mahalanobis method proposed by Lee et al. (2018b) in all of the experiments. This result validates the contribution of our technique further, since it does not only achieve state-of-the-art results in OOD detection with OE, but it can be additionally combined with DBPT methods like the Mahalanobis distance-based classifier to achieve state-of-the-art results in the OOD detection task. The superior performance of our method when combined with the Mahalanobis distance-based classifier can be justified by the fact that the latter extracts the learned features from the layer(s) of the DNN and it subsequently uses those features to define a confidence score based on the Mahalanobis distance. The simulation results presented in Table 1 and Table 3 showed that our method can teach the DNN to learn feature representations that can further distinguish in-and out-of distribution data and therefore, the combination of the two methods improves the OOD detection capability of a DNN.

5. CONCLUSION:

In this paper, we proposed a method for simultaneous classification and out-of-distribution detection. The proposed loss function includes two regularization terms where the first minimizes the l 1 norm between the output distribution of the softmax layer of a DNN and the uniform distribution, while the second minimizes the Euclidean distance between the training accuracy of a DNN and its average confidence in its predictions on the training set. Experimental results showed that the proposed loss function achieves state-of-the-art results in OOD detection with OE (Hendrycks et al., 2019) in both image and text classification tasks. Additionally, we experimentally showed that our method can be combined with DBPT methods for OOD detection like the Mahalanobis distance-based classifier (Lee et al., 2018b) and achieves state-of-the-art results in the OOD detection task. Hendrycks & Dietterich (2018) consists of 10,000 images belonging to 50 classes of icons. As part of preprocessing, we removed the class "Number" in order to make it disjoint from the SVHN dataset. Textures: This dataset contains 5,640 textural images (Cimpoi et al., 2014) . LSUN: It consists of around 1 million large-scale images of scenes (Yu et al., 2015) . Rademacher: A synthetic image dataset created by sampling from a symmetric Rademacher distribution.

A.3 VALIDATION DATA FOR IMAGE EXPERIMENTS:

Uniform Noise: A synthetic image dataset where each pixel is sampled from U[0, 1] or U[-1, 1] depending on the input space of the classifier. Arithmetic Mean: A synthetic image dataset created by randomly sampling a pair of in-distribution images and subsequently taking their pixelwise arithmetic mean. Geometric Mean: A synthetic image dataset created by randomly sampling a pair of in-distribution images and subsequently taking their pixelwise geometric mean. Jigsaw: A synthetic image dataset created by partitioning an image sampled from D in into 16 equally sized patches and by subsequently permuting those patches. WikiText-2: This dataset contains over 2 million articles from Wikipedia and is exclusively used as D OE out in our experiments. We used the same preprocessing as in Hendrycks et al. (2019) in order to have a valid comparison. SNLI: The Stanford Natural Language Inference (SNLI) corpus is a collection of 570,000 humanwritten English sentence pairs (Bowman et al., 2015) . IMDB: A sentiment classification dataset containing movies reviews. Multi30K: A dataset of English and German descriptions of images (Elliott et al., 2016) . For our experiments, only the English descriptions were used. WMT16: A dataset used for machine translation tasks. For our experiments, only the English part of the test set was used. Yelp: A dataset containing reviews of users for businesses on Yelp.

EWT: The English Web Treebank (EWT) consists of 5 different datasets: weblogs (EWT-W), newsgroups (EWT-N), emails reviews (EWT-R) and questions-answers (EWT-A).

B.2 VALIDATION DATA FOR NLP EXPERIMENTS:

The validation dataset D val out used for the NLP OOD detection experiments was constructed as follows. For each D in dataset used, we used the rest two in-distribution datasets as 

D

:



Figures and Tables:

also force the model to make uncertain predictions for OOD examples. Using an ensemble of classifiers, Lakshminarayanan et al. (2017) showed that their method was able to express higher uncertainty in OOD examples. Liu et al. (2018) provided theoretical guarantees for detecting OOD examples under the assumption that an upper bound of the fraction of OOD examples is available.

Figure 1: Histogram of softmax probabilities with CIFAR-10 as D in and Places365 as D test out (1,000 samples from each dataset). Top: MSP baseline detector. Bottom: MSP detector fine-tuned with (3). Results. The results of the image classification experiments are shown in Table 1. In Figure 1, as an example, we plot the histogram of softmax probabilities using CIFAR-10 as D in and Places365 as D test out . The detailed description of the image datasets used in the image OOD detection experiments is presented in Appendix A.2. Network Architecture and Training Details. Similar to Hendrycks et al. (2019), for CIFAR 10 and CIFAR 100 experiments, we used 40-2 wide residual networks (WRNs) proposed byZagoruyko & Komodakis (2016). We initially trained the WRN for 100 epochs using a cosine learning rate(Loshchilov & Hutter, 2017) with an initial value 0.1, a dropout rate of 0.3 and a batch size of 128. As inHendrycks et al. (2019), we also used Nesterov momentum and l 2 weight regularization with a decay factor of 0.0005. For CIFAR 10, we fine-tuned the network for 15 epochs minimizing the loss function given by (3) using a learning rate of 0.001, while for the CIFAR 100 the corresponding number of epochs was 20. For the SVHN experiments, we trained 16-4 WRNs using a learning rate of 0.01, a dropout rate of 0.4 and a batch size of 128. We then fine-tuned the network for 5 epochs using a learning rate of 0.001. During fine-tuning, the 80 Million Tiny Images dataset was used as D OE out . The values of the hyperparameters λ 1 and λ 2 were chosen in the range [0.03, 0.09] using a separate validation dataset D val out similar toHendrycks et al. (2019). We note that D val out and D test out are disjoint. The data used for validation are presented in Appendix A.3.

Our task is to design deep neural network classifiers that can achieve high accuracy on examples generated by a learned probability distribution called D in while at the same time, they can effectively detect examples generated by a different probability distribution called D out during the test phase. The examples generated by D in are called in-distribution while the examples generated by D out are called out-

Table content: <table/>

.40 90.48 93.08 CIFAR-100 38.50 28.89 87.89 91.80 58.15 71.50 Image OOD example detection for the maximum softmax probability (MSP) baseline detector after fine-tuning with OE

Table content: <table><tr><td/><td colspan="2">FPR95↓</td><td>AUROC↑</td><td>AUPR↑</td></tr><tr><td>D in</td><td colspan="4">+OE OURS +OE OURS +OE OURS</td></tr><tr><td>SVHN</td><td>0.10</td><td>0.03</td><td colspan="2">99.98 99.99 99.83 99.55</td></tr><tr><td>CIFAR-10</td><td>9.50</td><td>6.56</td><td>97.81 98</td></tr></table>

Table 2 also demonstrates that our method can significantly improve the OOD detection performance of the DNN compared to the case where only the cross-entropy loss is minimized at the expense of only an insignificant degradation in the test accuracy of the DNN on examples generated by D in . OE out . The values of the hyperparameters λ 1 and λ 2 were chosen in the range [0.04, 0.1] using a separate validation dataset as described in Appendix B.2. 4.2 A COMBINATION OF OE AND DBPT METHODS FOR OOD DETECTION Lee et al. (

Table content: <table><tr><td>D in</td><td colspan="6">λ 1 λ 2 FPR95↓ AUROC↑ AUPR↑ Test Accuracy(D in )</td></tr><tr><td/><td>-</td><td>-</td><td>34.94</td><td colspan="2">89.27</td><td>59.16</td><td>94.65</td></tr><tr><td>CIFAR-10</td><td>-</td><td/><td>8.87</td><td colspan="2">96.72</td><td>77.65</td><td>92.72</td></tr><tr><td/><td/><td/><td>6.56</td><td colspan="2">98.40</td><td>93.08</td><td>93.86</td></tr><tr><td/><td>-</td><td>-</td><td>62.66</td><td colspan="2">73.11</td><td>30.05</td><td>75.73</td></tr><tr><td>CIFAR-100</td><td>-</td><td/><td>26.75</td><td colspan="2">91.59</td><td>68.27</td><td>71.29</td></tr><tr><td/><td/><td/><td>28.89</td><td colspan="2">91.80</td><td>71.50</td><td>73.14</td></tr><tr><td colspan="7">Table 2: Contribution of each regularization term of (3) on the OOD detection performance and the</td></tr><tr><td colspan="7">test accuracy of the DNN. Results are averaged over 10 runs and over 8 OOD datasets.</td></tr><tr><td colspan="5">4.1.3 TEXT CLASSIFICATION EXPERIMENTS</td><td/></tr><tr><td colspan="7">Results. The results of the text classification experiments are shown in Table 3. The detailed</td></tr><tr><td colspan="7">description of the text datasets used in the NLP OOD detection experiments is presented in Ap-</td></tr><tr><td>pendix B.1.</td><td/><td/><td/><td/><td/></tr><tr><td/><td/><td/><td colspan="2">FPR90↓</td><td colspan="2">AUROC↑</td><td>AUPR↑</td></tr><tr><td>D in</td><td/><td/><td colspan="4">+OE OURS +OE OURS +OE OURS</td></tr><tr><td colspan="4">20 Newsgroups 4.86</td><td>0.63</td><td colspan="2">97.71 99.18 91.91 97.02</td></tr><tr><td colspan="2">TREC</td><td/><td>0.78</td><td>0.75</td><td colspan="2">99.28 99.32 97.64 97.52</td></tr><tr><td colspan="2">SST</td><td/><td colspan="4">27.33 17.91 89.27 93.79 59.23 74.10</td></tr><tr><td colspan="7">Table 3: NLP OOD example detection for the maximum softmax probability (MSP) baseline de-</td></tr><tr><td colspan="7">tector after fine-tuning with OE (Hendrycks et al., 2019) versus fine-tuning with our proposed loss</td></tr><tr><td colspan="7">function given by (3). All results are percentages and averaged over 10 runs and over 10 OOD</td></tr><tr><td colspan="6">datasets. Detailed experimental results are in Appendix B.3.</td></tr></table>

with 34 layers using CIFAR-10, CIFAR-100 and SVHN datasets as D in . For the CIFAR experiments, SVHN, TinyImageNet (a sample of 10,000 images drawn from the ImageNet dataset) and LSUN are used as D test out . For the SVHN experiments, CIFAR-10, TinyImageNet and LSUN are used as D test out . Both TinyImageNet and LSUN images are downsampled to 32 × 32. Similar to Lee et al. (2018b), for the Mahalanobis distance-based classifier, we train the ResNet model for 200 epochs with batch size 128 by minimizing the cross entropy loss using the SGD Comparison between the Mahalanobis distance-based classifier

Table content: <table><tr><td/><td/><td/><td>TNR95↑</td><td/><td>AUROC↑</td><td/><td>DAcc↑</td></tr><tr><td>D in</td><td>D test out</td><td colspan="6">Mahal. OURS+Mahal. Mahal. OURS+Mahal. Mahal. OURS+Mahal.</td></tr><tr><td/><td>SVHN</td><td>96.4</td><td>97.3</td><td>99.1</td><td>99.2</td><td>95.8</td><td>96.3</td></tr><tr><td>CIFAR-10</td><td>TinyImageNet</td><td>97.1</td><td>98.8</td><td>99.5</td><td>99.6</td><td>96.3</td><td>97.3</td></tr><tr><td/><td>LSUN</td><td>98.9</td><td>99.7</td><td>99.7</td><td>99.8</td><td>97.7</td><td>98.5</td></tr><tr><td/><td>SVHN</td><td>91.9</td><td>93.0</td><td>98.4</td><td>98.7</td><td>93.7</td><td>94.2</td></tr><tr><td>CIFAR-100</td><td>TinyImageNet</td><td>90.9</td><td>92.3</td><td>98.2</td><td>98.3</td><td>93.3</td><td>93.9</td></tr><tr><td/><td>LSUN</td><td>90.9</td><td>95.6</td><td>98.2</td><td>98.6</td><td>93.5</td><td>95.4</td></tr><tr><td/><td>CIFAR-10</td><td>98.4</td><td>99.9</td><td>99.3</td><td>99.9</td><td>96.9</td><td>99.2</td></tr><tr><td>SVHN</td><td>TinyImageNet</td><td>99.9</td><td>100.0</td><td>99.9</td><td>100.0</td><td>99.1</td><td>99.9</td></tr><tr><td/><td>LSUN</td><td>99.9</td><td>100.0</td><td>99.9</td><td>100.0</td><td>99.5</td><td>100.0</td></tr></table>

A EXPANDED IMAGE OOD DETECTION RESULTS AND DATASETS USED FORCOMPARISON WITH STATE-OF-THE-ART IN OE Image OOD example detection for the maximum softmax probability (MSP) baseline detector after fine-tuning with OE(Hendrycks et al., 2019) versus fine-tuning with our proposed loss function given by (3). All results are percentages and averaged over 10 runs. Values are rounded to the first decimal digit. A.2 D in , D OE out AND D test out FOR IMAGE EXPERIMENTS SVHN: The Street View House Number (SVHN) dataset (Netzer et al., 2011) consists of 32 × 32 color images out of which 604,388 are used for training and 26,032 are used for testing. The dataset has 10 classes and was collected from real Google Street View images. Similar to Hendrycks et al. (2019), we rescale the pixels of the images to be in [0, 1]. CIFAR 10: This dataset (Krizhevsky & Hinton, 2009) contains 10 classes and consists of 60,000 32 × 32 color images out of which 50,000 belong to the training and 10,000 belong to the test set. Before training, we standardize the images per channel similar to Hendrycks et al. (2019). CIFAR 100: This dataset (Krizhevsky & Hinton, 2009) consists of 20 distinct superclasses each of which contains 5 different classes giving us a total of 100 classes. The total number of images in the dataset are 60,000 and we use the standard 50,000/10,000 train/test split. Before training, we standardize the images per channel similar to Hendrycks et al. (2019). 80 Million Tiny Images: The 80 Million Tiny Images dataset (Torralba et al., 2008) was exclusively used in our experiments in order to represent D OE out . It consists of 32 × 32 color images collected from the Internet. Similar to Hendrycks et al. (2019), in order to make sure that D OE out and D test out are disjoint, we removed all the images of the dataset that appear on CIFAR 10 and 100 datasets. Places365: Places365 dataset introduced by Zhou et al. (2018) was exclusively used in our experiments in order to represent D test out . It consists of millions of photographs of scenes. Gaussian: A synthetic image dataset created by i.i.d. sampling from an isotropic Gaussian distribution. Bernoulli: A synthetic image dataset created by sampling from a Bernoulli distribution. Blobs: A synthetic dataset of images with definite edges. Icons-50: This dataset intoduced by

Table content: <table><tr><td colspan="3">A.1 IMAGE OOD DETECTION RESULTS</td><td/><td/><td/><td/><td/></tr><tr><td/><td/><td colspan="2">FPR95↓</td><td/><td/><td colspan="2">AUPR↑</td></tr><tr><td colspan="2">D in D test out</td><td colspan="6">+OE OURS +OE OURS +OE OURS</td></tr><tr><td/><td>Gaussian</td><td>0.0</td><td>0.0</td><td>100.</td><td>100.</td><td>100.</td><td>99.4</td></tr><tr><td/><td>Bernulli</td><td>0.0</td><td>0.0</td><td>100.</td><td>100.</td><td>100.</td><td>99.2</td></tr><tr><td>SVHN</td><td>Blobs Icons-50 Textures Places365</td><td>0.0 0.3 0.2 0.1</td><td>0.0 0.1 0.1 0.0</td><td>100. 99.8 100. 100.</td><td>100. 99.9 100. 100.</td><td>100. 99.2 99.7 99.9</td><td>99.6 99.5 99.6 99.7</td></tr><tr><td/><td>LSUN</td><td>0.1</td><td>0.0</td><td>100.</td><td>100.</td><td>99.9</td><td>99.7</td></tr><tr><td/><td>CIFAR-10</td><td>0.1</td><td>0.0</td><td>100.</td><td>100.</td><td>99.9</td><td>99.7</td></tr><tr><td/><td>Mean</td><td>0.10</td><td>0.03</td><td colspan="4">99.98 99.99 99.83 99.55</td></tr><tr><td/><td>Gaussian</td><td>0.7</td><td>0.7</td><td>99.6</td><td>99.8</td><td>94.3</td><td>99.0</td></tr><tr><td/><td>Rademacher</td><td>0.5</td><td>1.1</td><td>99.8</td><td>99.6</td><td>97.4</td><td>97.6</td></tr><tr><td>CIFAR-10</td><td>Blobs Textures SVHN Places365</td><td>0.6 12.2 4.8 17.3</td><td>1.5 4.0 1.4 13.3</td><td>99.8 97.7 98.4 96.2</td><td>99.1 98.9 99.6 96.9</td><td>98.9 91.0 89.4 87.3</td><td>91.7 95.0 97.9 89.5</td></tr><tr><td/><td>LSUN</td><td>12.1</td><td>6.7</td><td>97.6</td><td>98.4</td><td>89.4</td><td>91.9</td></tr><tr><td/><td>CIFAR-100</td><td>28.0</td><td>23.8</td><td>93.3</td><td>94.9</td><td>76.2</td><td>82.0</td></tr><tr><td/><td>Mean</td><td>9.50</td><td>6.56</td><td colspan="4">97.81 98.40 90.48 93.08</td></tr><tr><td/><td>Gaussian</td><td>12.1</td><td>0.7</td><td>95.7</td><td>99.7</td><td>71.1</td><td>97.2</td></tr><tr><td>CIFAR-100</td><td colspan="2">Rademacher 17.1 Blobs 12.1 Textures 54.4 SVHN 42.9 Places365 49.8 LSUN 57.5</td><td>0.7 1.3 50.1 16.7 47.8 56.6</td><td>93.0 97.2 84.8 86.9 86.5 83.4</td><td>99.7 99.6 87.8 94.9 88.1 85.9</td><td>56.9 86.2 56.3 52.9 57.9 51.4</td><td>96.2 96.3 61.5 74.1 58.5 53.0</td></tr><tr><td/><td>CIFAR-10</td><td>62.1</td><td>57.2</td><td>75.7</td><td>78.7</td><td>32.6</td><td>35.2</td></tr><tr><td/><td>Mean</td><td colspan="6">38.50 28.89 87.89 91.80 58.15 71.50</td></tr></table>

Speckle Noised: A synthetic image dataset created by applying speckle noise to images sampled from D in . Inverted Images: A synthetic image dataset created by shifting and reordering the color channels of images sampled from D in . RGB Ghosted: A synthetic image dataset created by inverting the color channels of images sampled from D in . B EXPANDED TEXT OOD DETECTION RESULTS AND DATASETS USED FOR COMPARISON WITH STATE-OF-THE-ART IN OE B.1 D in , D OE out AND D test out FOR NLP EXPERIMENTS 20 Newsgroups: This dataset contains 20 different newsgroups, each corresponding to a specific topic. It contains around 19,000 examples and we used the standard 60/40 train/test split. TREC: A question classification dataset containing around 6,000 examples from 50 different classes. Similar to Hendrycks et al. (2019), we used 500 examples for the test phase and the rest for training. SST: The Stanford Sentiment Treebank (Socher et al., 2013) is a binary classification dataset for sentiment prediction of movie reviews containing around 10,000 examples.

Table content: <table/>

val out . For instance, during the experiments where 20 Newsgroups represented D in , we used TREC and SST as D val NLP OOD example detection for the maximum softmax probability (MSP) baseline detector after fine-tuning with OE(Hendrycks et al., 2019) versus fine-tuning with our proposed loss function given by (3). All results are percentages and the result of 10 runs. Values are rounded to the first decimal digit.

Table content: <table><tr><td>out</td></tr></table>

Peer review (iclr2020):
This paper proposes to tackle the problems of out-of-distribution (OOD) detection and model calibration by adapting the loss function of the Outlier Exposure (OE) technique [1]. In OE, model softmax outputs are encouraged to be uniform for OOD samples, which is enforced through the use of a KL divergence loss function. The first proposed modification in this paper is to replace KL divergence term with an L1 penalty. The second change is the addition of an L2 penalty between the maximum softmax probability and the model accuracy. Experimental results demonstrate that adding these two components increases performance over OE on standard OOD benchmarks for both vision and text domains, and also improves model calibration. Although this paper presents some good quantitative results, I tend towards rejection in its current state. This is mainly due to the limited comparison to alternative methods, and the lack of ablation study. If these were addressed I would consider increasing my score. Things to improve the paper: 1) Currently, one of the most commonly used benchmark methods for OOD detection is the Mahalanobis distance based confidence score (MD) [2], which, as far as I am aware, is state-of-the-art among published works. The authors claim that they do not compare to this work because it is a post-training method, and, presumably, the techniques should be doubly effective when combined. However, we do not have any proof that this is actually the case. Therefore, I think it is important to verify that the two techniques are indeed compatible, and if not, then direct comparison with MD would still be necessary. 2) In the case of confidence calibration, there is no comparison made with other calibration techniques, such as temperature scaling [3]. I think it would be good to included these for reference. 3) Since two distinct components are being added to the loss function, I think it is important to include an ablation study to identify how much each component contributes to improvements in OOD detection and confidence calibration. Minor things to improve the paper that did not impact the score: 4) With regards to the confidence calibration loss, there is similar work by [4] which also optimizes the output of the model to make sure confidence predictions are close to the true accuracy. It may be worth citing if you think it is relevant. Additional questions: 5) How are lambda1 and lambda2 tuned? I could not find this information in the paper. 6) How sensitive is model performance to the setting of the lambda hyperparameters? It would be nice to see a plot of lambda versus the OOD detection metrics. 7) Have you evaluated how this method performs at detecting adversarial attacks? I do not think the paper will suffer without these results, but they are certainly relevant and of interest to practitioners in this area. References: [1] Hendrycks, Dan, Mantas Mazeika, and Thomas G. Dietterich. *Deep anomaly detection with outlier exposure.* ICLR (2018). [2] Lee, Kimin, Kibok Lee, Honglak Lee, and Jinwoo Shin. *A simple unified framework for detecting out-of-distribution samples and adversarial attacks.* NeurIPS, (2018). [3] Guo, Chuan, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. *On calibration of modern neural networks.* In Proceedings of the 34th International Conference on Machine Learning-Volume 70, pp. 1321-1330. JMLR. org, 2017. [4] Corbière, Charles, Nicolas Thome, Avner Bar-Hen, Matthieu Cord, and Patrick Pérez. *Addressing Failure Prediction by Learning Model Confidence.* NeurIPS (2019). ### Post-Rebuttal Comments ### I would like to thank the authors for their hard work during the rebuttal period. I think the current version of the paper is much improved over the previous version. The choice to remove the claims about calibration definitely improves the focus of the paper. The addition of the Mahalanobis distance experiments and the ablation study also significantly strengthen the paper. However, as the other reviewers have pointed out, the novelty of the paper is quite limited since the majority of the gains come from simply swapping the KL-divergence penalty with an L1 penalty. Despite simplicity, this single change yields a significant improvement in performance for the OE algorithm, which is noteworthy. As a result, I will increase my score from a weak reject (3) to a very, very weak accept (more like a 5 than a 6).