Year: 2019

Abstract:
Likelihood from a generative model is a natural statistic for detecting out-ofdistribution (OoD) samples. However, generative models have been shown to assign higher likelihood to OoD samples compared to ones from the training distribution, preventing simple threshold-based detection rules. We demonstrate that OoD detection fails even when using more sophisticated statistics based on the likelihoods of individual samples. To address these issues, we propose a new method that leverages batch normalization. We argue that batch normalization for generative models challenges the traditional i.i.d. data assumption and changes the corresponding maximum likelihood objective. Based on this insight, we propose to exploit in-batch dependencies for OoD detection. Empirical results suggest that this leads to more robust detection for high-dimensional images.

heading: 1 INTRODUCTION
text: Modern neural network models are known to make poorly calibrated predictions (Guo et al., 2017; Kuleshov et al., 2018), and can be highly confident even for unrecognizable or irrelevant inputs (Nguyen et al., 2015; Moosavi-Dezfooli et al., 2017). This has serious implications for AI safety (Amodei & Clark, 2016) in real world deployments, where a model could receive inputs that are beyond its training distribution. Detecting examples that are out of the training distribution becomes a viable solution: when encountering such samples, the model could choose to provide low confidence estimates or even abstain from making predictions (Cortes et al., 2017).
Density estimation is one approach to detecting out-of-distribution (OoD) samples. A likelihoodbased model is trained on the input samples; during evaluation, samples that have low likelihoods are assumed to be out-of-distribution. For high-dimensional inputs (such as images), deep generative models have been able to generate realistic samples as well as achieving good compression capabilities, which indicates high likelihoods on the training distribution (Ballé et al., 2016; Kingma & Welling, 2013; Kingma & Dhariwal, 2018; van den Oord et al., 2016); thus, recent works have considered using deep generative models to detect out-of-distribution samples (Li et al., 2018). However, contrary to popular belief, density estimates by deep generative models are highly inaccurate (Nalisnick et al., 2018). For example, a Glow (Kingma & Dhariwal, 2018) model trained on CIFAR10 gives higher likelihood estimates to SVHN samples than CIFAR10 ones, which makes accurate OoD detection impossible. While alternative statistics based on likelihood estimates have been proposed to alleviate this issue (Choi et al., 2018; Song et al., 2017), they are not able to detect OoD samples consistently.
In this paper, we propose a new statistic to detect OoD samples using deep generative models trained with batch normalization (Ioffe & Szegedy, 2015). We argue that using batch normalization not only improves optimization (as argued in (Kohler et al., 2018; Santurkar et al., 2018)), but also challenges the i.i.d. assumption underlying typical likelihood-based objectives. We show in that the training objective of generative models with batch normalization can be interpreted as maximum pseudo-likelihood over a different joint distribution that does not assume data in the same batch are i.i.d. samples. Empirically, we demonstrate that over this joint distribution, the estimated likelihood of a batch of OoD samples is much lower than that of in-distribution samples. This allows us to propose a permutation test which outperforms existing methods by a significant margin without modifying how the underlying generative model is trained. In particular, we achieve near-perfect performance even on cases such as Fashion MNIST vs. KMNIST, where the likelihood distributions for single samples are nearly identical (see Figure 1, left). While generative models trained with BatchNorm
might not provide state-of-the-art likelihood numbers on the test set, it remains competitive and could be more suited for the OoD detection problem (Kingma & Dhariwal, 2018; Nalisnick et al., 2018).

heading: 2 BACKGROUND
text: Setup Let X = {xi}Ni=1 be a set of N observations; we assume that “in-distribution” samples are drawn i.i.d. from some underlying distribution x ∼ p(x). Our goal is to detect whether a test sample x is “out-of-distribution”; we consider drawing the test samples from an unknown distribution q(x), but we do not have access to samples from q(x) during training. Following definitions in (Hendrycks & Gimpel, 2016; Liang et al., 2017), we define OoD examples as the test samples that have low densities under p(x). We note that samples from q(x) are not necessarily all OoD; for example, if q = p then most samples should not be classified as OoD. Detection of OoD samples is useful for applications such as anomaly detection (Li et al., 2018) and exploration in reinforcement learning (Ostrovski et al., 2017).
Likelihood-based generative models for out-of-distribution detection Likelihood-based models are trained by finding parameters θ such that the corresponding pθ(x) is as close as possible to the training distribution p(x), in terms of Kullback-Leibler divergence (KL):
arg min θ DKL(p(x)‖pθ(x)) = arg min θ Ep(x) [log p(x)− log pθ(x)]
Finding appropriate solutions depends heavily on choosing the right family of (parametrized) probability distributions. In the context of images, deep neural networks have demonstrated good performance. Likelihood-based deep generative models include variational autoencoders (Kingma & Welling, 2013) (where variational lower bounds are optimized), autoregressive models (van den Oord et al., 2016; Salimans et al., 2017), and invertible flow models (Dinh et al., 2016; Kingma & Dhariwal, 2018) (where exact likelihood is optimized).
Given a sample x, we could attempt to test whether it is OoD or not by evaluating its likelihood − log pθ(x). Intuitively, if pθ(x) is sufficiently similar to p(x), OoD samples should have low likelihood under pθ(x). However, this is not the case for some deep generative models (Nalisnick et al., 2018; Choi et al., 2018), where OoD samples are observed to have higher likelihoods than samples from the training distribution p(x) across several datasets and models. For example, stateof-the-art models trained on CIFAR10 (Krizhevsky & Hinton, 2009) assign higher likelihood to SVHN (Netzer et al., 2011) samples than CIFAR10 samples. A similar phenomenon has also been observed by Nalisnick et al. (2018) for models trained on Fashion MNIST (Xiao et al., 2017) (Figure 1 (left)), where images with lower variance across pixels (such as MNIST) are assigned higher likelihoods. This invalidates the assumption that OoD samples are assigned lower likelihoods by existing deep generative models.
To alleviate this issue, Choi et al. (2018) use Watanabe Akaike Information Criterion (WAIC):
−WAIC(x) = −Eθ[log pθ(x)] + Varθ[log pθ(x)] (1) where the expectations are computed using independently trained model ensembles. This method does not assign higher negative WAIC values for OoD samples in some simple cases, but is empirically observed it to be effective for certain datasets and generative models.
Likelihood-based permutation tests In the context of detecting adversarial examples, Song et al. (2017) considered using permutation tests statistics to determine whether an input x′ comes from p(x) or not. One such test statistic uses the rank of pθ(x′) in {pθ(x1), · · · , pθ(xN )}, where {xi}Ni=1 is a (training) dataset of N samples from p(x):
Tperm = T (x ′;x1, . . . ,xN ) , ∣∣∣∣∣ N∑ i=1 I[pθ(xi) ≤ pθ(x′)]− N 2 ∣∣∣∣∣ ∈ [0, N/2 + 1] (2) where I is the indicator function. When Tperm(x) is large, x is assumed to be OoD. This addresses the case where higher likelihood is observed for certain out-of-distribution samples (such as the SVHN vs. CIFAR10 example in Nalisnick et al. (2018)), as both “high-likelihood” and “low-likelihood” samples will have Tperm close to N/2 (because of the absolute value) and be identified as OoD.

heading: 3 OUT-OF-DISTRIBUTION SAMPLES AND MODEL MIS-SPECIFICATION
text: Nalisnick et al. (2018) find it surprising that deep generative models assign higher likelihood to out-of-distribution samples, given their successful generalizing on a test dataset. However, we argue that this is to be expected when the unerlying generative model pθ(x) is mis-specified, and perhaps this is more likely than previously anticipated in the literature.
We consider a simple example where a mis-specified model would overestimate the likelihood of out-of-distribution samples (Figure 1, right). Let p(x) be a uniform mixture of two Gaussians on R1, N (−1.0, 0.01) and N (1.0, 0.01), and pθ(x) = N (µ, σ2) be our model with parameters (µ, σ). The maximum likelihood solution is (µ?, σ?) ≈ (0.0, 1.0), where mode-covering behavior occurs. x = 0 has the largest likelihood under pθ(x), yet it is highly atypical in the original distribution. This is also a failure mode for WAIC as discussed in (Choi et al., 2018).
Given the complexity of high-dimensional image distributions, existing likelihood-based generative models are likely to be mis-specified, which invalidates the use of likelihood estimates to perform OoD detection (White, 1982). Moreover, model selection is often based on the holdout method (Arlot et al., 2010), in which we evaluate log-likelihood over a validation set sampled from p(x), but not over out-of-distribution samples. As we do not know the entropy of p(x), we can never check whether DKL(p(x)‖pθ(x)) ≈ 0 after training. Because of the mode-seeking nature of DKL, an alternative distribution q(x) 6= p(x) can have even lower KL-divergence with pθ(x), i.e., DKL(q(x)‖pθ(x)) DKL(p(x)‖pθ(x)) even if pθ(x) is trained on samples from p(x). In Appendix B, we demonstrate that even more sophisticated tests over log-likelihood, such as likelihood-based permutation tests, cannot detect out-of-distribution samples effectively.

heading: 4 DETECTING OUT-OF-DISTRIBUTION SAMPLES WITH BATCH NORMALIZATION
text: In the following sections, we argue that by taking advantage of batch normalization (BatchNorm), outof-distribution samples can be detected with existing deep generative models. For a batch of inputs z = {zi}bi=1 of batch size b, batch normalization (Ioffe & Szegedy, 2015) performs normalization over the inputs followed by a parametrized affine transformation:
BatchNorm(z; γ, β, ) = z − E[z]√ Var[z] + · γ + β
where γ, β are trainable parameters, and is a hyperparameter for numerical stability. The mean E[z] and variance Var[z] are computed over a single batch in training mode, and over the entire training set in evaluation mode1. For deep generative models using batch normalization, existing literature evaluate the log-likelihood on some validation set in evaluation mode. The role of training mode is generally perceived to accelerate optimization (Kohler et al., 2018; Santurkar et al., 2018), similar to supervised learning.
1This is typically done by keeping an exponential moving average over the batch statistics during training.

heading: 4.1 TRAINING MODE DECREASES LIKELIHOOD OF OOD BATCHES
text: Our central observation is that likelihoods assigned by the model under training mode and evaluation mode are significantly different for OoD samples, but much less so for in-distribution samples, i.e., when we use BatchNorm statistics computed over a single batch. We evaluate log-likelihood (measured in bits per dimension, BPD2) on Fashion MNIST, MNIST, CIFAR and SVHN test sets with several models including RealNVP, VAE and PixelCNN++3. Pre-activation batch normalization layers are used within the residual block for RealNVP and PixelCNN++, and before each convolutional layer for VAE. The datasets are evaluated in both evaluation mode and training mode.
In Table 1 we found that in evaluation mode MNIST samples have smaller BPD than Fashion MNIST for models trained on Fashion MNIST; SVHN samples have smaller BPD than CIFAR10 for models trained on CIFAR10, which agrees with the observations in (Nalisnick et al., 2018). However, as we change from evaluation mode to training mode, the log-likelihood of the in-distribution samples does not change significantly, while that of OoD samples plummets (see ∆ in Table 1). In Appendix C.3, we demonstrate that this sudden decrease in log-likelihood not only happens for samples from other datasets, but also adversarial samples that are able to fool likelihood models and likelihood-based permutation tests. This empirically suggests that simply by using training mode during evaluation, we are able to consistently detect a batch of out-of-distribution samples. We further note that no special modifications is made over the training procedure, and no additional OoD datasets are required.
0.0
0.1
0.2
0.3
0.4
0.5
De ns
ity (u
no rm
al ize
d)
pf(x) p(x) q(x) (eval) q(x) (train)

heading: 4.2 EXPLAINING THE EFFECTIVENESS OF BATCH NORMALIZATION
text: Why is batch normalization effective at detecting OoD batches while other likelihood-based generative models (e.g., Glow trained with ActNorm) fail? First we provide an example to illustrate why training mode and evaluation mode provide different likelihood estimates for OoD distributions. Then we argue that with training mode, the learned generative model no longer assumes samples are i.i.d., which differs from models without BatchNorm.

heading: 4.2.1 EXAMPLE OF BATCHNORM MITIGATING MODEL MIS-SPECIFICATION
text: In Figure 2, we illustrate a case where BatchNorm could be useful for OoD detection. Suppose we try to learn some distribution p(x) with a 2-d flow model with one coupling layer (Dinh et al., 2016): f : (x1, x2) 7→ (z1, z2) where z1 = x1, z2 = x2 + (x1 − E(x1))/ √ V (x1) · γ + β with learnable parameters γ, β; E(x1), V (x1) are the empirical mean and variance of a batch of x1 in training mode, and the mean and variance of p(x1) in evaluation mode. To simplify our analysis, We assume that the training distribution p(x1, x2) = p(x1)p(x2) where p(x1) is a mixture of two Gaussians (N (−1, σ2) and N (1, σ2) with σ → 0) and p(x2) = δ0(x2) (Dirac delta) and batch sizes are infinite; hence z2 ≈ (x1−E(x1))/ √ V (x1) · γ+β. Since the Jacobian of f is triangular and has a determinant of 1, the likelihood of the flow model is simply pf (x1, x2) = p(f(x1, x2)); we assume the prior p(z1, z2) is standard Gaussian N (0, I). The optimal parameters are then γ ≈ 14 and β = 0. Now let us consider q(x1, x2) = q(x1)p(x2) where q(x1) = Uniform(−0.5, 0.5). In evaluation mode, z2 ≈ x1 and Eq[log pf (x)] ≈ −1.92; in training mode, z2 ≈ √ 12x1, which decreases the log-likelihood to Eq[log pf (x)] ≈ −2.38. We include a more detailed analysis in Appendix D. In this case, BatchNorm manages to learn a global property of the input distribution (variance), and use this to counteract major distributional shifts (e.g. the proposed uniform distribution q(x)). The effect leads to lower log-likelihoods in training mode compared to that in evaluation mode.

heading: 4.2.2 REVISITING THE I.I.D. ASSUMPTIONS FOR BATCH-NORMALIZED GENERATIVE MODELS
text: While it is difficult to analytically characterize the change of likelihood estimates in training mode for high-dimensional images and deep neural networks, we provide a probabilistic interpretation as to why training mode exhibits different behaviors than evaluation mode.
Training mode breaks the i.i.d. data assumption In training mode, the output for a particular sample xj is affected by other samples in the same batch (denoted as x−j), so they are not treated as i.i.d for the generative models in training mode. This suggest that using BatchNorm when training generative models not only changes the optimization landscape but also modifies the objective: it is no longer 1N ∑N i=1 log pθ(xi) where each sample is assumed to be i.i.d.
Pseudo-likelihood perspective of training mode How should we interpret the training objective with batch normalization? For each sample xj , its corresponding “likelihood” objective depends on the other samples from the same batch; we denote this as `θ(xj ;x−j). First, we show that the integral of exp(`θ(xj ;x−j)) over any particular sample (xj) when we fix the other samples in the batch (x−j) is one; this allows us to treat exp(`) as a probability density function5.
Proposition 1. Let b ∈ N, b > 1 be the batch size, and for all possible batch of samples of size (b − 1), denoted as x−j , if `θ(xj ;x−j) is the training objective over xj for a likelihood-based generative model with batch normalization, then:∫
xj
exp(`θ(xj ;x−j))dxj = 1.
where we consider likelihood-based generative models that sample either via some parametrized distribution (such as VAE and PixelCNN) or via parametrized invertible transformations constructed via affine coupling layers (such as RealNVP).
4By maximum likelihood, γ ≈ argmins −s2/2 + log s = 1. 5For VAE, we assume that the inference distribution is always optimal, i.e., there is no gap between the
evidence lower bound and the log-likelihood, so we can treat the objective as exact maximum likelihood.
We defer the proofs in Appendix A.1. Moreover, if we interpret `θ(xj ;x−j) as the conditional loglikelihood under a certain joint generative model p̃θ over an entire batch, our existing “log-likelihood” objective is a surrogate to the log-likelihood objective over the joint distribution p̃θ(x1,x2, . . . ,xb). Proposition 2. There exists a joint distribution p̃θ(x1,x2, . . . ,xb) such that for all j, p̃θ(xj |x−j)→ `θ(xj ;x−j) as b→∞. Then, the objective for one batch {xj}bj=1 in training mode
Ltrain({xj}bj=1;θ) = b∑ j=1 `θ(xj |x−j) , b∑ j=1 log p̃θ(xj |x−j) (3)
is the pseudo-log-likelihood for the joint distribution p̃θ(x1,x2, . . . ,xb) as b→∞.
Training mode versus evaluation mode In evaluation mode, the samples are treated as i.i.d., since the batch statistics is fixed and samples within the same batch do not affect each other. The objective for one batch {xj}bj=1 evaluated in evaluation mode is simply:
Leval({xj}bj=1;θ) = b∑ j=1 log pθ(xj) (4)
It is evident that Ltrain and Leval are not the same objective due to the differences in i.i.d. assumptions for samples within the same batch. Ltrain depends on the input batch statistics, whereas Leval does not. If we consider OoD batches that exhibit major distributional shifts, then it is likely that Ltrain differs from Leval. From the empirical evidence in Table 1, OoD samples have much lower BPD on training mode than on evaluation mode, whereas the same does not happen for in-distribution samples.

heading: 5 A PERMUTATION TEST BASED ON BATCH NORMALIZATION
text: Assume that during testing we have access to some “test dataset” X̂ , and our goal is to identify for each test sample x̂ ∈ X̂ whether it is OoD or not. Based on the observations over OoD batches, we propose a permutation test for each test sample x̂.
Interpolation between training and evaluation First, we propose a procedure that interpolates between training mode and evaluation mode, generalizing the settings in Section 4. We randomly obtain a batch of samples X̂b1 from X̂ with size b1 and a batch of samplesXb0 from p(x) with size b0 (e.g., from the training datasetX used to fit the generative model). For each x̂j ∈ X̂b1 indexed by j, we compute its log-likelihood under training mode by mixing X̂b1 andXb0 in the same batch:
log p̃θ(x̂j |x−j) where x−j = (Xb0 ∪ X̂b1) \ {x̂j} (5) Let b = b1 + b0 be the batch size and let r = b1/b be the ratio of the test samples in the entire batch. We note that the above procedure interpolates evaluation with training mode and evaluation with evaluation mode. As r → 0, the effect on the batch statistics is dominated by the training samples Xb0 , so Equation 5 converges to evaluation mode; as r → 1, the effect on the batch statistics is dominated by the test samples X̂b1 , so Equation 5 converges to training mode. As we increase r from 0 to 1, we are moving from evaluation mode to training mode.
The observations in Section 4 suggest that log p̃θ(x̂j |x−j) should be relatively stable if q(x) is close to p(x) and increase significantly if q(x) is far from p(x), which is indeed the case empirically. We consider evaluating the average log-likelihood on the test samples when the ratio r is varied, and show the results on several datasets and models in Figure 3. As we increase the ratio of test samples, the corresponding log-likelihood decreases dramatically for OoD samples, but is relatively stable for in-distribution samples.
Permutation test with BatchNorm We proceed to propose a permutation test statistics based on training mode evaluation. For a test sample x̂, a fixed batch size b and fixed ratio r, we select (rb− 1) samples from q(x) and (1 − r)b samples from p(x). The expected conditional likelihood of x̂ is used as the test statistic:
Sb,r(x ′) = Ep,q [ log p̃θ(x̂|X(1−r)b, X̂rb−1) ] where X(1−r)b ∼ p(x), X̂rb−1 ∼ q(x) (6)
In practice, we use monte carlo estimates for the expectation in Sb,r(x′). We select two different ratios r1, r2 ∈ (0, 1) where r1 < r2, and compute the differences in Sb,r(x′):
∆b,r1,r2(x ′) = |Sb,r1(x′)− Sb,r2(x′)| (7)
We proceed to use the rank of ∆b,r1,r2(x̂) in the training set as our test statistic:
Tb,r1,r2 = T (x ′;x1, . . . ,xN ) , N∑ i=1 I[∆b,r1,r2(xi) ≤ ∆b,r1,r2(x′)] (8)
For in-distribution samples, we expect ∆b,r1,r2 to be small across all choices of r1 and r2; for out-of-distribution samples, ∆b,r1,r2 should be large if (r2 − r1) is large. Therefore, if q(x) = p(x), then the statistics computed over the x ∼ q(x) should be approximately uniformly distributed over [0, N ], whereas if q(x) 6= p(x), then the statistics computed over out-of-distribution samples would be concentrated around N .

heading: 6 EXPERIMENTS
text: We verify the effectiveness of our proposed test statistic on several datasets and models, including RealNVP, VAE and PixelCNN++, and compare against several baselines including log-likelihood, permutation test and WAIC. First, we train a model p̃θ(x) on a dataset p(x); then we proceed to obtain the test statistic for each sample in q(x), where q(x) are several different datasets. For each q(x) 6= p(x), we consider a binary classification problem, where the prediction is the test statistic for each sample x, and the label is whether x is out-of-distribution (label 1) or not (label 0); larger prediction values indicate x is more likely to be out-of-distribution. We evaluate the area under the ROC curve (AUC) and average precision (AP) for each binary classification task, following the procedure in (Hendrycks & Gimpel, 2016). We select r1 = 0.1 and r2 = 0.9 for our proposed test statistic, and the batch size B = 64.
The OoD detection results are shown in Table 2. As expected, using log pθ(x) results in poor AUC and AP in cases where the OoD samples have higher log-likelihoods; Tperm outperforms log pθ(x) in cases where we also consider high log-likelihood samples as OoD; WAIC achieves higher AUC / AP than log pθ(x), yet its improvement is inconsistent across different models (RealNVP improvements are lower than VAE on Fashion MNIST). Our proposed statistic is able to detect all the out-ofdistribution samples by achieving near-optimal AUC / AP in most cases; this is most notable on CIFAR vs. ImageNet and Fashion MNIST vs. KMNIST as the sample have very similar likelihood distributions in evaluation mode. In Appendix C.4, we show that our method works well even with r1 → 0 and r2 = 0.15; therefore, the method is not very sensitive to the r1, r2 hyperparameters. This
suggest that in practice, even when the test samples contains only a small portion of the OoD samples we can still detect them reliably by selecting r1 → 0 (evaluation mode) and r2 → 1 (training mode). Additionally, we also perform permutation tests over entire batches of test samples, where the BPD of evaluation mode are averaged. The AUC / AP of CIFAR10 versus OoD datasets are 1.00 / 1.00 (SVHN), 0.56 / 0.64 (CIFAR100), 0.82 / 0.68 (LSUN), and 0.56 / 0.68 (ImageNet). These results are significantly lower than evaluated with training mode where the AUC / AP are near-perfect, which demonstrates that utilizing training mode is behind the improvements for OoD detection.

heading: 7 RELATED WORK
text: Task-dependent OoD detection Out-of-distribution detection is crucial to applications such as anomaly detection (Pidhorskyi et al., 2018; Hendrycks & Gimpel, 2016; Vyas et al., 2018), adversarial defense (Song et al., 2017; 2018), and novelty detection for exploration (Marsland, 2003; Bellemare et al., 2016; Fu et al., 2017). In the context of supervised learning, OoD detection methods (Hendrycks & Gimpel, 2016; Liang et al., 2017; DeVries & Taylor, 2018; Gal & Ghahramani, 2016; Lakshminarayanan et al., 2017) are applied to prevent poorly-calibrated neural networks (Guo et al., 2017) from making high-confidence predictions on nonsensical inputs (Szegedy et al., 2013; Goodfellow et al., 2014); these methods are task dependent and are not suitable for task-independent cases, such as exploration over novel states (Fu et al., 2017; Ostrovski et al., 2017).
Generative models for task-independent OoD detection For high-dimensional inputs such as images, deep generative models are widely applied for density estimation (van den Oord et al., 2016; Dinh et al., 2016; Kingma & Dhariwal, 2018), and thus are naturally considered for task-independent OoD detection (Chalapathy et al., 2018; Xu et al., 2018; Kliger & Fleishman, 2018; Ostrovski et al., 2017; Li et al., 2018). However, recent empirical evidence suggest that likelihood estimates by popular deep generative models are not reliable enough for OoD detection, even against samples that are not adversarial by construction (Nalisnick et al., 2018; Hendrycks et al., 2018). To address these issues, Škvára et al. propose tuning the hyperparameters of VAEs with additional OoD data. Choi et al. (Choi et al., 2018) address this empirically by assuming that OoD samples have higher variance likelihood estimates under different independently trained models. Ren et al. consider learning a separate density model for potentially confounding background statistics.
Statistical tests for OoD detection OoD detection can be posed as a hypothesis test where the null hypothesis assumes the data is OoD. One could also consider a more specific goodness-of-fit (GoF) test which determines whether a dataset is drawn from a specific distribution. Nalisnick et al. (2019) considers Kernelized Stein discrepancy (Chwialkowski et al., 2016; Liu et al., 2016) and Maximum-mean discrepancy (Gretton et al., 2012) as two GoF tests that scales to generative models. They propose to compare the empirical cross-entropy of the samples with entropy of the dataset, which is related to the permutation test proposed in Song et al. (2017). Our permutation test can also be cast as a GoF test with r → 1, where all test samples in the same batch with training mode, but we can also provide individual OoD predictions via different r values.

heading: 8 CONCLUSION
text: In this work, we revisit the i.i.d. assumptions in generative models trained with batch normalization, which results in an alternative interpretation to the training objective. The difference between the training objective and the evaluation objective explains the intriguing observation that likelihood estimates over OoD examples in training mode are much lower than that in evaluation mode. This allows us to develop a permutation test based on batch normalization, with which we can reliably detect OoD examples even for difficult cases such as Fashion MNIST vs. KMNIST.
We argue that batch normalization is merely one approach to introducing non-independence between observation variables in deep generative models. Neural processes (Garnelo et al., 2018), for example, considers generative models conditioned on certain observation contexts, which may differ significantly between regular and OoD batches. It would be interesting to investigate if such models could be utilized for more reliable out-of-distribution detection methods for high-dimensional data.

heading: A PROOFS
text: A.1 PROOF OF PROPOSITION 1
Proposition 1. Let b ∈ N, b > 1 be the batch size, and for all possible batch of samples of size (b − 1), denoted as x−j , if `θ(xj ;x−j) is the training objective over xj for a likelihood-based generative model with batch normalization, then:∫
xj
exp(`θ(xj ;x−j))dxj = 1.
where we consider likelihood-based generative models that sample either via some parametrized distribution (such as VAE and PixelCNN) or via parametrized invertible transformations constructed via affine coupling layers (such as RealNVP).
Proof. Note that in training mode, we can write down the batch norm function explicitly:
BatchNorm(z; γ, β, ) = z − 1b ∑ i=1 zi√
1 b−1 ∑ i=1(zi − 1 b ∑ i=1 z) 2 + · γ + β
if we fix z−i, γ, β and , then BatchNorm(z; γ, β, ) is a deterministic function over zi. The corresponding neural network gθ(xi;x−i) is also a deterministic function over xi (given x−i).
We summarize likelihood-based generative models into two types:
• In the first type, the neural network produces the parameters for a certain tractable distribution, which is used to compute the likelihood (or its lower bound). This includes VAE and autoregressive models. Since the distribution over xi is parametrized by the deterministic function gθ, so the likelihood is naturally normalized.
• In the second type, RealNVP models are composed by affine coupling layers (Dinh et al., 2014), which contains transformations (x, y) 7→ (x′, y′) where
x′ = x, y′ = s(x) · y + t(x) (9)
where s(·) and t(·) are neural networks (potentially with batch normalization layers). This has the reverse
x = x′, y = (y′ − t(x′))/s(x′) (10)
Since BatchNorm is a deterministic function over zi when z−i is fixed, the corresponding s(·) and t(·) functions also have the same property. Therefore, the corresponding RealNVP model over xi with fixed x−i is also invertible.
As gθ is a deterministic function over xi, the corresponding conditional likelihood is also normalized.
This completes the argument for likelihood-based generative models.
A.2 PROOF OF PROPOSITION 2
Proposition 2. There exists a joint distribution p̃θ(x1,x2, . . . ,xb) such that for all j, p̃θ(xj |x−j)→ `θ(xj ;x−j) as b→∞. Then, the objective for one batch {xj}bj=1 in training mode
Ltrain({xj}bj=1;θ) = b∑ j=1 `θ(xj |x−j) , b∑ j=1 log p̃θ(xj |x−j) (3)
is the pseudo-log-likelihood for the joint distribution p̃θ(x1,x2, . . . ,xb) as b→∞.
Proof. We treat each sample in the batch as a separate random variable, and consider the corresponding graphical model where batch normalization is involved. Since training mode aggregates the statistics of all the samples, all the random variables are connected to each other.
First, we need to show that for large enough b, there exists a joint distribution p̃θ(x1,x2, . . . ,xb) that is compatible with all the conditional distributions we defined (Arnold & Press, S. James, 1989). From Theorem 4.1 in (Arnold & Press, S. James, 1989), we need to show that there exists a function f such that
p̃θ(xi|x−i) p̃θ(xj |x−j) = f(x−j) f(x−i) (11)
Let f(x−j) = Exj [ ∑ k 6=j log p̃θ(xk|x−k)] be the sum of conditional log-likelihood of xk under the expectation of some distribution over xj . For large enough b, the value of xj will not affect the batch statistics, so f(x−j) = ∑ k 6=j log p̃θ(xk|x−k), so the condition for compatibility in Equation 11 holds, and there exists a compatible joint distribution, which we denote as p̃θ(x1,x2, . . . ,xb).
Next, we verify the conditions under which the product of the conditional likelihoods is a pseudolikelihood of p̃θ(x1,x2, . . . ,xb). The conditional likelihood for any sample xj is independent of x−j conditioned on its neighbors (which are x−j), so
Ltrain({xj}bj=1;θ) = b∑ j=1 log p̃θ(xj |x−j)
is the pseudo-log-likelihood objective (Besag, 1975) for {xj}bj=1, which approximates the loglikelihood of the joint distribution.

heading: B FOOLING LIKELIHOOD-BASED PERMUTATION TESTS
text: As suggested by empirical evidence, we assume that model mis-specification always occurs and that our likelihood estimates cannot be used naively for detecting out-of-distribution samples due to the mode seeking nature of DKL. Under this assumption, likelihood-based permutation tests may seems more effective than simple thresholding rules for detecting out-of-distribution samples, as it treats both high-likelihood and low-likelihood samples as OoD. In this section, however, we show that likelihood-based permutation test can also be easily fooled, making them infeasible for OoD detection in a straightforward manner.
We consider fooling a model pθ(x) using samples generated from another model qφ(x) (trained on another dataset), where we modify the “temperature” T of the generative model (Kingma & Dhariwal, 2018) (see Appendix C.2 for details). Then we gather the likelihood estimates for samples in p(x) and q(x) and obtain the area under the ROC curve (AUC) using Tperm as prediction values to classify if x is OoD. We consider a RealNVP (Dinh et al., 2016) model trained on CIFAR and a PixelCNN++ (Salimans et al., 2017) model trained on Fashion MNIST. We use a RealNVP trained on SVHN, and a PixelCNN++ trained on MNIST to fool the two pθ(x) models respectively. For RealNVP we set T = 1.10 and for PixelCNN++ we set T = 1.17.
In Figure 4, we show that it is possible to produce a distribution qφ(x) with generative models such that its likelihood distribution evaluated by pθ(x) lies around the median likelihood in p(x). This results in low AUC and thereby confusing the test based on Tperm. We show some out-of-distribution sample with similar bits-per-dimension (BPD) to training samples in Figure 5, where the generated samples look drastically different from training samples visually, even though they have similar log-likelihoods. We note that flipping the classifier predictions (i.e. using −Tperm) will not address this issue, since we would then treat low likelihood samples as more likely to be in-distribution.

heading: C ADDITIONAL EXPERIMENTAL DETAILS
text: C.1 MODEL ARCHITECTURES
For RealNVP (Dinh et al., 2016), we consider downscale once, with 4 residual blocks for each affine coupling layer and 32 channels for each convolutional layer, except for CIFAR where we have 8 residual blocks with 64 channels for each convolutional layer.
For VAE (Kingma & Welling, 2013; van den Berg et al., 2018), our inference network has 6 convolutional layers followed by a fully connected layer, and the generator network has 8 deconvolutional layers. We add batch normalization to all the convolutional layers and deconvolutional layers, except for the last two deconvolutional layers. We detail the convolutional layer hyperparameters in Table 3.
For PixelCNN++, we made two simple modifications to default hyperparameters (Salimans et al., 2017). We reduce the number of filters in each ResNet block from 160 to 80, and we use batch normalization after convolution as opposed to adding weight normalization over convolution.
All the models are trained with default optimizer hyperparameters with a batch size of 64. We use a batch size of 64 also in evaluation mode.
C.2 EXPERIMENTAL PROCEDURES FOR SECTION B
We consider controlling the entropy of the generated samples by controlling a temperature hyperparameter T . In RealNVP, this is realized by multiplying the latent variable by a factor of T , which is equivalent to sampling from N (0, T 2I). In PixelCNN++, this is realized by dividing each pre-softmax scalar output by T ; larger T values would lead to higher entropy samples.
C.3 LIKELIHOOD DIFFERENCES BETWEEN TRAINING MODE AND TESTING MODE ON GENERATED DATA
We consider measuring the likelihood differences between training mode and testing mode using a RealNVP trained on CIFAR. The samples are generated from a RealNVP trained on SVHN, with several temperatures T ∈ {0.7, 1.0, 1.3}. Similar to the observation with SVHN samples, there is a large gap between training mode and evaluation mode evaluations.
C.4 OUT-OF-DISTRIBUTION DETECTION WITH ALTERNATIVE VALUES OF r1 AND r2
We include additional results with alternative values of r1 and r2. If our method is able to achieve high performance with small r2, this suggests that we can detect the OoD examples realiably even as they occupy a small portion within the batch. We consider r1 → 0 (which is evaluation mode) and r2 ∈ {0.15, 0.3, 0.5, 0.9}; we show our results in Table 5.
C.5 HISTOGRAMS OF LOG-LIKELIHOODS
We further show the histograms of log-likelihoods of several test datasets when the model is a RealNVP trained on CIFAR-10 datasets in Figure 6; the mean BPD is computed with evaluation mode.

heading: D DETAILS FOR THE DERIVATION IN SECTION 4.2.1
text: Suppose we try to learn some distribution p(x) with a 2-d flow model with one coupling layer (Dinh et al., 2016): f : (x1, x2) 7→ (z1, z2) where
z1 = x1 (12) z2 = x2 + (x1 − E(x1))/ √ V (x1) · γ + β (13)
with learnable parameters γ, β; E(x1), V (x1) are the empirical mean and variance of a batch of x1 in training mode, and the mean and variance of p(x1) in evaluation mode.
We assume the distribution p(x1) to be a even mixture of two Gaussians (N (−1, σ2) and N (1, σ2) with σ → 0, so it concentrates around −1 and 1), and p(x2) = δ0(x2) (x2 concentrates at zero), so z2 ≈ (x1 − E(x1))/ √ V (x1) · γ + β.
The Jacobian of f is:
J = ∂f(x)
∂x =
[ 1 0
γ/ √ V (x1) 1
] (14)
so its determinant is one. The likelihood of the flow model is simply
pf (x1, x2) = p(f(x1, x2))|J | = p(f(x1, x2))
We assume the prior p(z1, z2) is standard Gaussian N (0, I). Therefore, we have: pf (x1, x2) ≈ ϕ(x1) · ϕ((x1 − E(x1))/ √ V (x1) · γ + β) (15)
where ϕ(x) is the probability density function for the standard Gaussian distribution. Note that γ, β only depends on the second term. The maximum likelihood solution for β = 0 (due to symmetry); for γ, we can treat p(x1) as two point distributions at −1 and 1, so we have the optimal γ ≈ arg mins−s2/2 + log s = 1. Moreover, Ep[x1] = 0 and Varp[x1] ≈ 1.
For p(x1, x2) in evaluation mode, we have Ep[log pf (x1, x2)] ≈ Ep[logϕ(x1) + logϕ((x1 − E(x1))/ √ V (x1)] (16)
= Ep[logϕ(x1) + logϕ(x1)] ≈ −2.84. (17)
For q(x1, x2) in evaluation mode, we have
Eq[log pf (x1, x2)] ≈ Eq[logϕ(x1) + logϕ(x1)] ≈ −1.92. (18)
For q(x1, x2) in training mode, E(x1) = 0, V (x1) = 1/ √ 12, so we have:
Eq[log pf (x1, x2)] = Eq[logϕ(x1) + logϕ( √ 12x1)] ≈ −2.38. (19)

Review summaries:
This paper tackles the out of distribution detection problem and utilizes the property that the calculation of batch-normalization is different between training and testing for detecting out-of-distribution data with generative models. The paper first empirically demonstrates that the likelihood of out-of-distribution data has a larger difference between training mode and testing mode, then provides a possible theoretical explanation for the phenomenon. The proposed scoring function utilizes such likelihood differences in a permutation test for detecting out-of-distribution data. The evaluation is performed on two small in-distribution image datasets and four out-of-distribution datasets with three types of generative models.