SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Sangha Park<sup>1</sup>, Jisoo Mok<sup>1</sup>, Dahuin Jung<sup>1</sup>, Saehyung Lee<sup>1</sup>, Sungroh Yoon<sup>1,2,*</sup>  
<sup>1</sup>Department of Electrical and Computer Engineering, Seoul National University  
<sup>2</sup>Interdisciplinary Program in Artificial Intelligence, Seoul National University  
{wiarae, magicshop1118, annajung0625, halo8218, sryoon}@snu.ac.kr
Successful detection of Out-of-Distribution (OoD) data is becoming increasingly important to ensure safe deployment of neural networks. One of the main challenges in OoD detection is that neural networks output overconfident predictions on OoD data, make it difficult to determine OoD-ness of data solely based on their predictions. Outlier exposure addresses this issue by introducing an additional loss that encourages low-confidence predictions on OoD data during training. While outlier exposure has shown promising potential in improving OoD detection performance, all previous studies on outlier exposure have been limited to utilizing visual outliers. Drawing inspiration from the recent advancements in vision-language pre-training, this paper venture out to the uncharted territory of textual outlier exposure. First, we uncover the benefits of using textual outliers by replacing real or virtual outliers in the image-domain with textual equivalents. Then, we propose various ways of generating preferable textual outliers. Our extensive experiments demonstrate that generated textual outliers achieve competitive performance on large-scale OoD and hard OoD benchmarks. Furthermore, we conduct empirical analyses of textual outliers to provide primary criteria for designing advantageous textual outliers: near-distribution, descriptiveness, and inclusion of visual semantics. Code is available at https://github.com/wiarae/TOE
The standard assumption when deploying neural networks is that both the train and test data will fall under the same distribution, in which case, test data are considered to be in-distribution (ID). However, in the real world, they often encounter out-of-distribution (OoD) data, which refers to data that are distant from the training data distribution. Because the generalization capacity of neural networks does not extend outside the distribution of observed train data, OoD data can cause them to perform poorly or even fail [11]. Therefore, it is important for neural networks to not only achieve high accuracy on ID data but also successfully detect OoD data to preclude them from the inference process. Unfortunately, neural networks yield highly over-confident predictions on OoD data, making OoD detection a non-trivial research problem [39, 43].
One promising approach to OoD detection is "outlier exposure," which modifies the training procedure of neural networks [23, 18], such that they can accurately classify ID data while also reliably detecting OoD data. To simultaneously accomplish the two training objectives, outlier exposure utilizes proxy data that can emulate actual OoD data that the neural network may confront at test time. Outlier exposure then defines a regularization term that encourages low-confidence predictions on those proxy data. Finally, the neural network is optimized to minimize the regularization term in addition
to the supervised loss. The major challenge in outlier exposure is providing proxy data for training without explicit knowledge of OoD data.
Previously when neural networks could only process single-modal data, outlier exposure could only rely on visual outliers from the image domain. The recent emergence of multi-modal neural networks [37, 21] has opened new research opportunities. In this work, we study the powerfulness of textual outlier exposure by utilizing multi-modal neural networks. We first conduct preliminary studies of textual outlier exposure by replacing visual outliers with their textual counterparts in two widely-studied outlier exposure methods: real and virtual outliers. Our empirical results reveal that visual outliers suffer from high performance variation according to the choice of an auxiliary dataset and non-negligible time consumption. Textual outliers, on the contrary, do not experience the above problems, demonstrating that they can serve as attractive proxy data for outlier exposure.
Textual outliers can be designed in various forms, from single words to detailed descriptions. Initially, it may be unclear which type of textual outlier is most effective for facilitating textual outlier exposure. To address this ambiguity, we explore textual outliers at three verbosity levels: word, description, and caption. These textual outliers are generated using large-language models (LLMs) such as GPT-3, BERT, or vision-language models (VLMs) like BLIP-2. Among generated outputs, only those that can be considered OoD are utilized for outlier exposure. Our textual outlier generation methods rely solely on images and class labels of ID data. As a result, utilizing generated textual outliers eliminates the need to collect and curate proxy data to perform outlier exposure.
Our comprehensive experimental results present compelling evidence that the proposed textual outlier approach outperforms existing methods for OoD detection. Specifically, compared to the method in Hendrycks et al. [18] that employs real auxiliary datasets of outliers, our caption-level textual outlier reduces the FPR95 from  $73.80\%$  to  $58.21\%$ , yielding a direct improvement of  $15.59\%$  p on the challenging ImageNet-1K benchmark [6]. Additionally, our textual outlier approach surpasses advanced baselines in visual outlier exposure, demonstrating the advantages of the outlier synthesis approach in the textual space. Furthermore, through comparative analyses of visual versus textual outliers and different forms of textual outliers, we establish three key criteria for advantageous textual outliers: near-distribution, descriptiveness, and inclusion of visual semantics.
- This is the first work to investigate the potential of textual outlier exposure with multimodal neural networks. We reveal that textual outlier exposure can outperform its visual counterparts and overcome inherent limitations associated with them.
- We propose to utilize LLMs or VLMs to generate diverse drafts of textual outliers at different.   
 $\text{维}$ osity levels: word, description, and caption. Generative models facilitate the convenient and cost-effective collection of potential texts suitable for formatting into textual outliers. The generated outputs are then refined into more effective forms for textual outlier exposure.
- Proposed textual outliers are validated in various OoD detection settings through comparison with visual outlier exposure baselines. In particular, description-level textual outlier outperforms a competitive baseline from visual outlier exposure by  $38.60\%$  (AUROC) on a challenging detection scenario with semantically similar classes.
Background and Notations. Let  $\mathcal{X}$  represent the input space, and  $\mathcal{Y} = \{1,\dots,C\}$  denote the label space. In our framework, we consider two main datasets: the ID dataset,  $D_{\mathrm{ID}}$ , and the OoD dataset,  $D_{\mathrm{OoD}}$ . The  $D_{\mathrm{ID}} = \{(\mathbf{x}_i,y_i)\}_{i=1}^n$  is a set of every sample from ID and is defined over  $\mathcal{X} \times \mathcal{Y}$ . On the other hand,  $D_{\mathrm{OoD}}$  is defined solely over the input space  $\mathcal{X}$  and does not have any associated labels. During training, the neural network never observes the OoD dataset. In the inference process, the neural network should be able to reliably filter out OoD samples.
Out-of-distribution detection can be formulated as a binary classification problem. Given a classifier  $f: \mathcal{X} \to \mathbb{R}^C$  trained on samples in a subset of  $D_{\mathrm{ID}}$ , the objective is to design a binary function estimator,
$$
g (\mathbf {x}) = \left\{ \begin{array}{l l} \text {i n}, & \text {i f} S (\mathbf {x}, f) \geq \gamma \\ \text {o u t}, & \text {i f} S (\mathbf {x}, f) <   \gamma \end{array} \right. \tag {1}
$$
Figure 1: Framework overview. (a) During the training phase, we utilize textual outliers embeddings as proxies for test OoD data. For the ID image data, we train the model using cross-entropy loss, while for the textual outlier data, we employ outlier exposure loss, which enforce the model to output the low-confidence predictions on them. To reduce the modality gap between the two domains, we inject noise to textual outlier. (b) During the testing phase, the trained classifier filters out OoO data by thresholding output score.
that classifies whether a sample  $\mathbf{x} \in \mathcal{X}$  belongs to  $D_{\mathrm{ID}}$  or not. This is determined by the score function  $S(\mathbf{x}, f)$ , which is defined based on the classifier's output. The threshold parameter  $\gamma$  is typically chosen to ensure a high percentage (e.g., 95%) of correctly classified in-distribution samples.
Evaluation Metrics. The OoD detection performance can be assessed by using the following two evaluation metrics: (1) the false positive rate of OoD samples at a fixed true positive rate of  $95\%$  (FPR95) for ID samples, with lower values indicating better performance, and (2) the area under the receiver operating characteristic curve (AUROC), with higher values indicating better performance. Additionally, we report the accuracy of the ID classification.
**Framework Overview.** CLIP [37] is a large-scale vision-language model that has been trained on a vast dataset consisting of 400 million image-text pairs, collected from the internet. Its remarkable performance has been demonstrated across various tasks, leading to numerous studies exploring its transferable feature representation [59, 13]. Several previous works have shown improvements in diverse tasks by operating in the CLIP space with the frozen CLIP encoder [42, 14, 15, 9, 35, 1]. Likewise, we leverage the strength of the CLIP encoder to build a reliable classifier by training a linear classifier on top of it. The CLIP embedding space that jointly models images and texts enables usage of textual cues for visual OoD detection. Therefore, we employ textual, instead of visual, outliers to regularize the classifier; train data for the supervised loss and test data, both ID and OoD, remain defined in the image domain. The general framework for textual outlier exposure is illustrated in Figure 1.
3 Understanding the Potential of Textual Outlier
Prior to exploring various forms of textual outliers, we first show that even naïve approaches to textual outlier exposure can overcome the inherent limitations of its visual counterpart. We reveal the advantages of using textual outliers over images by replacing images with texts in two representative types of outlier exposure: (1) the use of real auxiliary datasets and (2) virtual outlier synthesis in the feature space. The empirical results demonstrate that textual outliers can achieve superior OoD detection performance, as well as significantly reducing the variance of performance and time consumption in (1) and (2). In this section, all of the experiments are conducted following the procedure in Figure 1.
3.1 Auxiliary datasets
Experimental setting. Hendrycks et al. [18] proposed to utilize real auxiliary datasets as proxy data for outlier exposure to improve the detection performance. We leverage four auxiliary datasets to evaluate visual and textual outliers (Table 1). To use texts instead of images, we adopt class labels from an auxiliary dataset as outliers, e.g., "a photo of bamboo forest" when SUN [52] is used as an
Table 2: Results of using images vs. texts (class labels) of auxiliary datasets as outliers. We compare the results of utilizing 4 different auxiliary datasets. In the testing phase, we use ImageNet20 and ImageNet10 as ID and OoD datasets, respectively. The best result in each column is in bold.
Auxiliary Dataset	Texture	Places	SUN	iNaturalist	Average
Metrics	FPR	AUROC	FPR	AUROC	FPR	AUROC	FPR	AUROC	ID Acc	FPR	AUROC
None	-	-	-	-	-	-	-	-	95.2	21.49	96.27
Image	29.80	95.96	13.60	97.53	18.60	96.89	36.20	93.34	95.6	24.55 ± 10.05	95.93 ± 1.84
Text	19.60	97.23	15.40	97.37	15.00	97.37	13.40	97.28	95.9	16.10 ± 3.12	97.25 ± 0.17
auxiliary dataset. To mitigate the imbalance in size between image and text datasets, we, following the experimental setting in Zhang et al. [57], train the model for 300 epochs with textual outliers and 25 epochs with visual outliers. We use ImageNet20 as ID data and ImageNet10 as OoD data for evaluation as proposed in Ming et al. [32].
Results. Table 2 presents a comparison of the detection performance and classification accuracy between visual and textual outliers. Notably, textual outliers demonstrate superior performance across all evaluation metrics. Furthermore, the detection performance of models trained with visual outliers is highly contingent on the choice of an auxiliary dataset, leading to signifi
cant performance variation. This poses a considerable challenge in determining the optimal dataset for effective outlier exposure. In contrast, the use of textual outliers noticeably reduces performance variation. Additional results on other benchmark datasets can be found in the Appendix C.1.
Table 1: Number of images / texts (class labels) in auxiliary datasets.
Textures	Places	SUN	iNaturalist
Image	5640	10000	10000	10000
Text	47	50	50	110
3.2 Synthesis in feature space
Experimental setting. As an alternative to using auxiliary datasets, virtual outlier synthesis in the feature space, which does not rely on real datasets, has been proposed [8, 46]. The feature space of a classifier can be represented as a Gaussian mixture model with the class mean and variance. It is reasonable to consider instances sampled from the low-likelihood regions of this distribution as outliers. To obtain means and variances per class using text instead of images, we adopt class labels, synonyms of class labels, and descriptions of classes obtained from GPT-3 [2]. Examples of labels and associated
synonyms and descriptions are provided in the Appendix C.2. We choose VOS [8] from a family of methods in outlier synthesis as the testbed to compare virtual outliers. For both textual and visual outliers, we utilize the CLIP embedding space to obtain class means and variances. We train the linear classifier with ImageNet10 and use ImageNet20 as OoD dataset for evaluation [32]. The number of training epochs is set to 300 for both images and texts.
Table 3: AUROC achieved after varying amounts of time consumption for virtual outlier synthesis.
Time
18m	30m	3h 54m
Image	91.65	96.59	97.77
Text	97.85	-	-
Results. Our findings, as shown in Table 3, indicate that utilizing class means and variances derived from texts for outlier synthesis outperforms those derived from images, while also demonstrating better sample efficiency. The majority of computational overhead in virtual outlier synthesis arises from computing the updated class mean and variance after each epoch to generate a new set of virtual outliers. Notably, when using text data, the training time is significantly reduced by a factor of 13 (18 minutes vs. approximately 4 hours), while still achieving comparable performance. When we reduce the amount of image data to match the synthesis and training time for textual outliers, the OoD detection performance experiences a considerable decline from 97.77 to 91.65 in terms of AUROC.
The superior performance of textual outliers can be attributed to their proximity to ID data. To analyze the relationship between ID data and different outliers, we utilize UMAP [30], a popular technique for dimension reduction. In Figure 2 (a), we visualize the latent space that con
tains ID data and two types of real auxiliary datasets, Texture [4] and iNaturalist [47]. They are the two auxiliary datasets whose textual outliers led to greatest performance improvements. Similarly, Figure 2 (b) shows the latent space representing three types of data: ID data, class-wise means of ID data in both image and text domains, and outliers sampled from each domain's distribution. Textual outliers, whether real or virtual, lie closer to ID data compared to their visual counterparts. This observation implies that textual outliers, which reside in the vicinity of ID data distribution, can offer informative signals about boundary regions [8, 33].
As a result, the usage of textual outliers contributes to improving OoD detection performance by assisting the neural network in modeling the ID-OoD boundary.
Based on these empirical findings, we conclude that exposing the neural network to textual outliers offers significant advantages, including robustness to performance variation and enhanced sample efficiency. In the subsequent sections, we delve into potential designs for textual outliers (Section 4) and analyze the factors that contribute to their effectiveness in outlier exposure (Section 5).
(a) Auxiliary dataset
Figure 2: Feature space analysis of image and text outliers in (a) auxiliary datasets and (b) synthesis settings.
(b) Synthesis
Unlike visual outliers, textual outliers can take various forms, ranging from a single word to more verbose descriptions. We investigate three different designs for textual outliers: 1) words retrieved from ID images, 2) descriptions of ID class-labels, and 3) captions of ID images generated by an image captioning model. Figure 3 visualizes the generation process for each type of textual outlier. We utilize LLMs and a VLM to generate textual outliers and selectively employ the generated outputs that are OoD but still lie adjacent to the ID data. We highlight that no additional data except for ID data is used to generate textual outliers.
4.1 Generating textual outliers in three types
4.1.1 Word-level textual outliers
(i) Motivation. The most straightforward way of designing textual outliers is in the form of "a photo of {word}", which we coin word-level textual outliers. As discussed in Section 3.1, word-level textual outliers can generate by simply leveraging class labels or comparable terms from auxiliary datasets, but they may not always lie in the proximity of ID data. In Section 3.3, we have observed that textual outliers that are closer to the ID data tend to provide more informative signals. To obtain word-level textual outliers that are near the ID data, we utilize image-based text retrieval. Utilizing texts that are close to images enhances the classifier's ability to capture the ID-OoD boundary, thereby improving its performance in distinguishing between ID and OoD data.
(ii) Generation. We exploit the framework proposed by Esmaeilpour et al. [10] to perform text retrieval from ID images. The retrieval process consists of the following steps. First, we use the CLIP image encoder to extract image embeddings of ID data. These embeddings are then treated as sequences of tokens and fed into the multi-head cross-attention head of BERT, which functions as a text decoder. Finally, the resulting text embeddings are linearly projected onto the text space. Figure 3 (a) provides a high-level overview of the retrieval
Table 4: Templates for prompt ensembling with textual outliers.
"A photo of a {}"
"A blurry photo of a {}"
"A photo of many {}"
"A photo of the large {}"
"A photo of the small {}"
process. Images from the validation set of the ID dataset, which does not overlap with the test set, are used as inputs.
(iii) Filtering. Initial versions of generated text outputs are not always guaranteed to be OoD. Therefore, we select a subset of retrieved words based on their cosine similarity to the ID image
(a) Word-level Textual Outlier
Figure 3: Illustration of (a) word-level, (b) description-level, and (c) caption-level textual outlier generation processes. A different generative model is used for each type of textual outlier. In (a), CLIP and BERT are used to perform image-based text retrieval to create word-level textual outliers. In (b) and (c), description-level and caption-level textual outliers are generated from GPT-3 and BLIP-2, respectively. For word- and caption-level textual outliers, the generated outliers are refined for the purpose of outlier exposure. See Section 4 for details.
embeddings. Only those with top- $k$  to  $k + \delta$  similarity values are selected, and afterwards, class labels are explicitly removed. Through this filtering process, we can effectively keep texts that are OoD but near ID data. To prompt CLIP with selected word-level textual outliers, we employ prompt ensemble using the templates outlined in Table 4.
4.1.2 Description-level textual outliers
(i) Motivation. We now consider generating textual outliers from class labels of ID data, instead of images. With LLMs, class labels can easily be expanded into illustrative descriptions that include linguistic semantics; we name these description-level textual outliers.
(ii) Generation. We utilize GPT-3, a powerful and widely-adopted LLM, to obtain class descriptions. GPT-3 is prompted with the phrase "describe what the {class name} looks like" [31].
(iii) Filtering. These class descriptions can be utilized as textual outliers without further refinement because they already are OoD from CLIP's viewpoint. For instance, when we prompt CLIP with a description of a Siamese cat (e.g., "a photo of + light-colored fur with dark points on the face, ears, legs, and tail"), it retrieves images that noticeably deviate from the actual visual characteristics of a Siamese cat. An illustrative example demonstrating this phenomenon can be found in the Appendix E.1. Therefore, we employ the class descriptions obtained from GPT-3, after excluding the corresponding class labels, as textual outliers and preprocess templates in Table 4 to each description.
4.1.3 Caption-level textual outliers
(i) Motivation. To generate descriptive textual outliers that also contain visual semantics, we propose to reformulate captions into textual outliers. The so-called caption-level textual outliers, generated with visual cues, can capture the complex visual semantics in images and also contain rich linguistic semantics, encompassing the benefits of word- and description-level textual outliers.
(ii) Generation. To acquire a set of captions, denoted as  $S = \{\mathbf{s}_1, \mathbf{s}_2, \dots, \mathbf{s}_N\}$ , we utilize BLIP-2 [25], known for its exceptional descriptive capabilities [40]. Images of the validation set of the ID data are used as inputs to BLIP-2. However, some of the captions that resemble the ID samples too closely are ineffective for outlier exposure.
(iii) Filtering. To filter out such ineffective captions, we utilize the Mahalanobis distance  $\mathrm{M}(\mathbf{s})$  [24] as a measure of closeness to ID data. The Mahalanobis distance is computed as follows:
$$
\mathrm {M} (\mathbf {s}) = \max  _ {c} \left(- \left(h _ {\text {t e x t}} (\mathbf {s}) - \hat {\mu} _ {c}\right) ^ {\top} \hat {\boldsymbol {\Sigma}} ^ {- 1} \left(h _ {\text {t e x t}} (\mathbf {s}) - \hat {\mu} _ {c}\right)\right), \tag {2}
$$
where  $\hat{\mu}$  and  $\hat{\Sigma}$  denote class-wise mean and variance of the training set.  $\hat{\mu}$  and  $\hat{\Sigma}$  are derived using the following equations:
$$
\hat {\mu} _ {c} = \frac {1}{N _ {c}} \sum_ {i: y _ {i} = c} h _ {\mathrm {i m a g e}} (\mathbf {x} _ {i}), \hat {\Sigma} = \frac {1}{N} \sum_ {c} \sum_ {i: y _ {i} = c} \left(h _ {\mathrm {i m a g e}} (\mathbf {x} _ {i}) - \hat {\mu} _ {c}\right) \left(h _ {\mathrm {i m a g e}} (\mathbf {x} _ {i}) - \hat {\mu} _ {c}\right) ^ {\top}, \tag {3}
$$
where  $h_{\{\}}(\cdot)$  refers to the CLIP image or text encoder. We only consider the top- $p\%$  of the data with the largest  $\mathrm{M}(\mathbf{s})$ .
4.2 Optimizing ID embeddings with textual outlier
We train our classifier using the loss as defined below:
$$
\mathcal {L} (f) = \mathbb {E} _ {(\mathbf {x}, y) \sim \mathcal {D} _ {I D}} \left[ \mathcal {L} _ {C E} \left(f \left(h _ {\text {i m a g e}} (\mathbf {x})\right), y\right) \right] + \lambda \mathbb {E} _ {\mathbf {s} \sim \mathcal {D} _ {o u t} ^ {O E}} \left[ \mathcal {L} _ {O E} \left(f \left(h _ {\text {t e x t}} (\mathbf {s})\right)\right) \right], \tag {4}
$$