SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Charles Guille-Escuret
ServiceNow Research, Mila,
guillech@mila.quebec
Pau Rodriguez
pau.rodriguez@servicenow.com
David Vazquez
david.vazquez@servicenow.com
Mila, Université de Montréal,
Canada CIFAR AI chair
ioannis@mila.quebec
Joao Monteiro
joao.monteiro@servicenow.com
Handling out-of-distribution (OOD) samples has become a major stake in the real-world deployment of machine learning systems. This work explores the use of self-supervised contrastive learning to the simultaneous detection of two types of OOD samples: unseen classes and adversarial perturbations. First, we pair self-supervised contrastive learning with the maximum mean discrepancy (MMD) two-sample test. This approach enables us to robustly test whether two independent sets of samples originate from the same distribution, and we demonstrate its effectiveness by discriminating between CIFAR-10 and CIFAR-10.1 with higher confidence than previous work. Motivated by this success, we introduce CADet (Contrastive Anomaly Detection), a novel method for OOD detection of single samples. CADet draws inspiration from MMD, but leverages the similarity between contrastive transformations of a same sample. CADet outperforms existing adversarial detection methods in identifying adversarially perturbed samples on ImageNet and achieves comparable performance to unseen label detection methods on two challenging benchmarks: ImageNet-O and iNaturalist. Significantly, CADet is fully self-supervised and requires neither labels for in-distribution samples nor access to OOD examples. $^{1}$
While modern machine learning systems have achieved countless successful real-world applications, handling out-of-distribution (OOD) inputs remains a tough challenge of significant importance. The
<sup>1</sup>Our code to compute CADet scores is publicly available as an OpenOOD fork at https://github.com/charlesGE/OpenOOD-CADet.
problem is especially acute for high-dimensional problems like image classification. Models are typically trained in a close-world setting but inevitably faced with novel input classes when deployed in the real world. The impact can range from displeasing customer experience to dire consequences in the case of safety-critical applications such as autonomous driving [31] or medical analysis [55]. Although achieving high accuracy against all meaningful distributional shifts is the most desirable solution, it is particularly challenging. An efficient method to mitigate the consequences of unexpected inputs is to perform anomaly detection, which allows the system to anticipate its inability to process unusual inputs and react adequately.
Anomaly detection methods generally rely on one of three types of statistics: features, logits, and softmax probabilities, with some systems leveraging a mix of these [66]. An anomaly score  $f(x)$  is computed, and then detection with threshold  $\tau$  is performed based on whether  $f(x) > \tau$ . The goal of a detection system is to find an anomaly score that efficiently discriminates between in-distribution and out-of-distribution samples. However, the common problem of these systems is that different distributional shifts will unpredictably affect these statistics. Accordingly, detection systems either achieve good performance on specific types of distributions or require tuning on OOD samples. In both cases, their practical use is severely limited. Motivated by these issues, recent work has tackled the challenge of designing detection systems for unseen classes without prior knowledge of the unseen label set or access to OOD samples [68, 63, 66].
We first investigate the use of maximum mean discrepancy two-sample test (MMD) [19] in conjunction with self-supervised contrastive learning to assess whether two sets of samples have been drawn from the same distribution. Motivated by the strong testing power of this method, we then introduce a statistic inspired by MMD and leveraging contrastive transformations. Based on this statistic, we propose CADet (Contrastive Anomaly Detection), which is able to detect OOD samples from single inputs and performs well on both label-based and adversarial detection benchmarks, without requiring access to any OOD samples to train or tune the method.
Only a few works have addressed these tasks simultaneously. These works either focus on particular in-distribution data such as medical imaging for specific diseases [65] or evaluate their performances on datasets with very distant classes such as CIFAR10 [32], SVHN [47], and LSUN [73], resulting in simple benchmarks that do not translate to general real world applications [33, 51].
- We use similarity functions learned by self-supervised contrastive learning with MMD to show that the test sets of CIFAR10 and CIFAR10.1 [52] have different distributions.
- We propose a novel improvement to MMD and show it can also be used to confidently detect distributional shifts when given a small number of samples.
- We introduce CADet, a fully self-supervised method for OOD detection inspired by MMD, and show it outperforms current methods in adversarial detection tasks while performing well on label-based OOD detection.
The outline is as follows: in Section 2, we discuss relevant previous work. Section 3 describes the self-supervised contrastive method based on SimCLRv2 [5] used in this work. Section 4 explores the application of learned similarity functions in conjunction with MMD to verify whether two independent sets of samples are drawn from the same distribution. Section 5 presents CADet and evaluates its empirical performance. Finally, we discuss results and limitations in Section 6.
We propose a self-supervised contrastive method for anomaly detection (both unknown classes and adversarial attacks) inspired by MMD. Thus, our work intersects with the MMD, label-based OOD detection, adversarial detection, and self-supervised contrastive learning literature.
MMD two-sample test has been extensively studied [19, 67, 18, 62, 8, 29], though it is, to the best of our knowledge, the first time a similarity function trained via contrastive learning is used in conjunction with MMD. Liu et al. [35] uses MMD with a deep kernel trained on a fraction of the samples to argue that CIFAR10 and CIFAR10.1 have different test distributions. We build upon that work by confirming their finding with higher confidence levels, using fewer samples. Dong et al. [11] explored applications of MMD to OOD detection.
Label-based OOD detection methods discriminate samples that differ from those in the training distribution. We focus on unsupervised OOD detection in this work, i.e., we do not assume access to data labeled as OOD. Unsupervised OOD detection methods include density-based [74, 45, 46, 7, 12, 53, 59, 17, 37, 10], reconstruction-based [56, 75, 9, 50, 49, 7], one-class classifiers [57, 54], self-supervised [15, 25, 2, 63], and supervised approaches [34, 23], though some works do not fall into any of these categories [66, 60]. We refer to Yang et al. [71] for an overview of the many recent works in this field.
Adversarial detection discriminates adversarial samples from the original data. Adversarial samples are generated by minimally perturbing actual samples to produce a change in the model's output, such as a misclassification. Most works rely on the knowledge of some attacks for training [1, 43, 13, 39, 76, 48, 40], with the exception of [27].
Self-supervised contrastive learning methods [69, 22, 4, 5] are commonly used to pre-train a model from unlabeled data to solve a downstream task such as image classification. Contrastive learning relies on instance discrimination trained with a contrastive loss [21] such as infoNCE [20].
Contrastive learning for OOD detection aims to find good representations for detecting OOD samples in a supervised [36, 30] or unsupervised [68, 44, 58] setting. Perhaps the closest work in the literature is CSI [63], which found SimCLR features to have good discriminative power for unknown classes detection and leveraged similarities between transformed samples in their score. However, this method is not well-suited for adversarial detection. CSI ignores the similarities between different transformations of a same sample, an essential component to perform adversarial detection (see Section 6.2). In addition, CSI scales their score with the norm of input representations. While efficient on samples with unknown classes, it is unreliable on adversarial perturbations, which typically increase representation norms. Finally, we failed to scale CSI to ImageNet.
3 Contrastive model
We build our model on top of SimCLRv2 [5] for its simplicity and efficiency. It is composed of an encoder backbone network  $f_{\theta}$  as well as a 3-layer contrastive head  $h_{\theta'}$ . Given an in-distribution sample  $\mathcal{X}$ , a similarity function sim, and a distribution of training transformations  $\mathcal{T}_{train}$ , the goal is to simultaneously maximize
$$
\mathbb {E} _ {x \sim \mathcal {X}; t _ {0}, t _ {1} \sim \mathcal {T} _ {\text {t r a i n}}} \left[ s i m \left(h _ {\theta^ {\prime}} \circ f _ {\theta} \left(t _ {0} (x)\right), h _ {\theta^ {\prime}} \circ f _ {\theta} \left(t _ {1} (x)\right)\right) \right],
$$
and minimize
$$
\mathbb {E} _ {x, y \sim \mathcal {X}; t _ {0}, t _ {1} \sim \mathcal {T} _ {\text {t r a i n}}} \left[ \operatorname {s i m} \left(h _ {\theta^ {\prime}} \circ f _ {\theta} \left(t _ {0} (x)\right), h _ {\theta^ {\prime}} \circ f _ {\theta} \left(t _ {1} (y)\right)\right) \right],
$$
i.e., we want to learn representations in which random transformations of a same example are close while random transformations of different examples are distant.
To achieve this, given an input batch  $\{x_{i}\}_{i = 1,\dots ,N}$ , we compute the set  $\{x_i^{(j)}\}_{j = 0,1;i = 1,\dots ,N}$  by applying two transformations independently sampled from  $\mathcal{T}_{train}$  to each  $x_{i}$ . We then compute the embeddings  $z_{i}^{(j)} = h_{\theta^{\prime}}\circ f_{\theta}(x_{i}^{(j)})$  and apply the following contrastive loss:
$$
L (\mathbf {z}) = \sum_ {i = 1, \dots , N} - \log \frac {u _ {i , j}}{\sum_ {j \in \{1 , \dots , N \}} \left(u _ {i , j} + v _ {i , j}\right)}, \tag {1}
$$
$$
u _ {i, j} = e ^ {s i m (z _ {i} ^ {(0)}, z _ {j} ^ {(1)}) / \tau} \quad \text {a n d} \quad v _ {i, j} = \mathbb {1} _ {i \neq j} e ^ {s i m (z _ {i} ^ {(0)}, z _ {j} ^ {(0)}) / \tau}.
$$
$\tau$  is the temperature hyperparameter and  $sim(x,y) = \frac{\langle x|y\rangle}{\|x\|_2\|y\|_2}$  is the cosine similarity.
Hyperparameters: We follow as closely as possible the setting from SimCLRv2 with a few modifications to adapt to hardware limitations. In particular, we use the LARS optimizer [72] with learning rate 1.2, momentum 0.9, and weight decay  $10^{-4}$ . Iteration-wise, we scale up the learning rate for the first 40 epochs linearly, then use an iteration-wise cosine decaying schedule until epoch 800, with temperature  $\tau = 0.1$ . We train on 8 V100 GPUs with an accumulated batch size of 1024. We compute the contrastive loss on all batch samples by aggregating the embeddings computed by each GPU. We use synchronized BatchNorm and fp32 precision and do not use a memory buffer. We use the same set of transformations, i.e., Gaussian blur and horizontal flip with probability 0.5, color
jittering with probability 0.8, random crop with scale uniformly sampled in [0.08, 1], and grayscale with probability 0.2.
For computational simplicity and comparison with previous work, we use a ResNet50 encoder architecture with final features of size 2048. Following SimCLRv2, we use a three-layer fully connected contrastive head with hidden layers of width 2048 using ReLU activation and batchNorm and set the last layer projection to dimension 128. For evaluation, we use the features produced by the encoder without the contrastive head. We do not, at any point, use supervised fine-tuning.
4 MMD two-sample test
The Maximum Mean Discrepancy (MMD) is a statistic used in the MMD two-sample test to assess whether two sets of samples  $S_{\mathbb{P}}$  and  $S_{\mathbb{Q}}$  are drawn from the same distribution. It estimates the expected difference between the intra-set distances and the across-sets distances.
Definition 4.1 (Gretton et al. [19]). Let  $k: \mathcal{X} \times \mathcal{X} \to \mathbb{R}$  be the kernel of a reproducing Hilbert space  $\mathcal{H}_k$ , with feature maps  $k(\cdot, x) \in \mathcal{H}_k$ . Let  $X, X' \sim \mathbb{P}$  and  $Y, Y' \sim \mathbb{Q}$ . Under mild integrability conditions,
$$
\begin{array}{l} M M D (\mathbb {P}, \mathbb {Q}; \mathcal {H} _ {k}) := \sup  _ {f \in \mathcal {H}, \| f \| _ {\mathcal {H} _ {k}} \leq 1} | \mathbb {E} [ f (X) ] - \mathbb {E} [ f (Y) ] | (2) \\ = \sqrt {\mathbb {E} \left[ k \left(X , X ^ {\prime}\right) + k \left(Y , Y ^ {\prime}\right) - 2 k (X , Y) \right]}. (3) \\ \end{array}
$$
Given two sets of  $n$  samples  $S_{\mathbb{P}} = \{X_i\}_{i\leq n}$  and  $S_{\mathbb{Q}} = \{Y_i\}_{i\leq n}$ , respectively drawn from  $\mathbb{P}$  and  $\mathbb{Q}$ , we can compute the following unbiased estimator [35]:
$$
\widehat {M M D} _ {u} ^ {2} \left(S _ {\mathbb {P}}, S _ {\mathbb {Q}}; k\right) := \frac {1}{n (n - 1)} \sum_ {i \neq j} \left(k \left(X _ {i}, X _ {j}\right) + k \left(Y _ {i}, Y _ {j}\right) - k \left(X _ {i}, Y _ {j}\right) - k \left(Y _ {i}, X _ {j}\right)\right). \tag {4}
$$
Under the null hypothesis  $\mathfrak{h}_0: \mathbb{P} = \mathbb{Q}$ , this estimator follows a normal distribution of mean 0 [19]. Its variance can be directly estimated [18], but it is simpler to perform a permutation test as suggested in Sutherland et al. [62], which directly yields a  $p$ -value for  $\mathfrak{h}_0$ . The idea is to use random splits  $X, Y$  of the input sample sets to obtain  $n_{perm}$  different (though not independent) samplings of  $\widehat{MMD_u^2}(X, Y; k)$ , which approximate the distribution of  $\widehat{MMD_u^2}(S_{\mathbb{P}}, S_{\mathbb{P}}; k)$  under the null hypothesis.
Liu et al. [35] trains a deep kernel to maximize the test power of the MMD two-sample test on a training split of the sets of samples to test. We propose instead to use our learned similarity function without any fine-tuning. Note that we return the  $p$ -value  $\frac{1}{n_{perm} + 1} \left( 1 + \sum_{i=1}^{n_{perm}} \mathbb{1}(p_i \geq est) \right)$  instead of  $\frac{1}{n_{perm}} \sum_{i=1}^{n_{perm}} \mathbb{1}(p_i \geq est)$ . Indeed, under the null hypothesis  $\mathbb{P} = \mathbb{Q}$ ,  $est$  and  $p_i$  are drawn from the same distribution, so for  $j \in \{0, 1, \dots, n_{perm}\}$ , the probability for  $est$  to be smaller than exactly  $j$  elements of  $\{p_i\}$  is  $\frac{1}{n_{perm} + 1}$ . Therefore, the probability that  $j$  elements or less of  $\{p_i\}_i$  are larger than  $est$  is  $\sum_{i=0}^{j} \frac{1}{n_{perm} + 1} = \frac{j+1}{n_{perm} + 1}$ . While this change has a small impact for large values of  $n_{perm}$ , it is essential to guarantee that we indeed return a correct  $p$ -value. Notably, the algorithm of Liu et al. [35] has a probability  $\frac{1}{n_{perm}} > 0$  to return an output of 0.00 even under the null hypothesis.
Additionally, we propose a novel version of MMD called MMD-CC (MMD with Clean Calibration). Instead of computing  $p_i$  based on random splits of  $S_{\mathbb{P}} \cup S_{\mathbb{Q}}$ , we require as input two disjoint sets of samples drawn from  $\mathbb{P}$  and compute  $p_i$  based on random splits of  $S_{\mathbb{P}}^{(1)} \cup S_{\mathbb{P}}^{(2)}$  (see Algorithm 1). This change requires to use twice as many samples from  $\mathbb{P}$ , but reduces the variance induced by the random splits of  $S_{\mathbb{P}} \cup S_{\mathbb{Q}}$ , which is significant when the number of samples is small. Note that  $S_{\mathbb{P}}^{(1)}$ ,  $S_{\mathbb{P}}^{(2)}$  and  $S_{\mathbb{Q}}$  must always have the same size. Under the null hypothesis,  $\mathbb{P} = \mathbb{Q}$ ,  $S_{\mathbb{P}}^{(1)}$ ,  $S_{\mathbb{P}}^{(2)}$  and  $S_{\mathbb{Q}}$  are identically distributed, so the  $p_i$  conserve the same distribution as for MMD (this is not the case when  $\mathbb{P} \neq \mathbb{Q}$ , hence the difference in testing power). Thus, the validity of MMD-CC follows from the validity of MMD.
Algorithm 1 MMD-CC two-sample test
Input:  $S_{\mathbb{P}}^{(1)}, S_{\mathbb{P}}^{(2)}, S_{\mathbb{Q}}, n_{perm}, sim$   
est  $\leftarrow \widehat{MMD}_u^2(S_{\mathbb{P}}^{(1)}, S_{\mathbb{Q}}; sim)$   
for  $i = 1, 2, \ldots, n_{perm}$  do  
Randomly split  $S_{\mathbb{P}}^{(1)} \cup S_{\mathbb{P}}^{(2)}$  into two disjoint sets  $X, Y$  of equal size  $p_i \leftarrow \widehat{MMD}_u^2(X, Y; sim)$   
end for  
Output:  $p: \frac{1}{1 + n_{perm}} \left(1 + \sum_{i=1}^{n_{perm}} \mathbb{1}(p_i \geq est)\right)$
4.1 Distribution shift between CIFAR-10 and CIFAR-10.1 test sets
After years of evaluation of popular supervised architectures on the test set of CIFAR-10 [32], modern models may overfit it through their hyperparameter tuning and structural choices. CIFAR-10.1 [52] was collected to verify the performances of these models on a truly independent sample from the training distribution. The authors note a consistent drop in accuracy across models and suggest it could be due to a distributional shift, though they could not demonstrate it. Recent work [35] leveraged the two-sample test to provide strong evidence of distributional shifts between the test sets of CIFAR-10 and CIFAR-10.1. We run MMD-CC and MMD two-sample tests for 100 different samplings of  $S_{\mathbb{P}}^{(1)}, S_{\mathbb{P}}^{(2)}, S_{\mathbb{Q}}$ , using every time  $n_{perm} = 500$ , and rejecting  $\mathfrak{h}_0$  when the obtained  $p$ -value is below the threshold  $\alpha = 0.05$ . We also report results using cosine similarity applied to the features of supervised models as a comparative baseline. We report the results in Table 1 for a range of sample sizes. We compare the results to three competitive methods reported in Liu et al. [35]: Mean embedding (ME) [8, 29], MMD-D [35], and C2ST-L [6]. Finally, we show in Figure 1a the ROC curves of the proposed model for different sample sizes.
Other methods in the literature do not use external data for pre-training, as we do with ImageNet, which makes a fair comparison difficult. However, it is noteworthy that our learned similarity can very confidently distinguish samples from the two datasets, even in settings with fewer samples available. Furthermore, while we achieve excellent results even with a supervised network, our model trained with contrastive learning outperforms the supervised alternative very significantly. We note however that with such high number of samples available, MMD-CC performs slightly worse than MMD. Finally, we believe the confidence obtained with our method decisively concludes that CIFAR10 and CIFAR10.1 have different distributions, which is likely the primary explanation for the significant drop in performances across models on CIFAR10.1, as conjectured by Recht et al. [52]. The difference in distribution between CIFAR10 and CIFAR10.1 is neither based on label set nor adversarial perturbations, making it an interesting task.
Table 1: Average rejection rates of  $\mathfrak{h}_0$  on CIFAR-10 vs CIFAR-10.1 for  $\alpha = 0.05$  across different sample sizes  $n$ , using a ResNet50 backbone.
n=2000	n=1000	n=500	n=200	n=100	n=50
ME [8]	0.588	-	-	-	-	-
C2ST-L [6]	0.529	-	-	-	-	-
MMD-D [35]	0.744	-	-	-	-	-
MMD + SimCLRv2 (ours)	1.00	1.00	0.997	0.702	0.325	0.154
MMD-CC + SimCLRv2 (ours)	1.00	1.00	0.997	0.686	0.304	0.150
MMD + Supervised (ours)	1.00	1.00	0.884	0.305	0.135	0.103
MMD-CC + Supervised (ours)	1.00	1.00	0.870	0.298	0.131	0.096
Table 2: AUROC for detection using two-sample test on 3 to 20 samples drawn from ImageNet and from ImageNet-O, iNaturalist or PGD perturbations, with a ResNet50 backbone.
n_samples	ImageNet-O	iNaturalist	PGD
3	5	10	20	3	5	10	20	3	5	10	20
MMD + SimCLRv2	64.3	72.4	86.9	97.6	88.3	97.6	99.5	99.5	35.2	53.8	86.6	98.8
MMD-CC + SimCLRv2	65.3	73.2	88.0	97.7	95.4	99.2	99.5	99.5	70.5	84.0	96.6	99.5
MMD + Supervised	62.7	69.7	83.2	96.4	91.8	98.7	99.5	99.5	20.0	22.5	33.0	57.5
MMD-CC + Supervised	62.6	71.0	85.5	97.2	98.0	99.5	99.5	99.5	57.4	61.3	70.5	85.8
4.2 Detection of distributional shifts from small number of samples
Given a small set of samples with potential unknown classes or adversarial attacks, we can similarly use the two-sample test with our similarity function to verify whether these samples are in-distribution [14]. In particular, we test for samples drawn from ImageNet-O, iNaturalist, and PGD perturbations, with sample sizes ranging from 3 to 20. For these experiments, we sample  $S_{\mathbb{P}}^{(1)}$  and  $S_{\mathbb{P}}^{(2)}$  5000 times across all of ImageNet's validation set and compare their MMD and MMD-CC estimators to the one obtained from  $S_{\mathbb{P}}$  and  $S_{\mathbb{Q}}$ . We report in Table 2 the AUROC of the resulting detection and compare it to the ones obtained with a supervised ResNet50 as the baseline.
Such a setting where we use several samples assumed to be drawn from a same distribution to perform detection is uncommon, and we are not aware of prior baselines in the literature. Despite using very few samples  $(3\leq n\leq 20)$ , our method can detect OOD samples with high confidence. We observe particularly outstanding performances on iNaturalist, which is easily explained by the fact that the subset we are using (cf. Section 1) only contains plant species, logically inducing an abnormally high similarity within its samples. Furthermore, we observe that MMD-CC performs significantly better than MMD, especially on detecting samples perturbed by PGD.
Although our method attains excellent detection rates for sufficient numbers of samples, the requirement to have a set of samples all drawn from the same distribution to perform the test makes it unpractical for real-world applications. In the following section, we present CADet, a detection method inspired by MMD but applicable to anomaly detection with single inputs.
5 CADet: Contrastive Anomaly Detection
While the numbers in Section 4 demonstrate the reliability of two-sample test coupled with contrastive learning for identifying distributional shifts, it requires several samples from the same distribution, which is generally unrealistic for practical detection purposes. This section presents CADet, a method to leverage contrastive learning for OOD detection on single samples.
Self-supervised contrastive learning trains a similarity function  $s$  to maximize the similarity between augmentations of the same sample, and minimize the similarity between augmentations of different samples. Given an input sample  $x^{test}$ , we propose to leverage this property to perform anomaly detection on  $x^{test}$ , taking inspiration from MMD two-sample test. More precisely, given a transformation distribution  $\mathcal{T}_{val}$ , we compute  $n_{trs}$  random transformations  $x_{i}^{test}$  of  $x_{test}$ , as well as  $n_{trs}$  random transformations  $x_{i}^{(k)}$  on each sample  $x^{(k)}$  of a held-out validation dataset  $X_{val}^{(1)}$ . We then compute the
intra-similarity and out-similarity:
$$
m ^ {i n} \left(x ^ {t e s t}\right) := \frac {\sum_ {i \neq j} s \left(x _ {i} ^ {t e s t} , x _ {j} ^ {t e s t}\right)}{n _ {t r s} \left(n _ {t r s} + 1\right)}, \quad \text {a n d} \quad m ^ {o u t} \left(x ^ {t e s t}\right) := \frac {\sum_ {x ^ {(k)} \in X _ {v a l} ^ {(1)}} \sum_ {i , j} s \left(x _ {i} ^ {t e s t} , x _ {j} ^ {(k)}\right)}{n _ {t r s} ^ {2} \times \left| X _ {v a l} ^ {(1)} \right|}. \tag {5}
$$
We finally define the following statistic to perform detection:
$$
\operatorname {s c o r e} _ {C} := m ^ {i n} + \gamma m ^ {\text {o u t}}. \tag {6}
$$