FROB: Few-shot ROBust Model for Classification with Out-of-Distribution Detection

1 INTRODUCTION . In real-world settings , it is crucial to robustly perform classification and OoD detection with high levels of confidence . The problem of detecting whether a sample is in-distribution , from the training distribution , or OoD is critical for adversarial attacks . This is crucial nowadays in many applications in safety , security , and defence . However , deep neural networks produce overconfident predictions and do not distinguish in- and out-of-data-distribution . Adversarial examples , when small modifications of the input appear , can change the classifier decision . It is an important property of a classifier to address such limitations with high level of confidence , and provide robustness guarantees for neural networks . In parallel , OoD detection is a challenging aim since classifiers set high confidence to OoD samples away from the training data . The state-of-art models are overconfident in their predictions , and do not distinguish in- and OoD . The setting that our proposed Few-shot ROBust ( FROB ) model addresses is robust few-shot Out-of-Distribution ( OoD ) detection and few-shot Outlier Exposure ( OE ) . To address rarity and the limited samples in the few-shot setting , we aim at reducing the number of the few-shots of the OoD samples , while maintaining accurate and robust performance . Diverse data are available today in large quantities . Deep learning magnifies the difficulty of distinguishing OoD from in-distribution . It is possible to use such data to improve OoD detection by training detectors with auxiliary outlier sets ( Hendrycks et al. , 2019 ) . OE enables detectors to generalize to detect unseen OoD samples with improved robustness and performance . Models trained with different outliers can detect unmodelled data and improve OoD detection by learning cues for whether inputs are unmodelled . By exposing models to different OoD , the complement of the support of the normal class distribution is modelled and the detection of new types of anomalies is enabled . OE improves the calibration of deep neural network classifiers in the setting where a fraction of the data is OoD , addressing the problem of classifiers being overconfident when applied to OoD ( Bitterwolf et al. , 2020 ) . Aiming at solving the few-shot robustness problem with classification and OoD detection , the contribution of our FROB methodology is the development of an integrated robust framework for self-supervised few-shot negative data augmentation on the distribution confidence boundary , combined with few-shot OE , for improved OoD detection . The combination of the generated boundary in a self-supervised learning way and the imposition of low confidence at this learned boundary is the main contribution of FROB , which greatly and decisively improves robustness for few-shot OoD detection . To address the rarity of relevant outliers during training using OoD samples , we propose to use even few-shots to improve the OoD detection performance . FROB achieves significantly better robustness and resilience to few-shot OoD detection , while maintaining competitive in-distribution accuracy . FROB achieves generalization to unseen anomalies , with applicability to new , in the wild , test sets that do not correlate to the training sets . FROB ’ s evaluation on different sets , CIFAR-10 , SVHN , CIFAR-100 , and low-frequency noise , using cross-dataset and One-Class Classification ( OCC ) evaluations , shows that our self-supervised model with few-shot OE on the confidence boundary and few-shot adaptation improves the few-shot OoD detection performance and outperforms benchmarks . The robustness performance analysis of FROB to the number of few-shots and to outlier variation shows that it is robust to few-shots and outperforms baselines . 2 OUR PROPOSED FEW-SHOT ROBUSTNESS ( FROB ) METHODOLOGY . We propose FROB for few-shot OoD detection and classification using discriminative and generative models . We devise a methodology for improved robustness and reliable confidence prediction , to force low confidence close and away from the data . To improve robustness , FROB generates strong adversarial samples on the boundary close to the normal class . It finds the boundary of the normal class , and it combines the self-supervised learning few-shot boundary with our robustness loss . Flowchart of FROB . Fig . 1 shows the flowchart of FROB which uses a discriminative model for classification and OoD detection . FROB also uses a generator for the OoD samples and the learned boundary . It generates low-confidence samples and performs active negative training with the generated OoD samples on the boundary . It performs self-supervised learning negative sampling of confidence boundary samples via the generation of strong and specifically adversarial OoD . It trains classifiers and generators to robustly classify as less confident samples on and out of the boundary . Our proposed loss . We denote the normal class data by x where xi are the labeled data with class labels yi . Our proposed loss of the discriminative model which is minimized during training is arg minf − 1 N N∑ i=1 log exp ( fyi ( xi ) ) ∑K k=1 exp ( fk ( xi ) ) − λ 1 M M∑ m=1 log ( 1− exp ( f ( Zm ) ) ∑K k=1 exp ( fk ( Zm ) ) ) ( 1 ) where f ( . ) is the Convolutional Neural Network ( CNN ) discriminative model for multi-class classification with K classes . Our loss has 2 terms and a hyper-parameter . The 2 losses operate on different samples for positive and negative training , respectively . The first loss is the cross-entropy between yi and the predictions , softmax ( f ( xi ) ) ; the CNN is followed by the normalized exponential to obtain the probability over the classes . Our robustness loss forces f ( . ) to accurately detect outliers , in addition to classification . It operates on the few-shot OE samples , Z . It is weighted by the hyper-parameter λ. k is a class index . For the in-distribution , N is the batch size and i is the batch data sampling index . For the OoD , M is the batch size and m is the batch data sampling index . FROB then trains a generator to generate low-confidence samples on the normal class boundary . Our algorithm includes these learned low-confidence samples in the training to improve the performance in the few-shot setting . Instead of using a large OE set , which constitutes an ad hoc choice of outliers to model the complement of the support of the normal class distribution , FROB performs learned negative data augmentation and self-supervised learning , to model the boundary of the support of the normal class distribution . We train a CNN deep neural network generator and denote it by O ( z ) , where O refers to OoD samples and z are latent space samples from a standard Gaussian distribution . Our proposed optimization of maximizing dispersion subject to being on the boundary is given by arg minO 1 N − 1 N∑ j=1 , zj ̸=z ||z − zj ||2 ||O ( z ) −O ( zj ) ||2 + µ max l=1,2 , ... , K exp ( fl ( O ( z ) ) − fl ( x ) ) ∑K k=1 exp ( fk ( O ( z ) ) − fk ( x ) ) + ν minj=1,2 , ... , Q ||O ( z ) − xj ||2 ( 2 ) where using ( 2 ) , we penalize the probability that O ( z ) have higher confidence than the normal class . We hence make O ( z ) have lower probability than x ( Jolicoeur-Martineau , 2019 ; Ren et al. , 2021 ) . FROB includes the learned low-confidence samples in the training by performing ( 1 ) with the selfgenerated few-shot boundary , O ( z ) , in addition to Z . Our self-supervised learning mechanism to calibrate confidence in unforeseen scenarios is ( 2 ) followed by ( 1 ) . FROB performs boundary data augmentation in a learnable self-supervised learning manner . It introduces self-generated boundary samples , and sets them as OoD to better perform few-shot OoD detection . This learned boundary has strong and adversarial anomalies close to the distribution support and near high probability normal class samples . FROB introduces optimal , relevant , and useful anomalies to more accurately detect few-shots of OoD ( Wang et al. , 2020a ; b ) . It detects OoD robustly , by generating strong adversarial OoD samples and helpful task-specific anomalies . A property of our nested optimization , where the inner optimization is O ( z ) in ( 2 ) and the outer one is cross-entropy with negative training in ( 1 ) , is that if an optimum is reached for the inner one , an optimum will also be reached for the outer . FROB addresses the few-shots problem by performing negative data augmentation in a well-sampled manner on the support boundary of the normal class . It performs OoD sample description and characterization , not allowing space between the normal class and our self-generated anomalies . FROB addresses the question of what OoD samples to introduce to our model for negative training , to robustly detect few-shots of data . FROB introduces self-supervised learning and learned data augmentation using the Deep Tightest-Possible Data Description algorithm of ( 2 ) followed by ( 1 ) , and our self-generated confidence boundary in ( 2 ) is robust to mode collapse ( Dionelis et al. , 2020b ; a ) . By performing scattering , FROB achieves diversity using the ratio of distances in the latent and data spaces rather than maximum entropy ( von Kügelgen et al. , 2021 ; Dieng et al. , 2019 ) . Our framework uses data space point-set distances ( Dionelis et al. , 2020b ; a ; Jalal et al. , 2017 ; Jordan et al. , 2019 ) . Inference . The Anomaly Score ( AS ) of FROB for any queried test sample , x̃ , during inference is AS ( f , x̃ ) = max l=1,2 , ... , K exp ( fl ( x̃ ) ) ∑K k=1 exp ( fk ( x̃ ) ) ( 3 ) where if the AS is smaller than a threshold τ , i.e . AS < τ , x̃ is OoD . Otherwise , x̃ is in-distribution . 3 RELATED WORK ON CLASSIFICATION WITH OOD DETECTION . Outlier Exposure . The OE method trains detectors with outliers to improve the OoD performance to detect unseen anomalies ( Hendrycks et al. , 2019 ) . Using auxiliary sets , disjoint from train and test data , models learn better representations for OoD detection . Confidence Enhancing Data Augmentation ( CEDA ) , Adversarial Confidence Enhancing Training ( ACET ) , and Guaranteed OoD Detection ( GOOD ) tackle the problem of classifiers being overconfident at OoD samples ( Bitterwolf et al. , 2020 ; Hein et al. , 2019 ) . Their aim is to force low confidence in a l∞-norm ball around each OoD sample where the prediction confidence is maxk=1,2 , ... , K pk ( x ) for the output K-class softmax ( Sensoy et al. , 2018 ; Hariharan & Girshick , 2017 ; Jeong & Kim , 2020 ) . CEDA employs point-wise robustness ( Bastani et al. , 2016 ; Rosenfeld et al. , 2020 ) . GOOD finds worst-case OoD detection guarantees . The models are trained on OE sets , using the 80 Million Tiny Images reduced by the normal class . Disjoint distributions are used for positive and negative training , but the OoD samples for OE are chosen in an ad hoc way . In contrast , FROB performs learned negative data augmentation on the boundary of the normal class to streamline and redesign few-shot OE ( and zero-shot OE ) . Human prior . GOOD defines the normal class , then filters it out from the 80 Million Tiny Images . This filtering-out process of normality from the OE set is human-dependent . This modified dataset is set as anomalies . Next , GOOD learns the normal class and sets low confidence to these OoD . This process is data-dependent , not automatic , and feature-dependent ( Dionelis et al. , 2021 ; Sohn et al. , 2021 ) . In contrast , FROB eliminates the need for feature extraction and human intervention which is the aim of Deep Learning , as these do not scale . This filtering-out process is not practical and can not be used in real-world scenarios as anomalies are not confined in finite closed sets ( Sensoy et al. , 2020 ) . FROB avoids feature- , application- , and dataset-dependent processes . Our self-supervised boundary data augmentation obviates memorization , scalability , and data diversity problems arising from memory replay and prioritized experience replay ( Zaheer et al. , 2020 ; Pourreza et al. , 2021 ) . Learned OoD samples . The Confidence-Calibrated Classifier ( CCC ) uses a GAN to create samples out of , but close to the normal class ( Lee et al. , 2018a ) . FROB substantially differs from CCC , as CCC finds a threshold and not the boundary . CCC uses the OE set , U ( y ) , where the labels follow a Uniform distribution , to compute this threshold . This is limiting as the threshold depends on U ( y ) , which is an ad hoc choice of outliers . In contrast , FROB finds the confidence boundary and does not use U ( y ) to find this boundary . FROB streamlines OE and few-shot outliers . Our boundary is not a function of U ( y ) , as U ( y ) is not necessary ( Sohn et al. , 2021 ) . For negative training , CCC defines a closeness metric ( KL divergence ) , and then penalizes this metric ( Zaheer et al. , 2020 ; Asokan & Seelamantula , 2020 ; Dionelis et al. , 2021 ) . CCC suffers from mode collapse as it does not perform scattering for diversity . The models in Lee et al . ( 2018a ) ; Vernekar et al . ( 2019a ; b ) and Wang et al . ( 2018 ) perform confidence-aware classification . Self-Supervised outlier Detection ( SSD ) creates OoD samples in the Mahalanobis metric ( Sehwag et al. , 2021 ) . It is not a classifier , as it performs OoD detection with OE . FROB achieves fast inference with ( 3 ) , in contrast to Tack et al . ( 2020 ) which is slow during inference ( Goldberger et al. , 2005 ) . Tack et al . ( 2020 ) does not address issues arising from detecting with nearest neighbors while using a different composite loss for training .

Summary: The paper addresses an important issue of Out-of-Distribution detection in a few-shot setting. The authors propose to generate negative samples in an adversarial way to increase the OoD performance. Additionally they augment the loss function with additional term for OoD samples. They perform experiments of 2 benchmark datasets: CIFAR-10 and SVHN.