Title: A VARIATIONAL DIRICHLET FRAMEWORK FOR OUT-OF-DISTRIBUTION DETECTION Anonymous authors Paper under double-blind review

Abstract: With the recently rapid development in deep learning, deep neural networks have been widely adopted in many real-life applications. However, deep neural networks are also known to have very little control over its uncertainty for test examples, which potentially causes very harmful and annoying consequences in practical scenarios. In this paper, we are particularly interested in designing a higher-order uncertainty metric for deep neural networks and investigate its performance on the out-of-distribution detection task proposed by Hendrycks & Gimpel (2016). Our method first assumes there exists an underlying higher-order distribution P(z), which generated label-wise distribution P(y) over classes on the K-dimension simplex, and then approximate such higher-order distribution via parameterized posterior function p θ (z|x) under variational inference framework, finally we use the entropy of learned posterior distribution p θ (z|x) as uncertainty measure to detect out-of-distribution examples. However, we identify the overwhelming over-concentration issue in such a framework, which greatly hinders the detection performance. Therefore, we further design a log-smoothing function to alleviate such issue to greatly increase the robustness of the proposed entropy-based uncertainty measure. Through comprehensive experiments on various datasets and architectures, our proposed variational Dirichlet framework with entropy-based uncertainty measure is consistently observed to yield significant improvements over many baseline systems.

1. INTRODUCTION:

Recently, deep neural networks (LeCun et al., 2015) have surged and replaced the traditional machine learning algorithms to demonstrate its potentials in many real-life applications like speech recognition (Hannun et al., 2014) , image classification (Deng et al., 2009; He et al., 2016) , and machine translation (Wu et al., 2016; Vaswani et al., 2017) , reading comprehension (Rajpurkar et al., 2016) , etc. However, unlike the traditional machine learning algorithms like Gaussian Process, Logistic Regression, etc, deep neural networks are very limited in their capability to measure their uncertainty over the unseen test cases and tend to produce over-confident predictions. Such overconfidence issue (Amodei et al., 2016; Zhang et al., 2016 ) is known to be harmful or offensive in real-life applications. Even worse, such models are prone to adversarial attacks and raise concerns in AI safety (Goodfellow et al., 2014; Moosavi-Dezfooli et al., 2016) . Therefore, it is very essential to design a robust and accurate uncertainty metric in deep neural networks in order to better deploy them into real-world applications. Recently, An out-of-distribution detection task has been proposed in Hendrycks & Gimpel (2016) as a benchmark to promote the uncertainty research in the deep learning community. In the baseline approach, a simple method using the highest softmax score is adopted as the indicator for the model's confidence to distinguish in-from out-ofdistribution data. Later on, many follow-up algorithms (Liang et al., 2017; Lee et al., 2017; Shalev et al., 2018; DeVries & Taylor, 2018) have been proposed to achieve better performance on this benchmark. In ODIN (Liang et al., 2017) , the authors follow the idea of temperature scaling and input perturbation (Pereyra et al., 2017; Hinton et al., 2015) to widen the distance between in-and out-of-distribution examples. Later on, adversarial training (Lee et al., 2017) is introduced to explicitly introduce boundary examples as negative training data to help increase the model's robustness. In DeVries & Taylor (2018) , the authors proposed to directly output a real value between [0, 1] as the confidence measure. The most recent paper (Shalev et al., 2018) leverages the semantic dense representation into the target labels to better separate the label space and uses the cosine similarity score as the confidence measure.

These methods though achieve significant results on out-of-distribution detection tasks, they conflate different levels of uncertainty as pointed in Malinin & Gales (2018) . For example, when presented with two pictures, one is faked by mixing dog, cat and horse pictures, the other is a real but unseen dog, the model might output same belief as {cat:34%, dog:33%, horse:33%}. Under such scenario, the existing measures like maximum probability or label-level entropy (Liang et al., 2017; Shalev et al., 2018; Hendrycks & Gimpel, 2016) will misclassify both images as from out-of-distribution because they are unable to separate the two uncertainty sources: whether the uncertainty is due to the data noise (class overlap) or whether the data is far from the manifold of training data. More specifically, they fail to distinguish between the lower-order (aleatoric) uncertainty (Gal, 2016) , and higherorder (episdemic) uncertainty (Gal, 2016) , which leads to their inferior performances in detecting out-domain examples. In order to resolve the issues presented by lower-order uncertainty measures, we are motivated to design an effective higher-order uncertainty measure for out-of-distribution detection. Inspired by Subjective Logic (Jøsang, 2016; Yager & Liu, 2008; Sensoy et al., 2018) , we first view the label-wise distribution P(y) as a K-dimensional variable z generated from a higher-order distribution P(z) over the simplex S k , and then study the higher-order uncertainty by investigating the statistical properties of such underlying higher-order distribution. Under a Bayesian framework with data pair D = (x, y), we propose to use variational inference to approximate such "true" latent distribution P(z) = p(z|y) by a parameterized Dirichlet posterior p θ (z|x), which is approximated by a deep neural network. Finally, we compute the entropy of the approximated posterior for outof-distribution detection. However, we have observed an overwhelming over-concentration problem in our experiments, which is caused by over-confidence problem of the deep neural network to greatly hinder the detection accuracy. Therefore, we further propose to smooth the Dirichlet distribution by a calibration algorithm. Combined with the input perturbation method (Liang et al., 2017; Krizhevsky & Hinton, 2009) , our proposed variational Dirichlet framework can greatly widen the distance between in-and out-of-distribution data to achieve significant results on various datasets and architectures.

The contributions of this paper are described as follows:

• We propose a variational Dirichlet algorithm for deep neural network classification problem and define a higher-order uncertainty measure.

• We identify the over-concentration issue in our Dirichlet framework and propose a smoothing method to alleviate such problem.

2. MODEL:

In this paper, we particularly consider the image classification problem with image input as x and output label as y. By viewing the label-level distribution

P(y) = [p(y = ω 1 ), • • • , p(y = ω k )] as a random variable z = {z ∈ R k : k i=1 z i = 1}

lying on a K-dimensional simplex S k , we assume there exists an underlying higher-order distribution P(z) over such variable z. As depicted in Figure 1 , each point from the simplex S k is itself a categorical distribution P(y) over different classes. The high-order distribution P(z) is described by the probability over such simplex S k to depict the underlying generation function. By studying the statistical properties of such higher-order distribution P(z), we can quantitatively analyze its higher-order uncertainty by using entropy, mutual information, etc. Here we consider a Bayesian inference framework with a given dataset D containing data pairs (x, y) and show the plate notation in Figure 2 , where x denotes the observed input data (images), y is the groundtruth label (known at training but unknown as testing), and z is latent variable higher-order variable. We assume that the "true" posterior distribution is encapsulated in the partially observable groundtruth label y, thus it can be viewed as P(z) = p(z|y). During test time, due to the inaccessibility of y, we need to approximate such "true" distribution with the given input image x. Therefore, we propose to parameterize a posterior model p θ (z|x) and optimize its parameters to approach such "true" posterior p(z|y) given a pairwise input (x, y) by minimizing their KL-divergence D KL (p θ (z|x)||p(z|y)). With the parameterized posterior p θ (z|x), we are able to infer the higher-order distribution over z given an unseen image x * and quantitatively study its statistical properties to estimate the higher-order uncertainty. In order to minimize the KL-divergence D KL (p θ (z|x)||p(z|y)), we leverage the variational inference framework to decompose it into two components as follows (details in appendix):

EQUATION

where L(θ) is better known as the variational evidence lower bound, and log p(y) is the marginal likelihood over the label y.

EQUATION

Since the marginal distribution p(y) is constant w.r.t θ, minimizing the KL-divergence D KL (p θ (z|x)||p(z|y)) is equivalent to maximizing the evidence lower bound L(θ). Here we propose to use Dirichlet family to realize the higher-order distribution p θ (z|x) = Dir(z|α) due to its tractable analytical properties. The probability density function of Dirichlet distribution over all possible values of the K-dimensional stochastic variable z can be written as:

EQUATION

)

where α is the concentration parameter of the Dirichlet distribution and B(α)

= K i Γ(αi) Γ( k i αi)

is the normalization factor. Since the LHS (expectation of log probability) has a closed-formed solution, we rewrite the empirical lower bound on given dataset D as follows:

EQUATION

where α 0 is the sum of concentration parameter α over K dimensions. However, it is in general difficult to select a perfect model prior to craft a model posterior which induces an the distribution with the desired properties. Here, we assume the prior distribution is as Dirichlet distribution Dir(α) with concentration parameters α and specifically talk about three intuitive prior functions in Figure 3 . The first uniform prior aggressively pushes all dimensions towards 1, while the *-preserving priors are less strict by allowing one dimension of freedom in the posterior concentration parameter α. This is realized by copying the value from k th dimension of posterior concentration parameter α to the uniform concentration to unbind α k from KL-divergence computation. Given the prior concentration parameter α, we can obtain a closed-form solution for the evidence lower bound as follows:

EQUATION

Γ denotes the gamma function, ψ denotes the digamma function. We write the derivative of L(θ) w.r.t to parameters θ based on the chain-rule:

∂L ∂θ = ∂L ∂α α • ∂f θ (x)

∂θ , where is the Hardamard product and ∂f θ (x) ∂θ is the Jacobian matrix. In practice, we parameterize Dir(z|α) via a neural network with α = f θ (x) and re-weigh the two terms in L(θ) with a balancing factor η. Finally, we propose to use mini-batch gradient descent to optimize the network parameters θ as follows:

EQUATION

where B(x, y) denotes the mini-batch in dataset D. During inference time, we use the marginal probability of assigning given input x to certain class label i as the classification evidence:

p(y = i|x) = z p(y = i|z)p θ (z|x)dz = α i k j=1 α j (7)

Therefore, we can use the maximum α's index as the model prediction class during inference ŷ = arg max i p(y = i|x) = arg max i α i .

3. UNCERTAINTY MEASURE:

After optimization, we obtain a parametric Dirichlet function p θ (z|α) and compute its entropy E as the higher-order uncertainty measure. Formally, we write the such metric as follows:

E(α) = -C(α) = - z zDir(z|α)dz = log B(α) + (α 0 -K)ψ(α 0 ) - k i (α i -1)ψ(α i ) (8)

where α is computed via the deep neural network f θ (x). Here we use negative of entropy as the confidence score C(α). By investigating the magnitude distribution of concentration parameter α for in-distribution test cases, we can see that α is either adopting the prior α = 1.0 or adopting a very large value α 1.0. In order words, the Dirichlet distribution is heavily concentrated at a corner of the simplex regardless of whether the inputs are from out-domain region, which makes the model very sensitive to out-of-distribution examples leading to compromised detection accuracy. In order to resolve such issue, we propose to generally decrease model's confidence by smoothing the concentration parameters α, the smoothing function can lead to opposite behaviors in the uncertainty estimation of in-and out-of-distribution data to enlarge their margin.

Concentration smoothing:

In order to construct such a smoothing function, we experimented with several candidates and found that the log-smoothing function α = log(α + 1) can achieve generally promising results. By plotting the histogram of concentration magnitude before and after log-scaling in Figure 4 , we can observe a very strong effect in decreasing model's overconfidence, which in turn leads to clearer separation between in-and out-of-distribution examples (depicted in Figure 4 ). In the experimental section, we detail the comparison of different smoothing functions to discuss its impact on the detection accuracy.

Input Perturbation Inspired by fast gradient sign method (Goodfellow et al., 2014) , we propose to add perturbation in the data before feeding into neural networks:

EQUATION

where the parameter denotes the magnitude of the perturbation, and (x, y) denotes the input-label data pair. Here, similar to Liang et al. (2017) our goal is also to improve the entropy score of any given input by adding belief to its own prediction. Here we make a more practical assumption that we have no access to any form of out-of-distribution data. Therefore, we stick to a rule-of-thumb value = 0.01 throughout our experiments. Detection For each input x, we first use input perturbation to obtain x, then we feed it into neural network f θ (x) to compute the concentration α, finally we use log-scaling to calibrate α and compute C(α). Specifically, we compare the confidence C(α) to the threshold δ and say that the data x follows in-distribution if the confidence score C(α) is above the threshold and that the data x follows out-of-distribution, otherwise.

Smoothing:



4. EXPERIMENTS:

In order to evaluate our variational Dirichlet method on out-of-distribution detection, we follow the previous paper (Hendrycks & Gimpel, 2016; Liang et al., 2017) to replicate their experimental setup. Throughout our experiments, a neural network is trained on some in-distribution datasets to distinguish against the out-of-distribution examples represented by images from a variety of unrelated datasets. For each sample fed into the neural network, we will calculate the Dirichlet entropy based on the output concentration α, which will be used to predict which distribution the samples come from. Finally, several different evaluation metrics are used to measure and compare how well different detection methods can separate the two distributions.

4.1. IN-DISTRIBUTION AND OUT-OF-DISTRIBUTION DATASET:

These datasets are all available in Github1 .

• In-distribution: CIFAR10/100 (Krizhevsky & Hinton, 2009) and SVHN (Netzer et al., 2011) , which are both comprised of RGB images of 32 × 32 pixels. • Out-of-distribution: TinyImageNet (Deng et al., 2009) , LSUN (Yu et al., 2015) and iSUN (Xiao et al., 2010) , these images are resized to 32 × 32 pixels to match the in-distribution images.

Before reporting the out-of-distribution detection results, we first measure the classification accuracy of our proposed method on the two in-distribution datasets in Table 1 , from which we can observe that our proposed algorithm has minimum impact on the classification accuracy.

4.2. TRAINING DETAILS:

In order to make fair comparisons with other out-of-distribution detectors, we follow the same setting of (He et al., 2016 ) models on the in-distribution datasets. All models are trained using stochastic gradient descent with Nesterov momentum of 0.9, and weight decay with 5e-4. We train all models for 200 epochs with 128 batch size. We initialize the learning with 0.1 and reduced by a factor of 5 at 60th, 120th and 180th epochs. we cut off the gradient norm by 1 to prevent from potential gradient exploding error. We save the model after the classification accuracy on validation set converges and use the saved model for out-of-distribution detection.

4.3. EXPERIMENTAL RESULTS:

We measure the quality of out-of-distribution detection using the established metrics for this task (Hendrycks & Gimpel, 2016; Liang et al., 2017; Shalev et al., 2018) . ( 1 (Gal, 2016) .

We report our VGG13's performance in Table 2 and ResNet/WideResNet's performance in Table 3 under groundtruth-preserving prior, where we list the performance of Baseline Hendrycks & Gimpel (2016) , ODIN Liang et al. (2017) , Bayesian Neural Network (Gal, 2016) 2 , Semantic-Representation (Shalev et al., 2018) and Learning-Confidence (DeVries & Taylor, 2018) . The results in both tables have shown remarkable improvements brought by our proposed variational Dirichlet framework. For CIFAR datasets, the achieved improvements are very remarkable, however, the FPR score on CIFAR100 is still unsatisfactory with nearly half of the out-of-distribution samples being (Shalev et al., 2018) wrongly detected. For the simple SVHN dataset, the current algorithms already achieve close-toperfect results, therefore, the improvements brought by our algorithm is comparatively minor.

4.4. ABLATION STUDY:

In order to individually study the effectiveness of our proposed methods (entropy-based uncertainty measure, concentration smoothing, and input perturbation), we design a series of ablation experiments in Figure 5 . From which, we could observe that concentration smoothing has a similar influence as input perturbation, the best performance is achieved when combining these two methods. Here we mainly experiment with four different priors and depict our observations in Figure 6 . From which, we can observe that the non-informative uniform prior is too strong assumption in terms of regularization, thus leads to inferior detection performances. In comparison, giving model one dimension of freedom is a looser assumption, which leads to generally better detection accuracy. Among these two priors, we found that preserving the groundtruth information can generally achieve slightly better performance, which is used through our experiments.

We also investigate the impact of different smoothing functions on the out-of-distribution detection accuracy. For smoothing functions, we mainly consider the following function forms:

√ x, 3 √

x, log(1 + x), x, x 2 , Sigmoid(x) and Sof tSign(x). Here we use Sigmoid(x), Sof tSign(x) (range=[0, 1]) as baselines to investigate the impact of the range of smoothing function on the de- tection accuracy, and use x, x 2 as baselines to investigate the impact of compression capability of smoothing function on the detection accuracy. From Figure 7 , we can observe that the first three smoothing functions greatly outperforms the baseline functions. 

5. RELATED WORK:

The novelty detection problem (Pimentel et al., 2014) has already a long-standing research topic in traditional machine learning community, the previous works (Vincent & Bengio, 2003; Ghoting et al., 2008; Schlegl et al., 2017) have been mainly focused on low-dimensional and specific tasks. Their methods are known to be unreliable in high-dimensional space. Recently, more research works about detecting an anomaly in deep learning like Akcay et al. (2018) and Lee et al. (2017) (Gal & Ghahramani, 2016; 2015; Gal, 2016; Kingma et al., 2015) , which are powerful in providing stochasticity in deep neural networks by assuming the weights are stochastic. However, Bayesian Neural Networks' uncertainty measure like variational ratio and mutual information rely on Monte-Carlo estimation, where the networks have to perform forward passes many times, which greatly reduces the detection speed.

6. CONCLUSION:

In this paper, we aim at finding an effective way for deep neural networks to express their uncertainty over their output distribution. Our variational Dirichlet framework is empirically demonstrated to yield better results, but its detection accuracy on a more challenging setup like CIFAR100 is still very compromised. We conjecture that better prior Dirichlet distribution or smoothing function could help further improve the performance. In the future work, we plan to apply our method to broader applications like natural language processing tasks or speech recognition tasks.

EQUATION

B DETAILED DATASET

• CIFAR10/100 (in-distribution): The CIFAR-10 and CIFAR100 dataset (Krizhevsky & Hinton, 2009) consists of RGB images of 32 × 32 pixels. Each image is classified into 10/100 classes, such as dog, cat, automobile, or ship. The training split for both datasets is comprised of 50,000 images, while the test split is comprised of 10,000 images. • SVHN (in-distribution): The Street View Housing Numbers (SVHN) dataset (Netzer et al., 2011) consists of colored housing number pictures ranging from 0 to 9. Images are also with a resolution of 32 × 32. The official training split is comprised of 73,257 images, and the test split is comprised of 26,032 images. • TinyImageNet (out-of-distribution): The TinyImageNet dataset2 is a subset of the ImageNet dataset (Deng et al., 2009) . The test set for TinyImageNet contains 10,000 images from 200 different classes for creating the out-of-distribution dataset, it contains the original images, downsampled to 32 × 32 pixels.

• LSUN (out-of-distribution): The Large-scale Scene UNderstanding dataset (LSUN) (Yu et al., 2015) has a test set consisting of 10,000 images from 10 different scene classes, such as bedroom, church, kitchen, and tower. We downsample LSUN's original image and create 32 × 32 images as an out-of-distribution dataset. • iSUN (out-of-distribution): The iSUN dataset (Xiao et al., 2010) is a subset of the SUN dataset, containing 8,925 images. All images are downsampled to 32 × 32 pixels.

C EFFECTS ON KL-DIVERGENCE:

Here we investigate the impact of KL-divergence in terms of both classification accuracy and detection errors. By gradually increasing the weight of KL loss (increasing the balancing factor η from 0 to 10), we plot their training loss curve in Figure 8 . With a too strong KL regularization, the model's classification accuracy will decrease significantly. As long as η is within a rational range, the classification accuracy will become stable. For detection error, we can see from Figure 8 that adopting either too large value or too small value can lead to compromised performance. For the very small value η → 0, the variational Dirichlet framework degrades into a marginal log-likelihood, where the concentration parameters are becoming very erratic and untrustworthy uncertainty measure without any regularization. For larger η > 1, the too strong regularization will force both in-and outof-distribution samples too close to prior distribution, thus erasing the difference between in-and out-of-distribution becomes and leading to worse detection performance. We find that adopting a hyper-parameter of η = 0.01 can balance the stability and detection accuracy. 

D RESULTS ON CIFAR100:

Here we particularly investigate the out-of-distribution detection results of our model on CIFAR100 under different scenarios. Our experimental results are listed in (Shalev et al., 2018) 

:

https://github.com/ShiyuLiang/odin-pytorch

We use the variational ratio as uncertainty measure to perform out-of-distribution detection, specifically, we forward Bayesian deep network 100 times for each input sample for Monte-Carlo estimation.

Figures and Tables:

Figure1: An intuitive explanation of higher-order distribution and lower-order distribution and their uncertainty measures.

Figure 2: Plate Notation

Figure 3: An intuitive explanation of different prior functions.

Figure 4: Concentration and confidence distribution before and after smoothing for CIFAR10 under VGG13 architecture with iSUN as out-of-distribution dataset.

Figure 5: Ablation experiments for VGG13 architecture to investigate the impact of our proposed smoothing with CIFAR10 as in-distribution dataset and iSUN/LSUN as out-of-distribution dataset.

Figure 6: Impact of different prior distributions. The network architecture is VGG13 with CIFAR10 as in-distribution dataset and iSUN/LSUN as out-of-distribution dataset.

Figure 7: Impact of different smoothing functions. The network architecture is VGG13 with indistribution CIFAR10 dataset and out-of-distribution iSUN/LSUN dataset.

Figure 8: The training loss curve under ResNet18 on CIFAR10 dataset for different η is demonstrated on the left side, the accuracy and out-of-distirbution detection results on the right side.

Classification accuracy of Dirichlet framework on various datasets and architectures.

Table content: <table><tr><td>Dataset</td><td colspan="3">Cross-Entropy VGG13 WideResNet ResNet-18</td><td>VGG</td><td colspan="2">Ours WideResNet ResNet-18</td></tr><tr><td>CIFAR10</td><td>93.2</td><td>-</td><td>94.4</td><td>93.8 (+0.6)</td><td>-</td><td>94.8 (+0.4)</td></tr><tr><td>CIFAR100</td><td>-</td><td>81.4</td><td>-</td><td>-</td><td>81.8 (+0.4)</td><td>-</td></tr><tr><td>SVHN</td><td>96.8</td><td>96.7</td><td>-</td><td>95.9 (-0.9)</td><td>96.1 (-0.6)</td><td>-</td></tr></table>

Measures the Area Under the Precision-Recall (PR) curve, where AUPR-In refers to using in-distribution as positive class and AUPR-Out refers to using out-of-distribution as positive class. Experimental Results on VGG13 architecture, where Confidence refers to Learning Confidence algorithm (DeVries & Taylor, 2018), BNN refers to Bayesian Neural Network

Table content: <table><tr><td>) FPR at 95% TPR</td></tr></table>

Experimental results for ResNet architecture, where Semantic refers to multiple semantic representation algorithm

Table content: <table><tr><td>Model</td><td>OOD-Dataset</td><td>Method</td><td colspan="5">FPR (TPR=0.95) Error Detection AUROC AUPR AUPR In Out</td></tr><tr><td>ResNet18</td><td>iSUN</td><td>Baseline</td><td>52.6</td><td>13.6</td><td>92.4</td><td>94.6</td><td>88.9</td></tr><tr><td>CIFAR-10</td><td/><td>ODIN</td><td>22.7</td><td>9.6</td><td>96.3</td><td>97.2</td><td>95</td></tr><tr><td/><td/><td colspan="2">Semantic 21.5</td><td>9.2</td><td>96.3</td><td>97.1</td><td>94.3</td></tr><tr><td/><td/><td>Ours</td><td>13.8</td><td>8.4</td><td>97.1</td><td>97.4</td><td>96.8</td></tr><tr><td/><td>LSUN-</td><td>Baseline</td><td>50.2</td><td>12.3</td><td>93.1</td><td>94.8</td><td>90.8</td></tr><tr><td/><td>resized</td><td>ODIN</td><td>17.9</td><td>8.4</td><td>96.9</td><td>97.5</td><td>96.3</td></tr><tr><td/><td/><td colspan="2">Semantic 23</td><td>14</td><td>96</td><td>96.7</td><td>94.8</td></tr><tr><td/><td/><td>Ours</td><td>12.1</td><td>6.3</td><td>97.4</td><td>97.4</td><td>97.5</td></tr><tr><td/><td>Tiny-</td><td>Baseline</td><td>59</td><td>15.1</td><td>91.1</td><td>93.2</td><td>88.1</td></tr><tr><td/><td colspan="2">ImageNet ODIN</td><td>32.1</td><td>11.2</td><td>94.9</td><td>95.8</td><td>93.6</td></tr><tr><td/><td/><td colspan="2">Semantic 32.1</td><td>13.1</td><td>93.2</td><td>94.2</td><td>90.6</td></tr><tr><td/><td/><td>Ours</td><td>18.4</td><td>9.9</td><td>95.9</td><td>95.8</td><td>96.1</td></tr><tr><td colspan="2">WideResNet iSUN</td><td>Baseline</td><td>9.6</td><td>5.9</td><td>98</td><td>99.3</td><td>93.4</td></tr><tr><td>SVHN</td><td/><td>ODIN</td><td>1.1</td><td>2.7</td><td>99.6</td><td>99.8</td><td>99.1</td></tr><tr><td/><td/><td>Ours</td><td>0.8</td><td>1.8</td><td>99.8</td><td>99.9</td><td>99.5</td></tr><tr><td/><td>LSUN-</td><td>Baseline</td><td>9.5</td><td>5.8</td><td>98</td><td>99.3</td><td>94</td></tr><tr><td/><td>resized</td><td>ODIN</td><td>1.5</td><td>2.9</td><td>99.6</td><td>99.8</td><td>99</td></tr><tr><td/><td/><td>Ours</td><td>0.6</td><td>1.5</td><td>99.8</td><td>99.9</td><td>99.5</td></tr><tr><td/><td>Tiny-</td><td>Baseline</td><td>10.6</td><td>6.1</td><td>97.8</td><td>99.2</td><td>93.6</td></tr><tr><td/><td colspan="2">ImageNet ODIN</td><td>2.1</td><td>3.2</td><td>99.5</td><td>99.8</td><td>98.8</td></tr><tr><td/><td/><td>Ours</td><td>1.8</td><td>2.8</td><td>99.8</td><td>99.8</td><td>99.5</td></tr></table>

Therefore, we can conclude that the smoothing function should adopt two important characteristics: 1) the smoothing function should not be bounded, i.e. the range should be [0, ∞]. 2) the large values should be compressed.

Table content: <table><tr><td/><td/><td/><td/><td colspan="11">Different Smoothing functions on CIFAR10/iSUN</td><td/><td/><td/><td/><td/><td/><td/><td/><td colspan="4">Different Smoothing functions on CIFAR10/LSUN</td></tr><tr><td>100</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>100</td><td/><td/><td/><td/><td/><td/></tr><tr><td>98</td><td>97.4</td><td>97.8</td><td>98</td><td/><td/><td colspan="2">97.9</td><td>98.2</td><td>98.4</td><td/><td/><td/><td>96.8</td><td>96.8</td><td>97</td><td/><td/><td/><td>98</td><td>97.4</td><td>97.9</td><td>98.1</td><td/><td/><td colspan="2">97.7</td><td>98.1</td><td>98.4</td><td>97.1</td><td>97.7</td><td>97.9</td></tr><tr><td>90 92 94 96</td><td/><td/><td>95.3</td><td>94.1</td><td>91.7</td><td>91</td><td/><td/><td>95.9</td><td>95.1</td><td>92.5</td><td>92</td><td/><td/><td>93.3</td><td>92.7</td><td>91</td><td>90.1</td><td>92 94 96</td><td/><td/><td>95.3</td><td>94.5</td><td>91.5</td><td>90.8</td><td>95.3</td><td>94.6</td><td>91.6</td><td>91.1</td><td>93.8</td><td>93.1</td><td>91.7</td><td>90.8</td></tr><tr><td>88</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>90</td><td/><td/><td/><td/><td/><td/></tr><tr><td>86</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>88</td><td/><td/><td/><td/><td/><td/></tr><tr><td>84</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>86</td><td/><td/><td/><td/><td/><td/></tr><tr><td/><td/><td/><td colspan="2">AUROC</td><td/><td/><td/><td/><td colspan="2">AUPR-IN</td><td/><td/><td/><td/><td colspan="2">AUPR-OUT</td><td/><td/><td/><td/><td/><td colspan="2">AUROC</td><td/><td/><td>AUPR-IN</td><td>AUPR-OUT</td></tr><tr><td/><td/><td/><td/><td/><td>sqrt</td><td>cube-root</td><td colspan="2">log</td><td>linear</td><td colspan="2">square</td><td>sigmoid</td><td colspan="2">softsign</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>sqrt</td><td>cube-root</td><td>log</td><td>linear</td><td>square</td><td>sigmoid</td><td>softsign</td></tr></table>

, which propose to leverage adversarial training for detecting abnormal instances. In order to make the deep model more robust to abnormal instances, different approaches like Bekker & Goldberger (2016); Xiao et al. (2015); Li et al. (2017); Lathuilière et al. (2018) have been proposed to increase deep model's robustness against outliers during training. Another line of research is Bayesian Networks

Table content: <table/>



Table content: <table><tr><td>Model</td><td>OOD-Dataset</td><td>Method</td><td colspan="5">FPR (TPR=0.95) Error Detection AUROC AUPR AUPR In Out</td></tr><tr><td colspan="2">WideResNet iSUN</td><td>Baseline</td><td>82.7</td><td>43.9</td><td>72.8</td><td>74.2</td><td>69.2</td></tr><tr><td>CIFAR100</td><td/><td>ODIN</td><td>57.3</td><td>31.1</td><td>85.6</td><td>85.9</td><td>84.8</td></tr><tr><td/><td/><td colspan="2">Semantic 61.1</td><td>34.7</td><td>81.1</td><td>81.2</td><td>80.5</td></tr><tr><td/><td/><td>Ours</td><td>44.7</td><td>25.3</td><td>88.4</td><td>88.2</td><td>88.1</td></tr><tr><td/><td>LSUN-</td><td>Baseline</td><td>82.2</td><td>43.6</td><td>73.9</td><td>75.7</td><td>70.1</td></tr><tr><td/><td>resized</td><td>ODIN</td><td>56.5</td><td>30.8</td><td>86</td><td>86.2</td><td>84.9</td></tr><tr><td/><td/><td colspan="2">Semantic 59.1</td><td>33.5</td><td>81.4</td><td>81.8</td><td>80.6</td></tr><tr><td/><td/><td>Ours</td><td>45.9</td><td>27.3</td><td>87.9</td><td>88.1</td><td>87.9</td></tr><tr><td/><td>Tiny-</td><td>Baseline</td><td>79.2</td><td>42.1</td><td>72.2</td><td>70.4</td><td>70.8</td></tr><tr><td/><td colspan="2">ImageNet ODIN</td><td>55.9</td><td>30.4</td><td>84.0</td><td>82.8</td><td>84.4</td></tr><tr><td/><td/><td colspan="2">Semantic 59.3</td><td>31.5</td><td>82.8</td><td>81.3</td><td>81.3</td></tr><tr><td/><td/><td>Ours</td><td>51.2</td><td>28.6</td><td>86.1</td><td>84.9</td><td>86.1</td></tr></table>

Experimental results for ResNet architecture, where Semantic refers to multiple semantic representation algorithm

Table content: <table/>

Peer review (iclr2019):
 This paper proposes a new framework for out-of-distribution detection, based on variational inference and a prior Dirichlet distribution. The Dirichlet distribution is presented, and the way it is used withing the method is discussed (i.e. clipping, scaling, etc). Experiments on several datasets and comparison with the state of the art is reported and extensively discussed. The motivation of the proposed approach is clear, and I agree with the attempt to regularize the network output. The choice of the Dirichlet distribution is quite natural, as each of its samples are the prior weights of a multinomial distribution. However, some other choices are less clear (clipping, scaling, decision, and the use of a non-informative prior). The overall inference procedure appears to be advantageous in the many experiments that the authors report (several datasets, and several baselines). The first thought that came to my mind, is that out-of-distribution detection is to classification what outlier detection is to regression. Therefore, relevant and recent work on the topic deserves to be cited, for instance: S. Lathuiliere, P. Mesejo, X. Alameda-Pineda and R. Horaud, DeepGUM: Learning Deep Robust Regression with a Gaussian-Uniform Mixture Model, In ECCV, 2018. One thing that I found quite strange at first sight is the choice of clipping the parameters of the Dirichlet distribution. It is said that this is done in order to choose an appropriate prior distribution. However, the choice is not very well motivated, because what "appropriate" means is not discussed. So why do you clip to 1? What would happen if some of the alpha*s go over 1? Is it a numerical problem, a modeling problem, a convergence issue? I would also like the authors to comment on the use of a non-informative Dirichlet distribution within the KL-divergence. The KL divergence measures the deviation between the approximate a posteriori distribution and the true one. If one selects the non-informative Dirichlet distribution, this is not only a brutal approximation of the true posterior, but most importantly a distribution that does not depend on x, and that therefore cannot be truly called posterior. It is also strange to take a decision based on the maximum alpha. On the contrary, the smallest alpha should be taken, since it is the one that concentrates more probability mass to the associated corner in the simplex. Regarding the scaling function, it is difficult to grasp its motivation and effects. It is annouced that the aim of the smoothing function is to smooth the concentration parameters alpha. But in what sense? Why do they need to be smoothed? Is this done to avoid numerical/convergence problems? Is this a key part of the model? The same stands, by the way, for the form of the input perturbation. The experiments are plenty, and I appreciated the sanity check done after introducing the datasets. However, I did not manage to understand why some methods appear in some tables and not in other (for example "Semantic"). I also have the feeling that the authors could have chosen CIFAR-100 in Table 2, since most of the metrics reported are quite high (the problems are not much challenging). Regarding the parameter eta, I would say that its discussion right after Table 3 is not long enough. Specially, given the high sensitivity of this parameter, as reported in the Table of Figure 4. What is the overall interpretation of this sensitivity? From a quantitative perspective, the results are impressive, since the propose methods systematically outperforms the baselines (at least the ones reported). However, since these baselines are not the same in all experiments, CIFAR-100 is not used, and the discussion of the results could be richer, I conclude that the experimental section is not too strong. In addition to all my comments, I would say that the authors chose to exceed the standard limit of 8 pages. Even if this is allowed, the extra pages should be justified. I am affraid that there are many choices not well motivated, and that the discussion of the results is not informative enough. I am therefore not inclined to accept the paper as it is.