Title: ZERO-SHOT OUT-OF-DISTRIBUTION DETECTION WITH FEATURE CORRELATIONS

Abstract: When presented with Out-of-Distribution (OOD) examples, deep neural networks yield confident, incorrect predictions. Detecting OOD examples is challenging, and the potential risks are high. In this paper, we propose to detect OOD examples by identifying inconsistencies between activity patterns and class predicted. We find that characterizing activity patterns by feature correlations and identifying anomalies in pairwise feature correlation values can yield high OOD detection rates for far-from-distribution examples. We identify anomalies in the pairwise feature correlations by simply comparing each pairwise correlation value with its respective range observed over the training data. Unlike many approaches, this can be used with any pre-trained softmax classifier and does not require access to OOD data for fine-tuning hyperparameters, nor does it require OOD access for inferring parameters. The method is applicable across a variety of architectures and vision datasets and, for the important and surprisingly hard task of detecting far-from-distribution outliers, it generally performs better than or equal to state-ofthe-art OOD detection methods (including those that do assume access to OOD examples). 1

1. INTRODUCTION:

Even when deep neural networks (DNNs) achieve impressive accuracy on challenging tasks, they do not always visibly falter on misclassified examples: in those cases they can often make predictions that are both very confident and completely incorrect. Yet, predictive uncertainty is essential in real-world contexts tolerating minimal error margins such as autonomous vehicle control and medical, financial and legal fields.

In this work, we focus on flagging test examples that do not contain any of the classes modeled in the train distribution. Such examples are often referred to as being out-of-distribution (OOD), and while their existence has been well-known for some time, the challenges of identifying them and a baseline method to do so in a variety of tasks such as image classification, text classification, and speech recognition were presented by Hendrycks and Gimpel (2017) . Recently, Nalisnick et al. (2019a) identified a similar problem with generative models: they demonstrate that flow-based models, VAEs, and PixelCNNs cannot distinguish images of common objects such as dogs, trucks, and horses (i.e. CIFAR-10) from those of house numbers (i.e. SVHN), assigning a higher likelihood to the latter when the model is trained on the former. They report similar findings across several other pairs of popular image datasets.

While we might expect neural networks to respond differently to OOD examples than to in-distribution (ID) examples, exactly where and how to find these differences in activity patterns is not at all clear. Hendrycks and Gimpel (2017) and others (Nguyen et al., 2015; Yu et al., 2011) showed that looking at the maximal softmax value is insufficient. In Section 2 we describe some other recent approaches to this problem. In this work, we find that characterizing activity patterns by feature correlationscomputed with an extension of Gram matrices that we introduce-lets us quantify anomalies to allow state-of-the-art (SOTA) detection rates on OOD examples.

Intuition. We identify out-of-distribution examples by jointly considering the class assigned at the output layer and the activity patterns in the intermediate layers. For example, if an image is predicted to be a dog, yet the intermediate activity patterns are somehow atypical of those seen by the network for other dog images during training, then that is a strong indicator of an OOD example. This effectively allows us to detect incongruence between the prediction made by the network and the path by which it arrived at that prediction.

Strengths. Unlike those previous works that assume access to OOD examples and train an auxiliary classifier for identifying anomalous activity patterns, our method finds differences in activity patterns without requiring access to any OOD examples, and it works across architectures. We hope this will also help further our understanding of how neural networks respond differently to OOD examples in general, not just how a particular network responds to examples coming from a particular distribution.

Contributions. This work includes the following contributions:

1. We extend Gram matrices to compute effective feature correlations.

2. Using the p th -order Gram matrices, we present a new technique for computing classconditional anomalies in activity patterns.

3. We evaluate this technique on OOD detection, testing on • competitive architectures: DenseNet, ResNet;

• benchmark OOD datasets including: CIFAR-10, CIFAR-100, SVHN, TinyImageNet, LSUN and iSUN.

4. Zero-shot: crucially, our method does not require access to OOD samples for tuning hyperparameters or for training auxiliary models.

5. Nevertheless, we report results which, for the challenging and important cases of far-fromdistribution examples, are generally better than or equal to the state-of-the-art method for OOD detection that does require access to OOD examples.

2. RELATED WORK:

Previous work which aims to improve OOD detection can be roughly grouped by several themes:

Bayesian Neural Networks. A nice early Bayesian approach (Gal and Ghahramani, 2016) estimates predictive uncertainty by using an ensemble of sub-networks instantiated by applying dropout at test time. As opposed to implicitly learning a distribution over the predictions by learning a distribution over the weights, Chen et al. (2019) and Malinin and Gales (2018) explicitly parameterize a Dirichlet distribution over the output class distributions using DNNs in order to obtain a better estimate of predictive uncertainty; the main differences between these methods is that Chen et al. (2019) use ELBO, which only requires the in-distribution dataset for training whereas Malinin and Gales (2018) use a contrastive loss which requires access to (optionally synthetic) OOD examples.

Using any pre-trained softmax deep neural network with OOD examples. Lee et al. (2018b) to the best of our knowledge, the current SOTA technique by a significant margin-compute the Mahalanobis distance between the test sample's feature representations and the class-conditional gaussian distribution at each layer; they then represent each sample as a vector of the Mahalanobis distances, and finally train a logistic regression detector on these representations to identify OOD examples. Another technique in this category is ODIN (Liang et al., 2018) : they use a mix of temperature scaling at the softmax layer and input perturbations to achieve better results. In fact, both Lee et al. (2018b) and Liang et al. (2018) add small input perturbations to achieve better results; the former do so to increase the confidence score, while the latter do so to increase the softmax score. Recently, Quintanilha et al. (2019) achieve results comparable to that of Lee et al. (2018b) by training a logistic regression detector that looks at the means and standard deviations of various channels activations. Unlike the previous two techniques, Quintanilha et al. (2019) achieves comparable results even without the use of input perturbations, which allows it to be applicable to non-continuous domains. Our work, too, does not involve input perturbations.

All of these techniques depend on OOD examples for fine-tuning hyperparameters (Liang et al., 2018) or for training auxiliary OOD classifiers (Lee et al. (2018b) ; Quintanilha et al. (2019) ). Furthermore, these classifiers neither transfer between one non-training distribution and another, nor do they transfer between networks, so separate classifiers must be trained for each (In-Distribution, OOD, Architecture) triplet. In many real-world applications, this is infeasible: we cannot assume advance access to all possible OOD distributions. Our work does not require access to OOD samples. 

3. EXTENDING GRAM MATRICES FOR OUT-OF-DISTRIBUTION DETECTION:

Overview In light of the above considerations, we are interested in proposing a method that does not require access to any OOD examples, that does not introduce hyperparameters that need tuning, and that works across architectures. Gram matrices can be used to compute pairwise feature correlations, and are often used in DNNs to encode stylistic attributes like textures and patterns (Gatys et al., 2016) . We extend these matrices as will be described below, and then use them to compute class-conditional bounds of pairwise feature correlations at multiple layers of the network. Starting with a pre-trained network, we compute these bounds over only the training set, and can then use them to effectively discriminate between in-distribution samples and out-of-distribution samples at test time. Unlike other SOTA algorithms, we do not need to "look" at any out-of-distribution samples to tune any parameters; the only tuning required is that of a normalizing factor, which we compute using a randomly-selected validation partition of the (in-distribution) test set.

Notation If the considered deep convolutional network has L layers and the l th layer has n l channels, we consider feature co-occurrences between the 1<=l<=L

n l * (n l +1) 2

pairs of featuremaps. (Note that by "layer" we refer to any set of values obtained immediately after applying convolution or activation functions.) We use the following notation:

F l (D)

The feature map at the l-th layer for input image D; when referring to an arbitrary image D, we just write F l . It can be stored in a matrix of dimensions n l × p l , where n l is the number of channels at the l-th layer and p l , the number of pixels per channel, is the height times the width of the feature map.

D c /f (D)

The predicted class for input image Gram Matrices and Higher order Gram Matrices We compute pairwise feature correlations between channels of the l-th layer using the Gram matrix:

G l = F l F l (1)

where F l is an n l × p l matrix as defined above.

In order to compute feature correlations with more prominent activations of the feature maps, we define a higher-order gram matrix, which we write G p l , to be a matrix computed identically to the regular Gram matrix, but where, instead of using a raw channel activation a, we use a p , the p th power of each activation. G p l is therefore computed using F p l , where the power of F l is computed element-wise; in an effort to retain uniform scale across all orders of Gram matrices for a given layer, we compute the (element-wise) p-th root. The p-th order gram matrix is thus computed as:

G p l = F p l F p l 1 p (2)

We show in Section 5 that higher p values help significantly in improving the OOD detectability.

In our experiments, we limit the value of p to 10, as exponents beyond 10 are not worth the extra computation that is needed to avoid overflow errors2 .

The flattened upper (or lower) triangular matrix along with the diagonal entries is denoted as G p l . The set of all orders of gram matrices (in our case {1, . . . 10}) to be considered is denoted by P . The schematic diagram of the proposed algorithm is shown in Fig. 15 (in Appendix A ).

Preprocessing If we compute G p l for every layer l and every order p ∈ P , we obtain a total of .

N S = p∈P L l=1

Since each layer has different number of channels, the 4-th dimension has been large enough to accommodate the layer with the highest number of channels. 

for i in 1, n l (n l +1) 2 do 10: Mins[c][l][p][i] = min(Mins[c][l][p][i],stat[i]) 11: Maxs[c][l][p][i] = max(Maxs[c][l][p][i],stat[i]) 12: return Mins, Maxs

Computing Layerwise Deviations Given the class-specific minimum and maximum values of the N S feature correlations, we can compute the deviation of the test sample from the images seen at train time with respect to each of the layers. In order to account for the scale of values, we compute the deviation as the percentage change with respect to the maximum or minimum values of feature co-occurrences; the deviation of an observed correlation value from the minimum and maximum correlation values observed during train time can be computed as:

δ(min,max,value) =      0 if min ≤ value ≤ max min-value |min| if value < min value-max |max| if value > max (3)

The deviation of a test image with respect to a given layer l is the sum total of the deviations with respect to each of the p∈P 1 2 n l (n l + 1) correlation values:

EQUATION

Total Deviation of a test image D (∆(D)), is computed by taking the sum total of the layerwise deviations (δ l (D)). However, the scale of layerwise deviations (δ l ) varies with each layer depending on the number of channels in the layer, number of pixels per channel and semantic information contained in the layer. Therefore, we normalize the deviations by dividing it by E Va [δ l ], the expected deviation at layer δ l , computed using the validation data. Note that we use the same normalizing factor irrespective of the class assigned.

EQUATION

Threshold As is standard (Lee et al., 2018b) , a threshold, τ , for discriminating between out-ofdistribution data and in-distribution data is computed as the 95th percentile of the total deviations of test data (∆(D)). In other words, the threshold is computed so that 95% of test examples have deviations lesser than the threshold τ ; the threshold-based discriminator can be formally written as:

isOOD(D) = True if ∆(D) > τ, False if ∆(D) ≤ τ (6)

Computational Complexity. In order to reduce computational time, we can in fact compute deviations based on row-wise sums rather than individual elements. This would mean that the variable stat, defined in line 8 of Algorithm 1, would now contain row-wise sums of G p l instead of the flattened upper triangular matrix; the inner loop of Eq. 4 would loop over n l elements instead of 1 2 n l (n l + 1) elements while also reducing the storage required for Mins and Maxs. In practise, we found that computing the anomalies this way yields differences of less than 0.5%, and usually imperceptible, so the results described in the next section were computed in this way.

4. EXPERIMENTS -DETECTING OOD:

In this section, we demonstrate the effectiveness of the proposed metric using competitive deep convolutional neural network architectures such as DenseNet and ResNet on various computer vision benchmark datasets such as: CIFAR-10, CIFAR-100, SVHN, TinyImageNet, LSUN and iSUN.

For fair comparison and to aid reproducibility, we use the pretrained ResNet (He et al., 2016) and DenseNet (Huang et al., 2017 ) models open-sourced by Lee et al. (2018b) , i.e. ResNet34 and DenseNet3 models trained on CIFAR-10, CIFAR-100 and SVHN datasets. For each of these models, we considered the corresponding test partitions as the in-distribution (positive) examples. For CIFAR-10 and CIFAR-100, we considered the out-of-distribution datasets used by Lee et al. (2018b) : TinyImagenet, LSUN and SVHN. Additionally, we also considered the iSUN dataset. For ResNet and DenseNet models trained on SVHN, we used considered CIFAR-10 dataset as the third OOD dataset. Details on these datasets are available in Appendix B. (Malinin and Gales, 2018) Semantic (Shalev et al., 2018) Variational Dirichlet (Chen et al., 2019) Mahalanobis (Lee et al., 2018b) ODIN (Liang et al., 2018) OE (Hendrycks et al., 2019a) Baseline (Hendrycks and Gimpel, 2017) We benchmark our algorithm with the works listed in Table 1 using the following metrics:

1. TNR@95TPR is the probability that an OOD (negative) example is correctly identified when the true positive rate (TPR) is as high as 95%. TPR can be computed as T P R = T P/(T P + F N ), where TP and FN denote True Positive and False Negative respectively.

2. Detection Accuracy measures the maximum possible classification accuracy over all possible thresholds in discriminating between in-distribution and out-of-distribution examples. For those methods which assign a higher-score to the in-distribution examples, it can be calculated as

max τ {0.5P in (f (x) ≥ τ ) + 0.5P out (f (x) < τ )};

for those methods which assign a lower score to in-distribution examples, it can be calculated as

max τ {0.5P in (f (x) ≤ τ ) + 0.5P out (f (x) > τ )}.

3. AUROC is the measure of the area under the plot of TPR vs FPR. For example, for those methods which assign a higher score to the in-distribution examples, this measures the probability that an OOD example is assigned a lower score than an in-distribution example.

Experimental setup: We use a pre-trained network to extract class-specific minimum and maximum correlation values for all pairs of features across all orders of gram matrices. Subsequently, the total deviation is computed for each example following Eq. 5. Since the total deviation values depend on the randomly selected validation examples, we repeat the experiment 10 times to get a reliable estimate of the performance. The OOD detection performance for several combinations of model architecture, in-distribution dataset and out-of-distribution dataset are shown in Table 2 . The results for Outlier Exposure (OE) are available in Table 3 ; some more results for OE and the results for DPN, Variational Dirichlet and Semantic are available in Appendix E.1 and Appendix E.2 respectively.

The results of Table 2 show that at a glance, over a total of 24 combinations of model architecture/indistribution-dataset/out-of-distribution-datasets, the proposed method outperforms the previous competing methods in 15 of them, is on par in 6 of them, and gives second highest results on 3 of them3 . Furthermore, it does so without requiring access to samples from the OOD dataset. If the hyperparameters and/or parameters of Mahalanobis and ODIN algorithms are fine-tuned using FGSM adversarial examples instead of the real OOD examples, their performance decreases. We also observe that our performance is similar for both architectures.

We also performed experiments with fully-connected networks by using three different MLP architectures trained on MNIST; Fashion-MNIST (Xiao et al., 2017) and KMNIST (Clanuwat et al., 2018) were considered as the out-of-distribution datasets (Results are provided in Appendix E.3).

In (Hendrycks et al., 2019a) . Since OE uses a different model from ours, we also report the corresponding baseline accuracy. We extract the mean TNR @ TPR95 for our technique by considering both ResNet and DenseNet models. Some more results are available in Appendix E.1.

Near-distribution Outliers The metric does not perform well for near-distribution outliers (for example, CIFAR10 vs CIFAR100) -the detailed results can be seen in Table 4 ; a recent work which performs very well for near-distribution outliers and yet does not require knowledge of OOD distribution is Hendrycks et al. (2019b) .

Source of Performance Gain:

The above results are obtained when we consider all elements of gram matrix (Algorithm 1), compute deviations from extrema (Eq 3) and finally, compute the total deviation with normalized layerwise deviations (Eq 5). In order to better understand the source of performance gain, we conduct a detailed ablation study that considers alternative choices for the three steps outlined before; the alternative choices are chosen in order to answer the following questions: Q1) What if strictly diagonal elements or strictly off-diagonal elements are considered instead of complete Gram Matrix?; Q2) What happens if the deviation is computed from the mean instead of the extrema?; Q3) What happens if we do not normalize the layerwise deviations? In all, we conduct 12 experiments: 3 choices for Q1 × 2 choices for Q2 × 2 choices for Q3. As a broad summary, we find that, while there is no single rule that is unbroken by an exception, our proposed combination-i.e. using the complete Gram matrix, using the min/max metric, and using normalization as in Eq 5-is generally more robust than any of the other combinations that we tried. More details on the ablation tests and discussions are available in Appendix C.

5. DISCUSSION AND CONCLUSION:

Beyond explicit OOD detection, this line of work may ultimately help better interpret neural networks' responses to OOD examples. With this goal in mind, and at the same time to clarify the internal mechanism of our method, we perform tests to address the following two questions:

1. Which representations are most useful? In order to examine the role of the depth at which we compute G in detecting OODs, we construct detectors which make use of correlations derived from just one residual or dense block at a time; however, all orders of gram matrices are considered. Representative results are shown in Figure 1 . For all combinations of model/in-distribution/out-of-distribution-dataset, we find that the lower level representations are much more informative in discriminating between in-distribution and out-of-distribution datasets. However, the difference in detective power depends on the in-distribution dataset considered: for example, the difference in detective power between higher-level representations and lower-level representations is bigger for Cifar-100 than for Cifar-10. More graphs are available in Appendix C.1.

2. Which orders of gram matrices are most useful? In order to understand which orders of gram matrices are most helpful in detecting OODs, we construct detectors which make use of only one order of gram matrix at a time; however, correlations are derived from the representations of all residual and dense blocks. Representative results are shown in Figure 2 . For all combinations of model/in-distribution/out-of-distribution-dataset, we find that the higher order gram matrices are much more informative in discriminating between in-distribution and out-of-distribution datasets. Ignoring the variations at orders greater than 4, we find that the TNR @ 95TPR increases with higher orders and finally saturates. More graphs are available in Appendix C in Figure 4 to 9.

Conclusion.:

Out-of-distribution detection is a challenging and important problem. We have proposed and reported on a relatively simple OOD detection method based on pairwise feature correlations that gives new state of the art detection results without requiring access to anything other than the training data itself. A SCHEMATIC DIAGRAM Pairwise Correlations between the feature-maps of every layer are computed using Gram matrices of various orders. In the preprocessing stage, the class-specific element-wise minimum and maximum values are noted for each of the gram-matrices.

Total deviation ( ) is computed by summing across the deviations of all the layers. However, since the scale of deviations of each layer are different, we normalize by dividing it with , the expected deviation at layer , computed using the Validation Data. 2. LSUN, the Large-scale Scene UNderstanding dataset (Yu et al., 2015) has 10,000 test images from 10 different scenes. Each image is downsampled to size 32 x 32 and all 10,000 images are used, as given in the opensourced version by Liang et al. (2018) .

3. iSUN, a subset of SUN images (Xiao et al., 2010) , consists of 8925 images. Each image is downsampled to size 32 x 32 and is used; the downsampled version of the dataset has been opensourced by Liang et al. (2018) .

4. SVHN, the Street View House Numbers dataset (Netzer et al., 2011) , involves recognizing digits 0-9 in natural scene images. The test partition consisting of 26,032 images is used.

C DETAILED ABLATION RESULTS:

The results in the main paper correspond to the performance obtained when considering:

1. Feature Set: all gram matrix entries 2. Metric: layerwise deviations computed with respect to the mins and maxs.

3. Aggregation Scheme: the total deviation is then computed using Eq 5.

In this section, detailed ablation results are reported by considering other options. Specifically:

1. Alternate Feature Set: In addition to considering all gram matrix entries, we consider a proper partition of the gram matrix: strictly diagonal elements, and strictly off-diagonal elements. The diagonal elements correspond to the unary features, while the off-diagonal elements correspond to pairwise features. This can be done by appropriately changing the definition of variable stat in Line 7 of Algorithm 1. In these experiments, we consider row-wise sums wherever the size of stat is O(n 2 ); in other words, we consider row-wise sums when considering off-diagonal elements and all gram matrix entries.

2. Alternate Metric: An alternative formulation for computing feature-wise deviations can be to compute the deviation from the means using the one-dimensional Mahalanobis distance.

In the preprocessing stage, this would be done by storing the Means and Variances of stat (feature-wise) instead of their Mins and Maxs. Under this new alternative, the function δ defined in Eq 3 would be redefined as:

δ(mean,variance,value) = (value -mean) 2 variance (7)

Accordingly, the layerwise deviation δ l can be defined as:

EQUATION

where G p l (D) would correspond to the statistic chosen in the previous step: diagonal entries only, row-wise sums of off-diagonal entries only or row-wise sums of complete gram matrix. We thus consider 2 options for computing the deviations: the Min/Max method presented in the main paper and the Mean/Variance method (Gaussian) described above.

3.. Alternate Aggregation Scheme::

In order to compute the total deviation ∆ from the layerwise deviations δ l , we can compute it by following 5 or taking a simple sum as shown:

EQUATION

We refer to Eq 5 as the normalized estimate and Eq 9 as the unnormalized estimate.

In all, the By analysing the ablation results, we attempt to answer the following questions:

1. Are pairwise features more useful than unary features? We observe that the Min/Max metric can work equally well with both unary and pairwise features; in some cases, the unary features are marginally better (Ex: ResNet/CIFAR-10 vs SVHN) and in some cases, the pairwise features are marginally better (Ex: ResNet/CIFAR-100 vs iSUN/LSUN/TinyImgNet). Interestingly, the behavior of the Mean/Var metric is different: the performance with pairwise features are significantly higher than with unary features in 19 out of 28 tested cases. For example, the TNR at TPR95 for ResNet/CIFAR-100 vs TinyImgNet is 68.0 with unary features and 84.2 with pairwise features.

We notice that using the unary features (diagonal entries) sometimes did well when pairwise features (off-diagonal entries) did not do well, and vice versa, so using both gives the kind of effect that we want in an ensemble: models that cover and work well over different parts of the space. Therefore, an overall message of our experiments is that it is worthwhile to consider all elements of the gram matrix.

2. Is it neccessary to use Min/Max metric? Except in 6 cases (ResNet: CIFAR-10 vs CIFAR-100, ResNet: CIFAR-100 vs CIFAR-10, DenseNet: CIFAR-10 vs CIFAR-100, DenseNet: CIFAR-100 vs CIFAR-10, ResNet: SVHN vs CIFAR-10 and DenseNet: SVHN vs CIFAR-10), the min/max metric consistently performs better than the mean/var metric. Additionally, it is not clear if the Mean/Var estimate performs better with normalized sums or unnormalized sums: for example, observe that Mean/Var estimate performs very poorly with the unnormalized estimate for ResNet/CIFAR-100, while the performance of Mean/Var for DenseNet/CIFAR-100 is competitive with the performance of Min/Max only when an unnormalized estimate is computed.

One can observe that computing the one-dimensional Mahalanobis distance for each component of the statistic derived from the Gram Matrix and later computing the total sum is equivalent to representing each input image by a big vector (say, Z) derived from the Gram Matrices computed across various layers, constructing class-conditional distributions of Z (assuming that each component of Z is normally distributed and independent of the other components) and subsequently computing the probability of an unseen Z. In early research, we noticed the following problems with the Mean/Var estimate:

(a) The individual components of gram matrices do not follow normal distribution strictly and Mean/Var assigns lower probabilities to the in-distribution images as well.

(b) The total deviation ∆ -computed by simply summing across the layerwise deviations, δ l -was not able to accurately summarize the information contained in the different δ l s. Specifically, information about the layer where the input example had a higher deviation was lost when a simple sum was taken.

The proposed Min/Max idea solves problem (a) by employing a weaker metric: deviation from extrema instead of the mean. It can also be said that the Min/Max metric considers a uniform probability density between the extrema. Problem (b), which exists even for this newer metric, is solved by the normalization scheme described in the main paper for computing the sum total deviation.

Higher Order Gram Matrices:

The Min/Max metric is a weak approximation to the true probability density. On conducting a thorough analysis of how the OOD examples were able to fool the metric, it appeared that the intermediate features had several tiny activations that could yield innocuous correlation values. Higher-order gram matrices as described in the main paper provide a natural way to mitigate these effects.

Notable observations from Figures 4 through 9 (all layers are considered but only one order of gram matrix is considered at a time):

• Ensemble effect: In 24/28 cases, higher order gram matrices improve detection rates. Higher order gram matrices help both the Min/Max and the Mean/Var metrics. In most cases, the even powers are more helpful than the odd powers; in some cases, the odd powers are more helpful (Ex: DenseNet/CIFAR-100 vs CIFAR-10). Despite these variations, it is possible to get an ensemble effect by considering all possible powers as demonstrated in the main paper.

• In ResNet:CIFAR-10 vs CIFAR-100 and DenseNet:CIFAR-10 vs CIFAR-100, the higher order gram matrices yield lower detection rates. We find these exceptions interesting, and would like to understand them better in future.

Summary:

The unambiguous message from this ablation study is that the Gram matrix contains useful information which can be used for detecting OOD examples. While the standard Mean/Variance metric does not always work well, the proposed Min/Max metric yields consistent performance competitive with state-of-the-art methods. The use of higher-order Gram matrices further boosts the overall performance. Although the Min/Max method can work very well for "far-from-distribution" examples, it does not work well when a fine grained estimate is needed (for example, CIFAR-10 vs CIFAR-100). We hope the strong empirical proof that Gram matrices contain useful information can motivate the development of OOD detectors with powerful density estimators; eventually, such estimators might not need higher-order Gram matrices to boost their performance. Here they allow us to propose a metric based on simple thresholding that, generally, works independently of the particular OOD examples and independently of the architecture, and we believe that the fact that this is the case-the fact that this approach scores relatively well-itself raises several interesting new questions. We hope that answering these questions will ultimately strengthen our understanding of deep neural networks and give rise to more robust neural network models in the future. 

:

The code for this work is available at https://github.com/zeroshot-ood/ood-detection

The maximum activation values observed in the convolution layers of a ResNet trained on Cifar-10 (opensourced byLee et al. (2018b)) are 6.5 and 6.3 on train and test partitions.

This is based on the TNR at TPR 95% value; AUROC and Detection Accuracy results are comparable.

Figures and Tables:

n l (n l + 1) correlations for any image D. The preprocessing involves computing the class-specific minimum and maximum values for the correlations: for every class c, the minimum and maximum values for each of the N S correlations are computed over all training examples D classified as c. We keep track of the minimum and maximum values of the N S correlations for all the classes in 4-D arrays Mins and Maxs, each of the order C × L × |P | × max 1≤l≤L n l (n l +1) 2

Figure1: Significance of depth: The TNR@TPR95 is computed by constructing detectors which make use of all the gram matrices but consider only one residual or dense block at a time. ResNet32 has 4 residual blocks and DenseNet3 has 3 dense blocks.

Figure 3: The Schematic Diagram demonstrating the proposed algorithm

Figure 4: ResNet/CIFAR-10: The TNR at TPR95 trends for Min/Max and Mean/Var as the order of Gram Matrix is varied.

Figure 5: ResNet/CIFAR-100: The TNR at TPR95 trends for Min/Max and Mean/Var as the order of Gram Matrix is varied.

Figure 6: ResNet/SVHN: The TNR at TPR95 trends for Min/Max and Mean/Var as the order of Gram Matrix is varied.

Figure 7: DenseNet/CIFAR-10: The TNR at TPR95 trends for Min/Max and Mean/Var as the order of Gram Matrix is varied.

Figure 8: DenseNet/CIFAR-100: The TNR at TPR95 trends for Min/Max and Mean/Var as the order of Gram Matrix is varied.

Figure 9: DenseNet/SVHN: The TNR at TPR95 trends for Min/Max and Mean/Var as the order of Gram Matrix is varied.

Figure 11: DenseNet/CIFAR-100: The TNR at TPR95 trends for Min/Max and Mean/Var as we go deeper in the network.

Figure 13: ResNet/CIFAR-100: The TNR at TPR95 trends for Min/Max and Mean/Var as we go deeper in the network.

Alternative Training Strategies.Lee et al. (2018a)  jointly train a classifier, a generator and an adversarial discriminator such that the classifier produces a more uniform distribution on the boundary examples generated by the generator; they use OOD examples to fine-tune hyperparameters. DeVries and Taylor (2018) train neural networks with a multi-task loss for jointly learning to classify and estimate confidence.Shalev et al. (2018) use multiple semantic dense representations as the target instead of sparse one-hot vectors and use a cosine-similarity based measure for detecting OODs. Building on the idea proposed byLee et al. (2018a),Hendrycks et al. (2019a)  propose an Outlier Exposure (OE) technique. They regularize a softmax classifier to predict uniform distribution on (any) OOD distribution and show the resulting model can identify examples from unseen OOD distributions; this differs significantly from previous works which used the same OOD distributions for both training and testing. Unlike other methods, they retain the architecture of the classifier and introduce just one additional hyperparameter-the regularization rate-and also demonstrate that their model is quite robust to the choice of OOD examples chosen for the regularization. However, while the OE method is able to generalize across different non-training distributions, it understandably does not achieve the rates ofLee et al.

Table content: <table/>

Ours List of closely related methods. Note: OE uses OOD examples during training, but unrelated to test

Table content: <table/>

Comparison of OOD Detection Performance for all combinations of model architecture and training dataset are shown. The hyperparameters of ODIN and the hyperparameters and parameters of Mahalanobis are tuned using a random sample of the OOD dataset.

Table content: <table><tr><td>-dist (model)</td><td>OOD</td><td colspan="3">TNR at TPR 95% Baseline / ODIN / Mahalanobis / Ours AUROC</td><td>Detection Acc.</td></tr><tr><td/><td>iSUN</td><td colspan="2">44.6 / 73.2 / 97.8 / 99.3</td><td>91.0 / 94.0 / 99.5 / 99.7 85.0 / 86.5 / 96.7 / 98.1</td></tr><tr><td>CIFAR-10</td><td>LSUN</td><td colspan="2">49.8 / 82.1 / 98.8 / 99.6</td><td>91.0 / 94.1 / 99.7 / 99.8 85.3 / 86.7 / 97.7 / 98.6</td></tr><tr><td>(ResNet)</td><td colspan="3">TinyImgNet 41.0 / 67.9 / 97.1 / 98.7</td><td>91.0 / 94.0 / 99.5 / 99.6 85.1 / 86.5 / 96.3 / 97.8</td></tr><tr><td/><td>SVHN</td><td colspan="3">50.5 / 70.3 / 87.8 / 97.6 89.9 / 96.7 / 99.1 / 99.4</td><td>85.1 / 91.1 / 95.8 / 96.7</td></tr><tr><td/><td>iSUN</td><td colspan="2">16.9 / 45.2 / 89.9 / 95.1</td><td>75.8 / 85.5 / 97.9 / 98.9 70.1 / 78.5 / 93.1 / 95.2</td></tr><tr><td>CIFAR-100</td><td>LSUN</td><td colspan="2">18.8 / 23.2 / 90.9 / 97.0</td><td>75.8 / 85.6 / 98.2 / 99.3 69.9 / 78.3 / 93.5 / 96.2</td></tr><tr><td>(ResNet)</td><td colspan="3">TinyImgNet 20.4 / 36.1 / 90.9 / 95.1</td><td>77.2 / 87.6 / 98.2 / 99.0 70.8 / 80.1 / 93.3 / 95.1</td></tr><tr><td/><td>SVHN</td><td colspan="2">20.3 / 62.7 / 91.9 / 81.4</td><td>79.5 / 93.9 / 98.4 / 96.2 73.2 / 88.0 / 93.7 / 89.8</td></tr><tr><td/><td>iSUN</td><td colspan="2">62.5 / 93.2 / 95.3 / 99.1</td><td>94.7 / 98.7 / 98.9 / 99.8 89.2 / 94.3 / 95.2 / 98.0</td></tr><tr><td>CIFAR-10</td><td>LSUN</td><td colspan="2">66.6 / 96.2 / 97.2 / 99.5</td><td>95.4 / 99.2 / 99.3 / 99.9 90.3 / 95.7 / 96.3 / 97.9</td></tr><tr><td>(DenseNet)</td><td colspan="3">TinyImgNet 58.9 / 92.4 / 95.0 / 98.8</td><td>94.1 / 98.5 / 98.8 / 99.7 88.5 / 93.9 / 95.0 / 97.9</td></tr><tr><td/><td>SVHN</td><td colspan="2">40.2 / 86.2 / 90.8 / 96.0</td><td>89.9 / 95.5 / 98.1 / 99.1 83.2 / 91.4 / 93.9 / 95.8</td></tr><tr><td/><td>iSUN</td><td colspan="2">14.9 / 37.4 / 87.0 / 95.9</td><td>69.5 / 84.5 / 97.4 / 99.1 63.8 / 76.4 / 92.4 / 95.7</td></tr><tr><td>CIFAR-100</td><td>LSUN</td><td colspan="2">17.6 / 41.2 / 91.4 / 97.3</td><td>70.8 / 85.5 / 98.0 / 99.4 64.9 / 77.1 / 93.9 / 96.4</td></tr><tr><td>(DenseNet)</td><td colspan="3">TinyImgNet 17.6 / 42.6 / 86.6 / 95.8</td><td>71.7 / 85.2 / 97.4 / 99.0 65.7 / 77.0 / 92.2 / 95.6</td></tr><tr><td/><td>SVHN</td><td colspan="2">26.7 / 70.6 / 82.5 / 89.4</td><td>82.7 / 93.8 / 97.2 / 97.4 75.6 / 86.6 / 91.5 / 92.4</td></tr><tr><td/><td>iSUN</td><td colspan="2">78.3 / 82.2 / 99.9 / 99.3</td><td>94.4 / 94.7 / 99.9 / 99.8 89.6 / 89.7 / 99.2 / 98.3</td></tr><tr><td>SVHN</td><td>LSUN</td><td colspan="2">77.1 / 81.1 / 99.9 / 99.5</td><td>94.1 / 94.5 / 99.9 / 99.8 89.1 / 89.2 / 99.3 / 98.5</td></tr><tr><td>(DenseNet)</td><td colspan="3">TinyImgNet 79.8 / 84.1 / 99.9 / 99.1</td><td>94.8 / 95.1 / 99.9 / 99.7 90.2 / 90.4 / 98.9 / 97.9</td></tr><tr><td/><td>CIFAR-10</td><td colspan="2">69.3 / 71.7 / 96.8 / 80.2</td><td>91.9 / 91.4 / 98.9 / 95.5 86.6 / 85.8 / 95.9 / 89.0</td></tr><tr><td/><td>iSUN</td><td colspan="2">77.1 / 79.1 / 99.7 / 99.1</td><td>92.2 / 91.4 / 99.8 / 99.8 89.7 / 89.2 / 98.3 / 98.1</td></tr><tr><td>SVHN</td><td>LSUN</td><td colspan="2">74.3 / 77.3 / 99.9 / 99.4</td><td>91.6 / 89.4 / 99.9 / 99.8 89.0 / 87.2 / 99.5 / 98.5</td></tr><tr><td>(ResNet)</td><td colspan="3">TinyImgNet 79.0 / 82.0 / 99.9 / 99.3</td><td>93.5 / 92.0 / 99.9 / 99.7 90.4 / 89.4 / 99.1 / 97.9</td></tr><tr><td/><td>CIFAR-10</td><td colspan="2">78.3 / 79.8 / 98.4 / 85.7</td><td>92.9 / 92.1 / 99.3 / 97.3 90.0 / 89.4 / 96.9 / 91.9</td></tr><tr><td/><td/><td>In-dist</td><td colspan="2">Mean TNR @ TPR95 (Base) OE OE Ours (Base)</td><td>Ours</td></tr><tr><td/><td/><td>CIFAR-10</td><td colspan="2">65.1 90.5 51.7625</td><td>98.7</td></tr><tr><td/><td/><td>CIFAR-100</td><td>37.3 61.5</td><td>19.15</td><td>93.4</td></tr><tr><td/><td/><td>SVHN</td><td>93.7 99.9</td><td>76.65</td><td>95.2</td></tr></table>

Comparison of results with OE

Table content: <table/>



Table content: <table><tr><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td/><td/><td/><td/><td/><td/><td>AUROC</td><td/><td/><td/><td/><td/><td/><td>DTACC</td><td/></tr><tr><td>In-dist</td><td>OOD</td><td/><td colspan="2">Diagonal Elements</td><td colspan="3">Off Diagonal Elements (Row-wise Sums)</td><td colspan="3">Complete Gram Matrix (Row-wise Sums)</td><td>Diagonal Elements</td><td colspan="3">Off Diagonal Elements (Row-wise Sums)</td><td colspan="3">Complete Gram Matrix (Row-wise Sums)</td><td>Diagonal Elements</td><td colspan="3">Off-Diagonal Elements (Row-wise Sums)</td><td>Complete Gram Matrix (Row-wise Sums)</td></tr><tr><td>(model)</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>iSUN</td><td>99.1</td><td>96.3</td><td>95.7</td><td>73.8 99.3</td><td>97.1 97.0</td><td colspan="2">90.2 99.3</td><td>97.1 97.1</td><td>89.3 99.7</td><td>99.2 98.7</td><td>96.2 99.7</td><td>99.4 99.0</td><td colspan="2">98.1 99.7</td><td>99.4 99.0</td><td>98.0 97.9</td><td>95.7 95.5</td><td>92.1 98.0</td><td>96.2 96.0</td><td colspan="2">93.5 98.1</td><td>96.2 96.0</td><td>93.4</td></tr><tr><td>CIFAR-10 (ResNet)</td><td colspan="2">LSUN TinyImgNet 98.6 99.5 SVHN 97.8</td><td>98.3 93.8 70.7</td><td>97.0 96.2 94.8</td><td>77.7 99.6 68.2 98.8 19.9 97.6</td><td>98.8 98.1 97.2 95.7 81.1 94.8</td><td colspan="2">93.6 99.6 88.5 98.7 40.7 97.6</td><td>98.8 98.0 97.2 95.7 80.2 94.9</td><td>94.1 99.8 87.5 99.6 38.2 99.5</td><td>99.5 98.7 99.1 98.3 95.2 98.9</td><td>96.7 99.8 95.6 99.6 88.4 99.4</td><td>99.7 99.1 99.4 98.8 96.2 98.8</td><td colspan="2">98.5 99.8 97.8 99.6 92.0 99.4</td><td>99.7 99.1 99.4 98.8 96.2 98.9</td><td>98.4 98.5 97.7 97.5 91.8 97.0</td><td>97.0 96.0 95.6 94.7 90.1 95.0</td><td>93.0 98.6 91.2 97.7 84.7 96.6</td><td>97.6 96.6 96.3 95.3 90.9 94.9</td><td colspan="2">94.6 98.6 93.1 97.8 87.0 96.7</td><td>97.6 96.6 96.4 95.4 90.8 95.1</td><td>94.5 92.9 86.7</td></tr><tr><td/><td>CIFAR-100</td><td>33.3</td><td>29.4</td><td>42.5</td><td>32.9 32.9</td><td>27.2 41.8</td><td colspan="2">29.3 32.8</td><td>27.4 42.2</td><td>29.2 79.7</td><td>78.4 84.9</td><td>83.3 78.8</td><td>75.8 84.1</td><td colspan="2">79.0 79.0</td><td>76.1 84.2</td><td>79.2 72.4</td><td>71.7 78.2</td><td>76.8 71.5</td><td>69.1 77.4</td><td colspan="2">72.1 71.7</td><td>69.4 77.4</td><td>72.2</td></tr><tr><td/><td>iSUN</td><td>93.8</td><td>71.8</td><td>50.0</td><td>33.8 95.4</td><td>85.9 67.2</td><td colspan="2">55.0 95.1</td><td>85.3 65.4</td><td>52.8 98.7</td><td>95.5 92.1</td><td>87.8 98.9</td><td>97.4 94.5</td><td colspan="2">92.7 98.8</td><td>97.3 94.2</td><td>92.3 94.5</td><td>89.3 85.4</td><td>81.1 95.3</td><td>92.2 87.9</td><td colspan="2">86.1 95.1</td><td>92.0 87.6</td><td>85.6</td></tr><tr><td>CIFAR-100 (ResNet)</td><td colspan="2">LSUN TinyImgNet 94.1 95.6 SVHN 83.1</td><td>70.8 68.0 29.8</td><td>45.6 51.4 53.2</td><td>32.9 97.2 34.6 95.3 26.0 79.1</td><td>87.5 64.2 84.2 68.1 34.4 51.8</td><td colspan="2">52.0 97.0 52.8 95.1 29.6 81.4</td><td>86.8 62.4 83.5 66.6 33.9 55.6</td><td>49.7 99.1 50.8 98.8 29.2 96.5</td><td>95.9 91.8 95.1 92.5 84.7 92.3</td><td>87.8 99.3 87.1 99.0 80.8 95.7</td><td>97.8 94.6 97.2 94.8 86.8 91.6</td><td colspan="2">92.9 99.2 92.5 98.9 83.5 96.1</td><td>97.7 94.3 97.1 94.6 86.7 92.2</td><td>92.4 95.4 92.1 94.6 83.1 90.2</td><td>90.1 85.7 88.5 85.9 77.5 85.1</td><td>81.4 96.3 80.1 95.2 73.6 89.2</td><td>93.1 88.4 91.8 88.4 80.3 84.3</td><td colspan="2">86.6 96.1 85.9 95.1 75.3 89.7</td><td>93.0 88.1 91.6 88.2 80.3 84.8</td><td>86.1 85.4 74.9</td></tr><tr><td/><td>CIFAR-10</td><td>12.9</td><td>18.1</td><td>19.2</td><td>18.2 11.4</td><td>17.5 17.5</td><td colspan="2">17.9 12.1</td><td>17.6 18.1</td><td>18.0 69.3</td><td>71.2 76.6</td><td>74.6 67.3</td><td>70.0 75.3</td><td colspan="2">71.9 67.8</td><td>70.1 75.5</td><td>72.0 64.6</td><td>66.0 71.1</td><td>69.1 63.0</td><td>64.8 69.8</td><td colspan="2">66.5 63.3</td><td>65.0 70.1</td><td>66.6</td></tr><tr><td/><td>iSUN</td><td>98.9</td><td>97.1</td><td>98.8</td><td>96.3 99.1</td><td>97.8 99.1</td><td colspan="2">97.5 99.1</td><td>97.8 99.0</td><td>97.5 99.8</td><td>99.5 99.8</td><td>99.3 99.8</td><td>99.6 99.8</td><td colspan="2">99.6 99.8</td><td>99.6 99.8</td><td>99.5 97.8</td><td>96.5 97.8</td><td>95.9 97.9</td><td>96.9 97.8</td><td colspan="2">96.8 98.0</td><td>96.8 97.8</td><td>96.7</td></tr><tr><td>CIFAR-10 (DenseNet)</td><td colspan="2">LSUN TinyImgNet 98.7 99.4 SVHN 96.6</td><td>98.8 97.5 87.8</td><td>99.4 98.6 96.9</td><td>98.4 99.5 97.0 98.8 88.2 95.9</td><td>99.2 99.5 98.0 98.8 84.7 96.4</td><td colspan="2">99.0 99.5 97.7 98.8 86.9 96.0</td><td>99.1 99.4 97.9 98.7 84.0 96.5</td><td>98.9 99.9 97.7 99.7 87.1 99.2</td><td>99.8 99.9 99.5 99.7 97.6 99.3</td><td>99.7 99.9 99.3 99.7 97.6 99.1</td><td>99.8 99.9 99.6 99.7 96.9 99.2</td><td colspan="2">99.8 99.9 99.5 99.7 97.4 99.1</td><td>99.8 99.9 99.6 99.7 96.8 99.2</td><td>99.8 98.7 99.5 97.9 97.4 96.3</td><td>98.0 98.6 96.8 97.8 92.3 96.5</td><td>97.4 98.6 96.3 97.8 92.3 95.8</td><td>98.2 98.5 97.1 97.7 91.1 96.0</td><td colspan="2">98.1 98.7 97.0 97.9 92.0 95.8</td><td>98.1 98.5 97.0 97.7 90.9 96.1</td><td>98.1 97.0 92.0</td></tr><tr><td/><td>CIFAR-100</td><td>26.4</td><td>28.9</td><td>29.0</td><td>28.2 27.0</td><td>25.2 30.1</td><td colspan="2">24.8 26.8</td><td>25.5 30.1</td><td>25.1 68.5</td><td>75.1 68.9</td><td>74.1 72.1</td><td>72.7 73.3</td><td colspan="2">72.4 72.2</td><td>72.9 73.4</td><td>72.5 66.5</td><td>68.8 66.6</td><td>67.8 67.6</td><td>67.2 68.9</td><td colspan="2">66.6 67.3</td><td>67.3 68.6</td><td>66.6</td></tr><tr><td/><td>iSUN</td><td>96.0</td><td>84.2</td><td>95.5</td><td>91.9 96.1</td><td>88.8 95.5</td><td colspan="2">95.7 95.9</td><td>88.5 95.3</td><td>95.8 99.1</td><td>97.2 98.9</td><td>98.2 99.0</td><td>97.9 98.9</td><td colspan="2">99.0 99.1</td><td>97.8 98.9</td><td>99.0 95.7</td><td>91.4 95.4</td><td>93.6 95.7</td><td>92.6 95.3</td><td colspan="2">95.5 95.7</td><td>92.6 95.3</td><td>95.5</td></tr><tr><td>CIFAR-100 (DenseNet)</td><td colspan="2">LSUN TinyImgNet 95.8 97.4 SVHN 89.4</td><td>87.5 81.4 59.7</td><td>96.9 95.4 88.8</td><td>95.5 97.5 90.2 95.9 64.5 87.3</td><td>91.4 97.0 86.9 95.3 63.2 86.4</td><td colspan="2">97.8 97.3 94.2 95.8 67.4 89.4</td><td>91.2 96.8 86.4 95.2 62.9 87.9</td><td>97.8 99.4 94.3 99.0 67.3 97.4</td><td>97.8 99.3 96.6 98.9 92.5 97.3</td><td>99.0 99.4 97.8 99.0 92.6 97.0</td><td>98.3 99.3 97.5 98.9 92.7 96.9</td><td colspan="2">99.4 99.4 98.7 99.0 93.4 97.4</td><td>98.3 99.3 97.4 98.9 92.7 97.1</td><td>99.4 96.4 98.7 95.5 93.4 92.4</td><td>92.7 96.1 90.4 95.2 85.7 92.0</td><td>95.3 96.5 92.9 95.5 86.0 91.7</td><td>93.7 96.2 91.8 95.2 86.0 91.4</td><td colspan="2">96.7 96.4 94.7 95.6 87.1 92.4</td><td>93.7 96.2 91.7 95.2 86.2 91.9</td><td>96.7 94.7 87.1</td></tr><tr><td/><td>CIFAR-10</td><td>10.5</td><td>16.4</td><td>11.1</td><td>13.7 10.6</td><td>15.6 10.2</td><td colspan="2">13.9 10.5</td><td>15.6 10.2</td><td>13.8 64.4</td><td>70.1 65.0</td><td>66.7 63.7</td><td>68.3 64.2</td><td colspan="2">66.2 64.2</td><td>68.7 64.6</td><td>66.2 60.6</td><td>64.9 61.3</td><td>62.2 59.7</td><td>63.4 60.5</td><td colspan="2">61.6 60.4</td><td>63.8 61.0</td><td>61.5</td></tr><tr><td/><td>iSUN</td><td>99.3</td><td>99.8</td><td>98.1</td><td>96.9 99.5</td><td>99.9 97.8</td><td colspan="2">98.5 99.5</td><td>99.9 97.9</td><td>98.6 99.8</td><td>99.9 98.8</td><td>98.3 99.8</td><td>99.9 99.0</td><td colspan="2">99.0 99.8</td><td>99.9 99.0</td><td>99.0 98.0</td><td>98.4 96.6</td><td>96.3 98.1</td><td>98.5 96.4</td><td colspan="2">96.8 98.1</td><td>98.5 96.5</td><td>96.8</td></tr><tr><td>SVHN</td><td>LSUN</td><td>99.6</td><td>99.9</td><td>98.5</td><td>97.4 99.6</td><td>99.9 98.3</td><td colspan="2">99.0 99.6</td><td>99.9 98.4</td><td>99.0 99.9</td><td>99.9 98.9</td><td>98.4 99.8</td><td>99.9 99.1</td><td colspan="2">99.1 99.8</td><td>99.9 99.1</td><td>99.1 98.5</td><td>98.9 96.8</td><td>96.5 98.5</td><td>98.9 96.7</td><td colspan="2">97.0 98.5</td><td>98.9 96.7</td><td>97.0</td></tr><tr><td>(ResNet)</td><td colspan="2">TinyImgNet 99.0</td><td>99.6</td><td>97.8</td><td>96.5 99.3</td><td>99.6 97.8</td><td colspan="2">98.1 99.3</td><td>99.6 98.4</td><td>99.0 99.7</td><td>99.8 98.8</td><td>98.3 99.7</td><td>99.8 99.0</td><td colspan="2">99.0 99.7</td><td>99.8 99.0</td><td>99.0 97.6</td><td>98.1 96.4</td><td>96.2 97.9</td><td>98.2 96.4</td><td colspan="2">96.6 97.9</td><td>98.2 96.5</td><td>96.6</td></tr><tr><td/><td>CIFAR-10</td><td>82.6</td><td>93.7</td><td>86.1</td><td>86.8 85.9</td><td>94.9 86.5</td><td colspan="2">90.5 85.5</td><td>94.9 86.6</td><td>90.5 96.8</td><td>98.6 97.1</td><td>97.3 97.3</td><td>98.8 97.3</td><td colspan="2">97.8 97.3</td><td>98.8 97.3</td><td>97.8 91.1</td><td>94.9 92.5</td><td>94.0 92.0</td><td>95.2 92.8</td><td colspan="2">94.3 92.0</td><td>95.2 92.8</td><td>94.2</td></tr><tr><td/><td>iSUN</td><td>99.3</td><td>99.6</td><td>99.4</td><td>99.1 99.3</td><td>99.4 99.4</td><td colspan="2">97.9 99.3</td><td>99.4 99.4</td><td>98.0 99.8</td><td>99.9 99.9</td><td>99.8 99.8</td><td>99.9 99.8</td><td colspan="2">99.5 99.8</td><td>99.9 99.8</td><td>99.5 98.3</td><td>98.8 98.4</td><td>98.3 98.4</td><td>98.5 98.4</td><td colspan="2">97.3 98.3</td><td>98.6 98.4</td><td>97.3</td></tr><tr><td>SVHN</td><td>LSUN</td><td>99.5</td><td>99.7</td><td>99.7</td><td>99.4 99.5</td><td>99.4 99.6</td><td colspan="2">98.2 99.5</td><td>99.4 99.6</td><td>98.3 99.9</td><td>99.9 99.9</td><td>99.9 99.8</td><td>99.9 99.9</td><td colspan="2">99.6 99.8</td><td>99.9 99.9</td><td>99.6 98.6</td><td>98.9 98.7</td><td>98.5 98.6</td><td>98.6 98.7</td><td colspan="2">97.6 98.5</td><td>98.7 98.7</td><td>97.7</td></tr><tr><td>(DenseNet)</td><td colspan="2">TinyImgNet 99.2</td><td>99.5</td><td>99.3</td><td>99.2 99.1</td><td>99.2 99.2</td><td colspan="2">98.0 99.0</td><td>99.2 99.2</td><td>98.1 99.7</td><td>99.9 99.8</td><td>99.8 99.7</td><td>99.8 99.8</td><td colspan="2">99.6 99.7</td><td>99.8 99.8</td><td>99.6 97.9</td><td>98.5 98.1</td><td>98.2 98.0</td><td>98.3 98.1</td><td colspan="2">97.3 97.9</td><td>98.3 98.1</td><td>97.3</td></tr><tr><td/><td>CIFAR-10</td><td>76.6</td><td>93.5</td><td>76.9</td><td>91.8 81.2</td><td>94.3 85.6</td><td colspan="2">90.1 80.2</td><td>94.2 84.7</td><td>90.1 94.5</td><td>98.5 94.9</td><td>98.1 95.6</td><td>98.6 96.5</td><td colspan="2">97.6 95.5</td><td>98.6 96.4</td><td>97.7 88.1</td><td>94.3 88.6</td><td>93.5 89.2</td><td>94.7 90.7</td><td colspan="2">92.6 89.0</td><td>94.7 90.6</td><td>92.6</td></tr><tr><td>Summary</td><td>MEAN STD-DEV</td><td>95.4 6.2</td><td>86.6 17.2</td><td>87.9 18.1</td><td>77.3 95.6 27.0 6.0</td><td>90.1 90.4 14.7 13.5</td><td colspan="2">83.7 95.7 21.3 5.7</td><td>89.9 90.4 14.9 13.5</td><td>83.3 99.0 22.0 1.3</td><td>97.5 97.7 3.4 2.7</td><td>95.6 99.0 5.2 1.3</td><td>98.0 98.1 2.9 2.2</td><td colspan="2">96.9 99.0 3.9 1.2</td><td>98.0 98.1 2.9 2.2</td><td>96.8 96.0 4.0 2.9</td><td>93.7 94.1 5.2 4.5</td><td>91.6 96.1 6.8 2.8</td><td>94.4 94.5 4.5 3.9</td><td colspan="2">92.9 96.2 5.6 2.8</td><td>94.4 94.5 4.5 3.9</td><td>92.8 5.7</td></tr></table>

Figure 10: DenseNet/CIFAR-10: The TNR at TPR95 trends for Min/Max and Mean/Var as we go deeper in the network.

Table content: <table><tr><td/><td>1.0</td><td/><td/><td colspan="3">DenseNet: CIFAR100 vs iSUN</td><td/><td/><td>Min/Max Mean/Var</td><td>1.0</td><td/><td/><td colspan="3">DenseNet: CIFAR100 vs LSUN</td><td/><td/><td>Min/Max Mean/Var</td><td>1.0</td><td/><td/><td colspan="3">DenseNet: CIFAR100 vs TinyImgNet</td><td/><td/><td>Min/Max Mean/Var</td><td>0.9</td><td/><td/><td/><td colspan="3">DenseNet: CIFAR100 vs SVHN</td><td/><td/><td>Min/Max Mean/Var</td><td/><td/><td/><td colspan="3">DenseNet: CIFAR100 vs CIFAR10</td><td/><td/><td>Min/Max Mean/Var</td></tr><tr><td/><td>0.9</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.9</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.9</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.15</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.14</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.7</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.7</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.7</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.7</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.13</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td>TNR at TPR95</td><td>0.6</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.6</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.6</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.6</td><td/><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.12</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.11</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.3 0.4</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.4 0.3</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.4 0.3</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.4</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.10</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.09</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.2</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td/><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td></tr><tr><td/><td/><td/><td/><td colspan="3">DenseNet: CIFAR10 vs iSUN</td><td/><td/><td/><td/><td/><td/><td colspan="3">DenseNet: CIFAR10 vs LSUN</td><td/><td/><td/><td/><td/><td/><td colspan="3">DenseNet: CIFAR10 vs TinyImgNet</td><td/><td/><td/><td/><td/><td/><td/><td colspan="3">DenseNet: CIFAR10 vs SVHN</td><td/><td/><td/><td/><td/><td/><td colspan="3">DenseNet: CIFAR10 vs CIFAR100</td><td/><td/></tr><tr><td/><td>1.0</td><td/><td/><td/><td/><td/><td/><td/><td>Min/Max Mean/Var</td><td>1.0</td><td/><td/><td/><td/><td/><td/><td/><td>Min/Max Mean/Var</td><td>1.0</td><td/><td/><td/><td/><td/><td/><td/><td>Min/Max Mean/Var</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>Min/Max Mean/Var</td><td>Min/Max Mean/Var</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.9</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.9</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.9</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.9</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.28</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.26</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td>TNR at TPR95</td><td>0.6 0.7</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.6 0.7</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.7 0.6</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.7</td><td/><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.24 0.22</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.6</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.20</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.4</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.4</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.4</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.18</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.3</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.3</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.3</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.16</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Blocks</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Blocks</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Blocks</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>0.4</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Blocks</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Blocks</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td></tr></table>

Figure 15: DenseNet/SVHN: The TNR at TPR95 trends for Min/Max and Mean/Var as we go deeper in the network.Table shows results from preliminary experiments on combining OE with our method. The experiment was conducted with pretrained WideResNet open-sourced byHendrycks et al. (2019a). MSP uses Maximum Softmax Probability; "Ours" refers to the metric ∆ (Eq. 5); "Ours+MSP" is obtained by dividing ∆ with MSP.

Table content: <table><tr><td/><td>1.000</td><td/><td/><td/><td>DenseNet: SVHN vs iSUN</td><td/><td/><td/><td>Min/Max Mean/Var</td><td>1.00</td><td/><td/><td/><td>DenseNet: SVHN vs LSUN</td><td/><td/><td/><td>Min/Max Mean/Var</td><td>1.00</td><td/><td/><td colspan="3">DenseNet: SVHN vs TinyImgNet</td><td/><td/><td>Min/Max Mean/Var</td><td>0.9</td><td/><td/><td colspan="3">DenseNet: SVHN vs CIFAR10</td><td/><td/><td>Min/Max Mean/Var</td></tr><tr><td/><td>0.975</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.98</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.950</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.95</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.96</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.8</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.925</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.94</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td>TNR at TPR95</td><td>0.900</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.90</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.92</td><td/><td/><td/><td/><td/><td/><td/><td>TNR at TPR95</td><td>0.7</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.875</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.90</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.85</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.850</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.88</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.6</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.825</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.80</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.86</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>0.800</td><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td/><td>0.84</td><td/><td/><td/><td/><td/><td/><td/><td/><td>0.5</td><td/><td/><td/><td/><td/><td/><td/></tr><tr><td/><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td><td>1.00</td><td>1.25</td><td>1.50</td><td>1.75</td><td>2.00 Block</td><td>2.25</td><td>2.50</td><td>2.75</td><td>3.00</td></tr></table>

Comparison of Mean TNR@TPR95 values.FollowingHendrycks et al. (2019a), we created the gaussian, rademacher, blob and bernoulli synthetic datasets. Their descriptions are as follows: Gaussian anomalies have each dimension i.i.d. sampled from an isotropic Gaussian distribution. Rademacher anomalies are images where each dimension is 1 or 1 with equal probability, so each dimension is sampled from a symmetric Rademacher distribution. Bernoulli images have each pixel sampled from a Bernoulli distribution if the input range is [0, 1]. Blobs data consist of algorithmically generated amorphous shapes with definite edges. Textures is a dataset of describable textural images(Cimpoi et al., 2014). E.2 COMPARING WITH DPN, VD AND SEMANTIC.

Table content: <table><tr><td>OOD</td><td>Method</td><td>TNR @ TPR95</td><td>AUROC</td><td>Detection Accuracy</td><td>OOD</td><td>Method</td><td>TNR @ TPR95</td><td>AUROC</td><td>Detection Accuracy</td></tr><tr><td/><td>DPN</td><td>42.60</td><td>90.20</td><td>79.50</td><td/><td>Semantic</td><td>41.60</td><td>85.20</td><td>88.40</td></tr><tr><td/><td>VD</td><td>92.30</td><td>98.30</td><td>94.10</td><td/><td>VD</td><td>80.20</td><td>94.20</td><td>87.80</td></tr><tr><td>LSUN</td><td>Baseline ODIN</td><td>49.80 82.10</td><td>91.00 94.10</td><td>85.30 86.70</td><td>iSUN</td><td>Baseline ODIN</td><td>16.89 45.21</td><td>75.80 85.48</td><td>70.11 78.47</td></tr><tr><td/><td>Mahalanobis</td><td>98.80</td><td>99.70</td><td>97.70</td><td/><td>Mahalanobis</td><td>89.91</td><td>97.91</td><td>93.05</td></tr><tr><td/><td>Ours</td><td>99.85</td><td>99.89</td><td>98.66</td><td/><td>Ours</td><td>95.12</td><td>98.9</td><td>95.18</td></tr><tr><td/><td>DPN</td><td>71.60</td><td>93.00</td><td>86.40</td><td/><td>Semantic</td><td>20.50</td><td>79.00</td><td>57.80</td></tr><tr><td/><td>VD</td><td>82.90</td><td>96.80</td><td>91.30</td><td/><td>VD</td><td>85.50</td><td>95.90</td><td>90.40</td></tr><tr><td>Tiny ImgNet</td><td>Baseline ODIN</td><td>41.00 67.90</td><td>91.00 94.00</td><td>85.10 86.50</td><td>LSUN</td><td>Baseline ODIN</td><td>18.80 23.20</td><td>75.80 85.60</td><td>69.90 78.30</td></tr><tr><td/><td>Mahalanobis</td><td>97.10</td><td>99.50</td><td>96.30</td><td/><td>Mahalanobis</td><td>90.89</td><td>98.2</td><td>93.5</td></tr><tr><td/><td>Ours</td><td>99.48</td><td>99.72</td><td>97.82</td><td/><td>Ours</td><td>97.14</td><td>99.28</td><td>96.19</td></tr><tr><td/><td>DPN</td><td>79.90</td><td>95.90</td><td>87.30</td><td/><td>Semantic</td><td>37.60</td><td>83.10</td><td>75.60</td></tr><tr><td/><td>VD</td><td>71.30</td><td>93.20</td><td>86.40</td><td/><td>VD</td><td>83.70</td><td>95.30</td><td>89.70</td></tr><tr><td>SVHN</td><td>Baseline ODIN</td><td>50.50 70.30</td><td>89.90 96.70</td><td>85.10 91.10</td><td>Tiny ImgNet</td><td>Baseline ODIN</td><td>20.40 36.1</td><td>77.20 87.6</td><td>70.80 80.1</td></tr><tr><td/><td>Mahalanobis</td><td>87.80</td><td>99.10</td><td>95.80</td><td/><td>Mahalanobis</td><td>90.92</td><td>98.20</td><td>93.30</td></tr><tr><td/><td>Ours</td><td>98.14</td><td>99.50</td><td>96.71</td><td/><td>Ours</td><td>95.12</td><td>98.97</td><td>95.13</td></tr><tr><td/><td colspan="3">(a) ResNet/CIFAR-10</td><td/><td/><td colspan="3">(b) ResNet/CIFAR-100</td><td/></tr></table>

We compare our method with DPN, VD and Semantic by reporting results where available.E.3 RESULTS FOR FULLY-CONNECTED NETWORKS

Table content: <table><tr><td>Architecture</td><td>OOD</td><td colspan="4">Method TNR @ TPR95 AUROC Detection Accuracy</td></tr><tr><td>300</td><td>KMNIST Fashion-MNIST</td><td>Baseline Ours Baseline Ours</td><td>47.66 98.57 44.93 93.51</td><td>73.96 99.66 66.93 98.64</td><td>73.91 97.37 71.07 94.36</td></tr><tr><td>300-150</td><td>KMNIST Fashion-MNIST</td><td>Baseline Ours Baseline Ours</td><td>59.79 97.8 70.73 95.2</td><td>75.17 99.4 77.10 99.00</td><td>79.49 96.55 83.00 95.17</td></tr><tr><td>300-150-50</td><td>KMNIST Fashion-MNIST</td><td>Baseline Ours Baseline Ours</td><td>70.4 97.5 73.92 95.7</td><td>79.75 99.11 76.54 98.94</td><td>83.38 96.4 84.67 95.48</td></tr></table>

The method even works quite well with a fully-connected neural network trained on MNIST. The results are shown for 300-unit single layer MLP, 300-150 two-layer MLP and 300-150-50 MLP.

Table content: <table/>

Peer review (iclr2020):
This paper uses Gram matrices for OOD detection. This enables the reliable detection of far-from-distribution examples, which is a long-standing and surprisingly difficult problem in OOD detection. This is the best paper in my batch due to the strength of the results. However, this paper should more accurately reflect the contribution: this helps with far-from-distribution examples, not near-distribution yet OOD examples. For instance, I used their code and found that their technique leads to an AUROC of 79.01% when using CIFAR-10 as the in-distribution and CIFAR-100 as the OOD set. Likewise, with their code I found having CIFAR-100 as in and CIFAR-10 as out gives an AUROC of 67.95%. This is much worse than currently existing techniques. Hence the paper should re-frame or qualify their results as helping with far-from-distribution detection or the detection of obvious anomalies. This paper makes a solid stride in improving the detection of garbage inputs, but the paper should modify its message so as not to suggest this helps with all currently considered OOD detection tasks. Small comments: > Lee et al. (2018b)—to the best of our knowledge, the current SOTA technique by a significant margin This should be again qualified and expanded. If you assume access to knowledge of the test distribution, then Mahalanobis is easily the best. If not, the Outlier Exposure is best. If you assume access to no extra data during training, then the maximum softmax probability + rotation prediction is best [1]. > However, while the OE method is able to generalize across different non-training distributions, it does not achieve the SOTA rates of Lee et al. (2018b) on most cases. There are different senses of state-of-the-art and these should be qualified. Does this technique do better if you do 5th and 9th percentile instead of min and max? Is it important to do the min and max with training examples instead of validation examples? (Not a pressing question.) > Can work without access to OOD validation examples? Table 1 is deceptive. OE does not need the *validation* examples. I suggest two columns instead of one. *Can this work without knowledge of OOD test examples? Does this use OOD training examples?* Show AUROC and AUPR. Detection accuracy is an unusual metric relative to AUPR (OOD as positive). Show CIFAR-10 vs CIFAR-100 in the tables or I*ll downgrade my rating, since otherwise the paper is not leaving an accurate impression. Since OE is complementary, perhaps this technique can be combined to tackle these near-distribution cases? The title is confusing. *Zero-Shot* could be applied to various techniques in this space. Perhaps emphasize Gram matrices? In their code: validation_indices = random.sample(range(len(all_test_deviations)),int(0.1*len(all_test_deviations))) test_indices = sorted(list(set(range(len(all_test_deviations)))-set(validation_indices))) These indices change with every power, which is unrealistic. Please fix the sets beforehand. Since neural style transfer, which uses Gram matrices, works much better with VGG architectures than ResNets, does this technique work better with VGG architectures? [1] Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty. Hendrycks et al. NeurIPS 2019.