Unsupervised Out-of-Distribution Detection with Batch Normalization
Authors: Jiaming Song
Yang Song
Stefano Ermon
Venue:  (2020)

Abstract: Likelihood from a generative model is a natural statistic for detecting out-of-distribution (OoD) samples. However, generative models have been shown to assign higher likelihood to OoD samples compared to ones from the training distribution, preventing simple threshold-based detection rules. We demonstrate that OoD detection fails even when using more sophisticated statistics based on the likelihoods of individual samples. To address these issues, we propose a new method that leverages batch normalization. We argue that batch normalization for generative models challenges the traditional \emph{i.i.d.} data assumption and changes the corresponding maximum likelihood objective. Based on this insight, we propose to exploit in-batch dependencies for OoD detection. Empirical results suggest that this leads to more robust detection for high-dimensional images.

Under review as a conference paper at ICLR 2020
UNSUPERVISED OUT-OF-DISTRIBUTION DETECTION WITH BATCH NORMALIZATION
Anonymous authors Paper under double-blind review
ABSTRACT
Likelihood from a generative model is natural statistic for detecting out-of- distribution (OoD) samples. However, generative models have been shown assign higher likelihood to OoD samples compared to ones from the training distribution, preventing simple threshold-based detection rules. We demonstrate that Ool) detection fails even when using more sophisticated statistics based on the likelihoods of individual samples. To address these issues, we propose a new method that leverages batch normalization. We argue that batch normalization for generative models challenges the traditional i.i.d. data assumption and changes the corresponding maximum likelihood objective. Based this insight, we propose to exploit in-batch dependencies for OoD detection. Empirical results suggest that this leads to more robust detection for high-dimensional images.
INTRODUCTION
Modern neural network models are known make poorly calibrated predictions (Guo et al. 2017, Kuleshov et al. 2018). and can be highly confident even for unrecognizable or irrelevant
inputs (Nguyen et al., 2015 Moosavi-Dezfoolii al., 2017). This has serious implications for AI safety (Amodei & Clark (016) in real world deployments, where model could receive inputs that are beyond its training distribution. Detecting examples that are of the training distribution becomes a viable solution: when encountering such samples, the model could choose to provide low confidence estimates or even abstain from making predictions (Cortes et al., 2017).
Density estimation is one approach to detecting based model is trained on the input samples; during evaluation, samples that have low likelihoods are For high-dimensional inputs (such as images), deep generative
(OoD) samples. A likelihood-
assumed to be out-of-distributon models have been able to generate realistic samples as well as achieving good compression capabilities. which indicates high likelihoods on the training distribution (Ballé et al. 2016 Kingma & Welling 2013] Kingma Dhariwal 2018 van den Oord et al. 2016); thus, recent works have considered using deep generative models to detect of samples (Li al. 2018). However, contrary to popular belief, density estimates by deep generative models are highly inaccurate (Nalisnick et al.) 2018). For example, Glow (Kingma & Dhariwal 2018) model trained CIFARTO gives higher likelihood estimates to SVHN samples than CIFAR T0 ones, which makes accurate Ool detection impossible. While alternative statisties based on likelihood estimates have been proposed alleviate this issue (Choi et al. 2018 Song et al.) 2017), they are not able to detect OoD samples consistently.
In this paper, we propose new statistic to detect OoD samples using deep generative models trained with batch normalization (Toffe & Szegedy] 2015). We argue that using batch normalization not only improves optimization (as argued in (Kohler et al. [0188] (Snnurrar et al. 2018)). but also challenges the i.i.d. assumption underlying typical likelihood- training objective of generative models with batch normalization can be interpreted as maximum pseudo-likelihone over a different joint distribution that does not assume data in the same batch are i..d. samples. Empirically, we demonstrate that over this joint distribution, the estimated likelihood of batch of OoD samples is much lower than that of in-distribution samples. This allows us propose a permutation test which outperforms existing methods by a significant margin without modifying achieve wear-perfect performance
objectives. We show in that the
how the underlying generative model is trained. In particular, even on cases such as Fashion MNIST vs. KMNIST, where the likelihood distributions for single samples are nearly identical (see Figure T left). While generative models trained with BatchNorm

---

Under review as a conference paper at ICLR 2020
Density (unormalizen (zedm
1.00
Fashion MNIST
0.4
pula)
Density
0.75
MNIST
0.3
pix)
Omnigiot KMNIST
0.50
0.2
0.25
0.1
0.00
0.0
0
per dimension
Figure I: (Left) Density estimation with a RealNVP model trained on Fashion MNIST. The model assigns similar higher likelihoods several OoD datasets. (Right) Model mis-specification can result in OoD samples having higher log-likelihoods.
might not provide vate-of-the-arr likelihood numbers on the test set, it remains competitive and could be more suited for the OoD detection problem (Kingma & Dhariwal 2018 Nalisnick et al.) 2018).
2 BACKGROUND
Setup Let X = { be a set of N observations; we assume that "in-distribution" samples drawn i.i.d. from some underlying distribution p(z). Our goal is to detect whether test sample x is g(x), but do not have access to samples from g(x) during training. Following definitions in (Hendrycks & Gimpel 2016 Liang et al., 2017). we define OoD examples as the test samples that have low densities under p(z). We note that samples from g(x:) not necessarily all OoD; for example, if then most samples should not be classified as OoD. Detection of OoD samples is
we consider drawing the test samples from an unknown distribution
useful for applications such as anomaly detection (Li al. 2018) and exploration in reinforcement
learning (Ostrovski et al. 2017)
I Likelihood-basee generative models for -uitt--distribution detection Likelihood- based models are trained by finding parameters O such that the corresponding po is as close possible to the training distribution p(z), in terms of
divergence (KL):
arg min DKL (p(x) (x)) = arg min Ep(x)) [log p(x) log po (a:)
0
Finding appropriate solutions depends heavily choosing the right family of (parametrized) probabil- ity distributions. In the context of images, deep neural networks have demonstrated good performance. Likelihood-baie -based deep generative models include variational autoencoders (Kingma & Welling 2013)
(where variational lower bounds are optimized), autoregressive models (van den Oord et al. 2016
Salimans al., 2017). and invertible flow models (Dinh al., 2016)] Kingma & Dhariwal 2018) (where exact likelihood is optimized).
Given a sample æ, we could attempt to test whether it is OoD or not by evaluating likelihood logro (2:). Intuitively, if (a is sufficiently similar to p(æ), OoD samples should have low likelihood under pa (=(x)) However, this is not the case for some deep generative models (Nalisnick ct al. 2018 Choi et al. 2018). where OoD samples are observed to have higher likelihoods than samples from the training distribution p(æ) across several datasets and models. For example, state- of-the-art models trained on CIFAR10 (Krizhevsky & Hinton, 2009) assign higher likelihood to SVHN (Netzer et al. (011)) samples than CIFARIO samples. A similar phenomenon has also been observed by Nalisnick al. (2018) for models trained on Fashion MNIST (Xiao al. (017) (Figure
[]] (left),, where images with lower variance across pixels (such as MNIST) are assigned higher likelihoods. This invalidates the assumption that OoD samples are assigned lower likelihoods by existing deep generative models.
To alleviate this issue, Choi et al. (2018) use Watanabe Akaike Information Criterion (WAIC):
WAIC (x) E (o()) + Varg [arg[log pe (x)]
(1)
where the expectations computed using independently trained model ensembles. This method does not assign higher negative WAIC values for OoD samples in some simple cases, but is empirically observed it to be effective for certain datasets and generative models.
2

---

Under review as a conference paper at ICLR 2020
Likelihood-basse permutation tests In the context of detecting adversarial examples, SSng et al. (2017) considered using permutation tests statistics to determine whether an imput x' comes from p(æ) not. One such test statistic uses the rank of po in {po(zi), (P((xN) where {a, ] is (training) dataset of N samples from p(æ:):
N Σ (x) S po(x'))
N E 10,,N/2+1
perm = T(x'; x1, 2...... 2.N
(2)
2
where is the indicator function. When perm (z) large. æ is assumed be OoD. This addresses the samples (such as the SVHN vs. CIFARIO example in Nalisnick et al. (2018), as both "high-likeli likelihood" and "low- fow-likelihood" samples will have T perm close to N/2 (because of the absolute value) and be identified as OoD.
case where higher likelihood is observed for certain
3 OUT-OF-DISTRIBUTTEE
SAMPLES AND MODEL MIS-SPECIFICATION
Nalisnick et al. (0088) find it surprising that deep generative models assign higher likelihood to out-of-distriution samples, given their successful generalizing on a test dataset. However, we argue that this is to be expected when the unerlying generative model (x) is mis-specified, and perhaps this is more likely than previously anticipated in the literature.
We consider simple example where a mis-specified model would overestimate the likelihood of ditt---distribution samples (Figure | right). Let p(x) be uniform mixture of two Gaussians on R (-11. 0.01) and (110,, 0.01), and po [N,, o²) be our model with parameters (μ, The maximum likelihood solution is (f** a²) z (0.0, 1.0). where mode-covering behavior occurs. at = O has the largest likelihood under py (z). yet highly atypical in the original distribution. This is also a failure mode for WAIC as discussed in (Choi et al. 2018).
Given the complexity of high-dimensional image distributions, existing likelihood- generative models are likely to be mis- mis-specified, which invalidates the use of likelihood estimates to perform OoD detection (White 1982). Moreover, model selection often based on the holdout method (Arlot et al. 2010), in which we evaluate log- oig-iiklihood over a validation set sampled from p(æ), but not over -istri-iistiitttion samples. As we do not know the entropy p(ar), ) we can never check whether ( ar) [[p ( (a)) R O after training. Because of the mode-seeking nature of DKL., an alternative distribution (<x) ) * p(x) can have even lower KL-divergence with pe (x), i... [KL(g(x) (x<x)))) (z)) < DKL (p( x) pe
even if (z) is trained samples from p( (x)). In Appendix B we demonstrate that even more sophisticated tests over log-likell ligeeiod,, such as likelihood- cannot detect taat-of-distrbbtti samples effectively.
permutation tests,
4 DETECTING OUT-OF- SAMPLES WITH BATCH NORMALIZATION
In the following sections, we argue that by taking advantage of batch normalization (BatchNorm), out- of-distribution samples can be detected with existing deep generative models. For batch of inputs z = { i= of batch size 6, batch normalization (Ioffe & Szegedy 2015)) performs normalization
over the inputs followed by a parametrized affine transformation:
z - E(z]
BatchNor((2,7,..c
Var [=] + + +
where y, 3 are trainable parameters, and e is hyperparameter for numerical stability. The mean [[x] and variance Var[z] are computed over a single batch in training mode, and over the entire training set in evaluation mode"] For deep generative models using batch normalization, existing literature evaluate the log-likelihooe on some validation set in evaluation mode. The role of training mode is
generally perceived accelerate optimization (Kohler al. 2018 Santurkar al. 2018). similar to supervised learning.
"This typically done by keeping an exponential moving average over the hatch statisties during training.
3

---

Under review as a conference paper at ICLR 2020
Table 1: Log-likelihood (measured in bits per dimension) calculated with ReaINVP, VAE, Pixel- CNN++ models on MNIST, Fashion MNIST, CIFARIO, and SVHN test sets. We train RealNVP and VAE FashionMNIST, and train RealNVP and PixelCNN on CIFARIO. We report likelihood results with training mode, evaluation mode, and their difference (A).
(a) RealNVP (trained on Fashion MNIST)
(b) RealNVP (trained on CIFARIO)
Evaluated on
BN Mode
BPD
A
Evaluated on
BN Mode
BPD
A
evaluation training
2.92
evaluation training
3.48
Fashion MNIST
0.02
CIFARIO
0.03
2.94
3.51
evaluation training
1.74
evaluation training 11.10
2.44
MNIST
7.73
SVHN
8.56
9.47
(c) VAE (trained on Fashion MNIST)
(d) PixcICNN+ (trained on CIFAR10)
Evaluated on
BN Mode
BPD
A
Evaluated on
BN Mode
BPD
A
evaluation training
3.19
evaluation training
3.21
Fashion MNIST
0.01
CIFAR10
0.12
3.20
3.33
evaluation training
1.97
evaluation training
2.16
MNIST
6.53
SVHN
1.88
8.50
4.04
4.1 TRAINING MODE DECREASES LIKELIHOOD OF OoD BATCHES
Our central observation is that likelihoods assigned by the model under training mode and evaluation mode are significantly different for OoD samples, but much less so for in-distribution samples, i.e. when we use BatchNorm statistics computed over single batch. We evaluate log-likelihood (measured in bits per dimension, BPD on Fashion MNIST. MNIST, CIFAR and SVHN test sets with several models including RealNVP. VAE and PixcICNN+ Pre-activation batch normalization layers are used within the residual block for RealNVP and PixeICNN++, and before each convolutional layer for VAE. The datasets evaluated in both evaluation mode and training mode.
In Table [we we found that in evaluation mode MNIST samples have smaller BPD than Fashion MNIST for models trained on Fashion MNIST: SVHN samples have smaller BPD than CIFAR10 10 for models trained on CIFAR10, which agrees with the observations in (Nalinnick et al. 2018). However, as we change from evaluation mode to training mode, the log- likelihood of the in-distriuution samples does not change significantly. while that of OoD samples plummets (see A in Table [.. In Appendix C.3 we demonstrate that this sudden decrease in log-likelln likeliodd datasets, but also adversarial samples that are able to fool likelihood models and likelihood-baig based permutation tests. This empirically suggests that simply by using training mode during evaluation, we are able to consistently detect batch of out-of out-of-distribution samples. We further note that no special modifications is made over the training procedure, and no additional OoD datasets are required.
only happens for samples from other
0.5-
Example demonstrating how BatchNorm miti- gates nigh-likelihood in OoD distributions. p(x)), p)(r) (I) and g(x) denote the original, model and OoD distribu- tions. Distribution of 22 are different for g(x)) under the two modes of BatchNorm, leading to different likeli- hood results.
Figure 2:
Dendly Levenstoon
giel
0.3
2BPD is defined by the negative log-likelihood divided by the number of dimensions Theis 2015 if the likelihood is measured nats, then an additional division by in is needed.
We use implementation where we replace weight normalization with batch normalization for PixeICNN++, htttp::/ggghubb.oo///hh..e. http:///mmmccccccsa////cccaaaaam 4/p-
4

---

Under review as a conference paper at ICLR 2020
4.2 EXPLAINING THE EFFECTIVENESS OF BATCH NORMALIZATION
Why is batch normalization effective at detecting OoD batches while other likelihood-based generative models (e.g., Glow trained with ActNorm) fail? First provide example illustrate why training mode and evaluation mode provide different likelihood estimates for OoD distributions. Then we argue that with training mode, the learned generative model no longer assumes samples are i.i.d., which differs from models without BatchNorm.
4.2.1 EXAMPLE OF BATCHNORM MITIGATING MODEL MIS-SPECIHICATION
In Figure 2 we illustrate case where BatchNorm could be useful for OoD detection. Suppose we try to learn some distribution p(æ) with 2-d flow model with one coupling layer (Dinh et al. 2016): f (x1,02) + (2) where 21 = 21. 22 = 22 + (x) - /zz1))/ VV(1)
with learnable parameters y, 7, E(x1). V(11) are the empirical mean and variance of batch of 21 in training mode, and the mean and variance of p(r1) in evaluation mode. To simplify our analysis, We assume that the training distribution p( 22) = p(z)((1)))))) (p(zg) where p(z1) is mixture of two Gaussians (V(-1, and (11 o²) with o + 0) and p(æ2) = óo (Dirac delta) and batch sizes are infinite; hence 22 z (i, E(x))), (((zi))/V((()) ( B. Since the Jacobian of f is triangular and has a determinant of 1, the likelihood of the flow model is simply Py (x = (111 x2)) ); we assume the prior p( 21 22) is standard Gaussian (V,,
I). The optimal parameters are then y and B
Now let us consider q x2) = g(<1))((2)) where ((x1) = (1fformm-0..,0... In evaluation mode, 22 ~ and Egg [lo py (a)] R 1.92; in training mode, 22 R V12x1, which decreases the py
log-likelinn ligeliiklihood to Eg p/ ps (2) this case, BatchNorm manages to learn global property of the input distribution (variance), and use this to counteract major distributional shifts (e.g. the proposed uniform distribution ((x)). The effect leads to lower log-likelihoods in training mode compared to that in evaluation mode.
2.38.. We include more detailed analysis in Appendix [ In
4.2.2 REVISITING THE LLD.D ASSUMPTIONS FOR BATCH-NORMALIZED GENERATIVE MODELS
While it is difficult to analytically characterize the change of likelihood estimates in training mode for nigh-dimensional images and deep neural networks, we provide a probabilistic interpretation as to why training mode exhibits different behaviors than evaluation mode.
Training mode breaks the i..dd data assumption In training mode, the output for a particular sample æ, affected by other samples in the same batch (denoted as x xz-)), so they are not treated as Li.d for the generative models in training mode. This suggest that using BatchNorm when training generative models not only changes the optimization landscape but also modifies the objective: is no longer N Emm log po(po)) where each sample is assumed to be i.i.d.
Pseudo-likelihore perspective training mode How should we interpret the training objective with batch normalization? For each sample æj. its corresponding "likelihood" objective depends on the other samples from the same batch; we denote this as fa(w;; x=)). First, we show that the integral of exp(Co (zy; xz)) over any particular sample (ax,) when fix the other samples in the batch (x= is one; this allows us to treat exp(E) as probability density function[]
b, > 1 be the batch size, and for all possible batch of samples of size (b - 1), denoted as x-jj, if (o(x); generative model with batch normalization, then:
Proposition 1. Let
the training objective over æ, for a tikelihood-base
x =
where we consider likelihood based generative models that sample either via some parametrized distribution (such as VAE and PixelCNN) or via parametrized invertible transformations constructed via affine coupling layers (such as RealNVP).
By maximum likelihond, y R arg min, 2 logs=
For VAF, assume that the inference distribution is always optimal, i.c., there is gap between the evidence lower bound and the log-likellnn likeliihhodd so can the objective exact maximum likelihood.
5

---

Under review as a conference paper at ICLR 2020
We defer the proofs in Appendix A.1 Moreover, if we interpret (z(2x; as the conditional log- likelihood under a certain joint generative model Po over an entire batch, our existing "log-like "og-liiklihood"" objective is surrogate to the log- likeliiklihood objective over the joint distribution po (1 22 Tb,)-
Proposition 2. There exists a joint distribution po (1 I2,..., Ib) such that for all j. po (-ا (0(x):==)) as + co. Then, the objective for one batch {x,}}= in training mode
Eiaiin ( ((xz))=1:0) = Σ (o(xzyl=))
log po (x)
j=1
is the pseudo-log hiw.loooiieeiiooodoooooooooooooe for the joint distribution po 1 22..... vbb) as b +
Training mode versus evaluation mode In evaluation mode, the samples are treated i.i.d., since the batch statistics is fixed and samples within the same batch do not affect each other. The objective for one batch {x,}}== evaluated in evaluation mode is simply:
(fna(tay))
Σ log (x))
It is evident that Liiin and Leval are not the same objective due to the differences in i.i.d. assumptions for samples within the same batch. Luiin depends on the input batch statistics, whereas Leval does not, If we consider OoD batches that exhibit major distributional shifts, then it is likely that Cuain differs from Leval. From the empirical evidence in Table [ OoD samples have much lower BPD on training mode than on evaluation mode, whereas the same does not happen for in-distribution samples.
5 A PERMUTATION TEST BASED ON BATCH NORMALIZATION
Assume that during testing we have access to some "test dataset" X, and our goal is to identify for each test sample E X whether is OoD or not. Based on the observations over OoD batches, we propose permutation test for each test sample a.
Interpolation between training and evaluation First, we propose a procedure that interpolates between training mode and evaluation mode, generalizing the settings in Section 4 We randomly obtain a batch of samples Xb2 b2 from X with size b and a batch of samples Xb, from p(æ) with size bo (e.g., from the training dataset used to fit the generative model). For each Ø; Xx, indexed by j. we compute its log-likelihood under training mode by mixing X and X in the same batch:
log po (x:)) where x- = (X by Xx,) (
(5)
Let b = b1 + by be the batch size and let / be the ratio of the test samples in the entire batch. We note that the above procedure interpolates evaluation with training mode and evaluation with evaluation mode. As O, the effect the batch statistics is dominated by the training samples X,p- so Equation converges to evaluation mode; as r + 1, the effect on the batch statistics is dominated by the test samples X so Equation S converges to training mode. As we increase from to we are moving from evaluation mode to training mode.
The observations in Section 4 suggest that log po ( (z_;) should be relatively stable if q(x)) is close to p(x) and increase significantly if ((x:) is far from p(z), which is indeed the case empirically. We consider evaluating the average logelikeli on the test samples when the ratio is varied, and show the results on several datasets and models in Figure 3 As we increase the ratio of test samples, the corresponding ligeeiillooodd decreases dramatically for OoD samples, but is relatively stable for in-distribution samples.
Permutation test with BatchNorm We proceed to propose permutation test statistics based on training mode evaluation. For test sample 9, a fixed batch size and fixed ratio r, we select (rō - 1) samples from q(x) and (1 r)b samples from p(x). The expected conditional likelihood of à is used as the test statistic:
(b,r(z') Ep.g ( X
where X(1-7)6 p(x), X q(x)) (6)

---

Under review as a conference paper at ICLR 2020
Bits dimension
RealNVP (Fashion MNIST)
Bits dimension
15
RealNVP (CIFAR)
Feshion MNIST (Test
10
NNIST (Test)
SVHN (Tes)
10
5
5
0.2
0.4
0.6
0.8
1.0
0.1
0.2
0.4
0.6
0.8
1.0
Ratio of test samples in batch
Ratio of test samples in batch
Bits dimension
10.0
VAE (Fashion MNIST)
PixelCNN+ (CIFAR)
MNNS (Test)
CIFAR (Test)
7.5
MNIST (Tes)
5.0
2.5
0.1
0.2
0.4
0.6
0.8
1.0
0.1
0.2
0.4
0.6
0.8
1.0
Ratio of test samples in batch
Ratio test samples batch
Figure 3: Average BPD (- (- jo ( (--)) for test samples with varying ratios of test samples in the batch. The BPD of in-distribution samples do not increase the ratio increase, yet that of OoD samples increase significantly. This justifies the use of Ab.r1.r (xx) for OoD detection.
In practice, we use monte carlo estimates for the expectation in (z,", We select two different ratios T2, E 1) where < T2, and compute the differences in (zx);
Ab. ra=") |Sa.r1 (x=) (x)))
We proceed to use the rank of Ab.iino (i) in the training set as our test statistic:
T.. T(x'; 1 FN) (Z) S (o.r..2
(8)
For in-distribution samples, expect Ab.ri to be small across all choices of rı and r2; for out-of-distribution samples, Ab.r. should be large if (r2 - r1) is large. Therefore, if ((x) = p(x). then the statistics computed over the ((x) should be approximately uniformly distributed over [0, N]. whereas if q(x) & p(æ), then the statistics computed over out-of-distribution samples would be concentrated around N.
EXPERIMENTS
We verify the effectiveness of our proposed test statistic on several datasets and models, including RealNVP, VAE and PixeICN+++, and compare against several baselines including log- likeelooooodd, permutation test and WAIC. First, we train a model po (x) on a dataset p(z); then we proceed to obtain the test statistic for each sample in g(x),, where ((x)) several different datasets. For each ((x) * p(z), we consider a binary classification problem, where the prediction is the test statistic for each sample æ. and the label is whether is out-of-distribution (label 1) or not (label 0): larger prediction values indicate xe is more likely to be out-of- nul-of-distribution. We evaluate the area under the ROC curve (AUC) and average precision (AP) for each binary classification task, following the procedure in (Hendrycks & Gimpel 2016). We select 71 0.1 and = 0.9 for our proposed test statistic, and the batch size B =
The OoD detection results are shown in Table 2 As expected, using log (o(x) results in poor AUC and AP in cases where the OoD samples have higher log-likelihoods; Tpem outperforms log (a in cases where we also consider high log-likelihood samples as OoD; WAIC achieves higher AUC/ AP than log p yet its improvement is inconsistent across different models (RealNVP improvements are lower than VAE on Fashion MNIST). Our proposed statistic is able to detect all the out-of- distribution samples by achieving near optimal AUC/ / AP in most cases; this is most notable on CIFAR ImageNet and Fashion MNIST vs. KMNIST the sample have very similar likelihood distributions in evaluation mode. In Appendix [.44 we show that our method works well even with - 0 and r2 0.15; therefore, the method not very sensitive the rı, 12 hyperparameters. This
7

---

Under review as a conference paper at ICLR 2020
Table Out-of-distribution classification evaluated with AUC (left) and Average Precision (right). Higher is better. Rotation denotes g(x:) uses images in p(z) yet each image is rotated randomly by E (90, 270) degrees.
p())
Model
((z)
log pe (x)
perm
WAIC
Ours
Rotation
0.76 0.78
0.64 / 0.68
0.99 0.99
0.99 0.99
Fashion MNIST
MNIST
0.10 0.332
0.78 / 0.71
0.24 / 0.38
1.00 / 1.00
Re
Omniglot
0.05 / 0.06
0.86 / 0.80
0.97 0.95
1.00 / 1.00
KMNIST
0.47 / 0.46
0.45 / 0.45
0.63 0.65
1.00 / 1.00
Rotation
0.73 0.72
0.61
0.94
0.97 / 0.98
Fashion MNIST
MNIST
0.73 0.33
0.56
1.00 / 1.00
VAE
Omniglot
0.00 0.006
0.99 0.996
0.88
1.00 / 1.00
KMNIST
0.50 0.55 0.55
0.84 0.87
1.00 / 1.00
Rotation
0.87 0.88
/ /0.79
1.00 / 1.00
SVHN
0.07 0.552
0.86
0.16
1.00 / 1.00
RealNVP
CIFARIO
ImageNet
0
0.50
0.58 0.58 /0.59
0.98 / 0.97
LSUN
0.70/0.39
0.58 0.56
0.60
0.99 / 0.98
CIFARI00
0.52 0.54
/ 0.55 0.55
0.71 / 0.75
Rotation
0.77 /.775
0.67 0.663
0.90
0.99 / 0.99
SVHN
0.10/0.32
0.86/0.77
0.09
0.99 / 0.99
CIFARI0
PixeICNN+
ImageNet
0.51 0.51
0.49 / 0.50
0.66/0.69
0.89 0.87
LSUN
0.72 0.69
0.60 / 0.58
0.78 / 0.74
0.98 / 0.97
suggest that in practice, even when the test samples contains only small portion of the OoD samples we can still detect them reliably by selecting 7 - 0 (evaluation mode) and r2 - (training mode).
Additionally, we also perform permutation tests over entire batches of test samples, where the BPD of evaluation mode are averaged. The AUC AP CIFARIO 10 versus OoD datasets are 1.00 1.00 (SVHN), 0.56 / 0.64 (CIFARI00), 0.82 0.68 (LSUN), and 0.56 / 0.68 (ImageNet). These results significantly lower than evaluated with training mode where the AUC/ AP are near near-perfect, which demonstrates that utilizing training mode is behind the improvements for Ool detection.
7 RELATED WORK
Task-dependent OoD detection Out-of-distribution detection is crucial to applications such as
anomaly detection (Pidhorskyi et al. [018 Hendryyks & Gimpel| 2016 Vyas al. | 20188), adver- sarial defense (Song et al. 2017 2018). and novelty detection for exploration (Marsland, 2003]
Bellemare et al. 2016 Fu et al. (017)). the context of supervised learning, OoD detection meth-
ods (Hendrycks & Gimpel 2016 Liang al. 2017 Deies & Taylor 2018 Gal & Ghahramani
2016 Lakshminarayanan et al. (201)) are applied to prevent poorly-calibrater neural networks (Guo
al. 2017) from making high-confidence predictions
nonsensical inputs (Szegedy al. 2013
Goodfellow et al.] 20144;; these methods are task dependent and are not suitable for task-independent
cases, such exploration over novel states (Fu al. 2017 Ostrovski al. (017).
Generative models for task-independent OoD detection For high- dinensiinnii inputs such as images, deep generative models are widely applied for density estimation (van den Oord et al. 2016 Dinh et al. 2016 Kingma Dhariwal] 2018), and thus are naturally considered for task-independent OoD detection (Chalapathy et al.] 2018 Xu et al. 2018 Kliger & Fleishman, 2018 Ostrovski et al.) 2017 Li et al., 2018). However, recent empirical evidence suggest that likelihood estimates by popular deep generative models not reliable enough for OoD detection, even against samples that are not adversarial by construction (Nalisnick et al. 2018: Hendrycks et af.) 2018). To address these issues, Škvára "Ssues,,kváára et al. propose tuning the hyperparameters of VAEs with additional OoD data. Choi et
al. (Choi et al. (2018) address this empirically by assuming that OoD samples have higher variance
likelihood estimates under different independently trained models, [enn et al. consider learning a separate density model for potentially confounding background statistics.
8

---

Under review as a conference paper at ICLR 2020
Statistical tests for OoD detection OoD detection can be posed as hypothesis test where the null hypothesis assumes the data is OoD. One could also consider a more specific goodness-of of fit (GoF) test which determines whether dataset is drawn from specific distribution. Nalismick et al.
(2019) considers Kernelized Stein discrepancy (Chwialkowski et al. 2016 Liu et al. (016) and Maximum-mean discrepancy (Gretton et al. 2012) two GoF tests that scales to generative models. They propose to compare the empirical cross-entropy of the samples with entropy of the dataset, which is related the permutation test proposed in [Song et al. (017). Our permutation test can also be cast as a GoF test with r - 1, where all test samples in the same batch with training mode, but we can also provide individual OoD predictions via different values.
CONCLUSION
In this work, we revisit the i.i.d, assumptions in generative models trained with batch normalization, which results in an alternative interpretation to the training objective. The difference between the training objective and the evaluation objective explains the intriguing observation that likelihood estimates over OoD examples in training mode much lower than that in evaluation mode. This allows us to develop a permutation test based on batch normalization, with which we can reliably detect OoD examples even for difficult cases such Fashion MNIST KMNIST.
We argue that batch normalization is merely one approach to introducing non non-independence between observation variables in deep generative models. Neural processes (Garnelo et al. 2018), for example, considers generative models conditioned on certain observation contexts, which may differ significantly between regular and OoD batches. It would be interesting investigate if such models could be utilized for more reliable out-of-distribution detection methods for high- nigh-dimensional data.
REFERENCES
Dario Amodei and Jack Clark. Faulty reward functions in the wild, 2016.
Sylvain Arlot, Alain Celisse, et al. survey of cross-validation procedures for model selection. Statistics surveys, 4:40-79, 2010.
Barry C Amold and Press, S. James. Compatible conditional distributions. Journal of the American Statistical Association, 84(405))152-156 March 1989. ISSN 0162-1459, doi: 15.04499 1989. 10478750
Johannes Ballé, Valero Laparra, and Eero P Simoncelli. End-to-end optimized image compression. arXiv preprint arXiv: 161 1.01704, 2016.
Mare Bellemare, Sriram Srinivasan, Georg Ostrovski, Tom Schaul, David Saxton, and Remi Munos. Unifying Count-Based exploration and intrinsic motivation. In D D Lee, M Sugiyama, U Luxburg, I Guyon, and R Garnett (eds.), Advances in Neural Information Processing Systems 29, pp. 1471-1479. Curran Associates, Inc., 2016.
Julian Besag, Statistical analysis of non- lontlattice data. Journal of the Royal Statistical Society: Series D (The Statistician). 24(3):179-199 1975.
Raghavendra Chalapathy, Edward Toth, and Sanjay Chawla. Group anomaly detection using deep 04876, April 2018.
generative models. arXiv preprint
Hyunsun Choi, Eric Jang, and Alexander Alemi. WAIC, but why? generative ensembles for robust anomaly detection. arXiv preprint arXiv:18/0.01.399 October 2018.
Kacper Chwialkowski, Heiko Strathmann, and Arthur Gretton. A kernel test of goodness of fit. JMLR: Workshop and Conference Proceedings, 2016.
Corinna Cortes, Giulia DeSalvo, Claudio Gentile, Mehryar Mohri, and Scott Yang. Online learning with abstention. arXiv preprint arXiv: 0703 2017.
Terrance DeVries and Graham W Taylor. Learning confidence for coatt--Distributionn detection in neural networks. arXiv preprint arXiv: 1802.04888 February 2018

---

Under review as a conference paper at ICLR 2020
L Dinh, D Krueger, and Y Bengio. NICE: Non-linear independent components estimation, arXiv preprint arXiv:1410.8514 2014.
Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using real NVP. arXiv preprint arXiv:1605. 0r5.v:1605.08803, May 2016.
Justin Fu, John Co-Reyes, and Sergey Levine. Ex2: Exploration with exemplar models for deep reinforcement learning. In Advances in Neural Information Processing Systems, pp. 2577-2587, 2017.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty deep learning. In international conference on machine learning, pp. 1050-1059, 2016.
Marta Garnelo, Jonathan Schwarz, Dan Rosenbaum, Fabio Viola, Danilo J Rezende, S M Ali Eslami, and Yee Whye Teh. Neural processes. arXiv preprint arXiv:1807.01122,, July 2018.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXivv14122.. 112.6572, 2014.
Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bernhard Schölkopf, and Alexander Smola. kernel two-sample test. Journal of Machine Learning Research, 13(Mar):723-773 2012.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Weinberger. On calibration of modern neural networks. In Proceedings of the 34th International Conference on Machine Learning- Volume 70, pp. 1321-1330. JMLR. org, 2017.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and Out-of-Distribution examples in neural networks. arXiv preprint arXiv:1610.021166 October 2016.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint arXiv: 04666, December 2018.
Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. arXiv preprint arXiv:1502.03166 2015.
Diederik Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions.
arXiv preprint arXiv:1807 0000003039 July 2018.
Diederik Kingma and Max Welling. Auto-Encoding variational bayes. arXiv preprint
1312.61 14v11,1111100,, December 2013.
Mark Kliger and Shachar Fleishman. Novelty detection with gan. arXiv preprint arXiv: 1802.1050. 2018.
Jonas Kohler, Hadi Daneshmand, Aurelien Lucchi, Ming Zhou, Klaus Neymeyr, and Thomas Hofmann. Towards a theoretical understanding of batch normalization. arXiv preprint 1805 2018.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.
Volodymyr Kuleshov, Nathan Fenner, and Stefano Ermon. Accurate uncertainties for deep learning using calibrated regression. In International Conference on Machine Learning, 2018.
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. In Advances in Neural Information Processing Systems, pp. 6402-6413, 2017.
Dan Li, Dacheng Chen, Jonathan Goh, and See-kiong Ng. Anomaly detection with generative adversarial networks for multivariate time series. arXiv preprint 180. 2018.
Shiyu Liang. Yixuan Li, and R Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv preprint arXiv: 1706.02690 June 2017.
10

---

Under review as a conference paper at ICLR 2020
Qiang Liu, Jason Lee, and Michael Jordan. A kernelized stein discrepancy for goodness-of-th fit tests. In International conference on machine learning, pp. 276-284, 2016.
Stephen Marsland. Novelty detection in learning systems. Neural computing surveys, 3(2):157-195, 2003.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1773-177, 2017.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? arXiv preprint arXiv: 1VX.v:/8100099366 October 2018.
Eric Nalisnick, Akihiro Matsukawa, Yee whye Teh, and Balaji Lakshninarayanan. Detecting out-of-distriutiion inputs to deep generative models using test for typicality. arXiv preprint /rXiv:9906002994 2019.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 427-436, 2015.
Georg Ostrovski, Mare G Bellemare, Aäron van den Oord, and Rémi Munos. Count-based exploration with neural density models. In Proceedings of the 34th International Conference Machine Learning-Volue 70, pp. 2721-2730. JMLR. org, 2017.
Stanislav Pidhorskyi, Ranya Almohsen, and Gianfranco Doretto. Generative probabilistic novelty detection with adversarial autoencoders. In S Bengio, H Wallach, H Larochelle, K Grauman, N Cesa-Bianchi, and R Garnett (eds.), Advances in Neural Information Processing Systems 31, pp. 6822-6833, Curran Associates, Inc., 2018.
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark A DePristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribution detection. arXiv preprint arXiv:/9066 02845, 2019.
Tim Salimans, Andrej Karpathy, Xi Chen, and Diederik P Kingma. PixeICNN++: Improving the PixeICNN with discretized logistic mixture likelihood and other modifications. arXiv preprint 17X1v:1701.05517, January 2017.
Shibani Santurkar, Dimitris Tsipras, Andrew llyas, and Aleksander Madry. How does batch normal- ization help optimization? arXiv preprint arXi::1805.11604 May 2018.
Vít Škvára, Tomáš Pevný, and Václav Šmídl. Are generative deep models for novelty detection truly better? arXiv preprint arXiv:1807.0503: 2018
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. PixelDefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv: 1710.
1010. 10766, October 2017.
Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with generative models. In Advances in Neural Information Processing Systems, pp. 8312 8323, 2018
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.61991 2013.
Lucas Theis, Aäron van den Oord, and Matthias Bethge. A note on the evaluation of generative models. arXiv preprint arXiv:1511.0188 November 2015.
Rianne van den Berg, Leonard Hasenclever, Jakub M Tomezak, and Max Welling. Sylvester normalizing flows for variational inference. arXiv preprint arXiv: 1803. 056409664, March 2018.
11

---

Under review as a conference paper at ICLR 2020
Aaron den Oord, Nal Kalchbrenner, and Koray Kavukcuoglu. Pixel recurrent neural networks. arXiv preprint TrX.::1601006754 January 2016.
Apoorv Vyas, Nataraj Jammalamadaka, Xia Zhu, Dipankar Das, Bharat Kaul, and Theodore Willke. Out-of-distribution detection using ensemble of self supervised leave-out classifiers. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 550-564. openac-
cess.thecvf.com, 2018.
Halbert White. Maximum likelihood estimation of misspecified models. Econometrica: Journal of the Econometric Suciety, pp. 1-25, 1982.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mmist: novel image dataset for benchmarking machine learning algorithms. arXiv preprint arxiv: 2017.
Haowen Xu, Wenxiao Chen, Nengwen Zhao, Zeyan Li, Jiahao Bu, Zhihan Li, Ying Liu, Youjian Zhao, Dan Pei, Yang Feng, et al. Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications, In Proceedings of the 2018 World Wide Web Conference on World Wide Web, pp. 187-196. International World Wide Web Conferences Steering Committee, 2018.
12

---

Under review as a conference paper at ICLR 2020
A PROOFS
A.1 PROOF OF PROPOSITION
Proposition 1. Let b E N,b > be the batch size, and for all possible batch of samples of size 1), denoted as z-j, if [o(x;;x==)) the training objective over 32 for likelihood based generative model with batch normalization, then:
J (oollolazz3=))11 =
where we consider likelihood- generative models that sample either via some parametrized distribution (such as VAE and PixeICNN) or via parametrized invertible transformations constructed via affine coupling layers (such as RealNVP).
Proof. Note that in training mode, we can write down the batch norm function explicitly:
2 Eim1 Zi
ButchNorm(z,,,,.e
-7 3
Ei=1 (2: =)=12)2
if we fix z-i, B and then BatchNorm/ 7; 3.c. is a deterministic function over 2,.
The corresponding neural network (a(;;; x =;) is also deterministic function over æ; (given x_.).
We summarize likelihood-based generative models into two types:
In the first type, the neural network produces the parameters for a certain tractable distribu- tion, which used compute the likelihood (or its lower bound). This includes VAE and autoregressive models. Since the distribution over æ; is parametrized by the deterministic function ge, so the likelihood naturally normalized.
In the second type, RealNVP models are composed by affine coupling layers Dinh et al. 2014 which contains transformations (æx, y) + (æ', y/) where
x, y' s(x) y + t(x:)
where s(-) and ((-) are neural networks (potentially with batch normalization layers). This has the reverse
x ==z, y
(10)
Since BatchNorm is a deterministic function over 2; when z_, is fixed, the corresponding s(-) and t(-) functions also have the same property. Therefore, the corresponding RealNVP model over æ; with fixed æ_, is also invertible.
As ye deterministic function over a, the corresponding conditional likelihood is also normalized.
This completes the argument for likelihood-ban generative models.
A.2 PROOF OF PROPOSITION 2
Proposition 2. There exists a joint distribution (x) .2,.... ., xb) such that for all j. po( (zy) (x=)) lo x + co. Then, the objective for one butch {5. 1/ in training mode
Eerain C (155))=1100)
Σ (o(my(ar1))
Σ log po ( (z-
(3)
the pseudo-log wikeliooo for the joint distribution po(ar, .2, vbb) ) as b
13

---

Under review as a conference paper at ICLR 2020
Proof. We treat each sample in the batch separate random variable, and consider the correspond- ing graphical model where batch normalization is involved. Since training mode aggregates the statistics of all the samples, all the random variables connected to each other.
(z) First, we need to show that for large enough b, there exists a joint distribution (0( 22. Tbb
that is compatible with all the conditional distributions defined (Aroll & Press, S. James 1989).
From Theorem 4.1 in (Amold & Press, S. James 1989), we need to show that there exists a function such that
Po (o x-)) f(z
(11)
Po (1y ()-)) (x=
Let f(=-j) = Em, Exy; log (2 [x>+x] be the sum of conditional log- oigliikeihoodd of I under the expectation of some distribution over x,- For large enough b, the value of x; will not affect the batch
statisties, so f(x=-j) Σxzj log po [==x); so the condition for compatibility in Equation 11 holds, and there exists compatible joint distribution, which we denote as po (1 ;2,...;; (6).
Next, we verify the conditions under which the product of the conditional likelihoods is a pseudo- likelihood of (F1, .2..... z;). The conditional likelihood for any sample æ, is independent of -ー conditioned on its neighbors (which are a x-j),, so
Luain
log pe (x-)
J=1
is the lo-keliiooo objective (Besag. 1975 for {0z))=ı> which approximates the log- likelihood of the joint distribution.
L
B FOOLING LIKELIHOOD-BEL BASED PERMUTATION TESTS
As suggested by empirical evidence, we assume that model mis-specification always occurs and that our likelihood estimates cannot be used naively for detecting out-of-distribution samples due to the mode seeking nature of DKL. Under this assumption, likelihood-baase permutation tests may seems more effective than simple thresholding rules for detecting -ii-t-i-iittitttoonn samples, as treats both high-liks lighllikelihood and low- lowllikelihood samples as OoD. In this section, however, we show that likelihood- permutation test can also be easily fooled, making them infeasible for OoD detection in a straightforward manner.
We consider fooling a model po (ar) using samples generated from another model 46 (trained on another dataset), where we modify the "temperature" T of the generative model (Kingma & Dhariwal 2018) (see Appendix C.2 for details). Then we gather the likelihood estimates for samples p(æ) and (x) and obtain the area under the ROC curve (AUC) using Temm as prediction values to classify æ is OoD. We consider a RealNVP (Dinh et al., 2016) model trained on CIFAR and a PixeICNN+ (Salimans al.] 2017) model trained on Fashion MNIST. We use RealNVP trained on SVHN, and a PixeICNN+ ++ trained on MNIST to fool the two po (2:) models respectively. For RealNVP set T 1.10 and for PixeICNN+ set T 1.17.
In Figure we show that it is possible to produce a distribution (x(x)) with generative models such that its likelihood distribution evaluated by pe lies around the median likelihood in p(æ)). This results in low AUC and thereby confusing the test based on Tpem- We show some out-of-distribution sample with similar bits-pert per-ddeenn (BPD) to training samples in Figure where the generated samples look drastically different from training samples visually, even though they have similar log- likelihoods. We note that flipping the classifier predictions (i.e. using -Tpmm) will not address this issue, since we would then treat low likelihood samples more likely to be in-distribution.
C ADDITIONAL EXPERIMENTAL DETAILS
C.I MODEL ARCHITECTURES
For RealNVP Diih et al. 2016). consider downscale once, with residual blocks for each affine coupling layer and 32 channels for each convolutional layer, except for CIFAR where we have residual blocks with 64 channels for each convolutional layer.
14

---

Under review as a conference paper at ICLR 2020
ROC Curves for RealNVP (CIFAR)
ROC Curves for PixelCNN++ (Fashion MNIST)
1.0
1.0
True Positive Rate
0.8
0.8
0.6
0.4
0.4
0.2
AUCH0,250
0.2
0.0
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
False Positive Rate
False Positive Rate
Figure 4: ROC curves for using the p-values for likelihood based permutation tests. We assign positive labels samples in ((x) and negative labels to samples in p(z). While such tests detect OoD samples from other datasets, they could confused by samples from another generative model.
CIFAR samples
ReaiNVP samples (SVHN, 1.10)
3.932
3.500
3.525
Fashion MNIST test samples
PixeICNN+ samples (MNIST, T 1.17)
Figure 5: Samples and their BPD evaluated under (= (Top) (a)) is RealNVP trained on CIFAR. (Bottom) (a(x) a PixelCNN+ trained on Fashion MNIST.
For VAE (Kingma & Welling 2013 van den Berg et 2018), our inference network has convolu- tional layers followed by fully connected layer, and the generator network has 8 deconvolutional layers. We add batch normalization all the convolutional layers and deconvolutional layers, except for the last two deconvolutional layers. We detail the convolutional layer hyperparameters in Table 3
Table 3:
Architecture for VAE convolutional layers. & denotes image width divided by 4, denotes the number of channels of the image (1 for gray, 3 for colored).
Inference network
Layer
Channels
Kernel
Stride
Padding
32c
5
I
2
2
32c
5
2
2
3
32c
5
1
2
4
64c
5
2
2
5
64c
5
1
2
6
256
k
I
0
Generator network
Layer
Channels
Kernl
Stride
Padding
64c
5
1
2
2
64c
5
2
2
3
64c
5
I
2
32c
5
2
2
5
32c
5
I
2
6
32c
5
1
2
7
256
5
1
2
8
256c
1
0
For PixcICNN++, made two simple modifications to default hyperparameters (Salimans et al.) 2017). We reduce the number of filters in each ResNet block from 160 to 80, and we use batch normalization after convolution opposed to adding weight normalization over convolution.
15

---

Under review as a conference paper at ICLR 2020
All the models are trained with default optimizer hyperparameters with batch size of 64. We use batch size of 64 also in evaluation mode.
C.2 EXPERIMENTAL PROCEDURES FOR SECTION
We consider controlling the entropy of the generated samples by controlling temperature hy- perparameter T. In RealNVP, this is realized by multiplying the latent variable by factor of T. which is equivalent sampling from A/ I)). PixeICNN++, this is realized by dividing each pre-softmax scalar output by T; larger T values would lead to higher entropy samples.
C.3 LIKELIHOOD DIFFERENCES BETWEEN TRAINING MODE AND TESTING MODE ON GENERATED DATA
We consider measuring the likelihood differences between training mode and testing mode using RealNVP trained on CIFAR. The samples are generated from a RealNVP trained on SVHN, with several temperatures T E (0.7, 1.0, 1.3). Similar to the observation with SVHN samples, there is large gap between training mode and evaluation mode evaluations.
Table 4: Log-likelihood (measured in bits per dimension) calculated with a RealNVP trained on CIFAR and evaluated on generated samples from a RealNVP trained SVHN. We report likelihood results with training mode, evaluation mode, and their difference (A).
Dataset
Mode
BPD
A
evaluation
3.48
CIFAR
0.03
training
3.51
evaluation training
2.44
SVHN
8.56
11.10
evaluation
2.88
ReaINVP (SVHN, T 1.0)
325
training
328
evaluation
1.51
RealNVP (SVHN, T = 0.7)
315
training
317
evaluation
5.43
RealNVP (SVHN, T 1.3)
10.57
training
16.0
C.4 OUT-OF--ISTTIIUTTIO DETECTION WITH ALTERNATIVE VALUES OF ri AND 12
We include additional results with alternative values of and 72. If our method is able to achieve high performance with small 72, this suggests that we can detect the OoD examples realiably even as they occupy small portion within the batch. We consider 71 0 (which is evaluation mode) and r2 E {0.15, 0.3, 0.5, 0.9); we show our results in Table
C.5 HISTOGRAMS OF L.OG-LIKELJHHODS
We further show the histograms of ligeliils of several test datasets when the model RealNVP trained on CIFAR-10 datasets in Figure 6 the mean BPD is computed with evaluation mode.
D DETAILS FOR THE DERIVATION IN SECTION 4. 4.2.1
Suppose we try to learn some distribution p(z) with 2-d flow model with one coupling layer Dinh
et al. 2016): f (æ1, x2) + (21,22) where
21 = .i
(12)
22 D2 + (x1 E(a.))/
(13)
16

---

Under review as a conference paper at ICLR 2020
Table Out-of-distrrbutioo classification evaluated with AUC (left) and Average Precision (right). Rotation denotes (α)) uses images in p(æ) yet randomly rotate each image by (90, 270) degrees.
p(x)
Model
((x)
12 = 0.15
0.3
= 0.5
122 = 0.9
Rotation
0.93 0.95
0.91 / 00.94
0.98
0.99
0.99 / 0.99
Fashion
MNIST
0.92 0.93
1.00 1.00
1.00/ 1.00
1.00 1.00
RealNVP
MNIST
Omniglot
0.96 / 0.97
0,95 / 0.96
1.00/ 1.00
1.00 / 1.00
KMNIST
0.86 0.88
1.00 1.00
1.00 1.00
1.00 1.00
Rotation
0.88 / 0.91
0.94 70995
0.94 /0995
0.97 0.98
Fashion MNIST
MNIST
0.86 0.88
0.99 /
0.66
1.00 / 1.00
VAE
Omniglot
0.93 / 0.95
0,98 / 0.99
0.90/0.88
1.00 / 1.00
KMNIST
0.85 0.88
0.99 0.99
/
1.00 1.00
Rotation
1.00 1.00 1.00
1.00 1.00
1.00/..00
1.00 1.00
SVHN
0.92 / 0.90
1.00 1.00
1.00
1.00 / 1.00
CIFAR
RealNVP
ImageNet
0.74 / 0.72
0,92 0.90
0.98 0.98
0.98 0.97
LSUN
0.77 / 0.75
0.98 / 0.97
1.00/1.00
0.99/ 0.98
Rotation
0.87 0.83
0.97 /..9
7.99
0.99 0.99
SVHN
0.76 0.72
0,95 0.922
1.00/
0.99 0.99
CIFAR
PixcICN++
ImageNet
0.62 0.58
0.74 0.70
0.87 0.885
0.89 0.87
LSUN
0.72 / 0.69
0.80 / 0.75
0.98 0.98
0.98 0.97
1.0
CIFAR1D SVHN LSUN
CIFARIO
0.8-
10.0
SVHN
Density
TinylmageNee
7.5
TinylmageNer
0.4
0.2
2.5
0.0
2.5
3.0
3.5
4.0
(a) BPD of individual images.
(b) Mean BPD of batch of images.
Figure 6: Histograms of BPD of test datasets on a RealNVP dataset trained on CIFAR-10.
with learnable parameters 7, B; E(z1), (211 are the empirical mean and variance of batch of ø1 in training mode, and the mean and variance of p(z1) in evaluation mode.
We assume the distribution p(z1) to be even mixture of two Gaussians (N(-1, o²) and N(1, o²) with a + 0, so it concentrates around -1 and 1), and p(x22) = (0(x)) (æ2 concentrates at zero), so 22 ~ (x) - E(x) /)/ (V(zi) +
The Jacobian of is:
0f(x)
1
J
/// (Vv)))))
(14)
da:
so its determinant is one. The likelihood of the flow model is simply
(f(11, =(((<
(x))
We assume the prior p(a1, #2) is standard Gaussian N'0 /). Therefore, we have:
p ( (p(x)) (((m) E(z,))/ VV())) . +
(15)
where (ox) is the probability density function for the standard Gaussian distribution. Note that 7,8 only depends the second term. The maximum likelihood solution for B 0 (due to symmetry); for y, we can treat p(æ,) as two point distributions at -1 and 1, so we have the optimal y arg min, =2/ 9/2 log s 1. Moreover, [x]] O and Var,(z1] xs
17

---

Under review as a conference paper at ICLR 2020
For ((21, in evaluation mode, we have
Ep Sploog7 py (11, x2)] = Ep (allogg(zz)) + log (((11 E(xi))/ V(zi))/VV(zI)
(16)
Epllog + log ((x)) -284.
(17)
For X2) in evaluation mode, we have
(2), = By llg (0(1) + log (0))) )] ~ 11.2..
(18)
For (22 in training mode, ((x)) 0, ((zi) 12,
12, so we have:
Bgg Po (x1, x2)] = F,, log (m)) + log ( (1122) )] ~ 2.38..
(19)
18


Reviews:
[{"review_id": "rylGjLzaKB", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper attempts to address the problem of out-of-distribution detection with generative models. To do this they assume they are given batches of OOD examples or batches of in-distribution examples, and they detect whether the batch is in- or out-of-distribution. Normally we try to detect if an example is in- or out-of-distribution.\nUnfortunately, this is not an interesting assumption and makes the problem significantly easier. If we assume this, then averaging the anomaly scores of multi-class OOD detectors would result in performance near the ceiling.\nIt is not surprising that one can obtain a much better OOD detector given a batch of OOD samples. Hence they're making progress on a problem we have the community has not been interested in, and they are not making progress on the standard OOD detection problem.\n\nSmall notes:\n\n> given their successful generalizing on a test dataset.\nWhat does this mean? Does this mean their BPP is good? By what standard?\n\n> unerlying\nunderlying\n\n> CIFAR\nInclude CIFAR-10 vs CIFAR-100 results in the table.\n", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "SyxETFqe9H", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper makes the observation that likelihood models trained with batch norm assign much lower likelihoods to \"training batches\" of OoD data (batch norm statistics computed over over minibatch) than evaluation batches of OoD data (batch norm statistics over entire training set).\n\nOne issue with comparing this method to most other OoD detection works is that it considers OoD detection on *batches* of (all OoD data) or (all in-distribution data). As soon as the problem is changed to \"classify between OoD batches\" and not single samples, there are a large number of possible statistical tests one can perform to perform OoD (T-test between likelihoods of each batch) and the problem becomes *much* easier. In some ways, this makes things more well-defined (hard to compare distributions when one of them is just a single sample from an arbitrary distribution). \n\nHowever, that brings me to a big concern I have with the evaluation protocol. The batch size used for train/evaluation is rather large (64, this detail is hidden in the Appendix and I would have appreciated the number put in the main experiments section). If you take a likelihood model and evaluate on 64 samples from SVHN, you are all but guaranteed to sample a sample with *exceedingly* low likelihood, which dominates the mean statistic, making it possible to separate SVHN batch from CIFAR10 batches. I suspect that OoD datasets have plenty of these \"extremely low likelihood\" examples that will drag the mean likelihood down a lot.\n\nThis is consistent with your batch normalization experiments: in training mode, the likelihood is computed from mean activations over a batch of OoD samples, several of which probably contribute to the low likelihoods. In evaluation mode, likelihoods for each OoD sample are evaluated independently, which results in a similar observation to prior work showing that CIFAR10 likelihoods are inaccurate for SVHN. In other words, I think there is a mistake made here: it is the phenomenon that *batch likelihoods*, not *batch norm*, that is responsible for this method working well. One experiment that is missing from your paper (and would prove my hypothesis wrong) would be if you adapted the OoD criteria to compare the *mean* likelihoods in the evaluation mode, and show that for OoD datasets, the difference between batches still remains small.  \n\nNits:\n- \"...such as learning a mixture of Gaussians\", I believe this toy example was on univariate gaussians, not mixtures.\n- Choi et al. 2018 and should also be included in the citation that \"CIFAR10 gives higher likelihood estimates to SVHN than CIFAR10 ones\" (this was a concurrent discovery between the two papers)\n- Choi et al. 2018 is not the right citation for \"we evaluate the area under the ROC curve (AUC) and average precision (AP)\" for each binary classification task, a more appropriate one would be Hendryks and Gimpel 2017.\n- No doubt the authors realized already but Page 7 has some \"related work still needs some work, but there....\" which should be deleted.\n- It took me awhile to find the batch size used in training and evaluation mode (64), which was on page 16.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "HylnIU9AYr", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper tackles the out of distribution detection problem and utilizes the property that the calculation of batch-normalization is different between training and testing for detecting out-of-distribution data with generative models. The paper first empirically demonstrates that the likelihood of out-of-distribution data has a larger difference between training mode and testing mode, then provides a possible theoretical explanation for the phenomenon. The proposed scoring function utilizes such likelihood differences in a permutation test for detecting out-of-distribution data. The evaluation is performed on two small in-distribution image datasets and four out-of-distribution datasets with three types of generative models.\n\nWe recommend a weak accept. Its clarity is good, and the strength of the paper has three parts. The first is the thorough observation of the likelihood changes between different modes of batch-normalization. Second, the theoretical explanation for the observed phenomenon is sound. The example in Figure 2 gives a good intuition of how mis-specification can happen. The last is the strong performance on the out-of-distribution detection with generative models.\n\nHowever, I have some concerns about the design of the scoring function (Section 5), which looks like it is carefully tuned:\n1. Why do the authors use the permutation score ($T_{b,r1,r2}$) instead of likelihood difference ($\\delta_{b,r1,r2}$)? The likelihood difference itself seems like it could be a good indication for OoD detection.\n2. Why do the authors use interpolation between training and evaluation? It introduces extra hyperparameters (r1, r2) for the method. Is the performance sensitive to the choice of r1 and r2?\n\nOne minor issue:\n3. The sentence at the bottom of page 7 should be removed (\"related work still needs some work, but there seems to be some bug on overleaf right now\")\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors observe that batch normalization using the statistics computed from a *test* batch significantly improves out-of-distribution detection with generative models.  Essentially, normalizing an OOD test batch using the test batch statistics decreases the likelihood of that batch and thus improves detection of OOD examples.  The reviewers seemed concerned with this setting and they felt that it gives a significant advantage over existing methods since they typically deal with single test example.  The reviewers thus wanted empirical comparisons to methods designed for this setting, i.e. traditional statistical tests for comparing distributions.  Despite some positive discussion, this paper unfortunately falls below the bar for acceptance.  The authors added significant experiments and hopefully adding these and additional analysis providing some insight into how the batchnorm is helping would make for a stronger submission to a future conference.
Decision: Reject