Title: LEARNING OUT-OF-DISTRIBUTION DETECTION WITHOUT OUT-OF-DISTRIBUTION DATA

Abstract: Deep neural networks have attained remarkable performance when applied to data that comes from the same distribution as that of the training set, but can significantly degrade otherwise. Therefore, detecting whether an example is out-ofdistribution (OOD) is crucial to enable a system that can reject such samples or alert users. Recent works have made significant progress on OOD benchmarks consisting of small image datasets. However, such methods rely on training or tuning with both in-distribution and out-of-distribution data. The latter is generally hard to define a-priori, and its selection can easily bias the learning. In this work, we focus on the feasibility of learning OOD detection without OOD data, proposing two strategies for the problem. We specifically propose to decompose confidence scoring as well as a modified input pre-processing method. We show that both of these significantly help detection performance, all without tuning to any out-of-distribution data during training. Our further analysis on a larger scale image dataset shows that the two types of distribution shifts, specifically semantic shift and non-semantic shift, present a significant difference in the difficulty of the problem, providing an analysis of when the proposed strategies do or do not work.

1. INTRODUCTION:

State-of-the-art machine learning models, specifically deep neural networks, are generally designed for a static and closed world. The models are trained under the assumption that the input distribution at test time will be the same as the training distribution. In the real world, however, data distributions shift over time in a complex, dynamic manner. Even worse, new concepts (e.g. new categories of objects) can be presented to the model at any time. Such within-class distribution shift and unseen concepts both may lead to catastrophic failures since the model still attempts to make predictions based on its closed-world assumption. These failures are therefore often silent in that they do not result in explicit errors in the model.

The above issue had been formulated as a problem of detecting whether an input data is from indistribution (i.e. the training distribution) or out-of-distribution (i.e. a distribution different from the training distribution). A common baseline is to use the max value of class posterior probabilities output from a neural network classifier, which can in some cases be a good indicator for distinguishing in-distribution and out-of-distribution inputs (Hendrycks & Gimpel, 2017) . However, they also show that such probabilities tend to be overconfident. Since then, several works (Liang et al., 2017; Lee et al., 2018b; Vyas et al., 2018; Ren et al., 2019) follow a similar setting and evaluation metric, achieving significant improvement on the problem. However, the success of the above methods requires tuning hyperparameters with out-of-distribution data. In response, Dhamija et al. (2018) and Hendrycks et al. (2019) push this idea further by using a carefully chosen out-of-distribution dataset to regularize the learning of class posteriors so that out-of-distribution data have a much lower confidence than in-distribution. Lastly, Lee et al. (2018a) use a generative model to generate out-of-distribution data around the boundary of the in-distribution. All of the above strategies show the effectiveness of using out-of-distribution data during learning.

The risk of having out-of-distribution data for learning or tuning comes from the bias of the selection, leading to a concern that hyperparameters tuned with one out-of-distribution dataset might not generalize to others. Shafaei et al. (2019) investigate this concern and provide a less biased evalu-ation procedure by enumerating all combinations of known out-of-distribution datasets (for tuning) and unknown out-of-distribution datasets (for testing).

One natural choice for avoiding the mentioned bias is to not use out-of-distribution data for learning or tuning. Therefore in this work we focus on the setting where only in-distribution data are available during both training and validation stages. Furthermore, we consider a standard classification setting, in that the class labels and data are the only available information (in contrast, e.g. , to the work by Shalev et al. (2018) which uses extra supervision from word embeddings for learning).

Contribution: We propose two simple strategies for the problem under the above setting. First, inspired by the observation of classifier overconfidence (Hendrycks & Gimpel, 2017) , we provide a new probabilistic perspective of re-scaling the logits for decomposing confidence (predicted class probabilities) during the training. We specifically add a binary variable, representing whether the data is in-distribution or not, and use this variable to define the probability of the class and this variable conditioned on the data. We show this decomposes into two terms, both of which can be learned and used to define a new classifier. Our formulation is general and we show several existing methods reduce to specific cases for it. Second, we build on the input preprocessing method from ODIN (Liang et al., 2017) and develop an effective strategy to tune its perturbation magnitude (which is a hyperparameter of the preprocessing method) with only in-distribution data. We then perform extensive evaluations on benchmark image datasets such as CIFAR10/100, TinyImageNet, LSUN, SVHN, as well as a larger scale dataset DomainNet, for investigating the conditions under which the proposed strategies do or do not work. The results show that the two strategies can significantly improve upon baseline methods, achieving a performance close to, and in several cases surpassing, state-of-the-art methods (Lee et al., 2018b) which use out-of-distribution data for tuning. Lastly, our systematical evaluation with DomainNet reveals the relative difficulties between two types of distribution shifts: semantic shift and non-semantic shift, which are defined by whether a shift is related to the inclusion of new semantic categories.

2. BACKGROUND:

This work considers the OOD detection setting in classification problems. We begin with a dataset D in = {(x i , y i )} N i=1 , denotion in-distribution data x i ∈ R k and categorical label y i ∈ {y in } = {1..C} for C classes. D in is generated by sampling from a distribution p in (x, y in ). We then have a discriminative model f θ (x) with parameters θ learned with the in-domain dataset D in , predicting the class posterior probability p(y in |x).

When the learned classifier f θ is deployed in the open world, it may encounter data drawn from a different distribution p out such that p out = p in . Sampling from all possible distributions p out that might be encountered is generally intractable especially when the dimension k is large, such as in the cases of image data. Note also that we can conceptually categorize the type of differences into non-semantic shift and semantic shift. Data with non-semantic shift is drawn from the distribution p out (x, y in ). Examples with this shift come from the same object class but are presented in different forms, such as cartoon or sketch images. In the case of semantic shift, the data is drawn from a distribution p out (x, y out ) with {y out } ∩ {y in } = ∅. In other words, the data is from a class not seen in the training set D in .

The above separation leads to two natural questions that must be answered for a model to work in an open world: How can the model avoid making a prediction when encountering an input x ∼ p out (x, y out ), or reject a low confidence prediction when x ∼ p out (x, y in )? In this work, we propose to introduce an explicit binary domain variable d ∈ {d in , d out } in order to represent this decision, with d in meaning that the input is x ∼ p in while d out meaning x p in (or equivalently x ∼ p out ). Note that while generally the model cannot distinguish between the two cases we defined, we can still show that both of the questions above can be answered by estimating this single variable d.

The ultimate goal, then, is to find a scoring function S(x) which correlates to the domain posterior probability p(d|x), in that a higher score s from S(x) indicates a higher probability of p(d in |x). The binary decision now can be made by applying a threshold on s. Selecting such a threshold is subject to the application requirement or the performance metric calculation protocol. With the above notation, we can view the baseline method (Hendrycks & Gimpel, 2017) as a special case with a specific scoring function S Base (x) = max y in p(y in |x), where p(y in |x) is obtained from a standard neural network classifier f θ trained with cross entropy loss. However, S(x) can become a learnable parameterized function, and different OOD methods can then be categorized by specific parameterizations and learning procedures. A key differentiator between methods is whether the parameters are learned with or without OOD data.

2.1. RELATED METHODS:

This section describes the two methods that are the most related to our work: ODIN (Liang et al., 2017) and Mahalanobis (Lee et al., 2018b) . These two methods will serve as strong baselines in our evaluation, since Shafaei et al. (2019) reported that ODIN achieved the strongest results among 15 methods (which doesn't include Mahalanobis), out-performing popular strategies such as MC-Dropout (Gal & Ghahramani, 2016) , DeepEnsemble (Lakshminarayanan et al., 2017) , PixelCNN++ (Salimans et al., 2017) , and OpenMax (Bendale & Boult, 2016) with a less biased evaluation method. Mahalanobis has further been shown to have significant advantages over ODIN (Lee et al., 2018b) . Note that both ODIN and Mahalanobis start from a vanilla classifier f θ trained on D in , then have a scoring function S(x; f θ ) which has extra parameters to be tuned. In their original work, those parameters are specifically tuned for each OOD dataset. Here we will describe the methods to use them without tuning on OOD data.

ODIN comprises two strategies: temperature scaling and input preprocessing. The temperature scaling is applied to its scoring function which has f i (x) for the logit of i class:

S ODIN (x) = max i exp (f i (x)/T ) C j=1 exp (f j (x)/T ) (1)

Although ODIN originally involved tuning the hyperparameter T with out-of-distribution data, it was also shown that a large T value can generally be preferred, suggesting that the gain is saturated after 1000 (Liang et al., 2017) . We follow this guidance and fix T = 1000 in our experiments.

Mahalanobis comprises two parts as well: Mahalanobis distance calculation and input preprocessing. The score is calculated with Mahalanobis distance as follows:

EQUATION

The f (x) represents the output features at the th-layer of neural networks, while µ i and Σ are the class mean representation and the covariance matrix, correspondingly. The hyperparameter is α . In the original method, α is regressed with a small validation set containing both in-distribution and out-of-distribution data. Therefore they have a set of α tuned for each OOD dataset. As a result, for the baseline that does not tune on OOD data we use uniform weighting S M aha (x) = S M aha (x).

Note that both methods use the input preprocessing strategy, which has a hyperparameter to be tuned.

In their original works, this hyperparameter is tuned for each OOD dataset as well. Therefore we develop a version that does not require tuning with out-of-distribution data.

3. APPROACH:



3.1. THE DECOMPOSED CONFIDENCE:

Hendrycks & Gimpel (2017) observed that the softmax classifier tends to output a high confident prediction, reporting that "random Gaussian noise fed into an MNIST image classifier gives a predicted class probability of 91%". They attribute this to the use of the softmax function which is a smooth approximation of an indicator function, hence tending to give a spiky distribution instead of a uniform distribution over classes. We acknowledge this view and further consider it as a limitation in the design of the softmax classifier. To address this limitation, our inspiration starts from reconsidering its outputs, the class posterior probability p(y in |x), which does not consider the domain d at all. In other words, current methods condition on domain d = d in based on the implicit closed world assumption. Thus, we use our explicit variable d in the classifier, rewriting it as the quotient of the joint class-domain probability and the domain probability using the rule of conditional probability:

EQUATION

Equation 4 provides a probabilistic view of why classifiers tend to be overconfident. 2019), which adds an extra loss term to penalize a predicted non-uniform class probability when an out-of-distribution data is given to the classifier. In other words, this strategy requires out-of-distribution data for regularizing the training.

Without having supervision on domain d (i.e. without out-of-distribution data), there is no principled way to learn p(y in , d in |x). This situation is similar to unsupervised learning (or self-supervised learning) in that we need to insert assumptions or prior knowledge about the task for learning. In our case, we use the structure in Equation 4as the prior knowledge to re-design the structure of classifiers, leading to the decomposed confidence property.

We begin with describing a softmax function with logit f i (x) for class i. The f i (x) is defined by two functions h i (x) and g(x):

EQUATION

)

The h i (x) is a class-specific function similar to p(y in = i, d in |x), while the g(x) is shared among all classes like p(d in |x). The quotient of the two scores is then normalized by the exponential function (i.e. softmax) for outputting a class probability, which is subject to cross entropy loss. With Equation 5, the cross entropy loss can be minimized in two ways: increasing h i (x) or decreasing g(x). Here we make an assumption: There exist a pair of functions for h i (x) and g(x) so that h i (x) will have a harder time to output a large value for the data not in the high density region of in-distribution, but g(x) can easily output a small value (e.g. close to zero) for that case, making the logit f i (x) still able to generate a high p(y in = i|d in , x) for minimizing cross entropy loss.

There are several simple design choices for h i (x) and g(x) which satisfy the above assumption. Specifically we have g(x) = σ(BN (w g f p (x) + b g )), which uses features f p (x) from the penultimate layer of neural networks sequentially through another linear layer, batch normalization (BN , optional for a faster convergence), and a sigmoid function σ. For h i (x), we investigate three similarity measures, including inner-product (I), negative Euclidean distance (E), and cosine similarity (C) for h I i (x), h E i (x), and h C i (x), correspondingly:

EQUATION

The overall neural network model f θ therefore has two branches (h i and g) after its penultimate layer. At training time, the model calculates the logit f i followed by the softmax function with cross entropy loss on top of it. At testing time, the class prediction can be made by either calculating arg max i f i (x) or arg max i h i (x) (both will give the same predictions). For out-of-distribution detection, we use the scoring function S DeConf (x) = max i h i (x).

Note that when h i (x) = h I i (x) and g(x) = 1, this method reduces to the baseline (Hendrycks & Gimpel, 2017) . Additionally, the method in a concurrent work done by Techapanurak & Okatani (2019) can be regarded as a specific way to instantiate our framework when h i (x) = h C i (x). The above compatibility indicates that the proposed framework is general. Lastly, we call the three variants of our method DeConf-I, DeConf-E, and DeConf-C based the three different similarity measures (I, E, C) used in h i (x).

3.2. A MODIFIED INPUT PREPROCESSING STRATEGY:

This section describes a modified version of the input preprocessing method proposed in ODIN (Liang et al., 2017) . The main purpose of modification is making the search of the perturbation magnitude to not rely on out-of-distribution data. The perturbation of input is given by:

EQUATION

In the original method (Liang et al., 2017) the best value of is searched with a half-half mixed validation dataset of D val in ∼ p in and D val out ∼ p out over a list of 21 values. The perturbed images x are fed into the classification model f θ for calculating the score S(x). The performance of each magnitude is evaluated with the benchmark metric (TNR@TPR95, described later) and the best one is selected. This process repeats for each out-of-distribution dataset, and therefore the original method results in a number of values equal to the number of out-of-distribution datasets in the benchmark.

In our method, we search for the * which maximizes the score S(x) with only the in-distribution validation dataset D val in : * = arg max

EQUATION

Our searching criteria is still based on the same observation made by Liang et al. (2017) . They observe that the in-distribution images tend to have their score s increased more than the out-ofdistribution images when the input perturbation is applied. We therefore use Eq. 8 since we argue that an which makes a large score increase for in-distribution data should be sufficient to create a distinction in score. Our method also does not even require class labels although it is available in D val in . More importantly, our method selects only one based on D val in without access to the benchmark performance metric (e.g. TNR@TPR95), greatly avoiding the hyperparameter from fitting to a specific benchmark score. Lastly, we perform the search of on a much coarser grid, which has only 5 values: [0.0025, 0.005, 0.01, 0.02, 0.04]. Therefore, our search is much faster. Although overshooting is possible (e.g. the maximum value is at the middle of two scales in the grid) due to the coarser grid, it can be mitigated by reducing the found magnitude by one scale (i.e. divide it by two). This simple strategy consistently gains or maintains the performance on varied scoring functions, such as S Base , S DeConf , S ODIN , and S M aha .

The method in this section is orthogonal to all the methods evaluated in this work. For convenience, we will add a * after the name of other methods to indicate a combination, for example Baseline* and DeConf-C*.

4. EXPERIMENTS:



4.1. EXPERIMENTAL SETTINGS:

Overall procedure: In all experiments, we first train a classifier f θ on an in-distribution training set, then tune the hyperparameters (e.g. the perturbation magnitude ) on an in-distribution validation set without using its class labels. At testing time, the OOD detection scoring function S(x) calculates the scores s from the outputs of f θ . The scores s is calculated for both in-distribution validation set D val in and out-of-distribution dataset D out ∼ p out . The scores s are then sent to a performance metric calculation function. The above procedure is the same as related works in this line of research (Liang et al., 2017; Lee et al., 2018b; Hendrycks et al., 2019; Shafaei et al., 2019; Vyas et al., 2018 Lee et al., 2018a) , except that we do not use OOD data for tuning the hyperparameters in the scoring function S(x).

In-distribution Datasets: We use CIFAR-10/100 images with size 32x32 (Krizhevsky et al., 2009) for the classification task. Detecting OOD with CIFAR-100 classifier is generally harder than CIFAR-10, since a larger amount of classes usually involves a wider range of variance thus has a higher tendency to treat random data (e.g. Gaussian noise) as in-distribution. For that reason we use CIFAR-100 in our ablation and robustness study.

Out-of-distribution Datasets::

We include all the OOD datasets used in ODIN (Liang et al., 2017) , which are TinyImageNet(crop), TinyImageNet(resize), LSUN(crop), LSUN(resize), iSUN, Uniform random images, and Gaussian random images. We further add SVHN (Netzer et al., 2011) , a colored street numbers image dataset, to serve as a difficult OOD dataset. The selection is inspired by the finding in the line of works which uses a generative model for OOD detection (Ren et al., 2019; Nalisnick et al., 2018; Choi & Jang, 2018) . Those works report that a generative model of CIFAR-10 assigns higher likelihood to SVHN images, indicating a hard case for OOD detection.

Networks and Training Details::

We use DenseNet (Huang et al., 2017) , ResNet (He et al., 2016) , and WideResNet (Zagoruyko & Komodakis, 2016) for the classifier backbone. DenseNet has 100 layers with growth rate 12. It is trained with batch size 64 for 300 epochs with weight decay 0.0001. The ResNet and WideResNet-28-10 are trained with batch size 128 for 200 epochs with weight decay 0.0005. In both training, the optimizer is SGD with momentum 0.9, and the learning rate starts with 0.1 and decreases by factor 0.1 at 50% and 75% of the training epochs. Note that we do not apply weight decay for the weights in the h i (x) function of DeConf classifier since they work as the centroids for classes, and those weights are initialized with He-initialization (He et al., 2015) .

Evaluation Metrics: We use the two most widely adopted metrics in the OOD detection literature. The first one is the area under the receiver operating characteristic curve (AUROC), which plots the true positive rate (TPR) of in-distribution data against the false positive rate (TPR) of OOD data by varying a threshold. Thus it can be regarded as an averaged score. The second one is true negative rate at 95% true positive rate (TNR@TPR95), which simulates an application requirement that the recall of in-distribution data should be 95%. Having a high TNR under a high TPR is much more challenging than having a high AUROC score, thus TNR@TPR95 can discern between high-performing OOD detectors better. 

4.2. RESULTS AND DISCUSSION:

OOD benchmark performance: We show an overall comparison for methods that train without OOD data in Table 1 with 8 OOD benchmark datasets. The ODIN* and Mahalanobis* are significantly better than the baseline, while DeConf-C* still outperform them with a significant margin. These results clearly show that learning OOD detection without OOD data is feasible, and the two methods we proposed in Sections 3.1 and 3.2 combined are very effective for this purpose.

In Table 2 We further compare our results with the original ODIN (Liang et al., 2017) and Mahalanobis (Lee et al., 2018b ) methods which are tuned on each OOD dataset. We refer to the results of both original methods reported by Lee et al. (2018b) since it uses the same backbone network, OOD datasets, and metrics to evaluate OOD detection performance. In the comparison we find our ODIN* and Mahalanobis* perform worse than the ODIN orig and Mahalanobis orig in a major fraction of the cases. The result is not surprising because the original methods gain the advantage from using OOD data. However, our DeConf-C* still outperforms the two original methods with a margin in most of the cases. The cross-setting comparison further supports the effectiveness of proposed strategies.

Ablation Study: We study the effect of applying DeConf and our modified input preprocessing (IPP) strategy separately in Figure 1 and 2 . Figure 1 shows that all three variants (I, E, C) of the DeConf strategy help OOD detection performance with CIFAR-10 classifier, proving that the concept of DeConf is generally useful. However, the failure of DeConf-I with CIFAR-100 classifier may indicate the three variants have different robustness, which we will investigate in the next section. One downside of using the DeConf strategy is that the accuracy of the classifier may slightly reduce (Fig. 1b ). This could be a natural consequence of having an alternative term, i.e. g(x), in the model to fit the loss function. This may cause the lack of a high score for h i (x), instead assigning a lower score for the data away from the high density region of in-distribution data.

In Figure 2 , the results show that tuning the perturbation magnitude with only in-distribution data is an effective strategy, allowing us to reduce the required supervision for learning. The supervision here means the binary label for in/out-of-distribution.

Robustness Study: This study investigates when the OOD detection method will or will not work.

In Figure 3 , it shows that the number of in-distribution training data can largely affect the performance of the OOD detector. Mahalanobis has the lowest data requirement, but the DeConf method generally reaches a higher performance in the high data regime. In Figure 3 we also examine scalability by varying the number of classes in the in-distribution data. In this test, DeConf-E* and DeConf-C* show the best scalability. Overall, DeConf-C* is more robust than the other two DeConf variants. Lastly, Figure 4 shows that high performing methods such as DeConf-E*, DeConf-C*, and Mahalanobis* are not sensitive to the type and depth of neural networks. Therefore, the number of in-distribution samples and classes are the main factors that affect OOD detection performance. Figure 1 : An ablation study with three variants in our DeConf method (Section 3.1). Plain means g(x) = 1 so that the confidence decomposing effect is turned off. Each bar in (a) is averaged with the results on 8 OOD datasets listed in Table 1 . The backbone network is Resnet-34. Note that the plain setting with inner-product is equivalent to a vanilla Resnet for classification. Overall, our DeConf boosts the OOD detection performance while losing a small fraction of classification accuracy on in-distribution data.

Figure 2 : The OOD detection performance of our input preprocessing (IPP) strategy, which selects the perturbation magnitude with only in-distribution data. The setting plain means the IPP is turned off. The in-distribution data is CIFAR-100. The backbone network is Resnet-34. Each value is averaged with the results on 8 OOD datasets listed in Table 1 . Each method has its own scoring function S(x) (See Section 2.1 and 3), causing IPP to perform at varied levels of performance gain. 

4.3. SEMANTIC SHIFT VERSUS NON-SEMANTIC SHIFT:

One interesting aspect of out-of-distribution data that has not been explored is the separation of semantic and non-semantic shift. We therfore use a larger scale image dataset, DomainNet (Peng et al., 2018) , to repeat an evaluation similar to Table 1 . DomainNet has high resolution images in 345 classes from 6 different domains. There are 4 domains in the dataset with class labels available. They are real, sketch, infograph, and quickdraw, resulting in different types of distribution shifts.

To create subsets with semantic shift, we separate the classes to two splits. Split A has class indices from 0 to 172 while split B has 173 to 344. Our experiment uses real-A for in-distribution and has the other subsets for out-of-distribution. With the definition given in Section 2, real-B has a semantic shift from real-A, while sketch-A has a non-semantic shift. Sketch-B therefore has both types of distribution shift. Appendix Figure 5 illustrates the setup. The classifier learned on real-A uses a Resnet-34 backbone. Its training setting is described in Section 4.1 except that the networks are trained for 100 epochs and the images are center-cropped and resized to 224x224 in this experiment.

The results in Table 3 reveal two interesting trends. The first one is that the OOD datasets with both types of distribution shifts are easier to detect, followed by non-semantic shift. The semantic shift turns out to be the hardest one to be detected. The second observation is the failure of Mahalanobis*.

In most of the cases it is even worse than Baseline, except detecting random noise. In contrast, ODIN* has performance gain in most of the cases, but has less gain with random noise. Our DeConf-C* still performs the best, showing that its robustness and scalability is capable of handling a more realistic problem setting, although there is still large room for improvement.

5. CONCLUSION:

This paper shows methods and results that strongly suggest that learning OOD detection without OOD data is a viable option. Our comprehensive analysis shows that our two strategies, the decomposed confidence and modified input preprocessing, are effective and even better in many cases than the methods tuned for each OOD dataset. Our further analysis using a larger scale image dataset shows that the data with only semantic shift is harder to detect, pointing out a challenge for future works to address. ) /99.9(0.0) /99.9(0.0) Gaussian 48.0(28.) /62.0(38.) /100.(0.0) /6.79(4.9) /99.9(0.0) /99.9(0. 93.9(0.4) /92.9(2.9) /98.2(0.0) /98.6(0.0) /98.8(0.0) /99.4(0.1) iSUN 93.0(0.7) /92.2(3.4) /98.2(0.0) /98.6(0.0) /98.8(0.0) /99.4(0.0) SVHN 88.1(4.8) /89.6(0.3) /98.0(0.3) /98.2(0.2) /98.4(0.6) /98.8(0.1) Uniform 95.4(0.7) /98.9(0.7) /99.9(0.0) /99.2(0.5) /99.9(0.0) /99.9(0.0) Gaussian 94.0(2.9) /98.6(1.7) /100.(0.0) /99.1(0.3) /99.9(0.0) /99.9(0. 

:



Figures and Tables:

OOD detection performance with/without DeConf strategy (no input preprocessing). Left: CIFAR-10 classifier; Right: CIFAR-100 classifier.

Figure 3: Robustness analysis of 6 OOD detection methods. The left figure has classifiers trained on varied number of samples in CIFAR-10. The right figure has classifiers trained on varied number of classes in CIFAR-100. Each point in the line is an average of the results on 8 OOD datasets. The backbone network is Resnet-34. Please see Section 4.2 for a detailed discussion.

Figure 4: Robustness analysis using different neural network backbones. The in-distribution data is CIFAR-100. Each bar is averaged with the results on 8 OOD datasets. Table 3: Performance of four OOD detection methods using DomainNet. The in-distribution is the real-A subset. Each value is averaged over three runs. The type of distribution shift presents a trend of difficulty to the OOD detection problem: Semantic shift > Non-semantic shift > Semantic + Non-semantic shift.

Figure5: Semantic shift versus Non-semantic shift. We setup the two types of distribution shifts using DomainNet(Peng et al., 2018)

2.8) /56.0(3.1) /63.5(2.1) /31.0(3.4) /74.6(2.8) /87.8(1.7) Imagenet(r) 22.3(3.1) /59.4(3.7) /82.0(1.6) /21.4(4.0) /87.6(1.7) /93.3(1.2) LSUN(c) 23.0(2.2) /53.0(1.0) /31.6(1.3) /59.6(1.9) /51.0(1.0) /75.0(1.9) LSUN(r) 23.7(2.5) /64.0(3.0) /82.6(1.8) /21.1(3.3) /89.8(1.5) /93.8(0.3) iSUN 21.5(2.8) /58.4(4.1) /81.2(1.4) /17.6(3.3) /87.3(1.2) /92.5(0.2) SVHN 18.9(4.9) /35.3(2.9) /43.3(2.7) /52.0(0.6) /67.1(3.4) /77.0(5.0) Uniform 2.95(4.1) /66.1(46.) /100.(0.0) /0.0(0.0) /100.(0.0) /100.(0

Consider an example x ∼ p out : It is natural to expect that the joint probability P (y in , d in |x) is low (e.g. 0.09) for its maximum value among C classes. One would also expect its domain probability p(d in |x) is low (e.g. 0.1). Therefore, calculating p(y in |d in , x) with Equation4gives a high probability (0.9), demonstrating how overconfidence can result. Based on the form of Equation4, we call p(y in , d in |x) and p(d in |x) the decomposed confidence scores.One straight-forward solution for the above issue is to learn a classifier to predict the joint probability p(y in , d in |x) by having both supervision on class y in and domain d. Learning to predict p(y

Table content: <table/>

; Performance of four OOD detection methods. All methods in the table have no access to OOD data during training and validation. ODIN* and Mahalanobis* are modified versions that don't need any OOD data for tuning (see Section 2.1). The base network used in the table is DenseNet. All values are percentages averaged over three runs and the best results are indicated in bold. A more comprehensive version of the table is available in Appendix Table 5.

Table content: <table><tr><td>ID</td><td>OOD</td><td>AUROC</td><td>TNR@TPR95</td></tr><tr><td/><td/><td colspan="2">Baseline / ODIN* / Mahalanobis* / DeConf-C*</td></tr><tr><td/><td colspan="3">Imagenet(c) 79.0 / 90.5 / 92.4 / 97.6 25.3 / 56.0 / 63.5 / 87.8</td></tr><tr><td>CIFAR-100</td><td colspan="3">Imagenet(r) 76.4 / 91.1 / 96.4 / 98.6 22.3 / 59.4 / 82.0 / 93.3 LSUN(c) 78.6 / 89.9 / 81.2 / 95.3 23.0 / 53.0 / 31.6 / 75.0 LSUN(r) 78.2 / 93.0 / 96.6 / 98.7 23.7 / 64.0 / 82.6 / 93.8 iSUN 76.8 / 91.6 / 96.5 / 98.4 21.5 / 58.4 / 81.2 / 92.5 SVHN 78.1 / 85.6 / 89.9 / 95.9 18.9 / 35.3 / 43.3 / 77.0 Uniform 65.0 / 91.4 / 100. / 99.9 2.95 / 66.1 / 100. / 100.</td></tr><tr><td/><td>Gaussian</td><td colspan="2">48.0 / 62.0 / 100. / 99.9 0.06 / 33.3 / 100. / 100.</td></tr><tr><td/><td colspan="3">Imagenet(c) 92.1 / 88.2 / 96.3 / 98.7 50.0 / 47.8 / 81.2 / 93.4</td></tr><tr><td/><td colspan="3">Imagenet(r) 91.5 / 90.1 / 98.2 / 99.1 47.4 / 51.9 / 90.9 / 95.8</td></tr><tr><td>CIFAR-10</td><td>LSUN(c) LSUN(r) iSUN SVHN</td><td colspan="2">93.0 / 91.3 / 92.2 / 98.3 51.8 / 63.5 / 64.2 / 91.5 93.9 / 92.9 / 98.2 / 99.4 56.3 / 59.2 / 91.7 / 97.6 93.0 / 92.2 / 98.2 / 99.4 52.3 / 57.2 / 90.6 / 97.5 88.1 / 89.6 / 98.0 / 98.8 40.5 / 48.7 / 90.6 / 94.0</td></tr><tr><td/><td>Uniform</td><td>95.4 / 98.</td><td/></tr></table>

OOD detection with OOD data versus without OOD data. The values of ODIN orig and Maha orig (abbreviation of Mahalanobis) are copied from the Mahalanobis paper(Lee et al., 2018b)   which are tuned with OOD data. The values of ODIN*, Maha*, and DeConf-C* are copied from Table1of our paper which do not have any access to OOD data. All methods in this table use the same DenseNet for backbone. Note that the Mahalanobis paper(Lee et al., 2018b)  only has three OOD datasets for the table, so we only compare with those cases.

Table content: <table><tr><td>ID</td><td>OOD</td><td>AUROC</td><td>TNR@TPR95</td></tr><tr><td/><td/><td colspan="2">ODIN orig / Maha orig / ODIN* / Maha* / DeConf-C*</td></tr><tr><td/><td colspan="3">Imagenet(r) 85.2 / 97.4 / 91.1 / 96.4 / 98.6 42.6 / 86.6 / 59.4 / 82.0 / 93.3</td></tr><tr><td>CIFAR-100</td><td>LSUN(r)</td><td colspan="2">85.5 / 98.0 / 93.0 / 96.6 / 98.7 41.2 / 91.4 / 64.0 / 82.6 / 93.8</td></tr><tr><td/><td>SVHN</td><td colspan="2">93.8 / 97.2 / 85.6 / 89.9 / 95.9 70.6 / 82.5 / 35.3 / 43.3 / 77.0</td></tr><tr><td/><td colspan="3">Imagenet(r) 98.5 / 98.8 / 90.1 / 98.2 / 99.1 92.4 / 95.0 / 51.9 / 90.9 / 95.8</td></tr><tr><td>CIFAR-10</td><td>LSUN(r)</td><td colspan="2">99.2 / 99.3 / 92.9 / 98.2 / 99.4 96.2 / 97.2 / 59.2 / 91.7 / 97.6</td></tr><tr><td/><td>SVHN</td><td colspan="2">95.5 / 98.1 / 89.6 / 98.0 / 98.8 86.2 / 90.8 / 48.7 / 90.6 / 94.0</td></tr></table>



Table content: <table><tr><td>OOD</td><td>AUROC</td><td>TNR@TPR95</td></tr><tr><td/><td colspan="2">Baseline / ODIN* / Mahalanobis* / DeConf-C*</td></tr><tr><td>painting</td><td colspan="2">71.4(0.1) /62.4(0.2) /57.4(1.0) /66.7(0.2) 15.6(0.2) /5.55(0.2) /5.00(0.0) /7.40(0.5)</td></tr><tr><td>sketch</td><td colspan="2">75.8(0.1) /81.8(0.3) /63.8(0.1) /85.5(0.3) 19.7(0.5) /30.6(0.8) /8.21(0.1) /37.2(1.5)</td></tr><tr><td>clipart</td><td colspan="2">69.8(0.2) /82.6(0.1) /73.6(0.4) /85.0(0.0) 15.2(0.4) /35.3(0.5) /15.7(0.2) /41.7(0.6)</td></tr><tr><td>infograph</td><td colspan="2">77.4(0.0) /82.1(0.3) /80.4(0.8) /88.5(0.2) 18.7(0.4) /25.7(1.1) /20.5(1.0) /43.5(2.0)</td></tr><tr><td colspan="3">quickdraw 78.8(0.8) /97.6(0.1) /71.8(5.3) /97.4(0.2) 19.4(1.7) /88.4(0.8) /3.43(0.8) /87.5(1.7)</td></tr><tr><td>Uniform</td><td colspan="2">74.3(28.) /88.6(13.) /99.8(0.0) /97.0(1.1) 38.5(41.) /66.4(46.) /100.(0.0) /91.1(6.9)</td></tr><tr><td>Gaussian</td><td colspan="2">57.9(19.) /89.3(12.) /99.9(0.0) /98.1(0.1) 0.08(0.1) /66.6(47.) /100.(0.0) /99.9(0.1)</td></tr></table>

Performance of six OOD detection methods on 8 benchmark datasets. This is a full version of Table1which uses DenseNet for the backbone networks. The value in parentheses is the standard deviation.

Table content: <table><tr><td>ID</td><td>OOD</td><td>AUROC</td></tr><tr><td/><td/><td>Baseline / ODIN* / Maha* / DeConf-I* / DeConf-E* / DeConf-C*</td></tr><tr><td/><td>Imagenet(c)</td><td>79.0(2.2) /90.5(1.1) /92.4(0.3) /84.4(2.3) /95.1(0.5) /97.6(0.2)</td></tr><tr><td>CIFAR-100</td><td>Imagenet(r) LSUN(c) LSUN(r) iSUN SVHN Uniform</td><td>76.4(3.2) /91.1(1.3) /96.4(0.2) /81.2(3.6) /97.4(0.3) /98.6(0.2) 78.6(1.1) /89.9(0.5) /81.2(0.6) /91.7(0.3) /90.1(0.3) /95.3(0.4) 78.2(2.4) /93.0(0.8) /96.6(0.2) /84.1(2.1) /97.8(0.2) /98.7(0.0) 76.8(2.7) /91.6(1.1) /96.5(0.2) /82.1(2.9) /97.4(0.2) /98.4(0.0) 78.1(3.5) /85.6(0.0) /89.9(0.2) /89.7(0.4) /94.0(0.6) /95.9(0.7) 65.0(22.) /91.4(10.) /100.(0.0) /48.5(16.</td></tr></table>

Peer review (iclr2020):
Summary: Inspired by recent methods that aim to make neural networks (NNs) robust by training on both in- and out-of-distribution (OOD) data [Liang et al., 2017; Lee et al., 2018], this paper addresses the question of if the same level of robustness can be obtained without training on an OOD set. The authors propose introducing an auxiliary variable to directly model whether a given input originates from the training data or not. Of course, training a function to predict directly would require OOD data or at least a simulation of OOD from in-distribution data. To bypass this obstacle, the authors make an argument that parametrizing the softmax input with two functions--- ---is reminiscent of computing the conditional probability , with representing the joint density and the marginal. The paper also proposes an input perturbation strategy similar to Liang et al.’s [2017], the difference being the perturbation magnitude is set by maximizing instead of on OOD data. Experiments are reported showing performance on OOD detection, OOD detection when having access to OOD data during training vs when not, the effect of different choices of , the effect of the proposed data augmentation strategy, the effect of number of samples, classes, and architecture parameters, and the effect of the distributional shifts being semantic vs non-semantic. Pros: Making deep learning methods robust to distributional shift is essential for their safe deployment. As the paper notes, many previously proposed methodologies require access to OOD data. However, this reliance on OOD data not only adds implementation costs (extra memory and computation) but also makes the choice of OOD set a crucial modeling decision. I am unaware of any rigorous guidance for selecting a representative OOD set for a given training set. This paper makes some incremental but important contributions in relieving ODIN of its dependence on OOD data. These proposals are supported with a fairly thorough experimental investigation. The paper reports not only comparisons against sensible baselines but also performs ablation studies to isolate the effect of parametrization choices and their data augmentation strategy. Cons: My most significant critique of the paper is that it exaggerates its contributions and ignores a large body of previous work. There are two falsely claimed contributions in particular. The first is that the paper is the first to consider OOD detection without training with OOD data: “To our knowledge, this is the first study focused on such a minimal setting, investigating the feasibility of learning out-of-distribution detection without out-of-distribution data” (p 2). This is patently false. Classification with a rejection option has been studied for many years, and much of this work does not assume access to an OOD set. For just one example, Hellman [1970] considers k-nearest neighbor classification with a rejection option and requires no OOD set. Perhaps the authors meant this as a contribution w.r.t. neural networks, but that is not the case either. Cordella et al. [1995] studied rejection rules for MLPs, and Geifman & El-Yaniv [2017] studied selective classification for deep networks. To the best of my knowledge, neither of these works require OOD data for training (although I am not intimately familiar with the methodology). The second falsely claimed contribution is the use of an auxiliary variable to represent that the data is in-distribution: “We specifically add a binary variable, representing whether the data is in-distribution or not” (p 2). It surprises me that the authors would think that this idea hadn’t been proposed before, given its a rather obvious thing to try. The idea dates back at least to Cortes et al. [2016]; see Section 2.1 on “General Rejection Models.” Geifman & El-Yaniv [2017] use the same framework in the deep learning setting, defining a binary “selection function.” Given these omissions, the paper cannot be accepted in its current form. It requires substantial revisions: discussion of this previous work and modification of the claimed contributions. I think a proper characterization of the work would to be to call it an extension of ODIN: using a selection function to parametrize ODIN’s temperature. Yet this brings another question to the forefront: why is used to determine rejection when is supposed to be a proxy for (Equation 4)? In the public discussion, the authors state that does indeed work to a degree, but just not as well. This seems to call into question the foundational motivations of the procedure, and the authors should address this by including experiments comparing and . Final evaluation: The paper over-claims its contributions and ignores some very related work (e.g. [Geifman & El-Yaniv, NeurIPS 2017]), thus necessitating substantial revisions to the text. Moreover, the selection function has not been demonstrated to behave as the core motivation for the work implies it should---namely, modeling . References Cordella, Luigi Pietro, et al. *A method for improving classification reliability of multilayer perceptrons.* IEEE Transactions on Neural Networks 6.5 (1995): 1140-1147. Cortes, Corinna, Giulia DeSalvo, and Mehryar Mohri. *Learning with rejection.* International Conference on Algorithmic Learning Theory. Springer, Cham, 2016. Geifman, Yonatan, and Ran El-Yaniv. *Selective classification for deep neural networks.* Advances in neural information processing systems. 2017. Hellman, Martin E. *The nearest neighbor classification rule with a reject option.* IEEE Transactions on Systems Science and Cybernetics 6.3 (1970): 179-185.