SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Sungik Choi $^{1}$  Hankook Lee $^{1}$  Honglak Lee $^{1}$  Moontae Lee $^{1,2}$
$^{1}$ LG AI Research  $^{2}$ University of Illinois Chicago
{sungik.choi, hankook.lee, honglak.lee, moontae.lee}@lgresearch.ai
Novelty detection is a fundamental task of machine learning which aims to detect abnormal (i.e. out-of-distribution (OOD)) samples. Since diffusion models have recently emerged as the de facto standard generative framework with surprising generation results, novelty detection via diffusion models has also gained much attention. Recent methods have mainly utilized the reconstruction property of in-distribution samples. However, they often suffer from detecting OOD samples that share similar background information to the in-distribution data. Based on our observation that diffusion models can project any sample to an in-distribution sample with similar background information, we propose Projection Regret (PR), an efficient novelty detection method that mitigates the bias of non-semantic information. To be specific, PR computes the perceptual distance between the test image and its diffusion-based projection to detect abnormality. Since the perceptual distance often fails to capture semantic changes when the background information is dominant, we cancel out the background bias by comparing it against recursive projections. Extensive experiments demonstrate that PR outperforms the prior art of generative-model-based novelty detection methods by a significant margin.
Novelty detection [1], also known as out-of-distribution (OOD) detection, is a fundamental machine learning problem, which aims to detect abnormal samples drawn from far from the training distribution (i.e., in-distribution). This plays a vital role in many deep learning applications because the behavior of deep neural networks on OOD samples is often unpredictable and can lead to erroneous decisions [2]. Hence, the detection ability is crucial for ensuring reliability and safety in practical applications, including medical diagnosis [3], autonomous driving [4], and forecasting [5].
The principled way to identify whether a test sample is drawn from the training distribution  $p_{\mathrm{data}}(\mathbf{x})$  or not is to utilize an explicit or implicit generative model. For example, one may utilize the likelihood function directly [6] or its variants [7, 8] as an OOD detector. Another direction is to utilize the generation ability, for example, reconstruction loss [9] or gradient representations of the reconstruction loss [10]. It is worth noting that the research direction of utilizing generative models for out-of-distribution detection has become increasingly important in recent years as generative models have been successful across various domains, e.g., vision [11, 12] and language [13], but also they have raised various social issues including deepfake [14] and hallucination [15].
Among various generative frameworks, diffusion models have recently emerged as the most popular framework due to their strong generation performance, e.g., high-resolution images [16], and its wide applicability, e.g., text-to-image synthesis [11]. Hence, they have also gained much attention as an attractive tool for novelty detection. For example, Mahmood et al. [17] and Liu et al. [18] utilize the reconstruction error as the OOD detection metric using diffusion models with Gaussian noises [17] or checkerboard masking [18]. Somewhat unexpectedly, despite the high-quality generation results,
(a) Projection  $\Pi_{\theta}$
Figure 1: Conceptual illustration of our framework. (a) Given an image  $\mathbf{x}_0$ , the projection of the image,  $\Pi_{\theta}^{t}(\mathbf{x}_{0})$ , is defined by diffusing  $\mathbf{x}_0$  until an intermediate timestep  $t$  and then reversing the process using the consistency model  $f_{\theta}$ . The projection  $\Pi_{\theta}^{t}$  can map an out-of-distribution image to an in-distribution one with similar backgrounds when  $t$  is neither too early nor too late. (b) Our proposed method, Projection Regret, computes the abnormality score  $S_{\mathrm{PR}}$  by capturing the semantic difference between a test image and its projection. We further utilize the two-step projection to cancel out the background bias, especially for the case when background information is dominant.
(b) Projection Regret  $S_{\mathrm{PR}}$
their detection performance still lags behind other generative models, e.g., energy-based models [19]. We find that these undesired results are related to the background bias problem: the reconstruction error is often biased by non-semantic (i.e., background) information. Namely, the prior methods often struggle to detect out-of-distribution images with similar backgrounds (e.g., CIFAR-100 images against CIFAR-10 ones).
Contribution. To reduce the background bias, we first systemically examine the behavior of diffusion models. We observe that the models can change semantic information to in-distribution without a major change to background statistics by starting from an intermediate point of the diffusion process and reversing the process, which is referred to as projection in this paper (see Figure 1a). Based on this observation, we suggest using the perceptual distance [20] between a test image and its projection to detect whether the test image is out-of-distribution.
Although our projection slightly changes the background statistics, the perceptual distance sometimes fails to capture semantic differences when the background information is dominant over the semantics. To resolve this issue, we propose Projection Regret, which further reduces the background bias by canceling out the background information using recursive projections (see Figure 1b). We also utilize an ensemble of multiple projections for improving detection performance. This can be calculated efficiently via the consistency model [21], which supports the reverse diffusion process via only one network evaluation.
Through extensive experiments, we demonstrate the effectiveness of Projection Regret (PR) under various out-of-distribution benchmarks. More specifically, PR outperforms the prior art of diffusion-based OOD detection methods with a large margin, e.g.,  $0.620 \rightarrow 0.775$  detection accuracy (AUROC) against a recent method, LMD [18], under the CIFAR-10 vs CIFAR-100 detection task (see Table 1). Furthermore, PR shows superiority over other types of generative models (see Table 2), including EBMs [22, 23, 24] and VAEs [25]. We also propose a perceptual distance metric using underlying features (i.e., feature maps in the U-Net architecture [26]) of the diffusion model. We demonstrate that Projection Regret with this proposed metric shows comparable results to that of LPIPS [20] and outperforms other distance metrics, e.g., SSIM [27] (see Table 5).
To sum up, our contributions are summarized as follows:
- We find that the perceptual distance between the original image and its projection is a competitive abnormality score function for OOD detection (Section 3.1).
- We also propose Projection Regret (PR) that reduces the bias of non-semantic information to the score (Section 3.2) and show its efficacy across challenging OOD detection tasks (Section 4.2).
- We also propose an alternative perceptual distance metric that is computed by the decoder features of the pre-trained diffusion model (Section 4.3).
Given a training distribution  $p_{\mathrm{data}}(\mathbf{x})$  on the data space  $\mathcal{X}$ , the goal of out-of-distribution (OOD) detection is to design an abnormality score function  $S(\mathbf{x}) \in \mathbb{R}$  which identifies whether  $\mathbf{x}$  is drawn from the training distribution (i.e.,  $S(\mathbf{x}) \leq \tau$ ) or not (i.e.,  $S(\mathbf{x}) > \tau$ ) where  $\tau$  is a hyperparameter. For notation simplicity, "A vs B" denotes an OOD detection task where A and B are in-distribution (ID) and out-of-distribution (OOD) datasets, respectively. For evaluation, we use the standard metric, area under the receiver operating characteristic curve (AUROC).
In this paper, we consider a practical scenario in a generative model  $p_{\theta}(\mathbf{x})$  pre-trained on  $p_{\mathrm{data}}(\mathbf{x})$  is only available for OOD detection. Namely, we do not consider (a) training a detector with extra information (e.g., label information and outlier examples) nor (b) accessing internal training data at the test time. As many generative models have been successfully developed across various domains and datasets in recent years, our setup is also widely applicable to real-world applications as well.
2.2 Diffusion and consistency models
Diffusion models (DMs). A diffusion model is defined over a diffusion process starting from the data distribution  $\mathbf{x}_0\sim p_{\mathrm{data}}(\mathbf{x})$  with a stochastic differential equation (SDE) and its reverse-time process can be formulated as probability flow ordinary differential equation (ODE) [28, 29]:
$$
\text {F o r w a r d S D E :} \quad d \mathbf {x} _ {t} = \boldsymbol {\mu} (\mathbf {x} _ {t}, t) d t + \sigma (t) d \mathbf {w} _ {t},
$$
$$
\text {R e v e r s e O D E :} d \mathbf {x} _ {t} = \left[ \boldsymbol {\mu} (\mathbf {x} _ {t}, t) - \frac {1}{2} \sigma (t) ^ {2} \nabla \log p _ {t} (\mathbf {x} _ {t}) \right] d t,
$$
where  $t \in [0, T]$ ,  $T > 0$  is a fixed constant,  $\pmb{\mu}(\cdot, \cdot)$  and  $\sigma(\cdot)$  are the drift and diffusion coefficients, respectively, and  $\mathbf{w}_t$  is the standard Wiener process. The variance-exploding (VE) diffusion model learns a time-dependent denoising function  $D_{\theta}(\mathbf{x}_t, t)$  by minimizing the following denoising score matching objective [29]:
$$
\mathcal {L} _ {\mathrm {D M}} := \mathbb {E} _ {t \sim \mathcal {U} [ \epsilon , T ], \mathbf {x} \sim p _ {\text {d a t a}}, \mathbf {z} \sim \mathcal {N} (\mathbf {0}, \mathbf {I})} \left[ \| D _ {\boldsymbol {\theta}} (\mathbf {x} + \sigma_ {t} \mathbf {z}, t) - \mathbf {x} \| _ {2} ^ {2} \right], \tag {1}
$$
where  $\sigma_{t}$  depends on  $\sigma (t)$ . Following the practice of Karras et al. [29], we set  $\sigma_{t} = t$  and discretize the timestep into  $\epsilon = t_0 < t_1 < \ldots < t_N = T$  for generation based on the ODE solver.
Consistency models (CMs). A few months ago, Song et al. [21] proposed consistency models, a new type of generative model, built on top of the consistency property of the probability flow (PF) ODE trajectories: points  $(\mathbf{x}_t,t)$  on the same PF ODE trajectory map to the same initial point  $\mathbf{x}_{\epsilon}$ , i.e., the model aims to learn a consistency function  $f_{\theta}(\mathbf{x}_t,t) = \mathbf{x}_{\epsilon}$ . This function  $f_{\theta}$  can be trained by trajectory-wise distillation. The trajectory can be defined by the ODE solver of a diffusion model (i.e., consistency distillation) or a line (i.e., consistency training). For example, the training objective for the latter case can be formulated as follows:
$$
\mathcal {L} _ {\mathbb {C M}} := \mathbb {E} _ {i \sim \mathcal {U} \{0, \dots , N - 1 \}, \mathbf {x} \sim p _ {\text {d a t a}}, \mathbf {z} \sim \mathcal {N} (\mathbf {0}, \mathbf {I})} \left[ d \left(f _ {\boldsymbol {\theta} ^ {-}} \left(\mathbf {x} + \sigma_ {t _ {i}} \mathbf {z}, t _ {i}\right), f _ {\boldsymbol {\theta}} \left(\mathbf {x} + \sigma_ {t _ {i + 1}} \mathbf {z}, t _ {i + 1}\right)\right) \right], \tag {2}
$$
where  $d$  is the distance metric, e.g.,  $\ell_2$  or LPIPS [20], and  $\theta^{-}$  is the target parameter obtained by exponential moving average (EMA) of the online parameter  $\theta$ . The main advantage of CMs over DMs is that CMs support one-shot generation. In this paper, we mainly use CMs due to their efficiency, but our method is working with both diffusion and consistency models (see Table 6).
In this section, we introduce Projection Regret (PR), a novel and effective OOD detection framework based on a diffusion model. Specifically, we utilize diffusion-based projection that maps an OOD image to an in-distribution one with similar background information (Section 3.1) and design an abnormality score function  $S_{\mathrm{PR}}$  that reduces background bias using recursive projections (Section 3.2).
3.1 Projection
Although previous OOD detection methods based on generative models have been successfully applied to several benchmarks [8, 17], e.g., CIFAR-10 vs SVHN, they still struggle to detect out-of-distribution samples of similar backgrounds to the in-distribution data (e.g., CIFAR-10 vs CIFAR-100). We here examine this challenging scenario with diffusion models.
Figure 2: Projection of the OOD and the in-distribution image. We show full-step projection and single-step projection results for in-distribution (CIFAR-10) and OOD (CIFAR-100, SVHN) images.
Figure 3: AUROC of the OOD detection task under different design choices and time-steps. (Left): CIFAR-10 vs CIFAR-100 OOD detection. (Right): CIFAR-10 vs SVHN OOD detection. Our proposed abnormality score (red) is the best choice.
Given discrete timesteps  $\epsilon = t_0 < t_1 < \ldots < t_N = T$ , we first suggest two projection schemes,  $\pi_{\theta}^{t_i}(\mathbf{x},\mathbf{z})$  and  $\Pi_{\theta}^{t_i}(\mathbf{x},\mathbf{z})$ , by reversing the diffusion process until  $t = t_{i - 1}$  and  $t = \epsilon$ , respectively, starting from the noisy input  $\mathbf{x}_{t_i}\coloneqq \mathbf{x} + t_i\mathbf{z}$ . Note that  $\pi_{\theta}$  can be implemented by only the diffusion-based denoising function  $D_{\theta}$  while  $\Pi_{\theta}$  can be done by multi-step denoising with  $D_{\theta}$  or single-step generation with the consistency model  $f_{\theta}$  as described in Section 2.2. We refer to  $\pi_{\theta}$  and  $\Pi_{\theta}$  as single-step and full-step projections, respectively, and the latter is illustrated in Figure 1a. We simply use  $\pi_{\theta}^{t_i}(\mathbf{x})$  and  $\Pi_{\theta}^{t_i}(\mathbf{x})$  with  $\mathbf{z}\sim \mathcal{N}(\mathbf{0},\mathbf{I})$  unless otherwise stated.
We here systemically analyze the projection schemes  $\pi_{\theta}^{t_i}$  and  $\Pi_{\theta}^{t_i}$  with the denoising function  $D_{\theta}$  and the consistency function  $f_{\theta}$ , respectively, trained on CIFAR-10 [30] for various timesteps  $t \in [\epsilon, T]$ . Note that both projections require only one network evaluation. Figure 2 shows the projection results of CIFAR-100 [30] and SVHN [31] OOD images where  $t_i \approx 1.09$  (i.e.,  $i = 7$ ,  $N = 17$ , and  $T = 80$ ). One can see semantic changes in the images while their background statistics have not changed much. Furthermore, the shift from the in-distribution CIFAR-10 dataset is less drastic than the OOD dataset. We also observe that the projections (i) do not change any information when  $t_i$  is too small, but (ii) generate a completely new image when  $t_i$  is too large, as shown in Figure 1a. Moreover, we observe that the single-step projection  $\pi_{\theta}^{t_i}$  outputs more blurry image than the full-step projection  $\Pi_{\theta}^{t_i}$ .
Based on these observations, we propose projection-based OOD detection scores by measuring the reconstruction error between an input  $\mathbf{x}$  and its projection with a distance metric  $d(\cdot ,\cdot)$ :
$$
S _ {\pi} ^ {d} (\mathbf {x}, t; \boldsymbol {\theta}) := \mathbb {E} _ {\mathbf {z} \sim \mathcal {N} (\mathbf {0}, \mathbf {I})} \left[ d \left(\mathbf {x}, \pi_ {\boldsymbol {\theta}} ^ {t} (\mathbf {x}, \mathbf {z})\right) \right], \quad S _ {\Pi} ^ {d} (\mathbf {x}, t; \boldsymbol {\theta}) := \mathbb {E} _ {\mathbf {z} \sim \mathcal {N} (\mathbf {0}, \mathbf {I})} \left[ d \left(\mathbf {x}, \Pi_ {\boldsymbol {\theta}} ^ {t} (\mathbf {x}, \mathbf {z})\right) \right]. (3)
$$
For the distance  $d$ , in this paper, we use the common metrics in computer vision: the  $\ell_2$  distance and the perceptual distance, LPIPS [20]. One may expect that the latter is fit for our setup since it focuses on semantic changes more than background changes. Other choices are also studied in Section 4.3.
We report the AUROC on the CIFAR-10 vs (CIFAR-100 or SVHN) tasks in Figure 3. As expected, the perceptual distance is better than the  $\ell_2$  distance when  $t_i$  is not too small. Our proposed metric,  $S_{\Pi}^{\mathrm{LPIPS}}$  shows the best performance in the intermediate time step and this even exceeds the performance of diffusion-model-based OOD detection methods [17, 18] in the CIFAR-10 vs CIFAR-100 task. Furthermore, the performance of  $S_{\pi}^{\mathrm{LPIPS}}$  degrades in larger time step due to the blurry output of the diffusion model  $D_{\theta}$ . On the other hand,  $S_{\Pi}^{\ell_2}$  and  $S_{\pi}^{\ell_2}$  consistently struggle to detect the CIFAR-100 dataset and even output smaller abnormality scores on the SVHN dataset.
3.2 Projection Regret
While the perceptual distance performs better than the  $\ell_2$  distance, it may fail to capture the semantic change when background information is dominant. For example, we refer to Figure 1b for the failure case of  $S_{\Pi}^{\mathrm{LPIPS}}$ . While the projection of the OOD (i.e., bridge) data shows in-distribution (i.e., church) semantics, the area of the changed region is relatively small. Hence,  $S_{\Pi}^{\mathrm{LPIPS}}$  outputs a lower detection score for the OOD data than the in-distribution data.
To reduce such a background bias, we propose Projection Regret, a novel and effective detection method using recursive projections inspired by the observations in Section 3.1: (i) a projected image  $\mathbf{x}' = \Pi_{\boldsymbol{\theta}}^{t_{\alpha}}(\mathbf{x})$  can be considered as an in-distribution image with a similar background to the original image  $\mathbf{x}$ , and (ii) its recursive projection  $\Pi_{\boldsymbol{\theta}}^{t_{\beta}}(\mathbf{x}')$  may not change semantic information much because of (i). Therefore, the change in background statistics from  $\mathbf{x}$  to  $\Pi_{\boldsymbol{\theta}}^{t_{\beta}}(\mathbf{x})$  would be similar to that from  $\mathbf{x}'$  to  $\Pi_{\boldsymbol{\theta}}^{t_{\beta}}(\mathbf{x}')$ , in other words,  $d(\mathbf{x}, \Pi_{\boldsymbol{\theta}}^{t_{\beta}}(\mathbf{x})) \approx$  semantic difference  $+ d(\mathbf{x}', \Pi_{\boldsymbol{\theta}}^{t_{\beta}}(\mathbf{x}'))$ .
Based on this insight, we design our Projection Regret score,  $S_{\mathrm{PR}}$ , as follows:
$$
S _ {\mathbb {P R}} (\mathbf {x}, \alpha , \beta ; \boldsymbol {\theta}) = S _ {\Pi} ^ {d} (\mathbf {x}, t _ {\beta}; \boldsymbol {\theta}) - \mathbb {E} _ {\mathbf {z} \sim \mathcal {N} (\mathbf {0}, \mathbf {I})} \left[ S _ {\Pi} ^ {d} \left(\Pi_ {\boldsymbol {\theta}} ^ {t _ {\alpha}} (\mathbf {x}, \mathbf {z}), t _ {\beta}; \boldsymbol {\theta}\right) \right], \tag {4}
$$
where  $\alpha$  and  $\beta$  are timestep hyperparameters. We mainly use LPIPS [20] for the distance metric  $d$ . It is worth noting that Projection Regret is a plug-and-play module: any pre-trained diffusion model  $\theta$  and any distance metric  $d$  can be used without extra training and information. The overall framework is illustrated in Figure 1b and this can be efficiently implemented by the consistency model  $f_{\theta}$  and batch-wise computation as described in Algorithm 1.
**Ensemble.** It is always challenging to select the best hyperparameters for the OOD detection task since we do not know the OOD information in advance. Furthermore, they may vary across different OOD datasets. To tackle this issue, we also suggest using an ensemble approach with multiple timestep pairs. Specifically, given a candidate set of pairs  $\mathcal{C} = \{(\alpha_i, \beta_i)\}_{i=1}^{|\mathcal{C}|}$ , we use the sum of all scores, i.e.,  $S_{\mathrm{PR}}(\mathbf{x}; \boldsymbol{\theta}) = \sum_{(\alpha, \beta) \in \mathcal{C}} S_{\mathrm{PR}}(\mathbf{x}, \alpha, \beta; \boldsymbol{\theta})$ , in our main experiments (Section 4.2) with a roughly selected  $\mathcal{C}$ .<sup>1</sup> We discuss the effect of each component in Section 4.3.
In this section, we evaluate the out-of-distribution (OOD) detection performance of our Projection Regret. We first describe our experimental setups, including benchmarks, baselines, and implementation details of Projection Regret (Section 4.1). We then present our main results on the benchmarks (Section 4.2) and finally show ablation experiments of our design choices (Section 4.3).
We follow the standard OOD detection setup [33, 34, 35]. We provide further details in the Appendix.
Datasets. We examine Projection Regret under extensive in-distribution (ID) vs out-of-distribution (OOD) evaluation tasks. We use CIFAR-10/100 [30] and SVHN [31] for ID datasets, and CIFAR-10/100, SVHN, LSUN [36], ImageNet [37], Textures [38], and Interpolated CIFAR-10 [19] for OOD datasets. Note that CIFAR-10, CIFAR-100, LSUN, and ImageNet have similar background information [39], so it is challenging to differentiate one from the other (e.g., CIFAR-10 vs ImageNet). Following Tack et al. [39], we remove the artificial noise present in the resized LSUN and ImageNet
<sup>1</sup>We first search the best hyperparameter that detects rotated in-distribution data as OODs [32]. Then, we set  $\mathcal{C}$  around the found hyperparameter.
Table 1: Out-of-distribution detection performance (AUROC) under various in-distribution vs out-of-distribution tasks. Bold and underline denotes the best and second best methods.
Method	C10 vs	C100 vs	SVHN vs
SVHN	CIFAR100	LSUN	ImageNet	SVHN	C10	LSUN	C10	C100
Diffusion Models [26, 28]
Input Likelihood [6]	0.180	0.520	-	-	0.193	0.495	-	0.974	0.970
Input Complexity [7]	0.870	0.568	-	-	0.792	0.468	-	0.973	0.976
Likelihood Regret [8]	0.904	0.546	-	-	0.896	0.484	-	0.805	0.821
MSMA [17]	0.992	0.579	0.587	0.716	0.974	0.426	0.400	0.976	0.979
LMD [18]	0.992	0.607	-	-	0.985	0.568	-	0.914	0.876
Consistency Models [21]
MSMA [17]	0.707	0.570	0.605	0.578	0.643	0.506	0.559	0.985	0.981
LMD [18]	0.979	0.620	0.734	0.686	0.968	0.573	0.678	0.832	0.792
Projection Regret (ours)	0.993	0.775	0.837	0.814	0.945	0.577	0.682	0.995	0.993
Table 2: Out-of-distribution detection performance (AUROC) of Projection Regret against various generative models. Bold and underline denotes the best and second best methods.
Method	Category	SVHN	CIFAR100	CF10 Interp.	Textures	Avg Rank.
PixelCNN++ [48]	Autoregressive	0.32	0.63	0.71	0.33	4.25
GLOW [42]	Flow-based	0.24	0.55	0.51	0.27	7.25
NVAE [25]	VAE	0.42	0.56	0.64	-	6.33
IGEBM [19]	EBM	0.63	0.50	0.70	0.48	5.25
VAEBM [23]	VAE + EBM	0.83	0.62	0.70	-	4.33
Improved CD [22]	EBM	0.91	0.83	0.65	0.88	3.25
CLEL [24]	EBM	0.98	0.71	0.72	0.94	2
Projection Regret (ours)	Diffusion model	0.99	0.78	0.80	0.91	1.5
datasets. We also remove overlapping categories from the OOD datasets for each task. We also apply Projection Regret in a one-class classification benchmark on the CIFAR-10 dataset. In this benchmark, we construct 10 subtasks where each single class in the corresponding subtask are chosen as in-distribution data and rest of the classes are selected as outlier distribution data. Finally, we also test Projection Regret in ColoredMNIST [40] benchmark where classifiers are biased towards spurious background information. All images are  $32 \times 32$ .
Baselines. We compare Projection Regret against various generative-model-based OOD detection methods. For the diffusion-model-based baselines, we compare Projection Regret against MSMA [17] and LMD [18]. We refer to Section 5 for further explanation. We implement  $\mathrm{MSMA}^2$  in the original NCSN and implement LMD in the consistency model. Furthermore, we experiment with the ablation of MSMA that compares  $\ell_2$  distance between the input and its full-step projection instead of the single-step projection. Since likelihood evaluation is available in Score-SDE [28], we also compare Projection Regret with input likelihood [6], input complexity [7], and likelihood-regret [8] from the results of [18]. Finally, we compare Projection Regret with OOD detection methods that are based on alternative generative models, including VAE [41], GLOW [42], and energy-based models (EBMs) [19, 23, 22, 24]. Finally, for one-class classification, various reconstruction and generative model-based methods are included for reference (e.g. [43, 44, 45, 46]).