On the Importance of Gradients for Detecting Distributional Shifts in the Wild
Year: 2021

Abstract:
Detecting out-of-distribution (OOD) data has become a critical component in ensuring the safe deployment of machine learning models in the real world. Existing OOD detection approaches primarily rely on the output or feature space for deriving OOD scores, while largely overlooking information from the gradient space. In this paper, we present GradNorm, a simple and effective approach for detecting OOD inputs by utilizing information extracted from the gradient space. GradNorm directly employs the vector norm of gradients, backpropagated from the KL divergence between the softmax output and a uniform probability distribution. Our key idea is that the magnitude of gradients is higher for indistribution (ID) data than that for OOD data, making it informative for OOD detection. GradNorm demonstrates superior performance, reducing the average FPR95 by up to 16.33% compared to the previous best method. Code and data available: https://github.com/deeplearning-wisc/gradnorm_ood.

heading: 1 Introduction
text: When deploying machine learning models in the real world, there is an increasingly important question to ask: “Is the model making a faithful prediction for something it was trained on, or is the model making an unreliable prediction for something it has not been exposed to during training?” We desire models that are not only accurate on their familiar data distribution, but also aware of uncertainty outside the training distribution. This gives rise to the importance of out-of-distribution (OOD) detection, which determines whether an input is in-distribution (ID) or OOD. As of recently a plethora of literature has emerged to address the problem of OOD uncertainty estimation [2, 13, 14, 16, 24, 26–29, 31, 32, 41].
The main challenge in OOD uncertainty estimation stems from the fact that modern deep neural networks can easily produce overconfident predictions on OOD inputs [34]. This phenomenon makes the separation between ID and OOD data a non-trivial task. Much of the prior work focused on deriving OOD uncertainty measurements from the activation space of the neural network, e.g., using model output [13, 14, 24, 27, 29] or feature representations [26]. Yet, this leaves an alternative space—model parameter and its gradient space—largely unexplored. Will a model react to ID and OOD inputs differently in its gradient space, and if so, can we discover distinctive signatures to separate ID and OOD data from gradients?
⇤Work done while A.G was working as an undergraduate research assistant with Li’s lab.
35th Conference on Neural Information Processing Systems (NeurIPS 2021).
In this paper, we tackle this key question by exploring and exploiting the richness of the gradient space, ultimately showing that gradients carry surprisingly useful signals for OOD detection. Formally, we present GradNorm, a simple and effective approach for detecting OOD inputs by utilizing gradient extracted from a pre-trained neural network. Specifically, GradNorm employs the vector norm of gradients directly as an OOD scoring function. Gradients are backpropagated from the KullbackLeibler (KL) divergence [23] between the softmax output and a uniform distribution. ID data is expected to have larger KL divergence because the prediction tends to concentrate on one of the ground-truth classes and is therefore less uniformly distributed. As depicted in Figure 1, our key idea is that the gradient norm of the KL divergence is higher for ID data than that for OOD data, making it informative for OOD uncertainty estimation.
We provide both empirical and theoretical insights, demonstrating the superiority of GradNorm over both output-based and feature-based methods. Empirically, we establish superior performance on a large-scale ImageNet benchmark, as well as a suite of common OOD detection benchmarks. GradNorm outperforms the previous best method by a large margin, with up to 16.33% reduction in false-positive rate (FPR95). Theoretically, we show that GradNorm captures the joint information between the feature and the output space. The joint information results in an overall stronger separability than using either feature or output space alone.
Our key results and contributions are summarized as follows.
• We propose GradNorm, a simple and effective gradient-based OOD uncertainty estimation method, which is both label-agnostic (no label required for backpropagation) and OODagnostic (no outlier data required). GradNorm reduces the average FPR95 by 16.33% compared to the current best method.
• We perform comprehensive analyses that improve understandings of the gradient-based method under (1) different network architectures, (2) gradient norms extracted at varying depths, (3) different loss functions for backpropagation, and (4) different vector norms for aggregating gradients.
• We perform a mathematical analysis of GradNorm and show that it can be decomposed into two terms, jointly characterizing information from both feature and output space, which demonstrates superiority.

heading: 2 Preliminaries
text: We start by recalling the general setting of the supervised learning problem. We denote by X = Rd the input space and Y = {1, 2, ..., C} the output space. A learner is given access to a set of training data D = {(xi, yi)}Ni=1 drawn from an unknown joint data distribution P defined on X ⇥ Y . A neural network f(x; ✓) : X ! RC minimizes the empirical risk:
RL(f) = ED(LCE(f(x; ✓), y)), where ✓ is the parameters of the network, and LCE is the commonly used cross-entropy loss:
LCE(f(x), y) = log e fy(x)/T
PC c=1 e fc(x)/T . (1)
Specifically, fy(x) denotes the y-th element of f(x) corresponding to the ground-truth label y, and T is the temperature.
Problem statement Out-of-distribution (OOD) detection can be formulated as a binary classification problem. In practice, OOD is often defined by a distribution that simulates unknowns encountered during deployment time, such as samples from an irrelevant distribution whose label set has no intersection with Y and therefore should not be predicted by the model. Given a classifier f learned on training samples from in-distribution P , the goal is to design a binary function estimator,
g(x) = ⇢ in, if S(x) out, if S(x) < ,
that classifies whether a sample x 2 X is from P or not. is commonly chosen so that a high fraction (e.g., 95%) of ID data is correctly classified. The key challenge is to derive a scoring function S(x) that captures OOD uncertainty. Previous approaches have primarily relied on the model’s output or features for OOD uncertainty estimation. Instead, our approach seeks to compute S(x) based on the information extracted from the gradient space, which we describe in the next section.

heading: 3 Gradient-based OOD Detection
text: In this section, we describe our method GradNorm. We start by introducing the loss function for backpropagation and then describe how to leverage the gradient norm for OOD uncertainty estimation.
We calculate gradients w.r.t. each parameter by backpropagating the Kullback-Leibler (KL) divergence [23] between the softmax output and a uniform distribution. Formally, KL divergence quantifies how close a model-predicted distribution q = {qi} is to a reference probability distribution p = {pi},
DKL(p || q) = X
i
pi log pi
qi =
X
i
pi log qi + X
i
pi log pi = H(p, q) H(p). (2)
In particular, we set the reference distribution to be uniform u = [1/C, 1/C, ..., 1/C] 2 RC . The predictive probability distribution is the softmax output. Our KL divergence for backpropagation can be written as:
DKL(u || softmax(f(x)) = 1
C
CX
c=1
log e fc(x)/T
PC j=1 e fj(x)/T H(u), (3)
where the first term is the cross-entropy loss between the softmax output and a uniform vector u, and the second term H(u) is a constant. The KL divergence measures how much the predictive distribution is away from the uniform distribution. Intuitively, ID data is expected to have larger KL divergence because the prediction tends to concentrate on the ground-truth class and is thus distributed less uniformly.
GradNorm as OOD score For a given parameter w, the gradient of the above KL divergence is:
@DKL(u || softmax(f(x)) @w = 1 C
CX
i=1
@LCE(f(x), i) @w ,
(4)
where w is a component of network parameter ✓. Notice that the gradient of the entropy term is 0, i.e. @H(u)/@w = 0. In other words, the gradient of KL divergence is equivalent to averaging the derivative of the categorical cross-entropy loss for all labels.
We now define the OOD score via a vector norm of gradients of the selected parameters:
S(x) = k@DKL(u k softmax(f(x)) @w kp, (5)
where k·kp denotes Lp-norm and w is the set of parameters in vector form2. We term our method GradNorm, short for gradient norm. In practice, GradNorm can be conveniently implemented by calculating the cross-entropy loss between the predicted softmax probability and a uniform vector as the target. We will discuss the choices and impacts of the selected parameter set w in Section 4.2.
Rationale of GradNorm Our operating hypothesis is that using the KL divergence for backpropagation, the gradient norm is higher for ID data than that for OOD data. As we show in Section 4.2, using the gradient norm of the KL divergence is more effective than using the KL divergence directly. Moreover, GradNorm derived from the KL divergence with a uniform target offers two advantages over gradient norms derived from the standard cross-entropy loss.
• First, our method is label-agnostic and does not require any ground-truth label. It can be flexibly used during inference time when the label is unavailable for either ID or OOD data.
• Second, it captures the uncertainty across all categories, providing more information for OOD detection. We will provide empirical evidence to show the importance of utilizing all labels in Section 4.2.
2We concatenate all selected parameters into a single vector regardless of the original shapes of the parameters.

heading: 4 Experiments
text: In this section, we evaluate GradNorm on a large-scale OOD detection benchmark with ImageNet-1k as in-distribution dataset [16]. We describe experimental setup in Section 4.1 and demonstrate the superior performance of GradNorm over existing approaches in Section 4.2, followed by extensive ablations and analyses that improve the understandings of our approach.

heading: 4.1 Experimental Setup
text: Dataset We use the large-scale ImageNet OOD detection benchmark proposed by Huang and Li [16]. ImageNet benchmark is not only more realistic (with higher resolution images) but also more challenging (with a larger label space of 1,000 categories). We evaluate on four OOD test datasets, which are from subsets of iNaturalist [43], SUN [47], Places [51], and Textures [5], with non-overlapping categories w.r.t. ImageNet-1k (see Appendix B.1 for detail). The evaluations span a diverse range of domains including fine-grained images, scene images, and textural images. We further evaluate on CIFAR benchmarks that are routinely used in literature (see Appendix A).
Model and hyperparameters We use Google BiT-S models3 [21] pre-trained on ImageNet-1k with a ResNetv2-101 architecture [11]. We report performance on an alternative architecture, DenseNet121 [15], in Section 4.2. Additionally, we use L1-norm-based OOD scores as the default and explore the effect of other Lp-norms in Section 4.2. The temperature parameter T is set to be 1 unless specified otherwise, and we explore the effect of different temperatures in Section 4.2. At test time, all images are resized to 480 ⇥ 480.

heading: 4.2 Results and Ablation Studies
text: Comparison with output- and feature-based methods The results for ImageNet evaluations are shown in Table 1, where GradNorm demonstrates superior performance. We report OOD detection performance for each OOD test dataset, as well as the average over the four datasets. For a fair comparison, all the methods use the same pre-trained backbone, without regularizing with auxiliary outlier data. In particular, we compare with MSP [13], ODIN [27], Mahalanobis [26], as well as Energy [29]. Details and hyperparameters of baseline methods can be found in Appendix B.2.
GradNorm outperforms the best output-based baseline, Energy score [29], by 16.33% in FPR95. GradNorm also outperforms a competitive feature-based method, Mahalanobis [26], by 26.99% in FPR95. We hypothesize that the increased size of label space makes the class-conditional Gaussian density estimation less viable. It is also worth noting that significant overheads can be introduced by some methods. For instance, Mahalanobis [26] requires collecting feature representations from intermediate layers over the entire training set, which is expensive for large-scale datasets such as ImageNet. In contrast, GradNorm can be conveniently used through a simple gradient calculation without hyper-parameter tuning or additional training.
Gradients from the last layer is sufficiently informative In this ablation, we investigate several variants of GradNorm where the gradients are extracted from different network depths. Specifically, we consider gradients of (1) block n: all trainable parameters in the n-th block, (2) all parameters: all trainable parameters from all layers of the network, and (3) last layer parameters: weight parameters from the last fully connected (FC) layer.
3https://github.com/google-research/big_transfer
Table 2 contrasts the OOD detection performance using different gradient space. For each setting, we report the FPR95 and AUROC averaged across four OOD datasets. We observe that gradients from deeper layers tend to yield significantly better performance than shallower layers. This is desirable since gradients w.r.t. deeper layers are computationally more efficient than shallower layers. Interestingly,GradNorm obtained from the last linear layer yield the best results among all variants. Practically, one only needs to perform backpropagation w.r.t. the last linear layer, which incurs negligible computations. Therefore, our main results are based on the norm of gradients extracted from weight parameters in the last FC layer of the neural network.
GradNorm with one-hot v.s. uniform targets In this ablation, we contrast GradNorm derived using uniform targets (ours) v.s. one-hot targets. Specifically, our scoring function Equation 5 is equivalent to
S(x) = k 1 C
CX
i=1
@LCE(f(x), i) @w k, (6)
which captures the gradient of cross-entropy loss across all labels. In contrast, we compare against an alternative scoring function that utilizes only one dominant class label:
Sone-hot(x) = k @LCE(f(x), ŷ)
@w k, (7)
where ŷ is the predicted class with the largest output.
We first analyze the score distributions using uniform targets (top) and one-hot targets (bottom) for ID and OOD data in Figure 2. There are two salient observations we can draw: (1) using uniform target (ours), gradients of ID data indeed have larger magnitudes than those of OOD data, as the softmax prediction tends to be less uniformly distributed (and therefore results in a larger KL divergence). In contrast, the gradient norm using one-hot targets shows the opposite trend, with ID data having lower magnitudes. This is also expected since the training objective explicitly minimizes the cross-entropy loss, which results in smaller gradients for the majority of ID data. (2) The score distribution using one-hot targets displays a strong overlapping between ID (green) and OOD (gray) data, with large variances. In contrast, our method GradNorm can significantly improve the separability between ID and OOD data, resulting in better OOD detection performance.
Figure 3 reports the OOD detection performance using uniform targets (ours) v.s. one-hot targets. We use L1-norm in both cases. For one-hot targets, we use the negative norm, i.e. Sone-hot(x), to align with the convention that ID data has higher scores. GradNorm with uniform targets outperforms its counterpart with one-hot targets by a large margin. For instance, GradNorm reduces FPR95 by 48.35% when evaluated on the SUN dataset. Our analysis signifies the importance of measuring OOD uncertainty using all label information.
GradNorm is effective on alternative neural network architecture We evaluate GradNorm on a different architecture DenseNet-121 [15], and report performance in Table 3. GradNorm is consistently effective, outperforming the best baseline, Energy [29], by 10.29% in FPR95.
L1-norm is the most effective How does the choice of Lp-norm in Equation 5 affect the OOD detection performance? To understand this, we show in Figure 4 the comparison using L1⇠4-norm, L1-norm, as well as the fraction norm (with p = 0.3). Compared with higher-order norms, L1-norm achieves the best OOD detection performance on all four datasets. We hypothesize that L1-norm is better suited since it captures information equally from all dimensions in the gradient space, whereas higher-order norms will unfairly highlight larger elements rather than smaller elements (due to the effect of the exponent p). In the extreme case, L1-norm only considers the largest element (in absolute value) and results in the worst OOD detection performance among all norms. On the other hand, the fraction norm overall does not outperform L1-norm. We additionally provide results for more Lp-norms in Appendix C, with p = {0.3, 0.5, 0.8, 1, 2, 3, 4, 5, 6,1}.
Effect of temperature scaling We evaluate our method GradNorm with different temperatures T from T = 0.5 to T = 1024. As shown in Figure 5, T = 1 is optimal, while either increasing or decreasing the temperature will degrade the performance. This can be explained mathematically via the V term in Equation 9. Specifically, using a large temperature will result in a smoother softmax distribution, with C · e fj/T
PC j=1 e fj/T closer to 1 (and V ! 0). This leads to a less distinguishable
distribution between ID and OOD. Our method can be hyperparameter-free by setting T = 1. For completeness, we have included numerical results under a wider range of T in Appendix D.
GradNorm is more effective than directly using KL divergence We provide an ablation, contrasting the performance of using GradNorm v.s. using the KL divergence derived from Equation 3 as OOD scoring function. The results are show in Figure 6, where GradNorm yields significantly better performance than the KL divergence directly extracted from the output space, demonstrating the superiority of gradient space for OOD detection.
Effect of model capacity In this ablation, we explore the OOD detection performance of GradNorm with varying model capacities. For the ease of experiments, we directly use Google BiT-S models pre-trained on ImageNet1k [7]. We compare the performance of the following model family (in increasing size): BiT-S-R50x1, BiTS-R101x1, BiT-S-R50x3, BiT-S-R152x2, BiT-S-R101x3. All models are ResNetv2 architectures with varying depths and width factors. The average performance on 4 OOD datasets is reported in Table 4. OOD detection performance is optimal when the model size is relatively small
(ResNetv2-101x1), while further increasing model capacity will degrade the performance. Our experiments suggest that overparameterization can make gradients less distinguishable between ID and OOD data and that GradNorm is more suitable under a mild model capacity.

heading: 5 Analysis of Gradient-based Method
text: In this section, we analyze the best variant of GradNorm, L1-norm of the last layer gradients (see Section 4.2), and provide insights on the mathematical interpretations. Specifically, we denote the last FC layer in a neural network by:
f(x) = W>x+ b, (8)
where f = [f1, f2, . . . , fC ]> 2 RC is the logit output, x = [x1, x2, . . . , xm]> 2 Rm is the input feature vector, W 2 Rm⇥C is the weight matrix, and b 2 RC is the bias vector.
GradNorm captures joint information between feature and output First we can rewrite the KL divergence between the softmax prediction and the uniform target as:
DKL(uksoftmax(f(x))) = 1
C
CX
c=1
log e fc/T
PC j=1 e fj/T H(u)
= 1 C
0
@ 1 T
CX
c=1
fc C · log CX
j=1
e fj/T
1
A H(u).
Then we consider the derivative of DKL w.r.t. each output logit fc:
@DKL @fc = 1 CT
0
@1 CT · @
⇣ log PC
j=1 e fj/T
⌘
@fc
1
A
= 1 CT 1 C · e
fc/T
PC j=1 e fj/T
! .
Next the derivative of DKL w.r.t. the weight matrix can be written as:
@DKL
@W = x
@DKL @f = 1 CT · [x1, x2, . . . , xm]>[1 C ·
e f1/T
PC j=1 e
fj/T , . . . , 1 C · e
fC/T
PC j=1 e fj/T ].
Finally, the L1-norm of gradients of the weight matrix is simply the sum of absolute values of all elements in the gradient matrix:
S(x) = mX
i=1
CX
j=1
✓ @DKL
@W
◆
ij
= 1
CT
mX
i=1
0
@|xi|
0 @ CX
j=1
1 C · e fj/T
PC j=1 e fj/T
1
A
1
A
= 1
CT
mX
i=1
|xi| !0 @ CX
j=1
1 C · e fj/T
PC j=1 e fj/T
1
A
, 1 CT U · V,
(9)
where the first multiplicative term U = Pm
i=1 |xi| is the L1-norm of the feature vector x, and the second term V characterizes information in the output space.
Ablation on U and V In Figure 7 we plot distribution densities of U and V , for both ID and OOD data. It is important to note that U and V measure statistical distributions in the feature space and the output space, respectively. Therefore, GradNorm captures the joint information between the feature and the output space. The multiplication of both U and V results in an overall stronger separability between ID and OOD, as seen in Figure 2a. We report the OOD detection performance using U and V individually as scoring functions in Table 5, both of which are less competitive than GradNorm.

heading: 6 Discussion
text: To the best of our knowledge, there is very limited prior work studying how to use gradients for OOD detection. In this section, we discuss connections and differences between GradNorm and previous OOD detection approaches that utilize gradient information, in particular ODIN (Section 6.1) and Lee and AlRegib’s approach (Section 6.2).

heading: 6.1 Comparison with ODIN
text: Our work is inspired by ODIN [27], which first explored using gradient information for OOD detection. In particular, ODIN proposed using input pre-processing by adding small perturbations obtained from the input gradients. The goal of ODIN perturbations is to increase the softmax score of any given input by reinforcing the model’s belief in the predicted label. Ultimately the perturbations have been found to create a greater gap between the softmax scores of ID and OOD inputs, thus making them more separable and improving the performance of OOD detection.
It is important to note that ODIN only uses gradients implicitly through input perturbation, and OOD scores are still derived from the output space of the perturbed inputs. Different from ODIN, GradNorm utilizes information solely obtained from the gradient space. The effectiveness of GradNorm beckons a revisiting of combining information obtainable from the gradient space and the output space, which could provide a stronger method. We leave this question for future exploration.

heading: 6.2 Comparison with Lee and AlRegib
text: Lee and AlRegib [25] proposed to train an auxiliary binary classifier using gradient information from ID and OOD data. Importantly, they do not directly use gradient norms for OOD detection, but instead, use them as the input for training a separate binary classifier. Furthermore, the binary classifier is trained on the OOD datasets, which can unfairly overfit the test data and does not suit OOD-agnostic settings in the real world. In contrast, our methodology mitigates the shortcomings in that GradNorm (1) does not require any new model training, (2) is hyperparameter-free, and (3) is suitable for OOD-agnostic settings. For these reasons, these two methods are not directly comparable. However, for completeness, we also reproduce Lee and AlRegib’s method using random noise as a surrogate of OOD data and compare it with GradNorm in Appendix E. GradNorm outperforms their approach by 15.45% in FPR95 in this fair comparison.
Moreover, we provide comprehensive ablation studies and analyses on different design choices in using gradient-based methods for OOD detection (network architectures, gradients at different layers, loss functions for backpropagation, different Lp-norms, diverse evaluation datasets, and different temperatures, etc.), which were previously not studied in [25]. In particular, Lee and AlRegib utilize L2-norm gradients without comparing them with other norms. Our ablation study leads to the new finding that L1-norm works best among all variants with GradNorm, and outperforms L2-norm by up to 22.31% in FPR95. Furthermore, Lee and AlRegib utilize gradients from all layers to train a separate binary classifier, which can cause the computational cost to become intractable for deeper and larger models. In contrast, with GradNorm we show that the last layer gradient will always yield the best performance among all gradient set selections. Consequently, GradNorm incurs negligible computational cost. We believe such thorough understandings will be valuable for the field.

heading: 7 Related Work
text: OOD uncertainty estimation with discriminative models The problem of classification with rejection can date back to early works on abstention [3, 9], which considered simple model families such as SVMs [6]. A comprehensive survey on OOD detection can be found in [49]. We highlight representative works for post hoc detection. The phenomenon of neural networks’ overconfidence to OOD data is revealed by Nguyen et al. [34]. Early works attempted to improve the OOD uncertainty estimation by proposing the ODIN score [27], OpenMax [1], and Mahalanobis distance [26]. Recent work by Liu et al. [29] proposed using an energy score for OOD uncertainty estimation, which can be easily derived from a discriminative classifier and demonstrated advantages over the softmax confidence score both empirically and theoretically. Wang et al. [44] further showed an energy-based approach can improve OOD uncertainty estimation for multi-label classification networks. Huang and Li [16] revealed that approaches developed for common CIFAR benchmarks might not translate effectively into a large-scale ImageNet benchmark, highlighting the need to evaluate OOD uncertainty estimation in a large-scale real-world setting. Existing approaches derive OOD scores from either output or feature space. In contrast, we show that gradient space carries surprisingly useful information for OOD uncertainty estimation, which was underexplored in the literature.
OOD uncertainty estimation with generative models Alternative approaches for detecting OOD inputs resort to generative models that directly estimate density [8, 17, 18, 35, 38, 42]. An input is deemed as OOD if it lies in the low-likelihood regions. A plethora of literature has emerged to utilize generative models for OOD detection [19, 37, 39, 40, 45, 46, 48]. Interestingly, Nalisnick et al. [32] showed that deep generative models can assign a high likelihood to OOD data. Moreover, generative models can be prohibitively challenging to train and optimize, and the performance can often lag behind the discriminative counterpart. In contrast, our method relies on a discriminative classifier, which is easier to optimize and achieves stronger performance.
Distributional shifts Distributional shifts have attracted increasing research interests [20]. It is important to recognize and differentiate various types of distributional shift problems. Literature in OOD detection is commonly concerned about model reliability and detection of label-space shifts [13, 27, 29], where the OOD inputs have disjoint labels w.r.t. ID data and therefore should not be predicted by the model. Meanwhile, some works considered covariate shifts in the input space [30, 36], where inputs can be corruption-shifted or domain-shifted [14]. However, covariate shifts are commonly used to evaluate model robustness [12] and domain generalization performance [52], where the label space Y remains the same during test time. It is important to note that our work focuses on the detection of shifts where the model should not make any prediction, instead of covariate shifts where the model is expected to generalize.

heading: 8 Conclusion
text: In this paper, we propose GradNorm, a novel OOD uncertainty estimation approach utilizing information extracted from the gradient space. Experimental results show that our gradient-based method can improve the performance of OOD detection by up to 16.33% in FPR95, establishing superior performance. Extensive ablations provide further understandings of our approach. We hope that our research brings to light the informativeness of gradient space, and inspires future work to utilize gradient space for OOD uncertainty estimation.

heading: 9 Societal Impact
text: Our project aims to improve the reliability and safety of modern machine learning models. This stands to benefit a wide range of fields and societal activities. We believe out-of-distribution uncertainty estimation is an increasingly critical component of systems that range from consumer and business applications (e.g., digital content understanding) to transportation (e.g., driver assistance systems and autonomous vehicles), and to health care (e.g., unseen disease identification). Through this work and by releasing our code, we hope to provide machine learning researchers with a new methodological perspective and offer machine learning practitioners an easy-to-use tool that renders safety against OOD data in the real world. While we do not anticipate any negative consequences to our work, we hope to continue to build on our framework in future work.

heading: Acknowledgement
text: Research is supported by the Office of the Vice Chancellor for Research and Graduate Education (OVCRGE) with funding from the Wisconsin Alumni Research Foundation (WARF).

Review summaries:
The work presents GradNorm which uses the norm of gradient, back-propagated from the KL divergence between the softmax output and a uniform probability distribution, as the uncertainty score for OOD detection. The experimental results show that the proposed method outperforms the baselines on ImageNet1k vs OOD and CIFAR vs OOD benchmarks. Ablation studies are presented to help better understand the proposed method. The paper is written well and the experiments are comprehensive . 

This work presents a new method for detecting out-of-distribution inputs that relies on the gradient norm of the KL divergence between the model’s softmax output and a uniform probability distribution.  The method is easy to implement (using the norm of the gradient of a standard cross entropy loss with a uniform label vector), can be used at inference time without access to true labels, and does not require training an additional model.   The authors present empirical evidence that their method outperforms prior work by a significant margin, reducing the false positive rate (FPR95) for out-of-distribution detection by 10.89% and 14.47% on ImageNet and CIFAR-10 respectively. Additionally, the authors perform an ablation study that explores how their method performs as they vary layer parameters, type of target distribution used (uniform versus real), temperature, type of gradient norm, and using only individual terms that form a decomposition of the gradient norm. 

The manuscript proposes using the gradient norm of a trained classifier for out-of-distribution detection. Concretely, the norm of the gradient of the KL divergence between the actual prediction and the uniform prediction with regard to the network parameters is used to distinguish in-distribution and out-of-distribution data. Results on several benchmarks show this method has better OOD detection performance than some other methods. 

The work proposes a novel method for OOD detection. The method itself uses as scoring function the norm of the gradient of the KL divergence of the softmax vector to a uniform distribution. Importantly, this method does not require ground-truth OOD data and does not require hyperparameter tuning. The main contribution of the work is empirical demonstration that the method achieves state-of-the-art performance on a variety of datasets, as well as ablations to further understanding into the effectiveness of the proposed method.