Novelty Detection Via Blurring
Authors: Sungik Choi
Sae-Young Chung
Venue:  (2020)
Keywords: novelty
anomaly
uncertainty

Abstract:  Conventional out-of-distribution (OOD) detection schemes based on variational autoencoder or Random Network Distillation (RND) are known to assign lower uncertainty to the OOD data than the target distribution. In this work, we discover that such conventional novelty detection schemes are also vulnerable to the blurred images. Based on the observation, we construct a novel RND-based OOD detector, SVD-RND, that utilizes blurred images during training. Our detector is simple, efficient in test time, and outperforms baseline OOD detectors in various domains. Further results show that SVD-RND learns a better target distribution representation than the baselines. Finally, SVD-RND combined with geometric transform achieves near-perfect detection accuracy in CelebA domain.

Published as a conference paper at ICLR 2020
NOVELTY DETECTION VIA BLURRING
Sungik Choi & Sae- Young Chung
School of Electrical Engineering
Korea Advanced Institute of Science and Technology Daejeon, Republic of Korea
{s {si.choi, schung) (aauunggkkaiee akaist.ac. .r.kr
ABSTRACT
Conventional cuttof-diisributtinn (OOD) detection schemes based on variational autoencoder or Random Network Distillation (RND) have been observed to assign lower uncertainty to the OOD than the target distribution. In this work, we discover that such conventional novelty detection schemes are also vulnerable to the blurred images. Based on the observation, construct novel RND- OOD detector, SVD-RND, that utilizes blurred images during training. Our detector simple, efficient test time, and outperforms baseline OOD detectors in various domains. Further results show that SVD-RND learns better target distribution representation than the baseline RND algorithm. Finally, SVD-RND combined with geometric transform achieves near-perfect detection accuracy on the CelebA dataset.
INTRODUCTION
Out-of distribution (OOD) or novelty detection aims to distinguish samples in unseen distribution from the training distribution. A majority of novelty detection methods focus on noise filtering or representation learning. For example, we train an autoencoder to learn a mapping from the data to the bottleneck layer and use the bottleneck representation reconstruction error detect the OOD (Sakruada et al. 2014 Pidhorskyi et al.) 2018). Recently, deep generative models (Kingma et al. 2014] Dinh et 2017 Goodfellow al. 2014; Kingma al. 2018 Schlegl et al. (201) are widely used for novelty detection due to their ability to model high dimensional data. However, OOD detection performance deep generative models has been called into question since they have been observed to assign higher likelihood to the OOD data than the training data (Nalisnick et al. 2019
Choi et al. 2018).
On the other hand, adversarial examples are widely employed to fool the classifier, and training classifiers against adversarial attacks has shown effectiveness in detecting unknown adversarial attacks (Tramer et al. 22018). In this work, we propose blurred data adversarial examples. When we test novelty detection schemes on the blurred data generated by Singular Value Decomposition (SVD), we found that the novelty detection schemes assign higher confidence the blurred data than the original data.
Motivated by this observation, employ blurring to prevent the OOD detector from overfitting to low resolution. We propose a new OOD detection model, SVD-RND, which is trained using the idea of Random Network Distillation (RND) (Burda al. 2019) to diseriminate the training data from their blurred versions. SVD-RND is evaluated in some challenging scenarios where vanilla generative models show nearly 50% detection accuracy, such as CIFAR-IO vs. SVHN and ImageNet vs. CIFAR-10 10 (Nalisnick et al.) 2019). Compared to conventional baselines, SVD-RND shows significant performance gain from 50% to over 90% in these domains. Moreover, SVD-RND shows improvements over baselines on domains where conventional OOD detection schemes show moderate results, such as CIFAR-10 vs. LSUN.
2 PROBLEM FORMULATION AND RELATED WORK
The goal of OOD detection is to determine whether the data is sampled from the target distribution D. Therefore, based the training data Drrain D, we train scalar function that expresses the

---

Published as a conference paper at ICLR 2020
confidence, or uncertainty of the data. The performance of the OOD detector is tested on the Drest D against the OOD dataset DOOD. We denote an in in-distribution data and OOD pair as In Out in this paper, e.g., CIFAR-I0 SVHN.
In this section, we mention only closely related work to our research. For a broader survey on deep OOD detection, recommend the paper from Chalapathy al. (2019).
Majority of OOD detection methods rely on a reconstruction error and representa- tion learning. (Ruff al., 2018) trained a deep neural network to map data into minimum volume hypersphere. Generative probabilistic novelty detection (GPND) (Pidhorskyi et al. 2018) employed the distance the latent data manifold the confidence measure and trained the adversarial au- toencoder (AAE) to model the manifold. Deep generative models are widely employed for latent space modeling in OOD detection (Zenati et al.) 2018 Sabokrou et al. 2018). However, recent paper by Nalismick et al. (2019) discovered that popular deep generative models, such variational autoencoder (VAE) (Kingma et al.) (0044) or GLOW (Kingma et al.) 2018), fail detect simple OOD, While adversarially trained generative models, such as generative adversarial networks (GAN) (Goodfellow et al.) 2014) or AAE, are not discussed in Nalisnick et al. (2019), our experiments with GPND show that such models can also struggle to detect such simple OODs.
OOD Detection:
OOD Detection with Additional Data: Some methods try to solve OOD detection by appending additional data labels for training. Hendryykk et al. (2019) trained the detector with additional outlier data independent of the test OOD data. Ruff et al. (2019) employed semi-supervised learning for anomaly detection in the scenario where we have ground truth information few training data.
Golan et al. (2018) designed geometrically transformed data and trained the classifier to distinguish geometric transforms, such translation, flipping, and rotation. [Shalev et al. (2018) fine-tuned the image classifier to predict word embedding. However, the intuition behind these methods is to benefit from potential side information, while our self gelf-generated blurred image focuses on compensating for the deep model's vulnerability to OOD data with a lower effective rank.
Some methods combine OOD detection with classifi- cation, resulting in OOD detection utilizing labeled data. Adversarial examples can be viewed as generated OOD data that attacks the confidence of a pretrained classifier. Therefore, they share some similarities. For example, Heendrycks et al. (2017) set the confidence as the maximum value of the probability output, which is vulnerable against the adversarial examples generated by the Fast Sign Gradient Method (FSGM) (Goodfellow et al. 2014). On the other hand, Liang et al. (2018) employed FSGM counterintuitively to shift the OOD data from the target further, therefore improving OOD detection. Lee et al. (2018) employed Mahalanobis distance measure uncertainty in the hidden features of the network, which also proved efficient in adversarial defense.
Adversarial Examples and Labeled Data:
Bayesian Uncertainty Calibration: Bayesian formulation is widely applied for better calibration of the model uncertainty. Recent works employed Bayesian neural networks (Sun et al.) (017)) or interpreted a neural network's architecture in the Bayesian formulation, such as dropout (Gal et al.) 2016), and Adam optimizer (Khan et al., 2018). Our baseline, RND (Burda et al. 2019), can be viewed the Bayesian uncertainty of the model weight under randomly initialized prior (Osband el al. 2018).
3 METHODOLOGY
In this section, we motivate our use of blurred data as adversarial examples to conventional deep OOD detection methods. Motivatied by the observation, present our proposed algorithm, SVD-RND, and provide intuitions why SVD-RND help OOD detection.
3.1 GENERATING BLURRED DATA
In this work, blurred images function as adversarial examples. We directly employ the SVD on the data matrix of each image in the training data and force the bottom non-zers singular values to zero to construct blurred image. Suppose that data image d e D consists of multiple channels, where the j-th channel has Nj nonzero singular values J₁ 2 022 S ... JjN, > O. Then, the j-th channel can be represented as the weighted sum of orthonormal vectors.
2

---

Published as a conference paper at ICLR 2020
Number of Sampits
1000
Numbor of Samples
OHAR
sco
Auarage
4c0
200
4
100 3-10 4x21 Ex10
380
Loss
Loss
Epachs
Figure Test loss of VQ-VAE (left) and RND (middle) on original image and blurred image (K 28) of CIFAR-10 data. RND assigns higher confidence to blurred image and OOD data throughout the training process (right).
(t A,00l
Dpn
r
blurring
Training
1
Dv.
Figure 2: Training of SVD-RND (berain 1)
dj = 3ー>,د ب
We discard the bottom K non-zero singular values of each channel to construct the blurred image. We test conventional novelty detection methods on blurred images. We first train the VQ-VAE (Oord al. 2017) in the CIFAR-I0 (Krizhevsky al. 2009) dataset. Figure [ shows the loss of VQ-VAE on the test data and blurred test data (K 28). We follow the settings of the original paper. VQ-VAL IQ-VAE assigns higher likelihood the blurred data than the original data.
We note that this phenomenon is not constrained to the generative models. We trained the RND on the CIFAR- 10 dataset and plot the L2 loss the test data and blurred test data in Figure We refer to Appendix B for detailed explanation and employed architecture for the RND in the experiment. Furthermore, we plot the average loss on the blurred test data and original test data during the training procedure. Throughout the training phase, the model assigns lower uncertainty the blurred data. This trend similar to the CIFAR- 10: SVHN case observed by Nalisnick et al. (2019), where the generative model assigns more confidence to the OOD data throughout the training process.
While we employ SVD for our main blurring technique, conventional techniques in image processing can be applied for blurring, such as Discrete Cosine Transform (DCT) or Gaussian Blurring. However, DCT is quadratic in the size of the hyperparameter search space, therefore much harder to optimize than SVD. We further compare the performance between SVD and other blurring techniques in Section
3.2 OOD DETECTION VIA SVD-RND
We now present our proposed algorithm, SVD-RND. SVD-RND trains the predictor network f to discriminate between the original and blurred datasets. We first generate blurred datasets D, from Derain by zeroing the bottom K; non-zero singular values of each data channel (i 1,... braam where durain is the number of generated blurred datasets used for training). We then construct breaiu target networks, i.c., 9o: ...... Ihrrann The target networks are independently randomly initialized and their parameters unchanged during training. Predictor network is trained to minimize the la
3

---

Published as a conference paper at ICLR 2020
Table 1: Experiment In Out domains
Target
OOD
CIFAR-10
SVHN
LSUN
Tiny ImageNet
Tiny ImageeteNet
SVHI
CIFAR-10
CIFAR-100
LSUN
SVHN
CIFAR-I0
CIFAR-100
CelebA
SVHN
CIFAR-10
CIFAR-100
loss against the corresponding target network on each dataset.
arg min Ege Drvain
If(x) -0 Elerin DeDD. If(x) (x))
SVD-RND optimizes the predictor network f as shown in When a new test sample x is given, SVD-RND outputs [ff(z) - (z)2) as the uncertainty of the sample. Figure shows the training process SVD-RND. While the original RND paper employs a single target network train the predictor network, SVD-RND employs multiple target networks to discriminate the original data from the blurred images.
While SVD-RND directly regularizes only on the blurred images, OODs can be generated in alterna- tive directions. For completeness, we investigate the performance of conventional models in OODs generated in orthogonal direction to blurring. We refer to Appendix D for the detailed experiment.
4 EXPERIMENTAL RESULTS
4.1 EXPERIMENT SETTING
WVD-RND is examined in the cases in Table 1 CIFAR-10 SVHN, CelebA (Liu et al. 2015)
SVHN (Netzer et al. 2011), and
(Deng et al. 2009) (SVHN, CIFAR- 10, CIEAR 100)
the cases studied by Nalisnick et al. (2019). We also studied CIFAR-10 (LSUN Yu et al. 2015).
Tiny IingemageNet), LSUN; (SVHN, CIFAR-IO, CIFAR- 100) and CelebA: (CIFAR-10 10, CIFAR- 100)
pairs. We implement the baselines and SVD-RND in the PyTorch framework For unified treatment, we resized all images in all datasets to 32 x 32. We refer to Appendix [ the detailed setting.
For SVD-RND, we optimize the number of discarded singular values over different datasets. We choose the detector with the best performance across the validation data. We refer to Appendix[[foo the parameter setting. We also examine the case where each image is blurred by DCT and Gaussian blurring. For DCT, we apply the DCT to the image, discard low magnitude signals, and generate the blurred image by inverse DCT. DCT-RND, we optimize the number of discarded components in the frequency domain. For Gaussian blurring, optimize the shape of the Gaussian kernel. We denote this method as GB-RND.
We compare the performance of SVD-RND, DCT-RND, and GB-RND to the following baselines.
Generative Probabilistic Novelty Detector: GPND (Pidhorskyi et al. 2018) the conventional snocrative-moel--aasee novelty detection method that models uncertainty deviation from the latent representation, which modeled by the adversarial autoencoder. We trained GPND with further parameter optimization.
Golan et al. 2018) trained classifier to discriminate in-distribution data against geometrically transformed data to achieve better OOD detection performance. The authors used four types of geometric transforms: flip, rotation, vertical translation, and horizontal translation. We test each transformation by setting them as OOD proxies in the RND framework. Moreover, also investigate the effect pixel inversion, contrast reduction, and shearing. We refer to Cubuk et al. (2019) for detailed explanation the augmentation strategies.
Geometric Transforms:
RND: We test the original RND (Burda et al. 2019) baseline.
Our code is hased http://////tttttoooocoo///aaa/aa

---

Published as a conference paper at ICLR 2020
Table 2: OOD detection results (TNR 95% TPR) on CIFAR-IO, TinylmageNet, LSUN, and CelebA datasets. See Table D for OODs used in each case.
INR(95% TinyImageNet
Method
CIFAR-10
L.SUN
CelebA
AVD-RND (proposed)
0.969/0.956009555
0.99100.22600991
0.99590.62110.61
0.99910.997/0889
DCT RND (proposed)
1.899/0.797/0.44 748
0.929/0. 104/0 169
0.971/0.11 7/0.
1.989/0.991.0..0
GB-RND (proposed)
4474//.803//..33
0,962/0,200 264/0.321
0.98640 10090.176M 176/0. 266
399400455/00526
RND
0.008/0.76200.00
0001/0.001/0.000
0.012/0.03400.0 075
0.067/0.231 017700.311/0222
GPND
0,050/0.667/0.o
0.077/0.08500.
0.084/0.2300 200.0.233002222
Flip
0.057/0.09 18
0.1 0.160/0.21200
0.06000055/0000
0.055/0.72800. 700072800.750
Rotate
0.235/0,246/0.300
0.711/0.6690.666 688
0,341/0.276/0.3 334
0.95U/0.937/0.94
Vertical Translation
0.105/0.649/0.66
0150X0.0120..012
0.11770.044X0.0
0.9300 0.9300.8887.0.8 887/0.897
Horizental Translation
0.0700.675/0.65 630
109/0. 005/0.011
0.1 40V0.04340 ID1
0.894/0 874/0 889
Vertical Shear
0.077/0,74/00 684
0.094/0. 008000058/.0000 094
0.143/0.079/0.1 33
0,940/0 883/0 897
Horizontal Shear
0,227/0. 72000.67222
0.072/0.072/0.0 27800002/0008
0.1 0.148/0.08440.. 132
1.897/0.88500.0 888
Contrast
0,468/0 002
0.670/0. 143/0. 142
0.616/ 146
0.70 200.295500...
Invert
0.473/0.61440..6 6.2
0.455/0.057/0AM
O. 0.508/0 508/0.14220.10 172
0.766/0.740/0.0
Typicality Test
0.00890.7440.691
0.004/0.003/0.008
0.004/0.02400005
0.064/0.245500274
CIARLO-TEST SVHN-TEST
Number of Samples
TNR 0.95
0.50
2000
[0.85
0.80
1000
0.70
5WIN LSUN
500
0.65
Tinytragahe:
20
23
22
25 26 27 26
10404
Iu-U1
2001
Discarded Nonzero Singular Values
Loss
Figure 3: Left: Performance SVD-RND (proposed) for different K₁ in CIFAR-10 : (SVHN, LSUN, TinylmageNet) domains. Each filled region is the 95% confidence interval of the detector. SVD-RND shows a small confidence interval in the best performing parameters. Right: Histogram of SVD-RND's test loss for CIFAR-10 and SVHN datasets.
Typicality Test: Nalisnick et al. (2019) set the OOD metric of the generative model as the distance between the mean log likelihood the model on the training data and the log likelihood of the model on the test data. We experiment typicality test on the RND framework by employing the test loss of RND instead of log likelihood in the generative models.
Five metrics binary hypothesis testing used to evaluate the OOD detectors: under the Receiver Operating Characteristic curve (AUROC), area of the region under the Precision- Recall curve (AUPR), detection accuracy, and TNR (True negative rate) 95% TPR (True positive rate). All criteria are bounded between 0 and 1, and the results close to imply better OOD detection.
4.2 OOD DETECTION RESULTS
We summarize our results on the TNR at 95% TPR in Table For example, TNR of 96.9% is achieved by SVD-RND for CIFAR-10 SVHN pair. We refer to Appendix A the full results. In all In Out domains except the CelebA (CIFAR-10, CIFAR- domain, SVD-RND outperforms all other baselines every metric. Furthermore, all the proposed techniques outperform GPND and RND all In Out domains. We further visualize the CIFAR-10 10 data before and after blurring in Appendix E experimented with 4 seeds. In the best performing parameter for each OOD data, SVD-RND shows stable performance. See Appendix for results under small K1.
We plot the performance of SVD-RND over different Ki in Figure 3 In Figure 3 we
Furthermore, we plot the output of SVD-RND on target CIFAR-10 10 data and OOD SVHN data when Ki = 28 in Figure 3 Compared to the results in Figure [ BVD-RND better discriminates SVHN data from the in-distribution data.
5

---

Published as a conference paper at ICLR 2020
1.0
TNR TPR 0.95
68
10.6
|6.6
TIMG, 540
SUHIL
TING,ANC
10000 30000
45080
54000
Size of the training data
Figure 4: Left: Novelty detection performance (TNR 95% TPR) of SVD-RND and RND reduced CIFAR-10 10 training data. SVD-RND robust to reduced training data while RND's ' detection performance decreases. Middle: Top-9 anomalous CIFAR-I0 10 test samples detected by SVD-RND. Right: Top-9 anomalous CIFAR-10 test samples detected by RND.
Classification performance of fine-tuned classifier over the activation map trained by SVD-RND, RND, and randomly initialized weights. SVD-RND consistently outperforms RND.
Table 3:
Target: CIFAR-10
Activation map
SVD-RND (K=28)
RND
Random
15th (linear)
55.62 (1.10)
42.09 (0.66)
36.55 (0.56)
15th (7-layer)
86.29 (0.09)
83.78 (0.29)
86,56 (0.36)
27th (linear)
52.69 (0.24)
38,21 (2.00)
24.46 (0.42)
27th (7-layer)
70.31 (0.24)
57.18 (0.49)
66.40 (0.31)
GPND and RND fail discriminate OOD from the targets in CIFAR-10 SVHN, LSUN (SVHN, CIFAR-10, CIFAR-100) 100). TinylmageNet: : (SVHN, CIFAR-10, CIFAR 100), and CelebA : SVHN domains. Moreover, GPND performs the SVD of the Jacobian matrix in test time, which makes GPND slower than SVD-RND. Furthermore, we visualize the uncertainty prediction of RND and SVD-RND in Figure which shows the top-9 examples on CIFAR- 10 test data, where SVD-RND and RND assign the highest uncertainty. We observe that SVD-RND tends to assign higher uncertainty to blurry hardly recognizable images compared RND.
On the other hand. OOD detection schemes based on geometric transformations (Golan et al. 2018) show generally improved results against GPND and RND on detecting OOD data compared RND and GPND. Especially in CclebA: (SVHN, CIFAR- 10, CIFAR-100) domains. rotation- based methods and translation-based methods show excellent performance. However, in the CIFAR- 10 target domain, OOD detection schemes based on geometric transformations show degraded performance against RND or GPND on LSUN and TinyImageNet OOD data.
Furthermore, typicality test shows mixed results compared to the baseline algorithms.
Finally, we also investigate the case where limited training data available. We examined the performance of SVD-RND and RND in CIFAR-10 (LSUN, TinylmageNet) domains. Figure 4 shows the TNR at 95% TPR metric of each method when the number of training examples is reduced. For each OOD data, denote the result on SVD-RND as OOD_SVD and denote the result on RND as OOD RND.
FURTHER ANALYSIS
examine whether SVD-RND learns better representation compared to the baseline. Furthermore, we propose a novel heuristic for training SVD-RND in Section 3.2,, where validation OOD data is available. Finally, we show that we can further improve the performance of SVD-RND by incorporating geometric transformations in Section 5.3
In this section, we examine some other aspects of SVD-RND. In Section 5.1

---

Published as a conference paper at ICLR 2020
Table 4: Performance of uniform SVD-RND and optimized SVD-RND
Target: CIFAR-1O, OOD: SVHNILSUN/Tiyylmaseeee Target: TinIImagNNrr (TIMG), OOD: AVHN/CIFAR-IOCIFAL
Dataset/herain
AUROC
(NR(95%% TPR)
Detection accuracy
AUPR
AUPR
CIFAR-10/ (uniform)
0.96770.961/09996
0.944/0.827M8 827
0.962/0.90400
0.989/0.94992.88
CIFAR-104 (uniform)
5964/0.987/0.990
9991100954/00995
0,958/0.5578 95710.961
0.848/0 989/0,989
0 90, 985
CIFAR-IQ'1 (optimized)
0.981/0.985/0.00
0.969/0.956MM
0.98000.95500.00
0.903/0.987/0.990 983
0.993/0975500
TIMG/3 (uniformn
0.993/0.831/008844
0.999/0.748 74510,701
0 1989/0.855/0.832
0999100,44/00.
0.995/0 878/0.864
TIMG/4 (uniform)
0.98440.939/0.922.
0.954/0. 880/0.840 842
9976/0.927/09000
0.982/0.91 894
0.989/0 938/0 928
TIMG/2 (optimized)
0.983/0.969/09960
0.991/0.92600911
0 0,98090.96300.95
0.97800.9650.951
0.98900.55800.55
5.1 REPRESENTATION LEARNING IN SVD-RND
While SVD-RND outperforms RND every In Out domains in Section 4 we provide further evidence that SVD-RND learns superior target distribution representation compared to RND. For the evidence, fine-tune a classifier over the fixed activation map of SVD-RND and RND. We set the activation map as the output of the first 15 or 27 layers of RND and SVD-RND predictor network trained in CIFAR-10 10 datasets. For the fine-tuning, we either appended three residual blocks and linear output layer with softmax activation (denoted as 7-layer in Table 3) or a linear layer (denoted as linear in Table Then, we fine-tune the appended network for the CIFAR-I0 classification task. The SGD optimizer with learning rate 0.1 is used for fine-tuning, and the learning rate is annealed from 0.1 to 0.01 and 0.001 after 30 and 60 epochs over 100 epochs of training, respectively. We average the result across three fixed random seeds.
We show our results in Table 3 SVD-RND consistently outperforms RND on the fine-tuning task. Therefore, the result supports that SVD-RND learns better target distribution-speeifee knowledge.
5.2 SVD-RND WITHOUT OOD VALIDATION DATA
In our main experiments in Section 4 we used the OOD validation data for optimizing each K;, However, in realistic scenarios, OOD data are generally unknown to the detector. We propose an effective rank (Roy et al. 2007) based design of SVD-RND that does not use the OOD validation dataset and compare its performance against the results in Section g Log effective rank of the single image matrix D defined as the entropy of the normalized singular values (NI,...,ON) of the image matrix.
01 10
ON 1=
LERD =
In (3). H is the entropy function. Then, the effective rank is defined as the two to the power of the log effective rank. We set the effective rank of image data as the averaged effective rank of each channel.
Based on (3). we propose selecting each K; such that average of log effective rank on each blurred dataset is equally spaced. Specifically, suppose the log effective rank of the data averaged in training dataset Dirain is LER Then, we set the target log effective rank LER1, LER ... LER as follows.
i- LER LER Derstn
LER, 0.5 0.5
(4)
brrain
Then, we select K; such that the average of the log effective rank in the blurred dataset with K; discarded singular values is closest to LER; We test our criterion in CIFAR-10 and TinylmageNet data with different berain. We train SVD-RND for 25 epochs for btrain = 3, and 20 epochs for burain 4. We show the performance of SVD-RND based on (4] in Table 4 which is denoted as SVD-RND (uniform). We also show results of SVD-RND optimized with the validation OOD data from Table 2 and denote them SVD-RND (optimized) in Table 4 Uniform SVD-RND already outperforms the second- best methods in Table Furthermore, as brrai increases, uniform SVD-RND approaches the performance of the optimized SVD-RND.
7

---

Published as a conference paper at ICLR 2020
Table 5: OOD detection performance of SVD-ROT-RND and SVD-VER-RND
Target: CelchA, OOD: THHNCIFAR-IOCCIAAAT
Method
AUROC
TNRR(95 TPR)
Detection accuracy
SVD-ROT-RND
0.997/0.999/0...
(.999/0.993309999
0.9960.991100999
0998/0.99/009999
0.99330.98660.
SVD WID.VERBEE RND
0.999/0.99338
0999/0.982/00.0 982
0.998/0,9620) 982/0,981
0.999/0.99 000/09999//0--00 997
0.998/0 0E0.000994/996666
SVD-RND
0,999/0 963/0 964
0.999/0.88 897
0998/0,92800. 928
0.999/0.90 98//988//00 1/0 981
0.998/0. 94 /O. 343
ROT-RND
1977/0.979/0.996
0.9500..33770980
9926000952/09956
0.950/0.989/0. 991
0.98 11000/94400966
VER-RND
0.964/0.96110.964
0.93000.88700.89
0.952N..22300.226
0.93400.979009900
0.97.500944100944
5.3 FURTHER IMPROVEMENT OF SVD-RND
While SVD-RND achieves reasonable OOD detection performance, combining SVD-RND with other baseline algorithms may further enhance the performance. For example, shown in Table training against rotated data benefits OOD detection in CelebA dataset. Therefore, we combine SVD-RND and geometric transform-bass based methods to further improve SVD-RND. We treat both blurred data and geometrically transformed data as OOD and train the predictor network to discriminate the original data from the OOD, We combine rotation and vertical translation with SVD-RND and denote them as SVD-ROT-RND and SVD- VER-RND, respectively.
We compare the performance of SVD-ROT-RND and VVD-VERRRND against rotation and vertical translation in CelebA (SVHN, CIFAR-10, CIFAR-100) domains. We refer readers to the results in Table 5 We observe that SVD-ROT-RND and SVD-VER-RNE outperform their counterparts and SVD-RND. Especially, SVD-ROT-RND and SVD-VER-RND show significant performance gains in CelebA : (CIFAR-10, CIFAR-100) domains.
6 CONCLUSION
In this work, blurred images are introduced as adversarial examples deep OOD detection. SVD- RND is employed for adversarial defense against blurred images. SVD-RND achieves significant performance gain in all In Out domains. Even without the validation OOD data, we can design SVD-RND to outperform conventional OOD detection models.
7 ACKNOWLEDGEMENT
This work was supported by Samsung Electronics and the ICT R&D program of MSIP/ITTP [2016- 0-00563, Research on Adaptive Machine Learning Technology Development for Intelligent Au- tonomous Digital Companion]
REFERENCES
Yuri Burda, Harrison Edwards, Amos Storkey, and Oleg Klimov. Exploration by random network distillation. International Conference on Learning Representations, 2019.
Raghavendra Chalapathy and Sanjay Chawla. Deep learning for anomaly detection: a survey. arXiv preprint arXiv: 003407, 2019.
Hyunsun Choi, Eric Jang, and Alexander A. Alemi. WAIC, but why? generative ensembles for robust anomaly detection. arXiv preprint 18100138, 2018.
Ekin D. Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoe Le. Autoaugment: learning augmentation policies from data. IEEE Conference Computer Vision and Pattern Recognition, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hierarchical image database. IEEE Conference on Computer Vision and Pattern Recognition, 2009.
Laurent Dinh, Jascha Sohk-Dickstein, and Samy Bengio. Density estimation using Real NVP. Interna- fional Conference on Learning Representations, 2017.
8

---

Published as a conference paper at ICLR 2020
Yarin Gal and Zoubin Ghahramani. Dropout as bayesian approximation: representing model uncer- tainty in deep learning. International Conference on Machine Learning, 2016.
lan Golan and Ran EI- Yaniv. Deep anomaly detection using geometric transformations. Neural Information Processing Systems, 2018.
Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Neural Information Processing Systems, 2014.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, arXiv preprint arXi::1412.6572, 2014.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribttion examples in neural networks. International Conference on Learning Representations, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. International Conference on Learning Representations, 2019.
Mohammad Emtiyaz Khan, Didrik Nielsen, Voot Tangkaratt, Wu Lin, Yarin Gal, and Akash Srivastava. Fast and scalable bayesian deep learning by weight perturbation in adam. International Conference on Machine Learning. 2018.
Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. International Conference on Learning Representations, 2014.
Diederik P. Kingma and Prafulla Dhariwal. Glow: generative flow with invertible 1 convolutions. Neural Information Processing Systems, 2018.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical Report, University of Toronto, 2009.
Kimin Lec, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Neural Information Processing Systems, 2018.
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distributt image detection in neural networks. International Conference on Learning Representations, 2018.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. International Conference on Computer Vision, 2015.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan.
Do deep generative models know what they don't 't know? International Conference on Learning Representations, 2019.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Detecting out-of-distributin inputs to deep generative models using test for typicality. arXiv prerprint arXiv: /906. 02994, 2019.
Yuval. Netzer, Tao. Wang, Adam. Coates, Alessandro. Bissacco, Bo. Wu, and Andrew. Ng. Reading digits in natural images with unsupervised feature learning. NeurallPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
Aaron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learning. Neural Information Processing Systems, 2017.
Ian Osband, John Aslanides, and Albin Cassirer. Randomized prior functions for deep reinforcement learning. arXiv preprint arXiv:1806 03x333180..033335, 2018
Stanislav Pidhorskyi, Ranya Almohsen, Donald A Adjeroh, and Gianfranco Doretto. Generative probabilistic novelty detection with adversarial autoencoders. Neural Information Processing Systems, 2018
Oliver Roy and Martin Vetterli. The effective rank: a measure of effective dimensionality. European Signal Processing Conference, 2007.

---

Published as a conference paper at ICLR 2020
Lukas Ruff, Robert Vandermeulen, Nico Göermitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexan- der Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. International Conference Machine Learning, 2018.
Lukas Ruff, Robert Vandermeulen, Nico Göermitz, Lucas Deecke, Alexander Binder, Emmanuel Müller, Klaus-Robert Müller, and Marius Kloft. Deep semi-supervised anomaly detection. arXiv preprint arXiv:1906.02660 2019.
Mohammad Sabokrou, Mohammad Khalooei, Mahmood Fathy, and Ehsan Adeli. Adversarially learned one-class classifier for novelty detection. IEEE Conference on Computer Vision and Puttern Recognition, 2018.
Mayu Sakurada and Takehisa Yairi. Anomaly detection using autoencoders with nonlinear dimension- ality reduction. Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, 2014.
Thomas Schlegl, Philipp Seeböck, Sebastian M. Waidstein, Ursula Schmidt-Erfurte and George Langs. Unsupervised anomaly detection with generative adversarial networks guide marker discovery. Proceedings of the International Conference on Information Processing in Medical Imaging, 2017.
Gabi Shalev, Yossi Adi, and Joseph Keshet. Out-of-distribution detection using multiple semantic label representations. Neural Information Processing Systems, 2018.
Shengyang Sun, Changyou Chen, and Lawrence Carin. Learning structured weight uncertainty in bayesian neural networks. International Conference on Artificial Intelligence and Statistics, 2017.
Florian Tramer, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: attacks and defenses. International Conference on Learning Representations, 2018.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. LSUN: construction of a large-scale image dataset using deep learning with humans the loop. arXiv preprint arXiv: 15556003366 2015.
Houssam Zenati, Chuan Sheng Foo, Bruno Lecouat, Gaurav Manek, and Vijay Ramaseshan Chan- drasekhar. Efficient GAN-based anomaly detection. arXiv preprint arXiv: I 1802.00222..... 2018.
10

---

Published as a conference paper at ICLR 2020
A
FULL OOD DETECTION RESULTS
Table 6: OOD detection results on CIFAR-10, TinyImageNet, LSUN, and CelebA datasets
Target: CIFAR 10, OOD: SVINIISUUN/TnyymaaeeNee
Method
AUROC
TNR(95% TPR)
Detection accuracy
AUPR in
AUPR out
SVD-RND (proposed)
0.981/0.965/00990 985/0.9882
1.969/0.95660..0
9980M0.955H0.953
019903/0.98770.00
0.993MI.97500997
DCT-RND (proposed)
0,944/0.948/0 948009944//995
0,899/0,79700 797/0.748
0.9400 90008888008800
0. 0.76900.945/0.000
0.98180.94600999
GB-RND (proposed)
AG22400952/0.923
0.474/0.80300 803/0,739
07722/0.87700.88
0.31 908
D. 0.80000,95 952/0.99200
RND
0.21 1/0.1/9 /D, 923
0.008/0 762/0.736
0.500V0.8 873/08857
0. 0.180/0, 180/0.937/0 .08
GPND
0,230V0, 94 895
0.050/0.7622 767/0.665
0.51 33/0.87600.825
0. 19000.93600
0.605/0, 2.605/0,94/00.00
Flip
0.490/0.616/0.660
0.057/0.091/0.00
15334/0.601/0.5999
0281/0666300.66
(77079.56--00555
Rotale
0.853/0.77 824
0,235/0 246/0,006
0.826/0.71 14/0 755
0.735A1 806/0.840
0.911/0.719MB
Vertical Translation
0.276/0.9244 896
0. 105/0.64900 6448
0,540V0.849M 849/0.823
O. 19330,923/1.0 923/..81
0.65440.9 91 19/0.899
Horizontal Translation
0.279/0.9 890
0.070/0 675/0.630
0,523/0 844/0.811
113/0,91501 8874
0.637/0.905/0.88 889
Vertical Shear
0.331/0.937/0.900
0.077/0.7440 744/0.684
0.520/0.8690 869/0.839
O. 0.205/0,9366 896
0.663/0. 927
Horizontal Shear
0.503/0.99000 902
0. 0,227/0. 720/0.672
0.59000. 860/0. 8344
0.261 00..922500.0 886
/0.82/0 908
Contrast
0.659/0.85500 800.0889000.. 829
0.468/0.00 0000000000000000 002
0.725/0.815M 815/0.88
0.331/0.88500 842
D. 0.859/0 7460. 721
Invert
01111/091110.9900
0.712/0.849/0.8
0,303/0 919300919/0
0.84840 8348408871/0.83 1/1,870
Typicality Test
0.411/0.92900905
0.008/0.33/00.0 734/0.691
0.501/0.861/0.841
0.258/0.11700880
0.63280.3330.916
Target: TinyImageNet, OOD: SWHNCIFAR-IOCIIFRR
Method
AUROC
TNR195% TPR)
Detection accuracy
AUPR in
AUPR out
SVD-RND (proposed)
969300996999961
0.991/0.9260000
0.980N0.963H0.953
0.978/0.965/0.10
0.98990.558009955
DCT-RND (proposed)
0.9500.317/0.403
0.929/0. 109/0.169
0.958/0.5411 541/..69
0.758%0.40440 438
0.98440.4411 44100.518
GB RND (proposed)
0.9900.44770.551
0.982X0.2644 264/0.321
0.991/0.6 6/6.6663
0,969/0.492N0 492/1.5222
9998/1660600.66.
RND
0.079/0.18/000 184/0.133
0.001 0D 1/0.003
0.500V0. 50000.500
0. 163/0.336 30.0036633337
0.513/0.3166 1/600.324
GPND
0.256/0.367/0.33
0.0770008500.111
2.51440.5200..55
0.190/0.4220 02000.424044433
0.630N1.4440. 434/0.474
Plip
$.5000.55000.566
0. 16000.2 2/0.2231
0.636/0.6200 6000.6225
0,29440.5 1164X0.519/.5533 19/0.533
D. D.7650 0.765/9.6691055
Rotate
0.845/0. 015500.866/..88 821
0/71 669/0.688 688
868/0 822/0.82 832
0,54 727/0.742
0.933/0. 823/0 848
Vertical Translation
0.131/0,185/0.2
0.050/ 01200.012
0.521/0.5024 50210.501
117100,66/00370
0.567/0. 0.567X9.323/0332
Horizontal Translation
221000.184/0.20
O. 10900 005/0.011
0.548/0. 50000 052
0.18220. 362/0,375
0.627 112709.31770.334
Vertical Shear
0.33000.796/04447
0.094/0 058/0.094
0.5230.514400 5140.555
0,204/0.44310 04440.443/04446
D.675/1.43700.487
Horizontal Shear
0066/0.408/0444
0.07240.02/00099
0.512/0. 51 9/0.527
O. 197/0.4447/0.44 468
D. 0.648/0.458 1148/0.453/..44 490
Contrast
0.739/0.337/0.88
0.670/1 143/0.142
0.824/0.56 10100566110.000 160.55
0.388/0.41200
190990.465/0.44
Invert
0.56 248/0.275
0. 0.455/0.0572 006.0.06577006111
0.705/0.51 2/000514
0.28510.38 1/0. 390
D. 828/0. 0.88/0.3650..8 365/0,38
Typicality Test
0.285/0.262/0.28
0004/0.003/0.000
1.50000.50000.500
0221490.4000:400
0.5770.338/0.
Target: LSUN, OOD: SVIN/CIFAR 10CIIAR
Method
AUROC
TNR(95% TPR)
Detection accuracy
AUPR in
AUPR out
SVD RND (proposed)
0.986/0.75/00881
0.995/0.611006141
0.983/0.787/0777
724407774000730
0.990N0.828/0.c 834
DCT-RND (proposed)
1.984/0.508/0.77 575
0.971 I 11700.213
0.981/0 535/0.583
0.920/0.5
100000.51//0-. 513/0.552 .52
D. 0.995/0.534/0.22
GB-RND (proposed) )
0.99300.388000
0.986/0.
1086/0.176/0.220 176/0.266
(1890.566/0..0 609
0.96770.534/0.577
09997/0.8800.656
RND
0.1900044300.466
0.012/0.034/0.00
0.500N0.5000 500/0.514
0.177AU.476/U 4899
0.557/1.427/0.49
GPND
0.250/.449/0.444
0.051/0.0522 0000000000000222 102
1.513/0.509/0...
1192/0.48600..64
1.611/9 MLT//.466/00509
Flip
0.438/0.49/00550
0.060/0 0550000055//008
0.524K0.508/0.6 508/0.522
0,249/0.51 1/0.525
0.685/0
0.685/0-468/05500 468/0,500
Rotale
1.0990.752/0.779
0. D.344100.7888 278/0.334
0 736/0. 764
70070..0000.77
D.943/0.74300 743/0.778
Vertical Translation
0.258/0.41500.44
O. 1 044700066
0.548/0.506 506/0.515
0. (1900.458/0440
0.6500043500.44
Horizontal Translation
0,287/0.402/00 459
O. 140/0 043/0. 101
0.55700. 50400. 526
0.196/0.45 1/0 1/0.445
1670/0.424N 495
Vertical Shear
0.39770.459/0.05
1.1433000799 07900.19/
0.55000.516/0 516005516
0223/0.473/0.0
0.718/0.483M
Horizontal Shear
0,398/0 458/0.505
O. 1.14880.0KK 14A.0.04//.. 133
0.551/0.5188 111.0..5180.5446 840
(1223K1.42/0.46
0.722XU.487/V 5510
Contrast
0.7311004496005555
0.616/) 143
0.787/0.539/0.8
1387700500700519
0.900N0. 51 51700.545
Invert
0.66440.5040.544
0.508/0.1422 142/0.172
0.730N0.546/0.
5463
0.322N0,512/0.55
U. 0.86-99.535M0.566
Typicality Test
0.3320.415/004660
0.00440.0240.055
0.500V0.5000 50000.505
0.228/0.476/0.45
0.595/0.4100.445
Target: CelobA. OOD: SVHN, CIFAR-10, CIFAR-100
Method
AUROC
TNR195% TPR)
Detection accuracy
AUPR
AUPR
SVD-RND (proposed)
0.999/0 963/0.964
0,999/0.8970 897/0.9777
0.998/0.928/0.228
0.999/0.99 1/1100.000 98
0.998/0.941/09443
DCT--NI (peoposed)
0.997/0 854/0.879
1.98990.491/0.88
99990.771/00799
0096/U993600.9
0.99700.736/0.75
RND (proposed)
1.997/0.22/0..4 845
0.9948.45500.55
0.994/0. 74800.744006666
0,996/0.91880
0998/0669400.75
RND
2.41000743/00 741
0.067/0.23 1/0.253
0.51 12/ 68 1/0,678
0.479/0.88./11..
0.459/0.500 500/0.523
GPND
0.407/0.7423 74000.42///22 737
0.084/0.20 0084/0.2300..22 23000.200
0.536/0 68000 680
0.461/0.
T11.0//89/088777 870
0.478/0. 502/0.520
Flip
2.402/0.98/0.900
0055/0.728/0.750
0,507/0.8 047.00084400.8555
2-44000.944//) 0.66
(4477088300..66
Rotate
0.974/0.979/0.99 982
0.950/0.90 337/0.945
0.964/0.95 2/0 956
..5000999900
D. 0.98 N0.964/00 969
Vertical Translation
0.964/0 9/000/9666/099 964
0.930/0 887/0 897
(995200923/0..
0.934/0.979/0. 999009999009980
0.975/0 9414444110000 9-16
Horizontal Translation
0.955/0 949
0.89480.8748 874/U.899
9.9900992000.00 926
0.926A1 9688
D. D.967AU. 922.9222222222 932
Vertical Shear
0,974/0 (0w.996600.000 964
0.940/.8883 883/18997
0.954/0.921/D 10,929
0.962/0.975/..
0.977V.94000.C 940.099000.0000 44779947
Horizontal Shear
0.95 96340.964
8.89770.8550.88 $85/0.888
0.932/0-9200 922
O. 002200982/00 9822
D. 963600 9 936/0.945
Contrast
0.8-4800.7200 778/0.78
0.701/0. 295/0.329
0226/0.70/0/. 707
O. 0.6660887700 898
D. 8888050.8 w...0.550..... 568
Invert
0,86000 500/00900000 903
0.76600.4000.72 740/0,21
0.86440.84 84 847/0.89
0,752X0 92220,99900990 9977
D. 0.91ONL.87 87108861
Typicality Test
0.48400.799/0749
0.064/0.24500 245/0.244
0.51640.691.0..0
0.50000.8780.874
1.491
11

---

Published as a conference paper at ICLR 2020
B RANDOM NETWORK DISTILLATION
We use RND (Burda et al. 2019) as the base model of our OOD detector. RND consists of a trainable predictor network f. and randomly initialized target network g. The predictor network trained to minimize the l2 distance against the target network training data. The target network g remains fixed throughout the training phase.
f arg min Dve [f(x)) g(x)
(5)
Then, for unseen test data æ, RND outputs If(x) - g(x) 2 uncertainty measure. The main intuition of the RND is to reduce the distance between and g only on the in-distribution, hence naturally distinguish between the in in-distribution and the OOD.
We employ RND for our base OOD detector due to its simplicity over generative models. Also, RND has already shown to be effective in novelty detection on MNIST dataset (Burda et al. 2019).
In RND (Burda et al. 2019). the predictor network f has two more layers than the target network g. where I consists of convolution layers and fully connected layer. In experiments, set g as the first 33 layers of ResNet33 without ReLU activation in the end. f is constructed by appending two sequential residual blocks. The output size of each residual block is 1024 and 512. We also discard ReLU activation in the second residual block to match the output layer of g.
C DATA PREPROCESSING, NETWORK SETTINGS, PARAMETER SETTINGS FOR MAIN EXPERIMENT
To make the OOD detection task harder, we reduce each of the training dataset of CelebA, Tiny- ImageNet, and LSUN to 50000 examples and test dataset of CelebA to 26032 examples. For TinylmageNet data, we discard half of the images in each class, resulting in 250 training examples for each of the 200 classes. Reduction in LSUN dataset results in 5000 examples for each of the 10 classes. Also, the first 1000 images the test OOD data are used for validation. For SVD-RND and all other RND-based detectors, we the same structure for f and g defined in Appendix The number of parameter updates is fixed across the experiments. The Adam optimizer, with a learning rate of 10 is used for RND-based OOD detection methods. The learning rate annealed from 10-4 to 10-5 in half of the training process. For our main experiment, we average the result across two fixed random seeds.
In SVD-RND, DCT-RND, and GB-RND, we used birain = 1 for CIFAR-10 and CelebA dataset, and btrain
for TinylmageNet and LSUN dataset. For SVD-RND, We optimize across K₁ [18, 20, 22, 24, 25, 26, 27, 28) in the CIFAR-10 and CelebA datasets. For TinyImageNet and LSUN datasets, we optimize over K₃ E {8. 10, 12, 14) and K₂ (22, 24, 26, 28). In DCT-RND, we define K, as the number of unpruned signals in the frequency domain. For CIFAR-10 and CelebA datasets, we optimize K₁ across {4, 8, 12, 14, 16, 20, 24, 28). For TinyImageNet and LSUN datasets, we optimize optimize over Ki E {00, 24, 28,32) 32/ and K₂ E {40, 44, 48, 52). For Gaussian blurring, over the shape (x; yi) of the Gaussian kernel. We optimized the parameter over I; E {1,3, 3. 5) 31 (1.3. 5) for each blurre data. To fix the number of updates, we train SVD-RND, DCT-RND, and GB-RND for 50 epochs in the CIFAR-10 and CelebA datasets, and for 34 epochs for the rest.
For GPND, the settings for the original paper followed. Furthermore, optimize the recon- struction loss Xı and adversarial loss X2 for discriminator D. across λ e (8, 9, 10, 11, 12) and A2 21,2,33. We choose the parameters with the best validation performance at 100 epochs,
For RND, we trained over 100 epochs.
For geometric transforms, we optimize the magnitude of the shift of shear, horizontal translation and vertical translation methods. We optimize the magnitude of translation across (4, 8, 12, 16) and choose the parameter with the best validation performance. Detector is trained for | epochs, where [T] is the number of transformations. The number of transformations 2 for horizonta translation, vertical translation, and shear, and 3 for rotation and contrast.
in flipping and invert,
12

---

Published as a conference paper at ICLR 2020
Table Test uncertainty RND on OOD CIFAR-I0 data generated by adding orthogonal noise to the CIFAR-10 data
Data
Original
Blurred
a
a
a
15
at 20
Average Uncertainty(x1I) ( (0-00) 5.631
5.190
5.648
5.795
6.051
6.437
Finally, for typicality test, we estimated the average test loss the RND for 50000 training examples. For each test sample, use the distance between the test loss of the sample and the estimated average loss as the OOD metric.
D GENERATING OOD ADDING ORTHOGONAL VECTORS
We present the performance of RND on OODs generated by adding vectors orthogonal to the data. To genetrate such OODs, we sample Gaussian vector z and compute the component of the random vector ao that orthogonal to the data x.
2T x: x
Sorth.
x
(6)
We scaled the 12 norm of the orthogonal vector or each data to be a% of the la norm of the signal. We plot the average uncertainty of RND on the original data, blurred data, and the perturbed data in Table From the 20 independent runs on the perturbed data, we report the case with smallest test uncertainty in Table 7 We varied a from 5 to 20. While blurring reduces the average test uncertainty of RND, adding orthogonal vector to the data incerases the test uncertainty of RND.
(b)
(c)
(d)
cc)
(f)
gg)
Figure 5: Sample visualization on the best performing parameters of SVD-RND, DCT-RND, and GB-RND. (a): original CIFAR-10 sample. (b), (c): sample after SVD-RND. (d), (e): sample after
DCT-RND. (f), (g): sample after GB-RND.
13

---

Published as a conference paper at ICLR 2020
1.0
0.8
TNR TPR 0.95
10.4
0.2
SVHN
LSUN
TinylmageNet
0.0
5
10
15
20
25
Discarded Nonzero Singular Values
Figure 6: Extended version of Figure (left). When we discard small nonzero eigenvalues for the blurred images, SVD-RND fails to discriminate between original and blurred images.
E VISUALIZATION OF DIFFERENT BLURRING TECHNIQUES
For visualization, we plot the CIFAR-10 images and their blurred versions processed by SVD-RND, DCT-RND, and GB-RND in Figure 5 Images in the same column processed with the same technique. Furthermore, columns (b), (d), (c) are constructed by the best performing parameters of SVD-RND, DCT-RND,, and GB-RND SVHN OOD data. Likewise, (c), (e), (f) are constructed by the best performing parameters of SVD-RND, DCT-RND, and GB-RND on TinylmageNet OOD) data.
F EXTENDED VERSION OF FIGURE 3
We further extend Figure 3 to analyze the behavior of SVD-RND when small number of singular values are discarded. Therefore, we experiment SVD-RND where Ki 5, 10, 15 and plot the result in Figure 6
14


Reviews:
[{"review_id": "rJemcX4AYH", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: They tackle the problem of out-of-data distribution by leveraging RND applied to data augmentations. They train a model f(x) to match the outputs of g_i(aug_i(x)), where g_i is a random network and aug_i is a particular type of augmentation. An example with high error in this task is treated as an out-of-distribution example. This work focuses on exploring blurring through SVD, where the smallest K singular values are set to 0, and K varies between different aug_i calls. They find that their method of consistently can achieve strong detection rates across multiple target-dataset pairs.\n\nComments:\n* The experimental results in this work are impressive, which introduces many more questions.\n* The model used for f and g is not mentioned in the text.\n* Figure 4 (left) suggests that the SVD-RND performs about the same between 10K and 50K examples. The level of robustness is surprising, but doesn’t seem to square with intuition that more data ought to help. How little data can be used? In other words, extend the graph to the left. \n* The geometric transforms baseline is not fair, since SVD-RND uses multiple SVD transforms (b_train > 1) whereas the geometric transforms only have one. Please run a model with all the geometric transforms. This result is important for understanding whether the gains come from the particular transform (SVD) or the number of transforms used.\n* Following the spirit of the previous comment, what other data augmentations can be used in place of SVD? Typical image classification pipelines use a large variety of augmentations. I would suggest taking some augmentations from AutoAugment [1] and running RND on top of them.\n* An experiment that is missing is RND trained on blurred images. Is the blurring itself the important component, or is having multiple different heads important?\n* In general, I am confused about how a single head RND does not converge to 0 loss by learning the weights of g. This seems to be a simple optimization problem. The original RND paper avoided this problem by also using the network to learn a policy, but this does not exist in this approach.\n* Furthermore, a comparison with Ren et al. [2] and Nalisnick et al. [3] would be useful. [2] also uses data augmentation to create a background model that is compared against the real model. One can probably simulate this approach by comparing the error rates of each head of RND.\n\nIn general, this work seems promising, but lacks proper ablations that elucidate what components of the method are important. I am happy to increase my score if the experiments suggests are added to the work.\n\n[1] AutoAugment: Learning Augmentation Policies from Data. Ekin D. Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, Quoc V. Le\n[2] Likelihood Ratios for Out-of-Distribution Detection. Jie Ren, Peter J. Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark A. DePristo, Joshua V. Dillon, Balaji Lakshminarayanan\n[3] Detecting Out-of-Distribution Inputs to Deep Generative Models Using Typicality. Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Balaji Lakshminarayanan", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "rJeaGSQoKr", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "UPDATE: \nI acknowledge that I‘ve read the author responses as well as the other reviews. \nI appreciate the clarifications and improvements made to the paper. I‘ve updated my score to 6 Weak Accept. \n\n####################\n\nThis paper presents the idea to use blurred images as regularizing examples to improve out-of-distribution (OOD) detection performance based on Random Network Distillation (RND). The paper proposes to generate sets of such blurred images via Singular Value Decomposition (SVD) on the training images by pruning the lowest K non-zero singular values. The proposed method, SVD-RND, then extends the standard RND objective, which is to train a predictor network f to minimize the L2 loss to the output of some randomly initialized network over the (original) training data, with an additional regularization term that minimizes the L2 loss to the outputs of further multiple randomly initialized networks over the sets of blurred images. In OOD experiments on CIFAR-10, SVHN, TinyImageNet, LSUN, and CelebA, the proposed SVD-RND consistently outperforms baselines and recent competitors which are demonstrated to be vulnerable to blurred images.\n\nI find it hard to make a definitive evaluation for this work at this point and would like to take the authors' responses into account for my final recommendation. The main idea of the paper to generate adversarial examples for training via blurring is rather simple and thus the novelty of this work is somewhat minor. I think the quality of the paper also suffers from many statements in the text that draw too general and too bold conclusions at this point in my mind. The presentation overall is rather unpolished (see comments below). However, I find the empirical results itself quite strong and convincing and think they would make a relevant and significant contribution to the community. I do have questions left open though that need clarification:\n\n(i) I don’t see why different techniques for blurring (SVD, DCT, GB) should lead to such different results as the approach remains conceptually similar. Do you have a reason/intuition why SVD gives the best results? Might SVD just be the easiest to tune method?\n\n(ii) What do you think is the key reason that SVD-RND also appears to generalize too non-blurry OOD samples? Could you elaborate more on the two reasons you give in the paper? (1. RND performance on samples orthogonal to the data; 2. Discrimination between data and its low-rank projection)\n\n(iii) The generation and tuning of multiple sets of blurred images (how many samples per set?) may get quite extensive for large datasets. Could you be specific on the computational cost?\n\n(iv) Might the deep generative models (e.g. GPND) fail to detect blurred images due to insufficient model capacity of the decoder which results in blurry reconstructions? Have you varied the network capacity or latent space dimensionality of such models?\n\n(v) What is the idea behind choosing the log effective rank in such an equidistant manner as proposed?\n\n\n####################\n*Additional Feedback*\n\n*Positive Highlights*\n1. SVD-RND shows strong OOD detection performance in OOD experiments on a variety of image dataset combinations (CIFAR-10, SVHN, TinyImageNet, LSUN, and CelebA).\n2. The related work includes major works from all the related lines of research (Deep anomaly detection; OOD detection using side information; Adversarial examples/training)\n3. Useful hyperparameter selection criterion based on effective rank if no OOD validation data is available.\n\n*Ideas for Improvement* \n4. I think the tone of the paper would greatly benefit from not drawing too general conclusions and too bold implications. Keep statements precise and evidence-based. Declare hypotheses as such.\n5. I would appreciate a plot showing samples before and after blurring in the appendix to see the most effective degree of blurring. Maybe also compare the different blurring baselines here to see differences.\n6. Report std. devs. with your performance results to infer statistical significance.\n7. Compare to the specific geometric transforms method as proposed in the paper [3] and not only using those transformations within your RND approach.\n8. Add missing deep anomaly detection related work [6, 2, 5, 1].\n9. Expand the sensitivity analysis in Figure 3 (left) over a greater range of K. Especially, I would like to also see K = 0 (unblurred, original images) as a sanity check which may only improve over RND due to ensembling over multiple randomly initialized networks.\n10. Consider the one-vs-rest anomaly detection evaluation benchmarks from Ruff et al. [4] or Golan and El-Yaniv [3] to further infer the generalization performance of the proposed method.\n11. I think the paper spends too much time on introducing previous work. Section 2 Related Work and Section 3 Background might be combined into one section.\n\n*Minor comments*\n12. In the abstract: “... VAE or RND are known to assign lower uncertainty to the OOD data than the target distribution.” is a bit strong. Rather “have been observed” etc. This is a working hypothesis in the community, but there is recent work (https://openreview.net/forum?id=Skg7VAEKDS) indicating (at least for VAEs) those are effects of poor model design.\n13. In the abstract: “... efficient in test time ...” » “... efficient at test time ...”\n14. In the abstract: “... in CelebA domain.” » “... on the CelebA dataset.” or just “... on CelebA.”\n15. Section 1: “However, such models show underwhelming performance on detecting OOD, such as detecting SVHN from CIFAR-10. Specifically, generative models assign a higher likelihood to the OOD data than the training data.”. I think those are way too general conclusions at the moment. Rather something like “OOD detection performance of deep generative models has been called into question” and “have been observed to assign ...”.\n16. Section 1: “Such results clearly support the degeneracy of deep OOD detection schemes”. Again, I find this way too bold of a statement at this point in time.\n17. Section 2: “... a recently proposed paper ...” » “... a recent paper ...”\n18. Section 2: “... outlier data independent of OOD data.”. What would outlier data not being out-of- distribution be?\n19. Section 2: “Golan et al. (2018) design geometrically transformed data and regularized the classifier ...”. Not regularized. They trained a classifier on labels identified with these transformations.\n20. Section 2: “..., resulting in OOD detection in each labeled data” » “..., resulting in OOD detection on labeled data”\n21. A subsection title directly following a section title is bad style. A major section should be introduced with a few sentences on what this section is about.\n22. Figure 2, right plot: These loss curves are rather strange... Increasing, then sharply decreasing again. Is there a drop in learning rate at epoch 80?\n23. Many axis labels are too small and hard to read.\n24. In Section 3.3.: “.. in Section 7.2.” » “.. in Section 4.2.”?\n25. The definition of the log effective rank in Eq.~2 is weird. It's the entropy over the singular value distribution, i.e.~$H\\left(\\sigma_1 / \\sum_j \\sigma_j, \\ldots, \\sigma_N / \\sum_j \\sigma_j \\right)$. Also, the parameters/notation involved are not introduced.\n26. Make clear you apply SVD on single images. The paper alters formulations between data matrix and images...\n27. Several instances where citet is used instead of citep.\n28. In Table 1: Separate the target column from the three OOD columns more clearly. (e.g. vertical separator, center OOD, target in bold, etc.)\n29. In Section 5.1: “area of the region under the ... curve” » “area under the ... curve”.\n30. Figure 3: Better explain the plots. Are the three curves the respective target classes? What is the OOD set?\n31. Figure 4: Maybe use subfigures with individual titles/captions.\n32. Section 6: “For evidence, we fine-tune the classifier ...” » “For evidence, we fine-tune a classifier ...”\n33. Plots and Figures are somewhat scattered and not referenced chronologically.\n34. Introduce the effective rank at the point where it is used (Section 6.2). Somewhat unclear why to introduce this in Section 3 already.\n35. Visually speaking, I find the RND examples in Figure 4 actually more anomalous than the top-anomalous SVD-RND samples (flashy colors, weird angles, borders, high contrast, ...)\n\n\n####################\n*References*\n[1] R. Chalapathy and S. Chawla. Deep learning for anomaly detection: A survey. arXiv preprint arXiv:1901.03407, 2019.\n[2] H. Choi, E. Jang, and A. A. Alemi. Waic, but why? generative ensembles for robust anomaly detection. arXiv preprint arXiv:1810.01392, 2018.\n[3] I. Golan and R. El-Yaniv. Deep anomaly detection using geometric transformations. In NIPS, 2018.\n[4] L. Ruff, R. A. Vandermeulen, N. Görnitz, L. Deecke, S. A. Siddiqui, A. Binder, E. Müller, and M. Kloft. Deep one-class classification. In International Conference on Machine Learning, pages 4393–4402, 2018.\n[5] L. Ruff, R. A. Vandermeulen, N. Görnitz, A. Binder, E. Müller, K.-R. Müller, and M. Kloft. Deep semi-supervised anomaly detection. arXiv preprint arXiv:1906.02694, 2019.\n[6] T. Schlegl, P. Seeböck, S. M. Waldstein, U. Schmidt-Erfurth, and G. Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In Proceedings International Conference on Information Processing in Medical Imaging, pages 146–157. Springer, 2017.\n", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}, {"review_id": "Sylw6lsCYS", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposed a method called SVD-RND to solve the out-of-distribution (OOD) detection problem. The proposed SVD-RND is under the Random Network Distillation (RND) framework, but make use of blurred images as adversarial samples. SVD-RND outperforms state-of-the-art methods in several OOD tasks.\n\nIn general, this paper is well-structured. It is not difficult to understand the problem this paper focuses on and the proposed method. I believe the proposed method is interesting, and I have not seen a similar approach before. It is a simple method, but it achieves excellent performance in multiple OOD tasks.\n\nAlthough the authors try to explain why SVD-RND performs well, I am not entirely convinced and believe that more investigations might be necessary. Are the images from different datasets of similar average effective rank? I am also wondering how the proposed model will perform if we use other images as the adversarial examples. For example, we can use random low-rank images, which can be generated via Equation (3) by first randomly sampling $\\sigma_{jt}$, $u_{jt}$, and $v_{jt}$, and then let a certain number of singular values be zero.\n\nIn summary, I am inclined to accept this paper because it proposes a simple method that gives high performance. However, I would suggest the authors include more ablation studies to help the readers understand why the proposed method works.\n\nMinor:\nI suggest the authors explicitly state that we do not update the network $g$ in Equation (1) and (4), such that the readers are less likely to be confused. The authors might also need to briefly explain why RND works.\n\nIs a specific strategy applied to initialize the network $g$ randomly? Are weights in $g$ initialized using Gaussian distribution, uniform distribution, or via other initialization strategies?\n\nIn Table 1, all the datasets in columns 2, 3, and 4 are OOD samples, correct? \n\nTo ensure that the TPR  is $95\\%$ as described in Table 2, we need to tune the threshold for $|| f(x) - g_0(x) ||_2^2$, right? If a sample $x$ gives a $|| f(x) - g_0(x) ||_2^2$ that is higher than the threshold, it is considered as an OOD sample, correct?\n", "extra_scores": {"experience_assessment": "I do not know much about this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes a new method for out-of-distribution detection by combining random network distillation (RND) and blurring (via SVD). The proposed idea is very simple but achieves strong empirical performance, outperforming baseline methods in several OOD detection benchmarks. There were many detailed questions raised by the reviewers but they got mostly resolved, and all reviewers recommend acceptance, and this AC agrees that it is an interesting and effective method worth presenting at ICLR. 
Decision: Accept (Poster)