Year: 2021

Abstract:
It is an important problem in trustworthy machine learning to recognize outof-distribution (OOD) inputs which are inputs unrelated to the in-distribution task. Many out-of-distribution detection methods have been suggested in recent years. The goal of this paper is to recognize common objectives as well as to identify the implicit scoring functions of different OOD detection methods. In particular, we show that binary discrimination between inand (different) outdistributions is equivalent to several different formulations of the OOD detection problem. When trained in a shared fashion with a standard classifier, this binary discriminator reaches an OOD detection performance similar to that of Outlier Exposure. Moreover, we show that the confidence loss which is used by Outlier Exposure has an implicit scoring function which differs in a non-trivial fashion from the theoretically optimal scoring function in the case where training and test out-distribution are the same, but is similar to the one used when training with an extra background class. In practice, when trained in exactly the same way, all these methods perform similarly and reach state-of-the-art OOD detection performance.

heading: 1 INTRODUCTION
text: While deep learning has significantly improved performance in many application domains, there are serious concerns for using deep neural networks in applications which are of safety-critical nature. With one major problem being adversarial samples (Szegedy et al., 2014; Madry et al., 2018), which are small imperceptible modifications of the image that change the decision of the classifier, another major problem are overconfident predictions (Nguyen et al., 2015; Hendrycks & Gimpel, 2017; Hein et al., 2019) for images not belonging to the classes of the actual task. Here, one distinguishes between far out-of-distribution data, e.g. different forms of noise or completely unrelated tasks like CIFAR-10 vs. SVHN, and close out-of-distribution data which can for example occur in related image classification tasks where the semantic structure is very similar e.g. CIFAR-10 vs. CIFAR-100. Both are important to be distinguished from the in-distribution, but it is conceivable that close out-of-distribution data is the more difficult problem with potentially fatal consequences: in an automated diagnosis system we want that the system recognizes that it “does not know” when a new unseen disease comes in rather than assigning high confidence into a known class leading to fatal treatment decisions. Thus out-of-distribution awareness is a key property of trustworthy AI systems.
In this paper, we focus on the setting of OOD detection where during training time, there is no information available on the distribution of OOD inputs that might appear when the model is used for inference. A large number of different approaches to OOD detection based on combinations of density estimation, classifier confidence, logit space energy, feature space geometry, behaviour on auxiliary tasks, and other principles has been proposed to tackle this problem. We give a detailed overview of existing OOD detection methods in Appendix D. However, most OOD detection papers are focused on establishing superior empirical detection performance and provide little theoretical background on differences but also similarities to existing methods. In this paper we want to take a different path as we believe that a solid theoretical basis is needed to make further progress in this field. Our goal is to identify, at least for a particular subclass of techniques, whether the differences are indeed due to a different underlying theoretical principle or whether they are due to the efficiency of different estimation techniques for the same underlying detection criterion, called “scoring function”. In some cases, we will see that one can even disentangle the estimation procedure from the scoring function, so that one can simulate several different scoring functions from one model’s estimated quantities.
A simple approach to OOD detection is to treat it as a binary discrimination problem between inand out-of-distribution, or more generally predicting a score how likely the input is OOD. In this paper, we show that from the perspective of Bayesian decision theory, several established methods are indeed equivalent to this binary discriminator. Differences arise mainly from i) the choice of the training out-distribution, e.g. the popular Outlier Exposure of Hendrycks et al. (2019a) has advocated the use of a rich and large set of natural images as a proxy for the distribution of natural images, and ii) differences in the estimation procedure. Concretely, the main contributions of this paper are:
• We show that several OOD detection approaches are equivalent to the binary discriminator between in- and out-distribution when analyzing the rankings induced by the Bayes optimal classifier/density.
• We derive the implicit scoring functions for the confidence loss (Lee et al., 2018a) used by Outlier Exposure (Hendrycks et al., 2019a) and for using an additional background class for the out-distribution (Thulasidasan et al., 2021). The confidence scoring function turns out not to be equivalent to the “optimal” scoring function of the binary discriminator when training and test out-distributions are the same.
• We show that when training the binary discriminator between in- and out-distribution together with a standard classifier on the in-distribution in a shared fashion, the binary discriminator reaches state-of-the-art OOD detection performance.
• We show that density estimation is equivalent to discrimination between the in-distribution and uniform noise which explains the frequent observation that standard density estimates are not suitable for OOD detection.
Even though we identify that a simple baseline is competitive with the state-of-the-art, the main aim of this paper is a better understanding of the key components of different OOD detection methods and to identify the key properties which lead to SOTA OOD detection performance. All of our findings are supported by extensive experiments on CIFAR-10 and CIFAR-100 with evaluation on various challenging out-of-distribution test datasets.

heading: 2 MODELS FOR OOD DATA AND EQUIVALENCE OF OOD DETECTION SCORES
text: As most work in the literature we consider OOD detection on a compact input domain X where the most important example is image classification where X = [0, 1]D. The most popular approach to OOD detection is the construction of an in-distribution-scoring function f : X → R ∪ {±∞} such that f(x) tends to be smaller if x is drawn from an out-distribution than if it is drawn from the in-distribution. There is a variety of different performance metrics for this task, with a very common one being the area under the receiver-operator characteristic curve (AUC). The AUC for a scoring function f distinguishing between an in-distribution p(x|i) and an out-distribution p(x|o) is given by
AUCf ( p(x|i), p(x|o) ) = E
x∼p(x|i) y∼p(y|o)
[ 1f(x)>f(y) + 1
2 1f(x)=f(y)
] . (1)
We define an equivalence of scoring functions based on their AUCs and will show that this equivalence implies equality of other employed performance metrics as well.
Definition 1. Two scoring functions f and g are equivalent and we write f ∼= g if AUCf ( p(x|i), p(x|o) ) = AUCg ( p(x|i), p(x|o) ) (2)
for all potential distributions p(x|i) and p(x|o).
As the AUC is not dependent on the actual values of f but just on the ranking induced by f one obtains the following characterization of the equivalence of two scoring functions.
Theorem 1. Two scoring functions f, g are equivalent f ∼= g if and only if there exists a strictly monotonously increasing function ϕ : range(g) → range(f), such that f = ϕ(g). Corollary 1. The equivalence between scoring functions in Def. 1 is an equivalence relation.
Another metric is the false positive rate at a fixed true positive rate q, denoted as FPR@qTPR. A commonly used value for the TPR is 95%. The smaller the FPR@qTPR, the better the OOD discrimination performance. Lemma 1. Two equivalent scoring functions f ∼= g have the same FPR@qTPR for any pair of inand out-distributions p(x|i), p(x|o) and for any chosen TPR q.
In the next section, we use the previous results to show that the Bayes optimal scoring functions of, several proposed methods for out-of-distribution detection are equivalent to the scoring functions of simple binary discriminators.

heading: 3 BAYES-OPTIMAL BEHAVIOUR OF BINARY DISCRIMINATORS AND COMMON OOD DETECTION METHODS
text: In the following we will show that the Bayes optimal function of several existing approaches to OOD detection for unlabeled data are equivalent to a binary discriminator between in- and a (training) outdistribution whereas differences arise when one has labeled data. As the equivalences are based on the Bayes optimal solution, these are asymptotic statements and thus it has to be noted that convergence to the Bayes optimal solution can be infinitely slow and that the methods can have implicit inductive biases. This is why we additionally support our findings with extensive experiments.

heading: 3.1 OOD DETECTION FOR METHODS USING UNLABELED DATA ONLY
text: We first provide a formal definition of OOD detection before we show the equivalence of density estimators resp. likelihood to a binary discriminator.
The OOD problem In order to make rigorous statements about the OOD detection problem we first have to provide the mathematical basis for doing so. We assume that we are given an in-distribution p(x|i) and potentially also a training out-distribution p(x|o). At this particular point no labeled data is involved, so both of them are just distributions over X . For simplicity we assume in the following that they both have a density wrt. the Lebesgue measure on X = [0, 1]d. We assume that in practice we get samples from the mixture distribution
p(x) = p(x|i)p(i) + p(x|o)p(o) = p(x|i)p(i) + p(x|o)(1− p(i)) (3) where p(i) is the probability that we expect to see in-distribution samples in total. In order to make the decision between in-and out-distribution for a given point x it is then optimal to consider
p(i|x) = p(x|i)p(i) p(x) = p(x|i)p(i) p(x|i)p(i) + p(x|o)p(o) , (4)
which is defined for all x ∈ [0, 1]d with p(x) > 0 (assuming p(x|i) and p(x|o) can be written as densities). If the training out-distribution is also the test out-distribution then this is already optimal but we would like that the approach generalizes to other unseen test out-distributions and thus an important choice is the training out-distribution p(x|o). Note that as p(i|x) is only well-defined for all x with p(x) > 0, it is thus reasonable to choose for p(x|o) a distribution with support in [0, 1]d, that is p(x|o) > 0 for all x ∈ [0, 1]d. In this case we ensure that the criterion with which we perform OOD detection is defined for any possible input x. This is desirable as OOD detection should work for any possible input x ∈ X .
Optimal prediction of a binary discriminator between in- and out-distribution We consider a binary discriminator with model parameters θ between in- and (training) out-distribution, where p̂θ(i|x) is the predicted probability for the in-distribution. Under the assumption that p(i) is the probability for in-distribution samples and using cross-entropy (which in this case is the logistic loss up to a constant global factor of log(2)) the expected loss becomes:
min θ p(i) E x∼p(x|i) [− log p̂θ(i|x)] + p(o) E x∼p(x|o) [− log(1− p̂θ(i|x))] . (5)
One can derive that the Bayes optimal classifier minimizing the expected loss has the predictive distribution:
p̂θ∗(i|x) = p(x|i)p(i)
p(x|i)p(i) + p(x|o)p(o) = p(i|x). (6)
Thus at least for the training out-distribution a binary classifier based on samples from in- and (training) out-distribution would suffice to solve the OOD detection problem perfectly.
Equivalence of density estimation and binary discrimination for OOD detection In this section we further analyze the relationship of common OOD detection approaches with the binary discriminator between in-and out-distribution. We start with density estimators sourced from generative models. A basic approach that is known to yield relatively weak OOD performance (Nalisnick et al., 2019; Ren et al., 2019; Xiao et al., 2020) is directly utilizing a model’s estimate for the density p(x|i) at a sample input x. An improved density based approach which uses perturbed in-distribution samples as a surrogate training out-distribution is the Likelihood Ratios method (Ren et al., 2019), which proposes to fit a generative model for both the in- and out-distribution and to use the ratio between the likelihoods output by the two models as a discriminative feature.
We show that with respect to the scoring function, the correct density p(x|i) is equivalent to the Bayes optimal prediction of a binary discriminator between the in-distribution and uniform noise. Furthermore, the density ratio p(x|i)p(x|o) is equivalent to the prediction of a binary discriminator between the two distributions on which the respective models used for density estimation have been trained. Because of this equivalence, we argue that the use of binary discriminators is a simple alternative to these methods because of its easier training procedure. While this equivalence is an asymptotic statement, the experimental comparisons in the appendix show that the methods perform similarly poorly compared to the methods using labeled data.
We first prove the more general case of arbitrary likelihood ratios. In the following we use the abbreviation λ = p(o)p(i) to save space and make the statements more concise.
Lemma 2. Assume that p(x|i) and p(x|o) can be represented by densities and the support of p(x|o) covers the whole input domain X . Then p(x|i)p(x|o) ∼= p(x|i)p(x|i)+λp(x|o) for any λ > 0.
This means that the likelihood ratio score of two optimal density estimators is equivalent to the indistribution probability p̂θ∗(i|x) predicted by a binary discriminator and this is true for any possible ratio of p(i) to p(o). In the experiments below, we show that using such a discriminator has similar performance as the likelihood ratios of the different trained generative models.
For the approaches that try to directly use the likelihood of a generative model as a discriminative feature, this means that their objective is equivalent to training a binary discriminator against uniform noise, whose density is pUniform(x) = p(x|o) = 1 at any x.
Lemma 3. Assume that p(x|i) can be represented by a density. Then p(x|i) ∼= p(x|i)p(x|i)+λ for any λ > 0.
This provides additional evidence why a purely density based approach for many applications proves to be insufficient as an OOD detection score on the complex image domain: it is not reasonable to assume that a binary discriminator between certain classes of natural images on the one hand and uniform noise on the other hand provides much useful information about images from other classes or even about other nonsensical inputs.

heading: 3.2 OOD DETECTION FOR METHODS USING LABELED DATA
text: We first discuss how one can formulate the OOD problem when one has access to labeled data for the in-distribution and we identify the target distribution of OOD detection using a background/reject class. Then we derive the Bayes optimal classifier of the confidence loss (Lee et al., 2018a) as used by the most successful variant of Outlier Exposure (Hendrycks et al., 2019a) and discuss the implicit scoring function. In most cases the scoring functions turn out not to be non-equivalent to p(i|x) (which is optimal if training and test out-distribution agree) as they integrate additional information from the classification task.
Bayes optimal solutions for OOD Detection with Background class and confidence loss Outlier Exposure Given a joint in-distribution p(y, x|i) (where y ∈ {1, . . . ,K} given that we have K labels) for the labeled in-distribution, there are different ways how to come up with a joint distribution for in- and out-distribution. Interestingly, the different encodings used e.g. in training with a
background class (Thulasidasan et al., 2021) vs. training a classifier with confidence loss (Lee et al., 2018a) together with variants of the employed scoring function lead to methods which unexpectedly can have quite different behavior.
Background class: In this case we just put all out-of-distribution samples into a K + 1-class which is typically called background/reject class (Thulasidasan et al., 2021). The joint distribution then becomes
p(y, x) = { p(y, x|i)p(i) if y ∈ {1, . . . ,K}, p(x|o)p(o) if y = K + 1.
We denote by p(x|i) = ∑K
y=1 p(y, x|i) the marginal in-distribution and note that the marginal distribution of the joint distribution of in- and out-distribution is again given by
p(x) = p(x|i)p(i) + p(x|o)p(o). Then we get the conditional distribution
p(y|x) = { p(y|x, i)p(i|x) if y ∈ {1, . . . ,K}, p(o|x) = 1− p(i|x) if y = K + 1.
The Bayes optimal solution of training with a background class using any calibrated loss function L(y, f(x)), e.g. the cross-entropy loss (Laptev et al., 2016), then yields a Bayes optimal classifier f∗ which has a predictive distribution pf∗(y|x) = p(y|x). There are two potential scoring function that come to mind:
s1(x) = 1− pf∗(K + 1|x) and s2(x) = max k=1,...,K pf∗(k|x)
The first one, used in Chen et al. (2021); Thulasidasan et al. (2021), is motivated by the fact that pf∗(K +1|x) is directly the predicted probability that the point is from the out-distribution as indeed it holds: s1(x) = p(i|x) which is the optimal scoring function if training and test out-distribution are equal. On the other hand the maximal predicted probability maxk=1,...,K pf∗(k|x), which is often employed as a scoring function Hendrycks & Gimpel (2017), becomes for the Bayes optimal classifier
s2(x) = p(i|x) max k=1,...,K p(k|x, i),
which is a product of p(i|x) and the maximal conditional probability of some class of the indistribution (note that s2 is well defined as p(i|x) is defined if p(x|o) has support everywhere in X and if p(i|x) > 0 then also p(x|i) > 0). Thus the scoring function s2(x) integrates additionally to p(i|x) also class-specific information and is thus less dependent on the chosen training outdistribution. In fact, one can see that s2 only ranks points high if both the binary discriminator and the classifier rank the corresponding point high. On the other hand in the case where training and test out-distribution are identical, this scoring function is not equivalent to p(i|x) and thus introduces a bias in the estimation.
Outlier Exposure Hendrycks et al. (2019a) with confidence loss (Lee et al., 2018a): we analyze the Bayes optimal solution for the confidence loss (Lee et al., 2018a) that is used by Outlier Exposure (OE) and show that the associated scoring function can be written, similarly to the scoring function s2(x) for training with a background class, as a function of p(i|x) and p(y|x, i). The training objective with the confidence loss is in expectation given by
min θ E (x,y)∼p(x,y|i) [LCE(fθ(x), y)] + λ E x∼p(x|o)
[ LCE(fθ(x), uK) ] , (7)
where θ are the model parameters and fθ(x) ∈ RK is the model output as logits, and uK = ( 1K , . . . , 1 K ) T is the uniform distribution over the K classes of the in-distribution classification task.
In the following theorem we derive the Bayes optimal predictive distribution for this training objective.
Theorem 2. The predictive distribution pf∗(y|x) of the Bayes optimal classifier f∗ minimizing the expected confidence loss is given for y ∈ {1, . . . ,K} as
pf∗(y|x) = p(i|x)p(y|x, i) + 1
K
( 1− p(i|x) ) . (8)
Thus the effective scoring function of using the probability of the predicted class as suggested in Hendrycks & Gimpel (2017); Lee et al. (2018a); Hendrycks et al. (2019a) is given by
s3(x) = p(i|x) max y=1,...,K p(y|x, i) + 1 K
( 1− p(i|x) ) = p(i|x) [ max
y=1,...,K p(y|x, i)− 1 K
] + 1
K .
Please note that the term inside the brackets is positive as maxk=1,...,K p(k|x, i) ≥ 1K . Interestingly, the scoring functions s2 and s3 are not equivalent even though they look quite similar. In particular, due to the subtraction of 1K the scoring function s3 puts more emphasis on the classifier than s2. In Appendix F we additionally analyze Energy Based OOD Detection (Liu et al., 2020), and show that the Bayes optimal decision is equivalent to using the scoring function s1 = p(i|x).
3.3 SEPARATE VERSUS SHARED ESTIMATION OF p(i|x) AND p(y|x, i)
So far we have derived that at least from the point of view of the ranking induced by the Bayes optimal solution, OOD detection based on generative methods, likelihood ratios and the background class formulation with the scoring function s1 is equivalent to a binary classification problem between in- and out-distribution in order to estimate p(i|x). The differences arise mainly in the choice of the training out-distribution p(x|o): i) uniform for generative resp. density based methods, ii) a quite specific out-distribution for likelihood ratios (Ren et al., 2019) and iii) a proxy of the distribution of all natural images (Hendrycks et al., 2019a; Thulasidasan et al., 2021).
On the other hand when labeled data is involved we can additionally train a classifier on the indistribution in order to estimate p(y|x, i). We will then combine the estimates of p(i|x) and p(y|x, i) according to the three scoring functions derived in the previous section and check if the novel OOD detection methods constructed in this way perform similar to the OOD methods from which we derived the corresponding scoring function i) OOD detection with a background class (Thulasidasan et al., 2021) or ii) using Outlier Exposure Hendrycks et al. (2019a). This will allow us to differentiate between differences of the employed scoring functions for OOD detection and the estimators for the involved quantities. In this way we foster a more systematic approach to OOD detection.
In the unlabeled case we train simply the binary classifier pθ : [0, 1]d → R using logistic/cross entropy loss in a class balanced fashion
min θ − 1 N N∑ i=1 log ( p̂θ(i|xINi ) ) − λ M M∑ j=1 log ( 1− p̂θ(i|xOUTj ) ) , (9)
where (xINi ) N i=1 and (x OUT j ) M j=1 are samples from the in-distribution and the out-distribution.
In the case where we have labeled data we can additionally solve the classification problem. The obvious approach is to train the binary classifier for estimating p(i|x) and the classifier to estimate p(y|x, i) completely independently. Not surprisingly, we show in Section 4 that this approach works less well. In fact both tasks benefit from each other. Moreover, in training a neural network using a background class or with Outlier Exposure (Hendrycks et al., 2019a) we are implicitly using a shared representation for both tasks which improves the results.
Thus we propose to train the binary discriminator of in-versus out-distribution together with the classifier on the in-distribution jointly. Concretely, we use a neural network with K+1 outputs where the first K outputs represent the classifier and the last output is the logit of the binary discriminator. The resulting shared problem can then be written as
min θ − 1 Nb Nb∑ r=1 log ( p̂θ(i|xINr ) ) − λ M M∑ s=1 log ( 1− p̂θ(i|xOUTs ) ) − 1 Nc Nc∑ t=1 log ( p̂θ(y IN t |xINt ) ) , (10)
where λ = p(o)p(i) which is typically set to 1 during training in order to get a class-balanced problem. Note that the in-distribution samples (xINr ) Nb r=1 used to estimate p(i|x) can be a super-set of the labeled examples (xINt , y IN t ) Nc t=1 used to train the classifier so that one can potentially integrate unlabeled data - this is an advantage compared to OOD detection with a background class or Outlier Exposure where this is not directly possible. We stress that the loss functions of the classifier and the discriminator act on independent outputs; the functions modelling the two tasks only interact with each other due to the shared network weights up to the final layer. Nevertheless, we see in the next Section 4 that training with a shared representation boosts both the classifier and the binary discriminator.

heading: 4 EXPERIMENTS
text: We use CIFAR-10 and CIFAR-100 (Krizhevsky & Hinton, 2009) datasets as in-distribution and OpenImages dataset (Krasin et al., 2017) as training out-distribution. The 80 Million Tiny Images (80M) dataset (Torralba et al., 2008) is the de facto standard for training out-distribution aware models that has been adopted by most prior works, but this dataset has been withdrawn by the authors as Birhane & Prabhu (2021) pointed out the presence of offensive images. To be able to compare with other state-of-the-art methods without introducing a potential bias due to dataset selection, we include the evaluation with 80M as training out-distribution in Appendix H. Moreover, we show in the appendix results for the binary discriminator trained with different training out-distributions vs. likelihoods resp. likelihood ratios (Ren et al., 2019) as OOD method.
We use as OOD detection metric the false positive rate at 95% true positive rate, FPR@95%TPR; evaluations with AUC are in Appendix G. We evaluate the OOD detection performance on the following datasets: SVHN (Netzer et al., 2011), resized LSUN Classroom (Yu et al., 2015), Uniform Noise, Smooth Noise generated as described by (Hein et al., 2019), the respective other CIFAR dataset, 80M, and CelebA (Liu et al., 2015). We highlight that none of the listed methods has access
to those test distributions during training or for fine-tuning as we try to assess the ability of an out-distribution aware model to generalize to unseen distributions. The FPR for the OpenImages test set is not included in the Mean AUC, since this distribution has been used during training.
The binary discriminators (BINDISC) as well as the classifiers with background class (BGC) and the shared binary discriminator+classifier (SHARED) of p(i|x) and p(y|x, i) are trained on the 40-2 Wide Residual Network (Zagoruyko & Komodakis, 2016) architecture with the same training schedule as used in Hendrycks et al. (2019a) for training their Outlier Exposure(OE) models. This includes averaging the loss over batches that are twice as large for the out-distribution. This way we ensure that the differences do not arise due to differences in the training schedules or other important details but only on the employed objectives. In addition to their standard augmentation and normalization, we apply AutoAugment (Cubuk et al., 2019) without Cutout, and we use λ = 1 where applicable, which is a sound choice as we observe in an ablation on λ in Appendix K. For the Mahalanobis OOD detector (Lee et al., 2018b), we use the models and code published by the authors and use OpenImages for the fine tuning of input noise and layer weighting regression. We describe the exact details of the training settings and the used dataset splits in Appendix C.

heading: 4.1 OUT-DISTRIBUTION AWARE TRAINING WITH LABELED IN-DISTRIBUTION DATA
text: In Table 1 we compare multiple OOD methods trained with training out-distribution OpenImages and CIFAR-10/100 as in-distribution: confidence of standard training (PLAIN) and OE, MAHALANOBIS detection, classifier with background class (BGC) and the combination of a plain classifier and a binary in-vs-out-distribution classifier with shared representation (SHARED COMBI). As described in Section 2, both BGC and SHARED COMBI can be used in combination with different scoring functions. For BGC, we evaluate all three scoring functions s1, s2 and s3 and for SHARED COMBI we only use s2 and s3 as s1 is equivalent to p(i|x) which is the output of SHARED BINDISC. Additionally, we evaluate OOD detection based on the confidence of the shared classifier (SHARED CLASSI) trained together with SHARED BINDISC.
For CIFAR-10, a first interesting observation is that SHARED CLASSI has remarkably good OOD performance; significantly better than a normal classifier (plain) even though it is just trained using normal cross-entropy loss and so the OOD performance is only due to the regularization enforced by the shared representation with SHARED BINDISC. In fact SHARED BINDISC has already good OOD performance with a mean FPR@95%TPR of 19.56, which is improved by considering scoring function s2/s3 in the combination of SHARED BINDISC and SHARED CLASSI which yields very good classification accuracy and mean FPR/AUC. Moreover, interesting are the results of the classifier with background class (BGC) which is the method recently advocated in Thulasidasan et al. (2021). It works very well but the performance depends on the chosen scoring function. Whereas s1 (output of the background class) is a usable scoring function (mean FPR: 18.83), the maximum probability over the other classes s2 (mean FPR: 16.52) or the combination in terms of s3 (mean FPR: 16.63) performs better. In total with the scoring function s2/s3 integrating classifier and discriminative information, BGC reaches similar performance to OE (which implicitly also uses s3 as scoring function). In general, the differences of the methods are relatively minor both in terms of OOD detection and classification accuracy, where the latter is better for all OOD methods compared to the plain classifier; this is most likely explained by better learned representations, see also Hendrycks et al. (2019a); Augustin et al. (2020) for similar observations. The results for CIFAR-100 are similar to CIFAR-10, with some reversals of the overall rankings of the compared methods. OE achieves comparable OOD results to BGC s2/s3 and SHARED COMBI s2/s3. For this in-distribution our BGC s1 and SHARED BINDISC perform best in terms of OOD performance. Classification test accuracy is slightly higher for BGC and SHARED, but the differences are minor. The experiments with 80M as training out-distribution (Table 7 in Appendix H) confirm these observations.
Overall, as suggested by the theoretical results on the equivalence of the Bayes optimal classifier of OE with the s3 scoring function of BGC and SHARED COMBI, we observe that even though these methods are derived and in particular trained with quite different objectives, they behave very similar in our experiments. In total we think that this provides a much better understanding where differences of OOD methods are coming from. Regarding the question of which method and scoring function should be used for a given application, the experimental results across datasets and different out-distributions, see Appendix H, suggest that their difference is minor and there is no clear best choice. However, in Appendix B, we describe a potential situation where the s3 score and in
consequence OE is not powerful enough to distinguish in- and out-of-distribution inputs. On the other hand, in cases where the s1 score is not very informative as training and test out-distributions largely differ, combining it with the classifier confidences is beneficial; this can be observed in experiments with SVHN as training out-distribution which we show in Appendix I. This is why for an unknown situation, we recommend BGC or SHARED COMBI with the s2 scoring function as the safest option. However, it is an open question if there are also situations where s2 is fundamentally inferior to s3.

heading: 4.2 SHARED REPRESENTATION LEARNING FOR THE BINARY DISCRIMINATOR
text: As highlighted above the shared training of SHARED CLASSI and SHARED BINDISC and their combination SHARED COMBI with s2/s3 as scoring functions yields strong OOD detection and test accuracy among all methods. Here, we evaluate the importance of training the binary discriminator and the plain classifier with a shared representation in comparison to training two entirely separate models PLAIN CLASSI and SEPARATE BINDISC and their combination SEPARATE COMBI with scoring function s3. The results for CIFAR-10 and CIFAR-100 can be found in Table 2. In total, we see that separate training in particular for CIFAR-100 leads to worse results compared to shared training as expected as the binary discriminator and the classifier cannot benefit from each other. An interesting curiosity is that the combination of the separate classifier with the binary discriminator trained in a shared fashion (PLAIN ⊗ SHA DISC) yields almost the same OOD results as SHARED COMBI even though the classifier is significantly worse. Overall, SHARED COMBI performs significantly better when also considering the better classification accuracy which it inherits from SHARED CLASSI.

heading: 5 CONCLUSION
text: In this paper we have analyzed different OOD detection methods and have shown that the simple baseline of a binary discriminator between in-and out-distribution is a powerful OOD detection method if trained in a shared fashion with a classifier. Moreover, we have revealed the inner mechanism of Outlier Exposure and training with a background class which unexpectedly use a scoring function which integrates information from p(i|x) and p(y|x, i). We think that these findings will allow to build novel OOD methods in a more principled fashion.

heading: 6 ETHICS AND REPRODUCIBILITY STATEMENT
text: In this paper we provide an explanation for the inner workings of established OOD detection methods and propose a novel OOD detection method based on these considerations which outperforms OE in terms of OOD performance and test accuracy. The final goal is to have more trustworthy classifiers. One could criticize that the focus on OOD FPR/AUC performance and test accuracy covers just certain aspects and other aspects like calibration of the classifiers, fairness, robustness to corruptions or adversarial attacks play an important role, too. However, apart from the usual dual use problem we see only positive societal aspects of our paper, as it leads to more trustworthy ML methods.
We discuss the problematic situation with the retracted 80 Million Tiny Images (Torralba et al., 2008) dataset – which is used by many previous works in the field – in Appendix H and replace the it with OpenImages (Krasin et al., 2017) for training the models in the main paper. For comparability with previous methods, we include evaluations of models trained on 80M in the appendix. We hope that introducing an alternative dataset for natural surrogate OOD training helps the community towards avoiding the retracted dataset in the future, both from an ethical and also a practical perspective, in case 80M becomes fully unavailable.
All experimental details including used hardware are given in Appendix C, and code for training and evaluating out methods as well as weights of the evaluated neural networks are available at https://anonymous.4open.science/r/OOD_BGC_BinDisc-D7FB.

heading: A PROOFS
text: Theorem 1. Two scoring functions f, g are equivalent f ∼= g if and only if there exists a strictly monotonously increasing function ϕ : range(g) → range(f), such that f = ϕ(g).
Proof. Assume that such a function ϕ exists. Then for any pair x, y we have the logical equivalences g(x) > g(y) ⇔ f(x) = ϕ(g(x)) > ϕ(g(y)) = f(y) and g(x) = g(y) ⇔ f(x) = ϕ(g(x)) = ϕ(g(y)) = f(y). This directly implies that the AUCs are the same, regardless of the distributions.
Assume f ∼= g. For each a ∈ range(g), choose some â ∈ g−1(a). For any pair x, y ∈ X , by regarding the Dirac distributions p(x|i) = δx and p(x|o) = δy that are each concentrated on one of the points, we can infer that f(x) > f(y) ⇔ AUCf (p(x|i), p(x|o)) = 1 ⇔ AUCg(p(x|i), p(x|o)) = 1 ⇔ g(x) > g(y) and similarly f(x) = f(y) ⇔ g(x) = g(y). The latter ensures that the function defined as
ϕ : range(g) → range(f) a 7→ f(â) (11)
is independent of the choice of â and that f = ϕ ◦ g, and the former confirms that ϕ is strictly monotonously increasing.
Lemma 1. Two equivalent scoring functions f ∼= g have the same FPR@qTPR for any pair of inand out-distributions p(x|i), p(x|o) and for any chosen TPR q.
Proof. We know that a function ϕ as in Theorem 1 exists. Then for any pair x, y, we have the logical equivalences
g(x) > g(y) ⇔ f(x) = ϕ(g(x)) > ϕ(g(y)) = f(y) (12)
and
g(x) = g(y) ⇔ f(x) = ϕ(g(x)) = ϕ(g(y)) = f(y) . (13)
This directly implies that the FPR@qTPR-values are the same, for any p(x|i), p(x|o) and q.
Lemma 2. Assume that p(x|i) and p(x|o) can be represented by densities and the support of p(x|o) covers the whole input domain X . Then p(x|i)p(x|o) ∼= p(x|i)p(x|i)+λp(x|o) for any λ > 0.
Proof. The function ϕ : [0,∞] → [0, 1] defined by ϕ(x) = xx+λ (setting ϕ(∞) = 1) fulfills the criterion from Theorem 1 of being strictly monotonously increasing. With
ϕ ( p(x|i) p(x|o) ) =
p(x|i) p(x|o)
p(x|i) p(x|o) + λ p(x|o) p(x|o)
= p(x|i)
p(x|i) + λp(x|o) (14)
for p(x|o) ̸= 0 and ϕ (
p(x|i) 0 ) = ϕ(∞) = 1 = p(x|i)p(x|i)+λ·0 , the equivalence follows.
Lemma 3. Assume that p(x|i) can be represented by a density. Then p(x|i) ∼= p(x|i)p(x|i)+λ for any λ > 0.
Proof. This is a special case of Lemma 2, by setting p(x|o) = 1 = pUniform(x).
Theorem 2. The predictive distribution pf∗(y|x) of the Bayes optimal classifier f∗ minimizing the expected confidence loss is given for y ∈ {1, . . . ,K} as
pf∗(y|x) = p(i|x)p(y|x, i) + 1
K
( 1− p(i|x) ) . (8)
Proof. Minimizing the loss of Outlier Exposure given in Eq. (7) means solving the optimization problem
min pf (·|x)
− p(i|x) · K∑
k=1
p(k|x, i) · log pf (k|x)− (1− p(i|x)) · K∑
k=1
1
K · log pf (k|x)
subject to pf (k|x) ≥ 0 for each k ∈ {1, . . . ,K} K∑
k=1
pf (k|x) = 1 ,
(15)
where pf (·|x) is the model’s K-dimensional prediction. For p(i|x) = 0 or p(k|x, i) = 0, the optimalities of the respective terms are easy to show (applying the common conventions for 0 log 0), so we assume that tose are non-zero. The Lagrange function of the optimization problem is
L(pf (·|x), α, β) = −p(i|x) · K∑
k=1
p(k|x, i) · log pf (k|x)− (1− p(i|x)) · K∑
k=1
1
K · log pf (k|x)
− K∑
k=1
αkpf (k|x) + β ( −1 +
K∑ k=1 pf (k|x)
) ,
(16)
with β ∈ R and α ∈ RK+ . Its first derivative with respect to pf (k|x) for any k is ∂L
pf (k|x) = −p(i|x) · p(k|x, i) 1 pf (k|x) − (1− p(i|x)) · 1 K
1
pf (k|x) − αk + β
= −s K(k|x) pf (k|x)
− αk + β , (17)
where we set sK(k|x) := p(i|x)p(k|x, i) + 1K ( 1 − p(i|x) ) . The second derivative is a positive diagonal matrix for any point of its domain, therefore we find the unique minimum by setting (17) to zero, i.e. at
pf (k|x) = sK(k|x) β − αk . (18)
The dual problem is hence the maximization (with αk ≥ 0) of
q(α, β) = −p(i|x) · K∑
k=1
p(k|x, i) · log s K(k|x) β − αk
− (1− p(i|x)) · K∑
k=1
1 K · log s K(k|x) β − αk
− K∑
k=1
αk sK(k|x) β − αk + β
( −1 +
K∑ k=1 sK(k|x) β − αk
)
= K∑ k=1 sK(k|x) ( − log sK(k|x) + log(β − αk) +
β β − αk − αk β − αk
) − β ;
here, α only appears in log(β − αk) which has a positive factor sK(k|x), so α = 0 maximizes the expression. Noting ∑K k=1 s
K(k|x) = 1, what remains is q0(β) = 1 + log(β) −∑K k=1 s
K(k|x) log sK(k|x) − β, which is maximized by β = 1. This means that the dual optimal pair is pf (k|x) = sK(k|x), (β = 1, α = 0). Slater’s condition (Boyd et al., 2004) holds since the feasible set of the original problem is the probability simplex. Thus, pf∗(·|x) = sK(x) is indeed primal optimal.

heading: B CONFIDENCE LOSS MODELS AND MODELS WITH A BACKGROUND CLASS OR
text: A BINARY DISCRIMINATOR ARE ONLY EQUIVALENT AFTER s3 IS APPLIED
Seeing that for both in-distribution accuracy and OOD detection, OE models trained with confidence loss, models with background class and shared classifier/discriminator combinations behave very
similarly, the question arises if the training methods themselves lead to equivalent models. One idea might be that and effect of the confidence loss on the degree of freedom from logit translation invariance could be unfolded to obtain a K+1-dimensional output that contains the same information as a classifier with background class or with and additional binary discriminator output (the latter two are indeed equivalent). This is not the case, as the following example that in certain situations, the s1 and s2 scores of background class models and classifier/discriminator combinations are able to separate in- and out-distribution, while the s3 score and the equivalent confidence loss/OE models cannot.

heading: B.1 EURO COIN CLASSIFIER
text: As an example where the mentioned non-equivalence would occur, we hypothetically regard the task of classifying photos of 1-Euro coins by the issuing country. Each C1 coin features a common side that is the same for each country and a national side that pictures a unique motive per country. We assume that one side is visible on each photo, and that the training dataset of size 2mK is balanced, consisting of 2m coin photos with label c for each country c ∈ {1, . . . ,K}, where m photos show the common side and the other m photos show the informative national side for each country c.
It is easy to see that the Bayes optimal classifier trained with cross-entropy loss on this dataset predicts 100% for the respective country c when shown a photo of the national side of a C1 coin, and predicts 1/K for each country when shown the common side of a C1 coin.
Now we compare the behaviour of the different methods given a training out-distribution of poker chips images which are clearly recognizable as not being C1 coins.
A K-class model trained with confidence loss (Lee et al., 2018a) will not make a difference between common side coin images and poker chip images, and in the Bayes optimal case, it will predict the uniform class distribution in both cases. This does not only hold for the prediction of a hypothetical Bayes optimal model: assuming full batch gradient descent and identical sets of m common side training photos for each class, the loss for a common side input is the same as the loss for a poker chip.
On the other hand, a binary discriminator will easily distinguish between poker chips and C1 coins, no matter which side of the coin is shown. The same holds for a model with background class: the score of the class K + 1 will be close to 1 for chips and close to 0 for C1 coins.
We conclude that in the described situation, models trained with confidence loss/outlier exposure are not able to sufficiently distinguish in- and out-distribution, while the s1 scoring function of a classifier with background class or a binary discriminator is suitable for this task.
With the s2 scoring function, the background class model gives us s2(x) = maxk=1,...,K pf (k|x), and thus (1−pf (K+1|x))K ≤ s2(x) ≤ 1−pf (K+1|x), which means that if pf (K+1|x) is sufficiently large for in-distribution inputs and sufficiently small for out-of-distribution inputs, s2 is able to distinguish them independent of inconclusiveness in the first K classes. Similarly, s2 applied to a binary discriminator with a classifier (shared trained or not) will be able to distinguish common sides of coins and poker chips.
With s3, on the other hand, common sides of coins and poker chips can no longer be separated. For a classifier/discriminator pair, as defined above, s3(x) = pd(i|x) [
max y=1,...,K
pc(y|x, i) − 1
K
] + 1
K .
If on the common side of a coin the classifier predicts uniform 1K , we have s3(x) = 1 K no matter what the discriminator pd(i|x) predicts. On poker chips with discriminator prediction pd(i|x) = 1, we also get s3(x) = 1. For background class models, s3(x) = max
k=1,...,K pf (k|x) +
1
K pf (K + 1|x)
also yields 1K for a common side where the prediction over the K in-distribution classes is uniform and for a poker chips, where pf (K + 1|x) = 1. The fact that in this coin scenario when scored with s3, background class and classifier/discriminator combinations have the same problem as confidence loss/OE is not surprising considering their equivalence shown in Theorem 2.

heading: C EXPERIMENTAL DETAILS

heading: C.1 TRAINING
text: For training our models, we build upon the code of Hendrycks et al. (2019a) which they have available at https://github.com/hendrycks/outlier-exposure and borrow their general architecture and training settings. Concretely, we use 40-2 Wide Residual Network (Zagoruyko & Komodakis, 2016) models with normalization based on the CIFAR datasets and a dropout rate of 0.3. They are trained for 100 epochs with an initial learning rate of 0.1 that decreases following a cosine annealing schedule. Unless mentioned otherwise, each training step uses a batch of size 128 for the in-distribution and a batch of size 256 for the training out-distribution. The optimizer uses stochastic gradient descent with a Nesterov momentum of 0.9. Weight decay is set to 5 · 10−4. The deep learning framework we use is PyTorch (Paszke et al., 2019), and for evaluating we use the scikit-learn (Pedregosa et al., 2011) implementation of the AUC. Our code is available at https://anonymous.4open.science/r/OOD_BGC_BinDisc-D7FB.
For evaluating the Mahalanobis detector, we use the code by the authors of Lee et al. (2018b) provided at https://github.com/pokaxpoka/deep_Mahalanobis_detector. The input noise levels and regression parameters are chosen on the available out-distribution OpenImages and are 0.0014 for CIFAR-10 and 0.002 for CIFAR-100.
All experiments were run on Nvidia V100 GPUs of an internal cluster of our institution, using up to 4 GB GPU memory (batch sizes in:128/out:256), with no noticeable difference between ours and the compared OE Hendrycks et al. (2019a) runs.

heading: C.2 DATASETS
text: We train our models with the train splits of CIFAR-10 and CIFAR-100 Krizhevsky & Hinton (2009) (MIT license) which each consist of 50,000 labeled images, and evaluate on their test splits of 10,000 samples. As training out-distribution we use OpenImages v4 (Krasin et al., 2017) (images have a CC BY 2.0 license); the training split that we employ here consists of 8,945,291 images of different sizes, which get resized to 32× 32 pixels, and we test on 10,000 from the official validation split. For training with 80 Million Tiny Images (80M) (Torralba et al., 2008) in Appendix H (no license, see links in Appendix H), we use data from the beginning of the sequentialized dataset, and evaluate on a test set of 30,080 images starting at index 50,000,000. A subset of CIFAR images contained in 80M is excluded for training and evaluation. Further image datasets used for evaluation are SVHN (Netzer et al., 2011) (free for non-commercial use) with 26,032 samples, LSUN (Yu et al., 2015) Classroom (no license) with 300 samples, and CelebA (Liu et al., 2015) (available for non-commercial research purposes only) with 19,962 test samples. Uniform and Smooth Noise (Hein et al., 2019) are sampled, the latter by generating uniform noise and smoothing it using a Gaussian filter with a width that is drawn uniformly at random in [1, 2.5]. Each datapoint is then shifted and scaled linearly such that the minimal and maximal pixel values are 0 and 1, respectively. For both noises, we evaluate 30,080 inputs.

heading: D RELATED WORK ON OOD DETECTION
text: Out-of-distribution detection has been an important research area in recent years, and several approaches that are fitted towards different training and inference scenarios have been proposed.
One seemingly obvious line of thought is to use generative models for density estimation to differentiate between in- and out-distribution (Bishop, 1994; Nalisnick et al., 2019; Ren et al., 2019; Nalisnick et al., 2019; Xiao et al., 2020). Recent methods to a certain extent overcome the problem mentioned in Nalisnick et al. (2019) that generative models can assign higher likelihood to distributions on which they have not been trained. Another line of work are score-based methods using an underlying classifier or the internal features of such a classifier, potentially combined with a generative model (Hendrycks & Gimpel, 2017; Liang et al., 2018; Lee et al., 2018c; Hendrycks et al., 2019a; Hein et al., 2019). One of the most effective methods up to now is Outlier Exposure (Hendrycks et al., 2019a) and work building upon it (Chen et al., 2021; Meinke & Hein, 2020; Mohseni et al., 2020; Augustin et al., 2020; Papadopoulos et al., 2021; Thulasidasan et al., 2021) where a classifier is trained on
the in-distribution task and one enforces low confidence as proposed by Lee et al. (2018a) during training on a large and diverse set of out-of-distribution images (Hendrycks et al., 2019a) which can be seen as a proxy of all natural images. This approach generalizes well to other out-distributions. Recently, NTOM (Chen et al., 2021) has achieved excellent results for detecting far out-of-distribution data by adding a background class to the classifier which is trained on samples from the surrogate out-distribution that are mined such that they show a desired hardness for the model. At test time, the output probability for that class is used to decide if an input is to be flagged as OOD. Their ATOM method does the same while also adding adversarial perturbations to the OOD inputs during training. Even though it has been claimed that new approaches outperform Hendrycks et al. (2019a), up to our knowledge this has not been shown consistently across different and challenging test out-of-distribution datasets (including close and far out-of-distribution datasets). Below, we discuss some other recently proposed approaches that build upon different premises on the data available during training.
Hendrycks et al. (2019b) do not use any OOD data during training and instead teach the model to predict whether an input has been rotated by 0°, 90°, 180° or 270°. For inference, they use the loss of this predictor as an OOD score, and add this score to classifier output entropy, which behaves very similar to classifier confidence. Similar to our methods, they also use shared representations and the combination of the in-distribution classifier with a dedicated OOD detection score. If one interprets their rotation predictor loss as being an estimator of log p(o|x) for some implicit out-distribution, their scoring function coincides with our s2 scores.
Golan & El-Yaniv (2018) learn a similar transformation detector (with Dirichlet statistics collected on the in-distribution replacing ground truth labels) and use it directly to detect OOD samples without using in-distribution class information.
Winkens et al. (2020) fit for each class a normalized Mahalanobis detector on the activations of a model trained with SimCLR ands a classification head on only the in-distribution with smoothed labels. They describe their method as applying class-wise density estimation in the feature space, where the normalized Mahalanobis distance is equivalent to a Gaussian density for each class.
Roy et al. (2021) treat an interesting application of flagging unseen skin diseases, making use of class labels that are also available for their training OOD data, which contains diseases that are different from both the in-distribution diseases and the unseen diseases. This allows them to do fine-grained OOD detection by regarding the sum over all OOD classes which for their dataset shows large improvement over methods that treat the training out-distributuion as one class. They gain additional slight improvements by combining this with a coarse grained binary loss that treats the sum over all in-distribution class probabilities as p(i|x) and the sum over all OOD classes as p(o|x). They show that this method can be combined with various representation learning approaches in order to improve their detection of unknown diseases.
Tack et al. (2020) introduce distribution shifting transformations into SimCLR training. Those are transformations that are so strong that the resulting samples can be considered as OOD and as negatives w.r.t. the original in the SimCLR loss. Similarly to Hendrycks et al. (2019b) and Golan & El-Yaniv (2018), they also train a head that classifies the applied transformation. In a version extended to using in-distribution labels, they consider samples from the same class and with the same transformation as positives, and samples where either is different as negatives. With this method, they obtain OOD detection results that significantly improve over standard classifier confidence, without using any training OOD dataset.
Liu & Abbeel (2020) derive a contrastive loss from Joint Energy Based Model training (Grathwohl et al., 2020) and train it together with cross-entropy on the in-distribution in order to obtain classifiers whose logit values can be transformed into energies that are equivalent as OOD scoring functions to in-distribution density. They show that using these energies yields some improvements over previous density estimation approaches, and that also the classifier confidences show moderately improved OOD detection when compared to standard training.
Liu et al. (2020) propose another energy based method which incorporates surrogate OOD data during training. We analyse this method in detail in Appendix F, where we show that their Bayes optimal OOD detector is equivalent to the binary discriminator between in- and out-distribution.
Li & Vasconcelos (2020) use the same training method as OE and show that careful resampling of the training out-distribution resembling hard negative mining can reduce its size and therefore lead to a more resource effective training OOD dataset, while the resulting models reach similarly good OOD detection performance.

heading: E EXPERIMENTS COMPARING DENSITY ESTIMATION AND BINARY DISCRIMINATORS

heading: E.1 UNLABELED IN-DISTRIBUTION DATA AVAILABLE FOR TRAINING
text: We want to answer the following questions: How does estimating the in-distribution density compare to simply employing a binary discriminator between the in-distribution and uniform noise with respect to the task of out-of-distribution detection? Can other density based models be substituted for potentially easier to handle binary discriminators against a suitable (semi-)synthetic out-distribution? As generative models, we use a standard likelihood VAE, a likelihood PixelCNN++ and additionally compare with a Likelihood Regret VAE (Xiao et al., 2020). The binary classifier is trained to separate real data from uniform noise, thus none of the methods presented in this section make use of 80M or any other surrogate distribution. The results for OOD detection in terms of AUC for all methods are presented in Table 3.
Comparing the OOD detection performance of the binary discriminator trained against uniform noise with both VAE models, we asses that neither model is suitable for reliably detecting inputs from unknown out-distributions.
Following the theoretical analysis from the previous sections, the likelihood models and our binary classifier are able to perfectly separate the in-distribution data from uniform noise. This is expected as those methods are trained on that particular task of separating CIFAR-10 from uniform noise, whereas the LH Regret VAE with modified train objective has worse performance on uniform noise. It appears as if the training objective of the binary classifier seems to be too easy as the training and validation loss converge to almost zero in the first few epochs of training. However, the ability to separate uniform noise from real images does not generalize to other test distributions as both methods fail to achieve good out-of-distribution detection performance on the other test distributions. We note that while the score features from the likelihood models and the binary classifier are in expectation equivalent, both methods behave quite different on the test datasets (except for uniform noise). This is not surprising, as the probability of drawing real images from the uniform distribution is so small that neither training method properly regularizes the model’s behaviour on those particular image manifolds. Thus the results are artifacts of random fluctuation and no method clearly outperforms the other one, for example the binary classifier is better at separating CIFAR-10 from SVHN whereas the likelihood VAE significantly outperforms the binary classifier on LSUN. Similar fluctuations also exist between the two variational auto encoders and PixelCNN++, but in conclusion none of those methods is able to generalize to more specialized unseen distributions.

heading: E.2 LIKELIHOOD RATIOS AS A BINARY DISCRIMINATOR
text: In Section 3.1, we discussed that for the Bayes optimal solutions of their training objectives, the ratio of the likelihoods of two density estimators for different distributions is as an OOD detection scoring function equivalent to the prediction of a binary discriminator between the two distributions. In order to find out which role this equivalence plays in practise, we train a binary discriminator between CIFAR-10 as in-distribution and the background distribution obtained by mutating 10% of the pixles of in-distribution images as described in Ren et al. (2019). In Table 4, we compare the OOD detection performance of this discriminator with likelihood ratios estimated with PixelCNN++ (Salimans et al.,
2017) as trained with the code of Ren et al. (2019) setting L2 regularization as 10, and with the numbers taken from Xiao et al. (2020) given for their VAE models. Even though we use the code and hyperparameter settings of Ren et al. (2019), the AUC we obtain for SVHN as out-distribution differs significantly from their reported 93.1%. We observe that all three methods struggle with detecting inputs from several out-distributions and thus we do not consider them as reliable out-of-distribution detection methods.

heading: MODEL MEAN SVHN LSUN UNI SMOOTH C-100 OPEN CELEBA 80M

heading: F ENERGY BASED OOD DETECTION IN TERMS OF BINARY DISCRIMINATORS
text: With Energy Based OOD Detection (Liu et al., 2020), we exhibit another surprising case of the equivalence to Binary Discriminators to an OOD detection method which is based on ideas that are quite different from those of the other extensively discussed methods. This method is based on the premise that the logits fθ(x) of a classifier can be used to define an energy (here we ignore a potential temperature factor which as Liu et al. (2020) find can in good conscience be set to one)
Eθ(x) = − log K∑ l=1 efθ(l|x) (19)
that the model assigns to the input, which has been proposed by LeCun et al. (2006); Grathwohl et al. (2020). Ideally, this energy would be equivalent to the probability density of the in-distribution via
log p(x|in) = −Eθ(x)− Z where Z = ∫ z∈[0,1]D e−Eθ(z)dz . (20)
However, since the integral over the whole image domain is intractible, it is not possible to effectively decrease −Eθ on the in-distribution directly while also controlling Z. Naively training the classifier to have high energy on random inputs which would mean uniform noise is of course not a solution, since the model easily distinguishes the noise, and it is very unlikely to encounter any at least vaguely real images within finite time. Thus, Liu et al. (2020) rather use a surrogate training out-distribution of natural images which they increase the energy on during training; for their experiments, they take 80 Million Tiny Images, for which we compare their models with several other methods in Appendix H. Simultaneously, they minimize the standard classifier cross-entropy on the in-distribution. In order to avoid infinitely small potential losses, their training objective uses two margin hyper-parameters min < mout and reads
E (x,y)∼p(x,y|i) − log pθ(y|x) + λ · (
E (x)∼p(x|i) max {0, Eθ(x)−min}2 + E w∼p(w|o)
max {0,mout − Eθ(w)}2 ) (21)
with
log pθ(y|x) = log efθ(y|x)∑K l=1 e fθ(l|x) = fθ(y|x) + Eθ(x) . (22)
Note that their λ does not balance between in and out by depending on a prior on p(i), but it balances the energy regularization compared to the classifier cross-entropy loss. Theorem 3. The Bayes optimal logit output f∗θ (x) of the energy based OOD detection model minimizing the expected loss on an input x yields class probabilities p∗θ(k|x) = p(k|x, i) that are optimal for a standard classifier with cross-entropy loss and simultaneously fulfills
−E∗θ (x) = p(i|x) · (mout −min)−mout . (23)
Proof. Our goal is to find for a given input x the model output fθ(x) that minimizes the expected loss, assuming that we know the probabilities p(y|x, i) and p(i|x). This expected loss is
−p(i|x) · K∑
k=1
p(k|x, i) log pθ(k|x) (24)
+ λ · ( p(i|x)max {0, Eθ(x)−min}2 + (1− p(i|x))max {0,mout − Eθ(x)}2 ) . (25)
First, we note that if a certain E∗θ (x) minimizes the expected energy loss to λ · ( p(i|x)max {0, E∗θ (x)−min} 2 + (1− p(i|x))max {0,mout − E∗θ (x)} 2 ) , (26)
and if some f ♯θ(x) minimizes the expected CE loss (note that its minimization is independent of the positive factor p(i|x)) to
− K∑
k=1
p(k|x, i) log e f♯θ(k|x)∑K
l=1 e f♯θ(l|x)
, (27)
with corresponding E♯θ(x) = − log ∑K i=1 e f♯θ(x)[i], then the logit output with −E∗θ (x)+E ♯ θ(x) added to each component has the energy
Eθ(x) = − log K∑ i=1 ef ♯ θ(x)[i]−E ∗ θ (x)+E ♯ θ(x) = − log
( e−E ∗ θ (x)+E ♯ θ(x) ·
K∑ i=1 ef ♯ θ(x)[i]
) (28)
= E∗θ (x)− E ♯ θ(x)− log K∑ i=1 ef ♯ θ(x)[i] = E∗θ (x) , (29)
which means that this f∗(x) minimizes the expected energy loss, and also fulfills
pθ(x)[y] = ef
♯ θ(x)[y]−E ∗ θ (x)+E ♯ θ(x)∑K
l=1 e f♯θ(x)[l]−E ∗ θ (x)+E ♯ θ(x)
= ef ♯ θ(x)[y]∑K
l=1 e f♯θ(x)[l]
, (30)
i.e. has the same probability predictions as f ♯ and thus also minimizes the expected CE loss. This means that both can be optimized independently.
As we’ve seen before, the optimal pθ(k|x) for the expected CE loss is pθ(k|x) = p(k|x, i). Thus we independently minimize the expected energy loss
p(i|x)max {0, Eθ(x)−min}2 + (1− p(i|x))max {0,mout − Eθ(x)}2 . (31)
The first derivative with respect to Eθ(x) is 2 · (1− p(i|x)) · (Eθ(x)−mout) for Eθ(x) < min , 2 · (p(i|x) · (Eθ(x)−min) + (1− p(i|x)) · (Eθ(x)−mout)) for min < Eθ(x) < mout , 2 · p(i|x) · (Eθ(x)−min) for mout < Eθ(x) .
(32)
which simplified is < 0 for Eθ(x) < min , 2 · (Eθ(x) + p(i|x) · (mout −min)−mout) for min < Eθ(x) < mout , > 0 for mout < Eθ(x) .
(33)
Here, for simplicity we again make the reasonable assumption that in- and out-distribution have full support, i.e. 0 < p(i|x) < 1. (If we do not want to make the full support assumptions, for p(i|x) = 0, any energy ≥ mout would be optimal, and for p(i|x) = 1, any energy ≤ min would be optimal.) A the margin Eθ(x) = min, the derivatives for Eθ(x) < min and min < Eθ(x) < mout coincide as 2 · (1− p(i|x)) · (min −mout) < 0, which means that the minimizer is > min. Similarly, we see that the minimizer is < mout.
As the second derivative is positive, by solving where the derivative is zero, we find that the optimal negative energy (which is the score which they use for OOD detection) is
−E∗θ (x) = p(i|x) · (mout −min)−mout . (34)
This is a strictly monotonously increasing function in p(i|x). By our Theorem 1, we conclude that the negative energy score they obtain from their method is (for the Bayes optimal model that minimizes the loss on the training distributions) equivalent to p(i|x). Corollary 2. At their Bayes optima, the Energy Based OOD Detection criterion is equivalent to that of a binary discriminator between the training in- and out-distributions.
Note that while the classifier and energy loss terms can be optimized independently, the model is trained for both tasks simultaneously, which means that similar synergies to those we observe in 2 might contribute to the good performance of this method. Our empirical evaluation of energy based models in Appendix H confirms that their similar behaviour to the binary discriminator between inand training-out-distribution indeed holds in practice.

heading: G EVALUATIONS WITH THE AUC DETECTION METRIC
text: Complementing the evaluations of the FPR@95TPR metric presented in the main paper, Tables 5 and 6 show the AUC (AUROC) values of the same models as in Tables 1 and 2, respectively. The observations on the strngths of the different methods and scoring functions discussed in Section 4 also hold for the AUC evaluations, which is not surprising since the AUC and FPR@95TPR metrics are closely related.

heading: MODEL ACC. MEAN SVHN LSUN UNI SMOOTH C-10 OPENIM CELA 80M

heading: H DISCUSSION OF THE CHOICE OF OPENIMAGES AND EXPERIMENTAL RESULTS WITH 80 MILLION TINY IMAGES AS TRAINING OUT-DISTRIBUTION
text: Since the 80 Million Tiny Images (Torralba et al., 2008) dataset was retracted by the authors – their statement can be read at http://groups.csail.mit.edu/vision/TinyImages/1 – as a reaction to Birhane & Prabhu (2021) exposing the presence of offensive and prejudicial images in the dataset, a good "surrogate surrogate" training out-distribution for the CIFAR-10/CIFAR-100 in-distribution has to our knowledge not yet been established.
Our experience confirms the assessment which the authors of Hendrycks et al. (2019a) make in their discussion section 5: the surrogate training out-distribution should consist mainly of natural images, should have a high semantic diversity, and the number of samples in the dataset should be large. We also observe that it is vital that there are no easy to detect details that separate the training in- and out-distributions from each other, as for example using a different resizing interpolation method would lead to ’overfitting’ on such features with 100% train accuracy of the Binary Discriminator and near zero loss (apart from that of the in-distribution classifier) for OE and BGC, with no generalization to the test OOD datasets. OpenImages fulfills the mentioned criteria, and in our judgement does not contain ethically problematic images. It is, however, to be noted that CIFAR was sourced as a subset of 80M Tiny Images, see Krizhevsky & Hinton (2009) and https://www.cs.toronto.edu/~kriz/cifar.html, which explains the somewhat better results with 80M as training OOD dataset that we observe below in this section. Our results on the theoretical relations between the different methods and scoring functions do not depend on the choice of the training OOD dataset , and give reason to expect that our experimental confirmations of these relations will also hold for even better suited surrogate OOD datasets that we hope will be found in future works.
In the main paper, we employ OpenImages (Krasin et al., 2017) as a replacement, and for completeness and comparison to the originals of OE, Energy Based OOD detection and NTOM/ATOM, below we show and discuss the results obtained with the retracted 80M dataset which is commonly used in OOD detection literature.
The training procedure of our methods again follows that of OE, and for the 80M experiments we do not add AutoAugment, in order to stay as close as possible to the original. For the established methods we compare to, we use the original weights of their published models; the Plain and Outlier Exposure (OE) models were retrieved from the repository of the authors of OE (https://github. com/hendrycks/outlier-exposure), and for NTOM and ATOM (Chen et al., 2021) we use their code https://github.com/jfc43/informative-outlier-mining to evaluate their DenseNet models (their best models). We finetune the Mahalanobis detector on 80M with the same procedure as described above; the optimal input noise level for 80M is 0.0005 for both CIFAR in-distributions. We evaluate the Energy Based models fine-tuned on 80M which the authors of Liu et al. (2020) provide at https://github.com/wetliu/energy_ood with their evaluation code.
For CIFAR-10, as already seen with OpenImages as training out-distribution, the OOD detection performance of SHARED CLASSI is much better than that of the plain classifier. .In fact SHARED BINDISC has already very good OOD performance with a mean FPR of 7.56 and mean AUC of 97.90 which is only improved by considering scoring function s2/s3 in the combination of SHARED BINDISC and SHARED CLASSI which yields the best performance in classification accuracy and mean AUC.
The classifier with 80M as background class (BGC) works very well for all scoring functions and reaches SOTA performance similar to/better than OE. Both BGC/SHARED COMBI with s2/s3 perform particularly well on the challenging close out-distributions CIFAR-100 and OpenImages (which are the data sets where NTOM/ATOM perform significantly worse). However, as already observed with OpenImages as training out-distribution the differences of the methods are minor both in terms of classification accuracy.
1Archived statement: https://web.archive.org/web/20210415160225/http://groups. csail.mit.edu/vision/TinyImages/
The results for CIFAR-100 are again qualitatively similar to those for CIFAR-10. NTOM/ATOM now show worse mean AUC results which are mainly due to worse results for the close out-distributions CIFAR-10 and OpenImages, but better mean FPR@95%TPR, which is explained by their excellent detection of LSUN Classroom, where the other methods work quite well in terms of AUC but still make quite many errors at the 95%TPR threshold. OE again achieves comparable OOD results to the other evaluated methods. As the theoretical considerations we presented in Appendix F suggest, the energy based OOD detector achieves good performance that is comparable that to the other methods. Our SHARED COMBI s2/s3 performs best in terms of OOD performance and test accuracy but again differences are minor.
The conclusions are similar to those drawn for OpenImages in the main paper. Comparing the results, it is clear that 80M still works somewhat better than OpenImages, so for the CIFAR in-distributions, the search for an ethically acceptable replacement of 80M that allows for equal or improved results continues. The consistent similarities between the examined methods over the different datasets suggest that the methods and scoring functions would be similarly viable with such an alternative training OOD dataset.

heading: I EXPERIMENTS WITH SVHN AS TRAINING OUT-DISTRIBUTION
text: In order to examine the effect of a training out-distribution that relatively far away from the indistribution, we show experiments with SVHN as out-distribution in Tables 9 and 10. The OOD detection performance of these methods is much worse than with the closer OpenImages and 80M training out-distributions. In most cases, combinations s2 and s3/OE which implicitly or explicitly use the classifier confidence lead to better OOD detection than using the binary discriminator/s1. The inconsistent behaviour over the different test out.distributions of the methods that use SVHN as training out-distribution can be explained by the easiness of the discrimination task, which manifests itself in the fact that BGCs1 and SHARED BINDISC reach perfect FPR and AUC metrics. This indicates a form of overfitting to this specific out-distribution, without consistent generalization to unseen distributions which do not have characteristic features that are similar to those appearing in SVHN images.
We also do not observe a beneficial effect on test accuracy for the methods that use SVHN compared to plain, which is to be expected as the representations learned from SVHN are hardly useful for the in-distribution task.

heading: J EXPERIMENTS WITH RESTRICTED IMAGENET AS IN-DISTRIBUTION
text: In addition to the results for CIFAR-10 and CIFAR-100 shown in the main paper, here we provide results for Restricted ImageNet. Restricted ImageNet, introduced by Tsipras et al. (2019), consists of 9 classes, where each individual class is a union of multiple ImageNet (Deng et al., 2009) classes, for example the Restricted ImageNet class ’dog’ contains all dog breeds from ImageNet. As Restricted ImageNet only contains animal classes, the union over all its classes does not cover the entire ILSVRC2012 dataset (Russakovsky et al., 2015), which allows us to use the remaining ILSVRC2012 classes as training out-distribution. Like we did for the CIFAR experiments, we train a plain classifier, an Outlier Exposure model, a background class model and a shared discriminator/classifier and evaluate them with the different scoring functions. The model is a ResNet50 and we use random cropping and flipping as data augmentation during training. The results in terms of FPR@95%TPR and AUC can be found in Table 11.
Once again, we see that SHARED CLASSI has relatively good OOD detection performance and clearly beats the plain classifier from standard training. Again, we see that Outlier Exposure Hendrycks et al. (2019a), training with background class and shared training of classifier and binary discriminator perform similarly. In terms of accuracy, the shared model benefits most from the added unlabelled data compared to plain training. At 95% TPR, the sharedly trained binary discriminator and its combinations SHARED COMBI s2 and SHARED COMBI s2 detect flower images significantly better than the other approaches which results in the best mean FPR@95%TPR compared to the other methods, while in terms of AUC, OE has a slight advantage.

heading: AUC

heading: FPR@95%TPR

heading: IN-DISTRIBUTION: RESTRICTED IMAGENET
text: K THE EFFECT OF VARYING λ
We investigate the effect of choosing the training hyperparameter λ, which is the factor of the respective loss on the out-of-distribution samples and represents p(o)p(i) during training. We evaluate models trained with Outlier Exposure Hendrycks et al. (2019a), background class and shared training of binary discriminator and classifier, all scored with s3 (the implicit scoring function of OE). Note that in Section 4, the OE, BGC and SHARED models trained with λ = 1.0.
In Tables 12 and 13 we see that for CIFAR-10 the differences between different choices of λ are minor with no clear favorite, but setting λ = 2.0 tends to be too high. For CIFAR-100, the differences are much larger. Here, choosing λ too small can have a severe negative effect on the detection of the otherwise relatively to detect far out-distributions SVHN, Uniform Noise and Smooth Noise. Regarding the numbers for both in-distribution datasets, using λ = 1 is a considerate default choice.

heading: L STATISTICS OVER FIVE RUNS WITH DIFFERENT SEEDS

Review summaries:
The paper analyzes different OOD detection methods and show that even if the formulation for many OOD methods were different, the binary discrimination is equivalent to those different types of methods when the rankings induced by Bayes optimal classifier are analyzed. They also derive implicit scoring functions for confidence loss of OE and for BGC and compare them with “optimal” scoring functions. They also claim that training binary discriminator (in-dist vs out-dist) in a shared fashion along with standard classifier reaches state-of-the-art OOD performance. 

In this paper, the authors bring together recent work in the OOD detection problem and provide to the reader a sound mathematical framework to understand similarities and differences among these. The framework is based on the equivalence class of scoring function under the AUC / FPR@qTPR metrics and bayes optimality. The tools introduced in the paper allow the authors to explain why different methods perform largely similarly, when one scoring function should be preferred to others and draw conclusions regarding training with / without label data of the in-distribution set.

The authors aim to to recognize common objectives in OOD detection as well as to identify the implicit scoring functions of different OOD detection methods. They show that binary discrimination between in- and (different) out distributions is equivalent to several different formulations of the OOD detection problem. They find that, when trained in a shared fashion with a standard classifier, this binary discriminator reaches an OOD detection performance similar to that of Outlier Exposure.