IGEOOD: AN INFORMATION GEOMETRY APPROACH
Year: 2021

Abstract:
Reliable out-of-distribution (OOD) detection is fundamental to implementing safer modern machine learning (ML) systems. In this paper, we introduce IGEOOD, an effective method for detecting OOD samples. IGEOOD applies to any pre-trained neural network, works under different degrees of access to the ML model, does not require OOD samples or assumptions on the OOD data but can also benefit (if available) from OOD samples. By building on the geodesic (FisherRao) distance between the underlying data distributions, our discriminator is able to combine confidence scores from the logits outputs and the learned features of a deep neural network. Empirically, we show that IGEOOD outperforms competing state-of-the-art methods on a variety of network architectures and datasets.

heading: 1 INTRODUCTION
text: Deep neural networks (DNNs) achieve state-of-the-art in several classification tasks as they are known to generalize well on data with similar distribution to the training set. Whereas, in many practical applications, the training set does not reflect well enough the real-life environment (QuioneroCandela et al., 2009) which is often non-stationary and sometimes with unpredictable events. As a consequence, matching the training scenario to reality can be either not possible or too complex. The failure of machine learning (ML) models to adapt to non-stationary distributions could limit their adoption in critical systems (e.g., autonomous devices, healthcare applications).
Out-of-Distribution (OOD) or novelty detection is one of the main objectives in conceiving reliable ML systems (Amodei et al., 2016). A typical application is in monitoring ML-based online services for periodically shifting distributions. However, tracking changes in the underlying data distribution is challenging as they contain unusual (irregular or unexpected) events and have large dimensions. For instance, relying on the intrinsic properties of the ML models and their statistical behavior in the presence of in-distribution data is key to identifying OOD samples. Classic approaches to OOD detection consist of deriving metrics for detecting those abnormalities from the lens of ML models (e.g., softmax output, latent representations across layers), provided that often only a single test example is available. Besides, those metrics are subject to potential limitations inherent to practical scenarios depending on the level of information access in the ML model, e.g., only having access to the last layer or all intermediate layers.
The baseline approach for OOD detection relies on the predictive uncertainty of DNNs. Hendrycks & Gimpel (2017) demonstrated that OOD samples, in general, induce DNN classifiers to output less confident softmax scores. Whereas existing state-of-the-art methods on classification problems still output high accuracy even under dataset shift. For instance, Ovadia et al. (2019) show that as the accuracy of the underlying DNN increases, the supervisors’ outlier detection accuracy also improves. Unfortunately, also the variance increases. Henriksson et al. (2021) observed that small changes in model parameters that marginally impact the accuracy could have a degrading impact on the performance of the OOD discriminator. This challenge is not exclusive to discriminative models. Deep generative models also fall short in discerning OOD from in-distribution samples. Nalisnick et al. (2019) raise awareness of the fact that deep generative models also may output a higher likelihood to OOD samples. They show that, even though the samples from the in-distribution CIFAR-10 (Krizhevsky et al., 2009) dataset (e.g., cats, dogs, airplanes, ships) are conceptually and visually different from house numbers from SVHN (Netzer et al., 2011) dataset, DNN-based classifiers may still assign a high likelihood to SVHN samples.
In this paper, we propose IGEOOD, a new unified and effective method to perform OOD detection by rigorously exploring the information-geometric properties of the feature space on various depths of a DNN. IGEOOD provides a flexible framework that applies to any pre-trained softmax neural classifier. A key ingredient of IGEOOD is the Fisher-Rao distance. This distance is used as an effective differential geometry tool for clustering and as a distance in the context of multivariate Gaussian pdfs (Pinele et al., 2020; Strapasson et al., 2016). In our context, we measure the dissimilarity between probability (in and out) distributions, as the length of the shortest path within the manifold induced by the underlying class of distributions (i.e., the softmax probabilities of the neural classifier or the densities modeling the learned representations across the layers). By doing so, we can explore statistical invariances of the geometric properties of the learned features (Bronstein et al., 2021). Our method adapts to the various scenarios depending on the level of information access of the DNN and uses only in-distribution samples but can also benefit (if available) from OOD samples.

heading: 1.1 CONTRIBUTIONS
text: Our work studies the problem of OOD detection and advances state-of-the-art in very different ways.
• To the best of our knowledge, this is the first work studying information geometry tools to devise a unified metric for OOD detection. We derive an explicit characterization of the Fisher-Rao distance based on the information-geometric properties of the softmax probabilities of the neural classifier and the class of multivariate Gaussian pdfs. In general terms, our Fisher-Rao-based metric measures the mismatch–in the geometry space–between probability density functions of the pre-trained DNN classifier conditioning on test and indistribution samples. Section 3 shows in detail how IGEOOD is used for OOD detection.
• Experiments on BLACK-BOX and GREY-BOX setups using various datasets, architectures, and classification tasks show that IGEOOD is competitive with state-of-the-art methods. In the BLACK-BOX setup, we assume that only the outputs, i.e., the logits of the DNN, are available. In the GREY-BOX setup, we allow access to all parameters of the network; however, the detection must be performed using only the output softmax probabilities. The latter permits input pre-processing which introduces a small (additive) noise according to the direction of the gradients w.r.t the test sample. This pre-processing allows for further discrimination between in- and out-of-distribution samples. Our benchmark contains two DNN architectures, three in-distribution datasets, and nine OOD datasets.
• In a WHITE-BOX setting, we combine the logits with the low-level features of the DNN to leverage further useful statistical information of the encoded in-distribution data. We model the pre-trained latent representations as a mixture of Gaussian pdfs with a diagonal covariance matrix. Under this assumption, we derive a confidence score based on the Fisher-Rao distance between conditional pdfs corresponding to the test and the closest indistribution samples. Experiments based on various datasets, architectures, and classification tasks clearly show consistent improvement of IGEOOD, achieving new state-of-the-art performance on a couple of benchmarks. In particular, we increased the average TNR at 95% TPR by 11.2% with tuning on OOD data and by 2.5% with tuning on adversarial data compared to Lee et al. (2018).

heading: 1.2 RELATED WORKS
text: OOD discriminators consist of a binary classifier to distinguish between in- and out-of-distribution samples. A few works (Shalev et al., 2018; Hendrycks et al., 2019; Bitterwolf et al., 2020; Mohseni et al., 2020; Winkens et al., 2020; Vyas et al., 2018; Hein et al., 2019) propose retraining the base (or an auxiliary) model with synthetic or ground truth OOD samples to serve as a classifier and as an OOD discriminator. Disposing of both OOD and in-distribution samples during training enables the latent representations to learn the decision boundaries to facilitate OOD detection. These methods will not be compared to ours in this work, as they entail retraining or modifying the base neural network by using OOD data to further train parameters. Nagarajan et al. (2021) studies failure modes of OOD detection methods to better understand how to improve them, especially how spurious features like the background can vastly degrade detection performance. Lee et al. (2021) leverage OOD data as a regularization technique to improve the generalization and robustness of current neural networks. References (Schlegl et al., 2017; Kirichenko et al., 2020; Choi & Jang,
2019; Vernekar et al., 2019; Xiao et al., 2020; Ren et al., 2019; Zhang et al., 2021; Mahmood et al., 2021; Zhang et al., 2020; Zisselman & Tamar, 2020) study OOD detection in the context of generative models for density estimation. Open set recognition (Bendale & Boult, 2016), outlier or anomaly detection (Pimentel et al., 2014), concept drift detection (Quionero-Candela et al., 2009), and adversarial attacks detection (Goodfellow et al., 2015; Madry et al., 2018) are related topics.
BLACK-BOX and GREY-BOX scenarios. It is often the case on ML as a service (Ribeiro et al., 2015) that the model’s parameters knowledge and access are restricted to the end-user, granting access only to the computation of the forward and the logits or softmax outputs. The baseline work (Hendrycks & Gimpel, 2017) for BLACK-BOX techniques considers simply the unscaled maximum value of the softmax (MSP) as OOD score. In some cases, this confidence score is enough to distinguish between in-distribution and out-of-distribution examples, but it also may assign overconfident values to OOD examples (Hein et al., 2019). ODIN’s (Liang et al., 2018) method has two variations. The BLACK-BOX variation consists of temperature scaling the softmax outputs. While the GREYBOX variation also uses an input pre-processing technique that calculates the gradient of the model parameters and adds to the input in an adversarial manner for a more effective OOD detection. Hsu et al. (2020) proposes a variation of ODIN that does not need access to OOD data for validation. Liu et al. (2020) proposes an energy-based OOD score. Without retraining, they substitute the softmax confidence score by the free energy function with a temperature parameter. They also propose a GREY-BOX variation with posterior processing for improved results. Fine-tuning is done differently across the literature and should be considered when comparing methodologies.
WHITE-BOX scenario. This class of OOD detectors has access to all intermediate layer outputs. Naturally, discriminators have access to more information than the BLACK-BOX or GREY-BOX setups, warranting greater detection capacity. Batch-normalization statistics between layers are used (Quintanilha et al., 2019) to fit a logistic regression that serves as an OOD detection score. Sastry & Oore (2020) proposes high order Gram matrices to perform OOD detection by computing classconditional pairwise feature correlations between the test sample and the training set across the hidden layers of the network. Lee et al. (2018) assume that latent features of DNN models trained under the softmax score follow a class-conditional Gaussian mixture distribution with tied covariance matrix and different class-conditional mean vectors. They calculate the Mahalanobis distance between a test sample as a single estimator of the mean of a class-conditional Gaussian distribution with a tied covariance matrix estimated on the training set. The importance of each low-level component and hyperparameters are tuned using validation data. Ren et al. (2021) modifies this method to improve detection of near-OOD data. They fit the layer-wise background distribution with a Gaussian distribution with mean and standard calculated empirically from the training set. They subtract the Mahalanobis distance between the test example and this distribution from the score proposed in Lee et al. (2018), reducing the importance of features shared by in- and out-of-distribution data.

heading: 2 BACKGROUND
text: Let X ⊆ Rd be the feature space (continuous) and Y a label space. Moreover, let pXY be the underlying unknown probability density function (pdf) over X × Y . We define the in-distribution training dataset as DN , { (xi, yi) }N i=1 ∼ pXY , where xi ∈ X is the input feature data, yi ∈ Y , {1, . . . , C} is the output class among C possible classes and N denotes the number of training samples. The training dataset is characterized by the joint pdf pXY with in-distribution marginals X ∼ pX and Y ∼ PY . The predictor denoted by fDN : X → Y is based on the inferred model PŶ |X , i.e., fDN (x) ≡ fn(x;DN ) , arg maxy∈Y PŶ |X(y|x;DN ). In order to model the underlying problem, we introduce an artificial binary random variable Z ∈ {0, 1} indicating with z = 1 that the test sample x is OOD and otherwise, it is in-distribution. The open-world data can then be modeled as a mixture distribution pX|Z defined by
pX|Z(x|z = 0) , pX(x), pX|Z(x|z = 1) , qX(x). (1)
The intrinsic difficulty arises from the fact that very little can be assumed about the unknown distributions pX and qX , in particular for out-of-distribution.

heading: 3 IGEOOD: OOD DETECTION USING THE FISHER-RAO DISTANCE
text: In this section, we introduce IGEOOD, a flexible framework for OOD detection. IGEOOD is implemented in two ways: at the level of the logits using temperature scaling (Section 3.2), which mitigates the high-confidence scores assigned to OOD examples, and layer-wise level (Section 3.3). The key ingredient of IGEOOD is the Fisher-Rao distance that allows for effective differentiation between in-distribution and out-of-distribution samples. This distance measures the dissimilarity between two probability models within a class of probability distributions by calculating the geodesic distance between two points on the learned manifold. This measure connects information geometry and differential geometry through the R. Fisher information matrix (Fisher, 1922). Closed-form expressions of this distance are known to multivariate normal distributions under certain assumptions, among others distributions (Pinele et al., 2020).

heading: 3.1 MOTIVATION FOR THE USE OF THE FISHER-RAO DISTANCE FOR OOD DETECTION
text: We introduce a simple example to demonstrate conceptually how Fisher-Rao distance is instrumental to OOD detection. It should be noted that this example is limited to one dimension. However, we expect a similar behavior to be observed with more complex data that fit in a Gaussian model.
Consider the case where we are trying to distinguish between samples from distinct Gaussian distributions on 1D. We suppose that the in-distribution data follows a Gaussian N (µ1, σ1) while OOD data is drawn according to eitherN (µ2, σ1) orN (µ2, σ2). These distributions are illustrated in Figures 1a and 1b. In this setup, distance-based approaches which are invariant to the variance of the distributions would have the performance limited to the information given by the difference between the means of the underlying distributions. For instance, in the case of the Mahalanobis distance, we would rely our discrimination on the difference between the sample and the in-distribution mean, rescaled by the in-distribution standard deviation only, but nothing further could be obtained. However, if we can estimate OOD standard deviations from actual or pseudo OOD data, we expect the Fisher-Rao distance between Gaussian distributions to be more effective in distinguishing between distributions. Figure 1c shows that the Fisher-Rao distance can distinguish better between “In-dist.” and “OOD II” samples, while the other distances will fail.

heading: 3.2 IGEOOD SCORE USING THE SOFTMAX PROBABILITY
text: The Fisher-Rao distance (Atkinson & Mitchell, 1981) takes as input two probability distributions. For the classification problem, we can take the temperature T scaled softmax function (Eq. (2)) as an approximation of a class-conditional probability distribution:
qθ (y|f(x);T ) , exp (fy(x)/T )∑
y′∈Y exp (fy′(x)/T ) , (2)
where f : X → RC is a vectorial function with f , ( f1, f2, . . . , fC ) and fy(·) denotes the y-th logits output value of the DNN classifier. The Fisher-Rao distance dFR−Logits between two
probability distributions resulting from the softmax probability evaluated at two data points is1:
dFR−Logits ( qθ(·|f(x)), qθ(·|f(x′)) ) , 2 arccos ∑ y∈Y √ qθ ( y|f(x) ) qθ ( y|f(x′) ) . (3) Class conditional centroid estimation. We model the training dataset class-conditional posterior distribution by calculating the centroid of the logits representations of this set. Precisely, we compute the empirical centroid for the logits of each class y ∈ Y = {1, . . . , C} of the in-distribution training dataset DN corresponding to the Fisher-Rao distance, i.e.,
µy , min µ∈RC
1
Ny ∑ ∀ i : yi=y dFR−Logits ( qθ(·|f(xi)), qθ(·|µ) ) , (4)
whereNy is the amount of training examples with label y. We optimize this expression offline using SGD algorithm, where the parameter to be tuned isµ in the logits space. This is equivalent to finding the centroid of a cluster using the Fisher-Rao distance, after each example has been assigned to a cluster. Please refer to the appendix (see Section B) for further details on this optimization.
OOD and confidence score. We propose the Fisher-Rao distance-based OOD detection score FR0(x) for the logits to be the sum of the distances between f(x) and each individual class conditional centroid µy given by Eq. (4). By taking the sum instead of the minimal distance, we leverage useful information related to the example’s confidence score for each class y. We denote it by
FR0(x) , ∑ y∈Y dFR−Logits ( qθ(·|f(x)), qθ(·|µy) ) . (5)
Using the softmax probability, we can define a confidence score to be the minimum of the Fisher-Rao distance between f(x) and the class-conditional centroids. As a sanity check, we show empirically in the appendix (see Section C) that this confidence score does not degrade the in-distribution test classification accuracy. Thus, the estimated class ŷFR follows as:
ŷFR(x) , arg min y∈Y
dFR−Logits ( qθ(·|f(x)), qθ(·|µy) ) . (6)
However, we obtained slightly better OOD detection results by using Eq. (5) instead of the minimal value, which is natural since we are using extra information from the other logits dimensions. We provide an empirical study comparing both methods in the appendix (see Section E.1).
Input pre-processing. In consonance with the literature (Liang et al., 2018; Liu et al., 2020; Lee et al., 2018), we also perform input pre-processing to enhance the detection between in-distribution and OOD samples and potentially improve OOD detection performance for the GREY-BOX discriminator. We add small magnitude perturbations ε in a Fast Gradient-Sign Method-style (FGSM) (Goodfellow et al., 2015) to each test sample x to increase the proposed metric, that is:
x̃ = x+ ε sign [ ∇xFR0(x) ] . (7)
The OOD detector. The detector consists of a threshold-based function for discriminating between in-distribution and OOD data. This threshold δ and parameters are set so that the true positive rate, i.e., the in-distribution samples correctly classified as in-distribution, becomes 95%. Mathematically, the BLACK-BOX OOD detector gBB and the GREY-BOX OOD detector gGB writes:
gBB(x; δ, T ) = { 1 if FR0 (x) ≤ δ 0 if FR0 (x) > δ and gGB(x̃; δ, T, ε) = { 1 if FR0 (x̃) ≤ δ 0 if FR0 (x̃) > δ . (8)

heading: 3.3 IGEOOD SCORE LEVERAGING LATENT FEATURES
text: For each layer, we define a set of class-conditional Gaussian distributions with diagonal standard deviation matrix σ(`) and class-conditional mean µ(`)y , where y ∈ {1, . . . , C} and ` is the index of
1We refer the reader to the appendix (see Section A).
the latent feature. We compute the empirical estimates of these parameters according to
µ(`)y = 1
Ny ∑ ∀i : yi=y f (`) (xi) , and σ(`) = diag √ 1 N ∑ y∈Y ∑ ∀i : yi=y ( f (`) j (xi)− µ (`) y,j )2 , (9) where j ∈ {1, . . . , k}, k is the size of feature `, and f (`)(·) is the output of the network for feature `. The Fisher-Rao distance ρFR between two arbitrary univariate Gaussian pdfs N (µ1, σ21) and N (µ2, σ22) is given by2
ρFR ((µ1, σ1) , (µ2, σ2)) = √ 2 log
∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 ,−σ2 )∣∣∣+ ∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 , σ2 )∣∣∣∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 ,−σ2 )∣∣∣− ∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 , σ2
)∣∣∣ . (10) Similarly, the Fisher-Rao distance dFR−Gauss between two multivariate Gaussian pdfs with diagonal standard deviation matrix is derived from the univariate case and is given by
dFR−Gauss ( (µ,σ), (µ′,σ′) ) = √√√√ k∑ i=1 ρFR ( (µi, σi,i) , ( µ′i, σ ′ i,i ))2 , (11)
where k is the cardinality of the distributions N (µ,σ) and N (µ′,σ′), µi is the i-th component of the vector µ, and σi,i is the entry with index (i, i) of the standard deviation matrix σ.
Experimental support for a diagonal Gaussian mixture model. It is known that abnormal samples can be characterized better in the intermediate features of a DNN, in place of the output space of softmax posterior distributions as demonstrated by Lee et al. (2018). Nonetheless, we observed that the latent features covariance matrices are often ill-conditioned and are diagonal dominant. In other words, the condition number of the covariance matrix often diverges, and the magnitude of the diagonal entry in a row is greater than or equal to the sum of all the other entries in that row for most rows. Thus, a diagonal covariance matrix will be a favorable compromise for OOD detection. Please refer to the appendix (see Section B.3) for further details on the Gaussian model.
Fisher-Rao distance-based feature-wise confidence score. We derive a confidence score by applying the Fisher-Rao distance between the test sample x and the closest class-conditional diagonal Gaussian distribution. We can consider two scenarios: (i) We do not have access to any validation OOD data whatsoever. In this case, the natural choice is to model the test samples as Gaussian distribution with the same diagonal standard deviation as the learned representation, i.e.,
FR`(x) = min y∈Y
dFR−Gauss ( (x,σ(`)), (µ(`)y ,σ (`)) ) ; (12)
and (ii) we dispose of a validation OOD dataset on which the features’ diagonal standard deviation matrices σ′(`) and the means µ′(`) can be estimated, as well as the quantity:
FR′`(x) = min y∈Y
dFR−Gauss ( (x,σ(`)), (µ′(`),σ′(`)) ) . (13)
This validation dataset could be obtained from a synthetic dataset, a dataset different from the testing one, or even by adversarially creating OOD data by attacking the classifier model on the training dataset. In the appendix (Section B), we include pseudo-codes for calculating the IGEOOD score for the BLACK-BOX, GREY-BOX, and WHITE-BOX settings.
Feature ensemble. To further improve performance, we combine the confidence scores of the logits and the ones from the low-level features through a linear combination. Similarly to the strategy in Lee et al. (2018), we choose the weights α0, α` and α′` ∈ R by training a logistic regression detector using validation samples. Thus, we ensure that the metric emphasizes features that demonstrate a greater capacity for detecting abnormal samples. The following equation summarizes the IGEOOD score for the WHITE-BOX setting:
FR(x) , α0FR0(x) + ∑ ` α` · FR`(x) + α′` · FR′`(x), (14)
where FR0 is given by equation (5), FR` is given by equation (12) and FR′ considers a different validation diagonal covariance matrix for the test samples (equation (13)). We also apply input pre-processing similarly to the GREY-BOX setting (equation (7)), obtaining FR(x̃) as final score.
2The reader can be refereed to the appendix (Section A) for the derivation of this distance.
Unified metric. For the three settings, the metric is the same but has different formulations given the family of the distributions. For the DNN outputs, it is under the softmax posterior probability distribution setup. For the intermediate layers, it is under the model of diagonal Gaussian pdfs. Therefore, we have derived a unified OOD detection framework that combines a single distance for both the softmax outputs and the latent features of a neural network. Figure 2 illustrates how each of the presented techniques contributes towards separating in-distribution and OOD samples. Additional histograms of the detection scores are relegated to the appendix (see Section F).

heading: 4 EXPERIMENTAL RESULTS
text: We show the effectiveness of IGEOOD comparing to state-of-the-art methods. Details about the experimental setup3 and additional results are given in appendices (see Sections C, D, and E).

heading: 4.1 SETUP
text: The experimental setup follows the setting established by Hendrycks & Gimpel (2017), Liang et al. (2018) and Lee et al. (2018). We use two pre-trained deep neural networks architectures for image classification tasks: a Dense Convolutional Network (DenseNet-BC-100) (Huang et al., 2017) and a Residual Neural Network (ResNet-34) (He et al., 2016). We take as in-distribution data images from CIFAR-10 (Krizhevsky et al., 2009), CIFAR-100 and SVHN (Netzer et al., 2011) datasets.
For out-of-distribution data, we use natural image examples from the datasets: Tiny-ImageNet (Le & Yang, 2015), LSUN (Yu et al., 2015), Describable Textures Dataset (Cimpoi et al., 2014), Chars74K (de Campos et al., 2009), Places365 (Zhou et al., 2017), iSUN (Xu et al., 2015) and a synthetic dataset generated from Gaussian noise. For models pre-trained on CIFAR-10, data from CIFAR-100 and SVHN are also considered OOD; for models pre-trained on CIFAR-100, data from CIFAR-10 and SVHN are considered OOD, and for models pre-trained on SVHN, CIFAR-10 and CIFAR100 datasets are considered OOD. We resize the images to dimension 32 × 32 by downsampling and applying center crop when needed. We only use test data for evaluation. Even though we ran experiments with image data, IGEOOD could be applied to any neural-based classification task.
We measure the effectiveness of the OOD detectors with three standard evaluation metrics: (i) The true negative rate at 95% true positive rate (TNR at TPR-95%); (ii) the area under the receiving operating curve (AUROC); and (iii) the area under the precision-recall curve (AUPR). For calculating them, we use the test set of in-distribution and OOD datasets. For the BLACK-BOX and GREYBOX experimental settings, we tune hyperparameters for all of the OOD detectors only based on the DNN classifier architecture, the in-distribution dataset, and a validation dataset. The iSUN (Xu et al., 2015) dataset is chosen as a source of OOD validation data, independently from OOD test data. We choose the parameters that maximize the TNR at TPR-95% on the validation OOD dataset. For the WHITE-BOX framework, we allow both the benchmark and our method to tune either on adversarially generated data from in-distribution training samples or on a separate validation dataset containing 1, 000 images from the OOD test dataset with feature ensemble described in Section 3.3. In this case, we evaluate performance on the remaining test samples.
3Our code is publicly available at https://github.com/igeood/Igeood.

heading: 4.2 RESULTS FOR THE BLACK-BOX AND THE GREY-BOX SETUPS
text: For comparing IGEOOD under the hypothesis of a BLACK-BOX scenario, we consider the Baseline (Hendrycks & Gimpel, 2017) method, ODIN (Liang et al., 2018) with temperature scaling only, and the free-energy-based metric (Liu et al., 2020) with temperature scaling only–without input pre-processing or re-training. The results for the BLACK-BOX setting are available in Table 1, where we show the average and one standard deviation OOD detection performance for each of the eight OOD detection method in six different image classification contexts (couple DNN model and in-distribution dataset). The extended results for each OOD dataset can be found in Table 13. For comparison under the GREY-BOX assumption, we consider ODIN and the free-energy-based methods, both with input pre-processing. The results for the GREY-BOX setup are provided in the appendix (see Section E and Table 10). For the BLACK-BOX setting, IGEOOD slight improves the benchmark by less than 1% in TNR at TPR-95%. While for the GREY-BOX setting, results show IGEOOD is outperformed by <1% in a few benchmarks by ODIN, which is greatly improved by input pre-processing techniques.
Temperature scaling and input pre-processing. We observed that low values of temperature and moderate noise magnitude yield better detection performance for IGEOOD on the logits. For most models and datasets, we obtained better results for temperatures between 1 and 6 and noise magnitudes below 0.002. Detailed results and the best hyperparameters found for each configuration, as well as figures of their impact on performance, are delegated to the appendix (see Section E).
How the choice of validation dataset impacts performance. We include in the appendix (see Section E) the average OOD detection performance for each method when we change the validation set among the nine available ones. We show that the average TNR at TPR-95% for IGEOOD ranges between 63% and 72% on a BLACK-BOX scenario and between 65% and 74% on a GREY-BOX scenario. The performances among the compared methods are consistent across validation datasets.

heading: 4.3 RESULTS FOR THE WHITE-BOX SETTING
text: For benchmarking IGEOOD on the WHITE-BOX setting, we compare results to the Mahalanobis (Lee et al., 2018) method with input pre-processing and feature ensemble. For both of them, we extract features from every output of the dense (or residual) block of the DenseNet (or ResNet) model and the first convolutional layer. The size of each feature is reduced by average pooling in the spatial dimensions. Thus, the initial dimension F` × W` × H` is reduced to F`, where F` is the number of channels in block `. For DenseNet, this reduction translates to features of sizes F1 = {24, 108, 150, 342}; and for ResNet, to features of sizes F2 = {64, 64, 128, 256, 512}. We consider two scenarios for tuning hyperparameters for both Mahalanobis and IGEOOD: one with adversarially generated (FGSM) and in-distribution data and another one with 1,000 OOD samples and in-distribution data. We derive two methods: IGEOOD+, which is given by equation (14) and considers that we can calculate the statistics from OOD data as additional information; and IGEOOD, which doesn’t consider any prior on OOD data, i.e., set α′` = 0 on equation (14).
Comparison with current literature. For each DNN model and in-distribution dataset pair, we report the average and one standard deviation OOD detection performance for Mahalanobis (Lee et al., 2018), IGEOOD and IGEOOD+. Table 2 validates the contributions of our techniques. We observe substantial performance improvement in all experiments for the left-hand side of the table, where we outperform Mahalanobis on average for all test cases. IGEOOD+ show improvements of at least 2.1% up to 23% on TNR at TPR-95%. To assess the consistency of IGEOOD to the choice of validation data, we measured the detection performance when all hyperparameters are tuned only using in-distribution and generated adversarial data, as observed in the right-hand side of Table 2. IGEOOD record improvements up to 10.5%, and improves by 2.5% the average TNR at TPR-95% across all datasets and models. We provide an extra benchmark against other WHITE-BOX methods (Sastry & Oore, 2020; Hsu et al., 2020; Zisselman & Tamar, 2020) (see Table 11 in the appendix).
Ablation study. IGEOOD has three components, FR0, FR`, and FR′`, that together compose the final metric given by equation (14). The outputs of the network provide limited OOD detection capacity as observed in Table 1. Always when available, the intermediate features, i.e., FR`, are a valuable resource for OOD detection. Moreover, when few reliable OOD data is available, calculating FR′` can further improve the detection performance as shown on the left side column of Table 2. Also, data from a source other than in-distribution, e.g., adversarial samples, is enough for tuning hyperparameters and combining features, as observed on the right side column of Table 2. We also studied the detection capacity of each hidden layer before any tuning in the appendix (see Section B.4). Experiments show that the Fisher-Rao metric effectively separates in- and out-ofdistribution data for each of the features individually as well.

heading: 5 SUMMARY AND CONCLUDING REMARKS
text: In this work, we introduced IGEOOD, an effective and flexible method for Out-of-Distribution detection that applies to any pre-trained neural network. The main feature of IGEOOD relies on the geodesic distance of the probabilistic manifold of the learned latent representations that induces an effective measure for OOD detection. First, in a (GREY-) BLACK-BOX setup, we calculate the sum of the Fisher-Rao distance between the softmax output, corresponding to the test (pre-processed) sample, and a reference probability, corresponding to the conditional-class of softmax probabilities. Similarly, in a WHITE-BOX setup, we model the low-level features of a DNN as a diagonal Gaussian mixture. The Fisher-Rao distance between the pdf of the latent feature, corresponding to the test sample, and a reference pdf, corresponding to the conditional-class of pdfs, provides an effective confidence score. We consider diverse testing environments where prior knowledge of OOD data may or may not be available, which reflect diverse application scenarios. Experimentally, we showed that IGEOOD significantly and consistently improves the accuracy of OOD detection on several DNN architectures across various in-distribution and OOD datasets for a WHITE-BOX setting. Some perspectives for future work include studying causal factors, explainable components for OOD detection, and extensions to textual data.

heading: A REVIEW OF FISHER-RAO DISTANCE (FRD)
text: In this section, we review some results from references Atkinson & Mitchell (1981); Pinele et al. (2020). We intend to clarify some basic concepts surrounding the Fisher-Rao distance while motivating the use of this measure in the context of OOD detection.
In few words, the Fisher-Rao’s distance is given by the geodesic distance, i.e., the shortest path between points in a Riemannian space induced by a parametric family. Consider the family C of probability distributions over the class of discrete concepts or labels: Y = {1, . . . , C}, denoted by C , { qθ(·|x) : x ∈ X ⊆ RC } .
We are interested in measuring the distance between probability distributions qθ(·|x) with respect to the testing input x and a population of inputs drawn accordingly to the in-distribution data set. To this end, we first need to characterize the Fisher-Rao distance for two inputs or for two probability distributions qθ, q′θ ∈ C. Assume that the following regularity conditions hold (Atkinson & Mitchell, 1981):
(i) ∇x qθ(y|x) exists for all x, y and θ ∈ Θ; (ii) ∑ y∈Y ∇x qθ(y|x) = 0 for all x and θ ∈ Θ;
(iii) G(x) = EY∼qθ(·|x) [ ∇x log qθ(Y |x)∇>x log qθ(Y |x) ] is positive definite for any x and
θ ∈ Θ.
Notice that if (i) holds, (ii) also holds immediately for discrete distributions over finite spaces (assuming that ∑ y∈Y and∇x are interchangeable operations) as in our case. When (i)-(iii) are met, the variance of the differential form∇>x log qθ(Y |x)dx can be interpreted as the square of a differential arc length ds2 in the space C, which yields
ds2 = 〈dx, dx〉G(x) = dx>G(x)dx. (15)
Thus, G, which is the Fisher Information Matrix (FIM), can be adopted as a metric tensor. We now consider a curve γ : [0, 1]→ X connecting a pair of arbitrary points x, x′ in the input space X , i.e., γ(0) = x and γ(1) = x′. Notice that any curve γ induces a curve qθ(·|γ(t)) for t ∈ [0, 1] in the space C. The Fisher-Rao distance between the distributions qθ = qθ(·|x) and q′θ = qθ(·|x′) will be denoted as dR,C(qθ, q′θ) and is formally defined by the expression:
dR,C(qθ, q ′ θ) , inf
γ ∫ 1 0 √ dγ>(t) dt G(γ(t)) dγ(t) dt , (16)
where the infimum is taken over all piecewise smooth curves. This means that the FRD is the length of the geodesic between points x and x′ using the FIM as the metric tensor. In general, the minimization of the functional in equation (16) is a problem that can be solved using the well-known Euler-Lagrange differential equation.

heading: A.1 DERIVATION OF FISHER-RAO DISTANCE FOR THE CLASS OF SOFTMAX PROBABILITY DISTRIBUTIONS
text: The direct computation of the FIM of the family C with qθ(y|x) in the form of the softmax probability distribution function given by equation (2) can be shown to be singular, i.e., rank(G(x)) ≤ C−1, where C − 1 is the number of degrees of freedom of the manifold C. To overcome this issue, we introduce the probability simplex P defined by
P = q : Y → [0, 1]C : ∑ y∈Y q(y) = 1  . (17) Next, we consider the following parametrization for any distribution q ∈ P:
q(y|z) = z2y 4 , y ∈ {1, . . . , C}. (18)
From this expression, we consider the statistical manifold D ={ q(·|z) : ‖z‖2 = 4, zy ≥ 0,∀y ∈ Y } . Note that the parameter vector z belongs to the positive portion of a sphere of radius 2 and centered at the origin in RC . The computation of the FIM for z on D yields:
G(z) = Eq(y|z) [ ∇z log q(y|z)∇>z log q(y|z) ] = ∑ y∈Y z2y 4 ( 2 zy ey )( 2 zy e>y
) = ∑ y∈Y eye > y
= I,
(19)
where {ey} are the canonical basis vectors in RC and I is the identity matrix. From equation (19) we can conclude that the Fisher-Rao metric in this parametric space is equal to the Euclidean metric. Also, since the parameter vector lies on a sphere, the FRD between the distributions q = q(·|z) and q′ = q (·|z′) can be written as the radius of the sphere times the angle between the vectors z and z′. Which leads to expression:
dR,D (q, q ′) = 2 arccos
( z>z′
4
) = 2 arccos ∑ y∈Y √ q(y|z)q (y|z′)  . (20) Finally, we can compute the FRD for softmax distributions in C as
dFR−Logits (qθ, q ′ θ) = 2 arccos ∑ y∈Y √ qθ(y|x)qθ (y|x′)  , (21) obtaining the same form of equation (3). Notice that 0 ≤ dFR−Logits (qθ, q′θ) ≤ π for all x,x′ ∈ X ⊆ RC , being zero when qθ(·|x) = qθ (·|x′) and maximum when the vectors( qθ(1|x), . . . , qθ(C|x) ) and ( qθ (1|x′) , . . . , qθ (C|x′) ) are orthogonal.

heading: A.2 DERIVATION OF FISHER-RAO DISTANCE FOR MULTIVARIATE GAUSSIAN DISTRIBUTIONS
text: Consider a broader statistical manifold S , {pθ = p(x;θ) : θ = (θ1, θ2, . . . , θm) ∈ Θ} of multivariate differential probability density functions. The Fisher information matrixG(θ) = [gij(θ)] in this parametric space is provided by:
gij(θ) = Eθ ( ∂
∂θi log p(x;θ)
∂
∂θj log p(x;θ) ) = ∫ ∂
∂θi log p(x;θ)
∂
∂θj log p(x;θ)p(x;θ)dx.
(22)
Next, consider a multivariate Gaussian distribution:
p(x;µ,Σ) = (2π)−( n 2 )√
Det(Σ) exp
( − (x− µ)
>Σ−1(x− µ) 2
) , (23)
where x ∈ Rk is the variable vector, µ ∈ Rk is the mean vector, Σ ∈ Pk(R) is the covariance matrix, andPk(R) is the space of k positive definite symmetric matrices. We can define the statistical manifold composed by these distributions asM = {pθ;θ = (µ,Σ) ∈ Rk×Pk(R)}. By substituting equation (23) in equation (22), we can derive the Fisher information matrix for this parametrization, obtaining:
gij(θ) = ∂µ>
∂θi Σ−1
∂µ ∂θj + 1 2 tr
( Σ−1 ∂Σ
∂θi Σ−1
∂Σ
∂θi
) , (24)
which induces the following square differential arc length inM:
ds2 = dµ>Σ−1dµ+ 1 2 tr [( Σ−1dΣ )2] . (25)
Here, dµ = (dµ1, . . . , dµn) ∈ Rk and dΣ = [dσij ] ∈ Pk(R). We observe that this metric is invariant to affine transformations (Pinele et al., 2020), i.e., for any (c, Q) ∈ Rk × GLk(R), with GLk(R) the space of non-singular order k matrices, the map (µ,Σ) 7→ ( Qµ+ c, QΣQ> ) is an isometry inM. Thus, the Fisher-Rao distance between two multivariate normal distributions with parameters θ1 = (µ1,Σ1) and θ2 = (µ2,Σ2) inM satisfies:
dR,M (θ1,θ2) = dR,M (( Qµ1 + c, QΣ1Q >) , (Qµ2 + c, QΣ2Q>)) . (26) Unfortunately, a closed-form solution for the Fisher-Rao distance remains unknown. This is still an open problem for an arbitrary covariance matrix Σ and mean vector µ. Fortunately, the FRD is known for the univariate case and hence, for the submanifold where Σ is diagonal. Notice that in this case equation (25) admits an additive form.
From Pinele et al. (2020), we obtain the analytical expression of the Fisher-Rao in the 2-dimensional submanifold of univariate Gaussian probability distributions M2 = {pθ : θ = (µ, σ2) ∈ R × (0,+∞)}:
ρFR (( µ1, σ 2 1 ) , ( µ2, σ 2 2 )) = √ 2 log
∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 ,−σ2 )∣∣∣+ ∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 , σ2 )∣∣∣∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 ,−σ2 )∣∣∣− ∣∣∣( µ1√ 2 , σ1 ) − ( µ2√ 2 , σ2
)∣∣∣ , (27) where | · | is the Euclidian norm in R2 and σ denotes the standard deviation. Consequently, the FRD for Gaussian distributions with diagonal covariance matrix Σ = diag ( σ21 , σ 2 2 , . . . , σ 2 k ) in the 2k-
dimensional statistical submanifoldMD = { pθ : θ = (µ,Σ),Σ = diag ( σ21 , σ 2 2 , . . . , σ 2 k ) , σi >
0, i = 1, . . . , k } is
dFR−Gauss (θ1,θ2) = √√√√ k∑ i=1 dR,M2 ( (µ1i, σ1i) , (µ2i, σ2i) )2 . (28)

heading: A.3 FISHER-RAO VS. MAHALANOBIS DISTANCE
text: There is an intricate relationship between the FRD for multivariate Gaussian distributions and the Mahalanobis distance. We borrow the result from Pinele et al. (2020), which states that in the kdimensional submanifoldMΣ ofM where Σ is constant, i.e.,MΣ = {pθ : θ = (µ,Σ),Σ = Σ0 ∈ Pk(R)}, the Fisher-Rao distance dR,MΣ between two distributions is given by the Mahalanobis distance (Mahalanobis, 1936):
dR,MΣ ( N (µ1,Σ),N (µ2,Σ) ) = √
(µ1 − µ2)TΣ−1(µ1 − µ2). (29) The Mahalanobis distance is also used for OOD detection (Lee et al., 2018) and its performance is compared to the FRD through several experiments in Section 4. Since the covariance matrix for the hidden layers’ outputs is often not full rank, the pseudo-inverse is calculated instead of the inverse.
B IGEOOD ALGORITHMS AND COMPUTATION DETAILS
In this section, we provide pseudo-code for calculating the IGEOOD score from the logits (Algorithm 1) and from the latent features (Algorithm 2). The BLACK-BOX IGEOOD score is obtained with Algorithm 1 by setting ε = 0, while the GREY-BOX IGEOOD score is obtained with ε > 0. We calculated the centroid of the logits for the in-distribution training set by optimizing the objective function given by equation (4) through a gradient descent algorithm for each DNN. We used a constant learning rate of 0.01 and a batch size of 128 for 100 epochs. Finally, the WHITE-BOX IGEOOD score is obtained by combining the outputs of Algorithms 1 and 2 through fitting the multiplicative weights α through a logistic function classifier on a labeled mixture dataset composed from in- and out-of-distribution data according to a validation dataset, which leads to expression equation (14).
Note that the calculation of the training logits centroids µy , as well as the latent representations’ mean vectors µ(`)y and standard covariance matrices σ(`) is performed beforehand, prior to inference. In this way, we retrieve the objects from memory at inference time. Also, we define k as the cardinality of feature `, or |f (`)| and ρFR as the Fisher-Rao distance between univariate Gaussian distribution given by expression equation (10).
Algorithm 1: Evaluating IGEOOD score based on the logits. Input : Test sample x, temperature T and noise magnitude ε parameters, and training set DN = {(xi, yi)}Ni=1. Output: FR0: IGEOOD score in the logits level.
Calculate the logits centroids from the training data:
µy , minµ∈RC 1 Ny ∑ ∀ i : yi=y 2 arccos (∑ y′∈Y √ qθ ( y′|f(xi) ) qθ ( y′|µ )) Add small perturbation to x: x̃← x+ ε sign [ ∇x ∑ y 2 arccos (∑ y′∈Y √ qθ(y′|f(x))qθ(y′|µy)
)] return FR0(x̃)← ∑ y 2 arccos (∑ y′∈Y √ qθ(y′|f(x̃))qθ(y′|µy) )
Algorithm 2: Evaluating feature-wise IGEOOD score.
Input : Test sample x and training set DN = {(xi, yi)}Ni=1. Output: FR`: feature-wise IGEOOD scores.
for each feature ` ∈ {1, . . . , L} do Calculate the means: µ(`)y ← 1Ny ∑ i:yi=y f (`) (xi)
Calculate the diagonal standard deviation matrix:
σ (`) jj ← √ 1 N ∑ y∈Y ∑ ∀i : yi=y ( f (`) j (xi)− µ (`) y,j )2 Compute the OOD score for `:
FR`(x)← miny √∑k j=1 ρFR (( µ (`) y,j , σ (`) jj ) , ( f (`) j (x), σ (`) jj ))2 end return ( FR1(x), . . . ,FRL(x) )

heading: B.1 LOGITS CENTROIDS ESTIMATION DETAILS
text: In order to obtain the logits centroids given the Fisher-Rao distance in the space of softmax probability distributions, we designed a simple optimization problem. This problem aims to minimize the average distance between the class conditional training samples and the centroids as given by equation (4). We initialized theC centroids, whereC is the number of classes of a given model, with the identity matrix of size C × C. Note that the initial centroid for class i is given by the matrix’s line number i. We minimized the expression in equation (4) with a gradient descent optimizer for 100 epochs with a fixed learning rate equal to 0.1 for every DNN model and in-distribution dataset.
The computation of the logits centroid is done offline, and the loss of the centroid estimation converges fast. We show in Table 3 the execution time for some operations in the OOD detection pipeline accelerated by one GPU. The left-hand column shows the offline computations that are needed to run our setup. They are as follow:
• Save train set logits: We first do a forward pass through all the training set and save in memory the resulting logits for a given network, which takes on average 83s for CIFAR-10 and CIFAR-100;
• Centroid estimation: We load the training logits from memory and run the Gradient Descent algorithm, which takes on average 1.2s for CIFAR-10 and 11s for CIFAR-100;
The right-hand side of Table 3 shows the average online computation time for one test sample in a BLACK-BOX setting.
• Model inference: The average time needed to complete one forward pass for a DenseNetBC-100 model is 28 ms and 19 ms for CIFAR-10 and CIFAR-100, respectively.
• MSP and BLACK-BOX IGEOOD computations. Computing the OOD detection scores from the calculated softmax output is roughly 100 to 1000 times faster than the inference time taken by the model.
Hence, computing the Fisher-Rao distance between a test sample and the class-conditional centroids does not account for a considerable overhead in execution time.

heading: B.2 COVARIANCE MATRIX ESTIMATION DETAILS
text: We model the latent output probability distributions as Gaussian distributions with diagonal covariance matrix calculated with equation (9). We chose this model motivated by a closed form for the FRD and by observing that the standard covariance matrix for the latent features is often illconditioned. The condition number of a matrix correlates to its numerical stability, i.e., a small rounding error in its estimation may cause a large difference in its values. So, a matrix with a low condition number is said to be well-conditioned, while a matrix with a high condition number is said to be ill-conditioned. We calculate the condition number of the covariance matrices with the formula κ(Σ) =
∥∥Σ−1∥∥∞ ‖Σ‖∞, where ‖ · ‖∞ is the infinity norm. For each of the four dense blocks outputs of a DenseNet trained on CIFAR-10, we obtained the condition numbers κΣ = {2.8e10, 3.5e6, 3.1e5, 3.5e21}. While for the diagonal covariance matrix, we obtained smaller values of condition numbers: κΣD = {1.0e3, 3.0e1, 1.4e1, 7.6e20}. We associate the high value for the last feature mainly because the last feature is high dimensional and coarse, i.e., most of the values in the diagonal are close to zero.

heading: B.3 GAUSSIANITY TEST OF THE HIDDEN LAYERS’ OUTPUTS
text: In order to test if the Gaussian assumption is valid for the hidden features outputs, we conduct a Shapiro & Wilk (1965) normality test for each coordinate of the features for the training data of a DenseNet model. We calculated the test’s W statistic for each coordinate and class and averaged them. We chose a univariate normality test because they are often powerful and the problem is high dimensional what would be unfavorable for a multivariate statistic test. Thus, this study should be considered with caution, given the considered hypothesis. In Figure 3, we also show the standardized histograms for the first coordinate of each layer. Note that, apart from the penultimate layer, if we consider the coordinates of the hidden features independently, the Gaussianity assumption holds, as we obtain a W statistics close to 1. However, for the last block, this assumption sometimes does not hold. Hence, modeling the penultimate layer with a more powerful density estimator, and using a metric that takes into account this more complex distribution, may be favorable for OOD detection.

heading: B.4 FEATURE IMPORTANCE REGRESSION DETAILS
text: For both Mahalanobis and IGEOOD methods, we fitted a logistic regression model with crossvalidation using 1,000 OOD and 1,000 in-distribution data samples. Each regression parameter multiplies the layer scores outputs with the objective function of maximizing the TNR at TPR-95%. We set the maximum number of iterations to 100.
In order to investigate which feature helps the most in OOD detection, we calculate the TNR at TPR-95% for Blocks 1, 2, 3 of a DenseNet pre-trained on CIFAR-10 for Mahalanobis and IGEOOD.
We took as OOD the dataset SVHN. Figure 4 shows the histogram and detection performance for each layer as well as the results from the logistic regression. Note that for the IGEOOD score in this study we did not consider the logits.

heading: C DETAILED EXPERIMENTAL SETUP

heading: C.1 DNN MODELS AND TRAINING DETAILS
text: We describe the DNN models used in the experiments:
• DenseNet. Densely Connected Convolutional Networks (Huang et al., 2017), or DenseNet for short, are compositions of dense blocks, which are composed of multiple layers di-
rectly connected to every other layer in a feed-forward fashion. In this work, we use the DenseNet-BC-100 architecture. The BC stands for a model with 1x1 convolutional bottleneck (B) layers and channel number compression (C) of 0.5. The models have depth L = 100 and growth rate k = 12. We consider the outputs of each dense block after the transition layer (3 in total) and the first convolutional layer output as the latent features. After an averaging pooling, the latent features have dimensions F1 = {24, 108, 150, 342}.
• ResNet. Residual Networks (He et al., 2016), or ResNet, are deep neural networks composed of residual blocks. Each residual block is composed of layers connected in a feed-forward manner plus a skip connection. We use the ResNet with 34 layers pretrained on CIFAR-10, CIFAR-100, and SVHN datasets. We take the output of every residual block (4 in total) and the first convolutional layer for calculating the score on the WHITE-BOX setting. After an averaging pooling, the latent features have dimensions F2 = {64, 64, 128, 256, 512}.
We train each model by minimizing the cross-entropy loss using SGD with Nesterov momentum equal to 0.9, weight decay equal to 0.0001, and a multi-step learning rate schedule starting at 0.1 for 300 epochs. The pre-trained models is available at 4. We report their test set accuracy in Table 4 with the softmax function and by replacing it with the Fisher-Rao distance between the training
4http://github.com/igeood/Igeood
class-conditional centroids and the test sample outputs. Also, it is worth noting that one high-end GPU is sufficient for running every experiment presented in this work.

heading: C.2 EVALUATION METRICS
text: We introduce below standard binary classification performance metrics used to evaluate the OOD discriminators.
• True Negative Rate at 95% True Positive Rate (TNR at TPR-95% (%)). This metric measures the true negative rate (TNR) at a specific true positive rate (TPR). The operating point is chosen such that the TPR of the in-distribution test set is fixed to some value, 95% in this case. Mathematically, let TP, TN, FP, and FN denote true positive, true negative, false positive and false negative, respectively. We measure TNR = TN/(FP + TN), when TPR = TP/(TP + FN) is 95%.
• Area Under the Receiver Operating Characteristic curve (AUROC (%)). The ROC curve is constructed by plotting the true positive rate (TPR) against the false positive rate (= FP/(FP + TN)) at various threshold values. The area under this curve tells how much the OOD discriminator can distinguish in-distribution and OOD data in a thresholdindependent manner.
• Area Under the Precision-Recall curve (AUPR (%)). The PR curve plots the precision (= TP/(TP + FP)) against the recall (= TP/(TP + FN)) by varying a threshold. For the experiments, in-distribution data are specified as positives while OOD data as negative.
Note that the TNR at TPR-95% is significant because we want to identify OOD data and preserve a sufficiently good performance on identifying in-distribution data, which is not the case for the other metrics.

heading: C.3 DATASETS
text: In our experiments, we use natural image examples from the following image classification and synthetic datasets. We normalize the test samples with the in-distribution dataset statistics.
• CIFAR-10. The CIFAR-10 (Krizhevsky et al., 2009) dataset is composed of 32×32 natural images of 10 different classes, e.g., airplane, ship, bird, etc. The training set is composed of 50,000 images, and the test set is composed of 10,000 images. The classes are approximately equally distributed (5,000 examples each label). The CIFAR-10 dataset is under the MIT license.
• CIFAR-100. The CIFAR-100 (Krizhevsky et al., 2009) dataset contains similar natural images to the CIFAR-10 dataset, but with 90 additional categories. Its set repartition is also 50,000 for training and 10,000 for the test set. We expect around 500 samples for each class of the training set. It is also under the MIT license.
• SVHN. The SVHN (Netzer et al., 2011) dataset collects street house numbers for digit classification. It contains 73,257 training and 26,032 test RGB images of size 32 × 32 of printed digits (from 0 to 9). We take only the first 10,000 examples of the test set for evaluating the methods to have a balanced dataset of in-distribution and out-of-distribution data. This dataset is subject to a non-commercial license.
• Tiny-ImageNet. The Tiny-ImageNet (Le & Yang, 2015) dataset is a subset of the largescale natural image dataset ImageNet (Deng et al., 2009). It contains 200 different classes and 10,000 test examples. We downsize the images from their original resolution to images of dimension 32× 32× 3.
• LSUN. The LSUN (Yu et al., 2015) dataset, which has equally 10,000 test examples, is used for the large-scale scene classification of different scene categories (e.g., bedroom, bridge, kitchen, etc.). Similarly, we resize the images following the same procedure for the Tiny-ImageNet dataset. LSUN is under the Apache 2.0 license.
• iSUN. The iSUN (Xu et al., 2015) dataset consists of selected natural scene images from the SUN (Xiao et al., 2010) dataset. The test set has 8925 images, which we downsample to 32 × 32 × 3. We use this dataset as a source of OOD for validation purposes as an independent dataset from the test OOD data.
• Textures. The Describable Textures Dataset (DTD) (Cimpoi et al., 2014) is a collection of textural pattern images observed in nature. It contains 47 categories totaling 5640 images of various sizes, which are resized and center cropped to fit into the input size of 32× 32.
• Chars74K. The Chars74K dataset (de Campos et al., 2009) contains 74,000 samples of 62 classes of characters found in natural images, handwritten text, and synthesized from computer fonts. We used as OOD data only the EnglishImg dataset split, which contains 7705 characters from natural scenes. We resized and center-cropped the images.
• Places365. The Places365 dataset (Zhou et al., 2017) contains images of 365 natural scenes categories. We used the small images validation split as OOD data in our experiments. It contains 36,500 RGB images which were downsampled from 256× 256 to 32× 32.
• Gaussian. For the Gaussian dataset, we generated 10,000 synthetic RGB images from 2D Gaussian noise, where each RGB pixel is sampled from an i.i.d Gaussian distribution with mean 0.5 and variance 1.0. The pixel values are clipped to [0, 1] interval. This synthetic data was introduced in previous work as an easy benchmark (Hendrycks & Gimpel, 2017).

heading: C.4 ADVERSARIAL DATA GENERATION
text: We generate adversarial samples from the in-distribution dataset using the fast gradient sign method (FGSM). This method works by exploiting the gradients of the neural network to create a nontargeted adversarial attack. For an input image xi, the method computes the sign of the gradients of the loss function J with respect to the input image to create a new image xadvi that maximizes the loss as given by equation (30). This fabricated image is called an adversarial image, which we use for tuning the hyperparameters of the OOD detection methods in the WHITE-BOX case. Mathematically,
xadvi = xi + ε adv sign(∇xiJ(θ,xi, yi)), (30)
where εadv > 0 is the additive noise magnitude parameter. Table 5 shows the resulting L∞ mean perturbation and classification accuracy on adversarial samples.

heading: D BENCHMARK METHODS
text: In this section, we briefly re-introduce the benchmark OOD detection methods with a standardized notation.

heading: D.1 BASELINE
text: DNNs tend to assign lower confidence for OOD samples. So, calculating the Maximum Softmax Probability (MSP) (Hendrycks & Gimpel, 2017) is a natural baseline for OOD detection. In other words, provided an input data x, a pre-trained neural network f(·), and a confidence threshold δ, the OOD score, and the discriminator are given by
s(x) = max y∈Y efy(x)∑ y′∈Y e fy′ (x) and S(x; δ) =
{ 1 if s(x) ≤ δ 0 if s(x) > δ , (31)
respectively. Here, fy(x) indicates the y-th logits output. A limitation of this method is that unscaled softmax posterior distributions are usually spiky, i.e., softmax trained deep neural models are incorrectly calibrated, which does not favor OOD detection (Lakshminarayanan et al., 2017).

heading: D.2 ODIN: OOD DETECTOR FOR NEURAL NETWORKS
text: In summary, ODIN (Liang et al., 2018) explores the weaknesses of the MSP criterion by recalibrating the output’s confidence to the task of OOD detection. They improve the MSP baseline by using the temperature scaled softmax function (equation (2)) instead. Also, ODIN adds small adversarial noise perturbation to the inputs, i.e.,
x̃ = x− ε sign (−∇x log qθ(y|f(x);T )) , (32)
where ε is the perturbation magnitude. Hyperparameters T and ε are tuned on a validation dataset without requiring prior knowledge of test OOD data. They calculate the confidence score by taking the maximum of the perturbed input temperature scaled softmax outputs.

heading: D.3 ENERGY-BASED OOD DETECTOR
text: An energy-based OOD discriminator is proposed by Liu et al. (2020), where the differences of energies between in-distribution and OOD samples allow for distribution distinction. The energy-based model substitutes the softmax function with the Helmholtz free energy equation to extract a confidence score. They observed that examples with higher energy have a low likelihood of occurrence, concluding that they are likely OOD. The free energy expression is:
E(x; f) = −T · log ∑ y∈Y efy(x)/T . (33)
Note that, differently from ODIN and MSP, they use the information of all of the logits output values through the sum operation. Besides, they apply input pre-processing for further separating OOD data from in-distribution.

heading: D.4 MAHALANOBIS DISTANCE-BASED CONFIDENCE SCORE
text: The Mahalanobis-based method in Lee et al. (2018) fits the DNN training data features as classconditional Gaussian distributions. These use the outputs of every DNN latent block to leverage useful information for discrimination. For a test sample x, the confidence score from the `-th feature is calculated based on the Mahalanobis distance between f (`)(x) and the closest class-conditional distribution:
M`(x) = max y − ( f (`)(x)− µ̂(`)y )> Σ̂−1` ( f (`)(x)− µ̂(`)y ) , (34)
where f (`)(x) is the `-th latent feature output, and µ̂(`)y and Σ̂` are, respectively, the empirical class mean and covariance matrix estimates. The covariance matrix is often not full rank, so the pseudoinverse is calculated instead of the inverse. In addition, input pre-processing and feature ensemble are also used to boost performance. A logistic regression model learns the multiplicative weights α` for each layer score, which predicts 1 for in-distribution and 0 for OOD examples from a mixture validation dataset. Finally, the Mahalanobis-based discriminator is given by thresholding expression∑ ` α`M`(x).

heading: E ADDITIONAL OUT-OF-DISTRIBUTION DETECTION RESULTS

heading: E.1 FISHER-RAO DISTANCE VERSUS KULLBACK-LEIBLER DIVERGENCE
text: From Picot et al. (2021), the Kullback-Leibler divergence (KL) is connected to the Fisher-Rao distance between softmax probability distributions (dR,D) by the inequality:
1− cos ( dR,D (qθ, q ′ θ)
2
) ≤ 1
2 KL (qθ, q′θ) . (35)
To verify how the KL divergence would behave for OOD detection, we ran experiments with our BLACK-BOX setting, where we calculated the class conditional centroids with the KL divergence offline. During test time, we calculated the divergence of the test sample w.r.t each of these centroids, then aggregated the results with a sum or by taking the minimal value. The results are displayed in Table 6. We can conclude from these experiments that taking the sum of the outputs instead of the minimal value is overall advantageous for Fisher-Rao distance and KL divergence.

heading: E.2 HYPERPARAMETERS TUNING
text: For temperature T , we ran a Bayesian optimization for 500 epochs in the interval of temperature values between 1 and 1000 where the objective function was to maximize the TNR at TPR-95% metric for the validation set. We took the best temperature among five runs with different random seeds. For the input pre-processing noise magnitude ε tuning, we ran a grid search optimization with 21 values equally spaced in the interval [0, 0.002]. Table 7 shows the best hyperparameters we found for the methods in the BLACK-BOX, GREY-BOX, and WHITE-BOX settings.

heading: E.3 TEMPERATURE SCALING AND NOISE MAGNITUDE PLOTS
text: In Figure 5 and 6, we plot on the left hand side column the effect of the temperature parameter in the performance for the BLACK-BOX setup. We set the noise magnitude to zero and measured the TNR at TPR-95% for 500 different temperatures values found by a Bayesian optimization for a variety of DNN models. The performance is evaluated on the iSUN dataset. The right hand side column of Figure 5 and 6 show the effect of the noise magnitude parameter in the performance of IGEOOD score in the GREY-BOX setup. We set the temperature to the best found in the BLACK-BOX case. Then, we measured the OOD performance for 21 values of noise magnitude ε equally spaced in the interval [0, 0.004]. The best couple (T, ε) for each method and model is used to evaluate the GREY-BOX performances. The best hyperparameters found are detailed in Table 7.

heading: E.4 CONSISTENCY OF IGEOOD SCORE CONCERNING THE CHOICE OF THE VALIDATION DATA
text: To verify the consistency of IGEOOD and other methods to the choice of validation data, we measured the TNR at TPR-95% after tuning our method in a BLACK-BOX and GREY-BOX scenario on nine validation datasets. In Table 8, the first column shows the validation dataset, while we used the remaining OOD datasets to evaluate performance. We obtained consistent results, ranging from 63.4% to 72.0% the average TNR at TPR-95% in the BLACK-BOX case and from 65.0% to 73.4% in the GREY-BOX setting. We show that input pre-processing provides mild amelioration for our method and can be considered a fine-tuning step.

heading: E.5 ERROR BARS AND STANDARD DEVIATION
text: We conduct all of our experiments during inference time. Provided that we fix the DNN, the indistribution, and the out-of-distribution datasets, there is not a source of randomness to our algorithm because the weights α of the feature ensemble and centroids are initialized deterministically. Thus, the OOD scores for the same experimental setting do not change. To confirm this, we ran the same experiment five times and obtained the same results in all of them. However, if we allow for retraining the DNN from scratch, we might obtain different parameters, leading to slightly different model accuracy and potentially OOD detection performance. With this in mind, we retrained a DenseNet-BC-100 model on CIFAR-10 five times with five different random seeds. The results for OOD detection in a BLACK-BOX setting for the 5 models can be found in Table 9.
E.6 IGEOOD COMPARED TO OTHER WHITE-BOX METHODS.
Even though the work from Lee et al. (2018) shares the closest setup to ours, recent literature also shows promising results for OOD detection in a WHITE-BOX setting, achieving state-of-the-art in a few benchmarks. Notably, the works from Sastry & Oore (2020); Hsu et al. (2020); Zisselman & Tamar (2020) achieve great performance in a range of benchmarks. Thus, we gathered the reported results from the original work and displayed them in Table 11 and 12, which considers that a few OOD samples and only adversarial samples are available for tuning, respectively.

heading: E.7 EXTENDED OOD DETECTION RESULTS
text: We show in Table 13 extended OOD detection results of Table 1. It contains the OOD detection performance for each model, in-distribution dataset and OOD dataset in a BLACK-BOX setting. In Table 14, we show the performance of ODIN, energy-based, and IGEOOD scores in the task of OOD detection in a GREY-BOX setup for each OOD dataset. In Table 15 and 16, we show additional results referring to the right-hand column and left-hand column of Table 2, respectively.

heading: F HISTOGRAMS
text: Figures 7, 8, 10 and 9 display histograms for the OOD detection score for IGEOOD in the BLOCKBOX, GREY-BOX and WHITE-BOX settings, respectively.

Review summaries:
This paper presents IGEOOD, a new method for detecting OOD samples by using geodesic (Fisher-Rao) distance in confidence scoring. It further combines confidence scores from the logit outputs and the layer-wise features of a deep neural network. The method is validated under various testing environments such as the availability of OOD data or the accessibility of latent features of a deep network. The idea of using Fisher-Rao distance for OOD detection seems novel and interesting. 

The paper proposes a new group of methods for supervised OOD detection. In particular, the authors propose to use the Fisher-Rao distance between output distributions on the in-distribution data and test samples to detect OOD. The authors additionally propose to use Fisher-Rao distance in the hidden layer feature space, when possible (white-box setting). The method achieves strong empirical performance, improving upon standard baselines (such as Odin, Mahalanobis), especially in the white-box setting.

The paper proposes to use a score based on the Fisher-Rao information metric (the Riemannian metric in the space of probability distributions) for the detection of out-of-distribution samples input to a trained DNN. While the output SoftMax probabilities are used in the black-box and grey-box scenarios, the learnt features in the intervening DNN layers are additionally used in the white-box scenario. The approach models each sample as providing posterior probabilities – (a) the SoftMax probability in the label space, and (b) class-conditional PDFs over the corresponding feature spaces for each DNN layer. These latter are modeled as multivariate Gaussian distributions with diagonal covariance matrices. Extensive experiments on existing benchmarks are conducted for comparative results against the state of the art demonstrating promising results. 

UPDATE:  I acknowledge that I've read the author responses as well as the other reviews.   While the authors added further analysis on the proposed method, I am skeptical of the performance of the method since the proposed method requires validation OOD data to achieve SOTA performance and the runtime is much larger than MSP and energy baseline. However, I think the rebuttal clarified much of my concerns and therefore raise the score to 5 weak reject.   =================================================================  The paper proposes an out-of-distribution detection (OOD) metric based on Fisher-Rao distance which can be applied for pre-trained classifiers. First, the authors derive a Fisher-Rao distance applied to the distribution of softmax. Also, they motivate a toy example where the FIsher-Rao distance outperforms the conventional OOD metric, Mahalanobis distance. Furthermore, they formulate the Fisher-Rao distance-based framework, IGEOOD on Black(Grey)-Box, where we can only get access on the logit of the network output, and White-Box, where we can get access to intermediate feature layers. Finally, the authors compare IGEOOD against conventional OOD metrics on various out-of-distribution data and in-distribution data.