Bayesian Variational Autoencoders for Unsupervised Out-of-Distribution Detection
Authors: Erik Daxberger
José Miguel Hernández-Lobato
Venue:  (2020)
Keywords: variational autoencoders
out-of-distribution detection
stochastic gradient MCMC

Abstract: Despite their successes, deep neural networks still make unreliable predictions when faced with test data drawn from a distribution different to that of the training data, constituting a major problem for AI safety. While this motivated a recent surge in interest in developing methods to detect such out-of-distribution (OoD) inputs, a robust solution is still lacking. We propose a new probabilistic, unsupervised approach to this problem based on a Bayesian variational autoencoder model, which estimates a full posterior distribution over the decoder parameters using stochastic gradient Markov chain Monte Carlo, instead of fitting a point estimate. We describe how information-theoretic measures based on this posterior can then be used to detect OoD data both in input space as well as in the model’s latent space. The effectiveness of our approach is empirically demonstrated.

Under review as a conference paper at ICLR 2020
BAYESIAN VARIATIONAL AUTOENCODERS FOR UNSUPERVISED DUT-S--DISTTBBUTIIN DETECTION
Anonymous authors
Paper under double-blind review
ABSTRACT
Despite their successes, deep neural networks still make unreliable predictions when faced with test data drawn from a distribution different that of the train- ing data, constituting major problem for Al safety. While this motivated recent surge in interest in developing methods to detect such out-of-distribution (OoD) inputs, robust solution is still lacking. We propose new prohabilistic, unsu- pervised approach to this problem based on a Bayesian variational autoencoder model, which estimates full posterior distribution over the decoder parameters using stochastic gradient Markov chain Monte Carlo, instead of fitting a point es- timate. We describe how information thherrrtcc measures based on this posterior can then be used to detect OoD data both in input space as well as in the model's 's latent space. The effectiveness of our approach is empirically demonstrated.
INTRODUCTION
Outlier detection in input space. While deep neural networks (DNNs) have successfully tackled complex woal-world problems in various domains including vision, speech and language (Schmid- huber 2015 LeCun et al.] [0155] Goodfellow et al. (016)), they still face significant limitations that applications (Amodei al.) (016). One well-known shortcoming of DNNs is that when faced with test data points coming from different distribution than the data the network was exposed to during training. the DNN will not only output wrong predictions, but will do so with high confidence. The lack of robustness of DNNs such -ittrf-distribbutin (OoD) inputs (or outliers/anomalies) was recently addressed by the development of various methods to detect OoD inputs. Most existing OoD detection approaches are task-specific in that they consider a certain prediction task (typically classification) and use the corresponding output labels for the supervised training of deep discriminative model to produce the desired target output as well as some confidence score (Hendrycks & Gimpel| 2016; Hendrycks et al. 2018 Liang et al. 2017). Alternatively, task-agnostic OoD detection methods solely use the imput data for the unsupervised training of deep generative model (DGM). One simple and seemingly sensible approach to detect a potential OoD input x" to train flow-based DGM) by (approximately) maximizing the likelihood p p(D]0) of the model parameters 0 under the training data ID2, and to then estimate the probability p(x" (0) that x" was generated by the model 0 (Bishop| 1994): If p(x* (0) is large, then x" must be in in-distribution. and OoD otherwise. However, recent works have shown that this likelihood-
make them unfit for safety-critic
sedihhod-basee DGM (e.g. a VAE, auto-regressive DGM, or
approach does not work in general, as deep generative models sometimes assign higher probability OoD data than to in-distribution data Nallsnick et al. 2018 Choi & Jang 2018). Motivated by this finding, recent works have tried to develop more effective scores by correcting the likelihood estimate (Choi & Jang, 2018 Ren al.) 2019 Nalisnick et al. 2019). However, while these approaches improve upon the likelihood score, argue that OoD detection scores which are fundamentally based on the likelihood values robust, as the likelihood estimates produced by commonly used DGMs are not reliable for OoD data, similar how deep discriminative models produce unreliable output predictions on OoD data.
Outlier detection in latent space. In a distinct line of research, recent works have tackled the challenge of efficiently optimizing a complex black-box function f X + R, fx) = y defined over digh-dimensional, richly structured input domains X (c.g. graphs, images or text). Given examples = ((x,, H:) these methods jointly train a VAE on inputs x and a predictive model g : 7 R. (Z)) y mapping from latent codes targets y. to then perform the optimization

---

Under review as a conference paper at ICLR 2020
w.r.t. y in the low-dimensional, continuous latent space Z instead of in input space X (Gómez- Bombarelli et al. 2018). While these approaches have achieved statc-of-the-an results in important domains including automatic chemical design and automatic machine learning (Gómez-Bombarell)
et at 2018 Luo et al. 2018: Lu al. 2018), their practical effectiveness is limited by their ability to handle the following trade-off: They need to find inputs that both have high target value y and sufficiently novel (i.e., not too close to inputs in the training data D), while at the same time ensuring that the optimization w.r.t. y does not progress into regions of the latent space I too far away from the training data, which might yield latent points z that decode to semantically meaningless and/or 2017 Brookes et al. 2019. Mahmood & Hernandez-Looato 2019 Alperstein et al., (019)) We observe that the
syntactically invalid inputs x (Kusner et al., 2017: Griffiths & Hernández
required ability to quantify the semantic/syntactic distance of latent codes z to the training data directly corresponds to the ability to detect outliers in latent space Z.
Our approach. this work, we propose a principled, unsupervised, probabilistic method to si- multaneously tackle the challenge of detecting outliers x" in input space X (without directly relying on likelihood estimates) as well as outliers z" in latent space Z. To this end, we take an information- OoD detection, and propose to use the (expected) informativeness of in- put x* / latent x as a proxy for whether x* 2 is OoD or not. To quantify this informativeness, we take inspiration from infoommttion-thooretii active learning (MacKay 1992) and leverage probabilis- tic inference techniques to maintain a posterior distribution over the parameters of a deep generative model, in particular of variational autoencoder (VAE) (Kingma & Welling 2013 Rezende al. 2014). This results in a Bayesian VAE (BVAE) model, where instead of litting a point estimate of the decoder parameters via maximum likelihood, we estimate their posterior distribution using sam- ples generated via stochastic gradient Markov chain Monte Carlo (MCMC). The informativeness of an unobserved input x* latent z" is then quantified by measuring the (expected) change in the posterior over model parameters after having observed x* / z". In summary, our contributions are as follows: (a) We propose a Bayesian VAE model which uses state-of-the-un Bayesian inference techniques to estimate posterior distribution over the decoder parameters (Section 3.2)). (b) We
theoretic perspective
describe how this model can be used to detect outliers both in input space (Section (.3) as well as
in the model's latent space (Section 3.4) using copemattion-thhorette metrics. (c) We empirically
demonstrate that our approach outperforms state-of- ofhthe-rrt outlier detection methods (Section
2 BACKGROUND
2.1 VARIATIONAL AUTOENCODERS
Consider latent-variable model p(x, z(0) with marginal likelihood p(x(0) = p(x, z/0)dz, where x are observed variables, z are local latent variables (i.e., individually tied to some x), and are global latent variables (i.e., shared among all x) For clarity, will mostly refer to simply as la- tent variables (i.e., without the prefix local), and to @ as model/decoder parameters. We assume that p(x, z (0) p(x z. ())( i.e., the joint density p(x, z|0) factorizes into prior distribution p(z) on the local latent variables z and a parameterized likelihood p(x 2,, 0) of the observed variables x given z. We furthermore assume the
be continuous, such that computing p(x[0) in generally intractable. Such a model is called a variational autoencoder (VAE) (Kingma & Welling 2013 Rezende et al., 2014) f are the parameters of deep neural network, and the corresponding in- tractable posterior distribution p(z) x O) over the latent variables z is approximated using amortized variational inference via another deep neural network qz) Φ) parameterized by ø (typically called the encoder, inference network recognition network). Given some dataset D [x. of N
input vectors x; E X drawn i.i.d. from some underlying data distribution p" (x), the parameters and & of a VAE are then Iearned by maximizing the evidence lower bound (ELBO) Cg.p. which is lower bound to the marginal log-likelihoou log p(x(0), i...
L (x) = Ee((xxx.) plo zz, 0)] -
Φ) (p(z)) <
((x(())
(I)
for some input x E D. By independence, (D) Exen Lo.s (x). Since maximizing the ELBO approximately maximizes log (D))), this training procedure can be viewed as approximate max-
Note that most literature on VAEs includes the parameters 0 as a subscript, e.g., (x(x, z), assuming tixed point estimate PLLE of 0, i.c., PO (x, z) p(x, z/0 = OMLE) We instead use the notation p(x, z(0) to make explicit that assume é be random variable governed by some distribution (to he detailed in Section 3.
2

---

Under review as a conference paper at ICLR 2020
imum likelihood estimation (MLE). In practice, (x) in Eq. Ih is maximized by mini-batch stochastic gradient- optimization using low-variance, unbiased, stochastic Monte Carlo esti- mators of V La. obtained via the reparametrization trick. Finally, one can approximate the prob- ability p(x x (0, σ) of a data point x under the generative model via importance sampling w.r.t. the variational posterior q(2|x, Φ), i.e.
((x|2,0)p(21) q(z)x, ②)
p(x|ze, O)((z)) K ((zx|x,0) Φ)
K
p(x (0, Φ) = (x
=
2k ~ q(z2xx Φ)
(2)
Note that the likelihood p(x (,, Φ) in Eq. is conditioned on both 0 and p. to make explicit the dependence on the parameters @ of the proposal distribution g(z]x, x, é).
2.2 BAYESIAN LEARNING IN NEURAL NETWORKS VIA STOCHASTIC GRADIENT MCMC
To generate samples 0 p)) of parameters 9 of deep neural network, can state-of- the-art stochastic gradient Markov chain Monte Carlo methods such as stochastic gradient Hamil- tonian Monte Carlo (SGHMC). Hamiltonian Monte Carlo (HMC) (Duane al.. 1987 Betancourt 2017) is a method for generating samples 0 p(0 (D) in a Metropolis- Hastingg framework that efficiently explores the state space. In particular, consider the posterior distribution p(0 x
exp( (0 Dj) with potential energy function (0, D) = log p(D, 0) = log(p( (D)) (())
Σ EEDD log ((x - log p(0) induced by the prior p(0) and marginal log- likeliod log p(x ())
HMC generates samples 0- p(0 by simulating Hamiltonian dynamics, which involves evaluat- ing the gradient (0) of U. However, direct computation of this gradient requires examination of the entire dataset D (due to the summation of the log- likelihodoo over all x D), which might become prohibitively costly for large datasets. To tackle this issue, Chen et al. (2014) recently proposed a scalable HMC variant called stochastic gradient Hamiltonian Monte Carlo (SGHMC), which considers a noisy, unbiased estimate of the gradient computed from a minibatch M of points sampled uniformly at random from ID (i.e., akin to minibatch-basse optimization algorithms such as variants of stochastic gradient descent), i.e.,
VDU(O, = VoU(O, = ExEM Vo loggp(()(0) V l(0)
(3)
3 BAYESIAN VARIATIONAL AUTOENCODERS FOR OoD DETECTION
3.1 MOTIVATION AND INTUITION
We take the following information-theorees perspective on OoD detection. Consider active learn- ing scenario, where we have computed an estimate of our model parameters 0 based on some ob- servations ID, and want to add an unobserved input x" to the training set TD to improve our estimate of 0 as much as possible. To this end, in cioommttion-thoorete active learning (MacKay) 1992), is observed that every potential input x" contains a certain amount of information about the values of the model parameters. In other words, every data point x" helps us to some extent in updating model parameters to find the optimal ones which capture the true underlying data-generating process. Now, we argue that inputs which are uninformative about the model parameters are likely similar to the data points already in the training set ID, i.e., they are likely in-distribution inputs. In contrast, inputs which are very informative about the model parameters are likely different from everything we have seen so far in the training data D, i.e., they are likely OoD inputs. We thus propose to use the informativeness of a datum x* as a proxy for whether x" is OoD or not. To quantify this informativeness, information theoortic active learning approaches leverage probabilis- tie inference techniques to maintain posterior distribution p(0[D)) over model parameters 0 given data D (i.e., instead of fitting a point estimate of via maximum likelihood estimation). Given this posterior p(O[D), the informativeness of an unobserved datum x" is then quantified by measuring the (expected) change in the posterior after having observed x", i.e. the change required to update p(0[ID) to the posterior p(0 U {x*) }). We follow this approach and propose to use Bayesian VAE (B (AE) model, where instead of fitting a point estimate of the parameters via maximum likelihood, estimate their posterior distribution using samples generated via stochastic gradient MCMC.
3

---

Under review as a conference paper at ICLR 2020
3.2 THE BAYESIAN VAE (BVAE)
In contrast to an ordinary VAE, where we fit the generative model parameters 0 via (approximate) MLE, i.e., OMLE arg max, L(ID) 0,d: to obtain the likelihood p(x z. OMLE), we place a prior p(0)
over 0 and estimate its full posterior distribution p(0 D) x p p(D (0), to induce the generator like-
lihood p(x|z, D) = f p(x z, 0) p) ID) d0 = ppp p( 0). This induces the marginal likelihood
D ppxx) (p(x X z, D)] = / p(x|z, 0) ) plz))d02z ()pto))(<(((00)
(4)
which marginalizes over both the local latent variables z and the global latent variables 0. The generative process defined in Eq. (4) first draws latent vector p(z) from its prior and decoder parameterization 0 ~ p(0) [T) from its posterior, and then generates x ~ p(x|2,0) 0) by passing both through the likelihood. Training this model now involves performing Bayesian inference over both z and 0, resulting in the posterior p(z|x, DD) over z and the posterior p(0) D) & p(D[()pp()) over Since both posteriors are intractable for the model we consider, we will now discuss how to approximate inference over z and 8, respectively.
3.2.1 INFERENCE OVER THE LATENT VARIABLES
To estimate the posterior p(z x, D) over z, we follow an ordinary VAE and resort to amortized variational inference via a recognition network q q(z|x, Φ) with variational parameters ø, using the
ELBO Ca & log p(x(0) in Eq. (1). We learn the encoder parameters e via approximate MLE, using a lar-aariance, unbiased Monte Carlo estimator of the stochastic gradient VoCo. (xx, ie.,
FoCo, + ΣL= log [p(x| 0)] V (oDxx( p)))p(z)) Zi ~ g(zxx, o)
(5)
where the posterior samples z ~ q(z x. @) are generated using the reparametrizztioo trick.
3.2.2 INFERENCE OVER THE MODEL PARAMETERS 0
To generate posterior samples 0 p(D of decoder parameters (e.g. as required to approximate the gradient (x) in Eq. (5) we propose to use SGHMC (cf. Section 2}. However, the gra- dient of the energy function VO M) in Eq. 3 used for simulating the Hamiltonian dynamics requires us to evaluate the likeliood log p(x(0). which is intractable in a VAE and thus also in our model. To alleviate this issue, we approximate the log-likelihood appearing in VOU(O, M) by the ELBO Lo. (x) of an ordinary VAE in Eq. (1). Given set é = {6mm IM m== of posterior samples o.. ~ p(((TD), we can more intuitively think of working with finite mixture/ensemble of decoders//enerratiee models p(x/z, ID) Eppop [p(x|z, 0)] MI Enge S(nee)((xzze p(x|z, 0) (cf. Eq. (4)).
3.2.3 INFERENCE OVER THE VARIATIONAL PARAMETERS Ø
Recall that the goal of amortized variational inference to learn how to do posterior inference, by finding the optimal parameters OMLE arg max, L(D)o, (cf. Eq. (T) of inference net- mapping inputs to parameters &o of the variational posterior (z) = {z]xx, σ) over z. However, one fundamental shortcoming of fitting an inference network via MLE is that the model q(z)x, x, ÓMM.E) will not generalize OoD inputs, but instead produce con- fidently wrong posterior inferences for OoD inputs. To alleviate this issue, we refrain from fitting point estimate ÓMLE, and instead consider a Bayesian treatment of the variational parameters (i.e., in addition to the Bayesian treatment of the decoder parameters 0 discussed earlier). While this might seem strange conceptually, it allows us to quantify our epistemic uncertainty in the amortized inference of z, intuitively increasing the flexibility of the recognition network. We thus also place prior p()) over e and infer the posterior p(o(D) x (D))))(()) yielding the amortized posterior
work i X
V (x(
1 EMe g(2|x, 05), Φb ~ p(d (6) g x DD) [ (D) = Bppop) +) ~ 37
We also use SGHMC to generate the posterior samples o; ~ p JD)) again approximating the log- likelihood log p( D) in V (v, M) (cf. Eq. 3) by the BIBO (x,s(x) in Eq. ( Given a set
T = {Ø, 1 1 of posterior samples oy ~ P() we can again more intuitively think of Eq. 16 as defining finite mixture/ensemble of inference networks (2|xx D) M Eseo (2)
4

---

Under review as a conference paper at ICLR 2020
Inference over 0 revisited. When doing inference over both Φ and 8, we need to slightly adapt the SGHMC sampling procedure for the decoder parameters 9 ~ p(0 described in Section 3.2.2 In particular, instead of using the ELBO La. (x) of ordinary VAE in Eq. ① (which is based on the recognition network x(z]x,00 Φ) and thus depends on both 0 and (), we now need to use the ELBO
[x(x) = , x [log p /z, 0)] (x(((())))))ppp(
<
log ID)
(7)
which depends on & only, it is based on the encoder mixture g(z|,, ID) in Eq. (6) and thus integrates
the variational parameters & over their posterior p p(olD). We then obtain an approximation to the
stochastic gradient VaU (0, M) Eq. (3 by using Monte Carlo approximation of the gradient
(x) of the ELBO in Eq. i.e..
(8) The 21 (zz)x, x. IB) are sampled from the encoder mixture in Eq. O6) by first sampling the index of the mixture component uniformly at random, i.e., j ~ 2111, M (due to the mixture weights all being 1/M), and then sampling the latent vector z, from the j-th mixture component, i.e., Z q(z/x, 0,).
VxLo(x) = E (z) Vo log 0) - E Vo logr(((21; 21 ~ ID)
3.3 DETECTING OUTLIERS IN INPUT SPACE
Training a BVAE (see Appendix B for pscudocode) yields the sets 4 = م and θ = f0mm J-M of posterior samples Φj ~ p( ( [Db) and On ~ p([ of encoder and decoder parameters, respec- active learning (MacKay) 1992) (cf. Section [ and aim to detect if a certain test input x* is OoD based on its informativeness about the model parameters 8, as measured by the change in the posterior distribution over 0 after having observed x". In particular, assume that given some data D and prior p(0), we have inferred ((()))(())
tively. Given these samples, we follow ideas from anfformation-theoreee
p(D] p(0) over 9. In a sequential Bayesian setting. the posterior p(0 then serves as the new prior, which, given new observation x", is updated to pix (8)
the posterior p(0 - (()))d r(Dj))
the posterior p ( {x* J p(x" 6)) D)de
pix ())( D)
p(x D) ((0ID), i.c.. by multiplying p(O]ID) by
p(x* the normalized likelihood p(x* (D) The intuition now is as follows: If x" is very different from the
previous observations in then the updated posterior p(O (x*3) will likely be different from p(O[LD), to capture the atypicality of x". In contrast, if x is very similar to the observations in ID, then the posterior p(Ol U {x*)) will also be similar the previous one p(O[D). Thus, detect whether x" is OoD or not, we aim to quantify the change from P(D[I) to p( U fxx })) which is captured by the factor p(x (0)
pDx Since in our case, the posterior D) is represented by the finite set of samples O we find ourselves in a sequential Monte Carlo (or particle filtering) setting, such that
for a given parameter/particle 0 and input x*, the normalized likelihood p(x 10)
D) can be written as
p(x ((x'
p(x" (0)
p(x 10) I p(
p(x*10)
Mwo, with wo Eoco p(x*110
IDC
EptelD 10]]
TI
where We E [0, 1] and Eoco Wi = 1. The scalar wi defined in Eq. 9 can be interpreted as the probability that x" was generated from the particle 0, thus measuring how well x" is explained by the model 0 (and thus how useful 0 is for describing the updated posterior ((O })), relative to the other particles. More formally, the values [wy] weleee correspond to the importance weights of the samples/particles 0 E ④ drawn from the proposal distribution P(0[ID) (i.e., the previous posterior) for an importance sampling-basee
Monte Carlo approximation of an expectation w.r.t. the target distribution D U {x*}) (i.e., the updated posterior after having observed x"), i.e.
Ep(e|Du(x 1) [f)] [p
~ 3/ Eoco Mwef(() =ose wof(()
(10)
for some function f θ - To measure the change distribution from ((([T) to p IDU (x*)))), can then use the weights [welece to compute the effective sample size (ESS)
EBee p())
(X") Eoee w
such that ESSa((")) E M1,
(11)
Eoee p(x*
The ESS(x*) ) is widely used measure for the efficiency of the estimator in Eq. 10 and measures how many i.i.d. samples drawn from the target posterior p(0 (x*))(())) are equivalent to the M sam- ples 0 E θ drawn from the proposal posterior (DD and weighted according wa. It intuitively
5

---

Under review as a conference paper at ICLR 2020
quantifies the degree of agreement between the particles 0 E ô as to how probable the imput x" is, inducing the following decision rule: If (x*) is large, then [wglase is close to the uniform dis- tribution X7 loge (for which (SS(x*) M), meaning that all partieles 0 O explain x' equally well and are in agreement as to how probable x" is. Thus, x" likely is an in-distribution input. Conversely, if ESS(x") is small, then (wo]eee contains few large weights (i.e., corresponding to particles that by chance happen to explain the datum well), with all other weights being very small, where in the extreme case, [we]eee BEe [O,..., O, 1, .................... 0] (for which ESS(x*) = 1). This means that the particles do not agree as to how probable x" is, so that x" likely is an OoD input.
Finally, we discuss how to compute the likelihood p(x[0) of the BVAE given an input x required to compute the weight we in Eq. (9). We consider two approaches based on importance sampling, with different proposal distributions for sampling the latent codes 2i depending on the assumed relationship between the samples ④ of decoder parameters and the samples & of encoder parameters:
1. Firstly, one may treat the samples in θ and T being coupled as (0m: Qm) {(0m: Qm) JMM m where each pair (fm: 2m) effectively defines a separate VAE. This is motivated by the fact that in practice, we for simplicity do indeed take samples of full VAEs, by simultaneously sampling from p(O and p(o) J, as outlined in Algorithm in Appendix B Since such a coupled sample (9mm Pm) defines a VAE, the likelihood can then simply be computed as in a regular VAE, i... p(x (m) = p(x 0m. Φm) as defined in Eq. (2). using the proposal distribution g(z Φm).
2. Secondly, one may decouple the samples in and & and treat them as being independent each other. In particular, for a given decoder sample On. instead of using the corresponding sample on as the encoder, we may view the encoder as the mixture ((z/x, ID) ~ 1 is Ess* q(z (x, 6) in Eq. (6) defined by all samples in t. The likelihood is then estimated as p(x(0) = p(x TD) with
p(xx z, ()p(z) g(z/xx ID)
K
p(x O)p(zk)
p(x D) (
(21/x, ID) (12)
K
k= M Eoco q(zx Xx, Ø))
where the proposal distribution now is the mixture g(z)x, ID) instead of g(z)x, Φ). Since q(z) ( ID) marginalizes over encoder parameters Φ, the likelihood in Eq. (2) only depends on A.
3.4 DETECTING OUTLIERS IN LATENT SPACE
Detecting outliers in latent space involves identifying latent vectors z" which are very different from the latent vectors corresponding to the training inputs D, and which will thus yield unpredictable results when passed through the decoder to produce p(xiz", 9). To discriminate a given latent vector z" is an outlier or not, we follow the same approach as in Section 3.3 and quantify the informativeness of z" on the model parameters @ by measuring the change in the posterior p(OIDD). However, quantifying this change in posterior by e.g. computing the ESS metric in Eq. (11) requires evaluating the likelihood p(x*10) of the input x" corresponding to the latent code z", which is not available to us. We thus alternatively quantify the expected change in the posterior p(([D) by computing the expected ESS, by averaging over the likelihood mixture p(x/z" 1 D) (cf. Section 3.2 thus effectively taking into account all possible inputs x* corresponding to z², i.e.
(Eoco p(x, 12,, ,0) Eoce p(x,, "2" 0)2 x, xxx((xx",))) (13)
(xS) = E Fxpxxle D)) (x))
where the inputs x,, are sampled from the decoder mixture p(x(z" D) by first sampling the index of the mixture component uniformly at random, i.e., m ~ [[I,M] (due to the mixture weights all being 1/M), and then sampling X,, from the m-th mixture component, i.e., Xn ~ p(x|2", Om). In contrast to computing the ESS in Eq. (11) for outlier detection in input space, where we had to estimate the likelihoods via importance sampling using the (mixture of) inference network(s), computing the likelihoods p(x.|zz' 0) in Eq. (13) simply involves passing the given latent code zt through the decoders parameterized by f E e In fact, the encoding part of the model is not required for outlier detection in latent space. If we are only interested in outlier detection in latent space, thus do not face any of the issues arising from the recognition network making wrong inferences for OoD inputs, and as result do not require Bayesian treatment of the encoder parameters Φb

---

Under review as a conference paper at ICLR 2020
4 RELATED WORK
SupervisddDDisriinnatti outlier detection methods Most existing OoD detection approaches are task-speci and designed for the context of a certain prediction task. As described in Section II these approaches train a deep discriminative model in a supervised fashion using the given labels. To detect outliers w.r.t. the target task, many approaches then rely on a confidence score to decide on the reliability of the prediction, which is either produced by modifying the model and/or training procedure, or computed/extraated post-hoe from the model and/or predictions (DeVries & Taylor
2018
An & Cho 2015; Sölch et al.) 2016 Ahmed & Courville 2019 (rricharan & Srivastava Hendryeks & Gimpel 2016 Hendryekk et al., 2018 Liang et al. 2017] Shafaei et al., 2018)
2018
Alternatively, one can use predictive uncertainty estimates for OoD detection (Malinin & Gales)
2018
Gal & Ghahramani 2016 Lakshminarayanan et al.) 2017 Osawa et al. 2019 Ovadia et al.,
2019). One drawback of such task-specific approaches is that discriminatively trained models by
design discard all input features which are not informative about the specific prediction task, such that information which is relevant for OoD detection might be lost.
UnsuperviseddGGeneaan outlier detection methods In contrast, task-agnostic OoD detection methods solely use the input data for the unsupervised training of a deep generative model, which makes them more general, as they do not require the availability of labels for some prediction task. Moreover, these approaches capture the entire input data distribution via the generative model, which might be beneficial for OoD detection (it was shown that despite not exploiting label information, unsupervised approaches often work better in practice (Ren et al., 2019).. Perhaps closest to our approach is the recent work by Choi & Jang (2018), which use an ensemble (Lakshminarayanan) ict al. 2017) of independently trained likelihood bkkeeboodd-based generative models (i.c., with random pa- rameter initializations and random data shuffling) to approximate the Watanabe-Akaik, Information Criterion (Watanabe) 2010) Excep: (log p(x) Varp(e [log p(x* The WAIC provides an asymptotically correct estimate between the training and test set expectations (assuming fixed un- derlying data distribution) and can be viewed as a corrected log-likelihood score which penalizes points with a large variance in log-likelshoods. Their approach has two shortcomings as com- pared to ours: Firstly. while we use stochastic gradient MCMC on a single model to obtain M approximate posterior samples, they train M independent models form an ensemble, which (a) is not a principled way of doing approximate Bayesian inference (although connections can be made (Mandt et al. 2017) under certain conditions), and (b) is M times more computationally expen- sive in practice. Secondly, independent of the quality of the posterior approximation, their score is not expected to work well, since it still relies on the suboptimal log-likelihood estimates (as we will demonstrate in the experiments). Another recent unsupervised approach is the likelihood tio method by Ren et al. (209)). which corrects the likelihood log p(x") (6) for confounding general population level background statistics captured by background model p(x" (6p), resulting in the score log p(x* (0) logpp(x (0n). The background model p(x*|0p, (0,) is in practice trained by perturb- ing the data ID with noise corrupt its semantic structure, i.e., by sampling input dimensions i.i.d. from a Bernoulli distribution with rate E [0.1, and replacing their values by uniform noise, e.g. 24 u(O,... .., 255] for images. Finally, Nalisnick et al. (2019) proposed to use the score loog p(x) 2 ExED log p(x to account for the typicality of the input x".
EXPERIMENTS
We now present some experimental results showing the competitiveness of our approach.
5.1 OUT-OR-DISTRIBUTIOO DETECTION IN INPUT SPACE
BVAE details. We implemented the proposed BVAE model in PyTorch (see Appendix B for pseudocode). using the robust, scale adapted SGHMC variant proposed by (Springenberg et al. 2 We follow Chen et al. (2014); (Springenberg et al. (2016) and use Gaussian priors over and Ø, i.e., p(0) (D, A and p(0) = (0, A t) We also place Gamma hyperpriors over the precision parameters do and Ag. i.e., (\)) = T(ao, Bo) and p(hs) = T(a,, 18), with
We use their implementation of the SGHMC sampler a PyTorch Optimi zer (https:// gi github. com/ automl /pybnn), thus serving as drop-in replacement for optimizer such SGD.
7

---

Under review as a conference paper at ICLR 2020
ag 39 ag = 3. = 1, and resample Xo and X after every training epoch (i.e., after entire pass over ID). We also follow the previous work and use a step size of 10-3 and momentum decay of 0.05 for SGHMC. We discard samples within a burn-in phase of = 1 epoch, and store a sample (of both encoder and decoder parameters) after every D = 1 epoch. We only keep the 10 most recent samples to represent the posterior. In addition to the BVAE described in Section 3.2 which uses the two ELBOs La in Eq. [1) and La in Eq. 7 to train/sample from á and A, respectively (denoted by BVAE). we also report results on the following variants: a BVAE that uses the ordinary VAE ELBO in Eq. for both & and A (BVAE; see Appendix C for pseudocode) and a VAE where only 0 is integrated out and @ estimated via maximum likelihood (BVAEg). We furthermore consider both alternative ways of estimating the log-likelihoods for computing the ESS (cf. Section (3.3), i.e., the case where log-likelihoode are computed using samples & of encoders and & of decoders that are treated as independent (ESS), and the case where the log-likelihoods are computed using coupled samples {(0) 8,) (ESS)).
Experimental setup. We use two benchmarks: (a) FashionMNIST (in-distribution) vs. MNIST
(OoD) (Hendrycks et al. 2018: Nalisnick al.) 2018 Ren et al. 2019; Zenati al. 2018 Akeay
et al. 2018), and (b) eight classes of PashionMNIS (in-distriuttio) vs. the remaining two classes (OoD), using five different splits {(0, 1). (2, 3), (4, 5), (6. 7). (8, 9)} of held-out classes (Ahmed & Courville 2019). We compare against the log-likelihood (LIL) as well as three state-of oottth--r-ttttttte meth- ods for unsupervised OoD detection (all described in Section 4 (1) The generative ensemble based method by Choi & Jang (2018) composed of five independently trained models (WAIC), (2) the likelihood ratio method by Ren et al. (2019) (LLR), using Bernoulli rates μ = 0.2 for the Fashion- MNIST vs. MNIST experiment (Ren et al. 2019), and 0.15 for the other experiment, and (3) the test for typicality by Nalisnick et al. (2019) (TT). All methods use VAEs for the log-likelihoow estimation They are evaluated by randomly selecting 5000 in-distribution and OoD inputs from held-out test sets and computing the following threshold independent metrics (Hendrycks & Gimpel, 2016 Liang et al., 2017, Hendrycks al.] 2018 Alemi al. 2018 Ren et al. | (2019): (i) The area under the ROC curve (AUROCT), (ii) the area under the precision-recal curve (AUPRC1), and (iii)
the false-positive rate at 80% true-positive rate (FPR80J).
Results. Table T shows that our approaches generally perform better the considered bench- marks. Coupling the encoder and decoder samples appears beneficial, which might be due to the fact that we actually take the samples in couples after every epoch. Being Bayesian about the en- coder parameters Φ also seems to help. Fig. 2 show the precision-recall and ROC curves used to compute the metries, for the FashionMNIST vs. MNIST experiment (see Appendix E for the curves for the other experiment). Fig. shows histograms of the log-likelshoods (left) and of the BVAE-ESS scores (right) on FaSHionMMNIST in-distribution (blue) vs. MNIST OoD (orange) test data. While the log-likelihoods strongly overlap, the ESS scores more clearly separate in-distribution data (closer to ESS = 10 on the r.h.s.) from OoD data (closer to ESS = 1 on the I.h.s.).
5.2 DUT-OFF-DISTRIUTTIO DETECTION IN LATENT SPACE
While input space OoD detection well-studied problem, OoD detection in latent space was only recently identified as an important open problem BombareBo et al.] 2018 Griffiths & Hernández-L.oato) 2017 Mahmood & Hernández-Lobar 2019] Alperstein et al. 2019) (see also Section l). Thus, there lack of suitable experimental benchmarks, making quantitative evalua- tion challeggigg A major issue in designing toy benchmarks based on commonly-un as MNIST or FashionMNIST (i.e., as typically used for assessing input space OoD detection) is that it is not clear how to obtain ground truth labels for which latent points are OoD and which are not, as we require OoD labels for all possible latent vectors z" E Rdd, not just for those corresponding to inputs x* from some training or test set. As first step to facilitate systematic empirical evaluation of latent space OoD detection techniques, we propose the following experimental protocol.
datasets such
We use the BVAE variant where only 0 is integrated out and Φ is estimated via maximum likelihood (denoted by BVAEg in Section 5.1 using the same prior and hyperprior as described there). We
'The architecture of the deconvolutional VAE we use and the training protocol follows previous work Nal- isnick et al. 2018 Choi & Jang/ 2018 Ren et al. 2019). We use the Adam optimizer (Kingma & Ba 2014 with learning rate 10 for all maximum likelihood fits of parameters.
8

---

Under review as a conference paper at ICLR 2020
Table 1: AUROC1, AUPRC1, and FPR801 scores (where higher 1 lower & better) of the baselines (top) and our methods (bottom). For the experiment on FashionMNIST with with held-out classes, we report the mean scores over all five class splits.
MNSS vs MNIST
FashionMNIST (held-out)
AUROCT
AUPRC1
FPR801
AUROCT
AUPRC1
FPR80.
LL
0.557
0.564
0.703
0.565
0.577
0.683
WAIC
0,541
0,548
0.798
0.446
0.464
0.827
LLR
0.617
0.613
0,638
0.560
0.569
0.698
TT
0,482
0.502
0.833
0.482
0.496
0.806
BVAE ESS
0,842
0,830
0,245
0.660
0.650
0.577
BVAE-ESS
0.871
0,855
0,190
0.697
0.681
0,534
BVAE-ESS
0.897
0.893
0.149
0.672
0.659
0.562
BVAR-ESS
0.921
0.907
0.082
0.683
0.668
0.558
BVAEg ESS
0.904
0.891
0.117
0.693
0.680
0,540
in-distribution out-of-distribution
in-distribution
out-of-distribution
Figure 1: Histograms of LL (left) and BVAE-ESS? (right) on FashionMNIST (in-distribution) and MNIST (out-of-distributiin)) The ESS score separates the data more clearly than the LL score.
Precision-Recee curves (in)
ROC
1.0
0.8
0.6
LLR
LIR
πT
0.4
TT
WAIE
W/C
BVAE-ESS
BVAE-ESS
IMAE-E5S?
BVAE-E500
BVAT E55]
6VAT Essg
BVAE, E55
BVAG, ESS
0.0
0.2
0.5
Figure 2: (Left) Precision-recall curves (treating OoD data the upper class) and (right) ROC curves of all methods on the FashionMNIST vs. MNIST benchmark.
train this BVAE model on some dataset (we will use FashionMNIST here), and then sample 10000 latent test vectors z" from the Gaussian (0,,, b IIa) where E IR+ following Mahmood & H (2019) (we use b = 10000). Since there does not exist a ground truth label for whether given latent point 2* is OoD not. instead compute some OoD proxy detailed below) for each of the N latent test vectors and then simply define the N/2 latents with the lowest scores be in-distribution, and the N/2 latents with the highest scores to be OoD.
(to be

---

Under review as a conference paper at ICLR 2020
For this OoD score, we propose to train ensemble of J convolutional neural network clas- sifiers with parameters W = =[ on FasHionMNIST Lakshminaraaanan et al. 2017)
}
We then approximate the mutual information score proposed by Houlsby et al. (201 i.e., I( y x" D) = H(p(y/x",, D)) B [H(p(y)x, w))l, where (pp(wj)) Hlppyx w)) 3 Ewew H(ply|x*, w)) is the average entropy of the predictive class distribution of the clas- sifier with parameters w, and [[(p(v//x, ()) = H() Ewew p(ulx*, w)) is the entropy of the mixture $ Eww p(y|x", w) of categorical distributions p(y)x", w) (which is again categorical with averaged probits). Note that this score requires a test input x². Since in our setting, we only know the latent code z" corresponding to x", we instead use the expected mutual informa- tion under the mixture decoding distribution p(x|2", D) defined by the decoder ensemble O, i.e., Eptxie D) [T(w, ww v|x, D)] N Σn= ensemble of J 5 classifiers and N = 32 input samples for the expectation.
y Xn; ID) where Xn ~ p(x|2", ID). In practice, we use an
We compare the expected ESS (see Section 3.4 with N = 32) against two baselines: (a) The distance of x² E IR to the spherical annulus of radius vd- I, since that is where most probability mass lies under our prior (O. [a) (Annulus) (Alperstein al. 2019). (b) the log- log-probability of z" under the training data distribution in latent space g(z) N xxe q(z) (lzzxxo 6). i.c., a uniform
mixture of N Gaussians in our case (qz) (Mahmood & Honnandez-Lobatee 2019). Fig, 3 shows that our proposed method significantly outperforms the two baselines on this benchmark task.
Precision curves (In)
ROC
1.0
1.6
BVAE, LAUPRC-O.CR 6BI
BVAE, ESS (AUROC=6.69)
qz (AUPRC-O 44)
(AUROC-O, 64)
Ammuls (AUMFC-D-AT)
Annurus (AUROC=0.47)
0.8
0.2
Trae Postivv Sate
03.
0.0
0.0
0.2
Recall
Positive
Figure 3: (Left) Precision-recall curves (treating OoD data as the upper class) and (right) ROC curves of all methods on the FashionMNIST based latent space OoD detection benchmark.
6 CONCLUSION
We proposed new approach to unsupervised distribbitii detection in input space as well as in latent space, using coamattion-therrete metrics based on the approximated posterior over the parameters of a variational autoencoder. For future work, we are keen explore extensions of our approach to (i) state-of-the-art VAE architectures (e.g., using more sophisticated posteriors (Rezende & Mohamed| 2015), priors (Tomezak & Welling 2017 Papamakarios et al. 2017 Bauer Mnih 2019), decoders, etc., which is all complementary); ) (ii) use alternative lower bounds to the marginal log-likelihood, such as the importance weighted lower bound used in an IWAE (Burda et al. 2015)) or combinations of the VAE and IWAE lower bounds, as proposed in (Rainforth et al. (018); (iii) alternative approximate inference techniques for estimating the posterior distribution over model parameters: (iv) other aikelhhood-base deep generative models (e.g.. flow-based and auto-regressive deep generative models); (v) exploit label information (e.g., by using a hybrid model combining our BVAE with predictive model, to enable semi-supervised OoD detection).
*This score is closely related to the disagreement score Ewew (p(lp( w) w)]lp(g('* x", Tr)) proposed by Lakshminarayanan et (2017) for ensemble-based OoD detection, which could be used alternatively.
For efficiency, only consider the 100 nearest neighbors (found by 100-NN model) of latent test point for computing this log-poobaiility (Mahmood & Hermández-looatt 2019).
10

---

Under review as a conference paper at ICLR 2020
REFERENCES
Faruk Ahmed and Aaron Courville. arXiv:1908. 04388, 2019.
Detecting semantic anomalies.
arXiv preprint
Samet Akcay, Amir Atapour-Abart Abarghouei, and Toby P Breckon. Ganomaly: Semi-supervised anomaly detection via adversarial training. In Asian Conference Computer Vision, pp. 622- 637. Springer, 2018.
Alexander A Alemi, lan Fischer, and Joshua V Dillon. Uncertainty in the variational information bottleneck. arXiv preprint arXiv:1887.00006 2018.
Zaccary Alperstein. Artem Cherkasov, and Jason Tyler Rolfe. All smiles variational autoencoder. arXiv preprint 1905, 13343, 2019.
Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Con- crete problems in ai safety. arXiv preprint arXiv: 1606. 06565, 1,0.06666 2016.
Jinwon An and Sungzoon Cho. Variational autoencoder based anomaly detection using reconstruc- tion probability. Special Lecture on IE, 2(1), 2015.
Matthias Bauer and Andriy Mnih. Resampled priors for variational autoencoders. In The 22nd International Conference on Artificial Intelligence and Statistics, pp. 66-75, 2019.
Michael Betancourt. A conceptual introduction to hamiltonian monte carlo. arXiv preprint arXiv:1701.02434 2017.
Christopher M Bishop.
Novelty detection and neural network validation. IEE Proceedings-Vine Vision, Image and Signal processing, 141(4):217-22,, 1994.
David H Brookes, Hahnbeom Park, and Jennifer Listgarten. Conditioning by adaptive sampling for robust design. arXiv preprint arXiv: /0060, 2019.
Yuri Burda, Roger Grosse, and Ruslan Salakhutdinov. Importance weighted autoencoders. arXiv preprint arXiv: 1509900599000 2015.
Tianqi Chen, Emily Fox, and Carlos Guestrin. Stochastic gradient hamiltonian monte carlo. In International conference on machine learning, pp. 1683-1691, 2014.
Hyunsun Choi and Eric Jang. Generative ensembles for robust anomaly detection. arXiv preprint 1at.:188000192.. 2018
Terrance DeVries and Graham W Taylor. Learning confidence for out-of-distribution detection in neural networks. arXiv preprint arXiv:1802.04865. 2018.
Simon Duane, Anthony D Kennedy, Brian J Pendleton, and Duncan Roweth. Hybrid monte carlo. Physics letters B, 195(2):216-222, 1987.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In international conference machine learning, pp. 1050-1059, 2016.
Rafael
Jennifer Wei, David Duvenaud, José Miguel Hernández-Lobate Benjamín Sánchez-Lengelingg Dennis Sheberla, Jorge Iparraure,,,rr,guirrr,, Timothy D Hirzel, Ryan P Adams, and Alán Aspuru-Guzik. Automatic chemical design using data-driven contin- uous representation of molecules. ACS central science, 4(2):268 276, 2018.
Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, volume 1.
MIT Press, 2016.
Ryan-Rhys Griffiths and José Miguel Hernández-Lobato. Constrained bayesian optimization for automatic chemical design. arXiv preprint arXiv: 2017.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and dustrf-dist examples in neural networks. arXiv preprint 161.v21610.02/166 2016.

---

Under review as a conference paper at ICLR 2020
Dan Hendrycks, Mantas Mazeika, and Thomas G Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint 1rXiv:8112. 04606, 2018.
Neil Houlsby, Ferenc Huszár, Zoubin Ghahramani, and Máté Lengyel. Bayesian active learning for classification and preference learning. arXiv preprint arXiv:1112.5745, 2011.
Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 2014.
Diederik Kingma and Max Welling. arXiv:1312.6114 14, 2013.
Auto-encoding variational bayes.
arXiv preprint
Matt J Kusner, Brooks Paige, and José Miguel Hernández-Lobato. Grammar variational autoen- coder. In Proceedings of the 34th International Conference on Machine Learning-Voit Volume 70, pp. 1945-1954, JMLR. org, 2017.
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. In Advances in Neural Information Processing Systems, pp. 6402-6413, 2017.
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, 521(753)):36 2015.
Shiyu Liang, Yixuan Li, and R Srikant. Enhancing the reliability of out-of-distribution image detec- tion in neural networks. arXiv preprini arXiv:1706.000 1706.02690, 2017.
Xiaoyu Lu, Javier Gonzalez, Zhenwen Dai, and Neil Lawrence. Structured variationally auto- encoded optimization. In International Conference on Machine Learning, pp. 3273-3281, 2018.
Renqian Luo, Fei Tian, Tao Qin, Enhong Chen, and Tie- Yan Liu. Neural architecture optimization. In Advances in Neural Information Processing Systems, pp. 7827-7838, 2018.
David JC MacKay. Information-basee objective functions for active data selection. Neural compu- tation, 4(4):590-604 604, 1992.
Omar Mahmood and José Miguel Hernández-Lbaute Lobato. A cold approach to generating optimal sam- ples. arXiv preprint arXiv: 1905.09885, 2019.
Andrey Malinin and Mark Gales. Predictive uncertainty estimation via prior networks. In Advances in Neural Information Processing Systems, pp. 7047-7058, 2018.
Stephan Mandt, Matthew D Hoffman, and David M Blei. Stochastic gradient descent approximate bayesian inference. The Journal of Machine Learning Research,
2017.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't 't know? arXiv preprint arXiv: 2018.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, and Balaji Lakshminarayanan. Detecting out-of-distribution inputs to deep generative models using test for typicality. arXiv preprint 1vX:::/906.02994, 2019.
Kazuki Osawa, Siddharth Swaroop, Anirudh Jain, Runa Eschenhagen. Richard E Turner, Rio Yokota, and Mohammad Emtiyaz Khan. Practical deep learning with bayesian principles. arXiv preprint (tt.::/9000000000 2019.
Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, D Sculley, Sebastian Nowozin, Joshua V Dil- lon, Balaji Lakshminarayanan, and Jasper Snoek. Can you trust your model's uncertainty? eval- uating predictive uncertainty under dataset shift. arXiv preprint arXiv: /ete:/906000000 2019.
George Papamakarios. Theo Pavlakou, and lain Murray. Masked autoregressive flow for density estimation. In Advances in Neural Information Processing Systems, pp. 2338-2347, 2017.
Tom Rainforth, Adam R Kosiorek, Tuan Anh Le, Chris J Maddison, Maximilian Igl, Frank Wood, and Yee Whye Teh. Tighter variational bounds are not necessarily better. arXiv preprint arXiv: arXiv:1802.044 04537, 2018.
12

---

Under review as a conference paper at ICLR 2020
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark A DePristo, Joshua V Dillon, and Balaji Lakshninarayanan. Likelihood ratios for out-o--distribution detection. arXiv preprint arXiv:1906.02844 02845, 2019.
Danilo Jimenez Rezende and Shakir Mohamed. Variational inference with normalizing flows. arXiv preprint arXiv:1505.05770 2015.
Danilo Jimenez. Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and approximate inference deep generative models. arXiv preprint 4rXiv:1401.4082, 2014.
Jürgen Schmidhuber, Deep learning neural networks: An overview. Neural networks, 61:85-117, 2015.
Alireza Shafaei, Mark Schmidt, and James J Little. Does your model know the digit 6 is not cat? less biased evaluation of"" outlier" detectors. arXiv preprint arXiv:1809.04722 2018.
Maximilian Sölch, Justin Bayer, Marvin Ludersdorfer, and Patrick van der Smagt. Varia- tional inference for on-line anomaly detection high-dimensional time series. arXiv preprint arXiv: 1602.07799 2016.
Jost Tobias Springenberg, Aaron Klein, Stefan Falkner, and Frank Hutter. Bayesian optimization with robust bayesian neural networks. Advances Neural Information Processing Systems, pp. 4134 4142, 2016.
Kumar Sricharan and Ashok Srivastava. Building robust classifiers through generation of confident out of distribution examples. arXiv preprint arXiv:1812.0023: 2018.
Jakub M Tomezak and Max Welling. Vae with a vampprior. arXiv preprint arXiv: 175001 2017.
Sumio Watanabe. Asymptotic equivalence of bayes cross validation and widely applicable infor- mation criterion in singular learning theory. Journal of Machine Learning Research, 11(Dec): 3571-3594, 2010.
Houssam Zenati, Chuan Sheng Foo, Bruno Lecouat, Gaurav Manek, and Vijay Ramaseshan Chan- 2018.
drasekhar. Efficient gan- basebased anomaly detection. arXiv preprint
13

---

Under review as a conference paper at ICLR 2020
A SVHN vs. CIFARIO RESULTS FOR OoD DETECTION IN INPUT SPACE
We performed additional experiments on OoD detection in input space on the higher-dimensionn SVHN (in-distribution) CIFARIO (OoD) benchmark (Hendrycks et al. 2018 Nalisnick al. 2019 Choi & Jang 2018). following the same experimental protocol as described in Section 5.1 Looking Table 2 and Fig. S we arrive the same conclusion with the benchmarks considered in Section 5.] in that our approaches appear to significantly outperform the baselines we compare against. While the variants BVAE-ESS and BVAE-ESS", are not strong as the other BVAE-ESS variants this benchmark (as compared to the benchmarks considered in Section 3.3 they still outperform the other baselines. The histograms in Fig. 4 again show that the B BVAE-ESS scores (right) more clearly separate in-distribution data from OoD data than the log-likelihood scores (left).
Table 2: AUROC1, AUPRC1, and FPR801 scores (where higher t lower is better) of the baselines (top) and our methods (bottom) on the SVHN vs. CIFARIO 10 benchmark.
AUROCT
AUPRCT
FPR804
LL
0.574
0.575
0.634
WAIC
0,293
0.380
0.912
LLR
0.570
0.570
0.638
TT
0.395
0.428
0.859
BVAE-ESS
0.667
0.656
0.564
BVAE-ESS
0.669
0.647
0.562
BVAE ESS
0.828
0.817
0.281
BVAE ESS
0,814
0.799
0.310
BVAEg-ESS
0.807
0.793
0.331
in-distribution out-of-distribution
in-distribution
out-of-distribution
-ESSEESS-EEE ESS (right) on SVHN (in-distribution) and CIFAR10 (out-of-distributtinn) The ESS score separates the data more clearly than the I.I. score.
Figure 4: Histograms of LL (left) and BVAE-
B PSEUDOCODE OF BVAE TRAINING PROCEDURE
Algorithm [ shows the overall Bayesian VAE (BVAE) training procedure, which produces sets = { DB+D. ØB+2D,... } and θ = (0,, OB+DD BB42D.... 0r of M = (T - B)/D+ sequentially generated posterior samples Φi p()[D) and A; PDI that do not fall into the Markov chain's is burn-in phase of B epochs and are D epochs apart from each other (to avoid corre- lation). Note that Algorithm I can in practice be conveniently implemented by exploiting automatic differentiation tools commonly employed by modern deep learning frameworks.
"Interestingly, following the implementation details provided in Nalisnick al. 2019 we not quite able to reproduce their results, particular, our experiments yielded better calibrated log-likeling likelihood scores for the benchmark CIFARI0 (in un-distribution) vs. SVHN (OoD) than theirs (i.e., our VAE model assigned lower likelihood to most of the SVHN OoD data than to the CIFARIO in in-distribution data, as desired): this phe- nomenon requires further investigation. For this reason, instead chose the opposite benchmark, i.c., SVHN (in-distribution) vs. CIFARIO (OoD), for which the likelihood scores largely overlap, as shown in Fig. (left).
14

---

Under review as a conference paper at ICLR 2020
curves (in)
1.0
0.6
BVAE-E5S
BVAE
IVAD-E50
BMAE-1555
BVRE ESS
0.2
EVRE
#VAE-4555
BVAE, 555
BVAE,
0.2
0.6
3.8
0.2
0.6
Recal
Fabl Poxitiva Rate
Figure 5: (Left) Precision-recall curves (treating OoD data as the upper class) and (right) ROC curves of all methods the SVHN CIFAR10 benchmark.
Algorithm Bayesian VAE Training
Input:
Dataset ID, generative model p(x, z, 8), inference model q(z) x, Φ), burn-in length B, sam- ple distance D, mini-batch size [M]
Initialize Φo. 0g and + = 0, θ =
Define number of mini-batcher per epoch N₂
[E]
for t 1,..., do
Set do 1, P0 0 for = 1..... N₂ do
Sample minibatch MI ID
Set + (0 if < B else O, θ
Set +. = [ t B else 4.
Compute Vol (oli O,, Ml), update Φ + &b via SGHMC
Compute V Voi((b (f.-1, $.. M.). update 0--1 O via SGHMC
end for
Set de 2N,, 0,- 0N. if t 2 and (t. B) mod D = 0 then
Add 4 U { and è {0.}
end if
end for Output: Posterior samples & and +
Voū O., MI) and Voū((,,1) 4. M. are approximations to the stochastic gradient Eq. required for the SGHMC updates, defined as
D
(. V (ā. O., Ml)
VoCo (x)
-V
Vologp(ôm-1)
(14)
M
XEM
with ELBO gradient VoL 2o (x) as in Eq. 5 and
TD
(0,(0, R V Voū 2,,
V Vo VeLthetan (x) Vo Vologp(0p-))
(15)
M
XEM
with ELBO gradient VoL (x) as in Eq.
g
C PSEUDOCODE OF ALTERNATIVE B BVAE TRAINING PROCEDURE
Algorithm 2 shows pseudocode an alternative Bayesian VAE (B training procedure, which essentially identical to the training of ordinary VAF, but using the SGHMC sampler instead of
15

---

Under review as a conference paper at ICLR 2020
stochastic gradient optimizer. The posterior samples O and & are thus not used during training (as in Algorithm D. but only for test time prediction.
Algorithm 2 Alternative Bayesian VAE Training
Input: Dataset ID, generative model p(x, 2, 0), inference model g(z) x, Φ). burn-in length B, sam- plc distance D. mini-batch size [M] Initialize Φo. 8o and & 0, e =
Define number of mini-batches per epoch N₂- M
for f. = ,,. T do
Set do 0: 0o 0,-1
for ...... N₂
Sample minibatch M ID
Compute V ( 0-- M)) update Φ 6b via SGHMC
Compute V (0b- 0 M). update Oo- - Og via SGHMC
end for
Set Or = 2N.- 00 = dN. if B and (t B) mod D then
Add + U { and e = {0,}
end if end for
Output: Posterior samples and θ
We have
D
1( M)
Σ Cū. 1. (x) - -llogg -logp(p.- log 1ogp(00-1)
(16)
M
XEM
with the standard VAE ELBO as in Eq. i..
L (x) E
oelexxx (log p(x 0o- Dec.la(llx,bb-iillltta
(17)
D NUMERICALLY STABLE IMPLEMENTATION OF THE ESS SCORE
For numerical stability, we in practice always work with log-probabilities (since raw probabilities may get arbitrarily close and thus be rounded zero). I.e., instead of directly computing p(x in Eq. (12) based on the probabilities zz 0), p(z) and q(z),, Φ). we compute log p(x(0) based on the respective pog-brobabilities log logp(x z, 0), log p(z) and log g x, Φ) follows:
K
p(x|zz, p())))
log p(x(( ~ logg
K
EseD (( X. ②)
k=1
M
K
p(x 2x, 0 p)((z))) log
llog
exp
K
M Exeo q( 21. x, ②))
k=1
p(x Zk. 0 0)p(zz)
logmeanexp
log
M Σ Esco 9 x
exp(log(p Kii 0)p(zz)))
logmeanexp
log exp(log( 17 EsEo exp p(zu +)))
exp(log 0) + log pl (zzz)
logmeanexp
log exp(logmeanexp (log p(zz x, o)))
(loge xx x))) where 2 (z x, DD, where the last equality uses log exp(a) exp(t) log(exp(a - b)) a and where logmeanexp a variant of the commonly used numerically stable logsumexp function which computes the mean instead of the sum.
logmeanexp,.
(o)p(((zz, Z 0) log (
16

---

Under review as a conference paper at ICLR 2020
We thus obtain the vector p Ipolace [log p(x ((xx()))eee of logllikelihoods, which we can then to compute the vector w = leae of weights wi in Eq. by passing through the numerically stable softmax function, i.e.,
p(x
exp(pe)
explps - p*)
Wp E Oee EnEeP(x(0) p(x
E aee exp(po) Eoeo exp(ps p²) softmax(p pp")
(18)
where p" max(p)
) is the largest log- likelihood value across all I E e.
E PRECISION-RON AND PR CURVES FOR FASHIONMNIST (HELD-OUT CLASSES) BENCHMARK
Precsion Rocall curvis
ROC curves
TT (NURRCOREC
0.4
IMPPACHS 17)
WAC (ARRDC--.30 30
022
0706 SAURRCHE S31
SPAE JAROCH 801
0GREEL505 (AUTICHO.E))
STRE (MURCCH.E85)
(NsAeC 069
64 (NUROC
0.0
02
022
Rate Aciiice 4pto
Figure 6: (Left) peccision-recall curves and (right) ROC curves of all methods on the MNSS (held-out classes) benchmark with classes 0 and 1 held-out.
RBC curnes
0.4
TT DU1Ne--B.511
WWC (MBRDC--.0
650)
6.2 doff ESS (AU9RC--- nt)
6907 iss JNINOC- 601
05RE (AU
STAE (AUROCHOLES)
0.3
05
Tocal
Figure 7: (Left) rrecision-recall curves and (right) ROC curves of all methods on the MNSSS (held-out classes) benchmark with classes 2 and 3 held-out.
17

---

Under review as a conference paper at ICLR 2020
(AUTTICHO
SAURDCHH 21
WAI JAUFTCHSAA AD
WAC HARDOHHAD JAURCCHE
t50g (AU7RC-
t5og
0.2
aoTETES (U 201 0776 (AUFRC-0.22)
397 (Ss (MUROC-O.EE)
0.0
02
02
tocal
Take Nolive
Figure 8: (Left) Precision-recall curves and (right) ROC curves of all methods on the MNIST (held-out classes) benchmark with classes 4 and 5 held-out.
Precison Rocall curves
NOC curves
6.3
0.-
0.5
0.-
LLR JAJ.APRCHE 521
LA (NUADC-650)
0.4
(MUROCH044
ESS (A3
DVEE JAURCCHE
ESS5 (AU7SC-0.591
DVE (AUROCHOLEL)
02
02
JURDC-
aVereso (MUROCH
Botk, ESS JUiReC-
02
0.4
6.6
58
42
0.4
O8
Talx Toatic
Figure 9: (Left) Precision-recue curves and (right) ROC curves all methods on the FaSH (held-out classes) benchmark with classes 6 and 7 held-out.
0.3
0.5
GOUROCC- 721
CAUFFCHE500
WAC MARROHH350
DooL ES5 ESSTRCCRC 55)
SVAC 455 JAUTOCHE 241
ES0g poinec 6.97)
Ivie doo (SUAOC
HU100-093)
Figure 10: (Left) Precision-recall eurves and (right) ROC curves of all methods the FashionM-
NIST (held-out classes) benchmark with classes 8 and 9 held-out.
18


Reviews:
[{"review_id": "Syg9CadRFr", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "After reading all the reviews, the comments, and the additional work done by the Authors, I have decided to confirm my rating.\n\n==================\n\nThis paper leverage probabilistic inference techniques to maintain a posterior distribution over the parameters of a variational autoencoder (VAE). This results in a Bayesian VAE (BVAE) model, where instead of fitting a point estimate of the decoder parameters via maximum likelihood, they estimate their posterior distribution using samples generated via stochastic gradient Markov chain Monte Carlo (MCMC).\nThe informativeness of an unobserved input x* / latent z* is then quantified by measuring the (expected) change in the posterior over model parameters after having observed x* / z*.  The motivation is clear, when considered inputs which are uninformative about the model parameters, they are likely similar to the data points already in the training set. In contrast, inputs which are very informative about the model parameters are likely different from everything in the training data.\n\nThe contributions are:\n- A Bayesian VAE model which uses state-of-the-art Bayesian inference techniques to estimate a posterior distribution over the decoder parameters.\n- A description of how this model can be used to detect outliers both in input space and in the model’s latent space.\n- Results showing that this approach outperforms state-of-the-art outlier detection methods.\n\nThe paper is well written, and the proposed ideas are well motivated.\nHowever, the experiment section is too limited. The authors should at least use one more dataset such as CIFAR10. They just use FashionMNIST vs MNIST FashionMNIST (held-out).\nIn addition, it would strengthen the paper if the authors could show at least initial result about how the model performs to detect out of distribution in the latent space, given that it is considered as part of the contribution.\n\nThe paper lacks some references such as:\n- Predictive uncertainty estimation via prior networks, NEURIPS 2018.\n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "H1lxgQ5-9B", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies the problem of out-of-distribution data detection, which is an important problem in machine learning. The authors propose to use Bayesian variational autoencoder which applies SGHMC to get samples of the weights of the encoder and the decoder. The proposed method is tested on two benchmarks to demonstrate effectiveness.\n\nThe proposed Bayesian variational autoencoder appears to be technically sound. When applying it to OoD detection, effective sample size is used to quantify how much the posterior changes given the new data. The authors claim that ESS will be large when the data is in-distribution since all samples explain the data equally well. First, I’m not sure this is true that all samples from the posterior should explain the data equally well even if it is in-distribution. Second, if the data is out of distribution, it is likely that all samples explain the data equally bad which also results in high ESS. In practice, it is very likely that p(x*|theta) are low for all the theta when x* is out-of-distribution. Am I missing something here?\n\nHow to determine whether a data is out-of-distribution or not based on ESS? Is the threshold of ESS a hyperparameter to tune?\n\nFor the experiments, I wonder why the authors put Gamma hyper priors for BVAE which was not used in the previous work that use SGHMC. Is there any reason for doing this? Again, it is unclear to me how the authors decide whether a data is out-of-distribution or not based on ESS.\n\nIt seems like simply applying SGHMC for the decoder parameters is sufficient, as the other treatments only improve the results incrementally but adding large computational and storage cost. I’m not familiar with the literature enough to tell whether the results of previous methods are reasonable or not. By looking at the table, it seems that the proposed method achieves some gain over the previous methods. \n\nIn the experiments, BVAE only keeps the most recent 10 samples. Aren’t the samples very similar? Since the thinning interval is only 1 epoch.\n\nIt would make the paper stronger if the authors are able to demonstrate the usefulness of detecting OoD in latent space through experiments.   \n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "H1gQjvYpFS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper advocates to use information gain to detect whether a sample is out of distribution. To that end, a Bayesian VAE is introduced for which that quantity is tractable. The experiments show a solid improvement over previous methods.\n\nI like the paper, but I have a few questions. I am more than willing to increase my score from weak reject to weak or strong accept if these are addressed properly.\n\nWhat is the relationship of information gain to the marginal likelihood of the data? Since both can be expressed in entropies, I can see a very strong relationship, but would enjoy the authors opinion here–what exactly is it that gives the edge?\n\nThe experiments report results on the likelihood based score. Were these results taken from previous publications or obtained from exactly the same pipeline?\n\nWhy is the \"outlier in latent space\" section included even though it is not experimentally verified? I think it should go, as conducting experiments is cheap in ML. On the other hand, if we cannot come up with an experiment to conduct, then what is hypothesis is tested? I think the section needs to be removed and be revisited in future work.\n\nIs the method really principled? Where is the connection from the assumption that the score should be high for out of distribution and low for in distribution? If a method is called \"principled\" I want to see a rigorous derivation of how a method derives from what principles exactly and how it is approximated.\n\nSince only the 10 most recent samples are kept to represent the posterior, I am worried about their diversity. I think the authors should back up that this is sufficient to represent the posterior.\n\nWhat happens in the non-parametric limit, where the posterior will collapse to a point? Does the method not rely on an insufficiently inferred model?", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper tackles the problem of detection out-of-distribution (OoD) samples. The proposed solution is based on a Bayesian variational autoencoder. The authors show that information-theoretic measures applied on the posterior distribution over the decoder parameters can be used to detect OoD samples. The resulting approach is shown to outperform baselines in experiments conducted on three benchmarks (CIFAR-10 vs SVNH and two based on FashionMNIST).

Following the rebuttal, major concerns remained regarding the justification of the approach. The reason why relying on active learning principles should allow for OoD detection would need to be clarified, and the use of the effective sample size (ESS) would require a stronger motivation. Overall, although a theoretically-informed OoD strategy is indeed interesting and relevant, reviewers were not convinced by the provided theoretical justifications. I therefore recommend to reject this paper.
Decision: Reject