Title: OUT-OF-DISTRIBUTION DETECTION USING LAYER-WISE UNCERTAINTY IN DEEP NEURAL NETWORKS

Abstract: In this paper, we tackle the problem of detecting samples that are not drawn from the training distribution, i.e., out-of-distribution (OOD) samples, in classification. Many previous studies have attempted to solve this problem by regarding samples with low classification confidence as OOD examples using deep neural networks (DNNs). However, on difficult datasets or models with low classification ability, these methods incorrectly regard in-distribution samples close to the decision boundary as OOD samples. This problem arises because their approaches use only the features close to the output layer and disregard the uncertainty of the features. Therefore, we propose a method that extracts the uncertainties of features in each layer of DNNs using a reparameterization trick and combines them. In experiments, our method outperforms the existing methods by a large margin, achieving state-of-the-art detection performance on several datasets and classification models. For example, our method increases the AUROC score of prior work (83.8%) to 99.8% in DenseNet on the CIFAR-100 and Tiny-ImageNet datasets.

1. INTRODUCTION:

Deep neural networks (DNNs) have achieved high performance in many classification tasks such as image classification (Krizhevsky et al., 2012; Simonyan & Zisserman, 2014) , object detection (Lin et al., 2017; Redmon & Farhadi, 2018) , and speech recognition (Hinton et al., 2012; Hannun et al., 2014) . However, DNNs tend to make high confidence predictions even for samples that are not drawn from the training distribution, i.e., out-of-distribution (OOD) samples (Hendrycks & Gimpel, 2016) . Such errors can be harmful to medical diagnosis and automated driving. Because it is not generally possible to control the test data distribution in real-world applications, OOD samples are inevitably included in this distribution. Therefore, detecting OOD samples is important for ensuring the safety of an artificial intelligence system (Amodei et al., 2016) .

There have been many previous studies (Hendrycks & Gimpel, 2016; Liang et al., 2017; Lee et al., 2017; DeVries & Taylor, 2018; Lee et al., 2018; Hendrycks et al., 2018) that have attempted to solve this problem by regarding samples that are difficult to classify or samples with low classification confidence as OOD examples using DNNs. Their approaches work well and they are computationally efficient. The limitation of these studies is that, when using difficult datasets or models with low classification ability, the confidence of inputs will be low, even if the inputs are in-distribution samples. Therefore, these methods incorrectly regard such in-distribution samples as OOD samples, which results in their poor detection performance (Malinin & Gales, 2018) , as shown in Figure 1 .

One cause of the abovementioned problem is that their approaches use only the features close to the output layer and the features are strongly related to the classification accuracy. Therefore, we use not only the features close to the output layer but also the features close to the input layer. We hypothesize that the uncertainties of the features close to the input layer are the uncertainties of the feature extraction and are effective for detecting OOD samples. For example, when using convolutional neural networks (CNNs), the filters of the convolutional layer close to the input layer extract features such as edges that are useful for in-distribution classification. In other words, indistribution samples possess more features that convolutional filters react to than OOD samples. Therefore, the uncertainties of the features will be larger when the inputs are in-distribution samples.

Another cause of the abovementioned problem is that their approaches disregard the uncertainty of the features close to the output layer. We hypothesize that the uncertainties of the latent features close Baseline (Hendrycks & Gimpel, 2016) UFEL (ours) max softmax probability Baseline UFEL (ours) degree of uncertainty

Figure 1 : Comparison of existing and proposed methods. We visualized scatter plots of the outputs of the penultimate layer of a CNN that can estimate the uncertainties of latent features using the SVHN dataset (Netzer et al., 2011) . We used only classes 0, 1, and 2 for the training data. Classes 0, 1, 2, and OOD, indicated by red, yellow, blue, and black, respectively, were used for the validation data. We plot the contour of the maximum output of the softmax layer of the model. Left: Because the image of "204" includes the digits "2" and "0," the maximum value of the softmax output decreases because the model does not know to which class the image belongs. Right: The sizes of points in the scatter plots indicate the value of the combined uncertainties of features. We can classify the image of "204" as an in-distribution image according to the value of the combined uncertainties.

to the output layer are the uncertainties of classification and are also effective for detecting OOD samples. For example, in-distribution samples are embedded in the feature space close to the output layer to classify samples. In contrast, OOD samples have no fixed regions for embedding. Therefore, the uncertainties of the features of OOD samples will be larger than those of in-distribution samples.

Based on the hypotheses, we propose a method that extracts the Uncertainties of Features in Each Layer (UFEL) and combines them for detecting OOD samples. Each uncertainty is easily estimated after training the discriminative model by computing the mean and the variance of their features using a reparameterization trick such as the variational autoencoder (Kingma & Welling, 2013) and variational information bottleneck (Alemi et al., 2016; 2018) . Our proposal is agnostic to the model architecture and can be easily combined with any regular architecture with minimum modifications.

We visualize the maximum values of output probability and the combined uncertainties of the latent features in the feature space of the penultimate layer in Figure 1 . The combined uncertainties of the features discriminate the in-distribution and OOD images that are difficult to classify. For example, although the images that are surrounded by the red line are in-distribution samples, they have low maximum softmax probabilities and could be regarded as OOD samples in prior work. Meanwhile, their uncertainties are smaller than those of OOD samples and they are regarded as in-distribution samples in our method.

In experiments, we validate the hypothesis demonstrating that each uncertainty is effective for detecting OOD examples. We also demonstrate that UFEL can obtain state-of-the-art performance in several datasets including CIFAR-100, which is difficult to classify, and models including LeNet5 with low classification ability. Moreover, UFEL is robust to hyperparameters such as the number of in-distribution classes and the validation dataset.

2. RELATED WORK:

Methods based on the classification confidence Hendrycks & Gimpel (2016) proposed the baseline method to detect OOD samples without the need to further re-train and change the structure of the model. They define low-maximum softmax probabilities as indicating the low confidence of in-distribution examples and detect OOD samples using the softmax outputs of a pre-trained deep classifier. Building on this work, many models have recently been proposed. Liang et al. (2017) proposed ODIN, a calibration technique that uses temperature scaling (Guo et al., 2017) in the Methods based on the uncertainty Malinin & Gales (2018) attempted to solve the problem of classifying in-distribution samples close to the decision boundary as OOD samples by distinguishing between data uncertainty and distributional uncertainty. Data uncertainty, or aleatoric uncertainty (Kendall & Gal, 2017) , is irreducible uncertainty such as class overlap, whereas distributional uncertainty arises because of the mismatch between training and testing distributions. They argue that the value of distributional uncertainty depends on the difference in the Dirichlet distribution of the categorical parameter. Further, they estimate the parameter of the Dirichlet distribution using a DNN and train the model with in-distribution and OOD datasets. The motivation for our work is similar to that of Malinin & Gales (2018) . In our work, the distribution of the logit of the categorical parameters is modeled as a Gaussian distribution, which enables us to train the model without an OOD dataset. Furthermore, we estimate the parameters of the Gaussian distribution of latent features close to the input layer.

# " $ Σ " Σ " # " ) ! # ' % ' * ' * + Σ " Σ " # ) % " % " % ) Σ " Σ " * ) , -. / -. 0 -. 1 -. 2 Σ " Σ " # $ % " % " % $ Σ " Σ " * $ 3

3. PROPOSED METHOD:

In this section, we present UFEL, which extracts the uncertainties of features in each layer and combines them for detecting OOD samples. First, we use the maximum of the softmax output, as in Hendrycks & Gimpel (2016) , as one of our features. Second, we also use the distribution of the categorical parameter, as in Malinin & Gales (2018) , using the uncertainty of logits. Furthermore, we use the uncertainty of the feature extraction extracted from the latent space close to the input layer because they will not be relevant to the classification accuracy. We probabilistically model the values of these features, estimate their uncertainties, and combine them.

Let x ∈ X be an input, y ∈ Y = {1, • • • , K} be its label, and l ∈ {1, • • • , L} be the index of the block layers. The objective function of normal deep classification is as follows:

EQUATION

where p(x, y) is the empirical data distribution, L is a cross entropy loss function, and f φ is a DNN. We use the following notation

f φ = f φ L • f φ L-1 • • • • • f φ1 as shown in Figure 2.

To extract the uncertainties of features in each layer, we model the lth block layer's output z l as a Gaussian whose parameters depend on the l-1th block layer's output z l-1 as follows:

p(z l |z l-1 ) = N (z l |f µ φ l (z l-1 ), f Σ φ l (z l-1

)), where f φ l is the lth block layer, which outputs both the mean µ and covariance matrix Σ. In this paper, we use a diagonal covariance matrix to reduce the model parameters. We use the reparameterization trick (Kingma & Welling, 2013) to write z l = µ l + σ l , where

µ l = f µ φ l (z l-1 ), σ l = f Σ φ l (z l-1

), and is the Gaussian noise. Then, our objective function is as follows:

EQUATION

where z 0 = x. Because of the reparameterization trick, the loss gradient is backpropagated directly through our model, and we can train our model like the regular classification models in Equation 1.

Next, we explain the two methods of combining the features extracted in each layer. In the first method, we sum the uncertainties of each value of the features in each layer and linearly combine them. Because the feature maps of a convolutional block layer are three dimensional, each element is computed as z l ijk = µ l ijk + σ l ijk . Moreover, because the output of a fully connected layer is one dimensional, each element is formed as z l i = µ l i + σ l i . We use a weighted summation of the scale of each feature and the maximum value of the softmax scores as a final feature d LR as follows:

EQUATION

We choose the parameter λ l by training a logistic regression (LR) using in-distribution and OOD validation samples. In the second method, we combine the features directly and nonlinearly using a CNN as follows:

EQUATION

We train the CNN parameter θ with in-distribution and OOD validation samples using binary crossentropy loss. The detailed structures of the CNN are given in Table A .3. We use the values of these feature d(x) to test the performance of detecting OOD samples.

4. EXPERIMENTAL SETUP:

In this section, we present the details of the experiments, which includes the datasets, metrics, comparison methods, and models. Because of space limitations, more details are given in Appendix A.

Datasets We used several standard datasets for detecting OOD samples and classifying indistribution samples. The SVHN, CIFAR-10, and CIFAR-100 datasets were used as in-distribution datasets, whereas Tiny ImageNet (TIM), LSUN, iSUN, Gaussian noise, and uniform noise were used as OOD datasets. These data were also used in Liang et al. (2017) ; DeVries & Taylor (2018). We applied standard augmentation (cropping and flipping) in all experiments. We used 5,000 validation images split from each training dataset and chose the parameter that can obtain the best accuracy in the validation dataset. We also used 68,257 training images from the SVHN dataset and 45,000 training images from the CIFAR-10 and CIFAR-100 datasets. All the hyperparameters of ODIN and UFEL were tuned on a separate validation set, which consists of 100 OOD images from the test dataset and 1,000 images from the in-distribution validation set. We tuned the parameters of the CNN in Equation 4 using 50 validation training images taken from the 100 validation images. The best parameters were chosen by validating the performance using the rest of 50 validation images. Finally, we tested the models with a test dataset that consisted of 10,000 in-distribution images and 9,900 OOD images.

Evaluation metrics We used several standard metrics for testing the detection of OOD samples and the classification of in-distribution samples. We used TNR at 95% TPR, AUROC, AUPR, and accuracy (ACC), which were also used in Lee et al. (2017; 2018) .

Comparison method:

We compare UFEL with the baseline (Hendrycks & Gimpel, 2016) and ODIN (Liang et al., 2017) methods. For the baseline method, we used max k p(y = k|x) as the detection metric. For ODIN, we used the same detection metric and calibrated it using temperature scaling and small perturbations to the input. The temperature parameter T ∈ {1, 10, 100, 1000} and the perturbation parameter ∈ {0, 0.001, 0.005, 0.01, 0.05, 0.1} were chosen using the in-distribution and OOD validation datasets.

Model training details We adopted LeNet5 (LeCun et al., 1998) and two state-of-the-art models, WideResNet (He et al., 2016) and DenseNet (Huang et al., 2017) , in this experiment. In all experiments, we used the same model and conditions to compare UFEL with existing methods. Only the structure used to extract the variance parameters differs. For LeNet5, we increased the number of channels of the original LeNet5 to improve accuracy. See Table A .3 for model details. We inserted the reparameterization trick to the second convolutional layer and the softmax layer. LeNet5 was trained using the Adam (Kingma & Ba, 2014) optimizer for 10 epochs and the learning rate was set to 5e-4. Both DenseNet and WideResNet were trained using stochastic gradient descent, with a Nesterov momentum of 0.9. We inserted the reparameterization trick to the first convolutional block, the second convolutional block, and the softmax layer. For WideResNet, we used a WideResNet with a depth of 40 and width of 4 (WRN-40-4), which was trained for 50 epochs. The learning rate was initialized to 0.1 and reduced by a factor of 10× after the 40th epoch. For DenseNet, we used a DenseNet with depth L = 100 (Dense-BC), growth rate of 12, and drop rate of 0. DenseNet-BC was trained for 200 epochs with batches of 64 images, and a weight decay of 1e-4 for the CIFAR-10 and CIFAR-100 datasets. It was trained for 10 epochs for the SVHN dataset. The learning rate was initialized to 0.1 and reduced by a factor of 10× after the 150th epoch.

5. EXPERIMENTAL RESULTS:

In this section, we demonstrate the performance of UFEL by conducting five experiments. In the first experiment, we show that UFEL performs better than the baseline (Hendrycks & Gimpel, 2016) and ODIN (Liang et al., 2017) methods on several datasets and models. In the second experiment, we confirm that the features of UFEL have almost no relationship with the ACC. In the third experiment, we demonstrate that UFEL has a strong ability to detect OOD data, even if the number of classes of in-distribution data is small. In the fourth experiment, we confirm that UFEL is robust to the number of OOD samples, and in the fifth experiment, we test the performance of UFEL on unseen OOD datasets. The objective of these experiments is to show the uncertainties of the features obtained in each CNN layer distinguish the in-distribution and OOD data. Moreover, we obtain state-of-the-art performance for OOD sample detection by combining these features.

Detecting OOD samples on several datasets and models In this experiment, we evaluate the performance of OOD detection using Equation 3 and Equation 4. In this study, var l is used to denote σ l sum , max P is max(z L ), UFEL (LR) denotes d LR in Equation 3, and UFEL (CNN) denotes d CN N in Equation 4. We measured the detection performance using a DenseNet trained on CIFAR-100 when the iSUN dataset is used to provide the OOD images. Table 1 shows that var 1 and var 3 are strong features that, by themselves, can outperform ODIN. This indicates that the uncertainties of the feature extraction and classification are effective for detecting OOD samples. Moreover, the combination of these features yields state-of-the-art performance.

In Table 2 , we demonstrate that UFEL outperforms the baseline and ODIN methods on several datasets and models. Furthermore, UFEL is also slightly superior to them with respect to indistribution accuracy, which indicates that our model is robust to noise because of the reparameterization trick. Here, we do not report ODIN accuracy because the model of ODIN is the same as that of the baseline. We conducted this experiment three times and used the average of the results. We used the CIFAR-10, CIFAR-100, and SVHN datasets as the in-distribution datasets and the other datasets as the OOD samples. Note that our UFEL outperformed the baseline and ODIN methods by a large margin, especially when using CIFAR-100, which is difficult to classify, or LeNet5 which These results also indicate that we can discriminate in-distribution and OOD examples when using a dataset that is difficult to classify.

Detecting OOD samples while changing the number of in-distribution classes In this experiment, we show that UFEL is robust to the number of class labels. We used SVHN as indistribution dataset and changed the number of in-distribution classes in training as {0,1}, {0,1,2},..., {0,1,2,...,9}. We also used TIM, LSUN and iSUN datasets as OOD samples, and LeNet5 as a model. We compared the proposed method with the baseline and ODIN methods, as shown in Figure 4 . This graph shows the AUROC score of each model when changing the number of training data classes. As this graph shows, UFEL outperforms other methods in all cases and is robust to the number of in-distribution classes, whereas the performance of ODIN drops as the number of class labels decreases. These results suggest that UFEL is effective for small datasets because the number of samples can be decreased to one fifth of the original number when there are two in-distribution classes and the cost of label annotation is reduced.

Detecting OOD samples while changing the number of OOD samples In this experiment, we present the performance of UFEL while changing the number of OOD validation examples. All the hyperparameters of ODIN and UFEL were tuned on a separate validation set, which consists of 30, 50, and 100 OOD images in the test dataset and 1,000 images from the in-distribution validation set. As shown in Figure 5 , although UFEL (CNN) outperforms other methods including UFEL (LR) in most cases, it performs worse than ODIN in part of the results because some tuning for OOD samples is needed. Meanwhile, UFEL (LR) outperforms prior methods constantly because the number of hyperparameters is small and tuning samples are almost unneeded. Generalization to unseen OOD dataset Because OOD validation samples might not be available in practice, we used only uniform noise as the validation OOD dataset and tested the ability of our model to detect another OOD dataset. We added a binary classification as a comparison method. This method was trained using an in-distribution dataset (positive) and uniform noise (negative).

Table 3 shows that UFEL outperforms prior work in all cases and generalize well. Table 3 also indicates that the binary classification method does not generalize well because it cannot distinguish in-distribution dataset and OOD datasets TIM, LSUN, and iSUN, although it can distinguish Gaussian noise, which is similar to uniform noise. 

6. CONCLUSION AND FUTURE WORK:

In this paper, we demonstrated that the uncertainties of features extracted in each hidden layer are important for detecting OOD samples. We combined these uncertainties to obtain state-of-the-art OOD detection performance on several models and datasets. The approach proposed in this paper has the potential to increase the safety of many classification systems by improving their ability to detect OOD samples. In future work, our model could be used in an unsupervised model by training it to minimize reconstruction error, which would avoid the need to use in-distribution labels to detect OOD samples. Furthermore, although we compared our model with ODIN, UFEL will perform better if we combine UFEL with ODIN because they are orthogonal methods.

:



Figures and Tables:

Figure 2: Network structure of UFEL when using DenseNet. Black arrow: Extracting the variance of latent features using the reparameterization trick. Blue arrow: Combining these features.

Figure3: Plot of ACC (x-axis) and AUROC (y-axis). The number on the plot indicates the number of training epochs. We used CIFAR-10 (as in-distribution), TIM (as OOD), and the DenseNet-BC model. This graph shows that the AUROC of UFEL is less related to ACC than those of the baseline and ODIN.

Figure 4: Plot of AUROC (y-axis) when changing the number of in-distribution dataset classes (xaxis). We used SVHN as in-distribution dataset, TIM, LSUN, and iSUN as OOD datasets, and the LeNet5 model. All plots were averaged over three runs and the error bar indicates one standard deviation.

Figure5: Plot of AUROC (y-axis) when changing the OOD dataset (x-axis). We used CIFAR-10 and CIFAR-100 as the in-distribution dataset. All plots are averaged over three runs and the error bar indicates one standard deviation.

Results for the OOD detection test set data for image classification when the in-distribution dataset is CIFAR-100 and the OOD dataset is iSUN. We trained Dense-BC for each method under the same conditions. All results are averaged over three runs ± one standard deviation. All values are percentages, and the best results are indicated in bold.

Table content: <table><tr><td>Method</td><td>ACC</td><td colspan="2">TNR at TPR 95% AUROC</td><td>AUPR-In AUPR-Out</td></tr><tr><td>Baseline</td><td colspan="2">71.1±0.2 10.5±1.6</td><td colspan="2">61.7±5.4 65.4±6.5 57.1±3.9</td></tr><tr><td>ODIN</td><td/><td>43.4±10.4</td><td colspan="2">85.1±5.7 86.6±5.8 82.9±6.0</td></tr><tr><td>max P</td><td colspan="2">71.6±0.4 12.3±1.7</td><td colspan="2">63.9±4.1 67.8±4.9 59.2±2.9</td></tr><tr><td>var 1</td><td/><td>79.7±3.8</td><td colspan="2">93.9±0.9 92.8±0.8 94.7±0.9</td></tr><tr><td>var 2</td><td/><td>35.2±10.0</td><td colspan="2">79.4±2.9 79.8±2.0 77.5±4.6</td></tr><tr><td>var 3</td><td/><td>54.7±10.9</td><td colspan="2">90.8±2.5 92.4±2.1 87.4±3.4</td></tr><tr><td>UFEL (LR)</td><td/><td>93.1±0.7</td><td colspan="2">98.6±0.1 98.7±0.1 98.5±0.1</td></tr><tr><td>UFEL (CNN)</td><td/><td>99.3±0.5</td><td colspan="2">99.8±0.1 99.8±0.1 99.8±0.1</td></tr></table>

AUROC score for OOD detection test set data. All results are averaged over three runs. All values are percentages and the best results are indicated in bold. Gaussian 100.0/ 90.4 / 98.2 / 99.9 /100.0 100.0/ 92.6 / 99.2 / 99.9 /100.0 CIFAR-100 TIM 46.3 / 63.2 / 81.5 / 97.1 / 98.1 67.0 / 61.5 / 77.2 / 94.1 / 94.4 LSUN 47.1 / 65.2 / 85.2 / 98.0 / 98.8 73.4 / 62.4 / 79.3 / 94.5 / 94.7 iSUN 46.9 / 63.8 / 83.0 / 97.5 / 98.7 70.0 / 61.7 / 78.2 / 94.7 / 95.1 Gaussian 100.0/ 60.2 / 89.0 / 99.4 /100.0 100.0/ 84.7 / 99.3 /100.0/100.0

Table content: <table><tr><td>AUROC</td><td/><td>WRN-40-4</td><td>Dense-BC</td></tr><tr><td>In-dist</td><td>OOD</td><td colspan="2">Binary / Baseline / ODIN / UFEL (LR) / UFEL (CNN)</td></tr><tr><td>CIFAR-10</td><td>TIM</td><td>41.3 / 84.6 / 94.6 / 98.0 / 98.7</td><td>71.2 / 90.5 / 96.3 / 96.6 / 97.8</td></tr><tr><td/><td>LSUN</td><td>40.8 / 87.5 / 96.7 / 98.5 / 99.3</td><td>75.1 / 92.2 / 97.5 / 97.1 / 97.9</td></tr><tr><td/><td>iSUN</td><td>42.1 / 87.1 / 96.6 / 98.0 / 99.3</td><td>75.4 / 92.1 / 97.4 / 97.8 / 98.4</td></tr></table>

Peer review (iclr2020):
This paper tackles out-of-distribution samples detection via training VAE-like networks. The key idea is to inject learnable Gaussian noise to each layer across the network in the hope that the variance of the noise correlates well with the uncertainty of the input features. The network is trained to minimize the empirical loss subject to noise perturbation. The paper is well written, and the background is introduced clearly. As I understand it, the goal of *out-of-distribution sample detection* is to train a deep network that simultaneously generalizes well and also be discriminative to outliers. However, it’s not clear to me why the proposed method server this purpose; empirical results are not convincing either. My major concerns are as follows: First of all, from my intuition, it would be much easier to train deterministic networks than their counterparts with randomness. Empirically, researchers also often observe near-zero training loss for large deterministic networks such as Dense-BC trained on simple CIFAR/SVHN datasets. Especially, in this case, the training goal is simply to map higher-dimensional inputs to lower-dimensional classification categories. That being said, one would expect the variances go to zero at convergence to achieve lower empirical loss in the case of no additional diversity (or uncertainty) promotion terms. It is not clear to me how to avoid degenerate solutions at convergence while maintaining good testing performance with the proposed training strategy. From the empirical results, it also appears that all models reported might not be fully optimized? The baseline results are significantly worse than those reported in previous work. Specifically, in table 1, the testing accuracy of Dense-BC trained on CIFAR-100 is only 71.6. In table 2, the reported testing accuracy on CIFAR-10 using Dense-BC is 92.4. However, the results of DenseNet-BC (k=12, L=100, table 2) reported in the original paper are: CIFAR10 94.0 (also leave 5K examples as validation set) CIFAR100 75.9 Meanwhile, the reported accuracy of WRN-40-4 trained on CIFAR-10 and CIFAR-100 are 89.6 and 66.0, respectively. However, the corresponding baseline numbers in the original WRN paper are much higher, CIFAR-10 95.03 CIFAR-100 77.11 Could the authors comment on that? References: Gao Huang, Zhuang Liu, Laurens van der Maaten, Kilian Q. Weinberger. Densely Connected Convolutional Networks https://arxiv.org/abs/1608.06993 Sergey Zagoruyko, Nikos Komodakis. Wide Residual Networks. https://arxiv.org/pdf/1605.07146.pdf