SlowGuess/NeurIPS_2023_OCR huggingface dataset:
DREAM-OOD significantly improves the OOD detection performance. As shown in Table 1 and Table 3, we compare our method with the competitive baselines, including Maximum Softmax Probability [25], ODIN score [26], Mahalanobis score [27], Energy score [6], Generalized ODIN [28],
Methods	OOD Datasets	ID ACC
SVHN	PLACES365	LSUN	ISUN	TEXTURES	Average
FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑
MSP [25]	87.35	69.08	81.65	76.71	76.40	80.12	76.00	78.90	79.35	77.43	80.15	76.45	79.04
ODIN [26]	90.95	64.36	79.30	74.87	75.60	78.04	53.10	87.40	72.60	79.82	74.31	76.90	79.04
Mahalanobis [27]	87.80	69.98	76.00	77.90	56.80	85.83	59.20	86.46	62.45	84.43	68.45	80.92	79.04
Energy [6]	84.90	70.90	82.05	76.00	81.75	78.36	73.55	81.20	78.70	78.87	80.19	77.07	79.04
GODIN [28]	63.95	88.98	80.65	77.19	60.65	88.36	51.60	92.07	71.75	85.02	65.72	86.32	76.34
KNN [29]	81.12	73.65	79.62	78.21	63.29	85.56	73.92	79.77	73.29	80.35	74.25	79.51	79.04
ViM [30]	81.20	77.24	79.20	77.81	43.10	90.43	74.55	83.02	61.85	85.57	67.98	82.81	79.04
ReAct [31]	82.85	70.12	81.75	76.25	80.70	83.03	67.40	83.28	74.60	81.61	77.46	78.86	79.04
DICE [32]	83.55	72.49	85.05	75.92	94.05	73.59	75.20	80.90	79.80	77.83	83.53	76.15	79.04
Synthesis-based methods
GAN [33]	89.45	66.95	88.75	66.76	82.35	75.87	83.45	73.49	92.80	62.99	87.36	69.21	70.12
VOS [1]	78.50	73.11	84.55	75.85	59.05	85.72	72.45	82.66	75.35	80.08	73.98	79.48	78.56
NPOS [2]	11.14	97.84	79.08	71.30	56.27	82.43	51.72	85.48	35.20	92.44	46.68	85.90	78.23
DREAM-ODN (Ours)	58.75±0.6	87.01±0.1	70.85±1.6	79.94±0.2	24.25±1.1	95.23±0.2	1.10±0.2	99.73±0.4	46.60±0.4	88.82±0.7	40.31±0.8	90.15±0.3	78.94
Table 3: OOD detection results for CIFAR-100 as the in-distribution data. We report standard deviations estimated across 3 runs. Bold numbers are superior results.
KNN distance [29], ViM score [30], ReAct [31], and DICE [32]. Closely related to ours, we contrast with three synthesis-based methods, including latent-based outlier synthesis (VOS [1] & NPOS [2]), and GAN-based synthesis [33], showcasing the effectiveness of our approach. For example, DREAMOOD achieves an FPR95 of  $39.87\%$  on PLACES with the ID data of IMAGENET-100, which is a  $19.79\%$  improvement from the best baseline NPOS.
In particular, DREAM-OOD advances both VOS and NPOS by allowing us to understand the synthesized outliers in a human-compatible way, which was infeasible for the feature-based outlier sampling in VOS and NPOS. Compared with the feature-based synthesis approaches, DREAM-OOD can generate high-resolution outliers in the pixel space. The higher-dimensional pixel space offers much more knowledge about the unknowns, which provides the model with high variability and fine-grained details for the unknowns that are missing in VOS and NPOS. Since DREAM-OOD is more photo-realistic and better for humans, the generated images can be naturally better constrained for neural networks (for example, things may be more on the natural image manifolds). We provide comprehensive qualitative results (Section 4.2) to facilitate the understanding of generated outliers. As we will show in Figure 5, the generated outliers are more precise in characterizing OOD data and thus improve the empirical performance.
Comparison with other outlier synthesis approaches. We compare DREAM-OOD with different outlier embedding synthesis approaches in Table 2: (I) synthesizing outlier embeddings by adding multivariate Gaussian noise  $\mathcal{N}(\mathbf{0},\sigma_1^2\mathbf{I})$  to the token embeddings, (II) adding learnable noise to the token embeddings where the
Method	FPR95↓ AUROC ↑	FPR95↓ AUROC ↑
IMAGENET-100 as ID	CIFAR-100 as ID
(I) Add gaussian noise	41.35	89.91	45.33	88.83
(II) Add learnable noise	42.48	91.45	48.05	87.72
(III) Interpolate embeddings	41.35	90.82	43.36	87.09
(IV) Disjont class names	43.55	87.84	49.89	85.87
DREAM-OOD (ours)	38.76	92.02	40.31	90.15
Table 2: Comparison of DREAM-OOD with different outlier embedding synthesis methods using diffusion models.
noise is trained to push the outliers away from ID features, (III) interpolating token embeddings from different classes by  $\alpha \mathcal{T}(y_1) + (1 - \alpha)\mathcal{T}(y_2)$ , and (IV) generating outlier images by using embeddings of new class names outside ID classes. For (I), we set the optimal variance values  $\sigma_1^2$  to 0.03 by sweeping from  $\{0.01, 0.02, 0.03, \dots, 0.10\}$ . For (III), we choose the interpolation factor  $\alpha$  to be 0.5 from  $\{0.1, 0.2, \dots, 0.9\}$ . For (IV), we use the remaining 900 classes in IMAGENET-1K (exclude the 100 classes in IMAGENET-100) as the disjoint class names for outlier generation. We generate the same amount of images as ours for all the variants to ensure a fair comparison.
The result shows that DREAM-OOD outperforms all the alternative synthesis approaches by a considerable margin. Though adding noise to the token embedding is relatively simple, it cannot explicitly sample textual embeddings from the low-likelihood region as DREAM-OOD does, which are near the ID boundary and thus demonstrate stronger effectiveness to regularize the model (Section 3.2). Visualization is provided in Appendix E. Interpolating the token embeddings will easily generate images that are still ID (Appendix D), which is also observed in Liew et.al. [43].
In this section, we provide additional ablations to understand DREAM-OOD for OOD generation. For all the ablations, we use the high resolution IMAGENET-100 dataset as the ID data.
(a) Imagined outliers for ID class Jellyfish
(b) Imagined outliers for ID class Ladybug
Figure 5: Visualization of the imagined outliers w.r.t. jellyfish, ladybug class under different variance  $\sigma^2$ .
Ablation on the regularization weight  $\beta$ . In Figure 7 (a), we ablate the effect of weight  $\beta$  of the regularization loss  $\mathcal{L}_{\mathrm{ood}}$  for OOD detection (Section 3.2) on the OOD detection performance. Using a mild weighting, such as  $\beta = 1.0$ , achieves the best OOD detection performance. Too excessive regularization using synthesized OOD images ultimately degrades the performance.
Ablation on the variance value  $\sigma^2$ . We show in Figure 7 (b) the effect of  $\sigma^2$  — the number of the variance value for the Gaussian kernel (Section 3.2). We vary  $\sigma^2 \in \{0.02, 0.03, 0.04, 0.05, 0.06, 0.2\}$ . Using a mild variance value  $\sigma^2$  generates meaningful synthetic OOD images for model regularization. Too large of variance (e.g.,  $\sigma^2 = 0.2$ ) produces far-OOD, which does not help learn a compact decision boundary between ID and OOD.
Ablation on  $k$  in calculating  $k$ -NN distance. In Figure 7 (c), we analyze the effect of  $k$ , i.e., the number of nearest neighbors for non-parametric sampling in the latent space. We vary  $k = \{100, 200, 300, 400, 500\}$  and observe that our method is not sensitive to this hyperparameter.
Visualization of the generated outliers. Figure 5 illustrates the generated outlier images under different variance  $\sigma^2$ . Mathematically, a larger variance translates into outliers that are more deviated from ID data. We confirm this in our visualization too. The synthetic OOD images gradually become semantically different from ID classes "jellyfish" and "ladybug", as the variance increases. More visualization results are in Appendix C.
4.3 Extension: From DREAM-OOD to DREAM-ID
Our framework can be easily extended to generate ID data. Specifically, we can select the ID point with small  $k$ -NN distances w.r.t. the training data (Equation (5)) and sample inliers from the Gaussian kernel with small variance  $\sigma^2$  in the text-conditioned embedding space (Figure 6). Then we decode the inlier embeddings via the diffusion model for ID generation (Visualization provided in Appendix G). For the synthesized ID images, we let the semantic label be the same as the anchor ID point. Here we term our extension as DREAM-ID instead.
Datasets. We use the same IMAGENET-100 as the training data. We measure the generalization performance on both the original IMAGENET test data (for ID generalization) and variants with distribution shifts (for OOD generalization). For OOD generalization, we evaluate on (1) IMAGENET-A [44] consisting of real-world, unmodified, and naturally occurring examples that are misclassified by ResNet models; (2) IMAGENET-V2 [45], which is created from the
Flickr dataset with natural distribution shifts. We provide the experimental details in Appendix H.
Figure 6: TSNE visualization of ID embeddings (purple) and the synthesized inlier embeddings (orange), for class "hen" in IMAGENET.
Figure 7: (a) Ablation study on the regularization weight  $\beta$  on  $\mathcal{L}_{\mathrm{odd}}$ . (b) Ablation on the variance  $\sigma^2$  for synthesizing outliers in Section 3.2. (c) Ablation on the  $k$  for the  $k$ -NN distance. The numbers are AUROC. The ID training dataset is IMAGENET-100.
DREAM-ID improves the generalization performance. As shown in Table 4, we compare DREAM-ID with competitive data augmentation and test-time adaptation methods. For a fair comparison, all the methods are trained using the same network architecture, under the same configuration. Specifically, our baselines include: the original model without any data augmentation, RandAugment [46], AutoAugment [47], CutMix [48], AugMix [49], DeepAugment [50] and MEMO [51]. These methods are shown in the literature to help improve generalization. The results demonstrate that our approach outperforms all the baselines that use data augmentation for training in both ID generalization and generalization under natural distribution shifts ( $\uparrow 0.74\%$  vs. the best on IMAGENET-A,  $\uparrow 0.70\%$  vs. the best on IMAGENET-V2). Implementation details of the baselines are in Appendix I.
In addition, we compare our method with using generic prompts (i.e., "A high-quality photo of a  $[y]$ ") for data generation. For a fair comparison, we synthesize the same amount of images (i.e., 1000 per class) for both methods. The result shows that DREAM-ID outperforms the baseline by  $0.72\%$  on IMAGENET test set and  $0.95\%$ ,  $1.20\%$  on IMAGENET-A and IMAGENET-V2, respectively.
Methods	IMAGENET	IMAGENET-A	IMAGENET-V2
Original (no aug)	87.28	8.69	77.80
RandAugment	88.10	11.39	78.90
AutoAugment	88.00	10.85	79.70
CutMix	87.98	9.67	79.70
AugMix	87.74	10.96	79.20
DeepAugment	86.86	10.79	78.30
MEMO	88.00	10.85	78.60
Generic Prompts	87.74	11.18	79.20
DREAM-ID (Ours)	88.46±0.1	12.13±0.1	80.40±0.1
Table 4: Model generalization performance (accuracy, in %), using IMAGENET-100 as the training data. We report standard deviations estimated across 3 runs.
Diffusion models have recently seen wide success in image generation [9, 52-54], which can outperform GANs in fidelity and diversity, without training instability and mode collapse issues [55]. Recent research efforts have mostly focused on efficient sampling schedulers [14, 56, 57], architecture design [58], score-based modeling [59, 60], large-scale text-to-image generation [12, 11], diffusion personalization [61-63], and extensions to other domains [64-66].
Recent research efforts mainly utilized diffusion models for data augmentation, such as for image classification [67-75], object detection [76-78], spurious correlation [79] and medical image analysis [80-82] while we focus on synthesizing outliers for OOD detection. Graham et.al. [83] and Liu et.al. [84] utilized diffusion models for OOD detection, which applied the reconstruction error as the OOD score, and therefore is different from the discriminative approach in our paper. Liu et.al. [85] jointly trained a small-scale diffusion model and a classifier while regarding the interpolation between the ID data and its noisy version as outliers, which is different from the synthesis approach in DREAM-OOD. Meanwhile, our method does not require training the diffusion model at all. Kirchheim et.al. [86] modulated the variance in BigGAN [87] to generate outliers rather than using diffusion models. Franco et.al. [88] proposed denoising diffusion smoothing for certifying the robustness of OOD detection. Sehwag et.al. [89] modified the sampling process to guide the diffusion models towards low-density regions but simultaneously maintained the fidelity of synthetic data belonging to the ID classes. Several works employed diffusion models for anomaly segmentation on medical data [90-92], which is different from the task considered in our paper.
OOD detection has attracted a surge of interest in recent years [93-101]. One line of work performed OOD detection by devising scoring functions, including confidence-based methods [25, 26, 102],
energy-based score [6, 103, 104], distance-based approaches [21, 23, 27, 29, 105-108], gradient-based score [109], and Bayesian approaches [110-115]. Another promising line of work addressed OOD detection by training-time regularization [116-125]. For example, the model is regularized to produce lower confidence [4, 33] or higher energy [5, 6, 126] on the outlier data. Most regularization methods require the availability of auxiliary OOD data. [127, 128] enhanced OOD detection from the perspective of ID distribution. Several recent works [1, 2] synthesized virtual outliers in the feature space, and regularizes the model's decision boundary between ID and OOD data during training. In contrast, DREAM-OOD synthesizes photo-realistic outliers in pixel space, which enables visually inspecting and understanding synthetic outliers in a human-compatible way.
Recently, there has been growing interest in multi-modal OOD detection that utilizes textual information for visual OOD detection. Fort et.al. [129] proposed a scheme where pretrained CLIP models are provided with candidate OOD labels for each target dataset, and show that the output probabilities summed over the OOD labels effectively capture OOD uncertainty. Esmaeilpour et.al. [130] proposed to train a label generator based on the visual encoder of CLIP and use the generated labels for OOD detection. Ming et.al. [98, 99] alleviates the need for prior information on OOD by investigating pre-trained CLIP models and parameter-efficient fine-tuning methods for OOD detection. [131] utilized textual outlier exposure with vision-language models to enhance the neural network's capability to distinguish between ID and OOD data. In contrast, DREAM-OOD generates the outlier visual embeddings by training a classifier conditioned on the ID texts and then uses the diffusion model for outlier image synthesis.
In this paper, we propose a novel learning framework DREAM-OOD, which imagines photo-realistic outliers in the pixel space by way of diffusion models. DREAM-OOD mitigates the key shortcomings of training with auxiliary outlier datasets, which typically require label-intensive human intervention for data preparation. DREAM-OOD learns a text-conditioned latent space based on ID data, and then samples outliers in the low-likelihood region via the latent. We then generate outlier images by decoding the outlier embeddings with the diffusion model. The empirical result shows that training with the outlier images helps establish competitive performance on common OOD detection benchmarks. Our in-depth quantitative and qualitative ablations provide further insights on the efficacy of DREAM-OOD. We hope our work will inspire future research on automatic outlier synthesis in the pixel space.
7 Broader Impact
Our project aims to improve the reliability and safety of modern machine learning models. Our study on using diffusion models to synthesize outliers can lead to direct benefits and societal impacts, particularly when auxiliary outlier datasets are costly to obtain, such as in safety-critical applications. Nowadays, research on diffusion models is prevalent, which provides various promising opportunities for exploring the off-the-shelf large models for our research. Our study does not involve any violation of legal compliance. Through our study and release of code, we hope to raise stronger research and societal awareness towards the problem of data synthesis for out-of-distribution detection in real-world settings.
We thank Yifei Ming for his valuable suggestions on the draft. The authors would also like to thank NeurIPS anonymous reviewers for their helpful feedback. Research is supported by the Jane Street Graduate Research Fellowship, AFOSR Young Investigator Program under award number FA9550-23-1-0184, National Science Foundation (NSF) Award No. IIS-2237037 & IIS-2331669, Office of Naval Research under grant number N00014-23-1-2643, Philanthropic Fund from SFF, and faculty research awards/gifts from Google and Meta. Zhu is supported in part by NSF grants 2023239, 2041428, 2202457, ARO MURI W911NF2110317 and AF CoE FA9550-18-1-0166.
[119] Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 41-50, 2019.
[120] Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don't know. In Proceedings of the International Conference on Learning Representations, 2020.
[121] Sina Mohseni, Mandar Pitale, JBS Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable out-of-distribution detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 5216-5223, 2020.
[122] Taewon Jeong and Heeyoung Kim. Ood-maml: Meta-learning for few-shot out-of-distribution detection and classification. Advances in Neural Information Processing Systems, 33:3907-3916, 2020.
[123] Joost van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using a single deep deterministic neural network. In Proceedings of the International Conference on Machine Learning, pages 9690–9700, 2020.
[124] Jingkang Yang, Haoqi Wang, Litong Feng, Xiaopeng Yan, Huabin Zheng, Wayne Zhang, and Ziwei Liu. Semantically coherent out-of-distribution detection. In Proceedings of the International Conference on Computer Vision, pages 8281-8289, 2021.
[125] Hongxin Wei, Renchunzi Xie, Hao Cheng, Lei Feng, Bo An, and Yixuan Li. Mitigating neural network overconfidence with logit normalization. In Proceedings of the International Conference on Machine Learning, pages 23631-23644, 2022.
[126] Xuefeng Du, Xin Wang, Gabriel Gozum, and Yixuan Li. Unknown-aware object detection: Learning what you don't know from videos in the wild. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022.
[127] Julian Bitterwolf, Maximilian Müller, and Matthias Hein. In or out? fixing imagenet out-of-distribution detection evaluation. In International Conference on Machine Learning, pages 2471-2506, 2023.
[128] Jianing Zhu, Hengzhuang Li, Jiangchao Yao, Tongliang Liu, Jianliang Xu, and Bo Han. Unleashing mask: Explore the intrinsic out-of-distribution detection capability. arXiv preprint arXiv:2306.03715, 2023.
[129] Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of out-of-distribution detection. Advances in Neural Information Processing Systems, 34:7068-7081, 2021.
[130] Sepideh Esmaeilpour, Bing Liu, Eric Robertson, and Lei Shu. Zero-shot out-of-distribution detection based on the pre-trained model clip. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pages 6568-6576, 2022.
[131] Sangha Park, Jisoo Mok, Dahuin Jung, Jangho Lee, and Sungroh Yoon. On the powerfulness of textual outliers for visual ood detection. In Advances in Neural Information Processing Systems, 2023.
Dream the Impossible: Outlier Imagination with Diffusion Models (Appendix)
A Details of datasets
ImageNet-100. We randomly sample 100 classes from IMAGENET-1K [8] to create IMAGENET-100. The dataset contains the following categories: n01498041, n01514859, n01582220, n01608432, n01616318, n01687978, n01776313, n01806567, n01833805, n01882714, n01910747, n01944390, n01985128, n02007558, n02071294, n02085620, n02114855, n02123045, n02128385, n02129165, n02129604, n02165456, n02190166, n02219486, n02226429, n02279972, n02317335, n02326432, n02342885, n02363005, n02391049, n02395406, n02403003, n02442699, n02442845, n02444819, n02480855, n02510455, n02640242, n02672831, n02687172, n02701002, n02730930, n02769748, n02782093, n02787622, n02793495, n02799071, n02802426, n02814860, n02840245, n02906734, n02948072, n02980441, n03014705, n03028079, n03032252, n03125729, n03160309, n03179701, n03220513, n03249569, n03291819, n03384352, n03388043, n03450230, n03481172, n03594734, n03594945, n03627232, n03642806, n03649909, n03661043, n03676483, n03724870, n03733281, n03759954, n03761084, n03773504, n03804744, n03916031, n03938244, n04004767, n04026417, n04090263, n04133789, n04153751, n04296562, n04330267, n04371774, n04404412, n04465501, n04485082, n04507155, n04536866, n04579432, n04606251, n07714990, n0774594.
OD datasets. Huang et.al. [39] curated a diverse collection of subsets from iNaturalist [40], SUN [41], Places [36], and Texture [34] as large-scale OOD datasets for IMAGENET-1K, where the classes of the test sets do not overlap with IMAGENET-1K. We provide a brief introduction for each dataset as follows.
iNaturalist contains images of natural world [40]. It has 13 super-categories and 5,089 sub-categories covering plants, insects, birds, mammals, and so on. We use the subset that contains 110 plant classes which do not overlap with IMAGENET-1K.
SUN stands for the Scene Understanding Dataset [41]. SUN contains 899 categories that cover more than indoor, urban, and natural places with or without human beings appearing in them. We use the subset which contains 50 natural objects not in IMAGENET-1K.
Places is a large scene photographs dataset [36]. It contains photos that are labeled with scene semantic categories from three macro-classes: Indoor, Nature, and Urban. The subset we use contains 50 categories that are not present in IMAGENET-1K.
Texture stands for the Describable Textures Dataset [34]. It contains images of textures and abstracted patterns. As no categories overlap with IMAGENET-1K, we use the entire dataset as in [39].
ImageNet-A contains 7,501 images from 200 classes, which are obtained by collecting new data and keeping only those images that ResNet-50 models fail to correctly classify [44]. In our paper, we evaluate on the 41 overlapping classes withImagenet-100 which consist of a total of 1,852 images.
ImageNet-v2 used in our paper is sampled to match the MTurk selection frequency distribution of the original IMAGENET validation set for each class [45]. The dataset contains 10,000 images from 1,000 classes. During testing, we evaluate on the 100 overlapping classes with a total of 1,000 images.
B Formulation of  $Z_{m}(\kappa)$
The normalization factor  $Z_{m}(\kappa)$  in Equation (3) is defined as:
$$
Z _ {m} (\kappa) = \frac {\kappa^ {m / 2 - 1}}{(2 \pi) ^ {m / 2} I _ {m / 2 - 1} (\kappa)}, \tag {8}
$$
where  $I_{v}$  is the modified Bessel function of the first kind with order  $v$ .  $Z_{m}(\kappa)$  can be calculated in closed form based on  $\kappa$  and the feature dimensionality  $m$ .
C Additional Visualization of the Imagined Outliers
In addition to Section 4.2, we provide additional visualizations on the imagined outliers under different variance  $\sigma^2$  in Figure 8. We observe that a larger variance consistently translates into outliers that are more deviated from ID data. Using a mild variance value  $\sigma^2 = 0.03$  generates both empirically (Figure 7 (b)) and visually meaningful outliers for model regularization on IMAGENET-100.
Figure 8: Visualization of the imageined outliers for the beaver, apron, strawberry class with different variance values  $\sigma^2$ .
D Visualization of Outlier Generation by Embedding Interpolation