SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table C.4: Detailed results of ImageNet OOD detection, adversarial example detection and misclassification experiments, reporting AUROC, AUPR and FPR@TPR=95% for individual splits.
OOD dataset / task	Method	Split	↑ AUPR	↑ AUROC	↓ FPR@TPR=95%
ImageNet-O	Reference	I	0.615	0.629	0.952
II	0.600	0.622	0.953
III	0.613	0.628	0.954
I	0.671	0.682	0.855
cSG-HMC	II	0.661	0.671	0.876
III	0.674	0.679	0.872
I	0.684	0.681	0.975
MC dropout	II	0.675	0.677	0.974
III	0.689	0.681	0.972
I	0.573	0.557	0.920
Deep Ensembles (LL)	II	0.566	0.562	0.916
III	0.573	0.566	0.928
I	0.679	0.713	0.779
Deep Ensembles (all)	II	0.667	0.703	0.787
III	0.674	0.710	0.786
I	0.729	0.758	0.766
QUAM	II	0.713	0.740	0.786
III	0.734	0.761	0.764
ImageNet-A	Reference	I	0.779	0.795	0.837
II	0.774	0.791	0.838
III	0.771	0.790	0.844
I	0.800	0.800	0.785
cSG-HMC	II	0.803	0.800	0.785
III	0.799	0.798	0.783
I	0.835	0.828	0.748
MC dropout	II	0.832	0.828	0.740
III	0.826	0.825	0.740
I	0.724	0.687	0.844
Deep Ensembles (LL)	II	0.723	0.685	0.840
III	0.721	0.686	0.838
I	0.824	0.870	0.385
Deep Ensembles (all)	II	0.837	0.877	0.374
III	0.832	0.875	0.375
I	0.859	0.875	0.470
QUAM	II	0.856	0.872	0.466
III	0.850	0.870	0.461
Misclassification	Reference	I	0.623	0.863	0.590
II	0.627	0.875	0.554
III	0.628	0.864	0.595
I	0.478	0.779	0.755
cSG-HMC	II	0.483	0.779	0.752
III	0.458	0.759	0.780
I	0.514	0.788	0.719
MC dropout	II	0.500	0.812	0.704
III	0.491	0.788	0.703
I	0.452	0.665	0.824
Deep Ensembles (LL)	II	0.421	0.657	0.816
III	0.425	0.647	0.815
I	0.282	0.770	0.663
Deep Ensembles (all)	II	0.308	0.784	0.650
III	0.310	0.786	0.617
I	0.644	0.901	0.451
QUAM	II	0.668	0.914	0.305
III	0.639	0.898	0.399
Figure C.7: ImageNet: Histograms of uncertainty scores calculated for test set samples of the specified datasets.
(a) OOD detection
(b) Adversarial example detection
(c) Misclassification
(d) Selective prediction
Figure C.8: ImageNet-1K OOD detection results on ImageNet-O, adversarial example detection results on ImageNet-A, misclassification detection and selective prediction results on the validation dataset. ROC curves using the epistemic uncertainty of a given, pre-selected model (as in Eq. (2)) to distinguish between (a) the ImageNet-1K validation dataset and ImageNet-O, (b) the ImageNet-1K validation dataset and ImageNet-A and (c) the reference model's correctly and incorrectly classified samples. (d) Accuracy of reference model on subset composed of samples that exhibit lowest epistemic uncertainty.
C.5 Comparing Mechanistic Similarity of Deep Ensembles vs. Adversarial Models
The experiments were performed on MNIST, EMNIST, and KMNIST test datasets, using 512 images of each using Deep Ensembles, and the reference model  $\pmb{w}$ , trained on MNIST. Results are depicted in Fig. C.9. For each image and each ensemble member, gradients were integrated over 64 steps from 64 different random normal sampled baselines for extra robustness [Sundararajan et al., 2017]. Since the procedure was also performed on the OOD sets as well as our general focus on uncertainty estimation, no true labels were used for the gradient computation. Instead, predictions of ensemble members for which the attributions were computed were used as targets. Principal Component Analysis (PCA) was performed for the attributions of each image separately, where for each pixel the attributions from different ensemble members were treated as features. The ratios of explained variance, which are normalized to sum up to one, are collected from each component. If all ensemble members would utilize mutually exclusive features for their prediction, all components would be weighted equally, leading to a straight line in the plots in the top row in Fig. C.9. Comparatively high values of the first principal component to the other components in the top row plots in Fig. C.9 indicate low diversity in features used by Deep Ensembles.
The procedure was performed similarly for an ensemble of adversarial models. The main difference was that for each image an ensemble produced as a result of an adversarial model search on that specific image was used. We observe, that ensembles of adversarial models utilize more dissimilar features, indicated by the decreased variance contribution of the first principal component. This is especially strong for ID data, but also noticeable for OOD data.
C.6 Prediction Space Similarity of Deep Ensembles and Adversarial Models
In the following, ensembles members and adversarial models are analyzed in prediction space. We used the same Deep Ensembles as the one trained on MNIST for the OOD detection task described in Sec. C.4.1. Also, 10 adversarial models were retrieved from the reference model  $\mathbf{w}$  and a single OOD sample (KMNIST), following the same procedure as described in Sec. C.4.1.
For the analysis, PCA was applied to the flattened softmax output vectors of each of the 20 models applied to ID validation data. The resulting points represent the variance of the model's predictions across different principal components [Fort et al., 2019]. The results in Fig. C.10 show, that the convex hull of blue points representing adversarial models, in general, is much bigger than the convex hull of orange points representing ensemble members across the first four principal components, which explain  $99.99\%$  of the variance in prediction space. This implies that even though adversarial models achieve similar accuracy as Deep Ensembles on the validation set, they are capable of capturing more diversity in prediction space.
C.7 Computational Expenses
Experiments on Synthetic Datasets The example in Sec. C.2 was computed within half an hour on a GTX 1080 Ti. Experiments on synthetic datasets shown in Sec. C.3 were also performed on a single GTX 1080 Ti. Note that the HMC baseline took approximately 14 hours on 36 CPU cores for the classification task. All other methods except QUAM finish within minutes. QUAM scales with the number of test samples. Under the utilized parameters and 6400 test samples, QUAM computation took approximately 6 hours on a single GPU and under one hour for the regression task, where the number of test points is much smaller.
Experiments on Vision Datasets Computational Requirements for the vision domain experiments depend a lot on the exact utilization of the baseline methods. While Deep Ensembles can take a long time to train, depending on the ensemble size, we utilized either pre-trained networks for assembling or only trained last layers, which significantly reduces the runtime. Noteworthy, MC-dropout can result in extremely high runtimes depending on the number of forward passes and depending on the realizable batch size for inputs. The same holds for SG-HMC. Executing the QUAM experiments on MNIST (Sec. C.4.1) took a grand total of around 120 GPU-hours on a variety of mostly older generation and low-power GPUs (P40, Titan V, T4), corresponding to roughly 4 GPU-seconds per sample. Executing the experiments on ImageNet (Sec. C.4.2) took about 100 GPU-hours on a mix of A100 and A40 GPUs, corresponding to around 45 GPU-seconds per sample. The experiments presented in Sec.C.5 and C.6 took around 2 hours each on 4 GTX 1080 Ti.
Figure C.9: The differences between significant component distribution are marginal on OOD data but pronounced on the ID data. The ID data would be subject to optimization by gradient descent during training, therefore the features are learned greedily and models are similar to each other mechanistically. We observe, that the members of Deep Ensembles show higher mechanistic similarity than the members of ensembles obtained from adversarial model search.
PC2
Figure C.10: Convex hull of the down-projected softmax output from 10 Ensemble Members (orange) as well as 10 adversarial models (blue). PCA is used for down-projection, all combinations of the first four principal components (99.99% variance explained) are plotted against each other. Softmax outputs are obtained on a batch of 10 random samples from the ID validation dataset. The black cross marks the given, pre-selected model  $w$ .