SlowGuess/NeurIPS_2023_OCR huggingface dataset:
where  $\Delta f(\pmb{\theta}^{\prime})$  denotes the derivative at point  $\pmb{\theta}^{\prime}$ ,  $B(\pmb{\theta},\rho) = \{\pmb{\theta}^{\prime}:\| \pmb{\theta} - \pmb{\theta}^{\prime}\| < \rho \}$  denotes the open ball of radius  $\rho$  centered at the point  $\pmb{\theta}$  in the Euclidean space and  $\rho$  denotes the perturbation radius that controls the magnitude of the neighbourhood. The flatness  $R_{\rho}(\pmb{\theta})$  describes how flat the function landscape is [54]. It has been demonstrated that a flatter landscape could lead to better generalization [11, 55, 54, 53]. Eq. 12 indicates that the first-order flatness is determined by the largest gradient, therefore, our proposed method pruning the most sensitive parameters is able to improve the flatness of the function landscape and lead to better generalization. However, according to Remark 2, pruning the most sensitive parameters and neurons may also hurt the separability between ID and OOD samples. Therefore, there is a trade-off between better generalization and better ID-OOD separability. This explains why OOD performance improves with very few sensitive parameters pruned and drops with a large pruning ratio, as demonstrated in Fig. 3.
In this section, we describe our experimental setup and implementation details, then evaluate the effectiveness of the proposed OPNP method in different model architectures and OOD detection benchmarks, followed by extensive ablation studies.
Table 1: OOD detection results on ImageNet-1k benchmark with ResNet50 model. OPP, ONP and OPNP represent only using optimal parameter pruning, only using optimal neuron pruning and using both parameter and neuron pruning, respectively. All numbers are percentages.
Method	OOD Datasets	Average
iNatualist	SUN	Places	Texture
FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑
MSP[12]	54.05	87.43	73.37	78.03	72.98	78.03	68.85	79.06	67.31	80.64
ODIN[29]	47.66	89.66	60.15	84.59	67.89	81.78	50.23	85.62	56.48	85.41
Mahalanobis[26]	97.00	52.65	98.50	42.41	98.40	41.79	55.80	85.01	87.43	55.47
Energy[31]	55.72	89.95	59.26	85.89	64.92	82.86	53.72	85.99	58.41	86.17
ReAct[43]	20.38	96.22	24.20	94.20	33.85	91.58	47.30	89.80	31.43	92.95
DICE[44]	25.63	94.49	35.15	90.83	46.49	87.48	31.72	90.30	34.75	90.77
DICE+ReAct[44]	18.64	96.24	25.45	93.94	36.86	90.67	28.07	92.74	27.25	93.40
OPP	23.58	95.41	30.40	93.17	40.76	90.65	41.27	92.10	34.00	92.83
ONP	18.56	95.93	26.67	94.72	32.69	92.94	38.56	90.83	29.12	93.61
OPNP	18.89	96.03	18.50	95.62	30.14	93.46	36.17	91.70	25.93	94.20
OPNP+ReAct	14.72	96.78	19.73	95.65	30.23	93.34	27.78	94.13	23.12	94.98
Datasets. Following prior works [43, 44], we utilize ImageNet-1K, CIFAR-10 and CIFAR-100 as ID dataset. For ImageNet-1K benchmark, 50000 test samples are used as test ID samples, and four datasets are used as test OOD data, which are from (subset of) iNaturalist, SUN, Place and Texture [44]. For CIFAR benchmark, the standard split with 50,000 training ID images and 10,000 test ID images are utilized for training and evaluation. We follow [43, 44] to evaluate on six common OOD datasets  $^{2}$ , including iSUN [50], LSUN-Resize [52], LSUN-Crop [52], SVHN [36], Places365 [56], and Textures [4].
Models. We utilize two representative deep models, ResNet50 [18] and ViT-B/16 [7], to evaluate our proposal. For ResNet50, the model weights provided in TorchVision [34] is utilized. For ViT-B/16, we utilize the model weights provided in Pytorch Image Models (timm) library [49]. For both models, we only estimate the parameter and neuron sensitivity in the last fully-connected (FC) layer. The number of neurons in th pre-logit layer are 2048 and 768 for ResNet50 and ViT-B/16 respectively.
Evaluation Metric and Baselines. We utilize FPR95 and AUROC as evaluation metrics, which are the most important metrics in OOD detection [22, 31]. FPR95 is short for FPR@TPR95 which represents the false positive rate when the true positive rate is  $95\%$ . AUROC denotes the area under the receiver operating characteristic curve, which is threshold-free and reflects the average performance under different thresholds. Note that we following [44] do not report the ID classification accuracy since our proposal is training-free and only revises the last FC layer. We can always use the original FC layer for classification, which ensures an identical classification accuracy as unpruned model. We compared our OPNP with the most competitive post-hoc OOD detection methods, including MSP [21], ODIN[29], Mahalanobis distance [26], Energy Score [31], ReAct [43] and DICE [44].
Implementation Details. Implementation of this work is based on Pytorch library  $^{3}$ . We use all training images in ImageNet-1K to obtain the parameter sensitivity by using the autograd function achieved by energy_score.backup(). At test time, all images are resized to  $224 \times 224$ . The hyperparameters  $\rho_{min}^{w}$ ,  $\rho_{max}^{w}$ ,  $\rho_{min}^{o}$ ,  $\rho_{max}^{o}$  are experimentally determined in the validation set, which includes 50000 test ID samples and 50000 test OOD samples that are selected from images-21k. We utilize grid search to determine the optimal pruning percentage, where we vary  $\rho_{min}^{w} = \{0,5,10,20,\dots,60\}$ ,  $\rho_{max}^{w} = \{0,0.1,0.3,0.5,1,3,5\}$ ,  $\rho_{min}^{o} = \{0,5,10,20,\dots,50\}$ ,  $\rho_{max}^{o} = \{0,0.5,1,5,10,20,\dots,50\}$ . The same hyperparameters are adopted in the same model.
4.2 Main Results.
Evaluation on ImageNet-1K benchmark. In Table 1, we compare our proposal with other competitive post-hoc OOD detection methods based on ResNet50.  $\uparrow$  denotes larger values are better and  $\downarrow$  denotes smaller values are better. The results for those comparison baselines are directly taken from
$^{2}$ https://github.com/deeplearning-wisc/dice
<sup>3</sup>https://github.com/pytorch/pytorch
Table 2: OOD detection results on ImageNet-1k benchmark with ViT-B/16 model. All numbers are percentages.
Method	OOD Datasets	Average
iNatualist	SUN	Places	Texture
FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑	FPR95↓	AUROC↑
MSP[12]	21.28	91.63	51.96	85.08	50.63	84.92	50.57	87.50	43.61	87.28
Energy[31]	7.61	98.23	40.30	90.77	46.89	88.62	33.54	93.21	32.09	92.71
ReAct[43]	2.28	99.42	30.68	93.94	35.32	91.40	37.08	92.84	26.34	94.40
DICE[44]	4.51	98.87	32.43	93.30	37.46	91.02	39.19	92.44	28.40	93.91
DICE+ReAct[44]	2.65	99.38	29.45	93.52	38.45	91.17	33.78	93.27	26.08	94.34
OPP	3.12	99.18	25.28	93.99	34.00	91.43	35.56	92.21	24.49	94.20
ONP	3.87	99.13	29.63	93.08	35.68	90.73	35.60	91.54	26.20	93.62
OPNP	3.16	99.38	24.32	93.86	34.52	91.45	38.76	91.96	25.19	94.16
OPP+ReAct	2.52	99.35	23.96	94.50	32.80	92.10	36.03	91.77	23.83	94.43
Table 3: Changes in ID classification accuracy by varying pruning percentage in ResNet50 model.
Percentage	ρw=0	ρwmax=0.1	ρwmax=0.3	ρwmax=1	ρwmax=5	ρwmin=5	ρwmin=10	ρwmin=20	ρwmin=40
ID Acc	76.13	75.14	74.72	71.60	56.37	76.06	75.88	75.86	75.06
[43, 44], which utilizes the same experimental setup as ours. OPP, ONP and OPNP represent only utilize optimal parameter pruning, only utilize optimal neuron pruning and utilize both parameter and neuron pruning, respectively. The results in Table 1 reveal several interesting observations: (1) Optimal parameter pruning (OPP) achieves similar performance as DICE which also removes unimportant connections for OOD detection, and significantly outperforms MSP [21], Mahalanobis distance [26] and Energy [31] baselines. (2) Optimal neuron pruning (OPN) achieves much better performance than OPP, outperforms DICE [44] by a large margin and outperforms SOTA feature rectification method (ReAct) [43] by  $2.1\%$  in FPR95 and  $0.7\%$  in AUROC. (3) Compared to OPP and ONP, combining parameter pruning and neuron pruning (OPNP) also reduces FPR95 by  $3.3\%$  and improves AUROC by  $0.6\%$  based on ONP. (4) OPNP outperforms both SOTA weights pruning method (DICE) and SOTA feature rectification method (ReAct) by a large margin (more than  $5\%$  in FPR95). (5) Our proposed OPNP does not outperform ReAct and DICE in Texture dataset, which can be compensated by combining ReAct.
In Table 2, we compare our proposal with competitive post-hoc OOD detection methods based on ViT-B/16 model. We note that the performance of MSP [21] and Energy Score [31] in previous work [9] is worse than our implementation based on the same model, therefore, we reported the performance reproduced by ourselves. The results show that: (1) Both OPP and ONP outperforms Energy baseline [31] by a large margin, which demonstrates the effectiveness of our proposal in ViT model. (2) OPP outperforms ONP and combining parameter and neuron pruning (OPNP) does not further improve the OOD performance, which is different from the results in ResNet50. We think this is because the number of neurons in ViT-B/16 (768) is much less than in ResNet50 (2048), besides, there is a relu layer before pre-logit layer in ResNet, which results in more risky parameters and neurons in ResNet50 model. (3) OPP outperforms ReAct by  $1.85\%$  and outperforms DICE by  $3.91\%$  in FPR95, combining OPP and ReAct brings additional improvement.
Evaluation on CIFAR benchmark. The main results on CIFAR10 and CIFAR100 benchmarks are show in Table 5 and Table 6. As can be seen, we consider the three most commonly used post-hoc methods and compare the OOD detection performance with and without applying the OPNP. The results show that: (1) On both CIFAR10 and CIFAR100, using OPNP consistently outperforms the counterpart without OPNP, which indicates that our proposal is compatible with other post-hoc methods. (2) The performance improvement brought by OPNP on CIFAR100 is more significant than on CIFAR10 and less significant than on ImageNet benchmark. We believe this is because the FC layer on CIFAR10 classification model is much less overparameterized than CIFAR100 and ImageNet classification models. (3) The OPNP achieves similar performance as ReAct On CIFAR10 benchmark, and outperforms ReAct on CIFAR100 benchmark. Besides, utilizing OPNP and ReAct jointly reduces FPR95 by  $1.55\%$  and  $2.49\%$  in CIFAR10 and CIFAR100 benchmark, respectively.
(a) Sensitivity of  $\rho_{max}^{w}$
Figure 3: Effect of varying pruning percentage parameters in ResNet50 model. (a) Effect of varying  $\rho_{max}^{w}$ ; (b) Effect of varying  $\rho_{min}^{w}$  when set  $\rho_{max}^{w} = 0.5$ ; (c) Effect of varying  $\rho_{max}^{o}$ ; (d) Effect of varying  $\rho_{min}^{o}$  when set  $\rho_{max}^{o} = 30$ . All numbers are percentages.
(b) Sensitivity of  $\rho_{min}^{w}$
(c) Sensitivity of  $\rho_{max}^{o}$
(d) Sensitivity of  $\rho_{min}^{o}$
Table 4: OOD detection performance with different parameter and neuron pruning methods. We use ImageNet-1K as ID data, SUN and Places as OOD data. FPR95 performance in ResNet50 is reported.
Method	RPP	TPP	OPP	RNP	TNP	ONP
SUN	49.42	43.36	30.40	52.44	47.76	26.67
Places	54.40	51.86	40.76	53.92	52.84	32.69
(a) Distribution
(b) Uncalibrated
(c) After OPNP
Figure 4: Illustration of confidence reliability diagrams. (a) Sample distribution histogram in different confidence bins. (b) Confidence reliability diagrams (CRD) in the original calibrated model. (c) CRD in the model with optimal parameter and neuron pruning.
4.3 Ablation Studies.
Effect of pruning percentage. In Fig. 3, we demonstrate the impact on OOD detection performance by varying pruning percentages in two different tasks. Fig. 3(a) shows that pruning only  $0.5\%$  high sensitivity parameters brings significant improvement. In Fig. 3(b), we observe considerable performance improvement with a large pruning percentage for low sensitive parameters. Fig. 3(c) and Fig. 3(d) suggest that pruning high sensitive neurons is more effective than pruning low sensitive neurons, which brings marginal improvement. While OPNP achieves the SOTA performance, the performance could be significantly improved by pruning only the weights or neurons, which is much simple to determine the thresholds. Besides, the performance is improved and insensitive in a wide range of pruning ratio. For example, the optimal pruning ratio can be set to  $\rho_{min}^{w} \in [10, 30]$  and  $\rho_{max}^{w} \in [0.5, 3]$  across different OOD sets. In Table 3, we demonstrate the impact of different pruning percentages on ID classification accuracy. As observed, pruning only  $1.0\%$  high sensitive parameters decreases the ID accuracy by  $4.53\%$ . In contrast, pruning  $40\%$  low sensitive parameters only reduces ID accuracy by  $1.07\%$ . This highlights the effectiveness of our sensitivity estimation method, and also demonstrates the significant parameter redundancy in deep networks.
Ablation on pruning methods. In this ablation, we compare the proposed sensitivity guided parameter and neuron pruning method with other pruning method, including: (1) Random parameter pruning (RPP) [48]; (2) Target parameter pruning (TPP) [15], which prunes weights with low magnitude; (3) Random neuron pruning (RNP) [42]; and (4) Target neuron pruning (TNP) [15], which prunes neurons with low feature norm. For the comparison methods, we try different pruning percentages and report the best results. The ablation results in Table. 4 reveal that: (1) pruning
(a) Energy-SUN
(b) OPNP-SUN
Figure 5: Illustration of OOD score distributions in two tasks with the Energy baseline and our proposed OPNP. (a) Energy baseline in SUN benchmark. (b) OPNP in SUN benchmark. (c) Energy baseline in Places benchmark. (d) OPNP in Places benchmark.
(c) Energy-Places
(d) OPNP-Places
parameters and neurons with low magnitude outperforms random parameter and neuron pruning. (2) The introduced optimal parameter and neuron pruning outperforms other pruning methods by a margin margin, with  $16.68\%$  improvement in SUN dataset and  $18.95\%$  in Places dataset.
OPNP benefits model calibration. A well calibrated model should have better OOD detection performance [16]. In this ablation, we explore how OPNP influences model calibration. In Fig. 4, we evaluate model calibration performance with Confidence Reliability Diagrams (CRD) and Expected Calibration Error (ECE), which was introduced in [16]. As observed in Fig. 4(b), for an uncalibrated model, the confidence obviously exceeds accuracy, which indicates overconfident confidence. Fig. 4(c) illustrates the effect of utilizing OPNP, which shows that the consistency between confidence and accuracy is improved, and the ECE is reduced by  $1.5\%$ . It demonstrates that OPNP is beneficial to model calibration, which also explains why OPNP improves OOD detection performance.
How OPNP changes the score distribution In Fig. 5, we illustrate the OOD score distribution with the Energy baseline [31] and our proposed OPNP. We utilize SUN and Places benchmarks with ResNet50 model to exhibit how the OPNP changes the OOD score distributions. From the illustration, several interesting observations are: (1) Utilizing OPNP increases OOD scores for both ID and OOD samples. (2) The utilization of OPNP has a significant impact on the score distribution of OOD samples, resulting in a more condensed distribution. (3) The OOD score distributions of ID and OOD samples become more separable after applying OPNP, which validates the effectiveness of optimal parameter and neuron pruning.
Conclusion and future work. In this paper, we propose a simple yet effective post-hoc OOD detection method. In particular, a gradient-based method is proposed to estimate the sensitivity of model parameters and neurons. We show that the OOD detection performance could be significantly improved by simply removing the connection weights and neurons with exceptionally large or close to zero sensitivities. Extensive experiments and ablations are performed to demonstrate the effectiveness of our proposal. Compared to energy score baseline, our OPNP reduces FPR95 by  $32.5\%$  in ImageNet-1K benchmark. Besides, the OPNP outperforms the SOTA feature rectification method by  $5.5\%$  in FPR95 and outperforms the SOTA weight pruning method by  $8.8\%$  in FPR95. We believe the optimal parameter and neuron pruning is a promising direction for OOD detection tasks, and hope our findings can bring new ideas and breakthroughs to other researchers. In our future work, we will explore other post-hoc model pruning and quantization method, as well as low rank decomposition of model parameters for OOD detection.
Limitation and societal impact. The main limitation of this work is lack of theoretical guarantee. Therefore, we call for further application and explanation of the sensitivity guided parameter and neuron pruning method for OOD detection. This work aims to improve the safety of modern deep learning models, which tends to benefit a wide range of applications in social life, such as AI for medical, smart city and driverless system. We hope to provide a plug-and-play tool for AI model users to reduce the false recognition caused by OOD samples in the real world.
This work was supported by the National Key R&D Program of China under Grant 2020AAA0103902.
[52] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365, 2015.
[53] Jingzhao Zhang, Tianxing He, Suvrit Sra, and Ali Jababaie. Why gradient clipping accelerates training: A theoretical justification for adaptivity. In International Conference on Learning Representations, 2019.
[54] Xingxuan Zhang, Renzhe Xu, Han Yu, Hao Zou, and Peng Cui. Gradient norm aware minimization seeks first-order flatness and improves generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20247-20257, 2023.
[55] Yang Zhao, Hao Zhang, and Xiuyuan Hu. Penalizing gradient norm for efficiently improving generalization in deep learning. In International Conference on Machine Learning, pages 26982-26992. PMLR, 2022.
[56] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE transactions on pattern analysis and machine intelligence, 40(6):1452-1464, 2017.
[57] Yao Zhu, YueFeng Chen, Chuanlong Xie, Xiaodan Li, Rong Zhang, Hui Xue, Xiang Tian, Yaowu Chen, et al. Boosting out-of-distribution detection with typical features. arXiv preprint arXiv:2210.04200, 2022.
A Evaluation on CIFAR Benchmarks
A.1 Experimental setup
We additionally evaluate our proposal on the widely used CIFAR benchmarks with CIFAR10 and CIFAR100 as ID datasets. The standard split with 50,000 training ID images and 10,000 test ID images are utilized for training and evaluation. We following [43, 44] to evaluate on six common OOD datasets  $^{4}$ , including iSUN [50], LSUN-Resize [52], LSUN-Crop [52], SVHN [36], Places365 [56], and Textures [4]. Please refer to [44] for the details of the datasets. For both CIFAR10 and CIFAR100 datasets, we train a standard ResNet50 [18] model for 100 epochs. The learning rate is set to 0.01 and cosine annealing [32] is utilized for learning rate decay. The final accuracy of CIFAR10 and CIFAR100 classification model is  $96.44\%$  and  $85.27\%$  respectively.
A.2 Main results
The main results on CIFAR10 and CIFAR100 benchmarks are show in Table 5 and Table 6. As can be seen, we consider the three most commonly used post-hoc methods and compare the OOD detection performance with and without the applying OPNP. The results show that: (1) On both CIFAR10 and CIFAR100, using OPNP consistently outperforms the counterpart without OPNP, which indicates that our proposal is compatible with other post-hoc methods. (2) The performance improvement brought by OPNP on CIFAR100 is more significant than on CIFAR10 and less significant than on ImageNet benchmark. We believe this is because the output layer on CIFAR10 classification model, which has fewer connection weights, is much less overparameterized than CIFAR100 and ImageNet classification models. (3) The OPNP achieves similar performance as ReAct On CIFAR10 benchmark, and outperforms ReAct on CIFAR100 benchmark. Besides, utilizing OPNP and ReAct jointly reduces FPR95 by  $1.55\%$  and  $2.49\%$  in CIFAR10 and CIFAR100 benchmark, respectively.
Table 5: OOD detection results on CIFAR10 benchmark with ResNet50 model. All numbers are percentages. The performances are reported as FPR95/AUROC.
Method	OOD Datasets	Average
iSUN	LSUN-C	LSUN-R	SVHN	Places365	Textures
MSP[12]	18.54/93.80	11.40/96.52	15.75/94.25	6.81/98.07	24.47/92.10	18.54/93.77	15.92/94.75
MSP+OPNP	11.52/95.44	7.27/98.49	12.59/96.10	3.32/98.87	19.41/94.40	14.84/96.10	11.49/96.57
Energy [31]	9.44/97.60	4.29/99.04	7.77/97.79	1.50/99.67	18.60/95.33	13.22/96.98	9.14/97.74
Energy+OPNP	7.24/98.18	3.91/99.04	6.58/98.45	0.86/99.82	13.65/96.73	7.40/98.31	6.61/98.42
ReAct [43]	8.81/97.94	4.94/98.92	6.29/98.34	2.31/99.48	11.24/97.31	5.93/98.48	6.59/98.41
ReAct+OPNP	5.54/98.32	3.62/99.25	4.48/99.00	0.40/99.90	9.34/97.64	6.88/98.20	5.04/98.72
Table 6: OOD detection results on CIFAR100 benchmark with ResNet50 model. All numbers are percentages. The performances are reported as FPR95/AUROC.
Method	OOD Datasets	Average
iSUN	LSUN-C	LSUN-R	SVHN	Places365	Textures
MSP[12]	51.22/83.16	49.73/86.08	45.77/84.78	31.85/91.48	40.76/87.17	40.31/87.79	43.27/86.74
MSP+OPNP	42.63/86.20	43.96/87.13	38.44/88.67	24.65/92.94	33.80/91.04	31.68/91.23	35.86/89.54
Energy [31]	38.39/89.72	30.77/93.18	32.00/91.54	15.21/96.94	32.96/93.06	25.43/93.56	29.13/93.00
Energy+OPNP	32.39/91.86	26.24/94.36	27.19/94.36	11.23/97.88	27.03/94.38	23.96/95.10	24.67/94.66
ReAct [43]	30.53/92.00	30.86/93.10	31.15/92.57	14.69/97.15	28.04/94.01	21.03/95.27	26.05/94.02
ReAct+OPNP	28.78/92.21	26.42/94.14	29.42/93.84	16.71/96.68	22.71/95.07	17.36/96.38	23.56/94.71
B More Ablation Studies
B.1 Perform OPNP on different layers
In our main experiments, we apply the OPNP in the last FC layer in both ResNet50 and ViT-B/16. In this ablation, we also utilize the proposed OPNP in different intermediate layers of ResNet50.
4https://github.com/deeplearning-wisc/dice
As illustrated in Table. 7, we utilize the OPNP in four different convolutional layers, Layer1-Layer4, which represent the kernel weights of the last  $1 \times 1$  convolutional layer in four ResBlocks of ResNet50. The results show that utilizing the OPNP in the last FC layer significantly outperforms the performance by using OPNP in the intermediate convolutional layers, which indicates that the overconfident predictions mainly comes from the last fully connected layer. Besides, we also estimate the parameter sensitivity of the whole model and pruning the weights with two globally pruning strategies, including (1) Global Threshold Pruning: pruning all the weights in Convolution layer and FC layer in a global threshold. (2) Layer-wise Pruning: pruning the weights in different layer individually with the same pruning ratio. We find that both global pruning methods perform worse than only pruning the FC layer. To help understand what happens when weights are pruned globally, we illustrate the average parameter sensitivity of different layers in Fig. 6. It shows that the sensitivity magnitude across different layers differs greatly, the sensitivity of the FC layer is less than  $\frac{1}{10}$  of the shallow Convolution layer. Therefore, it is unreasonable to utilize a global threshold for all layers. It might be work if we use different thresholds for different layers, but it is too tricky to determine the optimal thresholds.
Table 7: Ablation study of applying OPNP on different layers of ResNet50. All numbers are percentages. The performances are reported as FPR95/AUROC.
Where to OPNP	SUN	Places
Layers1	54.98/85.44	59.63/83.91
Layers2	54.30/85.78	58.77/84.10
Layers3	46.51/86.55	53.12/85.33
Layers4	37.06/88.63	48.45/87.16
Global Threshold Pruning	39.74/91.91	49.13/88.32
Layer-wise Pruning	40.48/92.35	44.92/90.27
FC Layer	18.50/95.62	30.14/93.46
Figure 6: Average parameter sensitivity of different layers in ResNet50.
B.2 Parameter sensitivity estimation with different number of training samples.