SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Intuition: note that while CADet is inspired by MMD, it has some significant differences.  $m_{in}$  is computed across transformations of a same sample, while  $m_{out}$  is computed across transformations and across samples. Therefore, even under the null hypothesis,  $m_{in}$  and  $m_{out}$  cannot be expected to have the same distribution. Besides, both score can be expected to be smaller on OOD samples. Indeed, OOD samples can be expected to have representations further from clean data in average, thus decreasing  $m_{out}$ . Furthermore, since the self-supervised model was trained to maximize the similarity between transformations of a same sample, it is reasonable to expect that the model will perform this task better in-distribution than out-of-distribution, and thus that  $m_{in}$  will be higher in-distribution than on OOD data. This intuition justifies adding  $m_{in}$  to  $m_{out}$ , instead of the subtraction operated by MMD. Finally, note that we do not consider the intra-similarity between validation samples: the validation is fixed, so it is necessarily a constant.
Calibration: since we do not assume knowledge of OOD samples, it is difficult a priori to tune  $\gamma$ , although crucial to balance information between intra-sample similarity and cross-sample similarity. As a workaround, we calibrate  $\gamma$  by equalizing the variance between  $m^{in}$  and  $\gamma m^{out}$  on a second set of validation samples  $X_{val}^{(2)}$ :
$$
\gamma = \sqrt {\frac {\operatorname {V a r} \left\{m ^ {i n} (x) , x \in X _ {v a l} ^ {(2)} \right\}}{\operatorname {V a r} \left\{m ^ {o u t} (x) , x \in X _ {v a l} ^ {(2)} \right\}}}. \tag {7}
$$
It is important to note that the calibration of  $\gamma$  is essential, because  $m_{in}$  and  $m_{out}$  can have very different means and variances. Since  $m_{out}$  measures the out-similarity between transformations of different samples, it can be expected to be low in average, with high variance. On the contrary,  $m_{in}$  measures the similarity between transformations of a same sample, and can thus be expected to have higher mean and lower variance, which is confirmed in Table 5. Therefore, simply setting  $\gamma = 1$  would likely results in one of the score dominating the other.
Rather than evaluating the false positive rate (FPR) for a range of possible thresholds  $\tau$ , we use the hypothesis testing approach to compute the p-value:
$$
p _ {v} \left(x ^ {t e s t}\right) = \frac {\left| \left\{x \in X _ {v a l} ^ {(2)} \text {s . t .} \operatorname {s c o r e} _ {C} (x) <   \operatorname {s c o r e} _ {C} \left(x ^ {t e s t}\right) \right\} \right| + 1}{\left| \left\{X _ {v a l} ^ {(2)} \right\} \right| + 1}. \tag {8}
$$
The full pseudo-codes of the calibration and testing steps are given in Appendix A. Setting a threshold  $p \in [0,1]$  for  $p_v$  will result in a FPR of mean  $p$ , with a variance dependant of  $|X_{val}^{(2)}|$ .
Section 5.1 further describes our experimental setting.
5.1 Experiments
For all evaluations, we use the same transformations as SimCLRv2 except color jittering, Gaussian blur and grayscale. We fix the random crop scale to 0.75. We use  $|\{X_{val}^{(2)}\}| = 2000$  in-distribution samples,  $|\{X_{val}^{(1)}\}| = 300$  separate samples to compute cross-similarities, and 50 transformations per sample. We pre-train a ResNet50 with ImageNet as in-distribution.
Unknown classes detection: we use two challenging benchmarks for the detection of unknown classes. iNaturalist using the subset in [28] made of plants with classes that do not intersect ImageNet. Wang et al. [66] noted that this dataset is particularly challenging due to proximity of its classes. We also evaluate on ImageNet-O [26]; explicitly designed to be challenging for OOD detection with ImageNet as in-distribution. We compare to recent works and report the AUROC scores in Table 3.
Table 3: AUROC for OOD detection on ImageNet-O and iNaturalist with ResNet50 backbone.
Training	iNaturalist	ImageNet-O	Average
MSP [23]	88.58	56.13	72.36
Energy [38]	80.50	53.95	67.23
ODIN [34]	86.48	52.87	69.68
MaxLogit [24]	86.42	54.39	70.41
KL Matching [24]	Supervised	90.48	67.00	78.74
ReAct [61]	87.27	68.02	77.65
Mahalanobis [33]	89.48	80.15	84.82
Residual [66]	84.63	81.15	82.89
ViM [66]	89.26	81.02	85.14
CADet (ours)	Supervised	95.28	70.73	83.01
Self-supervised (contrastive)	83.42	82.29	82.86
Table 4: AUROC for adversarial detection on ImageNet against PGD, CW and FGSM attacks, with ResNet50 backbone.
Tuned on Adv	Training	PGD	CW	FGSM	Average
ODIN [34]	Yes	Supervised	62.30	60.29	68.10	63.56
Contrastive	59.91	60.23	64.99	61.71
FS [70]	Yes	Supervised	91.39	87.77	95.12	91.43
Contrastive	94.71	88.00	95.98	92.90
LID [41]	Yes	Supervised	93.13	91.08	93.55	92.59
Contrastive	91.94	89.50	93.56	91.67
Hu [27]	Yes	Supervised	84.31	84.29	77.95	82.18
Contrastive	94.80	95.19	78.18	89.39
Hu [27] + self-calibration	No	Supervised	66.40	59.58	71.02	65.67
Contrastive	75.69	75.74	69.20	73.54
Mahalanobis [33]	No	Supervised	92.71	91.01	96.92	93.55
Contrastive	84.14	83.78	79.90	82.61
CADet (ours)	No	Supervised	75.25	71.02	83.45	76.57
Contrastive	94.88	95.93	97.56	96.12
For Mahalanobis [33], since tuning on ood samples is not permitted, we use as score the mahalanobis score of the last layer as done in ViM [66]. Furthermore, to isolate the effect of the training scheme from the detection method, we present in Appendix B the performance of previous methods using the same self-supervised backbone as CADet, in conjunction with a trained linear layer.
Adversarial detection: for adversarial detection, we generate adversarial attacks on the validation partition of ImageNet against a pre-trained ResNet50 using three popular attacks: PGD [42], CW [3], and FGSM [16]. We follow the tuning suggested by Abusnaina et al. [1], i.e. PGD: norm  $L_{\infty}$ ,  $\delta = 0.02$ , step size 0.002, 50 iterations; CW: norm  $L_{2}$ ,  $\delta = 0.10$ , learning rate of 0.03, and 50 iterations; FGSM: norm  $L_{\infty}$ ,  $\delta = 0.05$ . We compare our results with ODIN [34], which achieves good performances in Lee et al. [33] despite not being designed for adversarial detection, Feature Squeezing (FS) [70], Local Intrinsic Dimensionality (LID) [41], Hu et al. [27], and Mahalanobis [33] (using the mahalanobis score of the last layer as for unknow classes detection). Most existing adversarial detection methods assume access to adversarial samples during training (see Section 2). We additionally propose a modification to Hu et al. [27] to perform auto-calibration based on the mean and variance of the criterions on clean data, similarly to CADet's calibration step. We report the AUROC scores in Table 4 and illustrate them with ROC curves against each anomaly type in Figure 1b.
Table 5: Mean and variance of  ${m}^{in}$  and  ${m}^{out}$  .
IN-1K	iNat	IN-O	PGD	CW	FGSM
Mean	\(m^{in}\)	0.972	0.967	0.969	0.954	0.954	0.948
\(m^{out}\)	0.321	0.296	0.275	0.306	0.302	0.311
\(γm^{out}\)	0.071	0.066	0.061	0.068	0.067	0.069
Var	\(m^{in}\)	8.3e-05	7.8e-05	1.0e-04	2.1e-04	2.0e-04	2.1e-04
\(m^{out}\)	1.7e-03	7.0e-04	2.3e-03	7.0e-04	1.7e-03	1.1e-03
CADet performs particularly well on adversarial detection, surpassing alternatives by a wide margin. We argue that self-supervised contrastive learning is a suitable mechanism for detecting classification attacks due to its inherent label-agnostic nature. Interestingly, Hu et al. [27] also benefits from contrastive pre-training, achieving much higher performances than with a supervised backbone. However, it is very reliant on calibrating on adversarial samples, since we observe a significant drop in performances with auto-calibration.
We explain the impressive performances of CADet on adversarial detection by the fact that adversarial perturbations will negatively affect the capability of the self-supervised model to match different transformations of the image. In comparison, the model has high capability on clean data, having been trained specifically with that objective.
While CADet does not outperform existing methods on label-based OOD detection, it performs comparably, an impressive feat of generality considering adversarially perturbed samples and novel labels have significantly different properties, and that CADet does not require any tuning on OOD samples.
Notably, applying CADet to a supervised network achieves state-of-the-art performances on iNaturalist with ResNet50 architecture, suggesting CADet can be a reasonable standalone detection method on some benchmarks, independently of contrastive learning. In addition, the poor performances of the supervised network on ImageNet-O and adversarial attacks show that contrastive learning is essential to address the trade-off between different type of anomalies.
Overall, our results show CADet achieves an excellent trade-off when considering both adversarial and label-based OOD samples.
6.2 The predictive power of in-similarities and out-similarities
Table 5 reports the mean and variance of  $m^{in}$  and  $m^{out}$ , and the rescaled mean  $\gamma m^{out}$  across all distributions. Interestingly, we see that out-similarities  $m^{out}$  better discriminate label-based OOD samples, while in-similarities  $m^{in}$  better discriminate adversarial perturbations. Combining in-similarities and out-similarities is thus an essential component to simultaneously detect adversarial perturbations and unknown classes.
Computational cost: To perform detection with CADet, we need to compute the features for a certain number of transformations of the test sample, incurring significant overhead. Figure 2 shows that reducing the number of transformations to minimize computational cost may not significantly affect performances. While the cal
ization step can seem expensive, it only required less than 10 minutes on a single A100 GPU, which is far from prohibitive. Moreover, it only needs to be run once for a given in-distribution. The
Figure 2: AUROC score of CADet against the number of transformations.
coefficient  $\gamma$  and scores are all one-dimensional values that can be easily stored, and we purposely use a small number of validation samples  $|\{X_{val}^{(1)}\}| = 300$  to make their embedding easy to memorize.
Architecture scale: as self-supervised contrastive learning is computationally expensive, we only evaluated our method on a ResNet50 architecture. In Wang et al. [66], the authors achieve significantly superior performances when using larger, recent architectures. The performances achieved with a ResNet50 are insufficient for real-world usage, and the question of how our method would scale to larger architectures remains open.
Adaptive attacks: we do not evaluate on adaptive attacks, and as such our detection method should be considered vulnerable to them. However, as shown in Tramer et al. [64], modern detection methods are typically weak to adaptive attacks. Since robustness to any adaptive attack is impossible to prove, we contend this is a limitation of detection methods in general, unspecific to CADet.
6.4 Future directions
While spurious correlations with background features are a problem in supervised learning, it is aggravated in self-supervised contrastive learning, where background features are highly relevant to the training task. We conjecture the poor performances of CADet on iNaturalist OOD detection are explained by the background similarities with ImageNet images, obfuscating the differences in relevant features. A natural way to alleviate this issue is to incorporate background transformations to the training pipeline, as was successfully applied in Ma et al. [40]. This process would come at the cost of being unable to detect shifts in background distributions, but such a case is generally less relevant to deployed systems. We leave to future work the exploration of how background transformations could affect the capabilities of CADet.
6.5 Conclusion
We have presented CADet, a method for both OOD and adversarial detection based on self-supervised contrastive learning. CADet achieves an excellent trade-off in detection power across different anomaly types, without requiring tuning on OOD samples. Additionally, we discussed how MMD could be leveraged with contrastive learning to assess distributional discrepancies between two sets of samples, and proved with high confidence that CIFAR10 and CIFAR10.1 have different distributions.
We thank Issam Laradji for his precious help in fixing cluster issues and our NeurIPS 2023 reviewers and AC for their constructive criticism and for taking the time to engage in discussions. We believe their feedback has significantly improved the quality of our submission.
[65] A. Uwimana I and R. Senanayake. Out of distribution detection and adversarial attacks on deep neural networks for robust medical image analysis. arXiv preprint arXiv:2107.04882, 2021.
[66] H. Wang, Z. Li, L. Feng, and W. Zhang. Vim: Out-of-distribution with virtual-logit matching. In Conference on Computer Vision and Pattern Recognition, 2022.
[67] L. Wenliang, D. Sutherland, H. Strathmann, and A. Gretton. Learning deep kernels for exponential family densities. In International Conference on Machine Learning, 2019.
[68] J. Winkens, R. Bunel, A. G. Roy, R. Stanforth, V. Natarajan, J. R. Ledsam, P. MacWilliams, P. Kohli, A. Karthikesalingam, S. Kohl, et al. Contrastive training for improved out-of-distribution detection. arXiv preprint arXiv:2007.05566, 2020.
[69] Z. Wu, Y. Xiong, S. X. Yu, and D. Lin. Unsupervised feature learning via non-parametric instance discrimination. In Conference on Computer Vision and Pattern Recognition, 2018.
[70] W. Xu, D. Evans, and Y. Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. CoRR, abs/1704.01155, 2017. URL http://arxiv.org/abs/1704.01155.
[71] J. Yang, K. Zhou, Y. Li, and Z. Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:2110.11334, 2021.
[72] Y. You, I. Gitman, and B. Ginsburg. Large batch training of convolutional networks. arXiv preprint arXiv:1708.03888, 2017.
[73] F. Yu, A. Seff, Y. Zhang, S. Song, T. Funkhouser, and J. Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365, 2015.
[74] S. Zhai, Y. Cheng, W. Lu, and Z. Zhang. Deep structured energy based models for anomaly detection. In International Conference on Machine Learning, 2016.
[75] B. Zong, Q. Song, M. R. Min, W. Cheng, C. Lumezanu, D. Cho, and H. Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International Conference on Learning Representations, 2018.
[76] F. Zuo and Q. Zeng. Exploiting the sensitivity of 12 adversarial examples to erase-and-restore. In Asia Conference on Computer and Communications Security, 2021.
A Algorithms pseudo-code
We give the full pseudo codes for CADet's calibration step and inference step in Algorithm 2 and 3.
Algorithm 2 CADet calibration step
Input:  $X_{val}^{(1)}, X_{val}^{(2)}, T_{eval}$ , learned similarity function  $s$ , various hyperparameters used below;  
1: for  $x^{(1)} \in X_{val}^{(1)}$  do  
2: for  $i = 1, 2, \ldots, n_{tr}s$  do  
3: Sample  $t$  from  $T_{eval}$   
4:  $x_{i}^{(1)} \gets t(x^{(1)})$   
5: end for  
6: end for  
7:  $k \gets 0$   
8: for  $x^{(2)} \in X_{val}^{(2)}$  do  
9: for  $i = 1, 2, \ldots, n_{tr}s$  do  
10: Sample  $t$  from  $T_{eval}$   
11:  $x_{i}^{(2)} \gets t(x^{(2)})$   
12: end for  
13:  $m_{k}^{in} \gets \sum_{i \neq j}^{n_{tr}s} s(x_{i}^{(2)}, x_{j}^{(2)})$   
14:  $m_{k}^{out} \gets \sum_{x^{(1)} \in X_{val}^{(1)}} \sum_{i,j}^{n_{tr}s} s(x_{i}^{(1)}, x_{j}^{(2)})$   
15:  $k \gets k + 1$   
16: end for  
17:  $m^{in} \gets \frac{m^{in}}{n_{tr}s(n_{tr}s + 1)}$   
18:  $m^{out} \gets \frac{m^{out}}{n_{tr}s^{\#}\{X_{val}^{(1)}\}}$   
19:  $V_{in}, V_{out} = Var(m^{in}), Var(m^{out})$   
20:  $\gamma \gets \sqrt{\frac{V_{in}}{V_{out}}}$   
21:  $k \gets 0$   
22: for  $x^{(2)} \in X_{val}^{(2)}$  do  
23: score_k  $\leftarrow m_{k}^{in} + \gamma \times m_{k}^{out}$   
24:  $k \gets k + 1$   
25: end for  
Output: coefficient:  $\gamma$ , scores: score_k, transformed samples:  $x_{i}^{(1)}$
Algorithm 3 CADet testing step
Input: transformed samples:  $x_{i}^{(1)}$ , scores: scores, test sample:  $x^{test}$ , coefficient:  $\gamma$ , trasnformation set:  $T_{eval}$ ;  
1: for  $i = 1,2,\ldots,n_{trs}$  do  
2: Sample  $t$  from  $T_{eval}$   
3:  $x_{i}^{test} \gets t(x^{test})$   
4: end for  
5:  $m^{in} \gets \sum_{i \neq j}^{n_{trs}} s(x_{i}^{test}, x_{j}^{test})$   
6:  $m^{out} \gets \sum_{x^{(1)} \in X_{val}^{(1)}} \sum_{i,j}^{n_{trs}} s(x_{i}^{test}, x_{j}^{(1)})$   
7:  $score^{te} \gets \frac{m^{in}}{n_{trs}(n_{trs} + 1)} + \gamma \frac{m^{out}}{n_{trs}^2 \# \{X_{val}^{(1)}\}}$   
8: rank  $\gets 0$   
9: for  $score^{val} \in scores$  do  
10: if  $score^{val} < score^{te}$  then  
11: rank  $\gets rank + 1$   
12: end if  
13: end for  
14:  $p_{val} \gets \frac{rank + 1}{\#\{scores\} + 1}$   
Output: p-value:  $p_{val}$
B Ablation on backbone
We present in table 6 the AUROC of previous methods on iNaturalist and ImageNet-O using a self-supervised contrastive ResNet50 backbone, as an ablation to table 3. Since most methods require class logits, we train a linear layer on top of the self-supervised features using all training labels. Thus, these methods still possess an unfair advantage over CADet by exploiting label information.
Table 6: AUROC for OOD detection on ImageNet-O and iNaturalist with ResNet50 backbone using self-supervised contrastive learning.
Training	iNaturalist	ImageNet-O	Average
MSP [23]	76.93	54.09	65.51
Energy [38]	69.55	57.91	63.73
ODIN [34]	81.83	52.10	66.97
MaxLogit [24]	75.62	52.35	63.99
KL Matching [24]	Self-supervised (contrastive)	79.27	67.71	73.49
ReAct [61]	78.95	68.08	73.52
Mahalanobis [33]	72.60	76.49	74.55
Residual [66]	78.60	80.99	79.80
ViM [66]	72.17	85.11	78.64
C Tuning of baselines
For previous works, when not specified otherwise we use the same tuning strategies described in the original papers.
For Mahalanobis [33] we employ the score of the last layer only as done in ViM [66]. For LID [41], we try for  $k$  in [10, 20, ..., 100] (and find  $k = 20$  to perform best on all benchmarks) and  $\sigma$  in the range [0, 10]. For ODIN, for OOD detection, we use the default values described in Liang et al. [34] (since we assume no access to ood samples), and tune them for adversarial detection. For FS [70], we use the best joint detection of multiple squeezers, which was tuned on ImageNet, ie. Bit Depth 5-bit, Median Smoothing 2x2, and Non-Local Mean 11-3-4.