Forte : Finding Outliers with Representation Typicality Estimation

## Abstract

Abstract Generative models can now produce photorealistic synthetic data which is virtually indistinguishable from the real data used to train it. This is a significant evolution over previous models which could produce reasonable facsimiles of the training data, but ones which could be visually distinguished from the training data by human evaluation. Recent work on OOD detection has raised doubts that generative model likelihoods are optimal OOD detectors due to issues involving likelihood misestimation, entropy in the generative process, and typicality. We speculate that generative OOD detectors also failed because their models focused on the pixels rather than the semantic content of the data, leading to failures in near-OOD cases where the pixels may be similar but the information content is significantly different. We hypothesize that estimating typical sets using self-supervised learners leads to better OOD detectors. We introduce a novel approach that leverages representation learning, and informative summary statistics based on manifold estimation, to address all of the aforementioned issues. Our method outperforms other unsupervised approaches and achieves state-of-the art performance on well-established challenging benchmarks, and new synthetic data detection tasks.

## 1 Introduction

In the past decade, deep learning has made significant strides, primarily due to the availability of large-scale annotated datasets (Deng et al., ) used in supervised learning and the emergence of self-supervised learning utilizing vast web-scale crawled open data (Schuhmann et al., ; Gao et al., ; Sharma et al., ; Radford et al., ). The transition from large-scale annotated datasets to self-supervised learning was driven by the expensive and labor-intensive nature of creating these datasets and yet the concerns surrounding data usage rights persist (He et al., ; Carlini et al., ; Huang et al., ). Recent advancements have led to the development of generative models that excel in generating highly realistic and detailed synthetic images (Stein et al., ). In this paper, we investigate identifying out-of-distribution (OOD) data and generated synthetic data created using large-scale pre-trained generative models, commonly referred to as “foundation models”(Bommasani et al., ).

Broadly speaking, data encountered during deployment that was not sampled from the distribution used to generate training data is considered OOD. OOD data represents a challenge to safe deployment of predictive models because they can make confident incorrect predictions, leading to actions which could have negative outcomes. Foundation models complicate the traditional definition of OOD slightly. These models are trained on extensive and diverse datasets, making the data generating process, and thus possible OOD inputs difficult to specify cleanly. Despite its diversity, the data generating process only samples a small portion of the input space, leaving many potential subspaces open for OOD contamination. This contamination can erode the calibration of predictive models trained using the foundation model as a base, representing a significant hazard for safe model deployment.

Predictive model failures due to OOD inputs can be understood through the lens of typicality. The concept of typicality arises from information theory and codifies the difference between likelihood from a generative process, and the probability of generating a sample from that process with a particular likelihood. In low dimensions these two are generally equivalent, but this is often not the case in high dimensions (Nalisnick et al., ; Choi et al., ). The asymptotic equipartition property asserts that most of the probability mass of a distribution is contained in the region of high typicality, referred to as the "typical set" of a distribution (Cover, ). Thus, OOD inputs confound predictive models because the model has no incentive to make calibrated predictions on this data, since any errors in the predictive model for OOD inputs do not contribute to the risk to the hypothesized model, which is being minimized via training. At the same time, the atypicality of OOD data presents a potential way to identify them (Nalisnick et al., ; Morningstar et al., ), and thus avoid making risky predictions.

Measuring typicality directly is challenging because one cannot typically query the probability of an observed datum under the (unknown) data generating process. This has led many prior works to propose using generative models to approximate the process and use it to measure the probability, and therefore test the typicality of the input. However, Zhang et al. () and Caterini & Loaiza-Ganem () have pointed out challenges in this approach that arise due to likelihood misestimation, which can cause OOD inputs to have likelihoods under the generative model that are consistent with ID data.

In this paper, we present the following key contributions:

- 1.
Forte, a novel framework combining diverse representation learning techniques (CLIP, ViT-MSN, and DINOv2) for typicality estimation with non-parametric density estimator models (OCSVM, KDE, or GMM) to detect atypical samples, i.e., out-of-distribution (OOD) and synthetic images generated by foundation models. Forte requires no class labels, exposure to OOD data during training, or restrictions on the architecture of generative models.
- 2.
A set of per-point summary statistics (precision, recall, density, and coverage) that effectively capture the “probability distribution of the representations” using reference and unseen test samples in the feature space, enabling more nuanced anomaly detection.
- 3.
Extensive experiments demonstrating Forte’s superior performance compared to state-of-the-art supervised and unsupervised baselines on various OOD detection tasks, and synthetic image detection, including photorealistic images generated by advanced techniques like Stable Diffusion.
- 4.
Insights into the limitations of relying solely on statistical tests and distribution-level metrics for assessing the similarity between real and synthetic data, highlighting the effectiveness of our proposed per-point summary statistics and anomaly detection framework.

## 2 Related Works

In discriminative machine learning, the assumption that inference data mirrors the training data distribution is foundational, yet often flawed. The occurrence of out-of-distribution (OOD) inputs can lead to misleadingly confident but incorrect predictions by models, posing significant reliability and safety concerns. Large neural networks are vulnerable to adversarial perturbations (Szegedy et al., ) and poor calibration (Guo et al., ), necessitating OOD detection. OOD detection methods are either supervised, using labels and examples to calibrate models or train them to identify OOD data (Liang et al., ; Hendrycks et al., ; Meinke & Hein, ; Dhamija et al., ), or unsupervised, employing generative models to approximate the training data density $q(\mathbf{X})$ and determine prediction reliability via $q(Y|\mathbf{X})$, assuming OOD inputs have lower probability (Bishop, ).

Unsupervised OOD detection methods typically use generative models to measure the likelihood of the data. (Bishop, ) assumed low likelihood would be observed on OOD data, but this may fail in high dimensionality (Choi et al., ; Nalisnick et al., ; Hendrycks et al., ; Serrà et al., ). Fixes include using WAIC (Choi et al., ), likelihood ratios (Ren et al., ), or typicality tests (Nalisnick et al., ), but these have limitations associated with high dimensional likelihoods. Morningstar et al. () proposed the Density of States Estimator (DoSE). Inspired by principles from statistical physics, it leverages multiple summary statistics from generative models to distinguish between in-distribution and OOD data.

Supervised OOD detection leverages labeled in-distribution and/or known OOD data. Techniques include using VIB rate (Alemi et al., ), calibrating predictions with ODIN (Liang et al., ) or its generalization (Hsu et al., ), ensembling classifiers (Lakshminarayanan et al., ), training with OOD examples to encourage uniform confidence (Hendrycks et al., ), adversarial attacks to lower confidence near training data (Stutz et al., ), visual concept networks to model human understandable features in graphs (Ganguly et al., ) and fitting Gaussian mixtures to latent representations (Meinke & Hein, ). While effective, these methods require labels or specific outliers.

Data augmentation using generative models, particularly diffusion models, has shown promise in improving model performance and generalization. Methods include using pretrained models to generate variations of existing data (Luzi et al., ; Sariyildiz et al., ), fine-tuning models on specific subjects or concepts (Gal et al., ; ; Kawar et al., ), and generating synthetic datasets for downstream tasks (Shipard et al., ; Roy et al., ; Packhäuser et al., ; Ghalebikesabi et al., ; Zhang et al., ; Trabucco et al., ; Karras et al., ; Bansal & Grover, ; Akrout et al., ). Other notable examples include TransMix Chen et al. () and MixPro Zhao et al. (), which have demonstrated strong performance on the ImageNet classification task, However, the effectiveness of these methods is lower compared to traditional data augmentation and retrieval baselines (Zietlow et al., ; Azizi et al., ; Burg et al., ). Potential biases introduced by synthetic data and the need to detect out-of-distribution generated samples should be considered when employing these techniques.

The concept of score-based likelihood maximization is fundamental to diffusion models, inherently guiding the reverse generation process towards maximizing the likelihood. This maximization process likely pushes the generated images closer to the dominant modes of the distribution Song et al. (); Song & Ermon (), which has been discussed but has not been explicitly demonstrated as a failure mode by Yamaguchi & Fukuda ().

Generative model assessment can be done over four categories as shown by Stein et al. (): ranking, fidelity, diversity, and memorization. Ranking metrics include FD (Heusel et al., ), which measures the Wasserstein-2 distance between real and generated distributions; FD∞ (Chong & Forsyth, ), which removes bias due to finite sample size; sFID (Nash et al., ), which uses a spatial representation; KD (Bińkowski et al., ), a proper distance between distributions; IS (Salimans et al., ), which evaluates label entropy and distribution; and FLS (Jiralerspong et al., ), a density estimation method. Fidelity and diversity are measured using precision, recall (Sajjadi et al., ; Kynkäänniemi et al., ), density, coverage (Naeem et al., ), rarity score (Han et al., ), and Vendi score (Friedman & Dieng, ), which quantify the quality and variety of generated samples. Memorization is quantified using AuthPct (Alaa et al., ), $C_{T}$ score (Meehan et al., ), FLS-POG (Jiralerspong et al., ), and memorization ratio with calibrated $l_{2}$ distance (Somepalli et al., ), which detect overfitting and copying of training data. These metrics can be computed in various supervised (including Inception-V3 (Szegedy et al., )) and self-supervised representation spaces, including self-supervised model families like contrastive (SimCLRv2 Chen et al. ()), self-distillation (DINOv2 Oquab et al. ()), canonical correlation analysis (SwAV Caron et al. ()), masked image modelling (MAE He et al. (), data2vec Baevski et al. ()), DreamSim Fu et al. (), and language-image (CLIP Radford et al. (), sometimes using the OpenCLIP implementation Ilharco et al. () trained on DataComp-1B Gadre et al. ()).

Figure: Figure 1: Visualization of Precision, Recall, Density, and Coverage metrics for reference and test samples in a 2D feature space, with nearest neighbour k=1. Precision is depicted by blue circles around reference samples, recall by red circles around test samples, density by teal circles around test samples, and coverage by green circles around test samples.
Refer to caption: extracted/5895131/images/prdcperpointvisualization.png

## 3 Methodology

### 3.1 Problem Setup

We start with data ${X_{i}=x}_{i}^{n}$ that comes from a true but unknown distribution $p$, where each $X_{i}$ is an independent and identically distributed random variable from $p$ and each $x_{i}$ is an observation. In the context of out-of-distribution detection, we consider that the unseen data might come from a mix of the true distribution $p$ and an unknown confounding distribution $\tilde{p}$ (which can be from an OOD benchmark or synthetic data generated using a model such as Stable Diffusion). The mixed distribution is denoted by $\grave{X}\sim\alpha p(\grave{X})+(1-\alpha)\tilde{p}(\grave{X})$, where $\alpha$ is an unknown mixing parameter. Since both $\alpha$ and $\tilde{p}$ are unknown, we cannot directly obtain samples from $\tilde{p}$ or make any assumptions about $\alpha$ and $\tilde{p}$. The goal of OOD detection is to develop a decision rule to determine when the input data $\grave{X}$ is atypical.

We build on Density of States Estimation (DoSE; Morningstar et al., ), which is the SoTA unsupervised method that addresses the OOD detection problem. The first step in DoSE is to create a *summary statistic* $\boldmath{T_{n}}$ that can help evaluate new, unseen data. Some examples of $T_{n}$ are the negative log-likelihood of $X$, the $L_{2}$ distance between $X$ and the sample mean, or the maximum likelihood estimate of a joint distribution $q(Y|X,\theta_{n})$. To determine when the input data $\grave{X}$ is atypical, DoSE models the distribution of $T$ values in the training data and uses the density to score the typicality of inputs based on the measured values of their statistics. While DoSE gives a valuable mechanism by which one can determine the typicality of a particular input, it does not identify which statistics are informative. DoSE further limited its focus to likelihood-based generative models, which Caterini & Loaiza-Ganem () showed may be suboptimal for OOD detection.

### 3.2 Creating Generalized Novel Summary Statistics

We propose the following *per-point metrics*, based on previous work in manifold estimation inside representation spaces by Naeem et al. () and Kynkäänniemi et al. () for capturing different facets of the generated samples. Let $\mathds{1}(\cdot)$ be the indicator function, $S({x_{j}^{r}}{j=1}^{m})=\bigcup{j=1}^{m}B(x_{j}^{r},\mathrm{NND}_{k}(x_{j}^{r}))$, where $B(x,r)$ is a Euclidean ball centered at $x$ with radius $r$, and $\mathrm{NND}k(x_{j}^{r})$ is the distance between $x_{j}^{r}$ and its $k$-th nearest neighbor in ${x_{j}^{r}}{j=1}^{m}$, excluding itself.

- 1.
Precision per point is a binary statistic that indicates whether each test point is within the nearest neighbor distance of any reference point:
$\mathrm{precision_{pp}^{(i)}}=\mathds{1}\left(x_{i}^{g}\in S({x_{j}^{r}}{j=1}^
{m})\right).$
(1)
A high overall precision indicates that the test samples are closely aligned, and similar to the reference data distribution.
- 2.
Recall per point is computed for each test point by counting the number of reference points within its nearest neighbor distance and dividing by the total number of reference points:
$\mathrm{recall_{pp}^{(i)}}=\frac{1}{m}\sum{j=1}^{m}\mathds{1}\left(x_{j}^{r}
\in B(x_{i}^{g},\mathrm{NND}_{k}(x_{i}^{g}))\right).$
(2)
A high recall implies that the test distribution collectively covers a significant portion of the reference data distribution, i.e. that the test distribution contains diverse samples that represent the different regions of the reference data distribution.
- 3.
Density per point is computed for each test point by counting the number of reference points within its nearest neighbor distance and dividing by the product of $\mathrm{nearest}_{k}$ and the total number of reference points:
$\mathrm{density_{pp}^{(i)}}=\frac{1}{km}\sum{j=1}^{m}\mathds{1}\left(x_{j}^{r}
\in B(x_{i}^{g},\mathrm{NND}_{k}(x_{i}^{g}))\right).$
(3)
A test point with high density suggests that it is located in a region of high probability density in the reference data distribution, i.e. it captures the underlying density of the reference data. Density per point essentially measures the expected likelihood of test points against the reference manifold, providing a more informative measure than the binary precision per point.
- 4.
Coverage per point is computed for each test point by checking if its distance to the nearest reference point is less than its own nearest neighbor distance:
$\mathrm{coverage_{pp}^{(i)}}=\mathds{1}\left(\min{j=1,\dots,m}d(x_{i}^{g},x_{j
}^{r})<\mathrm{NND}_{k}(x_{i}^{g})\right).$
(4)
High coverage indicates that the test samples are well-distributed and cover the support of the reference data distribution. Coverage per point effectively improves upon the original recall metric by building manifolds around reference points, making it more robust to outliers in the test data and computationally efficient.

We extract representations from reference and test images using CLIP Radford et al. (), which learns to map images and text into a shared latent space, self-supervised models Gui et al. () like ViT-MSN Assran et al. (), which predicts similarity between masked views of the same image, and DiNo v2 Oquab et al. (), which distills knowledge from a teacher to a student network. Combining representations from these diverse models captures distinct aspects of the data via different manifolds and improves robustness of our anomaly detection approach, as we observe later in Table 3.

### 3.3 Develop Decision Rule

We use the summary statistics to develop an non-parametric density estimator as an anomaly detection model. First, we generate feature vectors for the reference data using self-supervised learning methods. We split the data into three parts: one-third for held-out testing, one-third as the reference distribution, and one-third as a test distribution that is drawn from the reference distribution. We calculate summary statistics for the second and third to understand what these statistics look like when the test data matches the real data (i.e. $P\overset{d}{=}Q$). We train One-Class SVM (Schölkopf et al., ), Gaussian Kernel Density Estimation (Parzen, ), and Gaussian Mixture Model (Reynolds et al., ) on the reference summary statistics. These models learn a decision boundary enclosing the typical set of the reference data distribution. We then test the models’ ability to distinguish between a mix of held-out test and reference features by comparing their atypicality i.e. summary statistics to the reference distribution. By evaluating the models’ performance on the test set, we assess their effectiveness in detecting OOD samples and distinguishing real from synthetic data distributions.

To assess the performance of the anomaly detection models, using an unseen part of the training real distribution and the generated data distribution, we use Area Under the Receiver Operating Characteristic Curve (AUROC), which measures the ability of the model to discriminate between normal and anomalous points across different decision thresholds, and False Positive Rate at 95% True Positive Rate (FPR@95) which indicates the proportion of normal points incorrectly identified as anomalies when the model correctly identifies 95% of the true anomalies.

Under certain theoretical assumptions, we can justify the effectiveness of our per-point metrics in distinguishing between in-distribution (ID) and out-of-distribution (OOD) data. Specifically, if the reference data $\{x_{j}^{r}\}_{j=1}^{m}$ and the test data $\{x_{i}^{g}\}_{i=1}^{n}$ are drawn from Gaussian distributions with the same covariance but different means (with a significant mean difference), the expected values of these metrics differ markedly between ID and OOD samples. For ID data, the expected per-point precision and coverage approximate $1-e^{-k}$, the expected per-point recall is roughly $k/m$, and the expected per-point density is close to 1. In contrast, for OOD data, these expected values are near zero due to the large mean difference, which causes the test samples to fall outside the typical regions of the reference distribution. This substantial disparity provides a strong theoretical foundation for using these metrics as effective summary statistics for OOD detection. By computing these metrics for test samples and comparing them to the expected ID values, we can effectively identify anomalous data points. A detailed proof and further explanations are provided in the Appendix C.

### 3.4 Baseline Performance for OOD

Unsupervised Baselines : We train an ensemble of deep generative models on in-distribution data, validate on a heldout set to ensure no memorization, and compute DoSE scores on in-distribution and OOD test sets. We measure OOD identification performance and compare against several unsupervised baselines: single-sided threshold (Bishop, ), single-sample typicality test (TT) (Nalisnick et al., ), Watanabe-Akaike Information Criterion (WAIC) (Choi et al., ), and likelihood ratio method (LLR) (Ren et al., ). Given the best demonstrated unsupervised OOD detection results were in (Morningstar et al., ), we stick to using Glow models (Kingma & Dhariwal, ), where we use summary statistics: log-likelihood, log-probability of the latent variable, and log-determinant of the Jacobian between input and transformed spaces.

Supervised Baselines: We also compare our approach against state-of-the-art methods in out-of-distribution (OOD) detection literature, selecting the best reported results on established benchmarks, regardless of the model architecture or techniques employed. Specifically, we consider results from NNGuide (Park et al., ), Virtual Logit Matching (Wang et al., ), and OpenOOD v1.5 (Zhang et al., ). For OpenOOD v1.5, we select the top-performing entries from the leaderboard, which utilize a Vision Transformer (ViT-B) trained with cross-entropy loss, along with Maximum Logit Score (MLS) (Hendrycks et al., ) and Relative Mahalanobis Distance Score (RMDS) (Ren et al., ) for OOD detection. To explore the potential of foundation models in OOD detection, OpenOOD also employs a linear probing of Dinov2 (Oquab et al., ) in conjunction with MLS, however performance is demonstrated to be poor.

### 3.5 Baseline Performance for Synthetic Data Distributions

Distribution Divergence: We compute pairwise distances and divergences between real and generated feature distributions. First we start with KL Divergence which measures information loss when approximating $P$ with $Q$ Kullback & Leibler (): $D_{\text{KL}}(P\parallel Q)=\sum_{x\in\mathcal{X}}P(x)\log\frac{P(x)}{Q(x)}$, and JS Divergence which is the symmetric KL divergence variant, comparing distributions with disjoint support Lin (): $D_{\text{JS}}(P\parallel Q)=\frac{1}{2}\left(D_{\text{KL}}(P\parallel M)+D_{
\text{KL}}(Q\parallel M)\right),M=\frac{1}{2}(P+Q)$. The Wasserstein Distance on the other hand gives the minimum cost to transform one distribution into the other Rubner et al. (): $W(P,Q)=\inf_{\gamma\in\Gamma(P,Q)}\mathbb{E}{(x,y)\sim\gamma}[|x-y|],\Gamma(P,Q)$: joint distributions with marginals $P,Q$, while the Bhattacharyya Distance gives the similarity between $P$ and $Q$, 0 (identical) to $\infty$ (separated) Bhattacharyya (): $D_{B}(P,Q)=-\ln\left(\sum{x\in\mathcal{X}}\sqrt{P(x)Q(x)}\right)$

CLIP-based Zero Shot Strong OOD Baseline: To establish baseline performance for detecting anomalous generated images directly from representations, we split the in-distribution reference features $X^{r}$ extracted from any of the feature extraction model (e.g. CLIP) into training $X^{r}_{\text{train}}$ and testing $X^{r}_{\text{test}}$ sets and train all the same non-parametric density estimation models with the same hyperparameter tuning, including OCCSVM, KDE and GMM. We evaluate each model on a test set consisting of representations from held-out reference images $X^{r}_{\text{test}}$ and anomalous images $X^{g}$. This provides an strong initial assessment of how well these models can distinguish between reference and anomalous data based on, for e.g. the CLIP features.

Statistical Tests: To rigorously compare the real and generated feature distributions, we perform several statistical tests. The first is the Two-sample Kolmogorov-Smirnov (KS) Test, which is a non-parametric test that compares the empirical Cumulative Distribution Functions (CDFs) of two samples. The KS statistic measures the maximum distance between the CDFs, with a corresponding p-value for the null hypothesis that the samples are drawn from the same distributionMassey Jr (). The Mann-Whitney U Test gives a non-parametric test for whether two independent samples are drawn from the same distribution. It is based on the ranks of the observations in the combined sampleMann & Whitney (). The Z-test compares the standardized differences between the means of two samples, assuming they are normally distributed. The Z-score measures the distance between the sample means in units of standard error Sprinthall (). Finally we also calculate the Anomaly Detection with Local Outlier Factor (LOF) and Isolation Forest (IF): These algorithms assign anomaly scores to each point based on their local density (LOF) Breunig et al. () or ease of isolation (IF) Liu et al. () relative to the real data. Higher scores indicate a generated image is anomalous.

Generative Evaluation Techniques: In line with suggestions from (Stein et al., ), we use the Fréchet distance (FD) and $FD_{\infty}$ computed with the DINOv2 encoder, instead of the inception network to tell how different the generated images are from the reference set of images. We also use, the CLIP maximum mean discrepancy (CMMD), which is a distance measure between probability distributions that presents benefits over the Fréchet distance. With an appropriate kernel, CMMD does not assume any specific distribution, unlike the Fréchet distance which assumes multivariate normal distributions.

## 4 Results

Table 1 & 2 present the performance comparison between our proposed methods (Forte+SVM, Forte+KDE, and Forte+GMM) and various state of the art supervised and unsupervised techniques for out-of-distribution (OOD) detection techniques. Our methods consistently outperform techniques across all challenging dataset pairings, demonstrating their effectiveness in detecting OOD samples without relying on labeled data.

Table: Table 1: Performance comparison between our method and established supervised SoTA methods on various out-of-distribution (OOD) detection tasks. Our method consistently achieves the best performance across a range of dataset pairings, particularly outperforming on challenging datasets like NINCO and SSB-Hard. It also excels at detecting covariate shifted ID datasets. Key configurations include ViT-B trained with Cross Entropy and the RMDS postprocessor, and DINOv2+MLS, which utilizes training with Linear Probe DINOv2 alongside the MLS postprocessor. For reliable measurements, Forte is run with 10 random seeds.

**Table 2: Comparison of performance figures between our method and various unsupervised baselines for out-of-distribution (OOD) detection tasks, demonstrating superior performance of our method across all challenging dataset pairings. For reliable measurements, Forte is run with 10 random seeds.**
| Method | In-Dist (CIFAR-10) | OOD (CIFAR-100) | OOD (Celeb-A) | OOD (SVHN) |
| --- | --- | --- | --- | --- |
| $q(X|\theta_{n})$ | AUROC | 52.00 | 91.40 | 6.50 |
| FPR95 | 91.67 | 51.10 | 100.0 |  |
| WAIC | AUROC | 53.20 | 92.80 | 14.30 |
| FPR95 | 90.16 | 46.04 | 98.83 |  |
| TT | AUROC | 54.80 | 84.80 | 87.00 |
| FPR95 | 92.06 | 74.00 | 61.28 |  |
| LLR | AUROC | 48.13 | 80.08 | 64.21 |
| FPR95 | 93.44 | 64.79 | 76.36 |  |
| DoSE | AUROC | 56.90 | 97.60 | 97.30 |
| FPR95 | 91.95 | 12.82 | 13.16 |  |
| Forte+SVM (Ours) | AUROC | 97.29 $\pm$ 00.55 | 100.00 $\pm$ 00.00 | 99.84 $\pm$ 00.05 |
| FPR95 | 09.08 $\pm$ 01.82 | 0.00 $\pm$ 00.00 | 00.00 $\pm$ 00.00 |  |
| Forte+KDE (Ours) | AUROC | 94.81 $\pm$ 01.22 | 99.75 $\pm$ 00.06 | 98.37 $\pm$ 02.07 |
| FPR95 | 18.20 $\pm$ 03.82 | 0.06 $\pm$ 00.07 | 07.53 $\pm$ 10.77 |  |
| Forte+GMM (Ours) | AUROC | 97.63 $\pm$ 00.15 | 100.00 $\pm$ 00.00 | 99.49 $\pm$ 00.48 |
| FPR95 | 09.69 $\pm$ 01.08 | 0.00 $\pm$ 00.00 | 0.00 $\pm$ 00.00 |  |

Table 3 presents an ablation study investigating the impact of incorporating multiple representation learning techniques into the Forte framework, when detecting arbitrary superclasses from the ImageNet1k hierarchy. In this challenging task example, the in-distribution data consists of various vehicle classes from the ImageNet dataset, such as Ambulance, Beach wagon, Cab, Convertible, Jeep, Limousine, Minivan, Model t, Racer, and Sportscar. The out-of-distribution data is divided into two categories: Near OOD, which includes other utility vehicle classes like fire engine, garbage truck, pickup, tow truck, trailer truck, minivan, moving van, and police van; and Far OOD, which consists of animal classes such as Egyptian cat, Persian cat, Siamese cat, Tabby cat, Tiger cat, Cougar, Lynx, Cheetah, Jaguar, Leopard, Lion, Snow leopard, and Tiger. Our method is successful in very challenging near-ood situations, and becomes more so when using multiple representations. The combination of all three techniques (CLIP, MSN, and DINOv2) achieves the best overall performance for both Far OOD detection, and comes a close second in Near OOD detection. These findings suggest that leveraging diverse SSL representation techniques within the Forte framework can capture complementary information and enhance the overall OOD detection capabilities.

**Table 3: Ablation study investigating the impact of incorporating multiple representation learning techniques for detecting arbitrary superclasses from the ImageNet1k hierarchy, using Forte+GMM.**
| In Distribution (Superclass ImageNet 2012) | Far OOD | Near OOD |  |  |
| --- | --- | --- | --- | --- |
|  | AUROC | FPR95 | AUROC | FPR95 |
| Forte (CLIP) | 99.42 | 00.04 | 88.84 | 61.04 |
| Forte (MSN) | 99.13 | 00.39 | 82.63 | 77.53 |
| Forte (DINOv2) | 99.79 | 00.03 | 86.97 | 79.25 |
| Forte (CLIP+MSN) | 99.96 | 00.02 | 90.00 | 30.77 |
| Forte (CLIP+DINOv2) | 99.98 | 00.01 | 91.35 | 26.89 |
| Forte (DINOv2+MSN) | 99.97 | 00.00 | 88.71 | 31.65 |
| Forte (all 3) | 100.00 | 00.01 | 91.17 | 28.91 |

### 4.1 Performance on Synthetic Data Detection

To generate synthetic data for assessing distributional robustness, we first employ the Stable Diffusion Img2Img setting (Rombach et al., ), where a diffusion-based model can generate new images conditioned on an input image and a text prompt. We use the Stable Diffusion 2.0 base model and generate images with varying strength parameters (0.3, 0.5, 0.7, 0.9, 1.0) to control the influence of the input image on the generated output, essentially allowing our real distribution to be prior of controllable strength for the generated distribution. We also use the Stable Diffusion 2.0 text-to-image model to generate new images conditioned on the captions generated by BLIP(Li et al., ) for each real image from the reference distribution. This allows us to create images that are semantically similar to the real images but with novel compositions and variations. Finally, we also generate images directly from the class name associated with each real image (e.g., "a photo of a {monarch butterfly}, in a natural setting"). This provides a baseline for generating images that capture the essential characteristics of the class without relying on specific input images or captions. The image generation pipeline is implemented using the Hugging Face Transformers (Wolf et al., ) and Diffusers (von Platen et al., ) libraries, which provide high-level APIs for working with pre-trained models. Examples can be found in Figure 2 Figure 3 Figure 4

Fréchet Distance (FD), $FD_{\infty}$, and CMMD scores provide insights into the distribution shift between real and synthetic images, with generated images moving further away from the real distribution as diffusion strength increases. However, these distribution-level statistics do not provide information about individual images within the distribution, necessitating an OOD detection strategy.
Tables 4 & B compare the performance of Forte+GMM against a strong CLIP-based baseline on the Golden Retriever and Volleyball classes from ImageNet. For the well-represented Golden Retriever class, Forte+GMM consistently outperforms the baseline across all image generation settings, achieving near-perfect AUROC scores and low FPR95 values for Img2Img with strength parameters 0.9 and 1.0, Caption-based, and Class-based image generation. Lower performance at lower strengths is due to images being too similar to the real distribution. The Volleyball class, part of Hard ImageNet (Moayeri et al., ), focuses on classes with strong spurious cues. Volleyballs rarely occur alone in ImageNet images, and generating images without appropriate priors results in mode collapse (see Figure 4). Forte+GMM surpasses the CLIP-based baseline in all image generation scenarios, with notable improvements for Img2Img with higher strength parameters, Caption-based, and Class-based image generation (AUROC scores > 97%, FPR95 values < 6%).

**Table 4: Performance comparison of Forte+GMM against a CLIP-based baseline, and Gen Eval methods for detecting synthetic images of Golden Retrievers generated using various techniques.**
|  | FD | $FD_{\infty}$ | CMMD Score | Baseline Model CLIP | Forte+GMM |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  | AUROC | FPR95 | AUROC | FPR95 |
| Img2Img S=0.3 | 453.63 | 418.22 | 0.52 | 61.19 | 86.27 | 68.28 $\pm$ 02.14 | 68.07 $\pm$ 05.56 |
| Img2Img S=0.5 | 648.97 | 624.01 | 0.64 | 59.49 | 86.27 | 82.93 $\pm$ 02.50 | 46.80 $\pm$ 10.68 |
| Img2Img S=0.7 | 762.17 | 735.42 | 0.64 | 61.23 | 86.36 | 94.19 $\pm$ 01.85 | 24.90 $\pm$ 12.99 |
| Img2Img S=0.9 | 845.96 | 819.06 | 0.66 | 59.05 | 88.87 | 97.59 $\pm$ 01.23 | 14.41 $\pm$ 13.55 |
| Img2Img S=1.0 | 891.39 | 870.17 | 0.73 | 60.15 | 89.23 | 98.11 $\pm$ 00.75 | 06.09 $\pm$ 05.72 |
| Caption-based | 575.18 | 546.42 | 0.90 | 80.71 | 71.54 | 96.77 $\pm$ 01.14 | 18.90 $\pm$ 14.38 |
| Class-based | 1,065.96 | 1,048.18 | 1.07 | 75.73 | 82.23 | 98.26 $\pm$ 01.12 | 10.22 $\pm$ 13.04 |

Tables B & B compare various statistical measures for assessing the similarity between distributions of real and generated images across different image generation methods. The results are shown for the Golden Retriever and Volleyball classes. For both classes, the statistical tests fail to provide clear and consistent indications of distributional differences between real and generated images. Z-scores are close to zero, suggesting no significant difference in means, while K-S test and Mann-Whitney U test p-values are inconsistent across generation methods. LOF and IF scores show limited variation and struggle to identify anomalies in the generated images. JSD, KLD, Wasserstein distance, and Mahalanobis distance do not exhibit clear trends as generation strength increases, making it difficult to draw meaningful conclusions about distributional similarity. To add to this problem, JSD and KLD are not defined for any distribution of representations apart from MSN embeddings. Bhattacharya distances are not defined on any representation, indicating no overlap.
These results highlight the limitations of relying solely on statistical tests comparing representations of new points to the original distribution, as they often fail to capture subtle distributional differences between real and generated images, particularly when generated images are highly realistic. The inconsistencies and lack of clear trends underscore the need for more sophisticated approaches, such as the proposed Forte+GMM framework, which leverages diverse feature extraction techniques and anomaly detection algorithms to effectively detect synthetic images.

### 4.2 Performance on Medical Image Datasets

Magnetic resonance imaging (MRI) datasets and models present a unique challenge in a high stakes scenario, making robust out-of-distribution (OOD) detection paramount. These datasets, typically acquired under specific study protocols, suffer from batch effects that hinder model generalization even when changes in protocols are minute (Horng, ). The problem is exacerbated by dataset homogeneity within studies and limited dataset sizes in clinical applications, making it impractical to train separate models for each batch. Subtle distribution shifts between datasets of the same subject matter, though not immediately apparent to human observers, can significantly impact model performance. While data augmentation and harmonization methods have been explored (Hu et al., ), existing metrics for detecting distribution drift and assessing harmonization effectiveness are limited. Our work proposes deploying Forte as a more robust metric to address this gap by effectively differentiating between datasets that may appear similar but have crucial distributional differences. Using public datasets like FastMRI Zbontar et al. (); Knoll et al. () and the Osteoarthritis Initiative (OAI) Nevitt et al. (), we simulate realistic scenarios where models trained on one dataset (treated as in-distribution) are confronted with another (considered OOD). Table 5 demonstrates the effectiveness of Forte in differentiating the datasets. In other tests over closed-source but real-world hospital data, we observe similar near perfect performance, suggesting that Forte can have zero-shot applications in a variety of other sensitive domains.

**Table 5: Out-of-distribution (OOD) detection using Forte, applied to medical image datasets. Strong performance by Forte suggests the presence of batch effects and a need for data harmonization. Refer to Appendix D for more details on the FastMRI and OAI datasets. For reliable estimation, performance is measured over 10 random seeds.**
| Method | Metric | In-Dist: | FastMRI NoFS | FastMRI FS | FastMRI FS |
| --- | --- | --- | --- | --- | --- |
| OOD: | OAI TSE | OAI T1 | OAI MPR |  |  |
| Forte+SVM (Ours) | AUROC |  | 100.00 $\pm$ 0.00 | 100.00 $\pm$ 0.00 | 100.00 $\pm$ 0.00 |
| FPR95 |  | 00.00 $\pm$ 00.00 | 00.00 $\pm$ 00.00 | 00.00 $\pm$ 00.00 |  |
| Forte+KDE (Ours) | AUROC |  | 97.97 $\pm$ 5.63 | 95.98 $\pm$ 7.84 | 95.99 $\pm$ 7.86 |
| FPR95 |  | 9.49 $\pm$ 26.76 | 19.75 $\pm$ 39.10 | 19.77 $\pm$ 39.31 |  |
| Forte+GMM (Ours) | AUROC |  | 99.95 $\pm$ 0.13 | 99.91 $\pm$ 0.16 | 99.91 $\pm$ 0.17 |
| FPR95 |  | 0.00 $\pm$ 0.00 | 0.00 $\pm$ 0.00 | 0.00 $\pm$ 0.00 |  |

## 5 Discussion

While just using precision and density as summary statistics would lead Forte to be considered single-sample tests, recall and coverage make our framework a two-sample test, as they take into account the relationship between each synthetic image and the entire set of real images. This also allows us to better understand the behavior of the generated images in relation to the real data distribution. This is usually not a problem in production, and benchmarks, since when you check whether a sample is out of distribution, you usually sample from the mixture probability distribution of in and out of distribution, which is what we really use here. Prior work has also operated in this paradigm, i.e. two sample OOD test such as the typicality test (Nalisnick et al., ).

When selecting non-parametric density estimators to model typicality, it is important to consider the manifold properties. We observe that GMM excels with clustered data, especially with a bigger number of gaussians when operating with data from multiple possible classes, while KDE struggles with sharp density variations. OCSVM is robust to outliers and performs well in high-dimensional spaces, making it suitable for cohesive normal data.

## 6 Conclusion

Our work underscores the importance of developing robust methods for detecting out-of-distribution (OOD) data and synthetic images generated by foundation models. The proposed Forte framework combines diverse representation learning techniques, non-parametric density estimators, and novel per-point summary statistics, demonstrating far superior performance compared to state-of-the-art baselines across various OOD detection tasks and synthetic image detection tasks. The experimental results not only showcase the effectiveness of Forte but also reveal the limitations of relying solely on statistical tests and distribution-level metrics for assessing the similarity between real and synthetic data. We hope that as generative models continue to advance, strong test frameworks like Forte will play a crucial role in maintaining the reliability of ML systems by detecting deviating data, unsafe distributions, distribution shifts, and anomalous samples, ultimately contributing to the development of more robust and trustworthy AI applications in the era of foundation models.

## Appendix A Appendix: Synthetic Data Samples

Figure: Figure 2: Synthetic images generated for the class "ambulance" using various techniques. Row (a) shows real images, while rows (b) to (f) display Img2Img generated images with strength parameters 0.3, 0.5, 0.7, 0.9, and 1.0, respectively. Row (g) presents images generated using caption descriptions of the real images in row (a), and row (h) shows images generated solely based on the classname.
Refer to caption: extracted/5895131/images/ambulancesyntheticpanel.png

Figure: Figure 3: Synthetic images generated for the class "golden retriever" using different techniques. Row (a) shows real images, while rows (b) to (f) display Img2Img generated images with strength parameters 0.3, 0.5, 0.7, 0.9, and 1.0, respectively. Row (g) presents images generated using caption descriptions of the real images in row (a), and row (h) shows images generated solely based on the classname.
Refer to caption: extracted/5895131/images/goldensyntheticpanel.png

Figure: Figure 4: Synthetic images generated for the class "volleyball" using various techniques. Row (a) shows real images, while rows (b) and (c) display Img2Img generated images with strength parameters 0.3, 0.5 respectively. Row (d) presents images generated using caption descriptions of the real images in row (a), and row (e) shows images generated solely based on the classname. Row (e) exhibits mode collapse properties.
Refer to caption: extracted/5895131/images/volleyballsyntheticpanel.png

Figure: Figure 5: PCA of Golden Retriever Images in CLIP space. We can clearly observe that the distribution of real images is most diverse, whereas the "classname" based generated images are least diverse. We also see a progression of images tending towards the modes of the distribution with increasing strengths allotted to the diffusion process.
Refer to caption: extracted/5895131/images/pcagoldenretriever.png

Figure: (a) Normalized Mahalanobis Distances for generated distributions vs. real distributions, for the class "golden retriever".
Refer to caption: extracted/5895131/images/mahalanobis.png

Figure: (a) UMAP of Golden Retriever Images in CLIP space.
Refer to caption: extracted/5895131/images/umapgoldenretriever.png

## Appendix B Appendix: Baselines Statistical Tests

-3 cm-3 cm[!htb]Comparison of statistical measures for assessing distribution similarity across different
image generation methods. The table presents results for various statistical tests and metrics, including Z-score, Kolmogorov-Smirnov (K-S) test, Mann-Whitney U test, Local Outlier Factor (LOF), Isolation Forest (IF), and Wasserstein distance. The image generation methods evaluated include Img2Img with varying strength parameters (S=0.3, 0.5, 0.7, 0.9, 1.0), caption-based generation, and class-based generation for Golden Retrievers. KL Divergence and Jensen Shannon Divergence were calculated on MSN embeddings, since CLIP embeddings had no overlap.
Z-Score
K-S Test
M-W U-Test
LOF
IF
JSD (MSN)
KLD (MSN)
Wass
Mahalanobis
stat
p-val
stat
p-val
Img2Img S=0.3
-1.17e-9
4.17e-3
3.30e-4
1.27e+11
6.64e-1
31.11%
6.11%
2.75e-3
3.47e-3
5.52e-3
4.38e+1
Img2Img S=0.5
4.82e-9
4.72e-3
2.91e-5
2.76e+10
2.15e-3
27.82%
5.97%
-1.81e-3
-2.08e-3
6.49e-3
4.78e+1
Img2Img S=0.7
3.89e-9
4.20e-3
2.93e-4
1.28e+11
2.65e-2
28.67%
6.32%
2.23e-3
2.36e-3
6.16e-3
4.61e+1
Img2Img S=0.9
-4.16e-9
4.43e-3
1.09e-4
1.27e+11
9.20e-2
32.61%
6.92%
7.22e-3
1.02e-2
6.57e-3
4.22e+1
Img2Img S=1.0
7.93e-9
4.58e-3
5.49e-5
1.27e+11
3.44e-1
34.09%
7.10%
NaN
NaN
6.89e-3
4.02e+1
Caption-based
5.56e-9
1.02e-2
7.56e-23
1.29e+11
1.85e-29
31.83%
6.38%
NaN
NaN
1.39e-2
4.08e+1
Class-based
-2.98e-9
1.17e-2
5.19e-30
1.29e+11
3.26e-40
40.63%
7.73%
NaN
NaN
1.69e-2
3.43e+1

-3 cm-3 cm[!htb]Comparison of statistical measures for assessing distribution similarity across different
image generation methods using CLIP embeddings. The table presents results for various statistical tests and metrics, includ-
ing Z-score, Kolmogorov-Smirnov (K-S) test, Mann-Whitney U test, Local Outlier Factor (LOF),
Isolation Forest (IF), and Wasserstein distance. The image generation methods evaluated include
Img2Img with varying strength parameters (S=0.3, 0.5, 0.7, 0.9, 1.0), caption-based generation, and
class-based generation for the Volleyball class. KL Divergence and Jensen Shannon Divergence were calculated on MSN embeddings, since CLIP embeddings had no overlap.
Z-Score
K-S Test
M-W U-Test
LOF
IF
JSD
KLD
Wass
Mahalanobis
stat
p-val
stat
p-val
Img2Img S=0.3
2.25e-9
4.14e-3
3.47e-4
1.29e+11
1.41e-2
27.89%
4.54%
NaN
NaN
4.57e-3
4.90e+1
Img2Img S=0.5
-2.15e-9
3.62e-3
2.65e-3
1.30e+11
1.27e-1
22.98%
4.03%
-9.28e-3
-7.38e-3
5.75e-3
5.70e+1
Img2Img S=0.7
6.11e-9
7.99e-3
2.16e-14
1.30e+11
1.03e-8
20.73%
3.67%
-9.03e-3
-5.14e-3
3.30e-2
1.68e+2
Img2Img S=0.9
1.58e-8
1.13e-2
1.41e-28
1.31e+11
1.09e-16
19.06%
2.59%
NaN
NaN
1.12e-2
6.66e+1
Img2Img S=1.0
2.06e-9
1.22e-2
6.56e-33
1.31e+11
4.99e-17
19.42%
2.26%
NaN
NaN
1.23e-2
6.69e+1
Caption-based
6.77e-9
6.91e-3
7.12e-11
1.30e+11
3.46e-10
30.89%
5.27%
NaN
NaN
7.71e-3
4.51e+1
Class-based
-5.63e-9
2.65e-2
2.82e-154
1.32e+11
2.98e-85
36.54%
2.64%
NaN
NaN
2.18e-2
6.43e+1

## Appendix C Appendix : Theoretical Properties of per-point PRDC

###### Theorem C.1 .

Under the following assumptions:

- 1.
Feature Space: $\mathbb{X}=\mathbb{R}^{D}$, where $D$ is the dimensionality.
- 2.
In-Distribution (ID) Data:
•
Training Set: $X_{\text{ID}}^{\text{train}}=\{\mathbf{x}_{1},\dots,\mathbf{x}_{N_{\text{train
}}}\}$ with $\mathbf{x}_{i}\sim\mathcal{N}(\bm{\mu}_{\text{ID}},\sigma^{2}I)$.
•
Test Set: $X_{\text{ID}}^{\text{test}}=\{\mathbf{x}_{1}^{\prime},\dots,\mathbf{x}_{N_{
\text{test}}}^{\prime}\}$ with $\mathbf{x}_{i}^{\prime}\sim\mathcal{N}(\bm{\mu}_{\text{ID}},\sigma^{2}I)$.
- 3.
Out-of-Distribution (OOD) Data:
•
Test Set: $X_{\text{OOD}}=\{\mathbf{x}_{1}^{\prime\prime},\dots,\mathbf{x}_{N_{\text{OOD}
}}^{\prime\prime}\}$ with $\mathbf{x}_{i}^{\prime\prime}\sim\mathcal{N}(\bm{\mu}_{\text{OOD}},\sigma^{2}I)$, where $\Delta=\|\bm{\mu}_{\text{ID}}-\bm{\mu}_{\text{OOD}}\|\gg 0$.
- 4.
Distance Function: Euclidean distance $d(\mathbf{x},\mathbf{y})=\|\mathbf{x}-\mathbf{y}\|_{2}$.
- 5.
$k$-Nearest Neighbors: For a point $\mathbf{x}$, $\text{NN}_{k}(\mathbf{x})$ denotes its $k$-nearest neighbors in $X_{\text{ID}}^{\text{train}}$.

Using previous definitions of Per-Point PRDC Metrics:

- 1.
Precision per point ($\text{P}(\mathbf{x}^{\prime})$):
$\text{P}(\mathbf{x}^{\prime})=\mathbb{I}\left[\min_{\mathbf{x}\in X_{\text{ID}
}^{\text{train}}}d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(\mathbf{x})\right],$
where $r_{k}(\mathbf{x})$ is the distance from $\mathbf{x}$ to its $k$-th nearest neighbor in $X_{\text{ID}}^{\text{train}}$.
- 2.
Recall per point ($\text{R}(\mathbf{x}^{\prime})$):
$\text{R}(\mathbf{x}^{\prime})=\frac{1}{N_{\text{train}}}\sum_{\mathbf{x}\in X_
{\text{ID}}^{\text{train}}}\mathbb{I}\left[d(\mathbf{x}^{\prime},\mathbf{x})
\leq r_{k}(\mathbf{x})\right].$
- 3.
Density per point ($\text{D}(\mathbf{x}^{\prime})$):
$\text{D}(\mathbf{x}^{\prime})=\frac{1}{k}\sum_{\mathbf{x}\in X_{\text{ID}}^{
\text{train}}}\mathbb{I}\left[d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(
\mathbf{x})\right].$
- 4.
Coverage per point ($\text{C}(\mathbf{x}^{\prime})$):
$\text{C}(\mathbf{x}^{\prime})=\mathbb{I}\left[\min_{\mathbf{x}\in X_{\text{ID}
}^{\text{train}}}d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(\mathbf{x}^{
\prime})\right],$
where $r_{k}(\mathbf{x}^{\prime})$ is the distance from $\mathbf{x}^{\prime}$ to its $k$-th nearest neighbor in $X_{\text{ID}}^{\text{train}}$.

Then, the expected values and variances of these per-point PRDC metrics are:

- •
For ID Test Samples ($\mathbf{x}^{\prime}\in X_{\text{ID}}^{\text{test}}$):
1.
Expected Precision per point:
$\mathbb{E}[\text{P}(\mathbf{x}^{\prime})]\approx 1-e^{-k}.$
2.
Expected Recall per point:
$\mathbb{E}[\text{R}(\mathbf{x}^{\prime})]\approx\frac{k}{N_{\text{train}}}.$
3.
Expected Density per point:
$\mathbb{E}[\text{D}(\mathbf{x}^{\prime})]\approx 1.$
4.
Expected Coverage per point:
$\mathbb{E}[\text{C}(\mathbf{x}^{\prime})]\approx 1-e^{-k}.$
- •
For OOD Samples ($\mathbf{x}^{\prime\prime}\in X_{\text{OOD}}$):
1.
Expected Precision, Recall, Density, and Coverage per point are all approximately zero
- •
Variances:
1.
Precision and Coverage per point:
$\operatorname{Var}[\text{P}(\mathbf{x}^{\prime})]=\mathbb{E}[\text{P}(\mathbf{
x}^{\prime})]\left(1-\mathbb{E}[\text{P}(\mathbf{x}^{\prime})]\right).$
2.
Recall per point:
$\operatorname{Var}[\text{R}(\mathbf{x}^{\prime})]\approx\frac{\mathbb{E}[\text
{R}(\mathbf{x}^{\prime})]\left(1-\mathbb{E}[\text{R}(\mathbf{x}^{\prime})]
\right)}{N_{\text{train}}}.$
3.
Density per point
$\operatorname{Var}[\text{D}(\mathbf{x}^{\prime})]\approx\frac{\mathbb{E}[\text
{D}(\mathbf{x}^{\prime})]\left(1-\mathbb{E}[\text{D}(\mathbf{x}^{\prime})]
\right)}{k}.$

###### Proof.

Let us first clarify some assumptions and notation, specific to this proof for clarity.

- 1.
Feature Space: $\mathbb{X}=\mathbb{R}^{D}$.
- 2.
ID Data Distribution: $\mathcal{N}(\bm{\mu}_{\text{ID}},\sigma^{2}I)$.
- 3.
OOD Data Distribution: $\mathcal{N}(\bm{\mu}_{\text{OOD}},\sigma^{2}I)$, with
the mean difference $\Delta=\|\bm{\mu}_{\text{ID}}-\bm{\mu}_{\text{OOD}}\|\gg 0$.
- 4.
Sample Sizes:
(a)
$N_{\text{train}}$: Number of ID training samples.
(b)
$N_{\text{test}}$: Number of ID test samples.
(c)
$N_{\text{OOD}}$: Number of OOD samples.
- 5.
Distance Function: $d(\mathbf{x},\mathbf{y})=\|\mathbf{x}-\mathbf{y}\|_{2}$.
- 6.
$k$-Nearest Neighbor Distances:
(a)
$r_{k}(\mathbf{x})$: Distance from $\mathbf{x}$ to its $k$-th nearest neighbor in $X_{\text{ID}}^{\text{train}}$.
(b)
$r_{k}(\mathbf{x}^{\prime})$: Distance from $\mathbf{x}^{\prime}$ to its $k$-th nearest neighbor in $X_{\text{ID}}^{\text{train}}$.

Calculating Distribution of Distances

Distance Between ID Samples

Let $\mathbf{x},\mathbf{y}\sim\mathcal{N}(\bm{\mu}_{\text{ID}},\sigma^{2}I)$.
The difference $\mathbf{x}-\mathbf{y}\sim\mathcal{N}(\mathbf{0},2\sigma^{2}I)$.

The squared distance $d^{2}(\mathbf{x},\mathbf{y})$ is the sum of $D$ squared normal variables :

$$ $d^{2}(\mathbf{x},\mathbf{y})=\sum_{i=1}^{D}(x_{i}-y_{i})^{2}.$ $$

where, each $(x_{i}-y_{i})$ is $\sim\mathcal{N}(0,2\sigma^{2})$. Therefore, $\frac{d^{2}(\mathbf{x},\mathbf{y})}{2\sigma^{2}}\sim\chi^{2}_{D}$, i.e. follows a chi-squared distribution with $D$ degrees of freedom.

Expected and Variance of the Squared Distance:

$$ $\mathbb{E}[d^{2}(\mathbf{x},\mathbf{y})]=2\sigma^{2}D.$ $$

$$ $\operatorname{Var}[d^{2}(\mathbf{x},\mathbf{y})]=(2\sigma^{2})^{2}\cdot 2D=4 \sigma^{4}(2D)=8\sigma^{4}D.$ $$

Distance Between ID and OOD Samples

Let $\mathbf{x}\sim\mathcal{N}(\bm{\mu}_{\text{ID}},\sigma^{2}I)$ and $\mathbf{x}^{\prime\prime}\sim\mathcal{N}(\bm{\mu}_{\text{OOD}},\sigma^{2}I)$.

- •
The difference $\mathbf{x}-\mathbf{x}^{\prime\prime}\sim\mathcal{N}(\bm{\delta},2\sigma^{2}I)$, where $\bm{\delta}=\bm{\mu}_{\text{ID}}-\bm{\mu}_{\text{OOD}}$.
- •
The squared distance follows a non-central chi-squared distribution:
$\frac{d^{2}(\mathbf{x},\mathbf{x}^{\prime\prime})}{2\sigma^{2}}\sim\chi^{2}_{D
}\left(\lambda\right),$
where $\lambda=\frac{\|\bm{\delta}\|^{2}}{2\sigma^{2}}$.
- •
Therefore, the Expected Squared Distance of a non-central chi-squared distribution is:
$\mathbb{E}[d^{2}(\mathbf{x},\mathbf{x}^{\prime\prime})]=2\sigma^{2}(D+\lambda)
=2\sigma^{2}D+\Delta^{2}.$
- •
And the Variance of Squared Distance of a non-central chi-squared distribution is
$\operatorname{Var}[d^{2}(\mathbf{x},\mathbf{x}^{\prime\prime})]=4\sigma^{4}(2D
+4\lambda)=8\sigma^{4}D+16\sigma^{4}\lambda.$

Expected $k$-Nearest Neighbor Distance $r_{k}(\mathbf{x})$

- •
Distances from $\mathbf{x}$ to other training samples are i.i.d. and follow the distribution of $d(\mathbf{x},\mathbf{y})$ as previously defined.
- •
Empirical CDF of Distances:
$F(d)=P\left(d(\mathbf{x},\mathbf{y})\leq d\right).$
- •
Expected $k$-th Nearest Neighbor Distance:
1.
For large $D$ (number of dimensions in the vector), the chi-squared distribution can be approximated by a normal distribution:
$\chi^{2}_{D}\approx\mathcal{N}\left(D,2D\right).$
2.
This yields standard normal statistic
$\dfrac{\frac{d^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}\sim\mathcal{N}(0,1)$
3.
Since p-value of a test statistic follows a standard uniform distribution under the null hypothesis:
$\Phi\left(\dfrac{\frac{d^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}\right)\sim u(0,1)$
4.
If $f$ is a monotonically increasing function of variable $X$ whose $k$th order statistic in a sample of size $n$ is $X_{(k)}$, then the $k$th order statistic of $f(X)$ is $f(X_{(k)})$ when $X$ is taken from the sample. Note that $\Phi$ is monotonically increasing as it is a CDF, and so is $f(X)=\dfrac{\frac{X^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}$ on the positive reals which are the domain of $r_{k}(\mathbf{x})$.
5.
By definition $d_{(k)}=r_{k}(\mathbf{x})$ for some $\mathbf{x}$. Then if $U=\Phi\left(\dfrac{\frac{d^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}\right)$ is a standard uniform, its $k$th order statistic in the sample is
$U_{(k)}=\Phi\left(\dfrac{\frac{(r_{k}(\mathbf{x}))^{2}}{2\sigma^{2}}-D}{\sqrt{
2D}}\right)$
6.
The $k$th order statistic of a standard uniform follows a Beta distribution with $\alpha=k$ and $\beta=n-k+1$:
$\Phi\left(\dfrac{\frac{(r_{k}(\mathbf{x}))^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}
\right)\sim\text{Beta}(k,n-k+1)$
7.
Because the expected value of a Beta distribution is $\frac{\alpha}{\alpha+\beta}$:
$\mathbb{E}\left[\Phi\left(\dfrac{\frac{(r_{k}(\mathbf{x}))^{2}}{2\sigma^{2}}-D
}{\sqrt{2D}}\right)\right]=\frac{k}{n+1}$

Expected PRDC Metrics for ID Samples

Expected Precision per point ($\mathbb{E}[\text{P}(\mathbf{x}^{\prime})]$)

- •
Definition:
$\mathbb{E}[\text{P}(\mathbf{x}^{\prime})]=\mathbb{E}[\min_{\mathbf{x}\in
\mathbf{X^{\text{train}}_{\text{ID}}}}P\left(d(\mathbf{x}^{\prime},\mathbf{x})
\leq r_{k}(\mathbf{x})\right)]=1-\prod_{\mathbf{x}\in X_{\text{ID}}^{\text{
train}}}\left(1-\mathbb{E}[P\left(d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(
\mathbf{x})\right)]\right).$
- •
Also:
$P\left(d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(\mathbf{x})\right)]=P\left(
\dfrac{\frac{d(\mathbf{x}^{\prime},\mathbf{x})^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}
\leq\dfrac{\frac{(r_{k}(\mathbf{x}))^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}\right)=
\Phi\left(\dfrac{\frac{(r_{k}(\mathbf{x}))^{2}}{2\sigma^{2}}-D}{\sqrt{2D}}\right)$
- •
Probability for a Single Training Sample, using the above Beta distribution formula, is
$\mathbb{E}\left[P\left(d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(\mathbf{x})
\right)\right]=\mathbb{E}\left[\Phi\left(\dfrac{\frac{r_{k}^{2}(x)}{2\sigma^{2
}}-D}{\sqrt{2D}}\right)\right]=\dfrac{k}{N_{\text{train}}+1}$
- •
Expected Precision per point:
Because we are dealing with in-distribution data and p-values are uniformly distributed under the null hypothesis,
$\mathbb{E}[\text{P}(\mathbf{x}^{\prime})]=1-\left(1-\frac{k}{N_{\text{train}}+
1}\right)^{N_{\text{train}}}\approx 1-e^{-k}.$
since,
$\lim_{n\to\infty}\left(1-\frac{k}{n+1}\right)^{n}=\lim_{n\to\infty}\dfrac{
\left(1-\frac{k}{n+1}\right)^{n+1}}{1-\frac{k}{n+1}}=\dfrac{e^{-k}}{1-0}=e^{-k}$

Expected Recall per point ($\mathbb{E}[\text{R}(\mathbf{x}^{\prime})]$)

- •
Definition:
$\text{R}(\mathbf{x}^{\prime})=\frac{1}{N_{\text{train}}}\sum_{\mathbf{x}\in X_
{\text{ID}}^{\text{train}}}\mathbb{I}\left[d(\mathbf{x}^{\prime},\mathbf{x})
\leq r_{k}(\mathbf{x})\right].$
- •
From our earlier results for precision, we have that the expected value of the indicator function is $\frac{k}{N_{\text{train}}+1}$, yielding the Expected Value for Recall per point as:
$\mathbb{E}[\text{R}(\mathbf{x}^{\prime})]=\frac{1}{N_{\text{train}}}\times N_{
\text{train}}\times\frac{k}{N_{\text{train}}+1}=\frac{k}{N_{\text{train}}+1}.$

Expected Density per point ($\mathbb{E}[\text{D}(\mathbf{x}^{\prime})]$)

- •
Definition:
$\text{D}(\mathbf{x}^{\prime})=\frac{1}{k}\sum_{\mathbf{x}\in X_{\text{ID}}^{
\text{train}}}\mathbb{I}\left[d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(
\mathbf{x})\right].$
- •
Expected Sum, for large N:
$\mathbb{E}\left[\sum_{\mathbf{x}\in X_{\text{ID}}^{\text{train}}}\mathbb{I}
\left[d(\mathbf{x}^{\prime},\mathbf{x})\leq r_{k}(\mathbf{x})\right]\right]=N_
{\text{train}}\times\frac{k}{N_{\text{train}}+1}\approx k.$
- •
Expected Density per point:
$\mathbb{E}[\text{D}(\mathbf{x}^{\prime})]\approx\frac{k}{k}=1.$

Expected Coverage per point ($\mathbb{E}[\text{C}(\mathbf{x}^{\prime})]$)

- •
Definition is similar to Precision per point. Therefore, Expected Coverage per point:
$\mathbb{E}[\text{C}(\mathbf{x}^{\prime})]\approx 1-e^{-k}.$

Expected PRDC Metrics for OOD Samples

- •
Due to the large distance $\Delta$, the probability that an OOD sample is within $r_{k}(\mathbf{x})$ of any ID training sample is negligible.
- •
Therefore:
1.
$\mathbb{E}[\text{P}(\mathbf{x}^{\prime\prime})]\approx 0$.
2.
$\mathbb{E}[\text{R}(\mathbf{x}^{\prime\prime})]\approx 0$.
3.
$\mathbb{E}[\text{D}(\mathbf{x}^{\prime\prime})]\approx 0$.
4.
$\mathbb{E}[\text{C}(\mathbf{x}^{\prime\prime})]\approx 0$.

Variances of PRDC Metrics

Variance of Precision and Coverage per point

- 1.
Since these are Bernoulli random variables:
$\operatorname{Var}[\text{P}(\mathbf{x}^{\prime})]=\mathbb{E}[\text{P}(\mathbf{
x}^{\prime})]\left(1-\mathbb{E}[\text{P}(\mathbf{x}^{\prime})]\right)=e^{-k}-e
^{-2k}.$
- 2.
Similarly for Coverage per point.

Variance of Recall per point

- 1.
Recall per point is an average of $N_{\text{train}}$ Bernoulli variables with success probability
$p=\frac{k}{N_{\text{train}}+1}$
.
- 2.
Because the sum of $N_{\text{train}}$ Bernoulli variables with probability $p$ is a binomial distribution and we are dividing that sum by $N_{\text{train}}$, the Variance becomes:
$\operatorname{Var}[\text{R}(\mathbf{x}^{\prime})]=\frac{1}{N_{\text{train}}^{2
}}\times N_{\text{train}}\times p\left(1-p\right)=\frac{p(1-p)}{N_{\text{train
}}}.$

Variance of Density per point

- •
Density per point sums $N_{\text{train}}$ Bernoulli variables and divides by $k$.
- •
Variance:
$\operatorname{Var}[\text{D}(\mathbf{x}^{\prime})]=\frac{1}{k^{2}}\times N_{
\text{train}}\times p\left(1-p\right)=\frac{p(1-p)N_{\text{train}}}{k^{2}}.$
- •
Since $p=\frac{k}{N_{\text{train}}+1}$, we get:
$\operatorname{Var}[\text{D}(\mathbf{x}^{\prime})]\approx\frac{1}{k}\left(1-
\frac{k}{N_{\text{train}}}\right).$
- •
For large $N_{\text{train}}$, this simplifies to:
$\operatorname{Var}[\text{D}(\mathbf{x}^{\prime})]\approx\frac{1}{k}.$

- •
For ID samples, per-point Precision and Coverage have expected values close to $1-e^{-k}$, which increases with $k$.
- •
Per-point Recall is small when $k\ll N_{\text{train}}$, with $\mathbb{E}[\text{R}(\mathbf{x}^{\prime})]\approx\frac{k}{N_{\text{train}}}$.
- •
Per-point Density is approximately 1 for ID samples, regardless of $k$.
- •
For OOD samples, all per-point PRDC metrics are approximately zero due to the large mean difference $\Delta$.
- •
Variances depend on $k$ and $N_{\text{train}}$, but are generally small for large datasets.

∎

Note on Assumptions and Approximations

- •
Independence Assumption: While distances are not strictly independent, the independence approximation simplifies calculations and is reasonable for large datasets.
- •
Large $D$ Approximation: Approximations using the normal distribution for the chi-squared distribution are valid when $D$ is large.
- •
Small $k$ Relative to $N_{\text{train}}$: The results are most accurate when $k\ll N_{\text{train}}$.

Figure: Figure 8: Distribution of PRDC metrics for the scenario where both the training (ID) and test (ID) data are drawn from the same Gaussian distribution with zero mean. Blue lines represent the ID data, and red lines represent the OOD data (which is actually the same as ID in this case). The histograms overlap entirely, indicating identical distributions for all metrics due to the same underlying data.
Refer to caption: extracted/5895131/images/PRDC_empirical_noshift.png

Figure: Figure 9: Distribution of PRDC metrics for the scenario with a moderate shift, where the OOD test data is generated from a Gaussian distribution with its mean shifted by 0.01 units compared to the ID data. Blue lines represent the ID data, and red lines represent the moderately shifted OOD data. The histograms show noticeable differences and partial overlap between ID and OOD distributions, reflecting the moderate shift in data.
Refer to caption: extracted/5895131/images/PRDC_empirical_moderateshift.png

Figure: Figure 10: Distribution of PRDC metrics for the scenario with a large shift, where the OOD test data is generated from a Gaussian distribution with its mean shifted by 5 units from the ID data. Blue lines represent the ID data, and red lines represent the significantly shifted OOD data. The histograms display minimal overlap, indicating that the PRDC metrics effectively distinguish between the ID and heavily shifted OOD data.
Refer to caption: extracted/5895131/images/PRDC_empirical_largeshift.png

Figure: Figure 11: Line plots showing the mean PRDC metrics—Precision, Recall, Density, and Coverage—per data point as a function of the number of samples (N) for varying values of k (number of nearest neighbors). Each subplot corresponds to one of the PRDC metrics, with different lines representing k=3, k=5, and k=10. The semi-logarithmic x-axis emphasizes the impact of sample size on the stability and reliability of the PRDC metrics across different neighborhood sizes. Notice that in precision and coverage, the variance goes down considerably (theoretically, exponentially) on the basis of k, supported by our theorem.
Refer to caption: extracted/5895131/images/PRDC_Ablations.png

###### Theorem C.1 .

###### Proof.

### C.1 Robustness to the curse of dimensionality

Intuition: The curse of dimensionality often manifests as the concentration of distances in high-dimensional spaces. By reducing to four scalar metrics, PRDC sidesteps many of these issues. Let $X_{n}$ be uniformly distributed in the $n$-dimensional unit ball. As $n\rightarrow\infty$:
$\frac{\max_{1\leq i<j\leq k}|X_{i}-X_{j}|}{\min_{1\leq i<j\leq k}|X_{i}-X_{j}|
}\stackrel{{\scriptstyle P}}{{\rightarrow}}1$
for any fixed $k$. As the number of dimensions n increases, the ratio of the maximum to minimum distances between any pair of k points approaches 1 in probability. This means that the distances between points become almost the same, regardless of their specific locations in the unit ball. This contributes to why directly using high dimensional representations does not help.

PRDC metrics are not directly affected by this distance concentration, as they capture relative rather than absolute distances. These metrics provide more meaningful comparisons between datasets, especially in high-dimensional spaces where traditional distance measures lose their discriminatory power. By emphasizing relative rather than absolute distances, PRDC metrics are less affected by the concentration of distances in high-dimensional spaces.

Experiment: We want to understand how increasing the dimensionality of data affects the ability of PRDC metrics and other measures to distinguish between inliers and outliers.

We use the following methodology for data generation :

- •
Inliers: For each dimension $D$ ranging from 2 to 200 (in steps of 5), we generate 1000 samples from a $D$-dimensional standard normal distribution centered at the origin:
$\mathbf{x}_{\text{inlier}}\sim\mathcal{N}(\mathbf{0},I_{D}),$
where $I_{D}$ is the $D\times D$ identity matrix.
- •
We generate 100 samples from a $D$-dimensional normal distribution centered at $\bm{\mu}=[3,3,\dots,3]$:
$\mathbf{x}_{\text{outlier}}\sim\mathcal{N}(3\mathbf{1},I_{D}),$
where $\mathbf{1}$ is a vector of ones.

We calculate the PRDC per point metrics, and then the following additional measures :

- •
Mean Euclidean Distance:
$\text{Mean Distance}=\frac{1}{N}\sum_{i=1}^{N}\|\mathbf{x}_{i}\|_{2},$
where $N$ is the number of inliers.
- •
Mean Cosine Similarity:
$\text{Mean Cosine Similarity}=\frac{2}{N(N-1)}\sum_{i<j}\frac{\mathbf{x}_{i}^{
\top}\mathbf{x}_{j}}{\|\mathbf{x}_{i}\|_{2}\|\mathbf{x}_{j}\|_{2}}.$
- •
PCA Variance Explained: Sum of variance explained by the first two principal components obtained from Principal Component Analysis (PCA) on the inliers.

We iterate over each dimension $D$ and:

- 1.
Generate inliers and outliers.
- 2.
Compute PRDC metrics for inliers vs. inliers and inliers vs. outliers.
- 3.
Compute additional measures.
- 4.
Record the results for analysis.

Observations

Figure: Figure 12: Precision, Recall, Density, and Coverage (PRDC) metrics plotted against the number of dimensions for Inlier (ID) and Outlier (OOD) datasets. In each subplot, the blue line represents the average PRDC metric for inliers compared against themselves, while the orange line depicts the average PRDC metric for outliers compared against inliers. This figure illustrates how increasing dimensionality impacts the effectiveness of PRDC metrics in distinguishing between inliers and outliers across different degrees of distributional shift.
Refer to caption: extracted/5895131/images/PRDC_dimensionality.png

Figure: (a) Average Euclidean Distance from the Origin and Average Cosine Similarity among Inliers plotted against the number of dimensions for Inlier (ID) datasets. The left y-axis (colored in green) shows the mean Euclidean distance of inliers from the origin, while the right y-axis (colored in orange) displays the mean cosine similarity among inliers. This dual-axis plot highlights how higher dimensionality leads to increased Euclidean distances and decreased cosine similarities, reflecting the effects of the curse of dimensionality on data geometry.
Refer to caption: extracted/5895131/images/euclidean_cosine_dimensionality.png

- •
Precision: Inliers exhibit high precision across dimensions, indicating that inliers are close to each other. For outliers, precision decreases with increasing $D$, and then stabilizes, due to increased distances in high-dimensional spaces.
- •
Recall: Inliers show higher recall, reflecting better coverage among inliers. Outliers on the other hand show lower recall, as outliers do not cover the inlier distribution well.
- •
Density: Inliers demonstrate high density, indicating dense clustering. For outliers, density decreases with $D$, showing sparse connections to inliers.
- •
Coverage: Inliers exhibit high coverage, demonstrating that they effectively cover the inlier distribution. Outlier coverage decreases with $D$, indicating poor coverage of inliers by outliers.
- •
Mean Euclidean Distance: This metric increases with $D$ for both inliers and outliers, due to the phenomenon where distances between points in high-dimensional spaces tend to increase.
- •
Mean Cosine Similarity: This measure decreases with $D$, approaching zero for both inliers and outliers, as random vectors in high dimensions become nearly orthogonal.
- •
PCA Variance Explained: This metric decreases with $D$ for both inliers and outliers, as variance is distributed among more components, making it harder to capture significant variance in the first few components.

### C.2 PRDC as local transformations

A local transformation is a function applied to a vector in a space which depends not only on the vector itself but also on its neighboring vectors. This allows for contextual dependence, where the transformation depends on the local environment of the vector, therefore making it sensitive to local variations and patterns. This also allows the local transformations to be non-linear, allowing for complex manipulations that are not possible with global linear transformations. This means they can adapt to regions of the data space, capturing variations and features that might be missed by global transformations.

These are obviously very powerful, as evidenced by convolution kernels (depending on neighbour pixels), Graph convolutions, Laplacian smoothing, and wavelet transforms. However, they can be sensitive to parameters like kernel size, weights, and tuning is important to ensure robustness. PRDC metrics might look very different at different k values, for example.

### C.3 Key Properties and Characteristics of the Forte Algorithm

At its core, Forte leverages locality, basing its per-point PRDC (Precision, Recall, Density, Coverage) metrics on local neighborhood structures. This approach makes the algorithm sensitive to local variations in data distribution. Simultaneously, Forte performs dimensionality reduction, compressing high-dimensional data ($D\gg 4$) into a more manageable $\mathbb{R}^{4}$ space while preserving essential information for OOD detection. This reduction not only aids in mitigating overfitting but also improves generalization and computational efficiency.

A key strength of Forte lies in its model-agnostic nature, allowing it to work with any feature extractor that provides meaningful representations in $\mathbb{R}^{D}$. Self-supervised models like CLIP, ViTMSN, and DINOv2 are particularly effective in this context due to their rich feature representations. The algorithm’s non-parametric approach, which avoids assumptions about the data distribution’s form, contributes to its flexibility and robustness. This is further enhanced by the tunable parameter $k$ (number of nearest neighbors), which allows for balancing sensitivity to local structures with noise robustness.

Forte’s effectiveness in OOD detection stems from its ability to capture both density (proximity of neighbors) and coverage (sample’s position within the support of $P_{\text{ID}}$). By focusing on local neighborhood information, the algorithm can detect subtle discrepancies between in-distribution and OOD samples, particularly effective when OOD samples reside in low-density regions. The use of multiple metrics (precision, recall, density, and coverage) provides a holistic view of how each sample relates to the training data $X_{\text{ID}}^{\text{train}}$, enhancing the algorithm’s discriminative power. The local transform employed by Forte also confers robustness to feature space variability, an important consideration when working with different self-supervised learning models. By normalizing differences through a focus on relative distances within the feature space, Forte maintains consistency across varied feature representations. Empirical results presented in this paper have comprehensively demonstrated Forte’s superior performance compared to traditional methods, showcasing how the combination of powerful feature extractors and the local transform leads to effective OOD detection.

## Appendix D Appendix: Medical Image Datasets

In medical imaging research, studies are often done using one in-house dataset. Conclusions and models drawn from these studies are then applied to new data, with poor results. In particular, MRI datasets exhibit strong batch effects that prevent them from being in-distribution relative to each other because some acquisition protocol is bound to be different between them. Moreover, dataset sizes are severely limited in clinical applications, which means a separate model cannot be trained for each batch. A single model cannot be robust to all MRI datasets of the same subject matter, even if they have similar acquisition parameters. Such datasets still carry enough differences to impact model performance.

To simulate this scenario, two public datasets are used for the experiments in Section 4.2: coronal knee MRI from FastMRI Zbontar et al. (); Knoll et al. () with two subsets and Osteoarthritis Initiative (OAI) Nevitt et al. () with three subsets. The acquisition parameters, including sequence and fat suppression are detailed in Table 6 and samples are shown in Figure 14. Treating the FastMRI dataset as in-distribution and assuming that models have been trained on them, Forte is used to determine the next course of action when confronted with the OAI dataset: 1) which subsets of the new dataset can be aligned with the existing subsets / models? 2) To what degree do these subsets diverge from each other? Using the FastMRI FS subset as in-distribution, the two OAI subsets (OAI T1 and OAI MPR) are tested for OOD detection. Similarly, the FastMRI NoFS subset is used as in-distribution and the OAI TSE subset is tested for OOD detection.

**Table 6: Acquisition parameters for MRI, grouped by distributions as used in Section 4.2.**
| Parameter | FastMRI NoFS | FastMRI FS | OAI TSE | OAI T1 | OAI MPR |
| --- | --- | --- | --- | --- | --- |
| Sequence | 2D TSE PD | 2D TSE PD | 2D TSE T1w | 3D FLASH T1w | 3D DESS T2w |
| FOV (mm^2) | 140 $\times$ 140 | 140 $\times$ 140 | 140 $\times$ 140 | 140 $\times$ 140 | 140 $\times$ 140 |
| Matrix size | 320 $\times$ 320 | 320 $\times$ 320 | 320 $\times$ 320 | 384 $\times$ 384 | 320 $\times$ 320 |
| Slice thickness (mm) | 3 | 3 | 3 | 0.7 | 1.5 |
| TR (ms) | 2750–3000 | 2850–3000 | 800 | 9.7 | 14.7 |
| TE (ms) | 27–32 | 33 | 9 | 4.0 | 4.2 |
| Fat suppression | No | Yes | No | Yes | Yes |

Figure: (a) FastMRI FS
Refer to caption: extracted/5895131/images/fast_fs.png

## Peer Reviews

confidence: 4
contribution: 4
initial_rating: 10
presentation: 4
questions: None.  The appendix cleared them up
soundness: 4
strengths: The paper is very well written, easy to follow, and highly implementable.  An extensive appendix provides supporting information and data.
summary: The authors present a methodology, Forte, which enables the identification of outliers using a rigorous unsupervised algorithm.  The algorithm relies on establishing metrics to identify which samples are in-distribution vs out-of-distribution.  The method is very general, and applicable to many models.  The authors use SVM, KDE, and GMM models with their method, and show that it is capable of distinguishing between real and synthetic data.
weaknesses: None

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 1
questions: 1. My main question is how the proposed method really works. If the authors could provide a pseudocode of the algorithm, and how it differs with DoSE, it would be great.
2. See above weaknesses.
3. Overall poor writing and latex formatting, in addition to the issues listed above. E.g., "in Figure 2 FIgure 3 Figure 4", 
3. Minor typos: "near-ood" -> "near-OOD", "Table 1 & 2" -> "Tables 1 & 2".
soundness: 2
strengths: [The following is based on my guess of the proposed method, which is not well described in paper.]

+ Proposed approach is a simple change over feature-space OOD methods, and appears effective.
+ Experiments seems cover a wide range of scenarios
summary: The paper investigates OOD by modeling distributions in feature space. The paper is poorly written, but my guess is that the proposed method is a variant of DoSE, using models _per-sample metrics_ of the feature space, rather than the feature vectors themselves. Four metrics, including precision and recall, are used. Experiments are performed on real images from distinct classes, synthetic vs. real images, and medical images. Results indicate that the proposed method is effective.

----

The authors' response have addressed most of my concerns. The changes have significantly improved the manuscript. I decide to raise my score.
weaknesses: + The paper is extremely poorly written. I list some major issues here.
    1. None of the math latex in section 3.2 is well formatted. Subscripts and superscripts are wrong.
    2. Variables are used without definition, e.g., $\text{nearest}_k$ in section 3.2. Is it different from the $k$ below?
    3. No description is given on how the four metrics are used. Are they used as the "summary statistics" that the proposed method models?
    4. The method, referred to as "Forte", is never truly defined or mentioned in the method section 3.
    
+ If my understanding of the method is correct, is it simple just taking DoSE and run it on the new set of statistics?
+ Incorrect claims. E.g., GMM is not non-parametric, and I don't think that the four metrics are newly proposed in this paper.
+ Density definition is inconsistent with Fig. 1. As defined, it is just a scaled "recall", which would make it useless to model.

---

confidence: 2
contribution: 2
initial_rating: 5
presentation: 1
questions: Could the computational demands of Forte’s ensemble approach limit its applicability in real-time OOD detection scenarios?

Would Forte’s effectiveness in OOD detection promote if one apply multiple models by one self-supervised approach in this framework?
soundness: 2
strengths: - **Performance**: Forte demonstrates superior OOD detection performance compared to state-of-the-art methods across multiple benchmarks, including synthetic data and medical image datasets, which often present significant OOD detection challenges.
- **Flexibility**: Forte’s unsupervised nature eliminates the need for labeled data or pre-exposure to OOD samples, making it adaptable to various tasks and practical for real-world applications where OOD examples may not be available during training.
- **Comprehensive Evaluation**: Forte is rigorously tested on both synthetic and medical datasets, demonstrating the framework’s versatility and robustness across vastly different domains.
- **Insightful Metrics**: The use of novel per-point summary statistics (e.g., precision, recall, density, and coverage) contributes valuable insight into data distribution, enhancing OOD detection beyond standard density-based methods.
summary: This paper introduces Forte, a novel out-of-distribution (OOD) detection framework that leverages self-supervised learners. Forte enhances detection by combining representation learning methods (e.g., CLIP, ViT-MSN, and DINOv2) with non-parametric density estimators (OCSVM, KDE, GMM) to model the typicality of input samples. The proposed framework emphasizes detecting atypical samples through summary statistics (precision, recall, density, and coverage) to analyze representation distributions. Forte’s performance was evaluated on synthetic datasets generated by Stable Diffusion and various medical image datasets, showcasing its advantages over existing supervised and unsupervised methods.
weaknesses: 1. **Paper Structure**: The paper allocates a substantial portion of its Introduction to reviewing existing OOD detection literature and explaining the typicality concept. This approach detracts from an immediate focus on the novel contributions and design of Forte, which may hinder reader engagement and understanding of the primary contributions.
2. **Complexity in Practical Implementation**: The integration of multiple representation learning techniques, combined with non-parametric density estimators, may lead to a higher computational overhead and increased complexity in practical deployment. The paper lacks an illustration figure to clearly explain the proposed framework how to integrate the representations from diverse models.
3. **Insight.**: This work integrates representations from diverse models empirically. It lacks insight into the choice of self-supervised models, such as whether any specific attributes of CLIP, ViT-MSN, or DINOv2 contribute uniquely to Forte’s robustness.

---

confidence: 2
contribution: 2
initial_rating: 6
presentation: 3
questions: I miss some comparison with DoSE in some table for completeness.
soundness: 3
strengths: The paper is clear to understand. The problem is relevant. The method is sound. The experimental framework is correct and complete.
summary: This paper proposes a method for identifying OOD and synthetic data created using generative models. The definition of OOD changes with the advent of foundation models that can generate very plausible data. However, even when this data seems real, there can still be distribution shifts that are difficult to detect. In this paper, the concept of typicality is used to assess OOD. However, computing typicality is challenging. This paper proposes Forte, a method for computing typicality, and they evaluate it and compare it with other methods.
weaknesses: In the related work section I miss some comparison of the current SOTA with Forte.

This method is based on DoSE. I miss a clear statement in the intro about that and the changes over DoSE with an intuition of why. Also, it would be beneficial to clearly state the method to guide the reader on what will come.

Meta-review: The paper focuses on outlier detection, and is well received by all reviewers. There were concerns regarding the clarity and novelty, however, these were well addressed, even raising scores significantly during the rebuttal phase. Thus, I recommend acceptance.

Decision: Accept (Poster)