A Simple and Effective  Baseline for Out-of-Distribution Detection using Abstention
Authors: Sunil Thulasidasan
Sushil Thapa
Sayera Dhaubhadel
Gopinath Chennupati
Tanmoy Bhattacharya
Jeff Bilmes
Venue:  (2021)
Keywords: deep learning
out-of-distribution detection

Abstract: Refraining from confidently predicting when faced with  categories of inputs different from those seen during training is an important requirement for the safe deployment of deep learning systems. While simple to state, this has been  a particularly challenging problem in deep learning, where models often end up making overconfident predictions in such situations. In this work we present a simple, but highly effective approach to deal with out-of-distribution detection that uses the principle of abstention: when encountering a sample from an unseen class, the desired behavior is to abstain from predicting. Our  approach uses a network with an extra abstention class and is trained on a dataset that  is augmented with an uncurated  set that consists of a large number of out-of-distribution (OoD) samples that are assigned the label of the abstention class; the model is then trained to learn an effective discriminator between in and out-of-distribution samples. 

 We  compare this relatively simple approach against a wide variety of more complex methods that have been proposed both for out-of-distribution detection as well as uncertainty modeling in deep learning, and empirically demonstrate its effectiveness on a wide variety of of benchmarks and deep architectures for image recognition and text classification, often outperforming existing approaches by significant margins. Given the simplicity and effectiveness of this method, we propose that this approach be used as a new additional baseline for future work in this domain.

Under review as a conference paper at ICLR 2021
A SIMPLE AND EFFECTIVE BASELINE FOR OUT-OF- DISTRIBUTION DETECTION USING AN ABSTENTION CLASS
Anonymous authors Paper under double-blind review
ABSTRACT
Refraining from confidently predicting when faced with categories of inputs dif- ferent from those seen during training is an important requirement for the safe deployment of deep learning systems. While simple to state, this has been partic- ularly challenging problem in deep learning, where models often end up making overconfident predictions in such situations. In this work present simple, but highly effective approach to deal with out-of-distribution detection that uses the principle of abstention: when encountering sample from unseen class, the desired behavior to abstain from predicting. Our approach uses a network with an extra abstention class and trained on a dataset that is augmented with an uncurated set that consists of large number of out-of -istriiiittiittion (OoD) samples that are assigned the label of the abstention class; the model then trained learn an effective discriminator between in and out-of- outoo-diistriuttin samples. We compare this relatively simple approach against a wide variety of more complex methods that have been proposed both for out-of-distribution detection as well as uncertainty modeling in deep learning, and empirically demonstrate its effectiveness on a wide variety of of benchmarks and deep architectures for image recognition and text clas- sification, often outperforming existing approaches by significant margins. Given the simplicity and effectiveness of this method, we propose that this approach be used as a new additional baseline for future work in this domain.
INTRODUCTION AND RELATED WORK
Most of supervised machine learning has been developed with the assumption that the distribution of classes seen at train and test time are the same. However, the real-world is unpredictable and open-ended, and making machine learning systems robust to the presence of unknown categories and -utoof-distribution samples has become increasingly essential for their safe deployment. While refraining from predicting when uncertain should be intuitively obvious to humans, the peculiarities of DNNs makes them overconfident to unknown inputs Nguyen et al. (2015) and makes this a challenging problem to solve in deep learning.
very active sub-field of deep learning, known as out-offdisttibuutio (OoD) detection, has emerged in recent years that attempts impart to deep neural networks the quality of "knowing when it doesn't 't know". The most straight-forward approach in this regard is based on using the DNNs output a proxy for predictive confidence. For example, simple baseline for detecting OoD samples using thresholded softmax scores was presented in [eeddyyck & Gimpel (2016). where the authors provided empirical evidence that for DNN classifiers, in-distribution predictions do tend to have higher winning scores than OoD samples, thus empirically justifying the use of softmax thresholding as a useful baseline. However this approach is vulnerable to the pathologies discussed in Nguyen et al. (2015). Subsequently. increasingly sophisticated methods have been developed to attack the OoD problem. [iang et al. (2018) introduced a detection technique that involves perturbing the inputs given input, based on
in the direction of increasing the confidence of the network's 's predictions the observation that the magnitude of gradients on in-distribution data tend to be larger than for OoD data. The method proposed in [ee et al. (2018) also involves input perturbation, but confidence in this case was measured by the Mahalanobis distance score using the computed mean and covariance of the pre-softmax scores. A drawback of such methods, however, is that it introduces number of

---

Under review as a conference paper at ICLR 2021
hyperparameters that need to be tuned on the OoD dataset, which is infeasible in many real-world scenarios as one does not often know in advance the properties of unknown classes. A modified version of the perturbation approach was recently proposed in in Hss et al. (2020) that circumvents some of these issues, though one still needs to ascertain an ideal perturbation magnitude, which might not generalize from one OoD set the other.
Given that one might expect a classifier to be more uncertain when faced with OoD data, many methods developed for estimating uncertainty for DNN predictions have also been used for OoD detection. A useful baseline in this regard is the temperature scaling method of /uo et al. (017) that was was proposed for calibrating DNN predictions on in-distribution data and has been observed to also serve as a useful OoD detector in some scenarios. Further. label smoothing techniques like mixup Zhang et al. (2017) have also been shown to be able to improve OoD detection performance in models approach, that is also augmented with adversarial examples during training, described in Lakshminarayanan et al. (2017) was also shown to improve predictive uncertainty and succesfully applied to OoD detection.
DNNs Thlassiaaannn et al. (2019). An ensemble-of-dest
In the Bayesian realm, methods such as Maddox et al. (2019) and Osawa et al., (2019) have also been used for OoD detection, though at increased computational cost. However, it has been argued that for OoD detection, Bayesian priors on the data are not completely justified since one does not have access to the prior of the open-set Boult et al. (2019). Nevertheless, simple approaches like dropout - -which have been shown to be equivalent to deep gaussian processes Gal & Ghahramani (016)) have been used as baselines for OoD detection.
Training the model to recognize unknown classes by using data from categories that do not overlap with classes of interest has been shown to be quite effective for out-of-distrbutioo detection and slew of methods that use additional data for discriminating between ID and OD data have been proposed.
DeVries & Taylor (018) describes a method ithat uses a separate confidence branch and misclassified training data samples that serve as proxy for OoD samples. In the outlier exposure technique described in Hendrycks et al. (2018), the predictions on natural outlier images used in training are regularized against the uniform distribution to encourage high-entropy posteriors on outlier samples. An approach that uses an extra-class for outlier samples is described in [Neal et al. (2018), where instead of natural outliers, counterfactual images that lie just outside the class boundaries of known classes are generated using a GAN and assigned the extra class label. A similar approach using generative samples for the extra class, but using a conditional Variational & Welling (2013) for generation, is described in Vernekar et al. (2019). A method to force a DNN to produce high-entropy (i.e., low confidence) predictions and suppress the magnitude of feature activations for Ool) samples was discussed in Dhamija et (2018). where, arguing that methods that use extra background class for Ool) samples force all such samples lie in one region of the feature space, the work also forces separation by suppressing the activation magnitudes of samples from unknown classes
auto-Encoders Kingma
The above works have shown that the use of known OoD samples (or known unknowns) often generalizes well to unknown unknown samples. Ineed, even though the space of unknown classes is potentially infinite, and one can never know in advance the myriad of inputs that can occur during test time, empirically this approach has been shown to work. The abstention method that we describe in the next section borrows ideas from many of the above methods: as in [endrrycks et al.) 2018), we uses additional samples of real images and text from non-overlapping categorics to train the model to abstain, but instead of entropy regularization over OoD samples, out method uses extra abstention class, While it has been sometimes argued in the literature that that using an additional abstention (or rejection) class is not an effective approach for OoD detection Dhamija et al. 2018);; Lee et al. (0177), comprehensive experiments we conduct in this work demonstrate that this is not the case. Indeed, we find that such an approach is not only simple but also highly effective for Ool detection, often outperforming existing methods that are more complicated and involve tuning of multiple hyperparameters. The main contributions of this work are as follows:
To the best of our knowledge, this is the first work to comprehensively demonstrate the efficacy of using an extra abstention (or rejection class) in combination with outlier training data for effective OoD detection.
In addition to being effective, our method is also simple: we introduce additional hyperparameters in the loss function, and train with regular cross entropy. From a standpoint, this is especially useful for deep learning practitioners who might not wish
practical
2

---

Under review as a conference paper at ICLR 2021
make modifications to the loss function while training deep models. In addition, since outlier data simply an additional training class, no architectural modifications to existing networks necded.
Due to the simplicity and effectiveness of this method, we argue that this approach be considered strong baseline for comparing new methods in the field of OoD detection.
2 OUT-OF-DISTRIBUTII DETECTION WITH AN ABSTAINING CLASSIFIER (DAC)
Our approach uses DNN trained with extra abstention class for detecting nut-of-distribution and novel samples; from here on, we will refer to this as the deep abstaining classifier (DAC). We augment training set of in-distribution samples (D;.. with an auxiliary dataset of known duittf-distribution samples (Dou)), that are known be mostly disjoint from the main training set (we will use Dant to denote wnknown out-o--distribution samples that we use for testing). We assign the training label of K + 1 to all the outlier samples in Dout (where K is the number of known classes) and train with cross-entropy; the minimization problem then becomes:
min B (x..)>D,. [- log Poly x|x)] + E x.y.DD.... |- log Po K 1|x)]
(1)
where are the weights of the neural network. This is somewhat similar to the approaches described in [Hendrycks et al. (2018) well in Lee al. (2017). with the main difference being that in those methods, an extra class is not used; instead predictions on outliers are regularized against the uniform distribution. Further the loss the outlier samples is weighted by hyperparameter which has to be tuned; in contrast, our approach does not introduce any additional hyperparameters.
In our experiments, we find that the presence of an abstention class that is used to capture the mass in Dout significantly increases the abil- ity detect Dout during testing. For exam- ple, in Figure [ we show the distribution of the winning logits (pre-softmax activations) in regular DNN (left). For the same experimen- tal setup, the abstention logit of the DAC pro- duces near- peerect separation of the in and out- of-distribution logits indicating that using an abstention class for mapping outliers
hogala DAN
DAC
Testroentetto
0.25
0.15
6:85
0.05
0.02
5.02
23
Score Warking Lagk
Absteetioo
An illustration of the separability of scores on in and out-of-distribution data for a regu- lar DNN (left) and the DAC (right). very effective approach to OoD detection. Theoretically. might be argued that the abstention class might only capture data that is aligned with the weight vector of that class, and thus this approach might fail to detect the myriad of Ool) inputs that might span the entire input region. Comprehensive experiments
Figure 1:
be
wide variety of benchmarks described in the subsequent section, however, empir- ically demonstrate that while the detection is not perfect, it performs very well, and indeed, much better than more complicated approaches.
Once the model is trained, we use a simple thresholding mechanism for detection. Concretely, the detector, g(z)= X 0, 1 assigns label (OoD) if the softmax score of the abstention class, i.c.. PK+1(6 (z) is above some threshold 8, and label O, otherwise:
g(x) {
if (x)
0 otherwise
Like in other methods, the threshold has to be determined based on acceptable risk that might be specific to the application. However, using performance metrics like area under the ROC curve (AUROC), we can determine threshold-independenn performance of various methods, and we use this as of our evaluation metrics in all our experiments.
3 EXPERIMENTS
The experiments we describe here can be divided into two sets: in the first set, we compare against methods that are explicitly designed for OoD detection, while in the second category, compare
3

---

Under review as a conference paper at ICLR 2021
against methods that are known improve predictive uncertainty in deep learning. In both cases, report results over a variety of architectures to demonstrate the efficacy of our method.
3.1 DATASETS
For all computer vision experiments, we use CIFAR-10 and CIFAR-ION 100 Krizhevsky & Hinton 2009) the in-distribution datasets, in addition to augmenting training with T00K unlabeled samples from the Tiny Images dataset Torralba et al. (2008). For the out-of-distribution datasets, we test on the following:
NetN et
(001 a large set of 32 32 color images of house numbers, comprising of ten classes of digits 0 9. We use a subset of the 26K images in the test set.
LSUN Yu et al. (2015), the Large-scale Scene Understanding dataset, comprising of 10 different types of scenes.
Places365 Zhou et al. (2017), large collection of pictures scenes that fall into one of 365 classes.
Tiny ImageNet tim (017)) (not to be confused with Tiny Images) which consists of images belonging to 200 categories that are a subset ImageNet categories. The images are x 64 color, which scale down to 32 x 32 when testing.
Gaussian synthetically generated dataset consisting of 32 random Gaussian noise images, where each pixel is sampled from an i.i.d Gaussian distribution.
For the NLP experiments, we use 20 Newsgroup Lang 1995), TREC TREC [Sherman] and SST Socher et al. (2013) datasets as our in-distribution datasets, which are the same those used by Hendrycks et al. (2018) to facilitate direct comparison. We use the 50-category version of TREC, and for SST, we use binarized labels where neutral samples are removed. For OoD training data, we use unlabeled samples from Wikitext2 by assigning them to the abstention class. We test our model on the following OoD datasets:
SNLI Bowman et al. (2015) is a dataset of predicates and hypotheses for natural language inference. We use the hypotheses for testing
IMDB Maas et al. (2011) is sentiment classification dataset of movie reviews, with similar statistics to those of SST.
Multi3KK Barrault et al. (2018) is dataset of we use the English descriptionss
image descriptions, of which
WMT16 Bojar et al. (2016) is dataset of English-German language pairs designed for machine translation task. We use the English portion of the test set from WMT16.
Yelp Zhang et al. 2015) is a dataset of restaurant reviews.
3.2 COMPARISON AGAINST OoD METHODS
In this section, we compare against slew of recent state-of-the-a methods that have been explicitly designed for OoD detection. For the image experiments, we compare against the following:
Deep Outlier Exposure, as described in Hendrycks et al. 2018 and discussed in Section
Ensemble of Leave-out Classifiers Vyas et al. (2018) where each classifier is trained by leaving out a random subset of training data (which is treated as OoD data), and the rest is treated as ID data.
ODIN, as described in Liang et al. (2018) and discussed in Section | ODIN uses input perturbation and temperature scaling to differentiate between ID and OoD samples.
Deep Mahalanobis Detector, proposed in Lee et al. (2018) which estimates the class- conditional distribution inant analysis and a Mahalanobis distance based confidence-score for thresholding, and further, similar to ODIN, uses input perturbation while testing.
hidden layer features of deep model using Gaussian discrim-
4

---

Under review as a conference paper at ICLR 2021
OpenMax, as described in Bendale & Boult (2016) for novel category detection. This method uses mean activation vectors of ID classes observed during training followed by Weibull fitting determine if given sample is novel or cuttof-distribution
For all of the above methods, we use published results when available, keeping the architecture and datasets the same as in the experiments described the respective papers. For the NLP experiments. we only compare against the published results in [Hendrycks et al. (2018). For OpenMax, we re-implement the authors' published algorithm using the Py PyTorch framework Paszke et al. (2019).
3.2.1 METRICS
Following established practices in the literature, use the following metrics to measure detection performance of our method:
AUROC or Area Under the Receiver Operating Characteristic curve depicts the relationship between the True Positive Rate (TPR) (also known as Recall)and the False Positive Rate (FPR) and can be interpreted as the probability that positive example is assigned higher detection score than a negative example Fawcett (2006). Unlike 0/1 accuracy, the AUROC has the desirable property that it is not affected by class imbalance
FPR at 95% TPR which is the probability that negative sample is misclassified as positive sample when the TPR (or recall) on the positive samples 95%.
In work that we compare against, the out-of of-disiibibuttion samples are treated as the positive class, so we do the same here, and treat the in-distribution samples the negative class.
3.2.2 RESULTS
Detailed results against the various OoD methods are shown in Tables I through for vision and language respectively. where we have a clear trend: almost all cases, the DAC outperforms the other methods, often by significant margins especially when the in-distribution data is more complex, as is the case with CIFAR-100. While the Outlier Exposure method Hendrycks et al. (2018) (shown the top in Table is conceptually similar to ours, the presence of an extra abstention class in our model often bestows significant performance advantages. Further, we do not need to tune a separate hyperparameter which determines the weight of the outlier loss, done in Hendrycks al. (2018).
In fact, the simplicity of our method is one of its striking features: we do not introduce any additional hyperparameters our approach. which makes it significantly easier implement than methods such as ODIN and the Mahalanobis detector; these methods need to be tuned separately on each OoD dataset, which is usually not possible as one does not have access the distribution of unseen classes in advance. Indeed, when performance of these methods is tested without tuning on the OoD test set, the DAC significantly outperforms methods such as the Mahalanobis detector (shown at the bottom of Table T.. We also show the performance against the OpenMax approach of Bendale & Boult (016) in Table Lable[]an and in every case, the DAC outperforms OpenMax by significant margins.
While the abstention approach uses extra class and OoD samples while training, and thus does incur some training overhead, it is significantly less expensive during test time, as the forward pass is no different from that of regular DNN. In contrast, methods like ODIN and the Mahalanobis detector require gradient calculation with respect to the input in order to apply the input perturbation; the DAC approach thus offers computationally simpler alternative. Also, even though the DAC approach introduces additional network parameters in the final linear layers (due to the presence of an extra abstention class), and thus might be more prone overfitting, we find that this be not the case as evidenced by the generalization of OoD performance to different types of test datasets.
3.3 COMPARISON AGAINST UNCERTAINTY-BASID METHOPS
Next we perform experiments to compare the OoD detection performance of the DAC against various methods that have been proposed for improving predictive uncertainty in deep learning. In these cases,
An alternaee area-under-e teneerr-th--uuee the-eurve metric, known as Area under Precision Recall Curve, or AUPRC, is used when the size of the negative class is high compared to the positive class. We do not report AUPRC here, as we keep our in-distribution and dutto--distribution balanced in these experiments.
5

---

Under review as a conference paper at ICLR 2021
vs. Outlier Exposure (OE) Hendrycks et al. 2018
(Model: Wide ResNet 40x2)
D in: CIFAR-10
Din: CIFAR-100
FPR95 5
AUROCT
IPR95 |
AUROCT
Dout
OE
Ours
OE
Ours
OE
Ours
OE
Ours
SVHN
4.8
2.09.69
98.4
99.460.16
42.9
40.4611.96
86.9
85.44
LSUN
12.1
0.10.06
97.6
99.960.02
57.5
9.271.62
83.4
97.671.40
Places365
17.3
0.22
96.2
99.920.05
49.8
23.375.30
86.5
93,981.66
Gaussian
0.7
0.13
99.6
99.939.09
12.1
13.2614.74
95.7
90.03
Vs, Ensemble of Leave-out Classifiers (ELOC) (Model: Wide ResNet 28x10)
Vyas et al.
2018
Di:: CIFAR-10
Din: CIFAR-100
FPR95
AUROC
FPR95
$
AUROC
Dout
ELOC
Ours
ELOC
Ours
ELOC
Ours
ELOC
Ours
Tiny ImageNet
2.94
1.912.24
99.36
99.45n.67
24.53
18.686.31
95.18
94,881.75
LSUN
0.88
1.5
99.7
99.61a.17
16.53
9.23
96.77
97.89
Gaussian
0.0
0.130.20
99.58
99.95n.08
98.26
0.72p.79
93.04
99.650.39
vs. ODIN Liang et al. 20188)
(Model: Wide Res.Net 28xI0)
D CIFAR-I0
Din::
CIFAR-100
FPR95 4.
AUROC
FPR95
L
AUROC f
Dout
ODIN
Ours
ODIN
Ours
ODIN
Ours
ODIN
Ours
Tiny ImageNet
25,5
1.912.24
92.1
99.45..67
55.9
18.68
84.0
94.88
LSUN
17.6
1,5
95.4
99.610.47
56.5
9.23
86.0
97.890.48
Gaussian
0.0
0.13
100.0
99.950.08
1.0
0.72
98.5
99.65g.38
vs. Deep Mahalanobis Detector (MAH) (Model: ResNet 34)
Lee et al.
2018
Din: CIFAR-10
Din: CIFAR- 100
FPR95 $
AUROC1
FPR95
AUROCT 1
Dout
MAH
Ours
MAH
Ours
MAH
Ours
MAH
Ours
SVHN
24.2
1.89
95.5
99.49p.17
58.1
41.31 8.01
84.4
86.852.38
Tiny ImageNet
4.5
0.36p.15
99.0
99.88p.04
29.7
12.10
87.9
97.14p.29
LSUN
1.9
0.30
99.5
99.91p.03
43.4
7.140.66
82.3
98.450.13
Table 1: Comparison of the extra class method (ours) with various other out-of-distribution detection methods when trained on CIFAR-10 and CIFAR-I00 and tested on other datasets. All numbers from comparison methods sourced from their respective original publications. For our method, we also report the standard deviation over five runs (indicated by the subscript), and treat the performance of other methods within one standard deviations as equivalent to ours. For fair comparison with the Mahalanobis detector (MAH) Lee et al.) (2018), we use results when their method was not tuned separately on each OoD test set (Table Lee et (2018).
OpenMax Bendale & Boult 2016 (Model KesNet 34)
D..: CIFAR-10 10
Din: CIFAR-100
AUROC
FPR95
AUROC
FPR95
Dont
OpenMax
Ours
OpenMax
Ours
OpenMax
Ours
OpenMax
Ours
SVHN
23.672
L89o.7s
90.72a.9
99.49
53.22
41.31g.01
80.88,
86.852.15
Tiny ImageNet
24.20
0.360.15
93.39p.m
99.88..04
32.67
12.10
81.22
97.14
LSUN
18.68, 24
0.30
92.161.82
99.916.03
30.21
7.14p.00
83.08
98.45p.13
Places365
27. 27.272.17
0.84
90.7 90.72..a5
99.67
50,711.25
30.542.28
81.13
92.69
Gaussian
40.58p2.18
0.04o.u2
84.7416.19
99.98..01
21,5011.78
1.66:
89.37..46
99.48..47
Table 2: DAC OpenMax.
The OpenMax implementation based code avail-
able at https: http:://gitttbbccc/ combabii
http://hww..ccc///aiiiitteeeedde jttbbhiatttbaaaeeeeeaeaaa CODDN and re-implemented by us in Py-
abmi
Torch Paszke al. (2019).

---

ensemble size of Under review as a conference paper at ICLR 2021
Outlier Exposure
Hendrycks al. 2018
for NLP Classification
[Model: 2 layered GRU)
FPR95
AUROC
Din
Dout
OE
Ours
OE
Ours
SNLI
12.5
3.90.54
95.1
98.32p.1
IMDB
18.6
1.780.12
93.5
99.17p.0
20 Newsgroup
Multi30K
3.2
0.80.13
97.3
99.52o.04
WMT16
2.0
1.40.16
98.8
99.33p.02
Yelp
3.9
0.76g.0s
97.8
99.61p.02
SNLI
4.2
12.0g.1
98.1
97.03 1.8
IMDB
0.6
0.0g.0
99.4
99.99
TREC
Multi30K
0.3
8,33.4
99.7
97.56p.5
WMT16
0.2
4.673.26
99.8
99.94p.6
Yelp
0.4
0.0p.0
99.7
99.0n.a
SNLI
33.4
20.92.3
86.8
92.24..77
IMDB
32.6
0.70.48
85.9
99.37p.1
SST
Multi30K
33.0
70.9
88.3
70.65
WMT16
17.1
31.65.9
92.9
90.641.7
Yelp
0.06g.00
92.7
99.67
Table 3: DAC vs OE for NLP Classification task. OE implementation was based on code available at https://gi //tt://gtthb con/hendrycks/outeeeooooo out exposure
one expects that such methods will cause the DNN to predict with less confidence when presented with imputs from a different distribution or from novel categories; we compare against the following methods:
Softmax Thresholding This is the simplest baseline, where OoD samples are detected by thresholding the winning softmax score; scores falling below a threshold are rejected.
Entropy Thresholding Another simple baseline, where OoD samples rejected if the Shannon entropy calculated over the softmax posteriors above a certain threshold.
MonteCarlo Dropout A Bayesian inspired approach proposed in Gal & Ghahramani (2016)
for improving the predictive uncertainty for deep learning. We found a dropout probability of = 0.5 to perform well, and use 100 forward passes per sample during the prediction.
Temperature Scaling, which improves DNN calibration as described in Guo et al. (2017). The scaling temperature T is tuned on held-out subset of the validation of the in- distribution data.
Mixup As shown in Thulasidasan et al. (2019), Mixup can be an effective OoD detector, so we also use this as one of our baselines.
Deep Ensembles which was introduced in Lakshminarayanan et al. (2017) for improving uncertainty estimates for both classification and regression. In this approach, multiple ver- sions of the same model are trained using different random initializations, and while training. adversarial samples generated improve model robustness. We
5 as suggested their paper.
SWAG, as described in Maddox et al. 2019) which is a Bayesian approach to deep learning and exploits the fact that SGD itself be viewed as approximate Bayesian inference Mandt et al. (007)). We use an ensemble size of 30 as proposed in the original paper.
3.3.1 RESULTS
Detailed results are shown in Table where the best performing method for each metric is shown in bold. The DAC is the only method this set of experiments that uses an augmented dataset, and as is clearly evident from the results, this confers significant advantage over the other methods in most cases. Calibration methods like temperature scaling, while producing well calibrated scores on in-distribution data, end up reducing the confidence in-distribution data as well, and thus losing discriminative power between the two types of data. We also note here that many of the methods listed in the table, like temperature scaling and deep ensembles, be combined with the
7

---

Under review as a conference paper at ICLR 2021
abstention approach. Indeed, the addition of extra abstention class and training with OoD data is compatible with most uncertainty modeling techniques in deep learning; we leave the exploration of such combination approaches for future work.
CIFAR-100
AUROC
Monte Carlo
Temp
Deep
DAC
ouut
Softmax
Entropy
Dropout
Scaling
Mixup
Ensemble
SWAG
(Ours)
LSUN
87. 860.54
89.53p.68
84.352.00
87.75
86.03
89.36n.28
83.872.58
98.73%.
365
79.770.7a
80.34n.s3
80.211.06
79.531.0 os
82.096.9s
82.69e.27
83.370.42
93.39h.50
Gaussian
80.766.52
80.46s.50
68,402a.29
80.52a.51
92.13a.0s
80.27s.0:
91.806.94
99.69h.28
SVHN
78.45
79.4 39.43
81.042.46
78.25 99
79. 15.52
82.42a.22
80.451.67
87.742.31
Tiny ImageNet
86.63u.2
88.00,.2
82.07
86.49, 14
84.57
86.64
80.90
97.60p
Din: CIFAR-100
FPR95
Monte Carlo
Temp Scaling
Deep Ensemble
DAC
Dout
Softmax
Entropy
Dropout
Mixup
SWAG
(Ours)
LSUN
35.641.aa
34.521.sz
42.934.6
35 35.641.6
34.521.a2
32.480.37
40.50 40.504.09
5.41g.38
Places-365
55.191.96
55.811.40
56,50,.s
55.19
55.811.40
46.55p.a:
47. 47.760.91
29.592.48
Gaussian
33.70s.11
12.82
41.3423.70
33.70,
32.82,0.19
23.855.07
13.58
0.89
SVHN
55.2810.30
16.1610.07
50.084.49
15.2810.30
55.1610.07
47.570.53
49.433.6a
40.448.31
Tiny ImageNet
37.271.04
36.651.25
47.106.0r 05
37.27
36.65
38.58p.s1
45.05%.08
10.15
Di:: CIFAR-10
AUROC1 1
Monte Carlo
Temp
Deep Ensemble
Dout
Softmax
Entropy
Dropout
Scaling
Mixup
SWAG
DAC
LSUN
93.45
93.84..a7
91.561.77
93.99%.s0
96.58
93.44..19
96.28p.oc
99,92,
Places-365
91.70p.58
92.08u.3e
89.296.72
92.39
96.38p.s7
94.78,
96.07u.e
100.00..o
Gaussian
79.3923.06
79. 79.2213.24
94.262.74
80.40g
95.6 95.62q.02
95.82
96.51g.32
100.00..0
SVHN
91.38, us
91.70,.11
83.56s.85
91.99u.3a
92.02..9
90.58 20
96.12
99.50, 16
Tiny ImageNet
91.98 85
92.31
88.84,,19
92.59
95.6 95.67
94.07p 29
95.65m.13
99.88,
Din: CIFAR-10
FPR95
Monte Carlo Dropout
Temp Scaling
Deep Ensemble
Dint
Softmax
Entropy
Mixup
SWAG
DAC
LSUN
19.15
18.93
25. 25.86,.4
18. 18.762.05
12.47
19.36,
12.7
0.27
Places-365
26.49%
26.423.70
33.652.31
26.37
14.77
15.79 39
12.80,.07
0.00p.00
Gaussian
52.842215
53.52.1.08
12.63.
15.91
10.96
9.15, as
9.55g.5
0.00
SVHN
24.642.41
24.672.48
43.32
25.06s.00
29.71
24.99
13.04
1.780.76
Tiny ImageNet
26.21
26.2410.00
33.2515.67
24.96s.58
14.84
17.03, s8
12.07p.14
0.33
Table 4: The performance of DAC OoD detector, evaluated on various metrics and compared against competing baselines. All experiments used the ResNet-34 architecture, except for MC Dropout, in which case we used the WideResNet 28x10 network. t and J indicate that higher and lower values are better, respectively. Best performing methods (ignoring statistically insignificant differences)on each metric are bold.
4 CONCLUSION
We presented a simple, but highly effective method for open set and out-of-distribution detection that clearly demonstrated the efficacy of using an extra abstention class and augmenting the training set with outliers. While previous work has shown the efficacy of outlier exposure Hendrycks et al. (2018), here we demonstrated an alternative approach for exploiting outier data that further improves upon existing methods, while also being simpler to implement compared to many of the other methods. The ease of implementation, absence of additional hyperparameter tuning and computational efficiency during testing makes this very viable approach for improving -ittof-distribution and novel category detection real-world deployments; we hope that this will also serve as an effective baseline for comparing future work in this domain.
REFERENCES
Tiny imagenet visual recognition challenge, 2017. URL https:/tiny-imageen herokuapp.com
8

---

Under review as a conference paper at ICLR 2021
Loic Barrault, Fethi Bougares, Lucia Specia, Chiraag Lala, Desmond Elliott, and Stella Frank. Findings of the third shared task on multimodal machine translation. In Proceedings of the Third Conference Machine Translation: Shared Task Papers, pp. 304-323, 2018.
Abhijit Bendale and Terrance E Boult. Towards open set deep networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1563-1572, 2016.
Ond rej Bojar, Rajen Chatterjee, Christian Federmann, Yvette Graham, Barry Haddow, Matthias Huck, Antonio Jimeno Yepes, Philipp Koehn, Varvara Logacheva, Christof Monz, Matteo Negri, Aurelie Neveol, Mariana Neves, Martin Popel, Matt Post, Raphael Rubino, Carolina Scarton, Lucia Specia, Marco Turchi, Karin Verspoor, and Marcos Zampieri. Findings of the 2016 conference on machine translation. In Proceedings of the First Conference on Machine Translation, pp. 131-198, Berlin, Germany, August 2016. Association for Computational Linguistics. URL http:// hettp://wwwaat
6200
TE Boult, S Cruz, AR Dhamija, M Gunther, Henrydoss, and WJ Scheirer. Learning and the unknown: Surveying steps toward open world recognition. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 9801-9807, 2019.
Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D. Manning. A large annotated corpus for learning natural language inference. In Proceedings of the 2015 Conference Empirical Methods in Natural Language Processing (EMNLP). Association for Computational Linguistics, 2015.
Terrance VeVries and Graham W Taylor. Learning confidence for out-of detection in neural networks. arXiv preprint arXiv: 048655 2018.
Akshay Raj Dhamija, Manuel Günther, and Terrance Boult. Reducing network agnostophobia. In Advances in Neural Information Processing Systems, pp. 9157-9168, 2018.
Tom Fawcett, An introduction to roc analysis. Pattern recognition letters, 27(():861-874, 2006.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In international conference on machine learning, pp. 1050-1059,
2016.
ZongYuan Ge, Sergey Demyanov, Zetao Chen, and Rahil Gamavi. Generative openmax for multi- class open set classification. arXiv preprint arXiv:1707.0 2017.
lan Goodfellow, Jean Pouget-Abadic, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural informa- fion processing systems, pp. 2672 2680, 2014.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. arXiv preprint 176.049006 2017.
Dan Hendrycks and Kevin Gimpel. baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv preprint 1rXiv:1610.02/53 2016.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint arXiv: 18/ 04606, 2018
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of- distribution image without learning from out-of-distributio data. arXiv preprint 1rXtv:2002.11297, 2020.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. 1rXiv:13/2.6114, 2013.
arXiv preprint
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. Advances in Neural Information Processing Systems, pp. 6402-6413, 2017.

---

Under review as a conference paper at ICLR 2021
Ken Lang. Newsweeder: Learning to filter netnews. In Proceedings of the Twelfth International Conference on Machine Learning, pp. 331-339, 1995.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training colideeeree classifiers for detecting out-oo-diitributiin samples. arXiv preprint arXiv:1711.09325, 2017.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Advances in Neural Information Processing Systems, pp. 7167-7177, 2018.
Shiyu Liang, Yixuan Li, and R Srikant. Enhancing the reliability of out-of-distribution image 02690
detection in neural networks. 2018. URL
Andrew L.. Maas, Raymond E. Daly, Peter Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, pp. 142-150, Portland, Oregon, USA, June 2011. Association for Computational Linguistics. URL http
/ //wwwaccwwed
Wesley Maddox, Pavel Izmailov, Timur Garipov, Dmitry P Vetrov, and Andrew Gordon Wilson A simple baseline for bayesian uncertainty in deep learning. In Advances in Neural Information Processing Systems, pp. 13132-13143, 2019.
Stephan Mandt, Matthew D Hoffman, and David M Blei. Stochastic gradient descent approximate bayesian inference. The Journal of Machine Learning Research, 18(1):4873-490) 2017.
Lawrence Neal, Matthew Olson, Xiaoli Fern, Weng- Veng-Keen Wong, and Fuxin Li. Open set learning with counterfactual images. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 613-628, 2018.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks easily fooled: High confidence predictions for unrecognizable images. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 427-436, 2015.
Kazuki Osawa, Siddharth Swaroop, Mohammad Emtiyaz E Khan, Anirudh Jain, Runa Eschenhagen, Richard Turner, and Rio Yokota. Practical deep learning with bayesian principles. In Advances in Neural Information Processing Systems, pp. 4301, 2019.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. In Advances in neural information processing systems, pp. 8026-8037, 2019.
Garrick Sherman. Trec document topic annotations. 20Newsgroups//
URL http:://wwnn..com//1
Richard Socher, A. Perelygin, J.Y. Wu, J. Chuang, C.D. Manning, A.Y. Ng. and C. Potts. Recursive deep models for semantic compositionality over a sentiment treebank. EMNLP, 1631:1631-1642, 01 2013.
Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: A simple way to prevent neural networks from overfitting. Journal of Machine Learning Research, 15(56)::929-1999) 2014. URL http://
Sri vastava 44..mml
Sunil Thulasidasan, Gopinath Chennupati, Jeff A Bilmes, Tanmoy Bhattacharya, and Sarah Michalak.
On mixup training: Improved calibration and predictive uncertainty for deep neural networks. In Advances in Neural Information Processing Systems, pp. 13888, 2019.
10

---

Under review as a conference paper at ICLR 2021
Antonio Torralba, Rob Fergus, and William T Freeman. 80 million tiny images: A large data set for nonparametric object and scene recognition. IEEE transactions on pattern analysis and machine intelligence,
2008.
Sachin Vernekar, Ashish Gaurav, Vahdat Abdelzad, Taylor Denouden, Rick Salay, and Krzysztof Czar- necki. Out-of-distribttion detection in classifiers via generation. arXiv preprint arXiv: MxXiv:9100.0224. 2019.
Apoorv Vyas, Nataraj Jammalamadaka, Xia Zhu, Dipankar Das, Bharat Kaul, and Theodore Willke. Out-of-distribution detection using ensemble of self supervised leave-out classifiers. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 550-564, 2018.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: 530,0335,, 2015.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint 17X1v:1710.09412, 2017.
Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level Convolutional Networks for Text Classification arXiv:1509.01626 [cs], September 2015. URL https: www..wwwwmmcccm...mmm..mmommmmm. dataset
Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE transactions pattern analysis and machine intelligence, 405644452-1 2017.


Reviews:
[{"review_id": "sfZV3fxO9xU", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "- Summary:\nThis paper shows that introducing an abstention class for out-of-distribution (OOD) works well for detecting it when the in-distribution dataset is CIFAR and TinyImageNet is available during training as an OOD dataset.\n\n- Reasons for score:\n1. The proposed setting with a large OOD dataset has already been proposed by [Hendrycks et al.], and the proposed method has been experimented in [Lee et al. (a)] and [Dhamija et al.], so the technical novelty of this work is limited.\n2. The experiments are not thoroughly conducted. The only value I can find in this paper is the empirical observation in a limited condition. More specifically, this paper found that adding an abstention class is better than prior methods when the in-distribution dataset is CIFAR and TinyImageNet is available during training as an OOD dataset. I am not sure this observation is consistent in other settings, so I recommend to conduct more thorough experiments, as done in [Hendrycks et al.]. Again, [Hendrycks et al.] considered a similar setting, but they proved the effectiveness of their method in image and natural language domains, with 7 in-distribution datasets and 3 large OOD datasets. However, even with more experiments, I am not sure this work is significant enough for publication in ICLR, because of the lack of novelty in both the experimental scenario and method.\n3. The comparison is unfair. Performances of prior methods are borrowed from original works, but they are mostly experimented in settings different from this paper. In particular, some works like [Lee et al. (b)] and [Hsu et al.] considered training/validating without OOD data, because it is hard to assume to have a large OOD dataset covering all possible OOD in practice.\n\n- Minor Comments:\n4. Citation format issue: you can use \\citet for noun and \\citep for adverb.\n\n[Lee et al. (a)] Training confidence-calibrated classifiers for detecting out-of-distribution samples. In ICLR, 2018.\n\n[Lee et al. (b)] A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In NeurIPS, 2018.\n\n[Dhamija et al.] Reducing network agnostophobia. In NeurIPS, 2018.\n\n[Hendrycks et al.] Deep anomaly detection with outlier exposure. In ICLR, 2019.\n\n[Hsu et al.] Generalized ODIN: Detecting Out-of-distribution Image without Learning from Out-of-distribution Data. In CVPR, 2020.\n\n**After rebuttal**\n\nI'd like to thank authors for their efforts to address my concerns. I didn't change my initial rating, due to the two main concerns below:\n\n(1) To me, the main argument of this paper sounds \"when a large (and maybe diverse) OOD is given, adding an OOD class to the classifier is better than baselines.\" Since the large OOD setting has already been proposed by [Hendrycks et al.], the only contribution of this work is on the empirical observation that the proposed method is better than baselines. While the observation is interesting, I think the contribution is not enough as a full ICLR paper at this point.\n\nDuring the rebuttal period, R3 corrected it that \"the main question investigated by the paper is how to best use the outlier exposure set,\" and this sounds better. However, authors didn't emphasize the setting but their method, such that their main argument is (if they intended to say as like what R3 understood) misleading. Training with a large OOD dataset like [Hendrycks et al.] is not common, and the observation in this paper is limited to this setting. However, the only statement about the setting I could find in the intro is that \"as in Hendrycks et al. (2018), we uses additional samples of real images and text from non-overlapping categories to train the model to abstain, ...\" i.e., rather than elaborating/emphasizing the setting (together with their method), they just cited a prior work.\n\nIn short, I recommend authors to rewrite abstract/intro as suggested by R3, to properly emphasize their contribution.\n\n(2) The comparison is unfair, as authors didn't re-evaluate baselines in the same setting (they had to make it the same as much as possible) but just pasted numbers from original papers. Even the comparison with the closest prior work [Hendrycks et al.] is unfair, as the prior work fine-tuned the model while the proposed method trained the model from scratch.\n\nRegarding the performance of similar methods evaluated in [Lee et al. (a)] and [Dhamija et al.], I think the main reason why they didn't get the same observation is on the size of OOD dataset, i.e., they didn't train their model with a large OOD dataset like [Hendrycks et al.] or this work. As this work claims, it might be true that when a large OOD dataset is available, adding an OOD class to the classifier is simply good enough.", "extra_scores": {}, "extra_text": {}}, {"review_id": "KzJGhOEnC00", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "I read this paper with great interest. The authors propose an easy-to-understand, easy-to-implement baseline method for detecting when inputs to a ML model is out of distribution. The method involves augmenting the training dataset with  an out of distribution dataset and adding an additional class in the classification layer for out of distribution. The paper describes several experiments—some in computer vision, some in NLP—and then compares them to other OOD techniques. The results are comparable to other techniques, although the proposed technique is definitely simpler.\n\nI believe that this is a direction worth exploring; however, I do feel that the authors could have provided some more insights into the following decisions:\n1. What are the desired characteristics of the OOD dataset used to augment the training set? How and why was the tiny images dataset chosen to augment the training set? If we instead used the Gaussian dataset as the OOD training set, will the results have been similar?\n2. How large should the OOD training set be? The paper used 100k images from the Tiny Images dataset for the vision tasks. Why 100k? What if we trained with 10k images instead? What should the balance between in-distribution and out-of-distribution images be in the training set?\n3. Does the task performance remain the same? If not, then how does the OOD detector (task + OOD classifier) proposed in the paper compare against, say, a model that just learns to classify in-vs-out of distribution?\n\nI look forward to hearing back from the authors and I’m open to changing my score.", "extra_scores": {}, "extra_text": {}}, {"review_id": "JFNRnhmRiv", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "-- Summary: \nThis paper presents experiments and results from using a reject-class in multi-class classification for the auxiliary task of out-of-distribution (ood) sample detection. Training requires unlabeled ood data disjoint from the training set. \n\n\n--  Review: \n1- The idea of using auxiliary task or reject-class for ood detection has been well explored in the past. Examples include Neal et al. [1] mentioned in the paper and recently by Mohseni et al [2] which is missing from the reference. This also has been used to improve representation learning in Zhang and LeCun [3]. \n \n2- Previous work accepted and recognized MSP score (with not additional data or hyperparameter) as the baseline for ood detection. What is your justification to propose your reject-class technique as the new baseline? \n\n3- A challenging test case for ood detection is training and testing on two similar datasets such as cifar10 and cifar100. The cifar10 as D-in for train and cifar100 as D-out for test (and vice versa) is a very common example. I wish we could see results on that. \n\n-- Strengths:\n- The ood detection problem is an important and interesting topic\n- Authors reviewed results and compared the proposed ood detection technique with multiple uncertainty-based techniques.\n\n\n-- Weaknesses: \n- Lack of novel contributions.\n- Experiments and results are limited. More recent papers studied the use of self-supervised learning (e.g. [4, 5] ) and contrastive learning (e.g., [6, 7,8]) to improve ood detection. \n\n\n[1] Neal, Lawrence, et al. \"Open set learning with counterfactual images.\" Proceedings of the European Conference on Computer Vision (ECCV). 2018.'\n[2] Mohseni, Sina, et al. \"Self-Supervised Learning for Generalizable Out-of-Distribution Detection.\" AAAI. 2020.\n[3] Zhang, Xiang, and Yann LeCun. \"Universum prescription: Regularization using unlabeled data.\" Thirty-First AAAI Conference on Artificial Intelligence. 2017.\n[4] Hendrycks, D., Mazeika, M., Kadavath, S., & Song, D. (2019). Using self-supervised learning can improve model robustness and uncertainty. In Advances in Neural Information Processing Systems (pp. 15663-15674).\n[5] Golan, Izhak, and Ran El-Yaniv. \"Deep anomaly detection using geometric transformations.\" Advances in Neural Information Processing Systems. 2018.\n[6] Tack, J., Mo, S., Jeong, J., & Shin, J. (2020). Csi: Novelty detection via contrastive learning on distributionally shifted instances. arXiv preprint arXiv:2007.08176.\n[7] Winkens, J., Bunel, R., Roy, A. G., Stanforth, R., Natarajan, V., Ledsam, J. R., ... & Cemgil, T. (2020). Contrastive training for improved out-of-distribution detection. arXiv preprint arXiv:2007.05566.\n[8] Liu, Hao, and Pieter Abbeel. \"Hybrid discriminative-generative training via contrastive learning.\" arXiv preprint arXiv:2007.09070 (2020).", "extra_scores": {}, "extra_text": {}}, {"review_id": "DVjgjYOxwRv", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**Update after author response:** I have read the other reviewer's comments. My take is that at a high level the contribution of this paper is above the bar of ICLR, but the experiments aren't controlled enough so I vote for a weak reject.\n\nHendrycks et al propose encouraging high entropy predictions on the outlier exposure set, instead of classifying them into a reject class. Going further, Hendrycks et al claim \"but we find that even with OE, classifiers with the reject option... are not as competitive\". As I understand, Hendrycks et al are basically saying the (simpler) method in this paper does not work as well - but Hendrycks et al don't provide experimental evidence for this claim, it's merely stated. The original paper might in fact discourage practitioners from trying this approach, and instead using the high entropy approach. In fact, this was a question in my mind when I read Hendrycks et al last year.\n\nInstead, this paper seems to show stronger results, with a more intuitive and simpler method (just classify the outlier exposure set into a separate class) that Hendrycks et al suggest doesn't work as well. Conceptually, the approach in Hendrycks et al also seems more brittle and there are distinctions between these two methods (e.g. see Vernekar et al 2019, “Analysis of Confident-Classifiers for Out-of-distribution Detection”).\n\nSo what's the potential practical impact? If this paper didn't exist, I suspect practitioners would use the method in Hendrycks et al, and not try the reject class method, because of that paper's claims. But with this paper, practitioners might use this method or try both, which seems like a good impact.\n\nSo barring problems with the experimental setup, I'd give the paper a 7 / accept, and so I'd encourage the authors to continue on with this work.\n\nTo me the decision hinges on the quality of the comparisons. I am inclined to agree with R1 on the quality of comparisons. Taking a closer look at their paper, they have no detailed discussion about the hyperparameters and experimental setup, which is key when the main contribution is a fine-grained comparison with Hendrycks et al. R1 raises a question about fine-tuning vs trained from scratch, and it does look like this paper trains from scratch whereas outlier exposure fine-tunes. The outlier exposure set is also different. While it is a smaller set in this paper, Hendrycks et al say \"experiments in this paper often used around 1% of the images in the 80 Million Tiny Images dataset since we only briefly fine-tuned the models.\".\n\nOverall, I agree that the best thing would probably be for them to do a more careful  and controlled comparison, include all these details, and submit to the next conference. In my review I did mention that their comparisons were unclear, but they didn't take the chance to update their paper and misleadingly responded that \"The OE method is closest to ours, so we are able to match their training regimen well\", but as R1 points out there seem to be salient differences.\n\n#########################################################################\n\nSummary:\n\nThis paper tackles the problem of out of distribution detection. Concretely, they have an in-distribution set of inputs D_in and the goal is to reject inputs from an unknown set D_out as out of distribution, while accepting inputs from D_in as in-distribution. Like in the outlier exposure paper, they assume a known set of proxy out of domain distribution inputs \\tilde{D}_out. The approach is to classify inputs in D_in into one of K classes, while classifying inputs from \\tilde{D}_out into a “K+1”-th class. On a few vision and NLP datasets, they show better performance than outlier exposure and other methods.\n\n#########################################################################\n\nReasons for score:\n\nThe main technical difference compared to outlier exposure is that they classify inputs from \\tilde{D}_out into a K+1-th class, whereas outlier exposure enforces that the prediction over the K classes have high entropy if the inputs are from \\tilde{D}_out. 1. One main concern is that they have other (hidden) differences from Hendrycks et al, for example I looked at their code and they use Mixup and a different \\tilde{D}_out, so it is unclear if the gain is actually coming from the K+1-th class, or e.g. more modern data augmentation practices. They also don’t test on the most challenging image datasets from Hendrycks et al, in particular D_in = CIFAR-100, D_out = CIFAR-10 (they have distinct sets of classes). 2. This method was also proposed by Vernekar et al, “Analysis of Confident-Classifiers for Out-of-distribution Detection”.\n\nI generally believe that this is the right thing to do, and seems simpler and more sound than enforcing high entropy, and Vernekar et al only have toy experiments. However, since the contribution is a small change to OE, to make this complete I believe they should have more complete experiments. In other words, I’m holding them to a higher bar experimentally, than if say their idea was novel or they had conceptual insights into the problem, because without more complete experiments the contribution to the community is limited. Note that unlike most works on OOD detection, they use more data, \\tilde{D}_out, similar to outlier exposure. This is completely fine, but that's why I think simply having SOTA results is not quite enough to push this over the bar since there's only about 1 paper on this precise setup.\n\nOn the plus side, this work should at least convince practitioners to try both methods, K+1-th class and enforcing high entropy.\n\n#########################################################################\n\nPros:\n\n- Simple idea, and does better than competing methods on most baselines.\n\n- Combination of vision and NLP datasets.\n\n- Well written, clear and simple.\n\n#########################################################################\n\nCons:\n\n- I looked at this paper’s code, and Mixup is an additional difference compared to Hendrycks et al’s outlier exposure. There could be other differences I did not spot (e.g. training procedure? Optimization method). It’s great that the overall method does better, but I’d like to see at experiments on some datasets investigating what happens if you use the same procedure as OE except K+1-th class instead of entropy.\n\n- Results on CIFAR-10 -> CIFAR-100, and CIFAR-100 -> CIFAR-10 would be good. Since the main contribution is experimental, it would be particularly compelling if a couple more datasets were added. E.g. the original OE paper is substantially more comprehensive. E.g. one combo could be Places365 -> ImageNet.\n\n- No conceptual reason for why the K+1-th method does better (I am still happy to vote to accept without this, but this would make the paper more compelling). The earlier work by Vernekar et all doesn’t quite explain things for high dimensional data like images.\n\n\n#########################################################################\n\nQuestions and things to improve:\n\nIf the comparisons to Hendrycks can be re-run with matching training procedure, and they show results on a few more cases (e.g. CIFAR-10 -> CIFAR-100, and CIFAR-100 -> CIFAR-10), I would seriously consider leaning towards an accept.\n\n#########################################################################\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a method for out-of-distribution (OOD) detection by introducing a K+1 abstention class for outliers, in addition to the in-distribution classes. While the method has shown promising performance compared to the Outlier Exposure (OE), the novelty is limited given the idea is almost identical to an AAAI'20 paper (Mohseni et al. 2020). In addition, several reviewers have raised concerns regarding the lack of fairness in the experimental setting. Authors are encouraged to address them in a future submission. 

The AC believes an interesting and valuable contribution to the community would be showing conceptual and theoretical reasoning for the pros and cons of using K+1 class vs. entropy regularization. Currently, the tradeoff between these two types of training objectives is not well understood. 

Overall, three knowledgeable reviewers in this area have indicated rejections. The AC discounted R2's rating due to the less familiarity in this area and lack of participation in the post-rebuttal discussion among reviewers. 

Lastly, the AC would like to greatly thank R1, R3, and R4 for the active engagement and participation in the paper discussion period. It was very helpful for the decision-making process. 





Decision: Reject