Intra-class Mixup for Out-of-Distribution Detection

1 INTRODUCTION Deep Learning has been employed by many state of the art machine learning models to effectively solve image recognition ( Krizhevsky et al. , 2012 ; LeCun et al. , 2015 ) and natural language processing ( Andor et al. , 2016 ) tasks . Despite their effectiveness , recent research has shown the existence of inputs ( Goodfellow et al. , 2015b ; Nguyen et al. , 2015 ) that lead these networks to make confident mispredictions . Two classes of such inputs have emerged in literature . The first class , adversarial examples ( Bruna et al. , 2014 ; Goodfellow et al. , 2015a ; Kurakin et al. , 2017 ) , are specifically crafted inputs with the intent of fooling deep neural nets . The second class dubbed Out-of-Distribution ( OoD ) ( Nguyen et al. , 2015 ) examples are examples that do not belong to the underlying true distribution that the training dataset is drawn from . High confidence of the networks on such OoD examples makes it difficult to identify false classifications and poses a challenge to their deployment in safety critical scenarios ( Amodei et al. , 2016 ) , from medical diagnosis to self driving applications . To address this problem several methods have been proposed which aim to identify out-of-distribution samples . In the context of deep learning , OoD detection methods can be broadly classified into two categories , generative and discriminative methods . Generative methods use various techniques such as Gaussian Discriminant Analysis ( Lee et al. , 2018b ) , Generative Adversarial Networks ( GANs ) ( Deecke et al. , 2018 ; Lee et al. , 2018a ; Ren et al. , 2019 ) or more generic generative methods ( Wang et al. , 2017 ) to model the underlying distribution and separate in-distribution samples from OoD samples . On the other hand , discriminative methods ( Hendrycks & Gimpel , 2017 ; Hendrycks et al. , 2019 ; Hsu et al. , 2020 ; Liang et al. , 2018 ; Liu et al. , 2020 ) detect OoD samples based on measures such as softmax probability ( Hendrycks & Gimpel , 2017 ; Hendrycks et al. , 2019 ) , energy scores ( Liu et al. , 2020 ) or other metrics computed from the trained network . Most of these metrics are a proxy for the distance of the sample representation from the decision boundary ( l2 margin in Figure 1a ) . Further , we show that existing techniques such as empirical risk minimization ( ERM ) and inter-class mixup ( Zhang et al. , 2018 ) result in networks learning representations that have large spread . This large spread creates broad overlapping representations for in-distribution and OoD data , making it hard to separate in-distribution data from OoD data . Additionally , the use of metrics that are proxies for distance from decision boundary have a disadvantage when OoD points have similar margin as in-distribution data . For example , consider point “ ( b ) OoD ” in Figure 1a where the OoD data point is far from the class representation and has similar l2 margin as in-distribution data ; this OoD point will have similar OoD metric scores as in-distribution data . Using angular margin would help separate OoD data in such a case . To account for these factors , we propose intra-class mixup supplemented with angular margin ( refer to Figure 1a ) to improve OoD detection where angular margin is the angle between the normal to the decision boundary and the sample representation . We show that the proposed intra-class mixup forces the network to learn latent representations with low variance ( i.e . small spread ) , thus improving in-distribution and OoD separability . This is visualized in Figure 1 , which plots the angular margin vs. l2 margin for in-distribution and OoD data for ERM , inter-class mixup and intra-class mixup . Further , we show that intra-class mixup trained , angular margin augmented OoD detector achieves on average 7.36 % and 9.10 % improvement in AUROC performance over ERM and inter-class mixup , respectively . In summary the contributions of this paper are as follows : • We propose intra-class mixup to improve OoD detection . We show that intra-class mixup learnt latent space representations have lower angular spread when compared to ERM and inter-class mixup , thus , improving separability of OoD examples . We attribute this to the reduced input variance resulting from intra-class mixup . • We show existing discriminiative OoD detection methods that use proxies for distance from the decision boundary benefit from intra-class mixup when compared to ERM and inter-class mixup . • We leverage better angular separability to improve OoD detection . We show that supplementing angular margin with existing OoD detection scores improves OoD detection performance on various existing techniques . 2 RELATED WORK In the context of deep-learning , the approaches to detect OoD examples can be broadly classified into two categories discriminative and generative methods . Under discriminative methods recent works ( Hendrycks & Gimpel , 2017 ; Hendrycks et al. , 2019 ; Hsu et al. , 2020 ; Liang et al. , 2018 ) have leveraged softmax probability scores to detect anomalous examples . The authors of Hendrycks & Gimpel ( 2017 ) presented their results on using softmax scores to detect OoD examples on several machine learning tasks . The idea of utilizing softmax scores was further extended in Hendrycks et al . ( 2019 ) by modifying the standard loss function used to train the classifier . The network was trained on an in-distribution dataset as well as an additional auxiliary or outlier dataset . The authors claim that such outlier exposure enables the detector to generalize and detect unseen anomalies . Further , the authors also observed characteristic properties of the auxiliary dataset which help improve detection performance . Another approach that leverages softmax scores are the ODIN ( Hsu et al. , 2020 ; Liang et al. , 2018 ) techniques , which showed improvement to OoD detection without having to explicitly tune the out-of-distribution dataset which the authors argue is generally hard to define a priori . The authors proposed decomposing the confidence score and modifying the input pre-processing method . Other recent work under the discriminative techniques proposed the use of energy score ( Liu et al. , 2020 ) instead of softmax scores arguing that softmax based approaches suffer from overconfident posterior distributions for out-of-distribution samples . They claim that energy scores are theoretically aligned with the probability density of the inputs and is therefore less likely to result in overconfident predictions . Further , in a non deep learning context angular distance based approaches ( Kriegel et al. , 2008 ) have been successfully used in literature to avoid the curse of dimensionality . Generative methods attempt to model the underlying true distribution and hence , identify samples outside the modelled distribution . The authors of Lee et al . ( 2018b ) proposed a technique that modelled a class conditional Gaussian distribution with respect to features of the deep network and used a Mahalanobis distance based confidence score calculated from the Gaussian model to detect OoD examples . In Lee et al . ( 2018a ) the authors proposed the use of Generative Adversarial Networks ( GANs ) ( Goodfellow et al. , 2014 ) to generate OoD samples to improve OoD detector training . They proposed two additional loss terms that were added to the original loss function . One of the proposed terms forced the classifier to be less confident on OoD samples while the other helped generate more effective OoD examples . Another work that investigated a generative model based approach for OoD detection was Ren et al . ( 2019 ) which proposed a likelihood ratio method which corrected for background statistics and achieved competitive performance on vision and sequence classification tasks . Approaches under both categories have focused on networks trained using Empirical Risk Minimization ( ERM ) which has been observed to result in undesirable behaviors such as memorization ( Zhang et al. , 2016 ) and sensitivity outside the training examples ( Bruna et al. , 2014 ) . Inter-class mixup ( Zhang et al. , 2018 ) has been shown to be effective against such undesirable behaviours ( Zhang et al. , 2018 ; Thulasidasan et al. , 2019 ) and has been shown to improve calibration and OoD performance ( Thulasidasan et al. , 2019 ) . However , we show that inter-class mixup and ERM trained networks learn representations with large variance ( i.e . large spread ) , impacting their OoD detection performance . To counter this effect , in this paper we propose intra-class mixup aided with angular margin for improving OoD detection . 3 BACKGROUND In-distribution . The training and testing samples used for a machine learning task are drawn from some underlying distribution , also called the true distribution . The samples from this underlying true distribution are called in-distribution samples and are represented by Din in this work . However , in most practical learning scenarios the true distribution is unknown a priori and hence , the training distribution , Dtrain , is used as a proxy for Din . Out-of-distribution . A sample is said to be Out-of-distribution ( OoD ) if it does not belong to the underlying true distribution Din , and is denoted by Dout . Since we do not have access to the true underlying distribution , for our experiments we use uniform noise , Gaussian noise and samples from other datasets for similar tasks as a proxy for Out-of-distribution samples or Dout . This is common practice in literature ( Hendrycks & Gimpel , 2017 ; Hendrycks et al. , 2019 ; Hsu et al. , 2020 ; Lee et al. , 2018b ; Liang et al. , 2018 ) . Empirical Risk Minimization ( ERM ) . The objective of learning algorithms , when the true underlying distribution is known , is to learn an optimal mapping f ( . ) from the input x to an output y , where ( x , y ) ∼ Din . This objective is satisfied by learning a function f ( . ) that minimizes a loss function L ( f ( x ) , y ) over the entire distribution . We can compute the expectation of the loss function as shown in Equation 1 . This is know as expected risk . Rexpected = Ex , y∼Din [ L ( f ( x ) , y ) ] ( 1 ) As in most realistic scenarios , we do not have access to the true data distribution , and hence , it is common to use available empirical data as proposed in Vapnik ( 1998 ) to approximate the expected risk . This form of approximation , presented in Equation 2 , is know as Empirical Risk Minimization ( ERM ) . Rempirical = 1 Ne Ne∑ i=1 L ( f ( xi ) , yi ) ( 2 ) where ( xi , yi ) ∼ Dtrain and Ne is the number of training samples in Dtrain . 4 METHODOLOGY 4.1 ANGULAR MARGIN In this subsection we define angular margin . Angular margin θ can be described by the following equations : n = W ŷc |W ŷc | ( 3 ) θ = arccos ( ainp |ainp| · n ) ( 4 ) where W ŷc is the weight vector of the final ( classifier ) layer of the deep neural net ( DNN ) for the predicted class ŷ , n is the unit vector orthogonal to the decision boundary1 , ainp is the latent space vector representation for the un-mixed input ( i.e . activations of the penultimate layer of the DNN ) . Further , we ignore the bias term when calculating the angular margin therefore W ŷc does not include the bias term . 4.2 INTRA-CLASS MIXUP In this subsection we explore the properties of intra-class mixup trained deep neural nets and how they can be leveraged to improve OoD detection performance . Inter-class mixup ( Zhang et al. , 2018 ) is a technique that helps improve the generalization of a machine learning classifier . Mixup trains a neural net on a convex combinations of examples and their corresponding soft labels . Consider a pair of training input , label tuples ( xi , yi ) and ( xj , yj ) . Inter-class mixup obtains a new augmented sample ( x̂ , ŷ ) for training the classifier described by Equation 5. x̂ = λ · xi + ( 1− λ ) · xj ŷ = λ · yi + ( 1− λ ) · yj ( 5 ) where , λ ∈ [ 0 , 1 ] represents the mixing parameter . In the same fashion as inter-class mixup ( Zhang et al. , 2018 ) λ ∼ Beta ( α , α ) and for our experiments we set α = 1 . Such an augmentation scheme forces the model to learn smooth interpolations between the samples of the training dataset . The proposed technique of intra-class mixup imposes an additional constraint on Equation 5 such that ŷ = yi = yj , forcing the training sample to be a convex combination of inputs within the same class . It can be shown that the additional constraint on ŷ reduces the class conditional input variance ( see Appendix A.1 ) . 1The unit vector is the decision boundary normal in case of binary classification . In case of a multi-class classification , the interpretation depends on the training loss used . σ2 X̂ = [ λ2 + ( 1− λ ) 2 ] σ2X Since λ2 + ( 1− λ ) 2 ≤ 1 σ2 X̂ ≤ σ2X ( 6 ) where σ2 X̂ is the variance of the input after mixup and σ2X is the variance of the input prior to mixup . Therefore intra-class mixup results in reduction of class conditional variance at the input . We observe that deep neural nets trained on intra-class mixup learn to represent even unmixed images with lower angular spread ( i.e . reduction of the class conditional representation variance ) compared to ERM or inter-class mixup . The angular spread refers to the standard deviation of the angular margin for a given dataset . This reduced angular spread increases the angular margin between in-distribution and OoD samples improving OoD detection performance . 4.3 SUPPLEMENTING ANGULAR MARGIN In this subsection we describe how angular margin scores can be supplemented with various OoD scores to improve detection performance . We observe from Figure 1 , that traditional scores that use the l2 margin can separate OoD data from in-distribution data . From Figure 1 , this can be interpreted as higher values along the y-axis are more likely to be OoD . But using only l2 ignores information in the angular margin that can be used to separate in-distribution samples from OoD samples . From Figure 1 , we see that using angular margin improves separability ( using two axes instead of one ) . This is also observed in our experimental results ( refer to Table 3 and 4 ) . Therefore we propose supplementing OoD score Js is given by Js = J + cos ( θ ) ( 7 ) where J is the OoD score from a detector of choice , θ is the angular margin of the test sample described in Equation 4 . The OoD score J is different for different detection schemes . For MSP ( Hendrycks & Gimpel , 2017 ) J would be the softmax probability of the predicted class while J would be the energy score ( Liu et al. , 2020 ) when using energy score detector , and so on . To complete our analysis we also use “ Vanilla cos ( θ ) ” which is when Js = cos ( θ ) . The following section details various experiments to evaluate the performance of the proposed method . 5 EXPERIMENTS We perform experiments which aim to understand and show the role of intra-class mixup in improving OoD detection performance . The experiments ’ goals are summarized below • To show intra-class mixup trained networks learn representations that have lower angular spread and improved angular separability ( Section 5.1 ) . • To show intra-class mixup improves OoD detection on methods that use distance proxies ( Section 5.2 ) . • To show that supplemental use of angular margin improves OoD detection performance ( Section 5.3 ) . 5.1 SEPARABILITY In this section we provide evidence for improved OoD separability resulting from intra-class mixup . To show that intra-class mixup improves OoD separability we evaluate the angular margin for indistribution and OoD examples . The improvement in separability resulting from intra-class mixup can be observed using a separability metric S given by S = ( θo − θi ) 2 σ2o + σ 2 i ( 8 ) where θo and θi are the angular margins for OoD data and in-distribution data respectively , σo and σi are the angular scatter/spread ( i.e . standard deviation ) of the angular margin . The metric S is the angular version of the Fisher ’ s criterion ( Fisher et al. , 1936 ) . Table 1 shows the angular separability of empirical risk minimization ( ERM ) , inter-class mixup ( Zhang et al. , 2018 ) and the proposed intra-class mixup . From Table 1 we clearly see improved OoD separability from intra-class mixup . For each in-distribution dataset in Table 1 , the numbers show the average angular margin and angular spread computed over 5 differently seeded ResNet18 networks evaluated on the test set of SVHN ( Netzer et al. , 2011 ) , CIFAR-10 , CIFAR-100 ( Krizhevsky et al. , 2009 ) , Places365 ( Zhou et al. , 2017 ) , Textures ( Cimpoi et al. , 2014 ) , LSUN ( Yu et al. , 2015 ) , TinyImageNet ( Li et al . ) , Gaussian Noise and Uniform Noise as OoD datasets . 5.2 INTRA-CLASS MIXUP FOR OOD DETECTION We have seen in the previous subsection that intra-class mixup improves OoD separability . In this subsection we provide evidence for improved OoD detection performance of intra-class mixup trained DNNs . We present the results of applying intra-class mixup on a few unsupervised methods that use proxies for distance from the decision boundary such as Maximum Softmax Probability ( MSP ) detection ( Hendrycks & Gimpel , 2017 ) , ODIN ( Liang et al. , 2018 ) and Energy score detection ( Liu et al. , 2020 ) . To evaluate the performance of the detectors we use a variety of metrics which are briefly described in the following section . Metrics . The performance of binary classification algorithm can be evaluated using Recall or True Positive Rate ( TPR ) , False Positive Rate ( FPR ) , Precision or a variety of other metrics . Recall ( TPR ) , FPR and Precision are defined by equations ( 9 ) , ( 10 ) and ( 11 ) respectively . Recall = True Positive Rate ( TPR ) = TP TP + FN ( 9 ) False Positive Rate ( FPR ) = FP FP + TN ( 10 ) Precision = TP TP + FP ( 11 ) where , TP is True Positive , FP is False Positive , TN is True Negative and FN is False Negative . Metrics commonly used in literature ( Hendrycks & Gimpel , 2017 ; Hendrycks et al. , 2019 ; Lee et al. , 2018b ) to evaluate the performance of OoD detectors are : • AUROC : The Receiver Operating Characteristic ( ROC ) , the plot of the True Positive Rate ( TPR ) against the False Positive Rate ( FPR ) . The area under the ROC is called Area Under the Receiver Operating Characteristic ( AUROC ) . AUROC of 1 denotes an ideal detection scheme , since the ideal detection algorithm results in 0 false positive and false negative samples . • AUPRC : The Precision Recall Characteristic ( PRC ) , the plot of the Precision against the Recall . The area under the PR is called AUPRC and should similarly be 1 for a ideal detection scheme . • FPR at TPR of 95 % ( FPR95 ) : denotes the FPR when the TPR is 95 % . Lower value of FPR at TPR of 95 % indicates a better classifier . To evaluate the effect of intra-class mixup on existing OoD detection techniques , we trained 5 differently seeded models each with ERM , inter-class mixup and intra-class mixup . We trained ResNet18 ( He et al. , 2016 ) networks on CIFAR-10 , CIFAR-100 , SVHN and TinyImageNet datasets till convergence ( baseline accuracies are presented in Table 2 ) . The training procedure used the SGD optimizer with a momentum of 0.9 and weight decay of 5 × 10−4 . The training used a 90 % -10 % training-validation split with the initial learning rate set to 10−2 and it was scaled down by a factor of 10 at 60 % and 80 % completion using a learning rate scheduler . It is common practice in literature ( Hendrycks & Gimpel , 2017 ; Lee et al. , 2018b ; Liang et al. , 2018 ; Ren et al. , 2019 ) to use data from distributions other than the training set as OoD data . We follow the same approach . For example , if a network is trained on CIFAR-10 , datasets other than CIFAR-10 ( SVHN , Places365 , Textures , LSUN , TinyImageNet , Gaussian Noise and Uniform Noise ) are used as OoD data . Table 3 ( which is a condensed version of Table 5 , 6 and 7 ) reports AUROC , AUPR and FPR95 results of applying MSP ( Maximum Softmax Probability Detector ( Hendrycks & Gimpel , 2017 ) ) , ODIN ( Liang et al. , 2018 ) and Energy Score ( Liu et al. , 2020 ) on ERM , inter-class mixup and intra-class mixup trained models . The detection performance ( AUROC , AUPR and FPR95 ) was obtained by aggregating results from 5 differently seeded models and OoD datasets . We used Gaussian Noise , Uniform Noise , SVHN , CIFAR-10 , CIFAR-100 , Places365 , Textures , LSUN and TinyImageNet as OoD datasets , excluding the corresponding in-distribution dataset . We also compare the effect of using only cos ( θ ) as the OoD score , referred in Table 3 as to “ Vanilla cos ( θ ) ” . Using only cos ( θ ) ignores information from the l2 margin , thus when existing techniques are provided with angular information , we observe improved performance . Table 3 demonstrates that using “ Vanilla cos ( θ ) ” performs better than MSP , ODIN and Energy score based detectors . Further , in Table 4 we observe adding angular information to existing techniques enhances their performance . On average we observe an improvement of 4.68 % , 3.98 % and 9.97 % on AUROC , AUPR and FPR95 metrics respectively on unsupervised OoD detection schemes with the use of intra-class mixup over empirical risk minimization . Further , we observe an improvement of 6.08 % , and 21.63 % on AUROC and FPR95 metrics over inter-class mixup and near identical AUPR performance when compared to inter-class mixup . 5.3 SUPPLEMENTING ANGULAR MARGIN In this subsection we present the performance results when the OoD detection score is supplemented angular margin . We show that the use of the cosine of the angular margin as the OoD detection score improves performance . The supplemented score is obtained by adding the OoD score to the cosine of the angular margin as described in Equation 7 . Figure 2 and Table 4 compare the OoD detection performance of methods that use distance proxies when used with intra-class mixup aided with angular margin . Table 4 reports mean and standard deviation obtained by averaging 5 different seeds for each in-distribution dataset and averaged over various OoD datasets as used for Table 3 . We observe that on average the use of angular margin with intra-class mixup improves OoD detection performance ( AUROC ) by 7.36 % over empirical risk minimization and 9.10 % over inter-class mixup . 6 CONCLUSION There have been numerous approaches to tackle the problem of OoD detection . In this paper we explore the use of intra-class mixup to train OoD detectors . We show that intra-class mixup reduces the angular spread of the learnt latent space representation , improving the angular separability of in-distribution and out-of-distribution data . We observe that the use of intra-class mixup on detection techniques that use distance proxies improves AUROC performance by 4.68 % and 6.08 % over empirical risk minimization and inter-class mixup trained models respectively . Further , the use of the cosine of the angular margin to supplement detection scores improves AUROC performance by 7.36 % over empirical risk minimization and 9.10 % over inter-class mixup trained networks . Our findings reveal that intra-class mixup can be an effective tool for training OoD detectors . 7 IMPACT STATEMENT The research presented in this paper focuses on improving the reliability of deep learning techniques in detecting anomalies , reducing the barriers to the deployment of deep learning in safety critical applications such as medical diagnosis , self driving cars etc . Hence it promises a positive impact on the society . However , one must be aware of the limitations of the specific techniques applied in conjunction with the technique proposed in the paper to ensure reliable and secure deployment in safety critical applications . This paper does not utilize human-derived data and does not utilize any datasets that have been discredited by the creators . REFERENCES Dario Amodei , Chris Olah , Jacob Steinhardt , Paul Christiano , John Schulman , and Dan Mané . Concrete problems in ai safety , 2016 . Daniel Andor , Chris Alberti , David Weiss , Aliaksei Severyn , Alessandro Presta , Kuzman Ganchev , Slav Petrov , and Michael Collins . Globally normalized transition-based neural networks . In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics ( Volume 1 : Long Papers ) , pp . 2442–2452 , Berlin , Germany , August 2016 . Association for Computational Linguistics . doi : 10.18653/v1/P16-1231 . URL https : //www.aclweb.org/anthology/ P16-1231 . Joan Bruna , Christian Szegedy , Ilya Sutskever , Ian Goodfellow , Wojciech Zaremba , Rob Fergus , and Dumitru Erhan . Intriguing properties of neural networks . International Conference on Learning Representation ( ICLR ) , Poster , 2014 . M. Cimpoi , S. Maji , I. Kokkinos , S. Mohamed , , and A. Vedaldi . Describing textures in the wild . In Proceedings of the IEEE Conf . on Computer Vision and Pattern Recognition ( CVPR ) , 2014 . Lucas Deecke , Robert Vandermeulen , Lukas Ruff , Stephan Mandt , and Marius Kloft . Image anomaly detection with generative adversarial networks . In Joint european conference on machine learning and knowledge discovery in databases , pp . 3–17 . Springer , 2018 . Ronald Aylmer Fisher et al . 138 : The use of multiple measurements in taxonomic problems . 1936 . Ian Goodfellow , Jean Pouget-Abadie , Mehdi Mirza , Bing Xu , David Warde-Farley , Sherjil Ozair , Aaron Courville , and Yoshua Bengio . Generative adversarial nets . In Advances in neural information processing systems , pp . 2672–2680 , 2014 . Ian J. Goodfellow , Jonathon Shlens , and Christian Szegedy . Explaining and harnessing adversarial examples . International Conference on Learning Representation ( ICLR ) , Poster , 2015a . Ian J. Goodfellow , Jonathon Shlens , and Christian Szegedy . Explaining and harnessing adversarial examples , 2015b . Kaiming He , Xiangyu Zhang , Shaoqing Ren , and Jian Sun . Deep residual learning for image recognition . In Proceedings of the IEEE conference on computer vision and pattern recognition , pp . 770–778 , 2016 . Dan Hendrycks and Kevin Gimpel . A baseline for detecting misclassified and out-of-distribution examples in neural networks . Proceedings of International Conference on Learning Representations , 2017 . Dan Hendrycks , Mantas Mazeika , and Thomas Dietterich . Deep anomaly detection with outlier exposure . Proceedings of the International Conference on Learning Representations , 2019 . Yen-Chang Hsu , Yilin Shen , Hongxia Jin , and Zsolt Kira . Generalized odin : Detecting out-ofdistribution image without learning from out-of-distribution data . In IEEE/CVF Conference on Computer Vision and Pattern Recognition ( CVPR ) , June 2020 . Hans-Peter Kriegel , Matthias Schubert , and Arthur Zimek . Angle-based outlier detection in highdimensional data . In Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining , pp . 444–452 , 2008 . Alex Krizhevsky , Geoffrey Hinton , et al . Learning multiple layers of features from tiny images . 2009 . Alex Krizhevsky , Ilya Sutskever , and Geoffrey E Hinton . Imagenet classification with deep convolutional neural networks . In F. Pereira , C. J. C. Burges , L. Bottou , and K. Q. Weinberger ( eds . ) , Advances in Neural Information Processing Systems 25 , pp . 1097–1105 . Curran Associates , Inc. , 2012 . URL http : //papers.nips.cc/paper/4824-imagenet-classificationwith-deep-convolutional-neural-networks.pdf . Alexey Kurakin , Ian Goodfellow , and Samy Bengio . Adversarial examples in the physical world . International Conference on Learning Representation ( ICLR ) , Workshop Track , 2017 . URL https : //openreview.net/forum ? id=S1OufnIlx . Yann LeCun , Yoshua Bengio , and Geoffrey Hinton . Deep learning . Nature , 521 ( 7553 ) :436–444 , May 2015 . ISSN 1476-4687. doi : 10.1038/nature14539 . URL https : //doi.org/10.1038/ nature14539 . Kimin Lee , Honglak Lee , Kibok Lee , and Jinwoo Shin . Training confidence-calibrated classifiers for detecting out-of-distribution samples . In International Conference on Learning Representations , 2018a . URL https : //openreview.net/forum ? id=ryiAv2xAZ . Kimin Lee , Kibok Lee , Honglak Lee , and Jinwoo Shin . A simple unified framework for detecting out-of-distribution samples and adversarial attacks . In S. Bengio , H. Wallach , H. Larochelle , K. Grauman , N. Cesa-Bianchi , and R. Garnett ( eds . ) , Advances in Neural Information Processing Systems 31 , pp . 7167–7177 . Curran Associates , Inc. , 2018b . URL http : //papers.nips.cc/ paper/7947-a-simple-unified-framework-for-detecting-out-ofdistribution-samples-and-adversarial-attacks.pdf . Fei-Fei Li , Andrej Karpathy , and Justin Johnson . Tiny imagenet visual recognition challenge . Shiyu Liang , Yixuan Li , and R. Srikant . Enhancing the reliability of out-of-distribution image detection in neural networks . In International Conference on Learning Representations , 2018 . URL https : //openreview.net/forum ? id=H1VGkIxRZ . Weitang Liu , Xiaoyun Wang , John D. Owens , and Yixuan Li . Energy-based out-of-distribution detection , 2020 . Yuval Netzer , Tao Wang , Adam Coates , Alessandro Bissacco , Bo Wu , and Andrew Y. Ng . Reading digits in natural images with unsupervised feature learning . In NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011 , 2011 . URL http : //ufldl.stanford.edu/ housenumbers/nips2011_housenumbers.pdf . A. Nguyen , J. Yosinski , and J. Clune . Deep neural networks are easily fooled : High confidence predictions for unrecognizable images . In 2015 IEEE Conference on Computer Vision and Pattern Recognition ( CVPR ) , pp . 427–436 , 2015. doi : 10.1109/CVPR.2015.7298640 . Jie Ren , Peter J Liu , Emily Fertig , Jasper Snoek , Ryan Poplin , Mark Depristo , Joshua Dillon , and Balaji Lakshminarayanan . Likelihood ratios for out-of-distribution detection . In Advances in Neural Information Processing Systems , pp . 14707–14718 , 2019 . Sunil Thulasidasan , Gopinath Chennupati , Jeff A Bilmes , Tanmoy Bhattacharya , and Sarah Michalak . On mixup training : Improved calibration and predictive uncertainty for deep neural networks . In H. Wallach , H. Larochelle , A. Beygelzimer , F. d'Alché-Buc , E. Fox , and R. Garnett ( eds . ) , Advances in Neural Information Processing Systems , volume 32 . Curran Associates , Inc. , 2019 . URL https : //proceedings.neurips.cc/paper/2019/file/ 36ad8b5f42db492827016448975cc22d-Paper.pdf . Vladimir N. Vapnik . Statistical Learning Theory . Wiley-Interscience , 1998 . William Wang , Angelina Wang , Aviv Tamar , Xi Chen , and Pieter Abbeel . Safer classification by synthesis . arXiv preprint arXiv:1711.08534 , 2017 . Fisher Yu , Ari Seff , Yinda Zhang , Shuran Song , Thomas Funkhouser , and Jianxiong Xiao . Lsun : Construction of a large-scale image dataset using deep learning with humans in the loop . arXiv preprint arXiv:1506.03365 , 2015 . Chiyuan Zhang , Samy Bengio , Moritz Hardt , Benjamin Recht , and Oriol Vinyals . Understanding deep learning requires rethinking generalization . arXiv preprint arXiv:1611.03530 , 2016 . Hongyi Zhang , Moustapha Cisse , Yann N. Dauphin , and David Lopez-Paz . mixup : Beyond empirical risk minimization . International Conference on Learning Representations , 2018 . URL https : //openreview.net/forum ? id=r1Ddp1-Rb . Bolei Zhou , Agata Lapedriza , Aditya Khosla , Aude Oliva , and Antonio Torralba . Places : A 10 million image database for scene recognition . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2017 . A APPENDIX A.1 VARIANCE OF INPUT DUE TO INTRA-CLASS MIXUP Consider two random variables X0 , X1 ∼ X where X is a class conditional distribution for class ŷ with mean µX and variance σ2X . Then the variance of X̂ = a0X0 + a1X1 where a0 = λ and a1 = 1− λ is given by σ2 X̂ = V ar ( X̂ ) = E [ ( X̂ − µX̂ ) 2 ] σ2 X̂ = E [ ( ∑1 k=0 aiXi − ∑1 k=0 aiµX ) 2 ] σ2 X̂ = E [ ( ∑1 k=0 ak ( Xk − µX ) ) 2 ] σ2 X̂ = E [ ( ∑1 k=0 ak ( Xk − µX ) ) ( ∑1 k=0 ak ( Xk − µX ) ) ] σ2 X̂ = E [ ∑1 j=0 ∑1 k=0 akaj ( Xk − µX ) ( Xj − µX ) ] σ2 X̂ = ∑1 j=0 ∑1 k=0 akajE [ ( Xk − µX ) ( Xj − µX ) ] σ2 X̂ = ∑1 k=0 a 2 kσ 2 X + 2a0a1Cov ( X0 , X1 ) The Cov ( X0 , X1 ) = 0 because X0 and X1 are drawn independently , therefore the equation is reduces to σ2 X̂ = [ λ2 + ( 1− λ ) 2 ] σ2X Since λ2 + ( 1− λ ) 2 ≤ 1 σ2 X̂ ≤ σ2X A.2 EXPANDED RESULTS FOR VARIOUS DETECTION SCHEMES

Summary: Inspired from inter-class mixup (Zhang et al, ICLR 2018), where data augmentation is used to train models more robust to adversarial samples, this work proposes intra-class mixup to reduce the variance of in-distribution samples, i.e. the training set, and improve the capacity of a trained model to detect out-of-distribution samples at inference time. The key difference between the two works is that the here proposed does the mixup within samples belonging to the same class.   In addition to this, the work propose to use the angular margin, i.e. the angle between the normal of the decision boundary of a neural net (obtained from the weights of the last layer) and an unmixed sample, to detect OOD samples. The cosine of such angle shall be coupled with an OOD method to perform OOD detection.